87 FR 197 pgs. 62107-62109 - Agency Information Collection Request; 60-Day Public Comment Request
Type: NOTICEVolume: 87Number: 197Pages: 62107 - 62109
Pages: 62107, 62108, 62109Docket number: [Document Identifier: OS-0945-0003-60D]
FR document: [FR Doc. 2022-22204 Filed 10-12-22; 8:45 am]
Agency: Health and Human Services Department
Official PDF Version: PDF Version
[top]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
[Document Identifier: OS-0945-0003-60D]
Agency Information Collection Request; 60-Day Public Comment Request
AGENCY:
Office of the Secretary, HHS.
ACTION:
Notice.
SUMMARY:
[top] In compliance with the requirement of the Paperwork Reduction Act of 1995, the Office of the Secretary (OS), Department of Health
DATES:
Comments on the ICR must be received on or before December 12, 2022.
ADDRESSES:
Submit your comments to Sherrette.Funn@hhs.gov or by calling (202) 264-0041.
FOR FURTHER INFORMATION CONTACT:
When submitting comments or requesting information, please include the document identifier OS-0945-0003-60D and project title for reference, to Sherrette A. Funn, email: Sherrette.Funn@hhs.gov, or call (202) 264-0041 the Reports Clearance Officer.
SUPPLEMENTARY INFORMATION:
Interested persons are invited to send comments regarding this burden estimate or any other aspect of this collection of information, including any of the following subjects: (1) The necessity and utility of the proposed information collection for the proper performance of the agency's functions; (2) the accuracy of the estimated burden; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) the use of automated collection techniques or other forms of information technology to minimize the information collection burden.
Title of the Collection: HIPAA Privacy, Security, and Breach Notification Rules, and Supporting Regulations Contained in 45 CFR parts 160 and 164.
Type of Collection: Extension.
OMB No. 0945-0003: Office for Civil Rights (OCR)-Health Information Privacy Division.
Abstract: Office for Civil Rights (OCR) requests approval to extend this existing, approved collection without changing any collection requirements. In 2021, OCR published a Notice of Proposed Rulemaking (NPRM) proposing modifications to the HIPAA Rules that would affect the hourly burdens associated with the HIPAA Rules. 86 FR 6446. OCR is reviewing public comment received on the NPRM about existing burdens associated with compliance with the HIPAA Rules, available at https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=202011-0945-001, and on changes in burden that could result from the modifications proposed in the NPRM. OCR will update this ICR to reflect the input we receive on this notice and through the rulemaking process.
Likely Respondents: HIPAA covered entities, business associates, individuals, and professional and trade associations of covered entities and business associates.
[top]
| Section | Type of respondent | Number of respondents | Number of responses per respondent | Average burden hours per response [1] | Total burden hours |
|---|---|---|---|---|---|
| 160.204 | Process for Requesting Exception Determinations (states or persons) | 1 | 1 | 16 | 16 |
| 164.308 | Risk Analysis-Documentation [2] | 1,700,000 | 1 | 10 | 17,000,000 |
| 164.308 | Information System Activity Review-Documentation | 1,700,000 | 12 | 0.75 | 15,300,000 |
| 164.308 | Security Reminders-Periodic Updates | 1,700,000 | 12 | 1 | 20,400,000 |
| 164.308 | Security Incidents (other than breaches)-Documentation | 1,700,000 | 52 | 5 | 442,000,000 |
| 164.308 | Contingency Plan-Testing and Revision | 1,700,000 | 1 | 8 | 13,600,000 |
| 164.308 | Contingency Plan-Criticality Analysis | 1,700,000 | 1 | 4 | 6,800,000 |
| 164.310 | Maintenance Records | 1,700,000 | 12 | 6 | 122,400,000 |
| 164.314 | Security Incidents-Business Associate reporting of incidents (other than breach) to Covered Entities | 1,000,000 | 12 | 20 | 240,000,000 |
| 164.316 | Documentation-Review and Update [3] | 1,700,000 | 1 | 6 | 10,200,000 |
| 164.404 | Individual Notice-Written and Email Notice (drafting) [4] | 58,482 | 1 | 0.5 | 29,241 |
| 164.404 | Individual Notice-Written and Email Notice (preparing and documenting notification) | 58,482 | 1 | 0.5 | 29,241 |
| 164.404 | Individual Notice-Written and Email Notice (processing and sending) [5] | 58,482 | 1,941 | 0.008 | 908,108 |
| 164.404 | Individual Notice-Substitute Notice (posting or publishing) [6] | 2,746 | 1 | 1 | 2,746 |
| 164.404 | Individual Notice-Substitute Notice (staffing toll-free number) [7] | 2,746 | 1 | 3.42 | 9,391 |
| 164.404 | Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information) [8], [9] | 113,264 | 1 | 0.125 | 14,158 |
| 164.406 | Media Notice [10] | 267 | 1 | 1.25 | 334 |
| 164.408 | Notice to Secretary (notice for breaches affecting 500 or more individuals) | 267 | 1 | 1.25 | 334 |
| 164.408 | Notice to Secretary (notice for breaches affecting fewer than 500 individuals) [11] | 58,215 | 1 | 1 | 58,215 |
| 164.410 | Business Associate notice to Covered Entity-500 or more individuals affected | 20 | 1 | 50 | 1,000 |
| 164.410 | Business Associate notice to Covered Entity-Less than 500 individuals affected | 1,165 | 1 | 8 | 9,320 |
| 164.414 | 500 or More Affected Individuals (investigating and documenting breach) | 267 | 1 | 50 | 13,350 |
| 164.414 | Less than 500 Affected Individuals (investigating and documenting breach)-affecting 10-499 | 2,479 | 1 | 8 | 19,832 |
| 164.414 | Less than 500 Affected Individuals (investigating and documenting breach)-affecting <10 | 55,736 | 1 | 4 | 222,944 |
| 164.504 | Uses and Disclosures-Organizational Requirements | 700,000 | 1 | 0.083333333 | 58,333 |
| 164.508 | Uses and Disclosures for Which Individual authorization is required | 700,000 | 1 | 1 | 700,000 |
| 164.512 | Uses and Disclosures for Research Purposes [12] | 113,524 | 1 | 0.083333333 | 9,460 |
| 164.520 | Notice of Privacy Practices for Protected Health Information (health plans-periodic distribution of NPPs by paper mail) [13], [18] | 100,000,000 | 1 | 0.004166667 | 416,667 |
| 164.520 | Notice of Privacy Practices for Protected Health Information (health plans-periodic distribution of NPPs by electronic mail) [19] | 100,000,000 | 1 | 0.002783333 | 278,333 |
| 164.520 | Notice of Privacy Practices for Protected Health Information (health care providers-dissemination and acknowledgement) [14] | 613,000,000 | 1 | 0.05 | 30,650,000 |
| 164.522 | Rights to Request Privacy Protection for Protected Health Information [15] | 20,000 | 1 | 0.05 | 1,000 |
| 164.524 | Access of Individuals to Protected Health Information (disclosures) [16] | 200,000 | 1 | 0.05 | 10,000 |
| 164.526 | Amendment of Protected Health Information (requests) | 150,000 | 1 | 0.083333333 | 12,500 |
| 164.526 | Amendment of Protected Health Information (denials) | 50,000 | 1 | 0.083333333 | 4,167 |
| 164.528 | Accounting for Disclosures of Protected Health Information [17] | 5,000 | 1 | 0.05 | 250 |
| Total | 2,070 | 921,158,940 |
Sherrette A. Funn,
Paperwork Reduction Act Reports Clearance Officer, Office of the Secretary.
[FR Doc. 2022-22204 Filed 10-12-22; 8:45 am]
BILLING CODE 4150-28-P