On December 14, 2018 the Department of Health & Human Services Office for Civil Rights (OCR) published a Request for Information (RFI) soliciting public input on updates to regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) with the goals of removing “regulatory obstacles” and decreasing “regulatory burdens” in furtherance of the health care industry’s transition to value-based care models.

In the RFI, OCR requests input on whether and how the HIPAA regulations (i) can be modified to remove regulatory obstacles and burdens to efficient care coordination and case management, (ii) may inhibit the transformation to a value-based health care system, and (iii) may be modified to facilitate efficient care coordination and case management, and promote the transformation to value-based care. OCR also solicits comment on four specific proposals for modifying the HIPAA regulations to accomplish some of its stated goals:

  • Promoting information sharing for treatment and care coordination or case management by amending the HIPAA Privacy Rule to encourage, incentivize or require covered entities to disclose protected health information (PHI) to other covered entities.
    • In connection with this issue, OCR requests information on potential changes to the regulations governing an individual’s right to access his/her PHI, and on the scope of the problem of delays in disclosures of PHI between health care providers that could affect care coordination and case management.
    • OCR requests comment on whether disclosures of PHI for care coordination or care management purposes to non-provider covered entities should be excepted from HIPAA’s minimum necessary standard.
    • OCR also requests comment on whether it should modify or clarify HIPAA to encourage covered entities to share PHI with non-covered entities when necessary to coordinate care, such as in the case of sharing PHI with a social services or community agency to help a patient suffering from homelessness or severe mental illness.
  • Encouraging covered entities to share treatment information with parents, loved ones and caregivers of adults facing health emergencies, in particular in connection with the opioid crisis. OCR requests suggestions on changes that can be made to HIPAA to address the opioid epidemic, and to address serious mental illness.
  • Implement a requirement set forth under the HITECH Act to include disclosures for treatment, payment, and health care operations from an electronic health record (EHR) in an accounting of disclosures in a manner that helps individuals without increasing the regulatory burden on covered entities or dis-incentivizing the implementation of EHRs.
    • OCR requests information on the current burden to covered entities posed by requests for accountings of disclosures, and whether EHRs are currently configured to enable easy accountings of such disclosures by covered entities and/or business associates.
  • Eliminate or modify the current requirement that covered health care providers make a good faith effort to obtain written acknowledgment of receipt of the Notice of Privacy Practices from individuals.

In total, OCR poses 54 questions/issues on which it solicits comment from the public and regulated entities in the RFI.  Comments must be submitted to OCR on or before February 12, 2019.


This post was co-authored by Alyssa Ferreone, legal intern at Robinson+Cole. Alyssa is not yet admitted to practice law.