View Information Collection Request (ICR) Package

Please note that the OMB number and expiration date may not have been determined when this Information Collection Request and associated Information Collection forms were submitted to OMB. The approved OMB number and expiration date may be found by clicking on the Notice of Action link below.

View ICR - OIRA Conclusion

OMB Control No: 0945-0003	ICR Reference No: 202304-0945-001
Status: Historical Inactive	Previous ICR Reference No: 202211-0945-003
Agency/Subagency: HHS/OCR	Agency Tracking No: 20296
Title: Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164
Type of Information Collection: Revision of a currently approved collection	Common Form ICR: No
Type of Review Request: Regular
OIRA Conclusion Action: Comment filed on proposed rule and continue	Conclusion Date: 06/27/2023
Retrieve Notice of Action (NOA)	Date Received in OIRA: 04/18/2023
Terms of Clearance: In accordance with 5 CFR 1320, the information collection is not approved at this time. Prior to publication of the final rule, the agency should provide to OMB a summary of all comments received on the proposed information collection and identify any changes made in response to these comments.

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2026	36 Months From Approved	03/31/2026
Responses	1,097,206,223	0	1,097,206,223
Time Burden (Hours)	921,158,940	0	921,158,940
Cost Burden (Dollars)	121,283,939	0	121,283,939

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: 1) Added a new category of prohibited uses and disclosures. 2) Adding a new requirement that, in certain circumstances, regulated entities must first obtain an attestation from the requestor that a requested use or disclosure is not for a prohibited purpose, resulting in a need to create an attestation form, update policies and procedures, update HIPAA training content, and update business associate agreements. 3) Modifying the content requirements of the Notice of Privacy Practices (NPP) to inform individuals that their PHI may not be used or disclosed for a prohibited purpose, resulting in a need for mailing the updated NPP to some individuals and posting it online. 4) Updating the number of estimated individuals requesting restrictions on disclosures of PHI due to the changed legal environment surrounding reproductive health care access. 5) Updating the number of covered entities. 6) Increasing the number of respondents requesting exceptions to state law preemption under 45 CFR 160.204 from 1 to 27 based on an expected reaction by states that have enacted restrictions on reproductive health care access. 7) Increasing the annual burden for distributing health plan NPPs to a percentage of health plan subscribers due to a 50% increase in the number of American with health coverage.

Annual Cost to Federal Government: $86,431

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination. No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination. No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

Agency Contact: Sherri Morgan 202 774-3042 sherri.morgan@hhs.gov