The HIPAA Privacy Rule establishes important standards for how healthcare organizations may use and disclose protected health information (PHI), as well as the rights individuals have over their health information.
In 2021, the U.S. Department of Health and Human Services (HHS) proposed significant modifications to the HIPAA Privacy Rule intended to strengthen individuals' access to their health information, improve care coordination and case management, facilitate appropriate information sharing, and reduce certain administrative burdens.
As of August 2026, this rulemaking, identified as RIN 0945-AA00, has advanced to the Final Rule Stage. Although the rulemaking has progressed, a final rule establishing these changes has not yet taken effect.
For healthcare providers and other HIPAA Covered Entities, the potential changes could eventually affect policies, procedures, patient requests, Notices of Privacy Practices, and workforce training.
Here are some of the most important proposed HIPAA Privacy Rule changes healthcare organizations should understand.
1. Patients Could Have Faster Access to Their Health Records
One of the most significant proposed changes involves an individual's HIPAA right of access.
Under the current Privacy Rule, Covered Entities generally must act on an individual's request to access PHI within 30 calendar days. The proposal would shorten that timeframe to 15 calendar days, with the possibility of an extension of no more than an additional 15 calendar days.
The proposal would also strengthen individuals' ability to inspect their PHI in person. Individuals would be permitted to take notes or use personal resources to capture images of their records while inspecting them.
If finalized as proposed, the shorter response deadline could require healthcare organizations to review existing medical-record request procedures and workflows to ensure requests can be processed efficiently.
2. Electronic Access to PHI Could Become Easier
The proposed changes also address how electronic protected health information (ePHI) must be provided.
HIPAA generally requires Covered Entities to provide PHI in the form and format requested by an individual when it is readily producible in that form and format. The proposal would provide additional clarity around what "readily producible" means.
For example, if another federal or state law requires PHI to be provided in a particular electronic form and format, that format would be considered readily producible for HIPAA purposes.
Similarly, if a Covered Entity or its technology provider has implemented a secure, standards-based application programming interface (API) capable of providing ePHI in the format used by an individual's personal health application, that format could also be considered readily producible.
The proposal also introduces definitions for Electronic Health Record and Personal Health Application to support these modernized access requirements.
3. Some Identity Verification Practices Could Be Prohibited
HIPAA requires Covered Entities to take reasonable steps to verify the identity and authority of someone requesting PHI.
The proposed Privacy Rule changes would maintain the verification requirement but prohibit measures that create unnecessary burdens when a less burdensome method is practicable.
Examples of potentially unreasonable verification practices include:
- Requiring an individual to notarize an access request
- Requiring an individual to appear in person when practical remote verification is available
- Using other verification procedures that create barriers or unnecessarily delay an individual's exercise of HIPAA rights
Covered Entities could still use reasonable verification procedures, such as requiring individuals to complete a standard form requesting information that is actually necessary to process the request.
4. HIPAA Could Make Care Coordination and Case Management Easier
Several proposed changes are intended to reduce uncertainty around sharing PHI for care coordination and case management.
The definition of Health Care Operations would be clarified to make clear that permissible care coordination and case management activities may apply to both groups of patients and individual patients.
The proposal would also create an exception to HIPAA's minimum necessary standard for certain individual-level care coordination and case management activities.
Generally, the minimum necessary standard requires a Covered Entity to limit certain uses, disclosures, and requests for PHI to the minimum amount necessary to accomplish the intended purpose.
Under the proposal, this requirement would not apply to certain uses, disclosures, or requests by a health plan or Covered Health Care Provider for individual-level care coordination and case management.
If finalized as proposed, these changes could give healthcare organizations greater flexibility when coordinating an individual's care while reducing uncertainty about how the minimum necessary standard applies.
5. Providers Could Have Greater Ability to Coordinate With Social Service Organizations
Healthcare needs frequently extend beyond services provided in a traditional medical setting.
The proposed Privacy Rule changes would clarify the ability of Covered Entities to disclose relevant PHI to organizations providing health-related services to an individual, including certain social service agencies, community-based organizations, and home and community-based service providers.
Depending on the circumstances, this could include organizations providing services such as:
- Food assistance
- Housing support
- Counseling
- Other health-related social services
The proposed permission would apply specifically to individual-level care coordination and case management. It would not establish a broad permission for population-level data sharing, and the recipient would need to provide health-related services to the individual.
6. "Good Faith" Could Replace "Professional Judgment" in Certain Situations
Another proposed change would replace certain HIPAA provisions that rely on a healthcare provider's professional judgment with a standard based on a Covered Entity's good faith belief.
This distinction could have practical consequences.
For example, a Covered Entity could disclose PHI directly relevant to a family member's or caregiver's involvement in an individual's care or payment for care when the Covered Entity has a good faith belief that the disclosure is in the individual's best interests.
The good faith standard could also be used by a broader range of appropriately trained workforce members rather than being limited to licensed healthcare professionals exercising professional judgment.
This proposed change is intended to facilitate appropriate information sharing with family members and caregivers, including in situations involving incapacity, health emergencies, serious mental illness, or substance use disorders.
Note: Other federal or state confidentiality requirements may also apply depending on the information involved, including additional requirements applicable to certain substance use disorder records.
7. The Standard for Threats to Health or Safety Could Change
HIPAA currently permits certain PHI disclosures when necessary to prevent or lessen a serious and imminent threat to a person's or the public's health or safety.
The proposal would replace "serious and imminent" with "serious and reasonably foreseeable."
If finalized as proposed, this would create a more flexible standard by potentially allowing appropriate disclosures before a threat becomes imminent.
Healthcare organizations would need to ensure that relevant workforce members understand the circumstances under which such disclosures may be permitted and how organizational policies address them.
8. Notice of Privacy Practices Requirements Could Be Updated
The HIPAA Notice of Privacy Practices (NPP) would also undergo several changes under the proposal.
The proposed modifications are intended to make the Notice easier for individuals to understand and provide clearer information about their HIPAA rights.
Among other changes, the NPP would more prominently explain:
- How an individual's health information may be used and disclosed
- The individual's rights regarding their health information
- How individuals can obtain copies of their records
- How to file a HIPAA complaint
- How to obtain a copy of the Notice
- How to contact a designated person to discuss the Notice
The proposal would also eliminate the current requirement for certain direct treatment providers to obtain an individual's written acknowledgment of receipt of the NPP.
Instead, individuals would have an explicit right to discuss the NPP with a person designated by the Covered Entity.
Healthcare organizations should keep in mind that other changes to HIPAA NPP requirements have occurred separately from this proposal. Organizations should continue following the NPP requirements currently in effect and should not rely on this proposed rule as a complete description of current NPP obligations.
9. Other Proposed HIPAA Privacy Rule Changes
The proposal contains several additional changes healthcare organizations should be aware of.
These include expressly permitting certain disclosures to Telecommunications Relay Services (TRS) communications assistants serving individuals who are deaf, hard of hearing, deaf-blind, or who have a speech disability. The definition of Business Associate would also be modified to exclude qualifying TRS providers.
The proposal would also expand an existing Armed Forces permission for the use or disclosure of PHI to cover all uniformed services, including the U.S. Public Health Service Commissioned Corps and the National Oceanic and Atmospheric Administration Commissioned Officer Corps.
What Should Healthcare Providers Do Now?
Because these provisions are not currently effective requirements, healthcare organizations should not revise their HIPAA policies and procedures solely to implement the proposed changes at this time.
However, Covered Entities can begin evaluating how their compliance programs could be affected if HHS ultimately finalizes the changes.
Healthcare organizations should consider the following:
- Continue complying with current HIPAA requirements. The proposed changes summarized in this article do not replace the requirements currently in effect.
- Review right-of-access procedures. Consider whether current medical-record request workflows could accommodate a shorter response period if one is ultimately required.
- Review electronic access capabilities. Understand how your organization currently provides electronic PHI and what technologies are available to support patient access.
- Identify potentially affected compliance materials. Determine which policies, forms, Notices of Privacy Practices, procedures, and training materials could require revision.
- Monitor HHS and OCR developments. Watch for publication of a final rule and, importantly, its effective and compliance dates.
- Review the final requirements before implementing changes. A final rule may differ from the original proposal, so organizations should compare any final requirements against existing policies before making updates.
Other areas worth reviewing include identity verification procedures, care coordination and case management policies, minimum necessary policies and procedures, disclosures involving family members and caregivers, and health and safety disclosures.
Preparing for Changes to the HIPAA Privacy Rule
The proposed HIPAA Privacy Rule modifications reflect a broader effort to improve individuals' access to their health information while reducing unnecessary barriers to care coordination and appropriate information sharing.
If finalized, the changes could have meaningful operational implications for healthcare providers, health plans, and other HIPAA-regulated organizations.
As of August 2026, these proposed changes have not taken effect. However, with the rulemaking now at the Final Rule Stage, healthcare organizations should continue monitoring HHS and OCR for further developments.
If HHS publishes a final rule, healthcare providers should carefully review the final requirements and applicable compliance dates before updating their HIPAA policies, procedures, forms, Notices of Privacy Practices, and workforce training.
Stay Up to Date with Gamma's HIPAA Documentation Programs
Gamma Compliance Solutions' HIPAA Documentation Programs provide healthcare organizations with practical resources to help establish and maintain a HIPAA compliance program, including customizable policies, procedures, forms, and other compliance documentation.
Our programs also include access to ongoing regulatory updates, helping your organization stay informed of important HIPAA developments such as these and providing updated compliance resources when applicable requirements change.
Sources and Additional Resources
- U.S. Department of Health and Human Services, Office for Civil Rights: HIPAA Privacy Rule and Care Coordination
- U.S. Department of Health and Human Services: Proposed Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement
- Federal regulatory materials for RIN 0945-AA00
This article is provided for informational and educational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel regarding their specific compliance obligations.