Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164

ICR 202411-0945-001

OMB: 0945-0003

Federal Form Document

Forms and Documents
Document
Name
Status
Supporting Statement A
2024-12-18
IC Document Collections
IC ID
Document
Title
Status
272168
New
272166
New
272165
New
272164
New
272163
New
272162
New
272161
New
272160
New
272159
New
272158
New
272157
New
272156
New
272155
New
272154
New
272153
New
272152
New
272151
New
272150
New
272149
New
272148
New
272147
New
272146
New
272145
New
272082
New
272081
New
264566
Unchanged
264565
Unchanged
264564
Removed
259737
Unchanged
259736
Removed
259735
Removed
259734
Removed
259733
Removed
259731
Modified
237898
Unchanged
237897
Unchanged
221884
Unchanged
221883
Unchanged
221882
Unchanged
221881
Unchanged
221880
Unchanged
221879
Unchanged
221878
Unchanged
221877
Unchanged
221876
Unchanged
221875
Unchanged
221874
Unchanged
221872
Unchanged
221871
Modified
221870
Modified
221869
Modified
221868
Modified
221866
Modified
221862
Modified
221861
Modified
221860
Modified
221859
Modified
208573
Unchanged
190153
Unchanged
190152
Unchanged
190151
Unchanged
190150
Unchanged
190149
Unchanged
190147
Unchanged
190146
Unchanged
190145
Modified
190144
Modified
190143
Modified
10428
Modified
ICR Details
0945-0003 202411-0945-001
Received in OIRA 202401-0945-002
HHS/OCR 20296
Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164
Revision of a currently approved collection   No
Regular 01/06/2025
  Requested Previously Approved
36 Months From Approved 07/31/2027
1,202,562,864 1,154,350,069
925,144,026 953,982,239
163,499,411 163,499,411

The individually identifiable health information collected is used by patients and by more than 800,000 covered entities and 1,000,000 business associates affected by the HIPAA Privacy, Security, and Breach Notification Rules. The information is routinely used by covered entities and business associates for treatment, payment, and health care operations. In addition, the information is used for specified public policy purposes, including research, public health, and as required by other laws.

PL: Pub.L. 104 - 191 1 Name of Law: Health Insurance Portability and Accountability Act of 1996
  
PL: Pub.L. 116 - 136 3221 Name of Law: Coronavirus Aid, Relief, and Economic Security Act

0945-AA22 Proposed rulemaking 90 FR 898 01/06/2025

No

64
IC Title Form No. Form Name
164.509 Disclosures for which attestation is required
164.520 Notice of Privacy Practices for Protected Health Information― Post updated notice online
164.520 Notice of Privacy Practices for Protected Health Information―Updating
164.530 Administrative Requirements-Policies & Procedures (new and updated)
164.530 Administrative Requirements―Training― 164.525 Update training content
500 or More Affected Individuals (investigating and documenting breach)
Access of Individuals to Protected Health Information (copies of PHI)
Accounting for Disclosures of Protected Health Information
Amendment of Protected Health Information (denials)
Amendment of Protected Health Information (requests)
Attestations requiring additional action
Attestations requiring investigation review
Business Associate Notice to Covered Entity – 500 or more affected individuals
Business Associate Notice to Covered Entity – Less than 500 affected individuals
Business Associate's Obtain Subcontractors' Compliance Verification
Configuration Management - Health Plan Sponsors
Configuration Management - Regulated Entities
Contingency Plan - Criticality Analysis - Health Plan Sponsors
Contingency Plan - Testing and Revision - Health Plan Sponsors
Contingency Plan- Criticality Analysis - Regulated Entities
Contingency Plan- Testing and Revision - Regulated Entities
Covered Entities Obtain Business Associates' Compliance Verification
Documentation - Review and Update
Individual Notice- Substitute Notice (posting or publishing)
Individual Notice- Written and E-mail Notice (drafting)
Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)
Individual Notice-Substitute Notice (staffing toll-free number)
Individual Notice-Written and E-mail Notice (preparing and documenting notification)
Individual Notice-Written and E-mail Notice(processing and sending)
Information System Activity Review - Documentation - Health Plan Sponsors
Information System Activity Review- Documentation - Regulated Entities
Less than 500 Affected Individuals (investigating and documenting breach)
Less than 500 Affected Individuals (investigating and documenting breach) breaches affecting <10 individuals
Maintenance Records - Health Plan Sponsors
Maintenance Records - Regulated Entities
Media Notice
Multi-factor Authentication - Health Plan Sponsors
Multi-factor Authentication - Regulated Entities
Network Segmentation - Regulated Entities
Notice of Privacy Practice for Protected Health Information (Health plans- periodic distribution of NPPs by electronic mail)
Notice of Privacy Practices for Protected Health Information (health care providers - dissemination/acknowledgement
Notice of Privacy Practices for Protected Health Information/health plan distribution paper mail
Notice of Privacy Practices for Protected Health Information―Mailing notice to 10% of subscribers at a rate of 240 notices/hour
Notice to Secretary (notice for breaches affecting 500 or more individuals)
Notice to Secretary (notice for breaches affecting fewer than 500 individuals)
Notification of Contingency Plan Activation - Health Plan Sponsors
Notification of Contingency Plan Activation - Regulated Entities
Notification of Termination of Access to ePHI - Regulated Entities
Notification of Termination of ePHI Access - Health Plan Sponsors
Ongoing Education - Health Plan Sponsors
Ongoing Education - Regulated Entities
Penetration Testing - Health Plan Sponsors
Penetration Testing - Regulated Entities
Process for Requesting Exception Determinations (states or persons)
Revise Health Plan Documents - Health Plans
Revise Policies and Procedures - Regulated Entities
Revising Business Associate Agreements
Rights to request privacy protection for protected health information
Risk Analysis - Documentation - Health Plan Sponsors
Risk Analysis-Documentation - Regulated Entities
Security Incidents (Other than Breaches) - Documentation - Health Plan Sponsors
Security Incidents (other than breaches)- Documentation - Regulated Entities
Security Incidents- Business Associate reporting of incidents (other than breach) to Covered Entities
Security Rule Compliance Audit - Regulated Entities
Update Workforce Training - Regulated Entities
Uses and Disclosures for Research Purposes
Uses and Disclosures for which Individual authorization is required
Uses and Disclosures-Organizational Requirement
Verification of Technical Safeguards by Business Associates

  Total Request Previously Approved Change Due to New Statute Change Due to Agency Discretion Change Due to Adjustment in Estimate Change Due to Potential Violation of the PRA
Annual Number of Responses 1,202,562,864 1,154,350,069 0 48,212,795 0 0
Annual Time Burden (Hours) 925,144,026 953,982,239 0 -28,838,213 0 0
Annual Cost Burden (Dollars) 163,499,411 163,499,411 0 0 0 0
Yes
Changing Regulations
Yes
Miscellaneous Actions
As a result of proposed program changes that would establish new requirements, the Department added new estimated burdens, as follows: (1) For each regulated entity to conduct a Security Rule compliance audit. (2) For each business associate (including each subcontractor) to provide verification of compliance with technical safeguards. (3) For each regulated entity to obtain verification of business associates’ and subcontractors’ compliance with technical safeguards. (5) For each regulated entity to provide notification to other regulated entities of workforce members' termination of access to ePHI. (6) For each regulated entity to deploy multi-factor authentication. (7) For each regulated entity to perform network segmentation. (8) For approximately 75 percent of regulated entities to disable unused ports and remove extraneous software. (9) For each regulated entity to conduct penetration testing. (10) For each regulated entity to notify covered entities or business associates, as applicable, upon activation of a contingency plan. (11) For each insurer and third-party administrator to update health plan documents. (12) For each regulated entity to update the content of its cybersecurity awareness and Security Rule training program. (13) For each regulated entity to update its policies and procedures. (14) For each regulated entity to update business associate agreements. (15) For each health plan sponsor that has access to ePHI to implement the Security Rule’s administrative, physical, and technical safeguards in their relevant electronic information systems. In addition, the Department is making updates and adjustments to certain estimates. The Department has revised the estimated annual burdens of compliance by: (1) Increasing the number of covered entities from 774,331 to 822,600. (2) Updating hourly wage rates from 2022 to 2023 rates. (3) Decreasing the number of respondents requesting exceptions to state law preemption under 45 CFR 160.204 from 27 to 1 to return to the previous baseline of 1 request per year. (4) Decreasing the estimated hourly burden for a business associate to report security incidents (other than breaches) to a covered entity from 20 hours per monthly report to 10 hours per monthly report. (5) Increasing the estimated number of disclosures for research from approximately 147,000 to 153,857.

$216,000
No
    No
    No
No
No
No
No
Sherri Morgan 202 774-3042 [email protected]

  No

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
 
 
 
 
 
 
 
    (i) Why the information is being collected;
    (ii) Use of information;
    (iii) Burden estimate;
    (iv) Nature of response (voluntary, required for a benefit, or mandatory);
    (v) Nature and extent of confidentiality; and
    (vi) Need to display currently valid OMB control number;
 
 
 
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
01/06/2025


© 2025 OMB.report | Privacy Policy