0991-AC05 202510 The Regulatory Plan and the Unified Agenda of Federal Regulatory and Deregulatory Actions 0991 Office of the Secretary OS 0900 Department of Health and Human Services HHS Privacy Act Regulations

This rulemaking will update the Department’s Privacy Act regulations at 45 CFR part 5b, which detail how the Department implements requirements of the Privacy Act of 1974, as amended (5 U.S.C. 552a), and will remove duplicative Food and Drug Administration (FDA) Privacy Act regulations at 21 CFR part 21.

]]> Other Significant Previously Published in The Unified Agenda Proposed Rule Stage No No Not subject to, not significant 45 CFR part 5b 5 U.S.C. 552a(f) Yes

The Department’s existing regulations were promulgated in 1975, when the Privacy Act was new. Certain details are now outdated, incomplete, or incorrect due to later amendments to the Privacy Act, statutorily mandated organizational changes, and judicial interpretations. The proposed amendment would result in significant changes and improvements to the Department’s regulations (for example, it would remove antiquated provisions that require an individual’s medical records to be released to the individual indirectly, through a doctor or other representative designated by the individual), and it would enable the separate FDA Privacy Act regulations to be removed as duplicative.

]]>

The Privacy Act statute at 5 U.S.C. 552a(f) requires each agency to maintain up-to-date rules implementing the Privacy Act. Based on the definition of agency in the Freedom of Information Act (FOIA) statute at 5 U.S.C. 552(f)(1) (formerly 5 U.S.C. 552(e)), which is incorporated in the Privacy Act statute at 5 U.S.C. 552a(a)(1), such rules must be maintained at the Departmental level but are not required at the sub-agency level. 

]]>

Leaving the regulations in their current state is not recommended, because certain details in the regulations are outdated, incomplete, or incorrect, and some required provisions are missing. For example, court cases have identified legal deficiencies in indirect-access-to-medical records provisions like those in the Department’s regulations, effectively rendering those provisions unenforceable in their current state.

]]>

The proposed rule is not significant for purposes of E.O. 12866. Privacy Act regulations do not apply to businesses or other entities and do not impose significant costs and burdens on individuals

]]>

The only risk that we perceive is associated with eliminating the indirect-access-to-medical-records provisions, i.e., that harm to the individual or another person could result from allowing subject individuals to receive direct access to their medical records under the Privacy Act. However, that same risk is present now, because the indirect access provisions are effectively unenforceable in their current state, and the risk would be present if the provisions were retained with curative provisions added, as the curative provisions would guarantee the full disclosure to the individual of any medical record the agency released to the individual’s designated representative.

]]> NPRM 07/00/2026 No No None No No No No Samuel Shipley Team Lead & Senior Regulatory Coordinator 0991 Office of the Secretary OS 202 503-6492 samuel.shipley@hhs.gov 200 Independence Avenue SW, Washington DC 20201