HIPAA covered entities (CEs) longing for the opportunity to dispense with what some would call the more nettlesome aspects of notices of privacy practices (NPPs) will just have to be patient. For how long, no one is saying. But the HHS Office for Civil Rights (OCR) has put finalizing these and other changes to the Privacy Rule—proposed in 2021 after more than five years in development—on the back burner.
The delay also means families who begged OCR to revise the rule to allow better access to health information about their loved ones, particularly those with serious mental illness, will have to keep waiting.[1]
Expanding protections for reproductive health information, as detailed in a new proposed rule, and harmonizing safeguards for substance use disorder records with HIPAA requirements, are OCR’s regulatory priorities now. And, like the rest of the federal government, OCR also will be grappling with the end of the COVID-19 public health emergency.
The agency formally began the process of revising the Privacy Rule in December 2018 under then-Director Roger Severino, with the publication of a request for information.[2] A proposed rule followed on Jan. 21, 2021, the day after President Joe Biden was inaugurated. Drafted by the Trump administration, publication under Biden was seen as a tacit endorsement of the proposed rule.[3]
When asked for updates on when a final rule might be published, Lisa Pino, who served as OCR head prior to the appointment of Melanie Fontes Rainer in September, said in February 2022 that staff was analyzing comments from 1,400 individuals and organizations. It remains to be seen if the final rule, when it emerges, is like the proposed rule or reflects Biden’s take.
The proposed rule addressed a range of topics, many more than the typical rule—problems OCR officials said at the time were long-standing. As the federal rulemaking website reginfo.gov describes, it “will address proposals to modify the HIPAA Privacy Rule to strengthen individuals’ rights to access their own protected health information [PHI], including electronic information; improve information sharing for care coordination and case management for individuals; facilitate greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; address disclosures in emergency or threatening circumstances; and reduce administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.”[4]
