A new bipartisan bill recently introduced in Congress has the potential to put the House and Senate on track to craft legislation that would accomplish a long overdue task: modernizing HIPAA, which includes regulations that are now 25 years old.

The primary focus of S. 3620, introduced by Sens. Bill Cassidy, R-La., a physician, and Tammy Baldwin, D-Wis., is the creation of a commission to deliver a report on how HIPAA should be updated—and quickly. The report would be due within six months of members being appointed.^[1]

But the breadth of issues the 17-member panel is assigned to address could lead to a comprehensive overhaul, in addition to presenting a snapshot of strengths—and flaws—of privacy and security protections as they exist today. For example, despite pleas from advocates two decades ago at the inception of the privacy rule, the HHS Office for Civil Rights (OCR) has never undertaken an educational campaign for the public about how HIPAA works—and as a result, literally hundreds of thousands of aggrieved patients and family members over the decades have submitted complaints to OCR over which it has no jurisdiction.

Based on the most recent data available, 75% of the approximately 27,000 complaints OCR received in 2020 were “resolved” during “review and intake,” and were not investigated for reasons such as they were received too late or that HIPAA didn’t apply.^[2] Complaints must be filed within 180 days of knowing of a possible violation.

The bill, according to Cassidy and Baldwin, stems from the concern that protected health information is increasingly shared by non-HIPAA covered entities or business associates. S. 3620 would “begin the process of modernizing our outdated health privacy laws and regulations.”