HHS proposes modifications to HIPAA privacy rule

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) on Monday unveled proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to support individuals’ engagement in their care, remove barriers to coordinated care, and reduce regulatory burdens on the health care industry.

According to a news release, the changes seek to support patients’ engagement in their care, remove barriers to coordinated care, and reduce regulatory burden as part of HHS’ Regulatory Sprint to Coordinated Care.

The Notice of Proposed Rulemaking (NPRM) is part of HHS’s Regulatory Sprint to Coordinated Care, initiated under HHS Secretary Alex Azar’s value-based transformation agenda and led by HHS Deputy Secretary Eric Hargan, which seeks to promote value-based health care by examining federal regulations that impede efforts among health care providers and health plans to better coordinate care for patients.

The proposed changes to the HIPAA Privacy Rule include strengthening individuals’ rights to access their own health information, including electronic information; improving information sharing for care coordination and case management for individuals; facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhancing flexibilities for disclosures in emergency or threatening circumstances, such as the Opioid and COVID-19 public health emergencies; and reducing administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.

“Our proposed changes to the HIPAA Privacy Rule will break down barriers that have stood in the way of commonsense care coordination and value-based arrangements for far too long,” said HHS Secretary Alex Azar, in a statement. “As part of our broader efforts to reform regulations that impede care coordination, these proposed reforms will reduce burdens on providers and empower patients and their families to secure better health.”

In a statement, Hargan noted that the announcement is a continuation of the department’s ongoing work under his Regulatory Sprint to Coordinated Care to eliminate unnecessary regulatory barriers blocking patients from getting better care.

“These proposed changes reduce burden on providers and support new ways for them to innovate and coordinate care on behalf of patients, while ensuring that we uphold HIPAA’s promise of privacy and security,” he added.

OCR Director Roger Severino pointed out that “the proposed changes to the HIPAA Privacy Rule will promote truly coordinated, value-based health care for all.”

OCR encourages comments from all stakeholders, including patients and their families, HIPAA covered entities (health plans, health care clearinghouses, and most health care providers) and their business associates, consumer advocates, health care professional associations, health information management professionals, health information technology vendors, and government entities.

Public comments on the NPRM will be due 60 days after publication of the NPRM in the Federal Register. The NPRM may be viewed or downloaded from HHS’s website at https://www.hhs.gov/sites/default/files/hhs-ocr-hipaa-nprm.pdf - PDF.