HHS Releases Comments to Proposed HIPAA Privacy Rule

On June 24, 2021, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) published comments that it received during the public comment period for the proposed modifications to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. OCR first announced the proposed rule-making in December 2020. While the proposal was not technically subject to the “regulatory freeze” by the Biden administration, it was effectively delayed because OCR extended the public comment period through May 2021.

The proposed changes to HIPAA are part of the larger transition to a value-based health care system in which providers are compensated based on patient health outcomes. The modifications propose to address standards that may impede the transition to a value-based health care system and other unnecessary burdens by increasing individuals’ rights to access their health information, enhancing information sharing for care coordination and case management, improving family and caregiver involvement for individuals experiencing health emergencies, reducing the administrative burden on HIPAA-covered providers, and facilitating the disclosure of certain health information during emergencies such as the opioid crisis and COVID-19 pandemic.

Some of the major changes to the Privacy Rule include:

-Defining electronic health records (EHR) and personal health application.

-Modifying rules concerning an individuals’ right of access to their PHI.

-Amending the definition of health care operations to broaden the permitted use and disclosure of PHI for care coordination and case management.

-Creating an exception for “minimum necessary” standard for the purpose of care coordination and case management.

-Clarification of the rules covering the ability to disclose PHI to social service agencies, community-based organizations, home and community-based services (HCBS) providers, and other organizations providing health related services.

-Replacing the “professional judgment” standard for permissible uses and disclosures with a good faith standard.

-Eliminating the requirement to obtain an acknowledgment of receipt of a direct treatment provider’s Notice of Privacy Practices (NPP).

-Modifying the required contents of a NPP to clarify the rights of individuals as it relates to their PHI and exercising those rights.

-Express permission to disclose PHI through Telecommunications Relay Services (TRS).

OCR received approximately 1,400 comments to the proposed rule-making. Some commenters were generally positive regarding the proposals, especially parties involved in mental health treatment who expressed support with removing barriers to family and caregivers’ access to information. Other commenters expressed concern that the proposed changes would create further administrative costs for providers. However, given the recent focus by HHS on promoting value-based care and patient access, it is likely that the final rule will closely resemble this proposal.

For over 35 years, Wachler & Associates has represented healthcare providers and suppliers nationwide in a variety of health law matters, and our attorneys can assist providers and suppliers in understanding new and proposed regulations. If you or your healthcare entity has any questions pertaining to healthcare compliance, please contact an experienced healthcare attorney  at 248-544-0888 or wapc@wachler.com