17 Health Systems Warn HHS: HIPAA Privacy Rule Plan Blocks PHI Verification

Seventeen health systems, hospitals and clinics have told HHS Secretary Robert F. Kennedy Jr. this week that the pending HIPAA Privacy Rule overhaul could strip providers of their ability to verify who is legitimately receiving protected health information. The coalition, led by the College of Healthcare Information Management Executives (CHIME), laid out its objections in a letter that lands as the rule moves toward finalization.

For CIOs and CISOs at provider organizations, the timing matters. The HHS Office for Civil Rights (OCR) has penciled in a final rule — formally titled HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens — for August 2026. The original Notice of Proposed Rulemaking dates back to the final days of the first Trump administration; OCR collected comments during the Biden years, the process stalled, and the second Trump administration revived it. Beyond confirming the final rule is a regulatory priority, OCR has said nothing new about its release date.

What does the rule change for providers?

The coalition's core worry: efforts to expand patient access to health technology could restrict a provider's ability to confirm that a third-party application has actually been authorized by the patient to receive their PHI. They also flagged the proposal to remove "unreasonable identity verification barriers" for individuals exercising their HIPAA rights — including directing copies of their PHI to third parties.

The risk is straightforward. Loosen verification, and bad actors get an easier path into patient records — while the provider wears the consequences.

"A final rule that categorically prohibits providers from confirming whether a patient has authorized a third-party application to receive PHI would represent a material departure from the proposed approach," the coalition wrote. "Although the NPRM solicited comments on unreasonable verification practices, it did not clearly notify affected parties that OCR might prohibit reasonable confirmation of patient authorization altogether."

The IAL2 problem

The letter gets sharper on digital identity. The coalition pushed back hard on any presumption that presenting an IAL2 credential alone satisfies every verification requirement for an application-initiated PHI request.

"Identity proofing, patient matching, and verification of authority are analytically and operationally distinct functions," the coalition explained. An IAL2 credential may prove who someone is — but it does not establish that the person has been accurately matched to the right medical record, nor the nature, scope, duration or validity of their authorization letting a third-party app pull the requested data.

"Treating IAL2 credentialing as sufficient for all verification purposes, while restricting providers' ability to confirm patient authorization, would introduce additional substantive limitations that were not clearly contemplated in the 2021 NPRM," the coalition stated.

What is the coalition asking for?

The group's requests to OCR are specific:

• Preserve provider discretion to take reasonable, risk-appropriate steps to confirm a patient authorized a third-party app to receive PHI — including confirming directly with the patient when appropriate.
• Issue clear guidance with concrete examples distinguishing unreasonable verification barriers from legitimate provider safeguards.
• If the final rule deviates from the original NPRM, run an additional notice-and-comment period.
• Short of that, establish explicit, meaningful enforcement protections for providers acting in good faith on patient-directed PHI disclosures.

The coalition was blunt about the stakes: changes meant to improve patient access and support innovation should not come at the expense of providers' ability to responsibly protect patient information. In their view, the proposed requirements raise the risk of privacy breaches — and leave providers exposed to regulatory penalties and lawsuits.

The question now sits with OCR, which must land a final rule by August 2026 without either reopening identity verification loopholes or criminalizing reasonable safeguards.