View Rule

This rule will address proposals to modify the HIPAA Privacy Rule to strengthen individuals’ rights to access their own protected health information, including electronic information; improve information sharing for care coordination and case management for individuals; facilitate greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhance flexibilities for disclosures in emergency or threatening circumstances; support the use of telecommunications relay services by individuals and workforce members of HIPAA covered entities and business associates who are deaf, hard of hearing, deaf-blind, or who have a speech disability; expand the Privacy Rule permission to use and disclose protected health information of Armed Forces personnel for national readiness purposes so that it applies to all uniformed services personnel; and reduce administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.

Statement of Need:

HHS is the Federal government's lead agency for protecting the health of all Americans and providing essential human services. OCR supports that mission by enforcing protections for health information privacy and security pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). In light of ongoing concerns that regulatory barriers across the Department impede effective delivery of coordinated, value-based health care, and impose unnecessary administrative expenses and limit initiatives that reward innovation, value, and performance, the Department launched efforts to promote care coordination and facilitate a nationwide transformation to value-based health care and reduce regulatory barriers to coordinated care.

Summary of the Legal Basis:

This regulation would be promulgated under HIPAA, the HITECH Act.

Alternatives:

OCR considered regulatory and non-regulatory alternatives to rulemaking, including expanding OCR outreach, guidance, and educational materials, as well as not engaging in rulemaking and maintaining the status quo. OCR determined that rulemaking is necessary to achieve the desired effects of reducing burdens and strengthening individual rights. OCR may supplement this rulemaking with non-regulatory actions such as issuing subregulatory guidance.

Anticipated Costs and Benefits:

OCR estimates an annualized cost savings of approximately $785 million discounted at 7 percent. Costs are attributable to new training, the development of new policies and procedures, and administrative expenses. Cost-savings are attributable to eliminating certain recordkeeping requirements.

Risks:

None known.