More Time for Filing Comments on Proposed HIPAA Changes

The U.S. Department of Health and Human Services (HHS) recently announced a 45-day extension of the comment period for proposed changes to the HIPAA Privacy Rule. The deadline for submitting comments now has been pushed from March 22, 2021, to May 6, 2021.

If adopted, the changes would impact many aspects of HIPAA compliance. We urge covered entities and business associates to submit comments for HHS's consideration. For more information on the proposed rule, click here for our prior summary that includes a PDF guide on subsections/topics and comments.

The announced extension was due to an anticipated "high degree of public interest in providing input on the proposals because the HIPAA Privacy Rule affects nearly anyone who interacts with the health care system," according to Acting OCR Director Robinsue Frohboese, quoted in the March 9, 2021, press release extending the comment period.

Proposed Changes to the HIPAA Privacy Rule

The proposed changes to the HIPAA Privacy Rule were published in December 2020 and, if adopted, would include the following:

• Changing and tightening the individual right of access requirements, including reducing response time, limiting the right to have a copy of PHI sent to a third party to only apply to electronic copies in an electronic health record (as provided in the Ciox Health decision), and imposing obligations on covered entities to request access on behalf of an individual;
• Clarifying information sharing for care coordination and case management for individuals;
• Changing the threshold for disclosures to avert or lessen emergency or threatening situations from "serious and imminent" threats to "serious and reasonably foreseeable" threats;
• Eliminating the requirement that individuals acknowledge in writing receiving the notice of privacy practices and changing the content requirements for the notice; and
• Replacing the "professional judgment" standard with a "good faith belief" standard that permits covered entities to make certain uses and disclosures of PHI if the covered entity "in good faith" believes the uses and disclosures are in the best interests of the individuals.

The complete notice of proposed rulemaking can be viewed here as published in the Federal Register.