On December 14, 2018, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) issued a Request for Information (RFI) seeking comments on potential modifications to the HIPAA Rules¹ focused on improving care coordination and aligning with the agency’s emphasis on value-based care.² As part of HHS’s declared “Regulatory Sprint to Coordinated Care,” the RFI complements two earlier 2018 RFIs related to reforming regulations promulgated pursuant to the Stark Law, the federal Anti-Kickback Statute, and the Civil Monetary Penalties Law.³

OCR seeks input primarily on four aspects of the HIPAA Rules:

1. Promoting information sharing for treatment and care coordination.  OCR seeks input on whether healthcare providers should be required to disclose protected health information (PHI) to another provider when requested for care coordination purposes (currently, the HIPAA Rules require a covered entity to disclose PHI only (i) to an individual pursuant to an access request and (ii) to OCR for compliance with the HIPAA Rules), whether (and under which circumstances) covered entities should expressly be permitted to share PHI with social service agencies and other non-provider third parties for care coordination purposes, and whether changes should be made to the minimum necessary rule to allow for fewer restrictions on disclosures for case management and care coordination.  More broadly, OCR seeks additional input on ways to modify the HIPAA Rules to reduce administrative burdens and eliminate obstacles to information sharing in an effort to promote value-based care.
2. Encouraging providers to share PHI with family members, caregivers and others to assist in the care of those with substance use disorders and mental health illness. OCR requests comment on (i) changes to the HIPAA Rules to help address the opioid epidemic while balancing the need to ensure the privacy of those seeking treatment, and (ii) changes to ensure that parents have access to the treatment information of their minor children relating to substance use disorders and mental health illness.
3. Accounting of disclosures for treatment, payment and healthcare operations (TPO). OCR withdraws its prior notice of proposed rulemaking to implement the HITECH⁴ mandate that the accounting obligation be extended to disclosures for TPO made through an electronic health record (EHR).  OCR instead requests feedback from covered entities to gauge the burden that accounting for TPO disclosures (including through their EHRs) would pose. OCR desires to implement this HITECH requirement without creating dis-incentives or obstacles to the continued adoption of EHRs by providers.
4. Reducing the burden of compliance with Notice of Privacy Practices documentation requirements. OCR seeks input on the administrative and economic impact of the Notice of Privacy Practices requirements, specifically those requiring healthcare providers that have a “direct treatment relationship” with individuals to make a good faith effort to obtain written acknowledgment from the individual of receipt of the Notice.  OCR considers removing the written acknowledgment requirements to reduce the burden on providers, but seeks to preserve individuals’ rights to information about covered entities’ privacy practices.

Comments to the RFI must be submitted on or before February 12, 2019.  OCR does not require that a response to every question be submitted.

¹ The regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191), set forth at 45 C.F.R. Parts 160 – 164.

² Request for Information on Modifying HIPAA Rules to Improve Coordinated Care, 83 Fed. Reg. 64302 (Dec. 14, 2018).

³ “Sprinting to Coordinated Care: Healthcare Industry Urges Stark Law Relief as OIG Solicits Feedback on Changes to the Anti-Kickback Statute & Civil Monetary Penalties Law” (September 7, 2018)

⁴ The Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act (Pub. L. 111-5).