AHA comments on proposed changes to HIPAA Privacy Rule

AHA today urged the Department of Health and Human Services’ Office for Civil Rights to take a holistic approach as it deliberates changes to the HIPAA Privacy Rule.

“The HIPAA regulations do not operate in a vacuum,” AHA said in comments on the notice of proposed rulemaking. “It is imperative that HHS acknowledge in the final regulations the intersection of the regulations under HIPAA, the Office of the National Coordinator for Health Information Technology (ONC) Cures Act interoperability and information blocking requirements, and the Part 2 regulations under Title 42 of the Code of Federal Regulations (CFR): Confidentiality of Substance Use Disorder Patient Records (Part 2).”  

HIPAA, “as the most comprehensive of the three federal regulatory regimes, should take preeminence for health privacy protections, and the other rules should defer to and conform with its privacy obligations,” AHA said.

As an intermediate step to harmonizing the three sets of regulatory requirements, AHA urged HHS not to implement any new HIPAA requirements related to additional rights of access that would be enforced prior to the availability of technologies essential for responding to patient requests.

“For example, as of now, the Cures Act requirements for developers of certified health information technology to provide technology upgrades, including enhanced application programming interface capabilities, essential to fulfilling requirements related to the proposed new rights of access will not be enforced until at least Dec. 31, 2022,” the letter notes.

HHS today extended the deadline to comment on proposed changes to the HIPAA Privacy Rule to May 6.