In January 2021, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a proposed HIPAA Privacy Rule update. It will include Improvements to the HIPAA Privacy Rule to Support, and Take Away Barriers to, Coordinated Care and Personal Engagement.
The objective of the proposed update is to modify the HIPAA Privacy Rule to reinforce personal rights to access health data, enhance care coordination, and minimize the compliance load on health plans and healthcare providers, while protecting patient privacy. The Biden administration did not seem to prioritize the proposed update by the HHS, the same is true for the Trump administration during the first year. However, on January 14, 2026, OCR Director Paula M. Stannard posted a notice of Tribal consultation about the 2021 Rule in the Federal Register.
Five years have passed since the HIPAA Privacy Rule proposed update was publicized in the Federal Register. Though little is mentioned about the proposed update in the last five years, a final rule seems to be near publication. Before the final rule, on February 6, 2026, a Tribal consultation meeting will be conducted via Zoom following Executive Order 13175 as well as the HHS Tribal Consultation Policy.
The consultation will take up a number of different topics, with OCR hoping to get responses concerning the proposed modifications to reinforce personal rights to health data; the measures suggested to enhance treatment coordination and case administration; the improved flexibilities for sharing patient data during emergency and threatening situations; the support for using telecommunications relay services by individuals and employees who are deaf-blind, deaf, hard of hearing, or have a speech handicap; and the expanded authorization to use and share Armed Forces service personnel PHI for national readiness reasons.
Although the Tribal consultation is an indication of progress toward applying some or all of the proposed modifications in the final rule, there are no signs at this time if the final rule will be publicized. When that happens, HIPAA-covered entities will get enough time to revise their guidelines, procedures, and practices and equip employees with training on the HIPAA Privacy Rule requirements prior to OCR’s enforcement.
Meanwhile, OCR has mentioned that enforcement initiatives will continue to focus on the HIPAA Right of Access requirement of the HIPAA Privacy Law, parental access to the health records of minors, and the risk analysis requirement of the HIPAA Security Law, and an extension of that program to include risk management. OCR likewise pointed out that a new enforcement initiative will be introduced for the privacy of substance use disorder treatment data, following the latest changes to Part 2 rules to align them more with HIPAA.
