What You Need to Know About Proposed Modifications to HIPAA’s Privacy Rule

Recently, I had the pleasure of presenting HIPAA Gets a Facelift: Are There Still Wrinkles with my colleague Angela Rose. During this webinar, we outlined the Notice of Proposed Rule Making (NPRM) for modifications to the HIPAA Privacy Rule, which was published in the Federal Register on January 21 and is now open for comment until May 6, 2021. The purpose of the proposed changes is to improve patient access to protected health information (PHI) and increase permissible PHI disclosure with the intent of improving care coordination and case management.

As many prepare to respond to this NPRM, knowing what is in the rule is important. I encourage you to view a summary of the modifications, and request the playback of our webinar to learn more. One major proposed change that covered entities (CEs) need to be aware of is the cost shift associated with this proposed rule.

Evaluation of the cost shift to CEs

• Costs associated with patients requesting to inspect and copy their records when “readily available” during an office visit. What manpower and equipment/space, such as viewing stations, will be needed when PHI is requested for review? The proposed rule does not provide the CE with the opportunity to deny or delay the right to inspect in person. And there should be more clarity on how to determine when PHI is “readily available.”

• Cost shift to CEs when PHI is requested to be copied on electronic media such as CDs and mailed, but only labor can be charged. What cost impact will this have? Consider that CDs are often the main copy format for medical images stored electronically in medical imaging picture archiving and communication systems (PACS).
• Cost shift associated with fee change related to patient-directed third-party requests. Specifically, when an individual directs an electronic copy of their PHI in an EHR be sent to a third party, the fee that can be charged is a reasonable cost-based fee, limited to labor only. This is in contrast to all other patient-directed third-party requests where the fees are not subject to fee limitations. Per the NPRM, current allowable fees for a 200-page hybrid record (100 pages electronic, 100 pages non-electronic) under state law is estimated at $133.50. Under the proposed rule, the estimated fee for the same record would be $25.23.

As the need for interoperability continues to grow, these Privacy Rule changes reflect the move toward ease of access by individuals. While this change is necessary, and welcome in many respects, an individual’s privacy must be protected. In addition, there must be continued recognition of the cost to provide information as we migrate more seamlessly to interoperability.

Comment Submission Process

I strongly encourage all CEs to respond to this proposed rule change before the May 6, 2021 deadline. MRO, along with other industry leaders, has designed a template response letter for commenting. You can submit comments to the NPRM by any of the following methods:

• Electronic Comments: Submit electronic comments at regulations.gov by searching for the Docket ID number HHS-OCR-0945-AA00. Follow the instructions provided.
• Regular, Express, or Overnight Mail: Submit comments to HHS, Office for Civil Rights, Attention: Proposed Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement NPRM, RIN 0945-AA00, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, SW, Washington, DC 20201.

Tips for Submitting Effective Public Comments

1. Plan Ahead. The comment period closes at 11:59 pm (ET) on the date comments are due. Planning ahead helps to ensure that your comments are submitted well before the deadline.
2. Contact the Agency. If you have questions or do not understand a part of the regulatory document, reach out to the agency contact person listed on the document before submitting your comment.
3. Identify the Issues. In your comment, clearly identify which issues you are commenting on within the regulatory action. Provide the page number, column, and/or paragraph from the Federal Registerif you are commenting on a particular word, phrase, or sentence.
4. Selection is Fine. You do not have to comment on every issue in a rule. You may select the issues on which you wish to comment.
5. Address Specific Agency Requests. The department often requests comments on specific parts of proposed rules. This may be a helpful place to focus your comments.
6. Details, Details. Constructive, detailed comments (whether positive or negative) are most beneficial. If you agree with a proposed action, your comments help to show that the public wants or needs the proposed action. If you disagree with a proposed action, then suggest an alternative (including not regulating at all) and provide an explanation of how the alternative might meet the same objective or be more effective. Evidence-based information is particularly helpful.

For more information about commenting effectively, check out the full list of Tips for Submitting Effective Comments – PDF on Regulations.gov.

To request the playback recording of this webinar and learn more about the HIPAA Notice of Proposed Rule Making, click here.