On January 28, 2020, The Department of Health and Human Services (HHS) released a notice regarding legislative modifications made to the HIPAA Omnibus Final Rule of 2013. The announcement was about a final rule published by HHS on January 25, 2013, entitled “Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act, and the Genetic Information Non-discrimination Act; Other Modifications to the HIPAA Rules.” (2013 Omnibus Rule).
A portion of that rule was challenged in federal court, specifically the part that covered an individual’s access to protected health information. On January 23, 2020, a federal court vacated the “third-party directive” within the individual right of access. Additionally, the fee limitation will only apply to an individual’s request for access to their own records. It will not apply to an individual’s request to transmit records to a third party.
The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.
A copy of the court order in Ciox Health, LLC v. Azar, et al., No. 18-cv-0040 (D.D.C. January 23, 2020), may be found at:
https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2018cv0040-51
References: