{"description":"Documents matching 'hipaa exceptions process'","count":1044,"total_pages":50,"next_page_url":"https://www.federalregister.gov/api/v1/documents?conditions%5Bterm%5D=hipaa+exceptions+process&format=json&page=2","results":[{"title":"Notification Regarding the Use of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Administrative Simplification Standards Exceptions Process by the Health Level Seven (HL7) International Da Vinci Project (Da Vinci) and the Availability of the Da Vinci Report","type":"Notice","abstract":"This notice provides the public with information about the availability and location of the Health Level Seven (HL7) International Da Vinci Project (Da Vinci) Report, which includes test results from the use of alternative standards for Referral Certification and Authorization and Eligibility for Health Plan transactions approved under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) exceptions process.","document_number":"2025-07386","html_url":"https://www.federalregister.gov/documents/2025/04/29/2025-07386/notification-regarding-the-use-of-the-health-insurance-portability-and-accountability-act-of-1996","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-04-29/pdf/2025-07386.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-07386.pdf?1745612109","publication_date":"2025-04-29","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"technology. \n \n Additional information about the exception request and approval process can be found at: \n https://www.cms.gov/files/document/guidance-letter-exception-process.pdf. \n \n \n Inquiries regarding the exception request and approval process can be sent to: \n AdministrativeSimplificationException@cms.hhs.gov. \n \n II. Exception Request \n \n On March 10, 2021, Health Level Seven (HL7) International Da Vinci Project (Da Vinci) submitted a request for an exception from the requirements to use the HIPAA-adopted standards for referral certification"},{"title":"HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information","type":"Proposed Rule","abstract":"The Department of Health and Human Services (HHS or \"Department\") is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Security Standards for the Protection of Electronic Protected Health Information (\"Security Rule\") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: changes in the environment in which health care is provided; significant increases in breaches and cyberattacks; common deficiencies the Office for Civil Rights has observed in investigations into Security Rule compliance by covered entities and their business associates (collectively, \"regulated entities\"); other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and court decisions that affect enforcement of the Security Rule.","document_number":"2024-30983","html_url":"https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-01-06/pdf/2024-30983.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-30983.pdf?1735334119","publication_date":"2025-01-06","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"only media on which data may be recorded, but also media on which data may be maintained or processed. \n \n Generally, data is either at rest, in transit, or in process (\n e.g., \n being worked on, in use, being modified in memory, or being updated).\n 342 \n \n After the data is no longer in use, it is either maintained or transmitted. It is especially important for entities to protect data in process because generally, data must be unencrypted to be processed, making this a time when it is particularly vulnerable to a breach or other security incident"},{"title":"Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA), National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard; Updates to Compliance and Other Related Dates","type":"Rule","abstract":"This document updates compliance and other dates presented in the final rule that appeared in the December 13, 2024 Federal Register titled \"Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard\" to conform with the subsequent final rule that appeared in the February 11, 2025 Federal Register.","document_number":"2025-15958","html_url":"https://www.federalregister.gov/documents/2025/08/21/2025-15958/administrative-simplification-modifications-of-health-insurance-portability-and-accountability-act","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-08-21/pdf/2025-15958.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-15958.pdf?1755693975","publication_date":"2025-08-21","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"rulemaking process, and consider this input prior to finalization. Exceptions to these requirements are available under section 553(b)(A) and (B) of the APA when a rule is interpretative, a general statement of policy, or concerns agency organization, procedure or practice; or when the agency for good cause finds that notice and comment are impracticable, unnecessary, or contrary to public interest. In addition, section 553(d) of the APA requires a 30-day delay in effective date after issuance or publication of a rule, with exceptions available under"},{"title":"Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard; Delay of Effective Date","type":"Rule","abstract":"In accordance with the Presidential memorandum of January 20, 2025, titled \"Regulatory Freeze Pending Review,\" the effective date of the final rule titled \"Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard\" is delayed until April 14, 2025. That final rule adopted updated versions of the retail pharmacy standards for electronic transactions adopted under the Administrative Simplification subtitle of HIPAA, which constitute modifications to the adopted standards for the following retail pharmacy transactions: health care claims or equivalent encounter information; eligibility for a health plan; referral certification and authorization; and coordination of benefits. It also adopted a modification to the standard for the Medicaid pharmacy subrogation transaction.","document_number":"2025-02511","html_url":"https://www.federalregister.gov/documents/2025/02/11/2025-02511/administrative-simplification-modifications-of-health-insurance-portability-and-accountability-act","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-02-11/pdf/2025-02511.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-02511.pdf?1739195114","publication_date":"2025-02-11","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"“Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard” is delayed until April 14, 2025. That final rule adopted updated versions of the retail pharmacy standards for electronic transactions adopted under the Administrative Simplification subtitle of HIPAA, which constitute modifications to the adopted standards for the following retail pharmacy transactions:"},{"title":"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Interoperability Standards and Prior Authorization for Drugs for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, and Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges","type":"Proposed Rule","abstract":"These proposals are intended to improve the electronic exchange of health care data and streamline processes related to prior authorization by increasing the interoperability of systems used across the health care industry. We are proposing new requirements for Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children's Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs), including issuers that offer small group market QHPs on the Federally-facilitated Small Business Health Options Program (FF- SHOP) Exchanges (hereinafter referred to as \"small group market QHP issuers on the FF-SHOPs\") (collectively \"impacted payers\"), to make available electronic prior authorization for drugs. We are also proposing to extend many existing interoperability requirements for the prior authorization of non-drug items and services to include prior authorizations for drugs to further reduce patient and provider burden. We are also proposing to require impacted payers to report their application programming interfaces (API) endpoints and related information for the Patient Access, Provider Directory, Provider Access, Payer-to-Payer, and Prior Authorization APIs to CMS. To help assess the impact of our policies, we are proposing to collect API usage metrics. In addition, we are proposing to apply the existing interoperability requirements to small group market QHP issuers on the FF-SHOPs as impacted payers. To improve impacted payers' ability to exchange health information while continuing CMS's drive toward interoperability, we are proposing to require certain Health Level Seven (HL7[supreg]) Fast Healthcare Interoperability Resources (FHIR[supreg]) implementation guides (IGs) that are currently recommended. In addition, HHS is proposing to adopt the HL7 FHIR base standard and certain associated specifications and IGs as the Health Insurance Portability and Accountability Act of 1996 (hereinafter referred to as \"HIPAA\") (Pub. L. 104-191, enacted Aug. 21, 1996) standards for dental, professional, and institutional \"referral certification and authorization\" transactions and \"eligibility for a health plan\" transactions associated with prior authorization. We are proposing to add a definition for \"failure to report,\" which would allow CMS to impose a civil monetary penalty (CMP) on applicable manufacturers or applicable group purchasing organizations (GPOs) if those entities fail to grant CMS timely access to documents for the purposes of an audit. Finally, ONC is using this rulemaking to propose to adopt updated versions of certain health information technology (health IT) standards and specifications for HHS use, such as CMS's interoperability requirements, to support a more robust health IT infrastructure.","document_number":"2026-07205","html_url":"https://www.federalregister.gov/documents/2026/04/14/2026-07205/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-standards","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-04-14/pdf/2026-07205.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-07205.pdf?1775852111","publication_date":"2026-04-14","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"},{"raw_name":"Office of the Secretary"}],"excerpts":"final rule was finalized and today, the existing HIPAA standard for prior authorization transactions is the X12N 278 transaction standard. We finalized the exemption process with the understanding that a HIPAA-compliant X12N 278 transaction standard would be an acceptable alternative to meet that requirement. However, if HHS's HIPAA proposals in section II.H. are finalized, that standard would no longer be HIPAA-compliant as of the finalized compliance date.\n \n \n Because the purpose of the HIPAA Administrative Simplification provisions is to ensure"},{"title":"HIPAA Privacy Rule To Support Reproductive Health Care Privacy","type":"Rule","abstract":"The Department of Health and Human Services (HHS or \"Department\") is issuing this final rule to modify the Standards for Privacy of Individually Identifiable Health Information (\"Privacy Rule\") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The Department is issuing this final rule after careful consideration of all public comments received in response to the notice of proposed rulemaking (NPRM) for the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (\"2023 Privacy Rule NPRM\") and public comments received on proposals to revise provisions of the HIPAA Privacy Rule in the NPRM for the Confidentiality of Substance Use Disorder (SUD) Patient Records (\"2022 Part 2 NPRM\").","document_number":"2024-08503","html_url":"https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-08503.pdf?1713816919","publication_date":"2024-04-26","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Birth, or Death \n \n Section 1178(a) of the SSA provides that HIPAA generally preempts contrary state laws with certain limited exceptions, such as those described in section 1178(b).\n 201 \n \n Specifically, section 1178(b) excepts from HIPAA's general preemption authority laws that provide for certain public health reporting, such as the reporting of disease or injury, birth, or death.\n 202 \n \n HIPAA does not define the terms in section 1178(b) that govern the scope of this exception to HIPAA's general preemption authority, nor has the Department previously"},{"title":"Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard","type":"Rule","abstract":"This final rule adopts updated versions of the retail pharmacy standards for electronic transactions adopted under the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These updated versions are modifications to the currently adopted standards for the following retail pharmacy transactions: health care claims or equivalent encounter information; eligibility for a health plan; referral certification and authorization; and coordination of benefits. This final rule also adopts a modification to the standard for the Medicaid pharmacy subrogation transaction.","document_number":"2024-29138","html_url":"https://www.federalregister.gov/documents/2024/12/13/2024-29138/administrative-simplification-modifications-of-health-insurance-portability-and-accountability-act","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-12-13/pdf/2024-29138.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-29138.pdf?1734011124","publication_date":"2024-12-13","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":" we sometimes refer to this statute as the “original” HIPAA. \n Section 1172(a) of the Act states that “[a]ny standard adopted under [HIPAA] shall apply, in whole or in part, to . . . (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a [HIPAA transaction],” which are collectively referred to as “covered entities.” Generally, section 1172 of the Act requires any standard adopted under HIPAA to be developed, adopted, or modified by a standard setting"},{"title":"Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures","type":"Rule","abstract":"This final rule implements requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010, enacted on March 30, 2010--collectively, the Affordable Care Act. Specifically, this final rule adopts standards for health care claims attachments transactions, which will support health care claims transactions, and a standard for electronic signatures to be used in conjunction with health care claims attachments transactions.","document_number":"2026-05676","html_url":"https://www.federalregister.gov/documents/2026/03/24/2026-05676/administrative-simplification-adoption-of-standards-for-health-care-claims-attachments-transactions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-03-24/pdf/2026-05676.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-05676.pdf?1774037709","publication_date":"2026-03-24","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"utilize the LOINC code set for HIPAA Attachments (87 FR 78445). \n In the proposed rule, we included an overview on tools available from Regenstrief to support utilization of the LOINC for HIPAA Attachments (87 FR 78445). \n \n Comment: \n Multiple commenters supported the use of the LOINC for HIPAA Attachments, with some stating that LOINC enables health plans to request documents, which will reduce processing delays caused by current inefficient document request processes. A commenter stated that the use of LOINC for HIPAA Attachments is logical, as Regenstrief"},{"title":"Health Data, Technology, and Interoperability: Protecting Care Access","type":"Rule","abstract":"This final rule has finalized certain proposals from the Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability Proposed Rule (HTI-2 Proposed Rule) and in doing so supports the access, exchange, and use of electronic health information. Specifically, this final rule amends the information blocking regulations to revise two existing information blocking exceptions and establish an additional reasonable and necessary activity that does not constitute information blocking referred to as the Protecting Care Access Exception.","document_number":"2024-29683","html_url":"https://www.federalregister.gov/documents/2024/12/17/2024-29683/health-data-technology-and-interoperability-protecting-care-access","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-12-17/pdf/2024-29683.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-29683.pdf?1734356733","publication_date":"2024-12-17","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Access Exception, finalized in this rule do not change or conflict with any condition of the Preventing Harm Exception in § 171.201. We emphasize that the Preventing Harm Exception and the Protecting Care Access Exception operate independently of one another and of all other exceptions. An actor's practice does not need to satisfy any portion of any other exception in order to satisfy the Preventing Harm Exception. Likewise, an actor's practice need not satisfy any portion of any other exception to satisfy the Protecting Care Access Exception. We refer"},{"title":"Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity","type":"Proposed Rule","abstract":"This proposed rule focuses on deregulatory actions identified in HHS regulations regarding Health information technology standards, implementation specifications, and certification criteria and certification programs for health information technology, and information blocking. This proposed rule seeks to reduce burden, offer flexibility to both developers and providers, and support innovation through the removal and revisions of certain certification criteria and regulatory provisions. This proposed rule also seeks to address reported misuse and abuse of information blocking definitions and exceptions.","document_number":"2025-23896","html_url":"https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-12-29/pdf/2025-23896.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-23896.pdf?1766438109","publication_date":"2025-12-29","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"elements granted by the actor in relation to fulfilling the request satisfy, respectively, the Fees Exception (45 CFR 171.302) and the Licensing Exception (§ 171.303) (89 FR 1388). \n \n In the HTI-2 Proposed Rule, we requested further comment on the TEFCA Manner Exception. We noted that the finalized exception differed in two ways from the proposal in the HTI-1 Proposed Rule: by applying the Fees Exception and the Licensing Exception to the TEFCA Manner Exception, and by including the limitation that carves out requests made for access, exchange, or use"},{"title":"Health Data, Technology, and Interoperability: Trusted Exchange Framework and Common Agreement (TEFCA)","type":"Rule","abstract":"This final rule has finalized certain proposals from a proposed rule published in August 2024 and in doing so advances interoperability and supports the access, exchange, and use of electronic health information. Specifically, this final rule amends the information blocking regulations by including definitions related to the Trusted Exchange Framework and Common Agreement (TEFCA) Manner Exception. It also implements provisions related to the TEFCA, which will support the reliability, privacy, security, and trust within TEFCA. Lastly, this final rule includes corrections and updates to current regulatory provisions of the Office of the National Coordinator for Health Information Technology (ONC) Health IT Certification Program.","document_number":"2024-29163","html_url":"https://www.federalregister.gov/documents/2024/12/16/2024-29163/health-data-technology-and-interoperability-trusted-exchange-framework-and-common-agreement-tefca","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-12-16/pdf/2024-29163.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-29163.pdf?1733924732","publication_date":"2024-12-16","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"the HIPAA Security Rule or the standards required by the HIPAA Security Rule. We make the distinction between “compliance with the HIPAA Security Rule” and compliance with the standards required by QHIN participation that mirror the HIPAA Security Rule requirements because some entities may not be a covered entity or business associate (\n i.e., \n a Non-HIPAA Entity) that are regulated by the HIPAA Security Rule. In order for TEFCA to have consistent security standards, we proposed that even though Non-HIPAA Entities cannot be covered by HIPAA, we"},{"title":"Health Breach Notification Rule","type":"Rule","abstract":"The Federal Trade Commission (\"FTC\" or \"Commission\") is amending the Commission's Health Breach Notification Rule (the \"HBN Rule\" or the \"Rule\"). The HBN Rule requires vendors of personal health records (\"PHRs\") and related entities that are not covered by the Health Insurance Portability and Accountability Act (\"HIPAA\") to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured personally identifiable health data.","document_number":"2024-10855","html_url":"https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-05-30/pdf/2024-10855.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-10855.pdf?1716986712","publication_date":"2024-05-30","agencies":[{"raw_name":"FEDERAL TRADE COMMISSION","name":"Federal Trade Commission","id":192,"url":"https://www.federalregister.gov/agencies/federal-trade-commission","json_url":"https://www.federalregister.gov/api/v1/agencies/192","parent_id":null,"slug":"federal-trade-commission"}],"excerpts":"because the HIPAA Breach Notification Rule is similarly constructed. However, while there are similarities between HIPAA-covered entities and HBNR-covered entities, it is not necessarily the case that rates of breaches would follow the same pattern. For instance, HIPAA-covered entities are generally subject to stronger data security requirements under HIPAA, but also may be more likely targets for security incidents (\n e.g., \n ransomware attacks on hospitals and other medical treatment centers covered by HIPAA have increased dramatically in recent"},{"title":"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally- Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program; Correcting Amendment","type":"Rule","abstract":"This document corrects technical errors in the final rule that appeared in the February 8, 2024 Federal Register titled \"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program\".","document_number":"2024-24801","html_url":"https://www.federalregister.gov/documents/2024/10/25/2024-24801/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-10-25/pdf/2024-24801.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-24801.pdf?1729773924","publication_date":"2024-10-25","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"APA provide for exceptions from the notice and comment and delay in effective date APA requirements. In cases in which these exceptions apply, sections 1871(b)(2)(C) and 1871(e)(1)(B)(ii) of the Act, also provide exceptions from the notice and 60-day comment period and delay in effective date requirements of the Act. Section 553(b)(B) of the APA and section 1871(b)(2)(C) of the Act authorize an agency to dispense with normal rulemaking requirements for good cause if the agency makes a finding that the notice and comment process are impracticable"},{"title":"Agency Information Collection Activities: Submission for OMB Review; Comment Request","type":"Notice","abstract":"The Centers for Medicare & Medicaid Services (CMS) is announcing an opportunity for the public to comment on CMS' intention to collect information from the public. Under the Paperwork Reduction Act of 1995 (PRA), federal agencies are required to publish notice in the Federal Register concerning each proposed collection of information, including each proposed extension or reinstatement of an existing collection of information, and to allow a second opportunity for public comment on the notice. Interested persons are invited to send comments regarding the burden estimate or any other aspect of this collection of information, including the necessity and utility of the proposed information collection for the proper performance of the agency's functions, the accuracy of the estimated burden, ways to enhance the quality, utility, and clarity of the information to be collected, and the use of automated collection techniques or other forms of information technology to minimize the information collection burden.","document_number":"2025-18506","html_url":"https://www.federalregister.gov/documents/2025/09/24/2025-18506/agency-information-collection-activities-submission-for-omb-review-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-09-24/pdf/2025-18506.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-18506.pdf?1758631515","publication_date":"2025-09-24","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"that a covered entity is not utilizing the adopted Administrative Simplification provisions of HIPAA are voluntarily requested to file a complaint with CMS via the Administrative Simplification Enforcement and Testing Tool (ASETT) online system, by mail, or by sending an email to the HIPAA mailbox at \n hipaacomplaint@cms.hhs.gov. \n Information provided on the standard form will be used during the investigation process to validate non-compliance of HIPAA Administrative Simplification provisions.\n \n \n This standard form collects identifying and contact"},{"title":"Confidentiality of Substance Use Disorder (SUD) Patient Records","type":"Rule","abstract":"The United States Department of Health and Human Services (HHS or \"Department\") is issuing this final rule to modify its regulations to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The Department is issuing this final rule after careful consideration of all public comments received in response to the notice of proposed rulemaking (NPRM) for the Confidentiality of Substance Use Disorder (SUD) Patient Records. This final rule also makes certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates.","document_number":"2024-02544","html_url":"https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-16/pdf/2024-02544.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-02544.pdf?1707408916","publication_date":"2024-02-16","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"part 2 enforcement with the HIPAA Enforcement Rule.\n \n \n \n 99 \n \n See \n U.S. Dep't of Health and Human Servs., “Enforcement Process” (Sept. 17, 2021), \n https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html; \n HIPAA Enforcement Rule, 45 CFR part 160, subparts C, D, and E.\n \n \n In contrast, prior to this final rule, all alleged part 2 violations were subject only to potential criminal penalties. Aligning part 2 and HIPAA enforcement approaches should make the enforcement process more straightforward for part"},{"title":"Agency Information Collection Activities: Proposed Collection; Comment Request","type":"Notice","abstract":"The Centers for Medicare & Medicaid Services (CMS) is announcing an opportunity for the public to comment on CMS' intention to collect information from the public. Under the Paperwork Reduction Act of 1995 (PRA), federal agencies are required to publish notice in the Federal Register concerning each proposed collection of information (including each proposed extension or reinstatement of an existing collection of information) and to allow 60 days for public comment on the proposed action. Interested persons are invited to send comments regarding our burden estimates or any other aspect of this collection of information, including the necessity and utility of the proposed information collection for the proper performance of the agency's functions, the accuracy of the estimated burden, ways to enhance the quality, utility, and clarity of the information to be collected, and the use of automated collection techniques or other forms of information technology to minimize the information collection burden.","document_number":"2025-11980","html_url":"https://www.federalregister.gov/documents/2025/06/27/2025-11980/agency-information-collection-activities-proposed-collection-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-06-27/pdf/2025-11980.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-11980.pdf?1750941925","publication_date":"2025-06-27","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"that a covered entity is not utilizing the adopted Administrative Simplification provisions of HIPAA are voluntarily requested to file a complaint with CMS via the Administrative Simplification Enforcement and Testing Tool (ASETT) online system, by mail, or by sending an email to the HIPAA mailbox at \n hipaacomplaint@cms.hhs.gov. \n Information provided on the standard form will be used during the investigation process to validate non-compliance of HIPAA Administrative Simplification provisions.\n \n \n This standard form collects identifying and contact"},{"title":"Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program","type":"Rule","abstract":"This final rule will improve the electronic exchange of health care data and streamline processes related to prior authorization through new requirements for Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children's Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs). This final rule will also add new measures for eligible hospitals and critical access hospitals (CAHs) to report under the Medicare Promoting Interoperability Program and for MIPS eligible clinicians to report under the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS). These policies, taken together, will reduce overall payer and provider burden and improve patient access to health information while continuing CMS's drive toward interoperability in the health care market.","document_number":"2024-00895","html_url":"https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-08/pdf/2024-00895.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-00895.pdf?1705612517","publication_date":"2024-02-08","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"},{"raw_name":"Office of the Secretary"}],"excerpts":"health information (PHI). For many processes described in this final rule, a patient's personal representative could act on a patient's behalf, as permitted by the HIPAA Privacy Rule and other applicable laws.\n \n \n \n 3 \n \n See \n 45 CFR parts 160 and 164, subparts A and E.\n \n \n \n \n 4 \n U.S. Department of Health and Human Services. Health Information and Privacy. Retrieved from \n https://www.hhs.gov/hipaa/for-professionals/faq/2069/under-hipaa-when-can-a-family-member/index.html \n and \n https://www.hhs.gov/hipaa/for-professionals/faq/personal-re"},{"title":"Medicaid Program; Community Engagement Requirement for Certain Individuals","type":"Rule","abstract":"This interim final rule with comment period (IFC) interprets and implements the community engagement requirement in Medicaid under section 1902(xx) of the Social Security Act. States are required to implement the new requirement no later than January 1, 2027. This IFC specifies the requirements and expectations for States, including the Medicaid applicants and beneficiaries who must demonstrate community engagement as a condition of their eligibility, the types of qualifying activities that satisfy the community engagement requirement, the criteria to meet an exception from the requirement (that is, be deemed compliant), and the criteria to meet a specified exclusion from the requirement. It also specifies requirements for verification of qualifying activities, outreach to affected populations, steps States must take if they determine individuals are noncompliant, and additional operational considerations for States. Finally, this IFC specifies implementation timing and establishes new State reporting requirements.","document_number":"2026-11094","html_url":"https://www.federalregister.gov/documents/2026/06/03/2026-11094/medicaid-program-community-engagement-requirement-for-certain-individuals","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-06-03/pdf/2026-11094.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-11094.pdf?1780346707","publication_date":"2026-06-03","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Centers for Medicare & Medicaid Services","name":"Centers for Medicare & Medicaid Services","id":45,"url":"https://www.federalregister.gov/agencies/centers-for-medicare-medicaid-services","json_url":"https://www.federalregister.gov/api/v1/agencies/45","parent_id":221,"slug":"centers-for-medicare-medicaid-services"}],"excerpts":"their behalf must request an exception, the State must also provide: notice of the method by which an applicable individual (or individual acting on their behalf) may request a short-term hardship exception; notice of the timeframe for requesting the exception; a timely process for determining whether a short-term hardship exception will be granted; notice to an applicable individual of the State's determination that a short-term hardship exception will or will not apply, and, if the State determines that the exception will apply, the anticipated"},{"title":"HIPAA Privacy Rule To Support Reproductive Health Care Privacy","type":"Proposed Rule","abstract":"The Department of Health and Human Services (HHS or \"Department\") is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Standards for Privacy of Individually Identifiable Health Information (\"Privacy Rule\") under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposal would modify existing standards permitting uses and disclosures of protected health information (PHI) by limiting uses and disclosures of PHI for certain purposes where the use or disclosure of information is about reproductive health care that is lawful under the circumstances in which such health care is provided. The proposal would modify existing standards by prohibiting uses and disclosures of PHI for criminal, civil, or administrative investigations or proceedings against individuals, covered entities or their business associates (collectively, \"regulated entities\"), or other persons for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided.","document_number":"2023-07517","html_url":"https://www.federalregister.gov/documents/2023/04/17/2023-07517/hipaa-privacy-rule-to-support-reproductive-health-care-privacy","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-04-17/pdf/2023-07517.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-07517.pdf?1681328717","publication_date":"2023-04-17","agencies":[{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"compromise the privacy of an individual[,]” such as “the transfer of information when making referrals from primary care to specialty care”).\n \n \n \n HIPAA's preemption provisions reflect Congress' intent to protect individuals' health care privacy. The statute provides a “[g]eneral rule” that, with certain exceptions, HIPAA's provisions “supersede any contrary provision of State law.” \n 49 \n \n One exception to HIPAA's preemption provisions is for “state privacy laws that are contrary to and more stringent than the corresponding federal standard, requirement"},{"title":"Federal Independent Dispute Resolution Operations","type":"Rule","abstract":"This document sets forth these final rules related to certain provisions of the No Surprises Act regarding the Federal independent dispute resolution (IDR) process, which was established as part of the Consolidated Appropriations Act, 2021 (CAA). These rules finalize new requirements relating to the disclosure of information that group health plans and health insurance issuers offering group or individual health insurance coverage must include along with the initial payment or notice of denial of payment for certain items and services subject to the surprise billing protections in the No Surprises Act. These final rules also require plans and issuers to communicate information by using claim adjustment reason codes (CARCs) and remittance advice remark codes (RARCs), as specified in guidance, when providing any paper or electronic remittance advice (ERA) to an entity that does not have a contractual relationship with the plan or issuer. This document also finalizes amendments to certain requirements related to the open negotiation period preceding the Federal IDR process, the initiation of the Federal IDR process, the Federal IDR dispute eligibility review process, and the payment and collection of administrative fees and certified IDR entity fees. This document also finalizes the definition of bundled payment arrangements, amends requirements related to batched items and services and amends the rules for extensions of timeframes due to extenuating circumstances. Additionally, this document finalizes provisions that require plans and issuers to register in the Federal IDR portal. In accordance with Federal law, a summary of these rules may be found at https://www.regulations.gov/.","document_number":"2026-11140","html_url":"https://www.federalregister.gov/documents/2026/06/04/2026-11140/federal-independent-dispute-resolution-operations","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-06-04/pdf/2026-11140.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-11140.pdf?1780348210","publication_date":"2026-06-04","agencies":[{"raw_name":"OFFICE OF PERSONNEL MANAGEMENT","name":"Personnel Management Office","id":406,"url":"https://www.federalregister.gov/agencies/personnel-management-office","json_url":"https://www.federalregister.gov/api/v1/agencies/406","parent_id":null,"slug":"personnel-management-office"},{"raw_name":"DEPARTMENT OF THE TREASURY","name":"Treasury Department","id":497,"url":"https://www.federalregister.gov/agencies/treasury-department","json_url":"https://www.federalregister.gov/api/v1/agencies/497","parent_id":null,"slug":"treasury-department"},{"raw_name":"Internal Revenue Service","name":"Internal Revenue Service","id":254,"url":"https://www.federalregister.gov/agencies/internal-revenue-service","json_url":"https://www.federalregister.gov/api/v1/agencies/254","parent_id":497,"slug":"internal-revenue-service"},{"raw_name":"DEPARTMENT OF LABOR","name":"Labor Department","id":271,"url":"https://www.federalregister.gov/agencies/labor-department","json_url":"https://www.federalregister.gov/api/v1/agencies/271","parent_id":null,"slug":"labor-department"},{"raw_name":"Employee Benefits Security Administration","name":"Employee Benefits Security Administration","id":131,"url":"https://www.federalregister.gov/agencies/employee-benefits-security-administration","json_url":"https://www.federalregister.gov/api/v1/agencies/131","parent_id":271,"slug":"employee-benefits-security-administration"},{"raw_name":"DEPARTMENT OF HEALTH AND HUMAN SERVICES","name":"Health and Human Services Department","id":221,"url":"https://www.federalregister.gov/agencies/health-and-human-services-department","json_url":"https://www.federalregister.gov/api/v1/agencies/221","parent_id":null,"slug":"health-and-human-services-department"}],"excerpts":"the Federal IDR process are different from the aspects of the claim discussed during the open negotiation period, and an explanation of why the party is initiating the Federal IDR process, including any of the permissible considerations described in paragraph (c)(5)(iii) of this section and § 54.9817-2(b)(2) that serve as the party's basis for initiating the Federal IDR process.\n \n The Departments received several comments offering general suggestions about the initiation of the Federal IDR process, including concerns that the process is administratively"}]}