Who Pays for HIPAA's $3.2 Billion in Savings?
An economically significant HIPAA Privacy Rule final rule has been sitting at OMB since April 2. It is day 205, longer than all four CY2027 rate books put together, and the Unified Agenda's own target was August. The proposal underneath it cuts your records response from 30 days to 15, bans a fee on anything a patient pulls through the portal, and makes you post a price list. The impact analysis books $4.4 billion of savings and not one dollar of it against any of that. Also in the window: a 203-page Exchange verification rule filed Friday afternoon, and 155 lab codes where CMS did not agree with its own advisory panel.
Sixteen rules sat at OMB this morning across CMS and the Office for Civil Rights. Fifteen of them you could have guessed at.
The four CY2027 rate books are there, where they always are in late October. So is the drug price negotiation final rule, and the thing CMS named CRUSH.
The one at the top of the list is not a CMS rule at all. It has been there since the first week of April, and it rewrites the part of your operation nobody in revenue cycle thinks of as regulated payment.
"What has the Office for Civil Rights been holding for seven months?"
The One You Weren't Watching
RIN 0945-AA00 is listed at OMB as a final rule, from HHS OCR, received April 2, 2026, economically significant, no legal deadline. That is 205 days as of this morning.
Put the four CY2027 rate books together and you get 132 (chart below). This single rule has outlasted all of them, and it has outlasted every CMS action in the queue by at least forty days.
The 2026 Unified Agenda entry for it lists Final Action 08/00/2026. August came and went.
The rest of this brief is for subscribers.
The impact tables, the code-level detail, and the rest of the analysis sit past this line.
$50 a month, or $500 a year.
Already a subscriber? Sign in