For years, HIPAA Privacy Rule compliance has been a relatively stable exercise. That may be about to change. The U.S. Department of Health and Human Services (HHS) appears poised to finalize its long-pending proposal to revise the HIPAA Privacy Rule that could require updates to patient access processes, privacy notices, information-sharing practices, and health IT workflows. Organizations that have not revisited their HIPAA policies in recent years may soon need to do so.
Released in the final days of the first Trump administration, the proposed rule sought to reduce perceived barriers to coordinated care, facilitate family and caregiver involvement, mitigate administrative burdens on HIPAA-regulated entities, and expand individual access rights and health IT interoperability. HHS submitted the rule, which had not advanced during the Biden Administration, for final review on April 2, 2026, and the federal government listed August 2026 as the anticipated date for final agency action.
If HHS finalizes the rule as proposed, HIPAA-regulated entities can expect changes that:
- expand permissible information sharing for individual-level care coordination and case management;
- increase flexibility for information-sharing with caregivers and family members;
- modify patient access rights and electronic information-sharing requirements;
- expand interoperability-related obligations involving EHR-based exchange, APIs, and personal health applications;
- revise access-fee and fee-transparency requirements; and
- eliminate Notice of Privacy Practices (NPP) acknowledgment requirements for covered healthcare providers with direct treatment relationships and require certain updates to NPPs.
These changes will require updates to HIPAA policies, procedures, forms, and training. Of particular note, if finalized as under the proposed rule, covered health care providers may need to provide access through a secure, standards-based API when requested electronic PHI is readily available through that API and permit patients to take notes, photographs, and videos during in-person inspection of their PHI in a designated record set, subject to reasonable safeguards. NPPs also will need to be revised to update the header and add a right to discuss the NPP with a designated contact person. The original proposed rule also required advance notice of certain access and authorization fees through posted fee schedules, individualized estimates, and itemized charges.
What to do now
Pending publication of the final rule, entities may benefit from some advanced planning, identifying policies, procedures, and notices that may need updating, and operational workflow changes that may be required. This early work may help organizations effectively and efficiently make updates when compliance timelines are confirmed.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
