View Rule

This proposed rule would seek comment on proposals to modify provisions of the HIPAA Rules which present barriers that limit or discourage coordinated care and case management (including care coordination challenges arising from the opioid crisis) among hospitals, physicians (and other providers), payors, and patients, and to support (and remove barriers) the engagement of individuals with the healthcare system, or otherwise impose regulatory burdens. Such burdens may impede the transformation to value-based healthcare or individual participation in or engagement with the healthcare system without providing commensurate privacy or security protections for patients' protected health information (PHI). The proposed rule would maintain and potentially expand patients' ability to control the use or disclosure of their PHI and to access PHI. This proposed rule would subsume the previous 0945-AA09 entry in the Regulatory Agenda. 

Overall Description of Deadline: Required by the HITECH Act. Statutory deadline contingent on further regulatory action.

Statement of Need:

The HHS Deputy Secretary launched the Regulatory Sprint to Coordinated Care initiative. The goal of the Regulatory Sprint is to remove regulatory barriers that impede coordinated, value-based health care.  This rulemaking supports the Regulatory Sprint, as well as other HHS initiatives.  

Summary of the Legal Basis:

The HIPAA statute and the HITECH Act.

Alternatives:

Anticipated Costs and Benefits:

OCR estimates an annualized cost savings of approximately $1.385 billion per year over five years.  Costs are attributable to new training, the development of new policies and procedures, and administrative expenses.  Cost-savings are attributable to eliminating the Notice of Privacy Practices recordkeeping requirement, eliminating burdens imposed on covered entities for compliance with the minimum necessary standard, and clarifying that business associate agreements are not necessary for telecommunications relay services.

Risks:

None known.