HHS Proposes Changes to the HIPAA Privacy Rule

On December 10, 2020, the U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR") issued a Notice of Proposed Rulemaking ("NPRM") proposing some significant changes to the Health Insurance Portability and Accountability Act ("HIPAA") Privacy Rule.  The proposed changes, if adopted, would provide individuals with greater access to their health information and improve information sharing for care coordination and case management for individuals. 

 While there are various proposed amendments, the more significant changes include: 

• Modifying individuals' rights to access their protected health information ("PHI"), including, with respect to the timing, form and method for providing access;
• Adjusting the rules governing the fees charged for in-person, internet-based and other access to PHI;
• Clarifying rules surrounding care coordination and case management, including addressing individual-level care coordination and case management and allowing disclosures to social services agencies, community-based organizations, and others;
• Revising the requirements for Notice of Privacy Practices, including eliminating the signature requirement;
• Expanding the ability to disclose PHI to avert a threat to health or safety when harm is "serious and reasonably foreseeable" instead of a "serious and imminent" threat to health or safety; 
• Permitting disclosures to Telecommunication Relay Services ("TRS") communication assistants, while excluding TRS providers from the business associate definition; and 
• Expanding the scope of the Armed Forces authorization to use or disclose PHI. 

OCR is accepting public comment for 60 days after publication in the Federal Register. Covered entities, business associates, and other stakeholders should review the NPRM to determine the extent to which the changes would affect their existing policies and operations and consider whether to submit comments on the proposed rules.