Notices. Notice

881 words·~4 min read·/register/2022/10/13/2022-22204

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

BILLING CODE 4163-18-P DEPARTMENT OF HEALTH AND HUMAN SERVICES [Document Identifier: OS-0945-0003-60D] Agency Information Collection Request; 60-Day Public Comment Request AGENCY: Office of the Secretary, HHS. ACTION: Notice. SUMMARY: In compliance with the requirement of the Paperwork Reduction Act of 1995, the Office of the Secretary (OS), Department of Health and Human Services, is publishing the following summary of a proposed collection for public comment. DATES: Comments on the ICR must be received on or before December 12, 2022. ADDRESSES: Submit your comments to *Sherrette.Funn@hhs.gov* or by calling

(202)264-0041. FOR FURTHER INFORMATION CONTACT: When submitting comments or requesting information, please include the document identifier OS-0945-0003-60D and project title for reference, to Sherrette A. Funn, email: *Sherrette.Funn@hhs.gov,* or call

(202)264-0041 the Reports Clearance Officer. SUPPLEMENTARY INFORMATION: Interested persons are invited to send comments regarding this burden estimate or any other aspect of this collection of information, including any of the following subjects:

(1)The necessity and utility of the proposed information collection for the proper performance of the agency's functions;

(2)the accuracy of the estimated burden;

(3)ways to enhance the quality, utility, and clarity of the information to be collected; and

(4)the use of automated collection techniques or other forms of information technology to minimize the information collection burden. *Title of the Collection:* HIPAA Privacy, Security, and Breach Notification Rules, and Supporting Regulations Contained in 45 CFR parts 160 and 164. *Type of Collection:* Extension. *OMB No. 0945-0003:* Office for Civil Rights (OCR)—Health Information Privacy Division. *Abstract:* Office for Civil Rights

(OCR)requests approval to extend this existing, approved collection without changing any collection requirements. In 2021, OCR published a Notice of Proposed Rulemaking

(NPRM)proposing modifications to the HIPAA Rules that would affect the hourly burdens associated with the HIPAA Rules. 86 FR 6446. OCR is reviewing public comment received on the NPRM about existing burdens associated with compliance with the HIPAA Rules, available at *https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=202011-0945-001,* and on changes in burden that could result from the modifications proposed in the NPRM. OCR will update this ICR to reflect the input we receive on this notice and through the rulemaking process. *Likely Respondents:* HIPAA covered entities, business associates, individuals, and professional and trade associations of covered entities and business associates. Annualized Burden Hour Table Section Type of respondent Number of respondents Number of responses per respondent Average burden hours per response [1] Total burden hours 160.204 Process for Requesting Exception Determinations (states or persons) 1 1 16 16 164.308 Risk Analysis—Documentation [2] 1,700,000 1 10 17,000,000 164.308 Information System Activity Review—Documentation 1,700,000 12 0.75 15,300,000 164.308 Security Reminders—Periodic Updates 1,700,000 12 1 20,400,000 164.308 Security Incidents (other than breaches)—Documentation 1,700,000 52 5 442,000,000 164.308 Contingency Plan—Testing and Revision 1,700,000 1 8 13,600,000 164.308 Contingency Plan—Criticality Analysis 1,700,000 1 4 6,800,000 164.310 Maintenance Records 1,700,000 12 6 122,400,000 164.314 Security Incidents—Business Associate reporting of incidents (other than breach) to Covered Entities 1,000,000 12 20 240,000,000 164.316 Documentation—Review and Update [3] 1,700,000 1 6 10,200,000 164.404 Individual Notice—Written and Email Notice (drafting) [4] 58,482 1 0.5 29,241 164.404 Individual Notice—Written and Email Notice (preparing and documenting notification) 58,482 1 0.5 29,241 164.404 Individual Notice—Written and Email Notice (processing and sending) [5] 58,482 1,941 0.008 908,108 164.404 Individual Notice—Substitute Notice (posting or publishing) [6] 2,746 1 1 2,746 164.404 Individual Notice—Substitute Notice (staffing toll-free number) [7] 2,746 1 3.42 9,391 164.404 Individual Notice—Substitute Notice (individuals' voluntary burden to call toll-free number for information) [8], [9] 113,264 1 0.125 14,158 164.406 Media Notice [10] 267 1 1.25 334 164.408 Notice to Secretary (notice for breaches affecting 500 or more individuals) 267 1 1.25 334 164.408 Notice to Secretary (notice for breaches affecting fewer than 500 individuals) [11] 58,215 1 1 58,215 164.410 Business Associate notice to Covered Entity—500 or more individuals affected 20 1 50 1,000 164.410 Business Associate notice to Covered Entity—Less than 500 individuals affected 1,165 1 8 9,320 164.414 500 or More Affected Individuals (investigating and documenting breach) 267 1 50 13,350 164.414 Less than 500 Affected Individuals (investigating and documenting breach)—affecting 10-499 2,479 1 8 19,832 164.414 Less than 500 Affected Individuals (investigating and documenting breach)—affecting <10 55,736 1 4 222,944 164.504 Uses and Disclosures—Organizational Requirements 700,000 1 0.083333333 58,333 164.508 Uses and Disclosures for Which Individual authorization is required 700,000 1 1 700,000 164.512 Uses and Disclosures for Research Purposes [12] 113,524 1 0.083333333 9,460 164.520 Notice of Privacy Practices for Protected Health Information (health plans—periodic distribution of NPPs by paper mail) [13], [18] 100,000,000 1 0.004166667 416,667 164.520 Notice of Privacy Practices for Protected Health Information (health plans—periodic distribution of NPPs by electronic mail) [19] 100,000,000 1 0.002783333 278,333 164.520 Notice of Privacy Practices for Protected Health Information (health care providers—dissemination and acknowledgement) [14] 613,000,000 1 0.05 30,650,000 164.522 Rights to Request Privacy Protection for Protected Health Information [15] 20,000 1 0.05 1,000 164.524 Access of Individuals to Protected Health Information (disclosures) [16] 200,000 1 0.05 10,000 164.526 Amendment of Protected Health Information (requests) 150,000 1 0.083333333 12,500 164.526 Amendment of Protected Health Information (denials) 50,000 1 0.083333333 4,167 164.528 Accounting for Disclosures of Protected Health Information [17] 5,000 1 0.05 250 Total 2,070 921,158,940 Sherrette A. Funn, Paperwork Reduction Act Reports Clearance Officer, Office of the Secretary. [FR Doc. 2022-22204 Filed 10-12-22; 8:45 am]