We’re here to help you prepare for the proposed HIPAA Privacy Rule Modifications.

At Verisma, we understand that the proposed HHS HIPAA Privacy Rule modifications are complex and will have an immediate effect on how health care systems facilitate access to and copies of patient records to various outside parties. In an effort to provide a simple and actionable perspective, we have compiled a simple 4-step process for consideration.

Step 1:

Be aware of the proposed changes.

Take the time to review the full proposed modifications to the HIPAA Privacy Rules here. Many of the proposed changes to the HIPAA Privacy Rule in the NPRM issued by HHS/OCR last month, [86 Fed. Reg. 6446 (Jan. 21, 2021)], appear to be reasonable ways to facilitate the use and disclosure of patient PHI—although they will require extensive staff re-training to ensure compliance. However, there are a few important items we believe would have significant impact on covered entities and for which feedback to HHS should be considered:

  • Reducing requirements relating to the form of patient ROI requests for records to be delivered to third parties (so-called “patient-directed requests” or “third party directives”), in particular allowing oral patient requests
  • Reducing the turn-around time (TAT) for fulfilling ROI requests from 30 to 15 calendar days
  • Extending the patient access ($6.50) rate to cover patient-directed requests

Step 2:

Align your internal team.

The proposed HIPAA rule changes will need to be understood across all aspects of your organization with opportunity to garner important feedback from various stakeholders such as corporate compliance, legal, and government affairs. Scheduling a time now to engage with your key stakeholders is highly recommended.

Contact us here if you would like our assistance in communicating the proposed changes to your organization.

Step 3:

Provide comments to HHS during the official 60-day public comment period.

The Administrative Procedure Act provides a 60-day public comment period following publication of the proposed rules in the Federal Register. The comments received form part of the record that guides the agency’s decision-making with respect to any final rules it adopts. If the record does not support the agency’s decisions, the rules may be changed in court. Although HHS filed the proposed changes in the HIPAA Privacy Rule on January 21, 2021, the new Biden Administration has announced a temporary freeze on new federal regulations that may delay the 60-day comment period. The submission date for comments was May 6, 2021. Hopefully your organization has submitted feedback as part of the commentary period.

Verisma’s submitted comments can be viewed here.
Download the PDF version of the HIPAA NPRM (notice of proposed rules change)
Download the Verisma HIPAA NPRM Position Statement

Step 4:

Contact us with questions.

We have a team of experts who are happy to help if you have questions or would like assistance on how to proceed. Contact us here.