In proposed changes to the HIPAA Privacy Rule,^[1] the HHS Office for Civil Rights (OCR) conveys there is very little that should come between patients and their protected health information (PHI). The proposed rule, which was announced Dec. 10, focuses on patient access and puts to rest the troublesome issues around direct patient requests for records versus third-party requests. OCR also tweaks the content of the notice of privacy practices (NPPs) and frees covered entities (CEs) from getting patient signatures on them.

“Under the right of access, providers would have to respond faster and for a lower cost, and that may be burdensome,” said Richelle Marting, an attorney in Olathe, Kansas. “It is not a minor burden to retrain the release of information department and reconfigure your workflows.” From the consumer rights perspective, however, “it’s a positive change.” For that reason, she doubts the final version will be withdrawn by the new administration or substantially revamped. Provisions also address care coordination, disclosures to avert a threat to health or safety when harm is “serious and reasonably foreseeable,” and other areas.

The impetus for the rule was twofold, Marting said: (1) OCR’s 2018 Request for Information on Modifying HIPAA Rules to Improve Coordinated Care (RFI)^[2] and (2) a federal court decision in Ciox Health, LLC vs. Azar, et al.,^[3] which voided part of OCR’s 2016 guidance, Individuals’ Right under HIPAA to Access their Health Information.

The Privacy Rule establishes the rights of individuals in terms of their PHI, including their right to access (i.e., to inspect and obtain a copy of) medical and other records. CEs and business associates (BAs) operating on their behalf may charge patients a reasonable, cost-based fee, known as the patient rate, for a copy. According to the 2016 OCR guidance, the fee is limited to the cost of supplies, postage and labor. The guidance said the patient rate applies even when patients send third parties, such as attorneys and life insurance companies, to retrieve their PHI, but CEs and BAs could charge more than the patient rate for records when requests come directly from third parties.