Standards for Privacy of
Individually Identifiable Health Information and Supporting
Regulations at 45 CFR Parts 160 and 164
No
material or nonsubstantive change to a currently approved
collection
No
Regular
11/13/2025
Requested
Previously Approved
07/31/2027
07/31/2027
1,154,350,069
1,154,350,069
953,982,239
953,982,239
163,499,411
163,499,411
The individually identifiable health
information collected is used by patients and by more than 700,000
covered entities affected by the HIPAA Privacy Rule. The
information is routinely used by covered entities for treatment,
payment, and health care operations. In addition, the information
is used for specified public policy purposes, including research,
public health, and as required by other laws.
PL:
Pub.L. 104 - 191 1 Name of Law: Health Insurance Portability
and Accountability Act of 1996
PL:
Pub.L. 116 - 136 3221 Name of Law: Coronavirus Aid, Relief, and
Economic Security Act
PL: Pub.L. 116 - 136 3221 Name of Law:
Coronavirus Aid, Relief, and Economic Security Act
Burdens increased due to
updated estimates for the number of covered entities, costs of
postage, wage rates, number of breaches, and number of individuals
requesting access to copies of their protected health information.
Burdens increased for the one-time activities of updating policies
and procedures, updating employee training, revising business
associate agreements, and revising the NPP, and the recurring
activity of obtaining an attestation for certain requests for
copies of protected health information. Hourly burdens decreased
for providing individual breach notification due to a drop in the
number of affected individuals per breach in the most recent
published reports.
$216,000
No
No
No
No
No
No
No
Sherri Morgan 202 774-3042
sherri.morgan@hhs.gov
No
On behalf of this Federal agency, I certify that
the collection of information encompassed by this request complies
with 5 CFR 1320.9 and the related provisions of 5 CFR
1320.8(b)(3).
The following is a summary of the topics, regarding
the proposed collection of information, that the certification
covers:
(i) Why the information is being collected;
(ii) Use of information;
(iii) Burden estimate;
(iv) Nature of response (voluntary, required for a
benefit, or mandatory);
(v) Nature and extent of confidentiality; and
(vi) Need to display currently valid OMB control
number;
If you are unable to certify compliance with any of
these provisions, identify the item by leaving the box unchecked
and explain the reason in the Supporting Statement.
Justification for Non-substantive Change.pdf
2024_04_30_HIPAA RHC Privacy FR_ICR_Supporting_Statement CLEAN.docx
Attestations requiring additional action