Updated on 02/16/2021

On January 21, 2021 the Office of Civil Rights (OCR) of the Department of Health & Human Services (HHS) issued proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to support individuals’ engagement in their care, remove barriers to coordinated care, and reduce regulatory burdens on the health care industry.

Several of the key proposals include:

  • Incorporates definitions into the Privacy Rule that are necessary to implement key privacy provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act, such as definitions for electronic health record and personal health application.
  • Strengthening the right to inspect and obtain copies of protected health information (PHI).
  • Creating a pathway for individuals to direct the sharing of an electronic copy of PHI in an EHR among covered health care providers and health plans.
  • Limits the individual right to access to direct the transmission of PHI to a third party to electronic copies of PHI in a EHR.
  • Proposals to adjust and clarify the fees that covered entities may charge for copies of PHI.
  • Require covered entities to provide advance notice of approximate fees for copies of PHI requested under the access right and with an individual’s valid authorization.
  • Require covered entities to post a fee schedule online (if they have a website) and make the fee schedule available to individuals at the point of service, upon an individual’s request.
  • Prohibit a covered entity from imposing an unreasonable identity verification requirement on an individual attempting to exercise the right of access, and includes examples of such measures.
  • Modify the regulations to require that access be provided “as soon as practicable,” but in no case later than 15 calendar days, rather than 30 days as currently required, after receipt of the request, with the possibility of one 15 calendar-day extension.
  • Require covered entities to establish written policies for prioritizing urgent or other high priority access requests (especially those related to health and safety) so as to limit the need to use 15 calendar-day extensions for such requests.
  • When covered entities offer to provide or direct a summary of PHI in lieu of requested copies, they must inform individuals that they retain the right to obtain or direct the requested copies if they do not agree with the offered summary.
  • Proposals to eliminate the requirements for a covered health care provider with a direct treatment relationship to an individual to obtain a written acknowledgment of receipt of the NPP and, if unable to obtain the written acknowledgment, to document their good faith efforts and the reason for not obtaining the acknowledgment. The proposal also would remove the current requirement to retain copies of such documentation for six years.

Comments on the proposed rule are due March 22, 2021.


Related links:


Article published by NAHC on February 12, 2021
CLICK HERE to read original post