Justification for Non-substantive Change

Justification for Non-substantive Change to Existing ICR
The existing information collection request (ICR), OMB No. 0945-0003, was approved on July 9,
2024, in connection with the publication of a final rule modifying 45 CFR parts 160 and 164, HIPAA
Privacy Rule to Support Reproductive Health Care Privacy, 89 FR 32976 (April 26, 2024). The
burdens for completing the form at issue were re-approved with that ICR as part of the larger
information collection that included the HIPAA Breach Notification Rule; however, the form for
collecting the information was not appended to the ICR package. The purpose of the form, HIPAA
Breach Portal Required Information, is to provide a simplified procedure for covered entities and
business associates to report a breach of protected health information to the Secretary of HHS as
required under 45 CFR 164.408. The HIPAA Breach Portal Required Information form is available
through the HHS OCR online breach portal,
https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf.