OMB Extends Review of HIPAA/HITECH Rule
By Anna Kraus and Rachel Grunberger
The long-awaited final rule implementing changes to the Health Insurance Portability and Accountability Act (HIPAA) regulations mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act has been delayed once again. Although the rule was expected by July, the Office of Management and Budget (OMB) has updated its website to note that the review period for the rule has been extended.
OMB had received the rule from the Department of Health and Human Services (HHS) on March 24, 2012, and was expected to complete its review within 90 days, as required by Executive Order 12866. According to the OMB website, however, the 90-day review period “may be extended indefinitely by the head of the rulemaking agency; alternatively, the OMB Director may extend the review period on a one-time basis for no more than 30 days.” It is not known whether HHS or OMB extended the review period for the HIPAA/HITECH Rule.
As we previously reported, HHS is calling the rule an “omnibus” regulation because it will finalize four different rulemakings:
- the proposed rule issued in July 2010 implementing changes to the HIPAA Privacy and Security Rules mandated by the HITECH Act, as well as other changes;
- the interim final breach notification rule issued in August 2009;
- the interim final enforcement rule issued in October 2009; and
- the proposed rule issued in October 2009 implementing changes to the HIPAA Privacy Rule mandated by the Genetic Information Nondiscrimination Act.
The rule is not expected to address the proposed rule concerning the accounting of disclosures requirement under the HIPAA Privacy Rule, which HHS issued in May 2011.
As OMB continues to review the rule, covered entities and business associates should also continue their efforts to ensure they are positioned to implement the changes expected in the regulations, which we have discussed in previous posts. HHS has indicated that it will likely begin enforcing the final rule 180 days after it becomes effective. We will continue to report on developments related to the final rule. In the meantime, if you have any questions about proposed changes, please contact our health privacy team.