With the overturning of Roe. v. Wade and the continuing opioid crisis, the HHS Office for Civil Rights (OCR) has decided to focus on safeguards for reproductive health and substance use disorder records and won’t be finalizing revisions to the Privacy Rule proposed in 2021 anytime soon.
At a recent conference sponsored by the Health Care Compliance Association, publisher of RRC, OCR Director Melanie Fontes Rainer said finalizing the proposed rule “is not a top priority for us this year with our limited resources.”[1]
But OCR has signaled it will continue to bring enforcement actions when covered entities violate patients’ or family members’ rights to access their medical records. In fact, the agency recently announced its 44th such action.
Hospitals and other medical providers affiliated with research institutions may recall OCR published a proposed rule on Jan. 21, 2021, the day after President Joe Biden was inaugurated.[2] OCR formally began the process of revising the Privacy Rule in December 2018 under then-Director Roger Severino, with the publication of a request for information. Drafted by the Trump administration, publication under Biden was seen as a tacit endorsement of the proposed rule by the current administration.
The proposed rule eliminated the requirement for providers to obtain a signature when they distribute their notices of privacy practices, a change popular among providers. It also addressed a range of topics, many more than the typical rule—problems OCR officials said at the time were long-standing.
2021 Reg Improved PHI Sharing, Coordination
As the federal rulemaking website reginfo.gov describes, it “will address proposals to modify the HIPAA Privacy Rule to strengthen individuals’ rights to access their own protected health information [PHI], including electronic information; improve information sharing for care coordination and case management for individuals; facilitate greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; address disclosures in emergency or threatening circumstances; and reduce administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.”[3]
Despite the proposed rule’s kitchen-sink approach to HIPAA, the 2021 regulation couldn’t have contemplated the U.S. Supreme Court’s June 24, 2022, decision overturning Roe v. Wade, which OCR officials say necessitated the April 16 reproductive health draft regulation. However, it is not the first time OCR (or HHS) has weighed in on the topic. This proposed regulation follows and formalizes related guidance OCR issued five days after the court’s Dobbs v. Jackson decision.
The new proposed rule “extend[s] additional privacy protections for providers, insurers, patients and others to safeguard protected health information when that information otherwise would be disclosed or used to identify, investigate, sue, or prosecute someone for seeking, obtaining, providing, or facilitating lawful reproductive health care.”[4]
