View Information Collection Request (ICR) Package

Please note that the OMB number and expiration date may not have been determined when this Information Collection Request and associated Information Collection forms were submitted to OMB. The approved OMB number and expiration date may be found by clicking on the Notice of Action link below.

View ICR - OIRA Conclusion

OMB Control No: 0945-0003	ICR Reference No: 202411-0945-001
Status: Historical Inactive	Previous ICR Reference No: 202401-0945-002
Agency/Subagency: HHS/OCR	Agency Tracking No: 20296
Title: Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164
Type of Information Collection: Revision of a currently approved collection	Common Form ICR: No
Type of Review Request: Regular
OIRA Conclusion Action: Comment filed on proposed rule and continue	Conclusion Date: 01/17/2025
Retrieve Notice of Action (NOA)	Date Received in OIRA: 01/06/2025
Terms of Clearance: Prior to publication of the final rule, the agency should provide to OMB a summary of all comments received on the proposed information collection and identify any changes made in response to these comments.

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	07/31/2027	36 Months From Approved	07/31/2027
Responses	1,154,350,069	0	1,154,350,069
Time Burden (Hours)	953,982,239	0	953,982,239
Cost Burden (Dollars)	163,499,411	0	163,499,411

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: Yes

Burden Reduction Due to: Miscellaneous Actions

Short Statement: As a result of proposed program changes that would establish new requirements, the Department added new estimated burdens, as follows: (1) For each regulated entity to conduct a Security Rule compliance audit. (2) For each business associate (including each subcontractor) to provide verification of compliance with technical safeguards. (3) For each regulated entity to obtain verification of business associates’ and subcontractors’ compliance with technical safeguards. (5) For each regulated entity to provide notification to other regulated entities of workforce members' termination of access to ePHI. (6) For each regulated entity to deploy multi-factor authentication. (7) For each regulated entity to perform network segmentation. (8) For approximately 75 percent of regulated entities to disable unused ports and remove extraneous software. (9) For each regulated entity to conduct penetration testing. (10) For each regulated entity to notify covered entities or business associates, as applicable, upon activation of a contingency plan. (11) For each insurer and third-party administrator to update health plan documents. (12) For each regulated entity to update the content of its cybersecurity awareness and Security Rule training program. (13) For each regulated entity to update its policies and procedures. (14) For each regulated entity to update business associate agreements. (15) For each health plan sponsor that has access to ePHI to implement the Security Rule’s administrative, physical, and technical safeguards in their relevant electronic information systems. In addition, the Department is making updates and adjustments to certain estimates. The Department has revised the estimated annual burdens of compliance by: (1) Increasing the number of covered entities from 774,331 to 822,600. (2) Updating hourly wage rates from 2022 to 2023 rates. (3) Decreasing the number of respondents requesting exceptions to state law preemption under 45 CFR 160.204 from 27 to 1 to return to the previous baseline of 1 request per year. (4) Decreasing the estimated hourly burden for a business associate to report security incidents (other than breaches) to a covered entity from 20 hours per monthly report to 10 hours per monthly report. (5) Increasing the estimated number of disclosures for research from approximately 147,000 to 153,857.

Annual Cost to Federal Government: $216,000

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination. No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination. No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

Agency Contact: Sherri Morgan 202 774-3042 sherri.morgan@hhs.gov