WPF comments on HHS proposal to change HIPAA Privacy Rule

WPF filed comments today with the Department of Health and Human Services regarding an important Notice of Proposed Rulemaking that, if adopted, will bring substantial changes to patients’ electronic health records and how they are managed, among other issues.

In general, we found much to support in the NPRM. However, there are sections of the NPRM that repeal key privacy provisions of HIPAA, and weaken others. Patients’ access to their health records is an essential element of privacy, and actions that will simplify patients’ access are generally welcome. However, not all of those actions are uniformly positive, and there can be negative consequences for patients and for the health care system in general.

Some of the tradeoffs are especially difficult because worthy goals raise conflicts and present sharp dilemmas, which we discussed in some detail in our comments. We note that some of the proposals in the NPRM, if allowed to move forward, would have the effect of repealing key privacy provisions of HIPAA, particularly § 164.510(b). We discuss this provision in more detail in the comments. At the close of these comments we included specific recommendations to mitigate some of the risks that the NPRM raises. Some of the risks, however, need to be mitigated by HHS rolling back some of the problematic provisions in this NPRM.

Read the Comments: WPF Comments HHS NPRM re: Modifications to HIPAA Privacy Rule. (21 pages, PDF)