The notice of proposed rulemaking (NPRM) revising the privacy rule has some provisions worth supporting, but shortening by half the time frame providers would have to respond to an access request isn’t one of them. And if the HHS Office for Civil Rights (OCR) isn’t careful, it may add to the already confusing and burdensome “patchwork of health information privacy requirements” in effect today.

That’s the word from the American Hospital Association (AHA), which released its comments^[1] on OCR’s Jan. 21 NPRM.^[2] AHA published its feedback on March 10, two weeks prior to the previous deadline of March 26. Stakeholders and other interested organizations have until May 6 to submit comments, as the deadline has been extended. The powerful association’s thoughts on the NPRM could provide guidance to other organizations and entities that are still composing their comments.

AHA did find a few things it liked, such as the proposed elimination of signatures on notices of privacy practices (NPPs) that direct treatment providers are required to give to patients. But it warned that OCR needs to work with other federal agencies to create a template and allow enough time for compliance.

“As a preface to our specific comments on the NPRM proposals, we urge HHS to take a holistic approach in its deliberations related to the NPRM. The HIPAA regulations do not operate in a vacuum,” according to comments submitted by Melinda Reid Hatton, AHA general counsel. “It is imperative that HHS acknowledge in the final regulations the intersection of the regulations under HIPAA, the Office of the National Coordinator for Health Information Technology (ONC) Cures Act interoperability and information blocking requirements, and the Part 2 regulations under Title 42 of the Code of Federal Regulations (CFR): Confidentiality of Substance Use Disorder Patient Records (Part 2).”