As part of the U.S. Department of Health and Human Services’ (HHS) Regulatory Sprint to Coordinated Care, the Office of Civil Rights (OCR) has issued a Notice of Proposed Rulemaking (NPRM) to modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The stated purpose of the NPRM is to “support individuals' engagement in their healthcare, remove barriers to coordinated care and decrease regulatory burdens on the healthcare industry, while continuing to protect individuals' health information privacy interests.”
Among the proposed changes referenced in the NPRM:
- Eliminating the requirement for Covered Entities to make a good faith effort to obtain an individual’s written acknowledgement of receipt of the provider’s notice of privacy practices;
- Reducing the amount of time Covered Entities have to respond to an individual’s records request from 30 calendar days to 15 calendar days;
- Enhancing individuals’ rights to inspect their records and take photos or notes of such records;
- Prohibiting covered entities from imposing “burdensome” identification verification, notarization requirements or other “unreasonable measures” on an individual seeking access to covered records;
- Requiring covered entities to respond directly to certain records requests from other covered health plans/providers when directed by the individual;
- Clarifying permissible fee schemas for covered entities providing certain records, and requiring disclosure of expected fees;
- Revising “minimum necessary” requirements in certain contexts to facilitate coordinated care and case management activities;
- Clarifying the scope and permissibility of covered entity disclosure of protected health information (PHI) to social service agencies, community-based organizations home and community based services providers, to facilitate coordinated care and case management activities; and
- Relaxing the standard permitting covered entities’ disclosure of PHI to avert a threat to health or safety when a threat is “serious and reasonably foreseeable” and more.
Comments are due 60 days from the date of publication of the proposed rule in the Federal Register. The American College of Radiology® (ACR®) intends to submit comments. ACR members with questions or proposed feedback on the NPRM should contact Gloria Romanelli, JD, ACR Senior Director of Legislative and Regulatory Affairs.