Research universities, academic medical centers and institutions with components that comply with HIPAA may wish to comment on a new notice of proposed rulemaking (NPRM)^[1] that was published just a day after President Biden was inaugurated.

The NPRM’s appearance in the Jan. 21 Federal Register caught some by surprise, as the long delay after it was announced^[2] by HHS and its Office for Civil Rights (OCR) spurred speculation it would not be officially released.

Coming just after a new administration took office and given that it is not yet finalized, the NPRM is subject to additional review by HHS officials, but, to date, it is still open for comment. Unless changed—a two-month extension is possible—the comment deadline is March 22.

While there are few, if any, provisions that relate specifically to research (there is one question), significant changes could be required overall if the NPRM is adopted as proposed.

The three primary areas of proposed changes relate to notices of privacy practices (NPPs) that HIPAA covered entities have to distribute; patients’ access to their medical records; and care coordination, with some significant revisions to when providers (or research physicians, for that matter) could notify loved ones in the event of a medical emergency or if it is feared that patients may harm themselves or others.

NPPs are given to first-time patients, and direct treatment providers currently are required to obtain a signature from the individual, a legal representative or family member as appropriate. Signed NPPs, which generally describe how organizations use and share protected health information (PHI), also are subject to a seven-year document retention requirement. The NPRM does away with both.