# Agency Information Collection Activities; Submission to OMB for Review and Approval; Public Comment Request > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2016-11785 ## Record - **Collection:** Federal Register - **Document type:** Notice - **Published:** May 19, 2016 - **Citation:** 81 FR 31646 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary [Document Identifier: HHS-OS-0945-0003-30D] Agency Information Collection Activities; Submission to OMB for Review and Approval; Public Comment Request AGENCY: Office of the Secretary, HHS. ACTION: Notice. SUMMARY: In compliance with section 3507(a)(1)(D) of the Paperwork Reduction Act of 1995, the Office of the Secretary (OS), Department of Health and Human Services, has submitted an Information Collection Request (ICR), described below, to the Office of Management and Budget (OMB) for review and approval. The ICR is for revision of the approved information collection assigned OMB control number 0945-0003, scheduled to expire on January 1, 2017. Comments submitted during the first public review of this ICR will be provided to OMB. OMB will accept further comments from the public on this ICR during the review and approval period. DATES: Comments on the ICR must be received on or before June 20, 2016. ADDRESSES: Submit your comments to OIRA_submission@omb.eop.gov or via facsimile to (202) 395-5806. FOR FURTHER INFORMATION CONTACT: Information Collection Clearance staff, Information.CollectionClearance@hhs.gov or (202) 690-6162. SUPPLEMENTARY INFORMATION: When submitting comments or requesting information, please include the OMB control number 0945-0003-30D for reference. Proposed Project: HIPAA Privacy, Security, and Breach Notification Rules, and Supporting Regulations Contained in 45 CFR parts 160 and 164. Abstract: This revision does not change any requirements of the HIPAA Privacy, Security, and Breach Notification Rules. Among other updates summarized below, the ICR requests to rename the information collection and incorporate into it the substance of two other information collections (#0945-0004, set to expire on May 31, 2016; and #0945-0001, expiring on September 30, 2016), which then would be discontinued. The ICR addresses the burden on regulated entities for compliance with the information collection requirements of the HIPAA Privacy, Security, and Breach Notification Rules; the voluntary burden on members of the public for obtaining information from covered entities regarding breaches of their protected health information; and the information collection burden on the Office for Civil Rights (OCR) associated with administering aspects of the HIPAA Breach Notification program. Combining the three existing information collections identified above will allow the regulated community, the public, and OCR to more easily view and track the estimated burdens associated with the HIPAA Rules that are administered and enforced by OCR. In addition to combining the ICRs, the proposed updates take into account our experience administering the Rules to more accurately reflect the burdens of compliance with the applicable regulatory requirements; remove the estimated burden of initial compliance with the Omnibus HIPAA Final Rule, because we are well past the compliance dates; and incorporate increases in wages for the job categories that we expect to be involved in compliance activities. Estimated Annualized Burden Table Section Type of respondent Number of respondents Number of responses per respondent Average burden hours per response Total burden hours 160.204 Process for Requesting Exception Determinations (states or persons) 1 1 16 16 164.308 Risk Analysis—Documentation 1,700,000 1 10 17,000,000 164.308 Information System Activity Review—Documentation 1,700,000 12 .75 15,300,000 164.308 Security Reminders—Periodic Updates 1,700,000 12 1 20,400,000 164.308 Security Incidents (other than breaches)—Documentation 1,700,000 52 5 442,000,000 164.308 Contingency Plan—Testing and Revision 1,700,000 1 8 13,600,000 164.308 Contingency Plan—Criticality Analysis 1,700,000 1 4 6,800,000 164.310 Maintenance Records 1,700,000 12 6 122,400,000 164.314 Security Incidents—Business Associate reporting of incidents (other than breach) to Covered Entities 1,000,000 12 20 240,000,000 164.316 Documentation—Review and Update 1,700,000 1 6 10,200,000 164.404 Individual Notice—Written and Email Notice (drafting) 58,481 1 .5 29,240 164.404 Individual Notice—Written and Email Notice (preparing and documenting notification) 58,481 1 .5 29,240 164.404 Individual Notice—Written and Email Notice (processing and sending) 58,481 353 .008 165,150 164.404 Individual Notice—Substitute Notice (posting or publishing) 2,746 1 1 2,746 164.404 Individual Notice—Substitute Notice (staffing toll-free number) 2,746 1 5.75 15,789 164.404 Individual Notice—Substitute Notice (individuals' voluntary burden to call toll-free number for information) 11,326,440 1 .125 1,415,805 164.406 Media Notice 267 1 1.25 333 164.408 Notice to Secretary (notice for breaches affecting 500 or more individuals) 267 1 1.25 333 164.408 Notice to Secretary (notice for breaches affecting fewer than 500 individuals) 58,215 1 1 58,215 164.414 500 or More Affected Individuals (investigating and documenting breach) 267 1 50 13,350 164.414 Less than 500 Affected Individuals (investigating and documenting breach) 2,479 (breaches affecting 10-499 individuals) 1 8 19,832 55,736 (breaches affecting <10 individuals) 1 4 222,944 164.504 Uses and Disclosures—Organizational Requirements 700,000 1 5/60 58,333 164.508 Uses and Disclosures for Which Individual authorization is required 700,000 1 1 700,000 164.512 Uses and Disclosures for Research Purposes 113,524 1 5/60 9,460 164.520 Notice of Privacy Practices for Protected Health Information (health plans—periodic distribution of NPPs by paper mail) 100,000,000 1 0.25 minutes [1 hour per 240 notices] 416,667 164.520 Notice of Privacy Practices for Protected Health Information (health plans—periodic distribution of NPPs by electronic mail) 100,000,000 1 0.167 minutes [1 hour per 360 notices] 278,333 164.520 Notice of Privacy Practices for Protected Health Information (health care providers—dissemination and acknowledgement) 613,000,000 1 3/60 30,650,000 164.522 Rights to Request Privacy Protection for Protected Health Information 20,000 1 3/60 1,000 164.524 Access of Individuals to Protected Health Information (disclosures) 200,000 1 3/60 10,000 164.526 Amendment of Protected Health Information (requests) 150,000 1 5/60 12,500 164.526 Amendment of Protected Health Information (denials) 50,000 1 5/60 4,166 164.528 Accounting for Disclosures of Protected Health Information 5,000 1 3/60 250 Total 921,813,702 Terry S. Clark, Asst Information Collection Clearance Officer. [FR Doc. 2016-11785 Filed 5-18-16; 8:45 am] BILLING CODE 4153-01-P --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2016-11785. Public record. Not legal advice.