Better care coordination, promotion of value-based health care, combating opioid addiction, addressing serious mental illness, facilitating the disclosure of protected health information (PHI) to other covered entities, and the elimination of signatures for Notices of Privacy Practices (NPP) are just a few of the topics discussed in the 32-page Request for Information (RFI) released by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

HHS is seeking input on how the Health Insurance Portability and Accountability Act (HIPAA) privacy and security regulations could be modified to further the HHS Secretary’s goal of promoting coordinated, value-based health care. Making meaningful reforms to HIPAA regulations is a top priority for HHS Deputy Secretary Eric Hargan, who said that this RFI is a key step in HHS’s “Regulatory Sprint to Coordinated Care.”

Specifically, OCR requests comments from covered entities and other health care providers, business associates, and individuals in identifying HIPAA regulations that may limit or discourage information sharing needed for coordinated care or to facilitate the transformation to value-based health care. The RFI requests information on any provisions of the HIPAA Rules that may present obstacles to these goals without meaningfully contributing to the privacy and security of PHI and/or patients’ ability to exercise their rights with respect to their PHI.

“We are looking for candid feedback about how the existing HIPAA regulations are working in the real world and how we can improve them,” said OCR Director Roger Severino. “We are committed to pursuing the changes needed to improve quality of care and eliminate undue burdens on covered entities while maintaining robust privacy and security protections for individuals’ health information.”

The RFI also seeks comments on specific areas of the HIPAA Privacy Rule, including:

• Encouraging information-sharing for treatment and care coordination
  • Should the exceptions to the Minimum Necessary Rule be expanded for PHI disclosures for non-treatment activities and to covered entities that are not health care providers?
• Facilitating parental involvement in care
  • OCR wants to know if there are circumstances in which parents are unable to gain access to their minor child’s health information where the child has a substance use disorder, such as opioid addiction.
• Addressing the opioid crisis and serious mental illness
  • OCR is considering separate rulemaking that would seek to encourage covered entities to share PHI with family members, caregivers, and others to combat substance use disorders.
• Accounting for disclosures of PHI for treatment, payment, and health care operations as required by the HITECH Act
  • OCR wants to know if they should require covered entities to account for their business associates’ disclosures for treatment, care, and operations or the covered entity should be allowed to refer the individual directly to the business associate.
• Changing the current requirement for certain providers to make a good faith effort to obtain a written acknowledgment of receipt of the Notice of Privacy Practices
  • OCR wants to know whether the signature and recordkeeping requirements should be eliminated and whether this elimination will reduce burdens on providers and allow for more time to focus on care coordination.

Public comments on the RFI will be due by February 11, 2019. The RFI may be downloaded from the Federal Register here.