Hospitals Warn HHS Not to Ban App Authorization Checks in the Coming HIPAA Final Rule

Hospital IT leaders are trying to head off a HIPAA change that has not been published yet. This week a coalition of 17 health systems, hospitals and clinics led by the College of Healthcare Information Management Executives (CHIME) wrote to Health and Human Services Secretary Robert F. Kennedy Jr. about the long-delayed final rule to the HIPAA Privacy Rule. Their worry is specific. They fear the final text could stop providers from checking whether a patient really authorized a third-party app to pull their records, and could treat a single identity credential as proof of everything. Both changes, they argue, would go well beyond what HHS proposed in 2021.

The rule they are worried about

HHS published its Proposed Modifications to the HIPAA Privacy Rule To Support, and Remove Barriers to, Coordinated Care and Individual Engagement on January 21, 2021, in the final days of the first Trump administration. Comments closed on May 6, 2021, after an extension. The proposal then stalled. Trade press reports that the Office for Civil Rights (OCR) has since revived it as a regulatory priority and once targeted an August 2026 release. As of today the Federal Register shows only the 2021 proposal and its comment extension, with no final rule.

The 2021 proposal was mainly about access. Among other things, it would have:

• cut the time to respond to a patient’s access request from 30 calendar days to 15, with one 15-day extension;
• defined “personal health application” and made clear that patients can get their electronic records through the app of their choice, including through a secure, standards-based API;
• let patients direct an electronic copy of records held in an electronic health record to a third party by a request that is “clear, conspicuous, and specific,” whether made orally or in writing; and
• expressly banned “unreasonable” identity verification, such as requiring notarized requests or in-person proof of identity when a remote method is practical.

On that last point the 2021 text left room for providers. HHS wrote that the change was “not intended to prevent covered entities from taking reasonable measures to verify the identity and authority of the individual or entity making the request.” The current Privacy Rule already requires that kind of check before most disclosures of protected health information. The coalition’s letter builds its case on that sentence.

What the coalition is asking for

According to GovInfoSecurity, which first reported the letter, a source said current officials want final provisions that differ from the 2021 proposal, including a ban on providers independently confirming patient authorization for third-party apps. That account comes from one anonymous source, and HHS has not confirmed it. The letter, as quoted by GovInfoSecurity and HIPAA Journal, responds to that possibility rather than to published text.

The groups make three main arguments.

First, a flat ban would be a new rule, not a refinement. “A final rule that categorically prohibits providers from confirming whether a patient has authorized a third-party application to receive PHI would represent a material departure from the proposed approach,” the coalition wrote. CHIME adds that the 2021 proposal “expressly preserved” reasonable verification, which shows it was aimed at unreasonable barriers, not at removing legitimate safeguards.

Second, identity and authority are different questions. The letter says an IAL2 credential “may provide sufficient assurance as to the identity of the individual,” but “does not necessarily establish that the individual has been accurately matched to the appropriate medical record, nor does it establish the nature, scope, duration, or validity” of what the patient authorized the app to do. Identity proofing, patient matching and checking authority are, in the coalition’s words, “analytically and operationally distinct functions.”

Third, process. Under the Administrative Procedure Act, a final rule must be a “logical outgrowth” of its proposal. Otherwise the public has not had fair notice. The coalition says the 2021 notice asked about unreasonable verification but did not warn that reasonable confirmation might be banned outright. It asks OCR to:

• preserve providers’ discretion to take reasonable, risk-appropriate steps to confirm that a patient authorized an app, including checking directly with the patient where appropriate;
• issue guidance with concrete examples separating unreasonable verification barriers from legitimate safeguards;
• open another notice-and-comment period if the final policy departs from the 2021 proposal; and
• if it does not, write explicit enforcement protections for providers who act in good faith on patient-directed disclosures.

Where IAL2 comes from

The IAL2 point is about more than the HIPAA rulemaking. Identity Assurance Level 2 is a federal digital identity standard for remote identity proofing. It has become central to the Centers for Medicare & Medicaid Services’ voluntary health technology ecosystem. Under the CMS Interoperability Framework, a patient who uses an IAL2 credential from a CMS-approved service, together with stronger AAL2 authentication such as a passkey, should get their records back from every node on a CMS Aligned Network “without requiring knowledge of specific providers, portal accounts, or additional interactions.”

The same framework says nothing in it is meant to override HIPAA. It states that participating covered entities keep their obligations, “including, for example, verifying the identity and authority of protected health information (PHI) requesters.” So CMS’s own document separates identity from authority, which is the same distinction the coalition is asking OCR to keep. The open question is whether the final Privacy Rule will treat a strong credential as satisfying both.

For patients the trade-off is real. Slow or obstructive verification is a long-standing access complaint, and the notarization and in-person examples in the 2021 proposal came from actual complaints to HHS. But once a record leaves the provider for a consumer app, much of HIPAA’s protection may no longer apply. The gap around consumer health apps that sit outside HIPAA helps explain why providers want a final check before the data leaves, and the letter warns that barring those checks could increase privacy and security risks for patients.

What compliance teams can do before the final rule lands

No one outside HHS knows what the final text will say. Several things will be useful either way:

1. Map your current verification steps. List every check you apply to access requests and to patient-directed disclosures to apps and other third parties. Mark which checks confirm identity, which match the patient to the record, and which confirm what the patient authorized.
2. Test each step against the 2021 “unreasonable” examples. Notarization, in-person-only proof of identity and portal-only requests were all named. If you still use any of them where a remote method would work, fix that now. Those changes are likely to survive in any version of the rule.
3. Document the risk basis for authorization checks. If you confirm app authorizations with patients, record why: mismatched demographics, unusual request volume, sensitive record types. A documented, risk-based process is easier to defend under either outcome.
4. Prepare for 15-day turnarounds. The proposed deadline is half the current one. Look at your intake queues, release-of-information vendors and API capacity.
5. Review app-facing contracts and vendor oversight. Release-of-information firms, EHR vendors and API platforms will carry out whatever the rule requires. Bring them into your third-party risk management program.
6. Give one owner responsibility for the rule. Make sure your HIPAA compliance officer or equivalent owns tracking the final rule, its effective date and any OCR guidance.

Providers have been burned before when rules about access and data sharing collided. Past interoperability fights show how quickly “open the data” and “protect the data” turn into litigation. The record can also move into places where HIPAA no longer follows it, as shown by the protection that disappears once a record is uploaded to an AI platform.

Frequently asked questions

Has HHS changed the HIPAA verification rules yet?

No. The current Privacy Rule still requires covered entities to verify the identity and authority of a person requesting PHI. The 2021 changes are only proposed, and no final rule appears in the Federal Register.

Is this the same as the HIPAA Security Rule update?

No. This dispute is about the Privacy Rule proposal on care coordination and individual access. The Security Rule proposal on cybersecurity safeguards is a separate rulemaking.

Would an IAL2 credential replace patient authorization?

Not under the 2021 proposal as written. The coalition fears the final rule could treat IAL2 as enough for every verification purpose. It argues that a credential proves who someone is, not which record is theirs or what they agreed to share.

What happens if the final rule differs a lot from the proposal?

Under the Administrative Procedure Act, provisions that are not a logical outgrowth of the proposal can be challenged. That is why the coalition asks for a new comment period, or for good-faith enforcement protections if HHS goes ahead.

The patient’s key is not the whole lock

Both sides agree that patients should get their records quickly, through the tools they choose. The disagreement is narrower: whether a strong digital ID is enough on its own for a provider to release records to an app, or whether the provider may still confirm that this patient sent this app for these records. HHS will answer that in the final rule. Until it does, providers should keep their verification steps reasonable, documented and easy to explain.