In December, the Office of Civil Rights (OCR) issued a Notice of Proposed Rulemaking with several changes to the HIPAA privacy rule in response to a request for feedback from covered entities in 2018 and 2019. At a high level, the new changes address standards that may make it difficult when transitioning to value-based health care by limiting or discouraging care coordination and case management communications among individuals and covered entities. Here are three of the most important proposed changes:

  1. Right of Access. The time to respond would no longer be 30 days but changed to 15 days with no more than a 15-day extension, reduced from the current 30-day extension. Patients can also inspect Protected Health Information (PHI) in person and take notes or photograph PHI.
  2. Notice of Privacy Practices. Providers will no longer need to obtain written acknowledgement of receipt of a provider’s Notice of Privacy Practices. Instead, patients will have the right to discuss the Notice of Privacy Practices with a person designated by the covered entity. This designated person will be available to the entity to explain all their rights regarding their PHI and will be available onsite as well as by phone and email. Providers will include this information at the beginning of the Notice of Privacy Practices along with what a patient can do if they suspect a violation of the Privacy Rule, and how to contact a designated person to ask questions.
  3. Health Care Operations/Coordination and Case Management. The definition of “Health Care Operations” would be changed to clarify the scope of permitted uses. The OCR would like to clarify the definition of health care operations to encompass all care coordination and case management by health plans, whether individual-level or population-based. The clarification in the definition would allow covered entities and individuals to have more clarity regarding their Privacy Rule standards and how they apply to which care coordination and case management activities, and thereby facilitate those beneficial activities. The new definition would read as follows: “. . . population-based activities relating to improving health or reducing health care costs; protocol development; case management and care coordination; contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment.”

The comment period for the Notice of Proposed Rulemaking ends in February, then the OCR will determine what changes to finalize. We may see a final rule published in the middle or end of 2021.