OMB control number

Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164

OMB 0945-0003 · HHS/OCR.

OMB 0945-0003

The individually identifiable health information collected is used by patients and by more than 700,000 covered entities affected by the HIPAA Privacy Rule. The information is routinely used by covered entities for treatment, payment, and health care operations. In addition, the information is used for specified public policy purposes, including research, public health, and as required by other laws.

The latest form for Standards for Privacy of Individually Identifiable Health Information and Supporting Regulations at 45 CFR Parts 160 and 164 expires 2027-07-31 and is listed under ICR 202509-0945-001.

Latest Forms, Documents, and Supporting Material

Latest forms, documents, and information collections
Document	Type
Justification for Non-substantive Change.pdf	Justification for No Material/Nonsubstantive Change
Justification for Non-substantive Change.pdf	Justification for No Material/Nonsubstantive Change
Supplemental Document HIPAA_Breach_Portal_Questions.pdf	Supplementary Document
Supplemental Document HIPAA_Breach_Portal_Questions.pdf	Supplementary Document
2024_04_30_HIPAA RHC Privacy FR_ICR_Supporting_Statement CLEAN.docx	Supporting Statement A
2024_04_30_HIPAA RHC Privacy FR_ICR_Supporting_Statement CLEAN.docx	Supporting Statement A
Attestations requiring additional action	Information collection
Attestations requiring investigation review	Information collection
Notice of Privacy Practices for Protected Health Information―Mailing notice to 10% of subscribers at a rate of 240 notices/hour	Information collection
164.509 Disclosures for which attestation is required	Information collection
164.530 Administrative Requirements―Training― 164.525 Update training content	Information collection
164.530 Administrative Requirements-Policies & Procedures (new and updated)	Information collection
164.520 Notice of Privacy Practices for Protected Health Information― Post updated notice online	Information collection
164.520 Notice of Privacy Practices for Protected Health Information―Updating	Information collection
164.504 Revising Business Associate Agreements	Information collection
Business Associate Notice to Covered Entity – Less than 500 affected individuals	Information collection
Business Associate Notice to Covered Entity – 500 or more affected individuals	Information collection
Less than 500 Affected Individuals (investigating and documenting breach) breaches affecting <10 individuals	Information collection
Less than 500 Affected Individuals (investigating and documenting breach)	Information collection
500 or More Affected Individuals (investigating and documenting breach)	Information collection
Notice to Secretary (notice for breaches affecting fewer than 500 individuals)	Information collection
Notice to Secretary (notice for breaches affecting 500 or more individuals)	Information collection
Media Notice	Information collection
Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)	Information collection
Individual Notice-Substitute Notice (staffing toll-free number)	Information collection
Individual Notice- Substitute Notice (posting or publishing)	Information collection
Individual Notice-Written and E-mail Notice(processing and sending)	Information collection
Individual Notice-Written and E-mail Notice (preparing and documenting notification)	Information collection
Individual Notice- Written and E-mail Notice (drafting)	Information collection
Documentation - Review and Update	Information collection
Security Incidents- Business Associate reporting of incidents (other than breach) to Covered Entities	Information collection
Maintenance Records	Information collection
Contingency Plan- Criticality Analysis	Information collection
Contingency Plan- Testing and Revision	Information collection
Security Incidents (other than breaches)- Documentation	Information collection
Security Reminders- Periodic Updates	Information collection
Information System Activity Review- Documentation	Information collection
Risk Analysis-Documentation	Information collection
Rights to request privacy protection for protected health information	Information collection
Accounting for Disclosures of Protected Health Information	Information collection
Amendment of Protected Health Information (denials)	Information collection
Amendment of Protected Health Information (requests)	Information collection
Access of Individuals to Protected Health Information (copies of PHI)	Information collection
Notice of Privacy Practice for Protected Health Information (Health plans- periodic distribution of NPPs by electronic mail)	Information collection
Notice of Privacy Practices for Protected Health Information (health care providers - dissemination/acknowledgement	Information collection
Notice of Privacy Practices for Protected Health Information/health plan distribution paper mail	Information collection
Uses and Disclosures for Research Purposes	Information collection
Uses and Disclosures for which Individual authorization is required	Information collection
Uses and Disclosures-Organizational Requirement	Information collection
Process for Requesting Exception Determinations (states or persons)	Information collection

All Historical Document Collections

Historical document collections
Reference	Filing	Received	Action
202509-0945-001	No material or nonsubstantive change to a currently approved collection	2025-11-13
202411-0945-001	Revision of a currently approved collection	2025-01-06
202401-0945-002	Revision of a currently approved collection	2024-04-30	Approved without change
202304-0945-001	Revision of a currently approved collection	2023-04-18	Comment filed on proposed rule and continue
202211-0945-003	Extension without change of a currently approved collection	2023-01-23	Approved with change
202211-0945-001	Revision of a currently approved collection	2022-12-02	Comment filed on proposed rule and continue
202011-0945-001	Revision of a currently approved collection	2021-03-01	Comment filed on proposed rule and continue
201909-0945-001	Extension without change of a currently approved collection	2019-09-30	Approved with change
201710-0945-002	No material or nonsubstantive change to a currently approved collection	2017-10-17	Approved without change
201603-0945-001	Revision of a currently approved collection	2016-06-10	Approved without change
201309-0945-001	Revision of a currently approved collection	2013-09-10	Approved without change
201302-0945-001	Extension without change of a currently approved collection	2013-02-01	Approved without change

OMB Details

Process for Requesting Exception Determinations (states or persons)

Federal Enterprise Architecture: Health - Health Care Services