Final Rule Implementing Proposed HIPAA Privacy Rule Changes Edges Closer
In January 2021, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published a proposed update to the HIPAA Privacy Rule – Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement.
The purpose of the update is to revise the HIPAA Privacy Rule to strengthen individuals’ rights to access their own health information, improve care coordination, and reduce the compliance burden on healthcare providers and health plans, while continuing to protect the privacy of patients. Under the Biden administration, the proposed update did not appear to be a priority for the HHS, and there have been no signs during the first year of the new Trump administration that a final rule is any closer to being published; however, that changed on January 14, 2026, when OCR Director Paula M. Stannard published a notification of Tribal consultation on the 2021 Rule in the Federal Register.
It has been five years since the proposed update to the HIPAA Privacy Rule was published in the Federal Register, and while there has been little mention of the proposed update over the past half-decade, a final rule appears to be close to publication. Ahead of the final rule, a Tribal consultation meeting will be held virtually via Zoom on February 6, 2026, pursuant to Executive Order 13175 and the HHS Tribal Consultation Policy.
The consultation will cover several different topics, with OCR seeking feedback on the proposed changes to strengthen individuals’ rights to their own health information; the measures proposed to improve care coordination and case management; the enhanced flexibilities for disclosures of patient information in emergencies and threatening circumstances; the support for the use of telecommunications relay services by individuals and workforce members who are deaf, hard of hearing, deaf-blind, or who have a speech disability; and the expanded permission to use and disclose the PHI of Armed Forces service personnel for national readiness purposes.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While the Tribal consultation is a sign of progress toward a final rule implementing some or all of the proposed changes, there are no indications at present when the final rule will be published. When and if that time comes, HIPAA-regulated entities will be given sufficient time to update their policies, procedures, and practices and provide training to the workforce on the new Privacy Rule requirements before OCR starts enforcement.
In the meantime, OCR has indicated that it is continuing with its enforcement initiatives targeting the HIPAA Right of Access provision of the HIPAA Privacy Rule, parental access to the medical records of minor children, and the risk analysis provision of the HIPAA Security Rule, and an expansion of that program to cover risk management. OCR has also indicated that a new enforcement initiative will soon be launched for the confidentiality of substance use disorder treatment records, pursuant to the recent changes to the Part 2 regulations to align them more closely with HIPAA.
