View Rule

View EO 12866 Meetings Printer-Friendly Version     Download RIN Data in XML

HHS/OCR RIN: 0945-AA09 Publication ID: Fall 2017 
Title: ●HIPAA Privacy Rule: Presumption of Good Faith of HealthCare Providers 
Abstract:

The proposed rule would modify the HIPAA Privacy Rule to clarify that healthcare providers are presumed to be acting in the individual's best interests when they share information with an incapacitated patient's family members unless there is evidence that a provider was acted in bad faith.

 

 

 
Agency: Department of Health and Human Services(HHS)  Priority: Other Significant 
RIN Status: First time published in the Unified Agenda Agenda Stage of Rulemaking: Proposed Rule Stage 
Major: No  Unfunded Mandates: No 
EO 13771 Designation: Deregulatory 
CFR Citation: 45 CFR 164.510   
Legal Authority: Health Insurance Portability and Accountability (HIPAA) Act of 1996, Pub. L. 104-191   
Legal Deadline:  None

Statement of Need:

HIPAA allows medical professionals to share protected health information with an individual's loved ones in emergency or dangerous situations but misunderstandings to the contrary persist and create obstacles to family support that is crucial to the proper care, treatment, and recovery of people experiencing a crisis situation. Therefore, the Department, through the Office for Civil Rights (OCR) intends to propose regulatory changes to the HIPAA Privacy Rule to clarify that healthcare providers are presumed to be acting in the individual's best interests when they share information with an incapacitated patient's family members, unless there is evidence that a provider acted in bad faith.  OCR by delegation from the Secretary, has broad authority under HIPAA to make modifications to the Privacy Rule, as provided by section 264 of HIPAA (codified at 42 U.S.C. and 1320d-2(note)).

Summary of the Legal Basis:

OCR has broad authority under the HIPAA statute to make modifications to the Privacy Rule, within the statutory constraints of the HITECH Act and other applicable law (e.g., the Administrative Procedures Act).

Alternatives:

The alternative is to not issue a proposed rule.

Anticipated Costs and Benefits:

The proposed rule will not create any new requirements or costs for regulated entities or the public. It will provide assurances to health care providers about their ability to make disclosures that are in the best interests of patients.

Risks:

OCR has not identified any risks associated with this proposal. OCR currently defers to a healthcare provider's professional judgment in these circumstances and has never taken enforcement action against a healthcare provider who shared information in good faith, thus, the proposed regulatory change will not decrease the privacy protections for individuals' protected health information, or significantly alter HIPAA enforcement policy.

Timetable:
Action Date FR Cite
NPRM  05/00/2018 
Regulatory Flexibility Analysis Required: No  Government Levels Affected: None 
Federalism: No 
Included in the Regulatory Plan: Yes 
RIN Data Printed in the FR: No 
Agency Contact:
Andra Wicks
Health Information Privacy Specialist
Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW.,
Washington, DC 20201
Phone:202 774-3081
TDD Phone:800 537-7697
Email: andra.wicks@hhs.gov