Proposed Changes to Federal Health Privacy Regulations Now at OMB for Review

The Administration is preparing to release a Request for Information (“RFI”) on potential modifications to Health Insurance Portability and Accountability Act (HIPAA) rules.  The draft RFI was recently submitted by the Department of Health and Human Services (“HHS”) to the White House’s Office of Management and Budget (“OMB”) for pre-release review.

The draft RFI seeks public input on whether provisions of HIPAA limit or impede coordinated care and case management among hospitals, physicians (and other providers), payors, and patients. The RFI specifically seeks comment on: (1) methods of accounting for disclosures of protected health information (“PHI”); (2) patients’ acknowledgment of receipt of a provider’s notice of privacy practices; (3) creation of a safe harbor for good faith disclosures of PHI for purposes of care coordination or case management; (4) disclosures of PHI without a patient’s authorization for treatment, payment, and healthcare operations; and (5) HIPAA’s minimum necessary requirement (i.e., taking reasonable steps to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose).

The RFI is part of the Administration’s efforts to enhance coordinated, value-based care.  It is specifically intended to support HHS’s recently launched initiative, the Regulatory Sprint to Coordinated Care, the goal of which is to remove “regulatory barriers that impede coordinated, value-based healthcare.”

HHS submitted the RFI to OMB on November 13, 2018.  Once approved, the RFI will be published in the Federal Register.  While it remains to be seen how broadly HHS will consider reforming HIPAA implementing regulations, the RFI is an important first step to scoping any forthcoming reform efforts.  Stakeholders may wish to consider needed reforms and clarifications they might highlight in comments in response to the RFI.