Following a pattern of familiarity for health lawyers, the Department of Health and Human Services (HHS) has released a substantial Notice of Proposed Rulemaking (NPRM) in December at the end of an administration. The NPRM is intended to revise the Privacy Rule under the Health Insurance Portability and Accountability Act (HIPAA). Because comments are not due until after the new Biden administration takes office, the fate of this NPRM is unclear. At the same time, this NPRM reflects two key issues of concern to the Office for Civil Rights (OCR) in its current incarnation: improving patient access to health information (a goal presumably shared by a new administration) and expanding opportunities for increased information sharing in specific contexts (primarily focused on coordinated care and sharing with social service organizations).

The access principles - while detailed and somewhat technical - generally seem consistent with policy goals that have been applied for more than a decade, as government tries to find easier means to allow patients meaningful and useful access to their own information. The more challenging elements of this NPRM stem from the desire to expand information sharing. While pursuing admirable goals (who is against coordinated care?), these elements present much more complicated policy issues and raise a broad variety of concerns in connection with the overall debate about health care privacy.

Originally published in Health Law Weekly - December 18, 2020.