In two public talks this spring, Melanie Fontes Rainer, director of the HHS Office for Civil Rights (OCR), said completing the 2021 proposed regulation extensively revising the Privacy Rule wasn’t a priority this year amid limited resources and more pressing matters—including safeguarding abortion-related information.^[1] Turns out it may not be a priority next year, either.

According to the newest federal Unified Agenda and Regulatory Plan, published June 13, OCR estimates a final version of the rule under development since 2018 will be published in December 2024.^[2] However, these agendas—typically published in the spring and fall each year—are often little more than guesses and frequently publication dates are missed, sometimes by a lot. This means a final rule could appear in 2025 or later.

In fact, OCR is more than 10 years late publishing regulations required by Congress that would allow people affected by privacy or security breaches to share in the financial penalties the agency collects for HIPAA violations. The June agenda lists March 2024 for a proposed rule on this topic. OCR published a related request for information in April of last year, a step that helps inform rulemaking but also lengthens the process. The statutory deadline for issuing the rule was Feb. 17, 2012.