On March 9, 2021, the Department of Health and Human Services (HHS)
announced an extension of the public comment period from March 22, 2021, to
May 6, 2021, for its
proposed modifications to regulations implementing the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) and the Health Information Technology
for Economic and Clinical Health Act of 2009 (HITECH).
HHS initially released the proposed rule on January 21, 2021. It is now extending the comment period to give the public
additional time to consider the proposed changes and give stakeholders such
as HIPAA-covered entities, business associates and health information
technology vendors more time to submit comments about the policies.
HIPAA-covered entities include hospitals, physicians and other healthcare
providers, payors and insurers.
According to Acting Office for Civil Rights (OCR) Director Robinsue Frohboese, “OCR anticipates
a high degree of public interest in providing input on the proposals
because the HIPAA Privacy Rule affects nearly anyone who interacts with the
health care system. The 45-day extension of the comment period to May 6,
2021, will give the public a full opportunity to consider the proposals and
submit comments to inform future policy.” As of March 18, 2021, regulations.gov showed that OCR had received 772
comments on the proposed rule.
As mentioned in McGuireWoods’
February 4, 2021 legal alert discussing the proposed rule, if HHS finalizes the proposed
rule, HIPAA-covered entities and business associates must update their policies, procedures, security
standards, notices of privacy practices, authorization and disclosure
forms, and business associate agreements, among other documents, to reflect
the modifications made by the proposed rule. Additionally, the proposed
rule would give providers more flexibility to disclose protected health
information while providing care to their patients, including encouraging
providers to engage in a greater degree of care coordination.
Interested stakeholders wishing to submit comments regarding the proposed
rule may do so on or before May 6, 2021, electronically or by mail.
McGuireWoods will continue to monitor the proposed rule, which is part of
the Regulatory Sprint to Coordinated Care initiative launched by HHS to
promote value-based healthcare. The initiative examines federal regulations
that impede efforts among healthcare providers and health plans to better
coordinate care for patients. For additional information on privacy and
security of health information and the Regulatory Sprint to Coordinated
Care, see McGuireWoods’ previous alerts and insights.