Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164
Revision of a currently approved collection
No
Regular
Comment filed on proposed rule and continue
06/27/2023
04/18/2023
In accordance with 5 CFR 1320, the information collection is not approved at this time. Prior to publication of the final rule, the agency should provide to OMB a summary of all comments received on the proposed information collection and identify any changes made in response to these comments.
table that charts list comparision
Inventory as of this Action
Requested
Previously Approved
03/31/2026
36 Months From Approved
03/31/2026
1,097,206,223
0
1,097,206,223
921,158,940
0
921,158,940
121,283,939
0
121,283,939
The individually identifiable health information collected is used by patients and by more than 700,000 covered entities affected by the HIPAA Privacy Rule. The information is routinely used by covered entities for treatment, payment, and health care operations. In addition, the information is used for specified public policy purposes, including research, public health, and as required by other laws.
PL:
Pub.L. 104 - 191 1
Name of Law: Health Insurance Portability and Accountability Act of 1996
1) Added a new category of prohibited uses and disclosures.
2) Adding a new requirement that, in certain circumstances, regulated entities must first obtain an attestation from the requestor that a requested use or disclosure is not for a prohibited purpose, resulting in a need to create an attestation form, update policies and procedures, update HIPAA training content, and update business associate agreements.
3) Modifying the content requirements of the Notice of Privacy Practices (NPP) to inform individuals that their PHI may not be used or disclosed for a prohibited purpose, resulting in a need for mailing the updated NPP to some individuals and posting it online.
4) Updating the number of estimated individuals requesting restrictions on disclosures of PHI due to the changed legal environment surrounding reproductive health care access.
5) Updating the number of covered entities.
6) Increasing the number of respondents requesting exceptions to state law preemption under 45 CFR 160.204 from 1 to 27 based on an expected reaction by states that have enacted restrictions on reproductive health care access.
7) Increasing the annual burden for distributing health plan NPPs to a percentage of health plan subscribers due to a 50% increase in the number of American with health coverage.
On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
(i) Why the information is being collected;
(ii) Use of information;
(iii) Burden estimate;
(iv) Nature of response (voluntary, required for a benefit, or mandatory);
(v) Nature and extent of confidentiality; and
(vi) Need to display currently valid OMB control number;
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
2023_04_18_HIPAA RHC Privacy NPRM_ICR_Supporting_Statement_FINAL.docx
164.509 Disclosures for which attestation is required