According to the Office of Information and Regulatory Affairs, Office of Management and Budget, final action on the proposed rules—published in the Federal Register—to modify the HIPAA Privacy Rule is scheduled to occur in March 2023.[1] Compliance professionals may want to take advantage of the lead time to prepare for possible changes to the Privacy Rule before the final rules are published in the Federal Register and, in particular, designated privacy officials responsible for developing and implementing policies with respect to the Privacy Rule. This lead time can allow privacy officials to take important steps to help transition their organizations from their current state of compliance with the Privacy Rule to the future state of compliance with the new requirements.
Even though we will not know precisely the specific changes to the Privacy Rule until the final rule is published in the Federal Register, the Notice of Proposed Rulemaking issued in January 2021 provides a useful perspective on what changes we may expect to see in the final rule.[2] This advance notice can provide a convenient and manageable time frame for individuals to assess and develop processes and workflows without the high pressure of working under a short timeline.
With respect to time, it is imperative that privacy officials also know that whenever the final rule is published, covered entities will have 240 days after the publication of the final rule before enforcement begins. Despite that, starting preparation as soon as possible provides more time to address the challenges we will face once the final rule takes effect. And although the government agency has yet to publish the final rule, such uncertainty should not be used as an excuse to do nothing, and covered entities should take preparatory actions early since previously proposed HIPAA rules often closely resemble the finalized ones with minor or no revisions. To help privacy officials plan and prepare for the upcoming changes, the following steps are provided for fellow compliance professionals’ consideration.
Identify the possible future state
To begin preparation, it is vital to first review the proposed changes to the HIPAA Privacy Rule and identify the gaps between the proposed rules and your current processes, policies, and practices. The January 21, 2021, Federal Register and the notice of proposed rulemaking detailed the specific changes that will come our way.[3] To help navigate through the different sections describing the proposed rules, there is a table of contents on the first page, which is organized into five main sections. The third section, titled “III. Need for the Proposed Rule and Proposed Modifications,” outlines detailed revisions that are expected to be finalized in March 2023.
Interestingly, one can make an anecdotal conclusion on which of the sections of the Privacy Rule may be affected most significantly. Using this approach, the section dealing with an individual’s access to protected health information (PHI) is the most extensive section where proposed changes appear in the Notice of Proposed Rulemaking (NPRM). When considering the ongoing focus and communications by the U.S. Department of Health & Human Services Office for Civil Rights (OCR) on the importance of providing an individual with access to PHI maintained in a designated record set, it is likely that this is also the section within the Privacy Rule that will be affected the most by the proposed changes listed in the notice of proposed rulemaking.
Second, become familiar with the changes in the NPRM; take advantage of the fact sheet related to the proposed rules, which OCR posted on December 10, 2020.[4] This six-page document is a summary of the proposed changes listed in the NPRM. The fact sheet also makes it easier to cross-reference the summary of proposed changes to the more detailed content of the proposed changes that appear in the Federal Register. This is also a good reason why having both documents—the Federal Register and fact sheet—can be instrumental in developing a comprehensive and detailed understanding of the proposed changes.
