HHS Proposes Changes to the HIPAA Privacy Rule

On December 10, 2020, HHS issued a Notice of Proposed Rulemaking to revise the HIPAA Privacy Rule.

On December 10, 2020, the U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR") issued a Notice of Proposed Rulemaking ("NPRM") proposing some significant changes to the Health Insurance Portability and Accountability Act ("HIPAA") Privacy Rule.  The proposed changes, if adopted, would provide individuals with greater access to their health information and improve information sharing for care coordination and case management for individuals. 

 While there are various proposed amendments, the more significant changes include: 

  • Modifying individuals' rights to access their protected health information ("PHI"), including, with respect to the timing, form and method for providing access;
  • Adjusting the rules governing the fees charged for in-person, internet-based and other access to PHI;
  • Clarifying rules surrounding care coordination and case management, including addressing individual-level care coordination and case management and allowing disclosures to social services agencies, community-based organizations, and others;
  • Revising the requirements for Notice of Privacy Practices, including eliminating the signature requirement;
  • Expanding the ability to disclose PHI to avert a threat to health or safety when harm is "serious and reasonably foreseeable" instead of a "serious and imminent" threat to health or safety; 
  • Permitting disclosures to Telecommunication Relay Services ("TRS") communication assistants, while excluding TRS providers from the business associate definition; and 
  • Expanding the scope of the Armed Forces authorization to use or disclose PHI. 

OCR is accepting public comment for 60 days after publication in the Federal Register. Covered entities, business associates, and other stakeholders should review the NPRM to determine the extent to which the changes would affect their existing policies and operations and consider whether to submit comments on the proposed rules.

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our “Contact Us” form, which can be found on our website at The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.