Unless an extension is granted or the notice of proposed rulemaking (NPRM) is withdrawn, covered entities (CEs) and business associates (BAs) have until late March to submit comments on possible revisions to the privacy rule. The day after President Biden was sworn in and six weeks after it was first announced,^[1] the HHS Office for Civil Rights (OCR) published the NPRM officials posted in December.^[2]

A political appointee, OCR Director Roger Severino had already resigned by the time the NPRM was published, and it was a busy week before he left on Jan. 15. A flurry of other regulatory actions occurred following his departure—all of which are now subject to possible revision and withdrawal by the Biden administration. Not likely to be reviewed, however, are two new enforcement resolutions issued last month, including a $5.1 million settlement with a health plan in New York for a 2015 breach affecting 9.3 million individuals.^[3]

As if this was not enough HIPAA news, the University of Texas MD Anderson Cancer Center won a major victory in court in the middle of last month when a circuit court overturned a $4.3 million fine OCR imposed for three breaches and lack of universal encryption.^[4]

While leading OCR, Severino made “conscience and religious freedom” in health care a priority, issuing a number of controversial, and last-minute, proposals. Just five days before the inauguration, OCR announced it had published an NPRM to protect “infants born alive from discrimination on the basis of disability.”^[5] However, this NPRM had not been published in the Federal Register as of RPP’s deadline.