The HHS Office for Civil Rights (OCR) is moving forward with its plans to modify the HIPAA privacy rule in ways it says will make it easier for health care organizations to share information that will enable them to better coordinate care, perform outcomes research and improve quality over time.

OCR’s notice of proposed rulemaking (NPRM), which follows a public request for information issued by OCR around two years ago, incorporates aspects of many comments the agency received.

The NPRM, announced in December, was published in the Federal Register Jan. 21. Comments will be accepted through March 22.^[1]

The proposed rules would strengthen individuals’ rights to access their own health information, including electronic information; improve information sharing for care coordination and care management for individuals; facilitate greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhance flexibilities for disclosures in emergency or threatening circumstances, such as the opioid and COVID-19 public health emergencies; and reduce administrative burdens on HIPAA-covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests, according to OCR.^[2]

Stakeholders took a cautious approach in reacting to the mammoth proposed rule, with both the American Hospital Association and the American Health Information Management Association (AHIMA) saying they looked forward to reviewing the specifics. “We are pleased the rule proposes strengthening the individual right of access under HIPAA,” AHIMA CEO Wylecia Wiggs Harris said in a statement. “We are also pleased it seeks to clarify how an individual’s right to direct their protected health information (PHI) to a third party should be treated. In certain instances, this has led to delays in individuals being able to access their medical record.”^[3]