HHS Proposes HIPAA Privacy Rule Changes Related to Care Coordination

The U.S. Department of Health and Human Services has proposed significant changes to the HIPAA Privacy Rule with the goal of reducing impediments to care coordination and case management communications among individuals and providers.

HHS is proposing a compliance date of 180 days after the effective date of a final rule, and the Office for Civil Rights would begin enforcement of the new and revised standards 240 days after publication of a final rule.

Several of the proposals modify provisions related to the individuals’ right of access to protected health information, including strengthening individuals’ rights to inspect their PHI in person, which includes allowing individuals to take notes or use other personal resources to view and capture images of their PHI. Another change shortens covered entities’ required response time to no later than 15 calendar days (from the current 30 days) with the opportunity for an extension of no more than 15 calendar days (from the current 30-day extension).