HHS Extends Comment Period for HIPAA Privacy Rule Changes

The Department of Health and Human Services Office for Civil Rights announced it has extended the comment period for proposed changes to the HIPAA Privacy Rule. Proposed in December 2020, the changes are designed to improve patients’ right of access and boost care coordination.

The 45-day extension comes in response to the high degree of public interest. The comment period for the proposed amendments has been pushed from March 22 to May 6, 2021.

“OCR anticipates a high degree of public interest in providing input on the proposals because the HIPAA Privacy Rule affects nearly anyone who interacts with the healthcare system,” said Acting OCR Director Robinsue Frohboese, in a statement.

“The 45-day extension of the comment period to May 6, 2021, will give the public a full opportunity to consider the proposals and submit comments to inform future policy,” she added.

The HHS proposal includes strengthening a patient’s right to access their own health records and supports the agency's Right of Access Initiative, a key priority for the agency over the last year.

More than a dozen enforcement actions have been enacted against providers failing to comply with the rule since the initiative was launched in 2019. While there’s been improvement among providers in this key area, stakeholders have stressed there is much room for improvement when it comes to compliance.

HHS has proposed direct changes to HIPAA that are meant to address these issues. The proposed changes would amend these rights, allowing for patients to take notes or use other resources to view and capture images of their PHI.

It would also reduce the amount of time providers are given to respond to access requests, from its current 30-day period to just 15 calendar days. The proposal would allow for extension requests for no more than an additional 15 calendar days.

The Right of Access changes also include clarifying the form and format required by providers when responding to PHI requests. HHS has also proposed requiring covered entities to inform patients that they retain the right to obtain or direct copies of their PHI to a third party, “when a summary is offered in lieu of a copy.”

HHS also proposed reducing identity verification for individuals exercising PHI access rights, as well as a pathway to directly share PHI from the EHR among covered healthcare providers and health plans.

The agency has also suggested modifications to HIPAA that would better facilitate caregiver and family involvement for those patients facing health crises or emergencies. The proposed changes would also allow for more flexibility in disclosures made during an emergency or in threatening situations, including those tied to COVID-19 or opioid abuse.

The proposal is meant to reduce administrative burdens on HIPAA-covered entities and health plans, in addition to strengthening privacy protections around patients’ protected health information.

In particular, HHS has proposed adding definitions for the terms electronic health records and personal health applications.

Lastly, HHS proposes “replacing the privacy standard that permits covered entities to make certain uses and disclosures of PHI based on their ‘professional judgment’ with a standard permitting such uses or disclosures based on a covered entity’s good faith belief that the use or disclosure is in the best interests of the individual.”

The goal is to provide covered entities and relevant business associates with needed support for innovating and coordinating care on behalf of patients. Overall, HHS is hoping to leverage direct changes to the HIPAA rule to continue empowering patients, while reducing the burden on providers.

The proposed changes can be reviewed on the Federal Register. All industry stakeholders are encouraged to provide feedback on the rule directly to HHS by May 6.