Despite recent indications from HHS and the Director of HHS’s Office for Civil Rights (OCR) that the HIPAA/HITECH Act Omnibus Final Rule is extremely close to publication, the White House’s Office of Management and Budget (OMB) has extended its review of the rule under Executive Order 12866. As we recently commented, in a report published in early June 2012, HHS indicated that it was targeting July 2012 for publication of the final rule. At the same time the Director of OCR stated in reported comments that the rule was “extremely close” to publication.
OMB has now extended its review of the final rule. Under Executive Order 12866, OMB is given 90 days to review most proposed and final rules. However, the Executive Order permits OMB to extend the review period for an additional 30 calendar days on its own, and, with the agreement of the agency head, for longer periods of time. Of the 19 HHS submissions to OMB under the Executive Order that are currently listed on the federal website that reports on regulations under review by OMB, there are 11 for which OMB review has been extended; the oldest appears to be an FDA proposed regulation that was submitted for review on May 24, 2011. As previously reported, the omnibus rule is expected to include modifications to:
- The Breach Notification Rule.
- The HIPAA Enforcement Rule, implementing changes mandated by the HITECH Act.
- The Privacy and Security Rules, implementing changes mandated by the HITECH Act, as well as other changes to the Privacy Rule proposed in July 2010.
- The Privacy Rule, implementing changes required by the Genetic Information Nondiscrimination Act.