Davis Wright Tremaine reported HHS lists a right of access timing proposed rule for November 2026

What happened

Davis Wright Tremaine, in a post dated July 8, 2026, reported on HHS’s updated rulemaking timeframes. It reported that a proposed rule on right of access timeliness, RIN 0945-AA28, is targeted for November 2026, and quoted HHS as saying it would address the amount of time covered entities have to respond to requests for protected health information.

The firm also reported that HHS pushed the final HIPAA Security Rule amendments from May 2026 to July 2027, with the status changed from final rule stage to long term actions, and that a proposed rule on distributing civil money penalties and settlements to harmed individuals, RIN 0945-AA04, is targeted for November 2027. It noted that all of these timelines are aspirational and subject to change. It also reported that the Privacy Rule coordinated care amendments, RIN 0945-AA00, were sent to OMB on April 4, 2026 and targeted for August 2026.

What we have not verified

We have not read the federal regulatory agenda entries ourselves, and we have not checked whether any of these rules has been published since the post. In particular we have not confirmed whether the coordinated care amendments were released in August. We are watching the official sources for each.

Analysis: Nothing here changes a clinic’s obligations today. The current Privacy Rule requirement to act on an access request within 30 days stays in force until a final rule says otherwise, and OCR’s recent right of access settlements, covered elsewhere on this desk, apply that standard. A proposed rule is only the start of a process that includes public comment. What a clinic can do now is to find out how long its own requests actually take and who owns each one, so that a shorter deadline, if one comes, finds a tracked process rather than an inbox. This is reporting, not legal advice.