The Office of Management and Budget (“OMB”) has released its 2026 Unified Agenda, which identifies regulatory actions that federal agencies expect to propose or finalize during the remainder of the year. Below, we highlight several notable health privacy, interoperability, and data exchange rules that the Department of Health and Human Services (“HHS”) has listed for proposed or final action in 2026. The descriptions and target dates below reflect only the agency’s stated intentions and are subject to change.
Final Rules
HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens
- The HHS Office for Civil Rights (“OCR”) intends to issue a final rule that would modify the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule to, among other changes, strengthen individuals’ right to access their protected health information (“PHI”), improve information sharing for care coordination and case management, facilitate greater family and caregiver involvement in emergency situations, enable greater disclosures in emergency or threatening circumstances, and reduce administrative burdens on HIPAA covered health care providers and health plans. The proposed rule was published on January 21, 2021, and we summarized the proposal here.
- Expected agency action: August 2026.
Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity (HTI-5)
- HHS, through the Office of the National Coordinator for Health Information Technology (“ONC”), intends to issue a final rule focused on deregulatory changes to the ONC health information technology standards, implementation specifications, and certification criteria, as well as updates to information blocking requirements. ONC previously issued a notice of proposed rulemaking on December 29, 2025, which we summarized here.
- Expected agency action: August 2026.
Proposed Rules
HIPAA Privacy Rule to Promote Individuals’ Timely Access to their Protected Health Information
- HHS intends to issue a notice of proposed rulemaking to solicit comments on proposals to modify the HIPAA Privacy Rule’s requirements regarding the time period within which covered entities must respond to an individual’s request for access to their PHI. As part of the January 21, 2021, proposed rule to update the HIPAA Privacy Rule (mentioned above), OCR had proposed shortening covered entities’ response time to no later than 15 calendar days (from the current 30 days).
- Expected agency action: November 2026.
Administrative Simplification: Modifications to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Electronic Transaction Standards
- The Centers for Medicare & Medicaid Services (“CMS”) intends to issue a notice of proposed rulemaking that would propose updating the standards for the electronic exchange of health information under HIPAA’s Administrative Simplification provisions. The rule would propose to replace the X12 Technical Reports Type 3, Version 5010 with an updated version for health care claims or equivalent encounter information transactions, as well as for electronic remittance advice transactions.
- Expected agency action: December 2026.
Health Data, Technology, and Interoperability: Application Programming Interfaces and Information Blocking (HTI-6)
- ONC intends to issue a notice of proposed rulemaking that would include proposals for standards adoption, certification of health IT to support expanded uses of application programming interfaces (“APIs”), and enhancements to the conditions of certification. The notice of proposed rulemaking would also update the information blocking regulations governing information sharing.
- Expected agency action: November 2026.
Recent Comments