Unless an extension is granted or the notice of proposed rulemaking (NPRM) is withdrawn, covered entities (CEs) and business associates (BAs) have until late March to submit comments on possible revisions to the privacy rule. The day after President Biden was sworn in and six weeks after it was first announced,[1] the HHS Office for Civil Rights (OCR) published the NPRM officials posted in December.[2]
A political appointee, OCR Director Roger Severino had already resigned by the time the NPRM was published, and it was a busy week before he left on Jan. 15. A flurry of other regulatory actions occurred following his departure—all of which are now subject to possible revision and withdrawal by the Biden administration. Not likely to be reviewed, however, are two new enforcement resolutions issued last month, including a $5.1 million settlement with a health plan in New York for a 2015 breach affecting 9.3 million individuals.[3]
As if this was not enough HIPAA news, the University of Texas MD Anderson Cancer Center won a major victory in court in the middle of last month when a circuit court overturned a $4.3 million fine OCR imposed for three breaches and lack of universal encryption.[4]
While leading OCR, Severino made “conscience and religious freedom” in health care a priority, issuing a number of controversial, and last-minute, proposals. Just five days before the inauguration, OCR announced it had published an NPRM to protect “infants born alive from discrimination on the basis of disability.”[5] However, this NPRM had not been published in the Federal Register as of RPP’s deadline.
The privacy rule NPRM is decidedly less controversial, and HHS leaders previously expressed confidence that its underlying goals are nonpartisan. This issue of RPP examines the care coordination provisions of the NPRM.[6]RPP previously discussed provisions that would eliminate the requirement for providers to obtain a signature when a patient is given a notice of privacy practices, which Severino called a “tremendous waste of time and effort that has caused massive confusion.”
NPRM Comment Period Open
In addition, the NPRM also would shorten the amount of time a provider has to respond to a medical records request from 30 to 15 days, which RPP has also addressed.[7]
Like other regulatory actions that were not yet in effect as of President Biden’s inauguration on Jan. 20, both the “born alive” and the HIPAA revisions NPRMs are subject to a review by Biden administration officials. Under a memorandum from the Office of Management and Budget,[8] documents not yet published must be reviewed, and those already published—like the HIPAA NPRM—are subject to a 60-day “freeze” and further review. Departments will have the option of reopening or extending comment periods on regulations that have not yet taken effect.
As of RPP’s deadline, there have been no changes to the HIPAA NPRM, and its comment deadline remains March 22. If OCR were to rescind or withdraw the NPRM, it would publish this in the Federal Register, as it would any decision to allow additional time for comments, but any such announcement could come in months from now, or longer.
The fact that Severino had left on Jan. 15 was included in a list of accomplishments that OCR published on Jan. 19.[9] OCR noted that Severino’s tenure was the longest of any directors “in the past three decades.” Severino’s recent predecessors had shorter periods due to former director Leon Rodriguez, who served from 2011 to 2014, being appointed to head the U.S. Citizenship and Immigration Services.[10] Jocelyn Samuels served from August 2014 to January 2017.
No names have been publicly floated for Severino’s replacement. Severino’s appointment came in late March 2017, the earliest in a president’s term in recent memory. At times the office has been vacant for more than a year at the start of an administration. The appointed director does not have to be confirmed by the Senate.
New Access Settlement Is Priciest
In the meantime, OCR is relying on a career agency public servant to helm the agency—Robinsue Frohboese is the acting director as well as continuing in her current role as OCR principal deputy director.[11]
Two days before his departure, Severino announced that OCR had entered into its 14th agreement with a CE over allegations it violated the privacy rule’s access requirements—its most costly to date and the first settlement of 2021.[12]
Under an initiative begun in 2019, OCR has sought to make it clear that, as Severino said in announcing the first such settlement with Bayfront Health St. Petersburg,[13] OCR officials “aim to hold the health care industry accountable for ignoring peoples’ rights to access their medical records and those of their kids.” He said at the time that “providing patients with their health information not only lowers costs and leads to better health outcomes, it’s the law.”
The newest settlement is with Banner Health of Phoenix, Arizona, and its affiliated CEs (ACEs), which agreed to pay $200,000 and implement a two-year corrective action plan (CAP).
According to OCR’s announcement of the settlement, the agency “received two complaints filed against Banner Health ACE entities alleging violations of the HIPAA Right of Access standard. The first complaint alleged that the individual requested access to her medical records in December 2017, and did not receive the records until May 2018. The second complaint alleged that the individual requested access to an electronic copy of his records in September 2019, and the records were not sent until February 2020. OCR’s investigations determined that Banner Health ACE entities’ failure to provide timely access to the requested medical records were potential violations of the HIPAA right of access standard.”
Future of Access Initiative Uncertain
Banner officials did not respond to RPP’s requests for comment on the settlement or the complaints that led up to it.
The CAP contains requirements that are now standard in such resolution agreements. Banner is to “review and, to the extent necessary, revise its written policies, procedures, and other written communications related to the provision of access to medical records,” submit such revisions to OCR for approval, and train its workforce on the new policies.[14]
It also must send OCR an implementation update at four months from the effective date of the CAP and annually for the next two years, as well as report to the agency any alleged violations of the access policy and actions taken within 30 days of such incidents.
Unlike a couple of the other organizations that also reached settlements over access complaints, Banner is not required to send OCR a running list of how it handled each access request received.
Are 14 settlements enough to get across Severino’s points on access? Time will tell.
Although it will be up to the incoming OCR director to decide whether to continue with this pattern of enforcement, Severino said in the Banner announcement that the settlement “signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records.”