Proposed Changes to HIPAA Privacy Rule

Written by: Sean Cox, Esq.

On December 10, 2020, the Trump administration announced proposed changes to the HIPAA privacy rule. According to the announcement, the changes are intended to “support individuals’ engagement in their care, remove barriers to coordinated care, and reduce regulatory burdens on the health care industry.” The most important changes relate to an individual right to obtain copies of their records and easing the circumstances when a covered entity can share protected information with other providers and public health authorities. While not exhaustive, the following are the changes that will likely have the greatest effects.

Under the proposed changes individuals would have greater access to their medical records, including the ability to take notes and make their own copies. The proposals would also shorten the time for covered entities to respond to requests for records from the current 30 days to 15 days, and reduce the verification burden on patients. Patients would also be given an increased ability to direct their records be shared with third-parties. Lastly, the proposed changes would alter the permitted fee structure, and require covered entities to post estimated fee schedules for providing the information.

The proposed changes also seek to soften the privacy rule’s effect on care coordination and public health needs. Under the new proposed rule, covered entities would be relieved of the minimum necessary requirement related to care coordination and case management activities. Additionally, the standard for disclosing protected health information would be changed from the current “serious and imminent threat to health or safety” standard to a less strict, “serious and reasonably foreseeable standard.”

The proposed changes have entered a period for public comment. A complete copy of the proposed changes can be found here: https://www.hhs.gov/sites/default/files/hhs-ocr-hipaa-nprm.pdf