In March, we reported that the U.S. Department of Health and Human Services (HHS) had submitted the HIPAA/HITECH Act Omnibus Final Rule to the Office of Management and Budget (OMB) for review under Executive Order 12866, and that OMB had up to 90 days to review the rule under the Executive Order.

In HHS’s May 2012 Retrospective Regulatory Review Update, which was released June 4, 2012 as part of a White House/OMB update on implementation of the January 2011 Executive Order on Improving Regulation and Regulatory Review, HHS indicates that it is targeting July 2012 for publication of the final rule. HHS also states that its retrospective review “will result in significant modifications to the [HIPAA] Privacy Rule.” It notes that the reforms in the final rule under development include (1) changes to the requirements for distribution of Notices of Privacy Practices by health plans when material changes are made in their privacy practices, (2) changes in the public health provisions to better facilitate disclosure of student immunization records to schools, and (3) modifications to streamline Privacy Rule processes for obtaining HIPAA authorizations for research purposes and harmonization authorization requirements with the Common Rule. HHS forecasts that the revised requirements for distribution of notices of privacy practices by health plans will result in a one-time savings of $90 million.

As previously reported, the omnibus rule is expected to include modifications to:

  • The Breach Notification Rule. 
  • The HIPAA Enforcement Rule, implementing changes mandated by the HITECH Act. 
  • The Privacy and Security Rules, implementing changes mandated by the HITECH Act, as well as other changes to the Privacy Rule proposed in July 2010.
  • The Privacy Rule, implementing changes required by the Genetic Information Nondiscrimination Act.

In addition, HHS continues to work on modifications to the accounting for disclosures requirement under the Privacy Rule to implement changes required by the HITECH Act, as well as to implement changes “to improve workability and to better balance the burden to regulated entities with the benefit to individuals.” HHS published the proposed rule May 2012, but does not forecast a publication date for the final rule in the May 2012 Update.