Home Health

HHS extends public comment period for HIPAA Privacy Rule modifications

The Office for Civil Rights (OCR) announced on March 9 a 45-day extension for the public comment period for the Notice of Proposed Rulemaking (NPRM) to modify the HIPAA Privacy Rule.

The NPRM was first published in the Federal Register on January 21. At the time, individuals had 60 days to submit their comments. The extension pushes back the deadline from March 22 to May 6.

The proposed changes to the longstanding HIPAA Privacy Rule focus heavily on individuals’ right to access protected health information (PHI).

The proposed measures include shortening the covered entities’ (CE) required response time from 30 days to 15 days when a patient requests copies of PHI. In addition, the 30-day extension would be reduced to 15 days. HHS also proposed to reduce the identity verification burden on individuals exercising their access rights, as well as eliminate the requirement for individuals to provide a written acknowledgement of receipt of an organization’s Notice of Privacy Practices.

In addition, the proposed modifications align with the initiatives put in place by the Interoperability and Patient Access final rule. The NPRM aims to create a pathway for individuals to direct the sharing of PHI in an electronic health record (EHR) among covered healthcare providers and health plans by requiring the providers and plans to submit an individual’s access request to another healthcare provider and to receive back the requested electronic copies of the individual’s PHI in an EHR.

Finally, the NPRM proposes amending the definition of healthcare operations to clarify the scope of permitted uses and disclosures for individual-level care coordination and case management that constitute healthcare operations.

OCR said it will carefully consider comments from all stakeholders, including patients and their families, consumer advocates, CEs and their business associates, healthcare professional associations, health information management professions, health information technology vendors, and government entities.

The NPRM is currently available for review and comment on the Federal Register.