Seyfarth Synopsis: The Department of Health and Human Services (HHS) has proposed changes to the required Privacy Notice under the HIPAA privacy regulations. If finalized, these would be the first significant changes to the HIPAA rules since the HITECH changes effective back in 2013.

The press release issued by HHS on December 10, 2020, states its intention to empower patients, improve coordinated care, and reduce regulatory burdens in the health care industry. HHS notes that the medical crises brought on by the opioid and COVID-19 epidemics have heightened the need to make these updates. While many of the changes directly affect health care providers and their patients, several provisions will also have an impact on employer-provided health plans. The Notice of Proposed Rulemaking is voluminous, but includes such things as an expansion of the definition of health care operations and the minimum necessary rule, changes to the required HIPAA Privacy Notice, shortened time frames to respond to individuals requests regarding their rights to their PHI, and disclosures of applicable fees for access to PHI. The Notice also provides long-awaited additional guidance on Electronic Health Records.

We will be following up this post with a more detailed Legal Update on the impact of these proposed changes to covered entity health plans. Also, click here for our Legal Update discussing these proposals and health care providers.