CHIME; Providers Express Concerns About Proposed HIPAA Privacy Rule Update
A coalition of 17 health systems, hospitals, and clinics led by the College of Healthcare Information Management Executives (CHIME) wrote a letter to HHS Secretary Robert F. Kennedy, Jr., this week, voicing their concern about some of the proposed changes to the HIPAA Privacy Rule to support coordinated care and individual engagement.
The HHS’ Office for Civil Rights (OCR) is due to issue a final rule implementing proposed updates to the HIPAA Privacy Rule. The Notice of Proposed Rulemaking (NPRM) was issued by OCR in the final days of the first Trump Administration; comments were collected by OCR during the Biden administration, then the proposed update stalled. OCR rekindled the proposed update in President Trump’s second term, and the final rule for the HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens was penciled in for an August 2026 release. OCR has not provided any further updates on when it plans to release the final rule, other than previous statements confirming that a final rule is a regulatory priority.
The coalition explains in the letter that efforts to expand patient access to health technology and improve patient engagement could restrict a healthcare provider’s ability to confirm that a third-party application has been authorized by the patient to receive their protected health information. Further, concern was raised about the proposal to remove unreasonable identity verification barriers to individuals exercising their HIPAA Rights, including directing copies of their PHI to third parties. The concerns are legitimate and need to be addressed, as while it is important to improve access to patient data, limiting the ability of providers to verify identity could open the door to bad actors seeking access to patient records.
“A final rule that categorically prohibits providers from confirming whether a patient has authorized a third-party application to receive PHI would represent a material departure from the proposed approach,” stated the coalition in the letter. “Although the NPRM solicited comments on unreasonable verification practices, it did not clearly notify affected parties that OCR might prohibit reasonable confirmation of patient authorization altogether.” Should that be the case, it would be a significant departure from the NPRM.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
“These concerns are further compounded by any presumption that presentation of an IAL2 credential, standing alone, satisfies all verification necessary to effectuate an application-initiated request for PHI. Identity proofing, patient matching, and verification of authority are analytically and operationally distinct functions,” explained the coalition in the letter. “Although an IAL2 credential may provide sufficient assurance as to the identity of the individual, it does not necessarily establish that the individual has been accurately matched to the appropriate medical record, nor does it establish the nature, scope, duration, or validity of the individual’s authorization or direction permitting a third-party application to obtain the requested information. Treating IAL2 credentialing as sufficient for all verification purposes, while restricting providers’ ability to confirm patient authorization, would introduce additional substantive limitations that were not clearly contemplated in the 2021 NPRM.”
The coalition stated that changes to the HIPAA Privacy Rule to improve patient access and support innovation should not come at the expense of providers’ ability to responsibly protect patient information. There is concern that the proposed requirements could increase the risk of privacy breaches and place healthcare providers at risk of regulatory penalties and lawsuits.
The coalition requests that OCR preserve provider discretion to take reasonable, risk-appropriate steps to confirm that a patient has authorized a third-party application to receive their PHI, including confirming that authorization directly with the patient when appropriate. They also request that OCR issue clear guidance and provide examples of what OCR considers to be unreasonable verification barriers as opposed to legitimate provider safeguards.
Should OCR plan to implement a policy that deviates from the original NPRM, the coalition said an additional notice and comment period on the rulemaking would be appropriate. If that is not the case, OCR should ensure that explicit, meaningful enforcement protections are established for providers acting in good faith regarding patient-directed disclosures of their PHI.
