The Department of Health & Human Services (HHS) has announced that it is allowing additional time for public comment on proposed changes relating to access to and disclosure of protected health information (PHI). The Office for Civil Rights (OCR) of HHS published significant proposed modifications to the Health Insurance Portability & Accountability Act (HIPAA) Privacy Standards in the Federal Register on January 21, 2021. The proposed rules were focused on supporting the transition to value-based health care by modifying restrictions on use of PHI for care coordination and case management. OCR also proposed significant changes in procedures for individuals’ access to their PHI. The original comment date of March 22, 2021 has been extended to May 6, 2021.

Many of the changes in the proposed rule are intended to provide individuals with easier access to their PHI. Major amendments include:

• Strengthening individuals’ rights to inspect their PHI in person, including using personal resources to view and capture images of their PHI
• Shortening covered entities’ response time to request for access from 30 to 15 days
• Clarifying the form and format required for responding to requests for PHI
• If the covered entity offers a summary of PHI in lieu of a copy, requiring the covered entity to inform individuals that they retain their right to obtain a full copy or direct a copy to a third party
• Reducing requirements for an individual to prove his/her identity when requesting access to PHI
• Creating a pathway for an individual to share PHI in an electronic health record (EHR) among health care providers and health plans, and requiring covered entities to respond to some requests from other providers and plans when directed by the individual
• Limiting the individual’s right to direct transmission of PHI to a third party to electronic copies
• Specifying when electronic PHI must be provided at no charge
• Amending the permissible fee structure for responding to requests to send PHI to a third party
• Requiring covered entities to post estimated fee schedules for access to PHI and provide individualized estimates of copying costs on request.

OCR also proposed some changes intended to reduce barriers to use of PHI for coordinated care and case management. These changes include:

• Providing that uses and disclosures of PHI by a covered entity for care coordination and case management for an individual do not need to be limited to the minimum necessary
• Clarifying the scope of permissible disclosures of PHI to social service agencies and similar third parties for coordination of care and case management
• Permitting certain uses and disclosures of PHI based on a good faith belief that disclosure is in the best interest of the individual, and expanding the ability to disclose PHI to avert a threat to an individual’s health or safety when harm is reasonably foreseeable (rather than the current standard of imminent threat)
• Eliminating the requirement to obtain an individual’s written acknowledgment of receipt of the Notice of Privacy Practices (NPP)
• Modifying the content requirements of the NPP to clarify individual rights
• Permitting disclosures to Telecommunications Relay Services
• Expanding permitted uses and disclosures of PHI for U.S. uniformed services.