[Federal Register Volume 75, Number 134 (Wednesday, July 14, 2010)]
[Proposed Rules]
[Pages 40868-40924]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-16718]
[[Page 40867]]
-----------------------------------------------------------------------
Part II
Department of Health and Human Services
-----------------------------------------------------------------------
45 CFR Parts 160 and 164
Modifications to the HIPAA Privacy, Security, and Enforcement Rules
Under the Health Information Technology for Economic and Clinical
Health Act; Proposed Rule
Federal Register / Vol. 75 , No. 134 / Wednesday, July 14, 2010 /
Proposed Rules
[[Page 40868]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Parts 160 and 164
RIN: 0991-AB57
Modifications to the HIPAA Privacy, Security, and Enforcement
Rules Under the Health Information Technology for Economic and Clinical
Health Act
AGENCY: Office for Civil Rights, Department of Health and Human
Services.
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: The Department of Health and Human Services (HHS or ``the
Department'') is issuing this notice of proposed rulemaking to modify
the Standards for Privacy of Individually Identifiable Health
Information (Privacy Rule), the Security Standards for the Protection
of Electronic Protected Health Information (Security Rule), and the
rules pertaining to Compliance and Investigations, Imposition of Civil
Money Penalties, and Procedures for Hearings (Enforcement Rule) issued
under the Health Insurance Portability and Accountability Act of 1996
(HIPAA). The purpose of these modifications is to implement recent
statutory amendments under the Health Information Technology for
Economic and Clinical Health Act (``the HITECH Act'' or ``the Act''),
to strengthen the privacy and security protection of health
information, and to improve the workability and effectiveness of these
HIPAA Rules.
DATES: Submit comments on or before September 13, 2010.
ADDRESSES: You may submit comments, identified by RIN 0991-AB57, by any
of the following methods (please do not submit duplicate comments):
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments. Attachments should be
in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft
Word.
Regular, Express, or Overnight Mail: U.S. Department of
Health and Human Services, Office for Civil Rights, Attention: HITECH
Privacy and Security Rule Modifications, Hubert H. Humphrey Building,
Room 509F, 200 Independence Avenue, SW., Washington, DC 20201. Please
submit one original and two copies.
Hand Delivery or Courier: Office for Civil Rights,
Attention: HITECH Privacy and Security Rule Modifications, Hubert H.
Humphrey Building, Room 509F, 200 Independence Avenue, SW., Washington,
DC 20201. Please submit one original and two copies. (Because access to
the interior of the Hubert H. Humphrey Building is not readily
available to persons without Federal government identification,
commenters are encouraged to leave their comments in the mail drop
slots located in the main lobby of the building.)
Inspection of Public Comments: All comments received before the
close of the comment period will be available for public inspection,
including any personally identifiable or confidential business
information that is included in a comment. We will post all comments
received before the close of the comment period at http://www.regulations.gov. Because comments will be made public, they should
not include any sensitive personal information, such as a person's
social security number; date of birth; driver's license number, State
identification number or foreign country equivalent; passport number;
financial account number; or credit or debit card number. Comments also
should not include any sensitive health information, such as medical
records or other individually identifiable health information, or any
non-public corporate or trade association information, such as trade
secrets or other proprietary information.
FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.
SUPPLEMENTARY INFORMATION:
The discussion below includes a description of the statutory and
regulatory background of the proposed rules, a section-by-section
description of the proposed modifications, and the impact statement and
other required regulatory analyses. We solicit public comment on the
proposed rules. Persons interested in commenting on the provisions of
the proposed rules can assist us by preceding discussion of any
particular provision or topic with a citation to the section of the
proposed rule being discussed.
I. Statutory and Regulatory Background
The regulatory modifications proposed below concern several sets of
rules that implement the Administrative Simplification provisions of
title II, subtitle F, of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), which added a new
part C to title XI of the Social Security Act (sections 1171-1179 of
the Social Security Act, 42 U.S.C. 1320d-1320d-8). The Health
Information Technology for Economic and Clinical Health (HITECH) Act,
which was enacted as title XIII of division A and title IV of division
B of the American Recovery and Reinvestment Act of 2009 (ARRA), Public
Law 111-5, modifies certain provisions of the Social Security Act
pertaining to the Administrative Simplification Rules (HIPAA Rules) and
requires certain modifications to the HIPAA Rules themselves.
A. HIPAA Administrative Simplification--Statutory Background
The Administrative Simplification provisions of HIPAA provided for
the establishment of national standards for the electronic transmission
of certain health information, such as standards for certain health
care transactions conducted electronically and code sets and unique
health care identifiers for health care providers and employers. The
Administrative Simplification provisions of HIPAA also required the
establishment of national standards to protect the privacy and security
of personal health information and established civil money and criminal
penalties for violations of the Administrative Simplification
provisions. The Administrative Simplification provisions of HIPAA apply
to three types of entities, which are known as ``covered entities'':
health care providers who conduct covered health care transactions
electronically, health plans, and health care clearinghouses.
B. HIPAA Administrative Simplification--Regulatory Background
The rules proposed below concern the privacy and security standards
issued pursuant to HIPAA, as well as the enforcement rules that
implement HIPAA's civil money penalty authority. The Standards for
Privacy of Individually Identifiable Health Information, known as the
``Privacy Rule,'' were issued on December 28, 2000, and amended on
August 14, 2002. See 65 FR 82462, as amended at 67 FR 53182. The
Security Standards for the Protection of Electronic Protected Health
Information, known as the ``Security Rule,'' were issued on February
20, 2003. See 68 FR 8334. The Compliance and Investigations, Imposition
of Civil Money Penalties, and Procedures for Hearings regulations,
collectively known as the ``Enforcement Rule,'' were issued as an
interim final rule on April 17, 2003 (68 FR 18895), and revised and
issued as a final rule, following rulemaking, on February 16, 2006 (71
FR 8390).
The Privacy Rule protects individuals' medical records and other
individually
[[Page 40869]]
identifiable health information created or received by or on behalf of
covered entities, known as ``protected health information.'' The
Privacy Rule protects individuals' health information by regulating the
circumstances under which covered entities may use and disclose
protected health information and by requiring covered entities to have
safeguards in place to protect the privacy of the information. As part
of these protections, covered entities are required to have contracts
or other arrangements in place with business associates that perform
functions for or provide services to the covered entity and that
require access to protected health information to ensure that these
business associates likewise protect the privacy of the health
information. The Privacy Rule also gives individuals rights with
respect to their protected health information, including rights to
examine and obtain a copy of their health records and to request
corrections.
The Security Rule, which applies only to protected health
information in electronic form, requires covered entities to implement
certain administrative, physical, and technical safeguards to protect
this electronic information. As with the Privacy Rule, the Security
Rule requires covered entities to have contracts or other arrangements
in place with their business associates that provide satisfactory
assurances that the business associates will appropriately safeguard
the electronic protected health information they receive, create,
maintain, or transmit on behalf of the covered entities.
The Enforcement Rule establishes rules governing the compliance
responsibilities of covered entities with respect to cooperation in the
enforcement process. It also provides rules governing the investigation
by the Department of compliance by covered entities, both through the
investigation of complaints and the conduct of compliance reviews. It
establishes rules governing the process and grounds for establishing
the amount of a civil money penalty where the Department has determined
a covered entity has violated a requirement of a HIPAA Rule. Finally,
the Enforcement Rule establishes rules governing the procedures for
hearings and appeals where the covered entity challenges a violation
determination.
C. The HITECH Act--Statutory Background
The HITECH Act, enacted on February 17, 2009, is designed to
promote the widespread adoption and standardization of health
information technology. Subtitle D of title XIII, entitled ``Privacy,''
supports this goal by adopting amendments designed to strengthen the
privacy and security protections of health information established by
HIPAA. These provisions include extending the applicability of certain
of the Privacy and Security Rules' requirements to the business
associates of covered entities; requiring HIPAA covered entities and
business associates to provide for notification of breaches of
``unsecured protected health information''; establishing new
limitations on the use and disclosure of protected health information
for marketing and fundraising purposes; prohibiting the sale of
protected health information; requiring the consideration of a limited
data set as the minimum necessary amount of information; and expanding
individuals' rights to access and receive an accounting of disclosures
of their protected health information, and to obtain restrictions on
certain disclosures of protected health information to health plans. In
addition, subtitle D adopts provisions designed to strengthen and
expand HIPAA's enforcement provisions. We provide a brief overview of
the relevant statutory provisions below.
In the area of business associates, the Act makes a number of
changes. First, section 13401 of the Act applies certain provisions of
the Security Rule that apply to covered entities directly to their
business associates and makes business associates liable for civil and
criminal penalties for the failure to comply with these provisions.
Similarly, section 13404 makes business associates of covered entities
civilly and criminally liable under the Privacy Rule for making uses
and disclosures of protected health information that do not comply with
the terms of their business associate contracts. The Act also provides
that the additional privacy and security requirements of subtitle D of
the Act are applicable to business associates and that such
requirements shall be incorporated into business associate contracts.
Finally, section 13408 of the Act requires that organizations that
provide data transmission of protected health information to a covered
entity or business associate and that require routine access to such
information, such as Health Information Exchange Organizations,
Regional Health Information Organizations, and E-prescribing Gateways,
as well as vendors that contract with covered entities to offer
personal health records to patients as part of the covered entities'
electronic health records, shall be treated as business associates for
purposes of the HITECH Act and the HIPAA Privacy and Security Rules and
required to enter into business associate contracts.
Section 13402 of the Act sets forth the breach notification
provisions, requiring covered entities and business associates to
provide notification following discovery of a breach of unsecured
protected health information. Additionally, section 13407 of the Act,
enforced by the Federal Trade Commission (FTC), applies similar breach
notification provisions to vendors of personal health records and their
third party service providers.
Section 13405 of the Act requires the Department to modify certain
Privacy Rule provisions. In particular, section 13405 sets forth
certain circumstances in which covered entities must comply with an
individual's request for restriction of disclosure of his or her
protected health information, provides for covered entities to consider
a limited data set as the minimum necessary for a particular use,
disclosure, or request of protected health information, and requires
the Secretary to issue guidance to address what constitutes minimum
necessary under the Privacy Rule. Section 13405 also requires the
Department to modify the Privacy Rule to require covered entities that
use or maintain electronic health records to provide individuals, upon
request, with an accounting of disclosures of protected health
information through an electronic health record for treatment, payment,
or health care operations; generally prohibits the sale of protected
health information without a valid authorization from the individual;
and strengthens an individual's right to an electronic copy of their
protected health information, where a covered entity uses or maintains
an electronic health record.
Section 13406 of the Act requires the Department to modify the
marketing and fundraising provisions of the Privacy Rule. With respect
to marketing, the Act requires authorizations for certain health-
related communications, which are currently exempted from the
definition of marketing, if the covered entity receives remuneration in
exchange for making the communication. The Act also strengthens an
individual's right under the Privacy Rule to opt out of fundraising
communications by requiring the Department to modify the Privacy Rule
so that covered entities must provide individuals with a clear and
conspicuous opportunity to opt out of receiving fundraising
[[Page 40870]]
communications and by requiring that an opt out be treated as a
revocation of authorization under the Privacy Rule.
Section 13410 of the Act addresses enforcement in a number of ways.
First, section 13410(a) provides that the Secretary's authority to
impose a civil money penalty will only be barred to the extent a
criminal penalty has been imposed, rather than in cases in which the
offense in question merely constitutes an offense criminally
punishable. In addition, section 13410(a) of the Act requires the
Secretary to formally investigate any complaint where a preliminary
investigation of the facts indicates a possible violation due to
willful neglect and to impose a penalty where a violation is found in
such cases. Section 13410(c) of the Act provides, for purposes of
enforcement, for the transfer to the HHS Office for Civil Rights of any
civil money penalty or monetary settlement collected under the Privacy
and Security Rules and also requires the Department to establish by
regulation a methodology for distributing to harmed individuals a
percentage of the civil money penalties and monetary settlements
collected under the Privacy and Security Rules. Effective as of
February 18, 2009, section 13410(d) of the Act also modified the civil
money penalty structure for violations of the HIPAA Rules by
implementing a tiered increase in the amount of penalties based on
culpability. In addition, as of February 18, 2009, section 13410(e) of
the Act also granted State Attorneys General the authority to enforce
the HIPAA Rules by bringing civil actions on behalf of State residents
in court.
Section 13421 states that HIPAA's State preemption provisions at 42
U.S.C. 1320d-7 shall apply to the provisions of subtitle D of the
HITECH Act in the same manner as they do to HIPAA's provisions.\1\
Section 13423 of the Act provides a general effective date of February
18, 2010, for most of its provisions, except where a different
effective date is otherwise provided.
---------------------------------------------------------------------------
\1\ We note that section 13421 of the HITECH Act and HIPAA's
State preemption provisions do not affect the applicability of other
Federal law, such as the Confidentiality of Alcohol and Drug Abuse
Patient Records Regulation at 42 CFR Part 2, to a covered entity's
use or disclosure of health information.
---------------------------------------------------------------------------
The Act also provides for the development of guidance, reports, and
studies in a number of areas, including guidance on appropriate
technical safeguards to implement the HIPAA Security Rule (section
13401(c)); for purposes of breach notification, guidance on the methods
and technologies for rendering protected health information unusable,
unreadable, or indecipherable to unauthorized individuals (section
13402(h)); guidance on what constitutes the minimum necessary amount of
information for purposes of the Privacy Rule (section 13405(b)); a
report by the Government Accountability Office (GAO) regarding
recommendations for a methodology under which harmed individuals may
receive a percentage of civil money penalties and monetary settlements
under the HIPAA Privacy and Security Rules (section 13410(c)); a report
to Congress on HIPAA Privacy and Security enforcement (section
13424(a)); a study and report on the application of privacy and
security requirements to non-HIPAA covered entities (section 13424(b));
guidance on de-identification (section 13424(c)); and a study on the
Privacy Rule's definition of ``psychotherapy notes'' at 45 CFR 164.501,
with regard to including test data that is related to direct responses,
scores, items, forms, protocols, manuals, or other materials that are
part of a mental health evaluation (section 13424(f)).
Finally, the Act includes provisions for education by HHS on health
information privacy and for periodic audits by the Secretary. Section
13403(a) provides for the Secretary to designate HHS regional office
privacy advisors to offer guidance and education to covered entities,
business associates, and individuals on their rights and
responsibilities related to Federal privacy and security requirements
for protected health information. Section 13403(b) requires the HHS
Office for Civil Rights, not later than 12 months after enactment, to
develop and maintain a multi-faceted national education initiative to
enhance public transparency regarding the uses of protected health
information, including programs to educate individuals about potential
uses of their protected health information, the effects of such uses,
and the rights of individuals with respect to such uses. Section 13411
requires the Secretary to provide for periodic audits to ensure covered
entities and business associates comply with the applicable
requirements of the HIPAA Privacy and Security Rules.
We discuss many of the Act's statutory provisions in more detail
below where we describe section-by-section how these proposed
regulations would implement those provisions of the Act. However, we do
not discuss in detail the breach notification provisions in sections
13402 of the Act or the modified civil money penalty structure in
section 13410(d) of the Act, which as explained below, have been the
subject of previous rulemakings. In addition, we do not address in this
rulemaking the accounting for disclosures requirement in section 13405
of the Act, which is tied to the adoption of a standard under the
HITECH Act at subtitle A of title XIII of ARRA, or the penalty
distribution methodology requirement in section 13410(c) of the Act,
which is to be based on the recommendations noted above to be developed
at a later date by the GAO. These provisions will be the subject of
future rulemakings. Further, we clarify that we are not issuing
regulations with respect to the new authority of the State Attorneys
General to enforce the HIPAA Rules. Finally, other than the guidance
required by section 13405(b) of the Act with respect to what
constitutes minimum necessary, this proposed rule does not address the
studies, reports, guidance, audits, or education efforts required by
the HITECH Act.
D. The HITECH Act--Regulatory Background
As noted above, certain of the HITECH Act's privacy and security
provisions have already been the subject of rulemakings and related
actions. In particular, the Department published interim final
regulations to implement the breach notification provisions at section
13402 of the Act for HIPAA covered entities and business associates in
the Federal Register on August 24, 2009 (74 FR 42740), effective
September 23, 2009. Similarly, the FTC published final regulations
implementing the breach notification provisions at section 13407 for
personal health record vendors and their third party service providers
on August 25, 2009 (74 FR 42962), effective September 24, 2009. For
purposes of determining to what information the HHS and FTC breach
notification regulations apply, the Department also issued, first on
April 17, 2009 (published in the Federal Register on April 27, 2009, 74
FR 19006), and then later with its interim final rule, the guidance
required by the HITECH Act under 13402(h) specifying the technologies
and methodologies that render protected health information unusable,
unreadable, or indecipherable to unauthorized individuals. In addition,
to conform the provisions of the Enforcement Rule to the new tiered and
increased civil money penalty structure made effective by the HITECH
Act on the day after enactment, or February 18, 2009, the Department
published an interim final rule on October 30, 2009 (74 FR 56123),
effective November 30, 2009.
[[Page 40871]]
II. General Issues
A. Effective and Compliance Dates
As noted above, section 13423 of the Act provides that the
provisions in subtitle D took effect one year after enactment, i.e., on
February 18, 2010, except as specified otherwise. There are a number of
exceptions to this general rule. Some provisions were effective the day
after enactment, i.e., February 18, 2009. For example, the tiered and
increased civil money penalty provisions of section 13410(d) were
effective for violations occurring after the date of enactment.
Sections 13402 and 13407 of the Act regarding breach notification
required interim final rules within 180 days of enactment, with
effective dates 30 days after the publication of such rules. Other
provisions of the Act have later effective dates. For example, the
provision at section 13410(a)(1) of the Act providing that the
Secretary's authority to impose a civil money penalty will only be
barred to the extent a criminal penalty has been imposed, rather than
in cases in which the offense in question merely constitutes an offense
that is criminally punishable, becomes effective for violations
occurring on or after February 18, 2011. The rules proposed below
generally pertain to the statutory provisions that became effective on
February 18, 2010, or, in a few cases, on a later date.
We note that the final rule will not take effect until after most
of the provisions of the HITECH Act became effective on February 18,
2010. We recognize that it will be difficult for covered entities and
business associates to comply with the statutory provisions until after
we have finalized our changes to the HIPAA Rules. In addition, we
recognize that covered entities and business associates will need some
time beyond the effective date of the final rule to come into
compliance with the final rule's provisions. In light of these
considerations, we intend to provide covered entities and business
associates with 180 days beyond the effective date of the final rule to
come into compliance with most of the rule's provisions. We believe
that providing a 180-day compliance period best comports with section
1175(b)(2) of the Social Security Act, 42 U.S.C. 1320d-4, and our
implementing provision at 45 CFR 160.104(c)(1), which require the
Secretary to provide at least a 180-day period for covered entities to
comply with modifications to standards and implementation
specifications in the HIPAA Rules. While the Social Security Act and
the HIPAA Rules permit the Secretary to further delay the compliance
date for small health plans, we do not believe that it is necessary to
do so for this rule both because most of the changes being proposed are
discrete modifications to existing requirements of the HIPAA Rules, as
well as because the Department is proposing an additional one-year
transition period to modify certain business associate agreements,
which should provide sufficient relief to all covered entities,
including small health plans. The Department welcomes comment on the
assumption that it is not necessary to extend the compliance date for
small health plans.
We also expect that for future modifications to the HIPAA Rules, in
most cases, a 180-day compliance period will suffice. Accordingly, we
propose to add a provision at Sec. 160.105 to address the compliance
date generally for implementation of new or modified standards in the
HIPAA Rules. Proposed Sec. 160.105 would provide that with respect to
new standards or implementation specifications or modifications to
standards or implementation specifications in the HIPAA Rules, except
as otherwise provided, covered entities and business associates must
comply with the applicable new standards or implementation
specifications or modifications to standards or implementation
specifications no later than 180 days from the effective date of any
such change. Where future modifications to the HIPAA Rules necessitate
a longer compliance period, we would provide so accordingly in the
regulatory text. We propose to retain the compliance date provisions at
Sec. Sec. 164.534 and 164.318, which provide the compliance dates of
April 14, 2003, and April 20, 2005, for initial implementation of the
HIPAA Privacy and Security Rules, respectively, for historical purposes
only.
We note that proposed Sec. 160.105 regarding the compliance date
of new or modified standards or implementation specifications would not
apply to modifications to the provisions of the HIPAA Enforcement Rule
because such provisions are not standards or implementation
specifications (as the terms are defined at Sec. 160.103). Such
provisions are in effect and apply at the time the final rule becomes
effective or as otherwise specifically provided. We also note that our
proposed general rule for a 180-day compliance period for new or
modified standards would not apply where we expressly provide a
different compliance period in the regulation for one or more
provisions. For purposes of this proposed rule, this would mean that
the 180-day compliance period would not govern the time period required
to modify those business associate agreements that qualify for the
longer transition period proposed in Sec. 164.532. We seek comments on
any potential unintended consequences of establishing a 180-day
compliance date as a regulatory default, with the noted exceptions.
B. Other Proposed Changes
While passage of the HITECH Act necessitates much of the rulemaking
below, it does not account for all of the proposed changes to the HIPAA
Privacy, Security, and Enforcement Rules encompassed in this
rulemaking. The Department is taking this opportunity to improve the
workability and effectiveness of all three sets of HIPAA Rules. The
Privacy Rule has not been amended since 2002, and the Security Rule has
not been amended since 2003. While the Enforcement Rule was amended in
the October 30, 2009, interim final rule to incorporate the
enforcement-related HITECH statutory changes that are already
effective, it has not been otherwise substantively amended since 2006.
In the intervening years, HHS has accumulated a wealth of experience
with these rules, both from public contact in various forums and
through the process of enforcing the rules. In addition, we have
identified a number of needed technical corrections to the rules.
Accordingly, we propose a number of modifications that we believe will
eliminate ambiguities in the rules and/or make them more workable and
effective. Further, we propose a few modifications to conform the HIPAA
Privacy Rule to provisions in the Patient Safety and Quality
Improvement Act of 2005 (PSQIA). We address the substantive proposed
changes in the section-by-section description of the proposed rule
below. Technical corrections are discussed at the end of the section-
by-section description of the other proposed amendments to the rules.
III. Section-by-Section Description of the Proposed Amendments to
Subparts A and B of Part 160
Subpart A of part 160 of the HIPAA Rules contains general
provisions that apply to all of the HIPAA Rules. Subpart B of part 160
contains the regulatory provisions implementing HIPAA's preemption
provisions. We propose to amend a number of these provisions. Some of
the proposed changes are necessitated by the statutory changes made by
the HITECH Act, while others are of a technical or conforming nature.
[[Page 40872]]
A. Subpart A--General Provisions, Section 160.101--Statutory Basis and
Purpose
This section sets out the statutory basis and purpose of the HIPAA
Rules. We propose a technical change to include a reference to the
provisions of the HITECH Act upon which most of the regulatory changes
proposed below are based.
B. Subpart A--General Provisions, Section 160.102--Applicability
This section sets out to whom the HIPAA Rules apply. We propose to
add a new paragraph (b) to make clear, consistent with the provisions
of the HITECH Act that are discussed more fully below, that the
standards, requirements, and implementation specifications of the
subchapter apply to business associates, where so provided.
C. Subpart A--General Provisions, Section 160.103--Definitions
Section 160.103 contains definitions of terms that appear
throughout the HIPAA Rules. For ease of reference, we propose to move
several definitions currently found at Sec. 160.302 to Sec. 160.103
without substantive change to the definitions themselves. This category
includes definitions of the following terms: ``ALJ,'' ``civil money
penalty,'' and ``violation or violate.'' As the removal of these
definitions, along with the removal of other definitions discussed
below (e.g., ``administrative simplification provision'' and
``respondent''), would leave Sec. 160.302 unpopulated, we propose to
reserve that section. We also propose to remove a comma from the
definition of ``disclosure'' inadvertently inserted into the definition
in a prior rulemaking, which is not intended as a substantive change to
the definition. In addition, we propose to replace the term
``individually identifiable health information'' with ``protected
health information'' in the definition of ``standard'' to better
reflect the scope of the Privacy and Security Rules. Further, we
propose the following definitional changes:
1. Definition of ``Administrative Simplification Provision''
This definition is currently located in the definitions section of
subpart C of part 160 of the HIPAA Enforcement Rule. We propose to
remove the definition of this term from Sec. 160.302 and move it to
the definitions section located at Sec. 160.103 for clarity and
convenience, as the term is used repeatedly throughout the entire part
160. We also propose to add to the definition a reference to sections
13400-13424 of the HITECH Act.
2. Definition of ``Business Associate''
Sections 164.308(b) of the Security Rule and 164.502(e) of the
Privacy Rule require a covered entity to enter into a contract or other
written agreement or arrangement with its business associates. The
purpose of these contracts or other arrangements, generally known as
business associate agreements, is to provide some legal protection when
protected health information is being handled by another person (a
natural person or legal entity) on behalf of a covered entity. The
HIPAA Rules define ``business associate'' generally to mean a person
who performs functions or activities on behalf of, or certain services
for, a covered entity that involve the use or disclosure of protected
health information. Examples of business associates include third party
administrators or pharmacy benefit managers for health plans, claims
processing or billing companies, transcription companies, and persons
who perform legal, actuarial, accounting, management, or administrative
services for covered entities and who require access to protected
health information. We propose a number of modifications to the
definition of ``business associate.'' In particular, we propose to
modify the definition to conform the term to the statutory provisions
of PSQIA, 42 U.S.C. 299b-21, et seq., and the HITECH Act. Additional
modifications are made for the purpose of clarifying circumstances when
a business associate relationship exists and for general clarification
of the definition.
a. Inclusion of Patient Safety Organizations
We propose to add patient safety activities to the list of
functions and activities a person may undertake on behalf of a covered
entity that give rise to a business associate relationship. PSQIA, at
42 U.S.C. 299b-22(i)(1), provides that Patient Safety Organizations
(PSOs) must be treated as business associates when applying the Privacy
Rule. PSQIA provides for the establishment of PSOs to receive reports
of patient safety events or concerns from providers and provide
analyses of events to reporting providers. A reporting provider may be
a HIPAA covered entity and, thus, information reported to a PSO may
include protected health information that the PSO may analyze on behalf
of the covered provider. The analysis of such information is a patient
safety activity for purposes of PSQIA and the Patient Safety Rule, 42
CFR 3.10, et seq. While the HIPAA Rules as written would encompass a
PSO as a business associate when the PSO was performing quality
analyses and other activities on behalf of a covered health care
provider, we propose this change to the definition of business
associate to more clearly align the HIPAA and Patient Safety Rules.
We note that in some cases a covered health care provider, such as
a public or private hospital, may have a component PSO that performs
patient safety activities on behalf of the health care provider. See 42
CFR 3.20. In such cases, the component PSO would not be a business
associate of the covered entity but rather the persons performing
patient safety activities would be workforce members of the covered
entity. However, if the component PSO contracts out some of its patient
safety activities to a third party, the third party would be a business
associate of the covered entity. In addition, if a component PSO of one
covered entity performs patient safety activities for another covered
entity, such component PSO would be a business associate of the other
covered entity.
b. Inclusion of Health Information Organizations (HIO), E-Prescribing
Gateways, and Other Persons That Facilitate Data Transmission; as Well
as Vendors of Personal Health Records
Section 13408 of the HITECH Act, which became effective on February
18, 2010, provides that an organization, such as a Health Information
Exchange Organization, E-prescribing Gateway, or Regional Health
Information Organization, that provides data transmission of protected
health information to a covered entity (or its business associate) and
that requires access on a routine basis to such protected health
information must be treated as a business associate for purposes of the
Act and the HIPAA Privacy and Security Rules. Section 13408 also
provides that a vendor that contracts with a covered entity to allow
the covered entity to offer a personal health record to patients as
part of the covered entity's electronic health record shall be treated
as a business associate. Section 13408 requires that such organizations
and vendors enter into a written business associate contract or other
arrangement with the covered entity in accordance with the HIPAA Rules.
In accordance with the Act, we propose to modify the definition of
``business associate'' to explicitly designate these persons as
business
[[Page 40873]]
associates. Under proposed paragraphs (3)(i) and (ii) of the
definition, the term ``business associate'' would include: (1) A Health
Information Organization, E-prescribing Gateway, or other person that
provides data transmission services with respect to protected health
information to a covered entity and that requires routine access to
such protected health information; and (2) a person who offers a
personal health record to one or more individuals on behalf of a
covered entity.
Section 13408 of the Act makes reference to Health Information
Exchange Organizations; however, we instead include in the proposed
definition the term ``Health Information Organization'' because it is
our understanding that ``Health Information Organization'' is the more
widely recognized and accepted term to describe an organization that
oversees and governs the exchange of health-related information among
organizations.\2\ Section 13408 of the Act also specifically refers to
Regional Health Information Organizations. However, we do not believe
the inclusion of the term in the definition of ``business associate''
is necessary as a Regional Health Information Organization is simply a
Health Information Organization that governs health information
exchange among organizations within a defined geographic area.\3\
Further, the specific terms of ``Health Information Organization'' and
``E-prescribing Gateway'' are merely illustrative of the types of
organizations that would fall within this paragraph of the definition
of ``business associate.'' We request comment on the use of these terms
within the definition and whether additional clarifications or
additions are necessary.
---------------------------------------------------------------------------
\2\ Department of Health and Human Services, Office of the
National Coordinator for Health Information Technology, The National
Alliance for Health Information Technology Report to the Office of
the National Coordinator For Health Information Technology: Defining
Key Health Information Terms, Pg. 24 (2008).
\3\ Id. at 25.
---------------------------------------------------------------------------
Section 13408 also provides that the data transmission
organizations that the Act requires to be treated as business
associates are those that require access to protected health
information on a routine basis. Conversely, data transmission
organizations that do not require access to protected health
information on a routine basis would not be treated as business
associates. This is consistent with our prior interpretation of the
definition of ``business associate,'' through which we have indicated
that entities that act as mere conduits for the transport of protected
health information but do not access the information other than on a
random or infrequent basis are not business associates. See http://www.hhs.gov/ocr/privacy/hipaa/faq/providers/business/245.html. In
contrast, however, entities that manage the exchange of protected
health information through a network, including providing patient
locator services and performing various oversight and governance
functions for electronic health information exchange, have more than
``random'' access to protected health information and thus, would fall
within the definition of ``business associate.''
c. Inclusion of Subcontractors
We propose to add language in paragraph (3)(iii) of the definition
of ``business associate'' to provide that subcontractors of a covered
entity--i.e., those persons that perform functions for or provide
services to a business associate, other than in the capacity as a
member of the business associate's workforce, are also business
associates to the extent that they require access to protected health
information. We also propose to include a definition of
``subcontractor'' in Sec. 160.103 to make clear that a subcontractor
is a person who acts on behalf of a business associate, other than in
the capacity of a member of the workforce of such business associate.
Even though we use the term ``subcontractor,'' which implies there is a
contract in place between the parties, we note that the definition
would apply to an agent or other person who acts on behalf of the
business associate, even if the business associate has failed to enter
into a business associate contract with the person. We request comment
on the use of the term ``subcontractor'' and its proposed definition.
The proposed modifications are similar in structure and effect to
the Privacy Rule's initial extension of privacy protections from
covered entities to business associates through contract requirements
to protect downstream protected health information. The proposed
provisions avoid having privacy and security protections for protected
health information lapse merely because a function is performed by an
entity that is a subcontractor rather than an entity with a direct
relationship with a covered entity. Allowing such a lapse in privacy
and security protections may allow business associates to avoid
liability imposed upon them by sections 13401 and 13404 of the Act,
thus circumventing the congressional intent underlying these
provisions. The proposed definition of ``subcontractor'' also is
consistent with Congress' overall concern that the privacy and security
protections of the HIPAA Rules extend beyond covered entities to those
entities that create or receive protected health information in order
for the covered entity to perform its health care functions. For
example, as discussed above, section 13408 makes explicit that certain
types of entities providing services to covered entities--e.g., vendors
of personal health records--shall be considered business associates.
Therefore, consistent with Congress' intent in sections 13401 and 13404
of the Act, as well as its overall concern that the HIPAA Rules extent
beyond covered entities to those entities that create or receive
protected health information, we propose that downstream entities that
work at the direction of or on behalf of a business associate and
handle protected health information would also be required to comply
with the applicable Privacy and Security Rule provisions in the same
manner as the primary business associate, and likewise would incur
liability for acts of noncompliance. We note, and further explain
below, that this proposed modification would not require the covered
entity to have a contract with the subcontractor; rather, the
obligation would remain on each business associate to obtain
satisfactory assurances in the form of a written contract or other
arrangement that a subcontractor will appropriately safeguard protected
health information. For example, under this proposal, if a business
associate, such as a third party administrator, hires a company to
handle document and media shredding to securely dispose of paper and
electronic protected health information, then the shredding company
would be directly required to comply with the applicable requirements
of the HIPAA Security Rule (e.g., with respect to proper disposal of
electronic media) and the Privacy Rule (e.g., with respect to limiting
its uses and disclosures of the protected health information in
accordance with its contract with the business associate).
d. Exceptions to Business Associate
We also propose to move the provisions at Sec. Sec. 164.308(b)(2)
and 164.502(e)(1)(ii) to the definition of business associate. These
provisions provide that in certain circumstances, such as when a
covered entity discloses protected health information to a health care
provider concerning the treatment of an individual, a covered entity is
not required to enter into a business
[[Page 40874]]
associate contract or other arrangement with the recipient of the
protected health information. While we do not change the meaning of
these provisions, we believe these limitations on the scope of
``business associate'' are more appropriately placed in the definition
as exceptions to the term to make clear that the Department does not
consider the recipients of the protected health information in these
circumstances to be business associates. The movement of these
exceptions and refinement of the definition of ``business associate''
also would help clarify that a person is a business associate if it
meets the definition of ``business associate,'' even if a covered
entity, or business associate with respect to a subcontractor, fails to
enter into the required contract with the business associate.
e. Technical Changes to the Definition
For clarity and consistency, we also propose to change the term
``individually identifiable health information'' in the current
definition of ``business associate'' to ``protected health
information,'' since a business associate has no obligations under the
HIPAA Rules with respect to individually identifiable health
information that is not protected health information.
3. Definition of ``Compliance Date''
The term ``compliance date'' currently refers only to covered
entities. We propose a technical change to include business associates
in the term, in light of the HITECH Act amendments, which apply certain
provisions of the HIPAA Rules to business associates.
4. Definition of ``Electronic Media''
The term ``electronic media'' was originally defined in the
Transactions and Code Sets Rule issued on August 17, 2000 (65 FR 50312)
and was included in the definitions at Sec. 162.103. That definition
was subsequently revised and moved to Sec. 160.103. The purpose of the
revision was to clarify that--
the physical movement of electronic media from place to place is
not limited to magnetic tape, disk, or compact disk. This
clarification removes a restriction as to what is considered to be
physical electronic media, thereby allowing for future technological
innovation. We further clarified that transmission of information
not in electronic form before the transmission, for example, paper
or voice, is not covered by this definition.
68 FR 8339, Feb. 20, 2003.
We propose to revise the definition of ``electronic media'' in the
following ways. First, we would revise paragraph (1) of the definition
to conform it to current usage, as set forth in ``Guidelines for Media
Sanitization'' (Definition of Medium, NIST SP 800-88, Glossary B, p. 27
(2006)). The NIST definition, which was updated subsequent to the
issuance of the Privacy and Security Rules, was developed in
recognition of the likelihood that the evolution of development of new
technology would make use of the term ``electronic storage media''
obsolete in that there may be ``storage material'' other than ``media''
that house electronic data. Second, we would add to paragraph (2) of
the definition of ``electronic media'' a reference to intranets, to
clarify that intranets come within the definition. Third, we propose to
change the word ``because'' to ``if'' in the final sentence of
paragraph (2) of the definition of ``electronic media.'' The definition
assumed that no transmissions made by voice via telephone existed in
electronic form before transmission; the evolution of technology has
made this assumption obsolete. This modification would extend the
policy described in the preamble discussion quoted above, but correct
its application to current technology, where some voice technology is
digitally produced from an information system and transmitted by phone.
5. Definition of ``Protected Health Information''
We propose to modify the definition of ``protected health
information'' at Sec. 160.103 to provide that the Privacy and Security
Rules do not protect the individually identifiable health information
of persons who have been deceased for more than 50 years. This proposed
modification is explained more fully below in Section VI.E. of the
preamble where we discuss the proposed changes to the Privacy Rule
related to the protected health information of decedents.
6. Definition of ``Respondent''
The definition of the term ``Respondent,'' which is currently in
Sec. 160.302, would be moved to Sec. 160.103. A reference to
``business associate'' would be added following the reference to
``covered entity'' in recognition of the potential liability imposed on
business associates for violations of certain provisions of the Privacy
and Security Rules by sections 13401 and 13404 of the Act.
7. Definition of ``State''
The HITECH Act at section 13400, which became effective February
18, 2010, includes a definition of ``State'' to mean ``each of the
several States, the District of Columbia, Puerto Rico, the Virgin
Islands, Guam, American Samoa, and the Northern Mariana Islands.'' This
definition varies from paragraph (2) of the HIPAA definition of
``State'' at Sec. 160.103, which does not include reference to
American Samoa and the Northern Mariana Islands. Thus, for consistency
with the definition applied to the HIPAA Rules by the HITECH Act, we
propose to add reference to American Samoa and the Commonwealth of the
Northern Mariana Islands in paragraph (2) of the definition of
``State'' at Sec. 160.103.
8. Definition of ``Workforce''
The HITECH Act is directly applicable to business associates and
has extended liability for compliance with certain provisions of the
Privacy and Security Rules to business associates. Because some
provisions of the Act and the Privacy and Security Rules place
obligations on the business associate with respect to workforce
members, we propose to revise the definition of ``workforce member'' in
Sec. 160.103 to make clear that such term includes the employees,
volunteers, trainees, and other persons whose conduct, in the
performance of work for a business associate, is under the direct
control of the business associate.
D. Subpart B--Preemption of State Law, Section 160.201--Statutory Basis
We propose to modify Sec. 160.201 regarding the statutory basis
for the preemption of State law provisions to add a reference to
section 264(c) of HIPAA, which contains the statutory basis for the
exception to preemption at Sec. 160.203(b) for State laws that are
more stringent than the HIPAA Privacy Rule. We also propose to add a
reference to section 13421(a) of the HITECH Act, which applies HIPAA's
preemption rules to the HITECH Act's privacy and security provisions.
Finally, we propose to re-title the provision to read ``Statutory
basis'' instead of ``Applicability.''
We also take this opportunity to make clear that section 264(c)(2)
of HIPAA and Sec. 160.203(b) do not create a Federal evidentiary
privilege. Additionally, we take this opportunity to make clear that
neither the HIPAA statute nor its implementing regulations give effect
to State physician-patient privilege laws or provisions of State law
relating to the privacy of individually identifiable health information
for use in Federal court proceedings. Therefore, consistent with the
Supremacy Clause, any State law that was preempted prior to HIPAA
because of conflicts with a Federal law would continue to be preempted.
Nothing in HIPAA or its implementing regulations is intended to expand
the
[[Page 40875]]
scope of State laws, regardless of whether they are more or less
stringent than Federal law.
E. Subpart B--Preemption of State Law, Section 160.202--Definitions.
1. Definition of ``Contrary''
The term ``contrary'' is currently defined in Sec. 160.202 to make
clear when the preemption provisions of HIPAA apply to State law.
Consistent with the limited application of the HIPAA provisions to
covered entities only, the current definition of the term ``contrary''
does not include reference to business associates. However, section
13421(a) of the HITECH Act provides that the HIPAA preemption provision
(section 1178 of the Social Security Act) applies to the provisions and
requirements under the HITECH Act ``in the same manner'' as it would
apply under the HIPAA provisions. Thus, the preemption provisions would
apply to business associates, who are now, by virtue of the HITECH Act,
required to comply with certain provisions of the HIPAA Rules and are
subject to penalties for noncompliance, as discussed elsewhere. Thus,
we propose to amend the definition of ``contrary'' by inserting
references to business associates in paragraph (1) of the definition.
We also expand the reference to the HITECH statutory provisions in
paragraph (2) of the definition to encompass all of the sections of
subtitle D of the HITECH Act, rather than merely to section 13402,
which was added by the breach notifications regulations. These changes
would give effect to section 13421(a).
2. Definition of ``More Stringent''
The term ``more stringent'' is part of the statutory preemption
language under HIPAA. HIPAA preempts State law that is contrary to a
HIPAA privacy standard unless, among other exceptions, the State law is
more stringent than the contrary HIPAA privacy standard. The current
regulatory definition of ``more stringent'' does not include business
associates. We propose to amend the definition to add a reference to
business associates, for the reasons set out in the preceding
discussion.
IV. Section-by-Section Description of the Proposed Amendments to the
Enforcement Rule--Subparts C and D of Part 160
Section 13410 of the HITECH Act made several amendments that
directly impact the Enforcement Rule, which applies to the Secretary's
enforcement of all of the HIPAA Administrative Simplification Rules, as
well as the recently promulgated Breach Notification Rule. We issued an
interim final rule on October 30, 2009, 74 FR 56123, to address the
HITECH Act amendments impacting the Enforcement Rule that became
effective on February 18, 2009. For context, we describe those
modifications to the Enforcement Rule briefly below. We then provide a
section-by-section description of the other section 13410 amendments
that are part of this proposed rule.
In addition, sections 13401 and 13404 of the HITECH Act impose
direct civil money penalty liability on business associates for
violations of the HITECH Act and certain Privacy and Security Rule
provisions. In doing so, sections 13401(b) and 13404(c) of the Act
provide that section 1176 of the Social Security Act shall apply to a
violation by a business associate ``in the same manner'' as it would
apply to a covered entity with respect to such a violation. Both
provisions are, by virtue of section 13423, effective February 18,
2010.
The provisions of subparts C and D of part 160 currently apply by
their terms solely to covered entities. Accordingly, to implement
sections 13401(b) and 13404(c) of the Act, we propose to revise a
number of provisions in both subparts to reflect this statutory change
by adding the term ``business associate'' where appropriate, following
a reference to ``covered entity.'' For ease, we list the sections in
which the term ``business associate'' is added here rather than repeat
the change in each discussion of the sections below: Sec. Sec.
160.300; 160.304; 160.306(a) and (c); 160.308; 160.310; 160.312;
160.316; 160.401; 160.402; 160.404(b); 160.406; 160.408(c) and (d); and
160.410(a) and (c).
In addition to these references, we propose to add a paragraph in
Sec. 160.402(c)(2) to describe a business associate's liability for
the actions of its agents, in accordance with the Federal common law of
agency. This proposed modification is discussed more fully below in the
discussion of Sec. 160.402(c).
As noted above, the Department issued an interim final rule (IFR)
on October 30, 2009, revising the Enforcement Rule to incorporate the
provisions required by section 13410(d) of the HITECH Act that
immediately took effect: Four categories of violations that reflect
increasing levels of culpability, the corresponding tiers of civil
money penalty amounts, and the revised limitations placed on the
Secretary's authority to impose penalties. More specifically, the IFR
revised subpart D of the Enforcement Rule to transfer the definitions
of ``reasonable cause,'' ``reasonable diligence,'' and ``willful
neglect'' from Sec. 160.410(a) to a new definitions section at Sec.
160.401. The IFR revised Sec. 160.404 to incorporate, for violations
occurring on or after February 18, 2009, the new penalty scheme
required by section 13410(d), as follows: For violations in which it is
established that the covered entity did not know and, by exercising
reasonable diligence, would not have known that the covered entity
violated a provision, an amount not less than $100 or more than $50,000
for each violation; for a violation in which it is established that the
violation was due to reasonable cause and not to willful neglect, an
amount not less than $1000 or more than $50,000 for each violation; for
a violation in which it is established that the violation was due to
willful neglect and was timely corrected, an amount not less than
$10,000 or more than $50,000 for each violation; and for a violation in
which it is established that the violation was due to willful neglect
and was not timely corrected, an amount not less than $50,000 for each
violation; except that a penalty for violations of the same requirement
or prohibition under any of these categories may not exceed $1,500,000
in a calendar year. It also revised the affirmative defenses in Sec.
160.410 for violations occurring on or after February 18, 2009, to
remove a covered entity's lack of knowledge as an affirmative defense
and to provide an affirmative defense when violations not due to
willful neglect are corrected within 30 days. Finally, the IFR added a
requirement that a notice of proposed determination pursuant to Sec.
160.420 also reference the applicable category of violation. Readers
are encouraged to refer to the IFR for a more detailed discussion of
these topics as well as the Enforcement Rule's statutory and regulatory
background. See 74 FR 56123, 56124, Oct. 30, 2009.
The rules proposed below would revise many provisions of subparts C
and D of part 160. However, the Department's current interpretations of
the regulatory provisions at subparts C and D continue unchanged,
except to the extent they are inconsistent with the changes to those
provisions, as indicated below.
A. Subpart C--Compliance and Investigations, Section 160.304--
Principles for Achieving Compliance
Section 160.304 identifies cooperation and assistance as two
overarching principles for achieving compliance. The principle of
cooperation, in Sec. 160.304(a), states that ``[t]he Secretary will,
to the extent practicable, seek the cooperation of covered entities in
[[Page 40876]]
obtaining compliance with the applicable administrative simplification
provisions.''
Section 13410(a) of the HITECH Act adds a new subsection (c) to
section 1176 of the Social Security Act:
(c) NONCOMPLIANCE DUE TO WILLFUL NEGLECT.--
(1) IN GENERAL.--A violation of a provision of this part due to
willful neglect is a violation for which the Secretary is required
to impose a penalty under subsection (a)(1).
(2) REQUIRED INVESTIGATION.--For purposes of paragraph (1), the
Secretary shall formally investigate any complaint of a violation of
a provision of this part if a preliminary investigation of the facts
of the complaint indicate such a possible violation due to willful
neglect.
Section 13410(b)(1) makes the provisions of section 13410(a) effective
February 18, 2011.
Under section 1176(c), HHS is required to impose a civil money
penalty for violations due to willful neglect. Accordingly, although
the Secretary often will still seek to correct indications of
noncompliance through voluntary corrective action, there may be
circumstances (such as circumstances indicating willful neglect), where
the Secretary may seek to proceed directly to formal enforcement. As a
conforming amendment, HHS proposes to add the phrase, ``and consistent
with the provisions of this subpart,'' to Sec. 160.304(a) to recognize
the statutory revision.
B. Subpart C--Compliance and Investigations, Section 160.306(c)--
Complaints to the Secretary
Section 160.306(c) of the Enforcement Rule currently provides the
Secretary with discretion to investigate HIPAA complaints, through use
of the word ``may.'' The new willful neglect provisions, at section
1176(c)(2) of the Social Security Act, will require HHS to investigate
``any complaint of a violation of a provision of this part if a
preliminary investigation of the facts of the complaint indicates * * *
a possible violation due to willful neglect.''
HHS proposes to implement section 1176(c)(2) by adding a new
paragraph (1) at Sec. 160.306(c) to provide that the Secretary will
investigate any complaint filed under this section when a preliminary
review of the facts indicates a possible violation due to willful
neglect. As a practical matter, HHS currently conducts a preliminary
review of every complaint received and proceeds with the investigation
in every eligible case where its preliminary review of the facts
indicate a possible violation of the HIPAA Rules. Nevertheless, we
propose this addition to Sec. 160.306 to make clear our intention to
pursue an investigation where a preliminary review of the facts
indicates a possible violation due to willful neglect.
HHS proposes to conform the remainder of Sec. 160.306(c)
accordingly. The new Sec. 160.306(c)(2) (presently, the initial
sentence of Sec. 160.306(c)) would be revised by replacing
``complaints'' with ``any other complaint'' to distinguish the
Secretary's discretion with respect to complaints for which HHS's
preliminary review of the facts does not indicate a possible violation
due to willful neglect from the statutory requirement to investigate
all complaints for which HHS's preliminary review of the facts
indicates a possible violation due to willful neglect, as set out in
the new Sec. 160.306(c)(1). The current second sentence of Sec.
160.306(c), which addresses the content of an investigation, would be
renumbered as Sec. 160.306(c)(3) and amended by changing the first
word of the sentence from ``such'' to ``an,'' to signal the provision's
application to any investigation, regardless of whether a preliminary
review of the facts indicates a possible violation due to willful
neglect.
C. Subpart C--Compliance and Investigations, Section 160.308--
Compliance Reviews
Section 160.308 provides that the Secretary may conduct compliance
reviews. Use of the word ``may'' in this section makes clear that this
is a discretionary activity. While complaints and not compliance
reviews are specifically mentioned in the statutory language of section
13410(a)(1)(B) of the Act regarding willful neglect, HHS proposes to
also amend Sec. 160.308 to provide that the Secretary will conduct a
compliance review to determine whether a covered entity or business
associate is complying with the applicable administrative
simplification provision when a preliminary review of the facts
indicates a possible violation due to willful neglect. This revision to
Sec. 160.308 furthers Congress' intent to strengthen enforcement with
respect to potential violations due to willful neglect and ensures that
investigations, whether or not initiated by complaint, are handled in a
consistent manner. Also, the current language of Sec. 160.308 would be
redesignated as paragraph (b), and the words ``in any other
circumstance'' would be added to the end of this paragraph to indicate
that the discretionary authority of this paragraph applies to cases
where the preliminary review of the facts does not indicate a possible
violation due to willful neglect. Note that if HHS initiates an
investigation of a complaint because its preliminary review of the
facts indicates a possible violation due to willful neglect, HHS would
not also be required to initiate a compliance review under this
section, since it would be duplicative to do so.
D. Subpart C--Compliance and Investigations, Section 160.310--
Responsibilities of Covered Entities
Section 160.310 explains a covered entity's responsibilities during
complaint investigations and compliance reviews to make information
available to the Secretary and to cooperate with the Secretary. Section
160.310(c)(3) provides that any protected health information obtained
by the Secretary in connection with an investigation or compliance
review will not be disclosed by the Secretary, except as necessary for
determining and enforcing compliance with the HIPAA Rules or if
otherwise required by law. We propose to also allow the Secretary to
disclose protected health information if permitted under the Privacy
Act at 5 U.S.C. 552a(b)(7). Section 552a(b)(7) permits the disclosure
of a record on an individual contained within a Privacy Act protected
system of records to another agency or instrumentality of any
governmental jurisdiction within or under the control of the United
States for a civil or criminal law enforcement activity if the activity
is authorized by law and if the agency has made a written request to
the agency that maintains the record. This proposed change is necessary
to permit the Secretary to cooperate with other law enforcement
agencies, such as the State Attorneys General pursuing HIPAA actions on
behalf of State residents pursuant to section 13410(e) of the Act, or
the Federal Trade Commission, pursuing remedies under other consumer
protection authorities.
E. Subpart C--Compliance and Investigations, Section 160.312--
Secretarial Action Regarding Complaints and Compliance Reviews
Where noncompliance is indicated, Sec. 160.312 requires the
Secretary to attempt to resolve situations by informal means. Section
1176(c)(2) of the Social Security Act, as added by section 13410(a) of
the HITECH Act, will require formal investigation of a complaint ``if a
preliminary investigation of the facts of the complaint indicate * * *
a possible
[[Page 40877]]
violation due to willful neglect.'' Further, section 1176(c)(1) of the
Social Security Act, as added by section 13410(a) of the HITECH Act,
will require the Secretary to impose a civil money penalty where HHS
makes a finding of a violation involving willful neglect. In addition
to the proposed modification to Sec. 160.306(c)(1), in light of the
new provisions at section 1176(c), we propose to make clear that HHS is
not required to attempt to resolve cases of noncompliance due to
willful neglect by informal means. To do so, we propose to replace the
word ``will'' in Sec. 160.312(a)(1) with ``may.'' While this change
would permit HHS to proceed with a willful neglect determination as
appropriate, it would also permit HHS to seek to resolve complaints and
compliance reviews that did not indicate willful neglect by informal
means (e.g., where the covered entity or business associate did not
know and by exercising reasonable diligence would not have known of a
violation, or where the violation is due to reasonable cause).
It should be noted that this amendment would not change the
substance of the response set forth in the April 18, 2005, preamble to
the proposed Enforcement Rule, at 70 FR 20224, 20245-6, regarding
objections to the 60-day time limit for filing a request for a hearing.
In that response, HHS indicated that it was not reasonable to assume
that a notice of proposed determination would be served on a respondent
with no warning because the covered entity would necessarily be made
aware of, and have the opportunity to address, HHS's compliance
concerns throughout the investigative period preceding the notice of
proposed determination. This proposed change to Sec. 160.312 would
allow the Secretary to proceed directly to a notice of proposed
determination without first attempting to resolve the matter
informally. This proposed revision does not change the fact that during
the course of a complaint investigation or a compliance review, a
covered entity or business associate would be made aware of, and have
the opportunity to address, HHS's compliance concerns.
F. Subpart D--Imposition of Civil Money Penalties, Section 160.401--
Definitions
Section 160.401 provides definitions of the terms ``reasonable
cause,'' ``reasonable diligence,'' and ``willful neglect.'' As
discussed in the interim final rule, at 74 FR 56123, 56126-7, given
section 13410(d) of the Act's use of these terms to describe the
increasing levels of culpability for which increasing minimum levels of
penalties may be imposed, HHS transferred these definitions from their
prior placement at Sec. 160.410(a) to signal the definitions' broader
application to the entirety of subpart D of part 160. However, because
section 13410(d) of the Act referred to these terms but did not amend
these definitions, the interim final rule did not alter their content.
HHS encourages readers, as it did in the interim final rule, to refer
to prior preambles to the Enforcement Rule for detailed discussions of
these terms at 70 FR 20224, 20237-9 and 71 FR 8390, 8409-11.
While the provisions of section 13410 of the Act do not explicitly
require modification of these definitions, HHS is concerned that the
mens rea demarcation between the categories of culpability associated
with the new tiers of civil money penalty amounts is not sufficiently
clear based on the existing definitions. As a result, certain
violations (i.e., those of which a covered entity or business associate
has or should have knowledge, but does not have the conscious intent or
reckless indifference associated with willful neglect) might not fit
squarely within one of the established tiers. Therefore, HHS proposes
to amend the definition of reasonable cause to clarify the scope of
violations fitting within that definition.
HHS does not propose to otherwise modify the definitions associated
with the categories of culpability of the amended section 1176(a) of
the Social Security Act. However, we wish to clarify how the Secretary
intends to apply these terms within this newly established context, to
assist covered entities and business associates in tailoring their
compliance activities appropriately. Accordingly, the discussion below
also addresses the terms associated with the other categories of
culpability (i.e., knowledge, reasonable diligence, and willful
neglect).
1. Reasonable Cause
Reasonable cause is currently defined, at Sec. 160.401, to mean
``circumstances that would make it unreasonable for the covered entity,
despite the exercise of ordinary business care and prudence, to comply
with the administrative simplification provision violated.'' This
definition is consistent with the Supreme Court's ruling in United
States v. Boyle, 469 U.S. 241, 245 (1985), which focused on whether
circumstances were beyond the regulated person's control, thereby
making compliance unreasonable. See 70 FR 20224, 20238. Prior to the
HITECH Act, section 1176 of the Social Security Act treated reasonable
cause as a partial limitation on the Secretary's authority to impose a
civil money penalty. That is, by establishing that a violation was due
to reasonable cause and not willful neglect and was either corrected
within a 30-day period or such additional period as the Secretary
determined to be appropriate, a covered entity or business associate
would bar the Secretary's imposition of a civil money penalty.
As described above, section 13410(d) of the HITECH Act revised
section 1176 of the Social Security Act to establish four tiers of
increasing penalty amounts to correspond to the levels of culpability
associated with the violation. The first category of violation (and
lowest penalty tier) covers situations where the covered entity or
business associate did not know, and by exercising reasonable diligence
would not have known, of a violation. The second category of violation
(and next highest penalty tier) applies to violations due to reasonable
cause and not to willful neglect. The third and fourth categories (and
second-highest and highest penalty tiers) apply to circumstances where
the violation was due to willful neglect that is corrected within a
certain time period and willful neglect that is not so corrected,
respectively. The importance of mens rea, or state of mind, in
determining the degree of culpability is clear with respect to the
first, third, and fourth categories, in that there is no mens rea with
respect to the lowest category of violation, while the existence of
mens rea is presumed with respect to the third and fourth categories of
violation.
However, the current definition of reasonable cause does not
address mens rea with respect to the second category of violations. HHS
therefore proposes to amend the definition of ``reasonable cause'' in
Sec. 160.401 to clarify the full scope of violations that will come
within the reasonable cause category of violations, including those
circumstances that would make it unreasonable for the covered entity or
business associate, despite the exercise of ordinary business care and
prudence, to comply with the administrative simplification provisions
violated, as well as those circumstances in which a covered entity or
business associate has knowledge of a violation but lacks the conscious
intent or reckless indifference associated with the willful neglect
category of violations. To that end, HHS proposes to replace the
current definition of ``reasonable cause'' with the following:
[[Page 40878]]
an act or omission in which a covered entity or business
associate knew, or by exercising reasonable diligence would have
known, that the act or omission violated an administrative
simplification provision, but in which the covered entity or
business associate did not act with willful neglect.
As modified, the definition of ``reasonable cause'' will continue
to recognize those circumstances that would make it unreasonable for
the covered entity or business associate, despite the exercise of
ordinary business care and prudence, to comply with the administrative
simplification provisions violated. Consider the following example:
A covered entity received an individual's request for access but
did not respond within the time periods provided for in Sec.
164.524(b)(2). HHS's investigation reveals that the covered entity
had compliant access policies and procedures in place, but that it
had received an unusually high volume of requests for access within
the time period in question. While the covered entity had responded
to the majority of access requests received in that time period in a
timely manner, it had failed to respond in a timely manner to
several requests for access. The covered entity did respond in a
timely manner to all requests for access it received subsequent to
the time period in which the violations occurred.
In this example, the covered entity had knowledge of the violations
but the investigation revealed circumstances that would make it
unreasonable for the covered entity, despite the exercise of ordinary
business care and prudence, to comply with the administrative
simplification provisions violated. The investigation also revealed
that the covered entity acted in a way that demonstrated a good faith
attempt to comply with Sec. 164.524(b)(2) by having compliant policies
and procedures in place, responding to the majority of access requests
in a timely manner, and otherwise responding to subsequent requests as
required. In contrast, had the investigation revealed that the series
of access requests occurred over a longer period of time, and that the
covered entity did not attempt to address the backlog or communicate
with the individuals, in writing, regarding the reasons for the delay
or the date by which the covered entity would complete its action on
the requests, the notice of proposed determination might alternatively
categorize the violation as being due to willful neglect.
The modified definition of reasonable cause will also encompass
those circumstances in which a covered entity or business associate has
knowledge of the violation but lacks the conscious intent or reckless
indifference associated with willful neglect. Consider the following
example:
A covered entity presented an authorization form to a patient
for signature to permit a disclosure for marketing purposes that did
not contain the core elements required by Sec. 164.508(c). HHS's
investigation reveals that the covered entity was aware of the
requirement for an authorization for a use or disclosure of
protected health information for marketing and had attempted to
draft a compliant authorization but had not included in the
authorization the core elements required under Sec. 164.508.
In this example, the covered entity failed to act with the ordinary
care and business prudence of one seeking to comply with the Privacy
Rule. Therefore, the violation cannot be considered to come within the
category of violation that is associated with violations where the
covered entity did not know (and by exercising reasonable diligence
would not have known) of the violation. Yet, because the covered entity
had attempted to draft a compliant authorization, it cannot be
established that the omission was due to willful neglect involving
either a conscious, intentional failure or reckless indifference to the
obligation to comply with Sec. 164.508. Unless otherwise resolved by
informal means, HHS would have grounds to find that the violation was
due to reasonable cause.
2. Knowledge and Reasonable Diligence
Prior rulemaking preambles discussing the Enforcement Rule explain
the concept of knowledge, as it applies to the limitations (i.e.,
affirmative defenses) that section 1176(b) of the Social Security Act
places on the Secretary's authority to impose a civil money penalty. As
they explain, ``the knowledge involved must be knowledge that [a]
violation has occurred, not just knowledge of the facts constituting
the violation.'' See 71 FR 8390, 8410, Feb. 16, 2006. Moreover, a
covered entity or business associate cannot assert an affirmative
defense associated with its ``lack of knowledge'' if such lack of
knowledge has resulted from its failure to inform itself about
compliance obligations or to investigate received complaints or other
information indicating likely noncompliance. See 70 FR 20224, 20237-8,
Apr. 18, 2005 and 71 FR 8390, 8410-11, Feb. 16, 2006.
Section 13410(d) of the Act establishes the category of violations
where the covered entity or business associate did not know (and by
exercising reasonable diligence would not have known) of a violation as
warranting the lowest range of civil money penalty amounts. The HITECH
Act incorporated the concepts of knowledge and reasonable diligence
from HIPAA, and it did not revise their substance. HHS therefore
expects to apply these existing concepts to the newly established
penalty structure consistent with its prior interpretations. Consider
the following examples:
1. A covered health care provider with a direct treatment
relationship with an individual patient failed to provide the
patient a complete notice of privacy practices in compliance with
Sec. 164.520(c). HHS's investigation reveals that the covered
entity has a compliant notice of privacy practices, policies and
procedures for provision of the notice, and appropriate training of
its workforce regarding the notice and its distribution. The
violation resulted from a printing error that failed to print two
pages of the notice of privacy practices. The printing error
affected a small number of the covered entity's supply of notices
and was an isolated failure to provide an individual with the
covered entity's notice of privacy practices.
2. A business associate failed to terminate a former employee's
access privileges to electronic protected health information in
compliance with Sec. 164.308(a)(3)(ii)(C). HHS's investigation
reveals that the business associate's policies and procedures
require the termination of such access within a reasonable time
period. The HHS investigation reveals that the business associate
attempted to terminate the former employee's access in accordance
with its policy, but that it instead terminated the access of a
current employee who had the same name as the former employee.
In both examples, HHS's investigations reveal that the covered entity
or business associate has compliant policies and procedures in place,
as well as some action by each covered entity or business associate
indicating its intent to implement the respective Privacy Rule
requirements. The investigations also reveal noncompliance that the
exercise of reasonable diligence would not have avoided.
HHS also notes that, in some circumstances, we expect that the
knowledge of an employee or agent of a covered entity or business
associate may determine whether a violation implicates the ``did not
know'' or ``reasonable cause'' categories of violation. That is, absent
an exception under the Federal common law of agency, the knowledge of
an employee or agent will generally be imputed to its principal (i.e.,
the covered entity or business associate). See 70 FR 20224, 20237 and
71 FR 8390, 8402-3 (discussing imputation of knowledge under the
Federal common law of agency and violations attributed to a covered
entity, respectively). Consider the following example:
[[Page 40879]]
A hospital employee accessed the paper medical record of his ex-
spouse while he was on duty to discover her current address for a
personal reason, knowing that such access is not permitted by the
Privacy Rule and contrary to the policies and procedures of the
hospital. HHS's investigation reveals that the covered entity had
appropriate and reasonable safeguards regarding employee access to
medical records, and that it had delivered appropriate training to
the employee.
In this example, the ``did not know'' category of violation is
implicated with respect to the covered entity because the mens rea
element of knowledge cannot be established. That is, while the
employee's act is attributed to the covered entity, the employee's
knowledge of the violation cannot be imputed to the covered entity
because the employee was acting adversely to the covered entity. The
Federal common law of agency does not permit the imputation of
knowledge to the principal where the agent consciously acts in a manner
that is adverse to the principal.
3. Willful Neglect
Willful neglect is defined, at Sec. 160.401, to mean the
``conscious, intentional failure or reckless indifference to the
obligation to comply with the administrative simplification provision
violated.'' The term not only presumes actual or constructive knowledge
on the part of the covered entity that a violation is virtually certain
to occur but also encompasses a conscious intent or degree of
recklessness with regard to its compliance obligations.
While the HITECH Act references willful neglect in several
provisions, it does not revise the term's definition. HHS therefore
expects to apply the current definition of willful neglect to all newly
established contexts in the same manner as previously discussed.
Consider the following examples:
1. A covered entity disposed of several hard drives containing
electronic protected health information in an unsecured dumpster, in
violation of Sec. 164.530(c) and Sec. 164.310(d)(2)(i). HHS's
investigation reveals that the covered entity had failed to
implement any policies and procedures to reasonably and
appropriately safeguard protected health information during the
disposal process.
2. A covered entity failed to respond to an individual's request
that it restrict its uses and disclosures of protected health
information about the individual. HHS's investigation reveals that
the covered entity does not have any policies and procedures in
place for consideration of the restriction requests it receives and
refuses to accept any requests for restrictions from individual
patients who inquire.
3. A covered entity's employee lost an unencrypted laptop that
contained unsecured protected health information. HHS's
investigation reveals the covered entity feared its reputation would
be harmed if information about the incident became public and,
therefore, decided not to provide notification as required by Sec.
164.400 et seq.
The facts in these examples demonstrate that the covered entities had
actual or constructive knowledge of their various violations. In
addition, the covered entities' failures to develop or implement
compliant policies and procedures or to respond to incidents as
required by Sec. 164.400 et seq. demonstrate either conscious intent
or reckless disregard with respect to their compliance obligations. In
the second example, the covered entity's refusal to accept any requests
for restrictions from individual patients who inquire would be grounds
for a separate finding of a violation due to willful neglect.
4. Correction of Willful Neglect Violations
We also note that while a covered entity's or business associate's
correction of a willful neglect violation will not bar the imposition
of a civil money penalty, such correction may foreclose the Secretary's
authority to impose a penalty from the highest penalty tier prescribed
by section 1176(a)(1) of the Social Security Act. While not all
violations can be corrected, in the sense of being fully undone or
remediated, HHS has previously set forth a broad interpretation of
``corrected,'' in light of the statute's association of the term with
``failure to comply.'' See 71 FR 8390, 8411 (recognizing that the term
``corrected'' could include correction of a covered entity's
noncompliant procedure by making the procedure compliant). For example,
in the event a covered entity's or business associate's inadequate
safeguards policies and procedures result in an impermissible
disclosure, the disclosure violation itself could not be fully undone
or corrected. The safeguards violation, however, could be ``corrected''
in the sense that the noncompliant policies and procedures could be
brought into compliance. In any event, corrective action will always be
required of a covered entity or business associate.
G. Subpart D--Imposition of Civil Money Penalties, Section 160.402--
Basis for a Civil Money Penalty
Section 160.402(a) provides the general rule that the Secretary
will impose a civil money penalty upon a covered entity if the
Secretary determines that the covered entity violated an administrative
simplification provision. Paragraphs (b) and (c) of this section
explain the basis for a civil money penalty against a covered entity
where more than one covered entity is responsible for a violation,
where an affiliated covered entity is responsible for a violation, and
where an agent of a covered entity is responsible for a violation. As
explained above, this proposed rule would add references to ``business
associate'' where appropriate in this section to effectuate the HITECH
Act's imposition of liability on business associates for violations of
the HITECH Act and certain Privacy and Security Rule provisions.
Further, in paragraph (c), which provides the basis for the
imposition of a civil money penalty against a covered entity for the
acts of its agent, in accordance with the Federal common law of agency,
we propose to add a parallel provision providing for civil money
penalty liability against a business associate for the acts of its
agent. Thus, we propose to add a new paragraph (2) to Sec. 160.402(c)
to provide that a business associate is liable, in accordance with the
Federal common law of agency, for a civil money penalty for a violation
based on the act or omission of any agent of the business associate,
including a workforce member or subcontractor, acting within the scope
of the agency.
The existing language of Sec. 160.402(c) regarding the liability
of covered entities for the acts of their agents would be redesignated
as paragraph (1), with one substantive change. This section currently
provides an exception for covered entity liability for the acts of its
agent in cases where the agent is a business associate, the relevant
contract requirements have been met, the covered entity did not know of
a pattern or practice of the business associate in violation of the
contract, and the covered entity did not fail to act as required by the
Privacy or Security Rule with respect to such violations. We propose to
remove this exception to principal liability for the covered entity so
that the covered entity remains liable for the acts of its business
associate agents, regardless of whether the covered entity has a
compliant business associate agreement in place. This change is
necessary to ensure, where the covered entity has contracted out a
particular obligation under the HIPAA Rules, such as the requirement to
provide individuals with a notice of privacy practices, that the
covered entity remains liable for the failure of its business associate
to perform that obligation on the covered entity's behalf.
[[Page 40880]]
We do not believe this proposed change would place any undue burden
on covered entities, since covered entities are customarily liable for
the acts of their agents under agency common law. We note that this
proposed regulatory change does not create liability for covered
entities with respect to business associates that are not agents, e.g.,
independent contractors. The determination of whether a business
associate is an agent of a covered entity, or whether a subcontractor
is an agent of a business associate, will be based on the facts of the
relationship, such as the level of control over the business
associate's or subcontractor's conduct.
H. Subpart D--Imposition of Civil Money Penalties, Section 160.408--
Factors Considered in Determining the Amount of a Civil Money Penalty
1. Determination of Penalty Amounts Prior to the HITECH Act
Section 160.408 implements section 1176(a)(2) of the Social
Security Act, which requires the Secretary, when imposing a civil money
penalty, to apply the provisions of section 1128A of the Social
Security Act ``in the same manner as such provisions apply to the
imposition of a civil money penalty under section 1128A.'' As currently
written, Section 1128A requires the Secretary to take into account--
(1) The nature of the claims and the circumstances under which
they were presented,
(2) The degree of culpability, history of prior offenses and
financial condition of the person presenting the claims, and
(3) Such other matters as justice may require.
Like other regulations that implement section 1128A, HHS tailored these
factors by breaking them down into their component elements and
providing a more specific list of circumstances, within each component,
that apply to the context of HIPAA Rule violations. Because the
Enforcement Rule applies to a number of rules, which apply to an
enormous number of entities and circumstances, HHS left to the
Secretary's discretion the decisions of whether and how (i.e., as
either aggravating or mitigating) to consider the following factors in
determining the amount of a civil money penalty:
(a) The nature of the violation, in light of the purpose of the
rule violated.
(b) The circumstances, including the consequences, of the
violation, including but not limited to * * * [specific
circumstances]
(c) The degree of culpability of the covered entity, including
but not limited to * * * [specific circumstances]
(d) Any history of prior compliance with the administrative
simplification provisions, including violations, by the covered
entity, including but not limited to * * * [specific circumstances]
(e) The financial condition of the covered entity, including but
not limited to * * * [specific circumstances]
(f) Such other matters as justice may require.
See 70 FR 20224, 20235-6 and 71 FR 8390, 8407-9 for a discussion of
HHS's interpretation of the factors currently enumerated in Sec.
160.408.
2. Determination of Penalty Amounts After the HITECH Act
As discussed in more detail in the IFR, section 13410(d) of the
HITECH Act modified section 1176(a)(1) of the Social Security Act in
several ways, including the establishment of tiers of penalty amounts
that are associated with increasing levels of culpability. It also
added a provision to section 1176(a)(1) of the Social Security Act
directing HHS to ``base such determination [of the appropriate penalty
amount] on the nature and extent of the violation and the nature and
extent of the harm resulting from such violation.'' The HITECH Act did
not modify section 1176(a)(2) (requiring application of section 1128A).
In addition, many of the factors currently identified by Sec. 160.408
already pertain to the nature of the violation and the resulting harm.
Section 160.408(a), for example, identifies the nature of the violation
for consideration; paragraph (b) addresses the circumstances, including
the consequences, of the violation (e.g., physical harm, financial harm
and whether the violation hindered or facilitated an individual's
ability to obtain health care); and paragraph (f) addresses such other
matters as justice may require. Thus, HHS did not modify Sec. 160.408
in the IFR.
Upon further consideration of the statutory mandates and the
significantly broader range of penalty amounts available, HHS believes
it is appropriate to amend the structure of Sec. 160.408, to make
explicit the new statutory requirement that the Secretary consider the
nature and extent of the violation and the nature and extent of the
harm resulting from the violation, in addition to those factors
enumerated in section 1128A. Thus, HHS proposes to revise Sec.
160.408(a) and (b), as discussed below, to require the Secretary's
consideration of the nature and extent of the violation, as well as the
nature and extent of the harm resulting from violation, in addition to
those factors referenced by section 1128A. We would exclude, however,
the factor presently identified as Sec. 160.408(c) (the degree of
culpability of covered entity), which originated in section 1128A.
Congress' revision of section 1176(a)(1) of the Social Security Act to
establish increasing tiers of penalty amounts that reflect increasing
degrees of culpability renders consideration of the degree of
culpability as an aggravating or mitigating factor redundant. In
contrast, HHS is not proposing to amend the Secretary's discretion with
respect to the non-exhaustive list of specific circumstances that may
be considered.
In addition, HHS proposes to reorganize the remaining, specific
circumstances under Sec. 160.408(a) and (b) to better reflect the
categories to which they are now attributed, to add another
circumstance for consideration under each, as described below, to
explicitly provide that the Secretary's consideration of all specific
circumstances is optional, and to modify the phrase ``prior
violations'' in subsections (c)(1) and (2) to read ``indications of
noncompliance.''
a. The Nature and Extent of the Violation
HHS proposes to revise subsection (a) to identify ``[t]he nature
and extent of the violation,'' as the first factor the Secretary must
consider in determining a civil money penalty amount. While the ``the
nature of the violation'' was previously identified for consideration,
as it is grounded in section 1128A, the current list of factors in
Sec. 160.408 does not specifically reference ``the extent of the
violation,'' which section 1176(a) now requires. We also propose to
transfer ``the time period during which the violation(s) occurred,'' to
this factor and to add, ``the number of individuals affected,'' since
both circumstances might be indicative measures of ``the nature and
extent of the violation.'' Our compliance and enforcement experience to
date further supports the addition of the latter, particularly with
respect to potential violations that negatively affect numerous
individuals (e.g., where disclosure of protected health information in
multiple explanation of benefits statements that were mailed to the
wrong individuals resulted from one inadequate safeguard but affected a
large number of beneficiaries). We recognize these specific
circumstances might also be considered under Sec. 160.406, with
respect to counting violations. In this regard, we direct readers'
attention to 71 FR 8390, 8409 (responding to a comment expressing
concern that the overlap of certain variables proposed in Sec. 160.406
with factors proposed in Sec. 160.408 might result in compound
liability by asserting that since
[[Page 40881]]
consideration of such circumstances may be relevant to each separable
element of the penalty calculation, their consideration will be
different in nature).
b. The Nature and Extent of the Harm Resulting From the Violations
HHS proposes to revise subsection (a) to identify ``[t]he nature
and extent of the harm resulting from the violation'' as the second
factor the Secretary must consider. This minor amendment merely
conforms the factor's language to the amended statutory language and
continues to include the optional consideration of several specific
circumstances which might be indicative of harm. In addition to these
specific circumstances, HHS proposes to add reputational harm to make
clear that reputational harm is as cognizable a form of harm as
physical or financial harm.
c. The History of Prior Compliance With the Administrative
Simplification Provisions
HHS proposes to modify the phrase ``prior violations'' in Sec.
160.408(c)(1) and (2) to read ``indications of noncompliance.'' As
defined in Sec. 160.302, ``violation'' or ``violate'' means, ``as the
context may require, failure to comply with an administrative
simplification provision.'' Use of the term is generally reserved,
however, to circumstances in which the Department has made a formal
finding of a violation through a notice of proposed determination. As
explained in 71 FR 8390, 8408, a covered entity's general history of
HIPAA compliance is relevant in determining the amount of a civil money
penalty within the penalty range. When we reviewed this language of
Sec. 160.408(c)(1) and (2) for the purposes of this rulemaking, we
noticed that the regulatory text uses the term ``violation'' which is
generally reserved for use in a notice of proposed determination. We
are proposing to change this terminology to ``indications of
noncompliance'' to make the regulatory language consistent with HHS'
policy of considering a covered entity's general history of HIPAA
compliance.
I. Section 160.410--Affirmative Defenses
Section 160.410 currently implements the limitations placed on the
Secretary's authority to impose a civil money penalty under section
1176(b) of the Act. As amended by the IFR, Sec. 160.410 is organized
to implement section 13410(d) of the HITECH Act in a way that
distinguishes the affirmative defenses available to covered entities
and business associates prior to, on, or after February 18, 2009, the
day after section 13410(d) of the HITECH Act became effective. See 74
FR 56123, Oct. 30, 2009, for a detailed discussion of the IFR's recent
amendments.
Section 13410(a)(1) revises section 1176(b) to replace the phrase,
``if the act constitutes an offense punishable under section 1177''
with ``a penalty has been imposed under section 1177 with respect to
such act.'' This statutory change is effective February 18, 2011.
HHS proposes to amend Sec. 160.410 to implement the revision of
section 1176(b)(1) of the Social Security Act by providing in a new
paragraph (a)(1) that the affirmative defense of criminally
``punishable'' is applicable to penalties imposed prior to February 18,
2011. A new paragraph (a)(2) in that section would make clear that, on
or after February 18, 2011, the Secretary's authority to impose a civil
money penalty will only be barred to the extent a covered entity or
business associate can demonstrate that a penalty has been imposed
under 42 U.S.C. 1320d-6 with respect to such act. As a conforming
change, current paragraphs (a)(2) and (a)(3) are renumbered as
paragraphs (b)(1) and (b)(2), respectively, and current paragraph (b)
is renumbered as paragraph (c).
As an additional conforming change, HHS also proposes to amend
Sec. 160.410(a)(3)(i) (which has been redesignated as Sec.
160.410(b)(2)(i)) to replace the term ``reasonable cause'' with the
unrevised text of its current definition. This will ensure that the
current definition is applied to violations occurring prior to February
18, 2009, thereby avoiding any potential issues regarding a retroactive
application of the revised term.
J. Section 160.412--Waiver
We propose conforming changes to this section, to align the cross-
references to Sec. 160.410 with the proposed revisions to that section
discussed above.
K. Subpart D--Imposition of Civil Money Penalties, Section 160.418--
Penalty Not Exclusive
We propose to revise this section to incorporate a reference to the
provision of the Patient Safety and Quality Improvement Act of 2005 at
42 U.S.C. 299b-22 that provides that penalties are not to be imposed
under both that act and the Privacy Rule for the same violation.
V. Section-by-Section Description of the Proposed Amendments to Subpart
A of Part 164 and the Security Rule in Subpart C of Part 164
The HITECH Act made several amendments that directly impact current
provisions of the HIPAA Security Rule. We discuss the proposed changes
to the Security Rule as a result of the HITECH Act in our section-by-
section description below. We also discuss various technical and
conforming proposed changes to the Security Rule, as well as proposed
changes to provisions in subpart A of part 164, which applies to both
the Security and Privacy Rules.
A. Technical Changes to Subpart A--General Provisions
1. Section 164.102--Statutory Basis
This section sets out the statutory basis of part 164. We propose a
technical change to include a reference to the provisions of sections
13400 through 13424 of the HITECH Act upon which the regulatory changes
proposed below are based.
2. Section 164.104--Applicability
This section sets out to whom part 164 applies. We propose to
replace the existing paragraph (b) with an applicability statement for
business associates, consistent with the provisions of the HITECH Act
that are discussed more fully below. Proposed paragraph (b) would make
clear that, where provided, the standards, requirements, and
implementation specifications of the HIPAA Privacy, Security, and
Breach Notification Rules apply to business associates. We propose to
remove as unnecessary the existing language in Sec. 164.104(b)
regarding the obligation of a health care clearinghouse to comply with
Sec. 164.105 relating to organizational requirements of covered
entities.
3. Section 164.105--Organizational Requirements
a. Section 164.105
Section 164.105 outlines the organizational requirements and
implementation specifications for health care components of covered
entities and for affiliated covered entities. As Sec. 164.105 now also
applies to subpart D of part 164 regarding breach notification for
unsecured protected health information, we propose to remove several
references to subparts C and E throughout this section to make clear
that the provisions of this section also apply to the new subpart D of
this part. In addition, we propose the following modifications to this
section.
[[Page 40882]]
b. Section 164.105(a)(2)(ii)(C)-(E)
We propose to modify this section to remove as unnecessary
paragraphs (C) and (D), which pertain to the obligation of a covered
entity to ensure that any component that performs business associate-
like activities and is included in the health care component complies
with the requirements of the Privacy and Security Rules, and to re-
designate paragraph (E) as (C). A covered entity's obligation to ensure
that a health care component complies with the Privacy and Security
Rules is already set out at Sec. 164.105(a)(2)(ii). In addition, in
light of a business associate's new direct liability for compliance
with certain of the Security and Privacy Rule provisions, we request
comment on whether we should require, rather than permit as is
currently the case under Sec. 164.105(a)(2)(iii)(C), a covered entity
that is a hybrid entity to include a component that performs business
associate-like activities within its health care component so that such
components are directly subject to the Rules.
c. Section 164.105(a)(2)(iii)(C)
We propose to modify this section to re-designate Sec.
164.105(a)(2)(iii)(C) as (D), and to include a new paragraph (C), which
makes clear that, with respect to a hybrid entity, the covered entity
itself, and not merely the health care component, remains responsible
for complying with Sec. Sec. 164.314 and 164.504 regarding business
associate arrangements and other organizational requirements. This
proposed modification is intended to recognize that hybrid entities may
need to execute legal contracts and conduct other organizational
matters at the level of the legal entity rather than at the level of
the health care component.
d. Section 164.105(b)(1)
We propose to fix a minor typographical error in this paragraph by
redesignating the second paragraph (1) as paragraph (2).
e. Section 164.105(b)(2)(ii)
We propose to simplify this paragraph by collapsing subparagraphs
(A), (B), and (C) regarding the obligations of an affiliated entity to
comply with the Privacy and Security Rules into one provision, and to
expand the reference to compliance with the ``part'' so that the breach
notification obligations in subpart D are also included.
4. Section 164.106--Relationship to Other Parts
We propose to add a reference to business associates, consistent
with their inclusion elsewhere throughout the other HIPAA Rules.
B. Modifications to the HIPAA Security Rule in Subpart C
1. References to Business Associates
The Security Rule, as it presently stands, does not directly apply
to business associates of covered entities. However, section 13401 of
the HITECH Act, which became effective on February 18, 2010, provides
that the Security Rule's administrative, physical, and technical
safeguards requirements in Sec. Sec. 164.308, 164.310, and 164.312, as
well as its policies and procedures and documentation requirements in
Sec. 164.316, shall apply to business associates in the same manner as
these requirements apply to covered entities, and that business
associates shall be civilly and criminally liable for penalties for
violations of these provisions.
Accordingly, to implement section 13401 of the HITECH Act, we
propose to insert references to ``business associate'' in subpart C, as
appropriate, following references to ``covered entity'' to make clear
that these provisions of the Security Rule also apply to business
associates. In particular, we propose to modify the following sections
by adding references to business associates: Sec. Sec. 164.302
(applicability), 164.304 (definitions of ``administrative safeguard''
and ``physical safeguard''), 164.308, 164.310, 164.312, and 164.316. In
addition, we propose the changes below to the Security Rule.
2. Section 164.306--Security Standards: General Rules
Section 13401 of the HITECH Act pertaining to requirements on
business associates does not specifically make reference to Sec.
164.306 of the Security Rule. However, Sec. 164.306 sets out the
general rules that apply to all of the security standards and
implementation specifications that follow. Thus, for example, Sec.
164.306(b)(2) sets out the particular factors that covered entities
must take into account in deciding which security measures to use, and
Sec. 164.306(d) sets out the general rule that required implementation
specifications must be implemented and the process and basis for
implementing addressable implementation specifications. Accordingly,
Sec. Sec. 164.308, 164.310, and 164.312 provide that the
administrative, physical, and technical safeguards of the Security Rule
must be implemented ``in accordance with Sec. 164.306.'' We do not
believe that Congress intended to apply enumerated Security Rule
sections to business associates in a different manner than to covered
entities, as evidenced by the statutory language that these sections
should be applied to business associates ``in the same manner that such
sections apply to the covered entity.'' For these reasons, we also
propose to revise Sec. 164.306 to insert the word ``business
associate,'' as appropriate, so that the general rules found at Sec.
164.306 apply to business associates in the same manner as covered
entities.
In addition, we propose technical revisions to Sec. 164.306(e) to
more clearly indicate that to maintain security measures that continue
to meet the requirements of Sec. Sec. 164.308, 164.310, and 164.312,
covered entities and business associates must review and modify such
security measures and update documentation accordingly under Sec.
164.316(b)(2)(iii).
3. Section 164.308--Administrative Safeguards
First, as noted above, we propose to modify Sec. 164.308 to
include throughout appropriate references to business associates.
Second, we propose a technical change to Sec. 164.308(a)(3)(ii)(C)
regarding security termination procedures for workforce members, to add
the words ``or other arrangement with'' after ``employment of'' in
recognition of the fact that not all workforce members are employees
(e.g., some may be volunteers) of a covered entity or business
associate. Third, we propose to remove the reference to Sec. 164.306
in paragraph (b)(1) as unnecessary. Fourth, as discussed below, we
propose a number of modifications to the provisions in this section
regarding business associate contracts and other arrangements to
conform to and address modifications proposed in the definition of
``business associate,'' including the proposed inclusion of
subcontractors within the scope of ``business associate.''
Section 164.308(b) provides that a covered entity may permit a
business associate to create, receive, maintain, or transmit electronic
protected health information only if the covered entity has a contract
or other arrangement in place to ensure the business associate will
appropriately safeguard the protected health information. Section
164.308(b)(2) contains several exceptions to this general rule for
certain situations that do not give rise to a business associate
relationship, such as where a covered entity discloses electronic
protected health information to a health care provider concerning the
treatment of an individual. We propose to remove these exceptions from
Sec. 164.308(b)(2), since as discussed
[[Page 40883]]
above, we propose to include these as exceptions to the definition of
``business associate.''
In addition, we propose to modify Sec. 164.308(b)(1) and (2) to
clarify the new proposed requirements on business associates with
regard to subcontractors. As described above with respect to the
definition of ``business associate'' in Sec. 160.103, we propose to
include in the definition subcontractors that create, receive,
maintain, or transmit protected health information on behalf of a
business associate. However, we do not intend this proposed
modification to mean that a covered entity is required to have a
contract with the subcontractor. Rather, such obligation is to remain
with the business associate who contracts with the subcontractor.
Accordingly, in Sec. 164.308(b)(1), we propose to clarify that covered
entities are not required to obtain satisfactory assurances in the form
of a contract or other arrangement with a business associate that is a
subcontractor. In Sec. 164.308(b)(2), we then propose to make clear
that it is the business associate that must obtain the required
satisfactory assurances from the subcontractor to protect the security
of electronic protected health information.
We propose to remove the provision at Sec. 164.308(b)(3), which
provides that a covered entity that violates the satisfactory
assurances it provided as a business associate of another covered
entity will be in noncompliance with the Security Rule's business
associate provisions, as a covered entity's actions as a business
associate of another covered entity are now directly regulated by the
Security Rule's provisions that apply to business associates.
Finally, in Sec. 164.308(b)(4) (renumbered as Sec.
164.308(b)(3)), which requires documentation of the required
satisfactory assurances through a written contract or other
arrangement, we propose to add a reference to the new paragraph at
Sec. 164.308(b)(2) regarding business associates and subcontractors.
4. Section 164.314--Organizational Requirements
Section 13401 of the HITECH Act does not include Sec. 164.314
among the provisions for which business associates are directly liable.
However, section 13401 does state that Sec. 164.308 applies to
business associates ``in the same manner'' that the provision applies
to covered entities. Section 164.308(b) requires a covered entity's
business associate agreements to conform to the requirements of Sec.
164.314. Accordingly, in order for Sec. 164.308(b) to apply to
business associates in the same manner as it applies to covered
entities, we have revised Sec. 164.314 to reflect that it is also
applicable to agreements between business associates and subcontractors
that create, receive, maintain, or transmit electronic protected health
information.
We also propose a number of modifications to the business associate
contract requirements in Sec. 164.314 to streamline the provisions.
First, we propose to remove Sec. 164.314(a)(1)(ii) regarding the steps
a covered entity must take if it knows of a material breach or
violation by the business associate of the contract. A parallel
provision exists in the Privacy Rule's business associate contract
provisions at Sec. 164.504 and, since a business associate for
purposes of the Security Rule is also always a business associate for
purposes of the Privacy Rule, the inclusion of a duplicate provision in
the Security Rule is unnecessary. For the same reason, we also propose
to remove the contract provision at Sec. 164.314(a)(2)(i)(D)
authorizing the termination of the contract by the covered entity if it
is determined the business associate has violated a material term of
the contract. A parallel provision exists in the Privacy Rule at Sec.
164.504(e)(2)(iii). Also, because the Privacy Rule has a parallel
provision, we remove the specific requirements under Sec.
164.314(a)(2)(ii) for other arrangements, such as a memorandum of
understanding when both a covered entity and business associate are
governmental entities, and instead simply refer to the requirements of
Sec. 164.504(e)(3).
Second, we propose the following modifications to the remaining
contract provision requirements: (1) In Sec. 164.314(a)(2)(i)(A), we
streamline the provision to simply indicate a business associate's
obligation to comply with the Security Rule; (2) in Sec.
164.314(a)(2)(i)(B), we revise the language with respect to ensuring
subcontractors implement reasonable and appropriate safeguards to refer
to the proposed requirement at Sec. 164.308(b)(4) that would require a
business associate to enter into a contract or other arrangement with a
subcontractor to protect the security of electronic protected health
information; and (3) in Sec. 164.314(a)(2)(i)(C), with respect to the
reporting of security incidents by business associates to covered
entities, we make clear that the business associate contract must
provide that the business associate will report to the covered entity
breaches of unsecured protected health information as required by Sec.
164.410 of the breach notification rules.
Third, we add a provision at Sec. 164.314(a)(2)(iii) that provides
that the requirements of this section for contracts or other
arrangements between a covered entity and business associate would
apply in the same manner to contracts or other arrangements between
business associates and subcontractors required by the proposed
requirements of Sec. 164.308(b)(4). For example, to comply with
proposed Sec. 164.314(a)(2)(i)(C), a business associate contract
between a business associate and a business associate subcontractor
must provide that the subcontractor report any security incident of
which it becomes aware, including breaches of unsecured protected
health information as required by Sec. 164.410, to the business
associate. Thus, if a breach of unsecured protected health information
occurs at or by a subcontractor, the subcontractor must notify the
business associate of the breach, which then must notify the covered
entity of the breach. The covered entity then notifies the affected
individuals, the Secretary, and, if applicable, the media, of the
breach, unless it has delegated such responsibilities to a business
associate.
Finally, we propose to remove the reference to subcontractors in
Sec. 164.314(b)(2)(iii) regarding amendment of group health plan
documents as a condition of disclosure of protected health information
to a plan sponsor, to avoid confusion with the use of the term
subcontractor when referring to subcontractors that are business
associates. This modification does not constitute a substantive change
to Sec. 164.314(b).
VI. Section-by-Section Description of the Proposed Amendments to the
Privacy Rule
The HITECH Act made a number of amendments that affect current
provisions of the Privacy Rule. In the section-by-section description
of the proposed regulatory changes below, we discuss the HITECH Act
requirements and the regulatory provisions affected by them, as well as
certain other substantive proposed changes to the Privacy Rule intended
to improve the workability and effectiveness of the Rule and to conform
the Privacy Rule to PSQIA. At the end of this discussion, we also
briefly list a number of proposed technical corrections and conforming
changes to the Privacy Rule that are not otherwise addressed elsewhere.
A. Section 164.500--Applicability
We propose to revise Sec. 164.500 to include new Sec. 164.500(c)
and to
[[Page 40884]]
redesignate the current Sec. 164.500(c) as (d). In accordance with
section 13404 of the HITECH Act, which applies certain of the Privacy
Rule requirements to business associates, as discussed more fully
below, Sec. 164.500(c) would now clarify that, where provided, the
standards, requirements, and implementation specifications of the
Privacy Rule apply to business associates.
B. Section 164.501--Definitions
1. Definition of ``Health Care Operations''
PSQIA, 42 U.S.C. 299b-21 et seq., provides, among other things,
that PSOs are to be treated as business associates of covered health
care providers. Further, PSQIA provides that the patient safety
activities of PSOs in relation to HIPAA covered health care providers
are deemed to be health care operations under the Privacy Rule. See 42
U.S.C. 299b-22(i).
We propose to amend paragraph (1) of the definition of ``health
care operations'' to include a reference to patient safety activities,
as defined in the PSQIA implementing regulation at 42 CFR 3.20. Many
health care providers participating in the voluntary patient safety
program authorized by PSQIA are HIPAA covered entities; PSQIA
acknowledges that such providers must also comply with the Privacy Rule
and deems patient safety activities to be health care operations under
the Privacy Rule. While such activities are already encompassed within
paragraph (1) of the definition, which addresses various quality
activities, we propose to expressly include patient safety activities
within paragraph (1) of the definition of health care operations to
expressly conform the definition to PSQIA and to eliminate the
potential for any confusion. This modification would also address
public comments the Department received during the rulemaking period
for the PSQIA implementing regulations, which urged the Department to
modify the definition of ``health care operations'' in the Privacy Rule
to expressly reference patient safety activities so that the
intersection of the Privacy and PSQIA Rules would be clear. See 73 FR
70732, 70780, November 21, 2008.
2. Definition of ``Marketing''
The Privacy Rule requires covered entities to obtain a valid
authorization from individuals before using or disclosing protected
health information to market a product or service to them. See Sec.
164.508(a)(3). Section 164.501 defines ``marketing'' as making a
communication about a product or service that encourages recipients of
the communication to purchase or use the product or service. Paragraph
(1) of the definition includes a number of exceptions to marketing for
certain health-related communications. In particular, the Privacy Rule
does not consider the following communications to be marketing: (1)
Communications made to describe a health-related product or service (or
payment for such product or service) that is provided by, or included
in a plan of benefits of, the covered entity making the communications,
including communications about: the entities participating in a
healthcare provider network or health plan network; replacement of, or
enhancements to, a health plan; and health-related products or services
available only to a health plan enrollee that add value to, but are not
part of, a plan of benefits; (2) communications made for the treatment
of the individual; and (3) communications for case management or care
coordination for the individual, or to direct or recommend alternative
treatments, therapies, health care providers, or settings of care to
the individual. Thus, a covered entity is permitted to make these
excepted communications without an individual's authorization as either
treatment or health care operations communications, as appropriate,
under the Privacy Rule. In addition, the Privacy Rule does not require
a covered entity to obtain individual authorization to communicate
face-to-face or to provide only promotional gifts of nominal value to
the individual. See Sec. 164.508(a)(3)(i). However, a covered entity
must obtain prior written authorization from an individual to send
communications to the individual about non-health related products or
services or to give or sell the individual's protected health
information to a third party for marketing. See the current paragraph
(2) of the definition of ``marketing'' in the Privacy Rule. Still,
concerns have remained about the ability under these provisions for a
third party to pay a covered entity in exchange for the covered entity
to send health-related communications to an individual about the third
party's products or services.
Section 13406(a) of the HITECH Act, which became effective on
February 18, 2010, addresses these marketing provisions. In particular,
section 13406(a) of the HITECH Act limits the health-related
communications that may be considered health care operations and thus,
that are excepted from the definition of ``marketing'' under the
Privacy Rule to the extent a covered entity receives or has received
direct or indirect payment in exchange for making the communication. In
cases where the covered entity would receive such payment, the HITECH
Act at section 13406(a)(2)(B) requires that the covered entity obtain
the individual's valid authorization prior to making the communication,
or, if applicable, prior to its business associate making the
communication on its behalf in accordance with its written contract.
Section 13406(a)(2)(A) of the HITECH Act includes an exception to the
payment limitation for communications that describe only a drug or
biologic that is currently being prescribed to the individual as long
as any payment received by the covered entity in exchange for making
the communication is reasonable in amount. Section 13406(a)(3) of the
Act provides that the term ``reasonable in amount'' shall have the
meaning given such term by the Secretary in regulation. Finally,
section 13406(a)(4) of the Act clarifies that ``direct or indirect
payment'' does not include any payment for treatment of the individual.
We believe Congress intended with these provisions to curtail a covered
entity's ability to use the exceptions to the definition of
``marketing'' in the Privacy Rule to send communications to the
individual that were motivated more by commercial gain or other
commercial purpose rather than for the purpose of the individual's
health care, despite the communication's being about a health-related
product or service.
To implement the marketing limitations of the HITECH Act, we
propose a number of modifications to the definition of ``marketing'' in
the Privacy Rule at Sec. 164.501. In particular, we propose to: (1)
Revise the exceptions to marketing to better distinguish the exceptions
for treatment communications from those communications made for health
care operations; (2) add a definition of ``financial remuneration;''
(3) provide that health care operations communications for which
financial remuneration is received are marketing and require individual
authorization; (4) provide that written treatment communications for
which financial remuneration is received are subject to certain notice
and opt out conditions set out at Sec. 164.514(f)(2); (5) provide a
limited exception from the remuneration prohibition for refill
reminders; and (6) remove the paragraph regarding an arrangement
between a covered entity and another
[[Page 40885]]
entity in which the covered entity receives remuneration in exchange
for protected health information. We propose to revise Sec. Sec.
164.514(f)(2) and 164.520(b)(1)(iii)(A) to include the notice and opt
out conditions that would attach to written treatment communications
about products or services sent by a health care provider to an
individual in exchange for financial remuneration by the third party
whose product or service is being described. We also propose to make a
conforming change to the authorization requirements for marketing at
Sec. 164.508(a)(3)(ii). We describe these proposed modifications in
more detail below.
In paragraph (1) of the definition of ``marketing,'' we propose to
maintain the general concept that ``marketing'' means ``to make a
communication about a product or service that encourages recipients of
the communication to purchase or use the product or service.'' In
paragraph (2) of the definition, we propose to include three exceptions
to this definition to encompass certain treatment and health care
operations communications about health-related products or services.
First, at proposed paragraph (2)(iii), we would exclude from the
definition of ``marketing'' certain health care operations
communications, except where, as provided by section 13406(a)(2) of the
HITECH Act, the covered entity receives financial remuneration in
exchange for making the communication. This provision would encompass
the health care operations activities currently described in paragraph
(1)(i) of the definition of ``marketing,'' which include communications
to describe a health-related product or service (or payment for such
product or service) that is provided by, or included in a plan of
benefits of, the covered entity making the communication. In addition,
the provision would encompass health care operations communications for
case management or care coordination, contacting of individuals with
information about treatment alternatives, and related functions, to the
extent these activities do not fall within the definition of treatment.
These are activities that currently fall within paragraph (1)(iii) of
the definition of ``marketing.''
Although the HITECH Act uses the term ``direct or indirect
payment'' to describe the limitation on permissible health care
operations disclosures, we have substituted the term ``financial
remuneration'' to avoid confusion since the Privacy Rule defines and
uses the term ``payment'' to mean payment for health care and since the
Privacy Rule's authorization requirements for marketing at Sec.
164.508(a)(3) use the term ``remuneration.'' We propose to define
``financial remuneration'' in paragraph (3) of the definition of
``marketing'' to mean direct or indirect payment from or on behalf of a
third party whose product or service is being described. We also
propose to make clear, in accordance with section 13406(a)(4) of the
HITECH Act, that financial remuneration does not include any direct or
indirect payment for the treatment of an individual. Additionally,
because the HITECH Act refers expressly to ``payment,'' rather than
remuneration more generally, we have specified that only the receipt of
financial remuneration in exchange for making a communication, as
opposed to any other type of remuneration, is relevant for purposes of
the definition of marketing. We propose a small conforming change to
Sec. 164.508(a)(3) to add the term ``financial'' before
``remuneration'' and to refer to the definition of ``financial
remuneration'' for consistency with the HITECH Act and the proposed
changes to the definition of ``marketing.''
We also emphasize that financial remuneration for purposes of the
definition of ``marketing'' must be in exchange for making the
communication itself and be from or on behalf of the entity whose
product or service is being described. For example, authorization would
be required prior to a covered entity making a communication to its
patients regarding the acquisition of new state of the art medical
equipment if the equipment manufacturer paid the covered entity to send
the communication to its patients. In contrast, an authorization would
not be required if a local charitable organization, such as a breast
cancer foundation, funded the covered entity's mailing to patients
about the availability of new state of the art medical equipment, such
as mammography screening equipment, since the covered entity would not
be receiving remuneration by or on behalf of the entity whose product
or service was being described. Furthermore, it would not constitute
marketing and no authorization would be required if a hospital sent
flyers to its patients announcing the opening of a new wing where the
funds for the new wing were donated by a third party, since the
financial remuneration to the hospital from the third party was not in
exchange for the mailing of the flyers.
Second, in paragraph (2)(ii) of the definition, we propose to
include the statutory exception to marketing at section 13406(a)(2)(A)
for communications regarding refill reminders or otherwise about a drug
or biologic that is currently being prescribed for the individual,
provided any financial remuneration received by the covered entity for
making the communication is reasonably related to the covered entity's
cost of making the communication. Congress expressly identified these
types of communications as being exempt from the remuneration
limitation only to the extent that any payment received for making the
communication is reasonable in amount. We request comment on the scope
of this exception, that is, whether communications about drugs that are
related to the drug currently being prescribed, such as communications
regarding generic alternatives or new formulations of the drug, should
fall within the exception. In addition, we considered proposing a
requirement that a covered entity could only receive financial
remuneration for making such a communication to the extent it did not
exceed the actual cost to make the communication. However, we were
concerned that such a requirement would impose the additional burden of
calculating the costs of making each communication. Instead, we propose
to allow costs that are reasonably related to the covered entity's cost
of making the communication. We request comment on the types and amount
of costs that should be allowed under this provision.
Third, proposed paragraph (2)(i) would exclude from marketing
treatment communications about health-related products or services by a
health care provider to an individual, including communications for
case management or care coordination for the individual, or to direct
or recommend alternative treatments, therapies, health care providers,
or settings of care to the individual, provided, however, that if the
communications are in writing and financial remuneration is received in
exchange for making the communications, certain notice and opt out
conditions are met. We note that while section 13406(a) of the HITECH
Act expressly provides that a communication to an individual about a
health-related product or service where the covered entity receives
payment from a third party in exchange for making the communication
shall not be considered a health care operation (emphasis added) under
the Privacy Rule, and thus is marketing, it is unclear how Congress
intended these provisions to apply to treatment communications between
a health care provider and a patient. Specifically, it is unclear
whether Congress intended to restrict
[[Page 40886]]
only those subsidized communications about products and services that
are less essential to an individual's health care (i.e., those
classified as health care operations communications) or all subsidized
communications about products and services, including treatment
communications. Given this ambiguity and to avoid preventing
communications to the individual by a health care provider about health
related products or services that are necessary for the treatment of
the individual, we do not propose to require individual authorization
where financial remuneration is received by the provider from a third
party in exchange for sending the individual treatment communications
about health-related products or services. However, to ensure the
individual is aware that he or she may receive subsidized treatment
communications from his or her provider and has the opportunity to
elect not to receive them, we propose to require a statement in the
notice of privacy practices when a provider intends to send such
subsidized treatment communications to an individual, as well as the
opportunity for the individual to opt out of receiving such
communications. In particular, the proposed rule would exclude from
marketing and the authorization requirements written subsidized
treatment communications only to the extent that the following
requirements proposed at Sec. 164.514(f)(2) are met: (1) The covered
health care provider's notice of privacy practices includes a statement
informing individuals that the provider may send treatment
communications to the individual concerning treatment alternatives or
other health-related products or services where the provider receives
financial remuneration from a third party in exchange for making the
communication, and the individual has a right to opt out of receiving
such communications; and (2) the treatment communication itself
discloses the fact of remuneration and provides the individual with a
clear and conspicuous opportunity to elect not to receive any further
such communications. Similar to the modifications discussed below
regarding fundraising communications, the opt out method provided to an
individual for subsidized treatment communications may not cause the
individual to incur an undue burden or more than a nominal cost. We
encourage covered entities to consider the use of a toll-free phone
number, an e-mail address, or similar opt out mechanism that would
provide individuals with a simple, quick, and inexpensive way to opt
out of receiving future communications. We note that we would consider
requiring individuals to write and send a letter to the covered entity
asking not to receive future communications to constitute an undue
burden on the individual for purposes of this proposed requirement. We
request comment on how the opt out should apply to future subsidized
treatment communications. For example, we request comment on whether
the opt out should prevent all future subsidized treatment
communications by the provider or just those dealing with the
particular product or service described in the current communication.
We also request comment on the workability of requiring health care
providers that intend to send subsidized treatment communications to
individuals to provide an individual with the opportunity to opt out of
receiving such communications prior to the individual receiving the
first communication and what mechanisms could be put into place to
implement the requirement.
Given that the new marketing limitations on the receipt of
remuneration by a covered entity would apply differently depending on
whether a communication is for treatment or health care operations
purposes, it is important to emphasize the difference between the two
types of communications. We note first that communications by health
plans concerning health-related products or services included in a plan
of benefits or for case management or care coordination are never
considered treatment for purposes of the Privacy Rule but rather would
always be health care operations and require individual authorization
under the proposed rule if financial remuneration is involved. With
respect to subsidized communications by a health care provider about
health-related products or services for case management or care
coordination or to recommend alternative treatments or settings of
care, whether the communication would require individual authorization,
or a statement in the notice and an opportunity to opt out, would
depend on to what extent the provider is making the communication in a
population-based fashion (health care operations) or to further the
treatment of a particular individual based on that individual's health
care status or condition (treatment). For example, a covered health
care provider who sends a pregnant patient a brochure recommending a
specific birthing center suited to the patient's particular needs is
recommending a setting of care specific to the individual's condition,
which constitutes treatment of the individual. If the health care
provider receives financial remuneration in exchange for making the
communication, the provider would be required to have included a
statement in its notice of privacy practices informing individuals that
it may send subsidized treatment communications to the individual and
that the individual has a right to opt out of such communications, and
to disclose the fact of remuneration with the communication and provide
the individual with information on how to opt out of receiving future
such communications. In contrast, a health care provider who sends a
blanket mailing to all patients with information about a new affiliated
physical therapy practice would not be making a treatment
communication. Rather, the provider would be making a communication for
health care operations if it does not receive any financial
remuneration for the communication, but would be making a communication
for marketing if it does receive financial remuneration.
We are aware of the difficulty in making what may be in some cases
close judgments as to which communications are for treatment purposes
and which are for health care operations purposes. We also are aware of
the need to avoid unintended adverse consequences to a covered health
care provider's ability to provide treatment to an individual.
Therefore, we request comment on the above proposal with regard to
these issues, as well as the alternatives of excluding treatment
communications altogether even if they involve financial remuneration
from a third party or requiring individual authorization for both
treatment and health care operations communications made in exchange
for financial remuneration.
We note that face to face communications about products or services
between a covered entity and an individual and promotional gifts of
nominal value provided by a covered entity are not impacted by these
proposed changes to the definition of ``marketing.'' These
communications may continue to be made without obtaining an
authorization under Sec. 164.508 or meeting the notice and opt out
requirements of Sec. 164.514(f)(2). We also clarify that
communications made by covered entities to individuals promoting health
in general, such as communications about the importance of maintaining
a healthy diet or getting an annual physical are still not considered
to be marketing. These types
[[Page 40887]]
of communications do not constitute marketing because they are not
promoting a specific product or service, and thus do not meet the
definition of ``marketing.'' Similarly, communications about government
and government-sponsored programs do not fall within the definition of
``marketing'' as there is no commercial component to communications
about benefits available through public programs.
Finally, we have proposed to remove the language at paragraph (2)
from the definition of ``marketing'' at Sec. 164.501. The current
language defines as marketing an arrangement between a covered entity
and any other entity in which the covered entity discloses protected
health information to the other entity, in exchange for remuneration,
for the other entity or its affiliate to make a communication about its
own product or service that encourages recipients of the communication
to purchase or use that product or service. This language describes a
situation which, as explained more fully below, would now constitute a
``sale'' of protected health information under section 13405(d) of the
HITECH Act and Sec. 164.508(a)(4) of this proposed rule. Because we
propose to modify Sec. 164.508 to implement section 13405(d) of the
HITECH Act by prohibiting the sale of protected health information
without an authorization, we propose to remove this paragraph from the
definition of ``marketing'' as unnecessary and to avoid confusion.
C. Business Associates
1. Section 164.502--Uses and Disclosures
The Privacy Rule currently does not directly govern business
associates. However, the provisions of the HITECH Act make specific
requirements of the Privacy Rule applicable to business associates, and
create direct liability for noncompliance by business associates with
regard to those Privacy Rule requirements. In particular, section 13404
of the HITECH Act, which became effective February 18, 2010, addresses
the application of the provisions of the HIPAA Privacy Rule to business
associates of covered entities. Section 13404(a) discusses the
application of contract requirements to business associates, paragraph
(b) applies the provision of Sec. 164.504(e)(1)(ii) regarding
knowledge of a pattern of activity or practice that constitutes a
material breach or violation of a contract to business associates, and
paragraph (c) applies the HIPAA civil and criminal penalties to
business associates. We discuss paragraphs (a) and (b) of section 13404
of the HITECH Act below. We address section 13404(c) regarding the
application of penalties to violations by business associates above in
the discussion of the proposed changes to the Enforcement Rule.
Section 13404(a) of the HITECH Act creates direct liability for
business associates by providing that in the case of a business
associate of a covered entity that obtains or creates protected health
information pursuant to a written contract or other arrangement as
described in Sec. 164.502(e)(2) of the Privacy Rule, the business
associate may use and disclose such protected health information only
if such use or disclosure is in compliance with the applicable business
associate contract requirements of Sec. 164.504(e) of the Rule.
Additionally, section 13404(a) applies the other privacy requirements
of the HITECH Act to business associates just as they apply to covered
entities.
Accordingly, we propose to modify Sec. 164.502(a) of the Privacy
Rule containing the general rules for uses and disclosures of protected
health information to address the permitted and required uses and
disclosures of protected health information by business associates.
First, we propose to revise Sec. 164.502(a) to provide that a business
associate, like a covered entity, may not use or disclose protected
health information except as permitted or required by the Privacy Rule
or the Enforcement Rule. Second, we propose to revise the titles of
Sec. 164.502(a)(1) and (2) regarding permitted and required uses and
disclosures to make clear that these paragraphs apply only to covered
entities. Note that in Sec. 164.502(a)(2)(ii), we also propose a
technical change to replace the term ``subpart'' with ``subchapter'' to
make clear that a covered entity is required to disclose protected
health information to the Secretary as needed to determine compliance
with any of the HIPAA Rules and not just the Privacy Rule.
Third, we propose to add new provisions at Sec. 164.502(a)(4) and
(5) to address the permitted and required uses and disclosures of
protected health information by business associates.\4\ In accordance
with section 13404(a) of the HITECH Act, proposed Sec. 164.502(a)(4)
would allow business associates to use or disclose protected health
information only as permitted or required by their business associate
contracts or other arrangements pursuant to Sec. 164.504(e), or as
required by law. If a covered entity and business associate have failed
to enter into a business associate contract or other arrangement, then
the business associate may use or disclose protected health information
only as necessary to perform its obligations for the covered entity
(pursuant to whatever agreement sets the general terms for the
relationship between the covered entity and business associate) or as
required by law; any other use or disclosure would violate the Privacy
Rule. In addition, proposed Sec. 164.502(a)(4) makes clear that a
business associate would not be permitted to use or disclose protected
health information in a manner that would violate the requirements of
the Privacy Rule, if done by the covered entity, except that the
business associate would be permitted to use or disclose protected
health information for the purposes specified under Sec.
164.504(e)(2)(i)(A) or (B), pertaining to uses and disclosures for the
proper management and administration of the business associate and the
provision of data aggregation services for the covered entity, if such
uses and disclosures are permitted by its business associate contract
or other arrangement.
---------------------------------------------------------------------------
\4\ We propose to reserve Sec. 164.502(a)(3) for provisions
implementing modifications to the Privacy Rule required by the
Genetic Information Nondiscrimination Act of 2008 (GINA), which were
proposed on October 7, 2009. See 74 FR 51698.
---------------------------------------------------------------------------
Section 164.502(a)(5) would require business associates to disclose
protected health information either when required by the Secretary
under subpart C of part 160 of this subchapter to investigate or
determine the business associate's compliance with this subchapter, or
to the covered entity, individual, or individual's designee, as
necessary to satisfy a covered entity's obligations under Sec.
164.524(c)(2)(ii) and (3)(ii), as modified, with respect to an
individual's request for an electronic copy of protected health
information. As section 13405(e) requires covered entities that
maintain protected health information in an electronic health record to
provide an individual, or the individual's designee, with a copy of
such information in an electronic format, if the individual so chooses,
and as section 13404(a) applies section 13405(e) to business associates
as well, we propose to include such language in Sec. 164.502(a)(5).
We propose to modify the minimum necessary standard at Sec.
164.502(b) to require that when business associates use, disclose, or
request protected health information, they limit protected health
information to the minimum necessary to accomplish the intended purpose
of the use, disclosure, or request. Applying the minimum necessary
standard is a condition of the permissibility of many uses and
disclosures of protected health information. Thus, a business associate
[[Page 40888]]
is not making a permitted use or disclosure under the Privacy Rule if
it does not apply the minimum necessary standard, where appropriate.
Additionally, the HITECH Act at section 13405(b) addresses the
application of minimum necessary and, in accordance with section
13404(a), also applies such requirements to business associates. We
note that we have not added references to ``business associate'' to
other provisions of the Privacy Rule that address uses and disclosures
by covered entities. This is because we found such changes to be
unnecessary, since a business associate generally may only use or
disclose protected health information in the same manner as a covered
entity (therefore any Privacy Rule limitation on how a covered entity
may use or disclose protected health information automatically extends
to business associates).
Section 164.502(e) sets out the requirements for disclosures to
business associates. We propose in Sec. 164.502(e)(1)(i) to provide
that covered entities are not required to obtain satisfactory
assurances from business associates that are subcontractors. Rather, as
we previously discussed with regard to proposed modifications to the
Security Rule pertaining to business associates, and as we discuss
further below, we propose in the Privacy and Security Rules to require
that business associates obtain satisfactory assurances, through a
written contract or other arrangement, from subcontractors that provide
that the subcontractor will comply with the applicable requirements of
the Rules. Accordingly, each business associate subcontractor would be
subject to the terms and conditions of a business associate agreement
with a business associate, eliminating the need for a similar agreement
with the covered entity itself.
We also propose to move the current exceptions to business
associates at Sec. 164.502(e)(1)(ii) to the revised definition of
business associates found in Sec. 160.103 for the reasons discussed in
that section.
We propose a new Sec. 164.502(e)(1)(ii) that provides that a
business associate may disclose protected health information to a
business associate that is a subcontractor, and to allow the
subcontractor to create or receive protected health information on
behalf of the business associate, if the business associate obtains
satisfactory assurances, in accordance with Sec. 164.504(e)(1)(i),
that the subcontractor will appropriately safeguard the information. As
such, the business associate must enter into a contract or other
arrangement that complies with Sec. 164.504(e)(1)(i) with business
associate subcontractors, in the same manner that covered entities are
required to enter into contracts or other arrangements with their
business associates. As we discussed with regard to the requirements of
the Security Rule regarding business associates, we believe that
business associates are in the best position to ensure that
subcontractors comply with the requirements of the Privacy Rule. For
example, a covered entity may choose to contract with a business
associate (contractor) to use or disclose protected health information
on its behalf, the business associate may choose to obtain the services
of (and exchange protected health information with) a subcontractor
(subcontractor 1), and that subcontractor may, in turn, contract with
another subcontractor (subcontractor 2) for services involving
protected health information. Under the current rules, the covered
entity would be required to obtain a business associate agreement with
the contractor, the contractor would have a contractual requirement to
obtain the same satisfactory assurances from subcontractor 1, and
subcontractor 1 would in turn have a contractual requirement to obtain
the same satisfactory assurances from subcontractor 2. The proposed
revisions to the Privacy and Security Rules would not change the
parties to the contracts. However, the contractor and subcontractors 1
and 2 all would now be business associates with direct liability under
the HIPAA Rules, and would be required to obtain business associate
agreements with the parties with whom they contract for services that
involve access to protected health information. (Note, however, as
discussed above with respect to the definition of ``business
associate,'' direct liability under the HIPAA Rules attaches regardless
of whether the contractor and subcontractors have entered into business
associate agreements.) The proposed revisions ensure that the covered
entity does not have a new obligation to enter into separate contracts
with the business associate subcontractors.
We propose to remove Sec. 164.502(e)(1)(iii), which provides that
a covered entity that violates the satisfactory assurances it provided
as a business associate of another covered entity will be in
noncompliance with the Privacy Rule's business associate provisions,
given that new proposed Sec. 164.502(a)(4) would restrict directly the
uses and disclosures of protected health information by a business
associate, including a covered entity acting as a business associate,
to those uses and disclosures permitted by its business associate
agreement.
2. Section 164.504(e)--Business Associate Agreements
Section 164.504, among other provisions, contains the specific
requirements for business associate contracts and other arrangements.
As discussed previously, section 13404 of the HITECH Act provides that
a business associate may use and disclose protected health information
only if such use or disclosure is in compliance with each applicable
requirement of Sec. 164.504(e), and also applies the provisions of
Sec. 164.504(e)(1)(ii), which outline the actions that must be taken
if the business associate has knowledge of a breach of the contract, to
business associates. We propose a number of modifications to this
section to implement these provisions and to reflect the Department's
new regulatory authority with respect to business associates, as well
as to reflect a covered entity's and business associate's new
obligations under subpart D to provide for notification in the case of
breaches of unsecured protected health information.
Section 164.504(e)(1)(ii) provides that a covered entity is not in
compliance with the business associate requirements if the covered
entity knew of a pattern of activity or practice of the business
associate that constituted a material breach or violation of the
business associate's obligation under the contract or other
arrangement, unless the covered entity took reasonable steps to cure
the breach or end the violation, as applicable, and if such steps were
unsuccessful, terminated the contract or arrangement or, if termination
is not feasible, reported the problem to the Secretary. We propose to
revise Sec. 164.504(e)(1)(ii) to remove the requirement that covered
entities report to the Secretary when termination of a business
associate contract is not feasible. In light of a business associate's
direct liability for civil money penalties for violations of the HIPAA
Rules and both a covered entity's and business associate's obligations
under subpart D to report breaches of unsecured protected health
information to the Secretary, we have other mechanisms through which we
expect to learn of such breaches and misuses of protected health
information by a business associate. We also propose to add a new
provision at Sec. 164.504(e)(1)(iii) applicable to business associates
with respect to subcontractors to mirror the requirements on covered
entities in
[[Page 40889]]
Sec. 164.504(e)(1)(ii) (minus the requirement to report to the
Secretary if termination of a contract is not feasible). Thus, proposed
Sec. 164.504(e)(1)(iii) would require a business associate, if it knew
of a pattern or practice of activity of its business associate
subcontractor that constituted a material breach or violation of the
subcontractor's contract or other arrangement, to take reasonable steps
to cure the breach of the subcontractor or to terminate the contract,
if feasible. We believe this proposed provision would implement the
intent of section 13404(b) of the HITECH Act, and aligns the
requirements for business associates with regard to business associate
subcontractors with the requirements for covered entities with regard
to their business associates. In other words, a business associate that
is aware of noncompliance by its business associate subcontractor must
respond to the situation in the same manner as a covered entity that is
aware of noncompliance by its business associate.
While business associates are now directly liable for civil money
penalties under the HIPAA Rules for impermissible uses and disclosures
as described above, business associates are still contractually liable
to covered entities pursuant to their business associate contracts, as
provided for and required by Sec. 164.504(e). We propose certain
modifications to these contract requirements. First, we propose to
revise Sec. 164.504(e)(2)(ii)(B) through (D) to require the following:
in (B), that business associates comply, where applicable, with the
Security Rule with regard to electronic protected health information;
in (C), that business associates report breaches of unsecured protected
health information to covered entities, as required by Sec. 164.410;
and in (D), that, in accordance with Sec. 164.502(e)(1)(ii), business
associates ensure that any subcontractors that create or receive
protected health information on behalf of the business associate agree
to the same restrictions and conditions that apply to the business
associate with respect to such information. These proposed revisions
align the requirements for the business associate contract with the
requirements in the HITECH Act and elsewhere within the HIPAA Rules.
Additionally with regard to business associate contract
requirements, we propose to insert a new provision at Sec.
164.502(e)(2)(ii)(H) and to renumber the current paragraphs (H) and (I)
accordingly. Section 164.502(e)(2)(ii)(H), as proposed, would require
that, to the extent the business associate is to carry out a covered
entity's obligation under this subpart, the business associate must
comply with the requirements of the Privacy Rule that apply to the
covered entity in the performance of such obligation. The HITECH Act
places direct liability for uses and disclosures and for the other
HITECH Act requirements on business associates. Beyond such direct
liability, this provision clarifies that a business associate is
contractually liable not only for uses and disclosures of protected
health information, but also for all other requirements of the Privacy
Rule, as they pertain to the performance of the business associate's
contract. For example, if a third party administrator, as a business
associate of a group health plan, fails to distribute the plan's notice
of privacy practices to participants on a timely basis, the third party
administrator would not be directly liable under the HIPAA Rules, but
would be contractually liable, for the failure. However, we emphasize
that in this example, even though the business associate is not
directly liable under the HIPAA Rules for failure to provide the
notice, the covered entity remains directly liable for failure to
provide the individuals with its notice of privacy practices because it
is the covered entity's ultimate responsibility to do so, despite its
having hired a business associate to perform the function.
We also propose to revise Sec. 164.504(e)(3) regarding other
arrangements for governmental entities to include references to the
Security Rule requirements for business associates to streamline the
two rules and, as discussed above, to avoid having to repeat such
provisions in the Security Rule.
To implement the requirements of sections 13404(a) of the HITECH
Act, we propose to include a new Sec. 164.504(e)(5) that applies the
requirements of Sec. 164.504(e)(2) through (e)(4) to the contract or
other arrangement between a business associate and its business
associate subcontractor as required by Sec. 164.502(e)(1)(ii) in the
same manner as such requirements apply to contracts or other
arrangements between a covered entity and its business associate. As
such, the business associate is required by Sec. 164.502(e)(1)(ii) and
by this section to enter into business associate contracts, or other
arrangements that comply with the Privacy and Security Rules, with
their business associate subcontractors in the same manner that covered
entities are required to enter into contracts or other arrangements
with their business associates.
Finally, we propose to remove the reference to subcontractors in
Sec. 164.504(f)(2)(ii)(B) to avoid confusion with the use of the term
subcontractor when referring to subcontractors as business associates.
For the same reason, we propose to remove the reference to
subcontractors in Sec. 164.514(e)(4)(ii)(C)(4) to avoid confusion with
the use of the term subcontractor when referring to subcontractors as
business associates. We do not intend these proposed modifications to
constitute substantive changes.
3. Section 164.532--Transition Provisions
We understand that covered entities and business associates are
concerned with the anticipated administrative burden and cost to
implement the revised business associate contract provisions of the
Privacy and Security Rules. Covered entities may have existing
contracts that are not set to terminate or expire until after the
compliance date of the modifications to the Rules, and we understand
that a six month compliance period may not provide enough time to
reopen and renegotiate all contracts. In response to these concerns, we
propose to relieve some of the burden on covered entities and business
associates in complying with the revised business associate provisions
by adding a transition provision to grandfather certain existing
contracts for a specified period of time. The Department's authority to
add the transition provision is set forth in Sec. 160.104(c), which
allows the Secretary to establish the compliance date for any modified
standard or implementation specification, taking into account the
extent of the modification and the time needed to comply with the
modification. We also note that the Final Privacy Rule, 65 FR 82462
(Dec. 28, 2000), and the Modifications to the HIPAA Privacy Rule, 67 FR
53182 (Aug. 14, 2002), both included transition provisions to ensure
that important functions of the health care system were not impeded
(e.g., to prevent disruption of ongoing research). Similarly, the
proposed transition period, here, will prevent rushed and hasty changes
to thousands of on-going existing business associate agreements. The
following discussion addresses the issue of the business associate
transition provisions.
We propose new transition provisions at Sec. 164.532(d) and (e) to
allow covered entities and business associates (and business associates
and business associate subcontractors) to continue to operate under
certain existing contracts for up to one year beyond the
[[Page 40890]]
compliance date of the revisions to the Rules. The additional
transition period would be available to a covered entity or business
associate if, prior to the publication date of the modified Rules, the
covered entity or business associate had an existing contract or other
written arrangement with a business associate or subcontractor,
respectively, that complied with the prior provisions of the HIPAA
Rules and such contract or arrangement was not renewed or modified
between the effective date and the compliance date of the modifications
to the Rules. The proposed provisions are intended to allow those
covered entities and business associates with contracts with business
associates and subcontractors, respectively, that qualify as described
above to continue to disclose protected health information to the
business associate or subcontractor, or to allow the business associate
or subcontractor to create or receive protected health information on
behalf of the covered entity or business associate, for up to one year
beyond the compliance date of the modifications, regardless of whether
the contract meets the applicable contract requirements in the
modifications to the Rules. With respect to business associates and
subcontractors, this proposal would grandfather existing written
agreements between business associates and subcontractors entered into
pursuant to 45 CFR 164.504(e)(2)(i)(D), which requires the business
associate to ensure that its agents with access to protected health
information agree to the same restrictions and conditions that apply to
the business associate. The Department proposes to deem such contracts
to be compliant with the modifications to the Rules until either the
covered entity or business associate has renewed or modified the
contract following the compliance date of the modifications, or until
the date that is one year after the compliance date, whichever is
sooner.
In cases where a contract renews automatically without any change
in terms or other action by the parties (also known as ``evergreen
contracts''), the Department intends that such evergreen contracts will
be eligible for the extension and that deemed compliance would not
terminate when these contracts automatically roll over. These
transition provisions apply to covered entities and business associates
only with respect to written contracts or other written arrangements as
specified above, and not to oral contracts or other arrangements.
These transition provisions only apply to the requirement to amend
contracts; they do not affect any other compliance obligations under
the HIPAA Rules. For example, beginning on the compliance date of this
rule, a business associate may not use or disclose protected health
information in a manner that is contrary to the Privacy Rule, even if
the business associate's contract with the covered entity has not yet
been amended.
D. Section 164.508--Uses and Disclosures for Which an Authorization is
Required
Section 164.508 of the Privacy Rule permits a covered entity to use
and disclose protected health information only if it has obtained a
valid authorization (i.e., one that meets the requirements of the
section), unless such use or disclosure is otherwise permitted or
required by the Privacy Rule. Section 164.508 also lists two specific
circumstances in which an authorization must be obtained: (1) Most uses
and disclosures of psychotherapy notes; and (2) uses and disclosures
for marketing.
1. Sale of Protected Health Information
Section 13405(d) of the HITECH Act adds a third circumstance that
requires authorization, specifically the sale of protected health
information. Section 13405(d)(1) prohibits a covered entity or business
associate from receiving direct or indirect remuneration in exchange
for the disclosure of protected health information unless the covered
entity has obtained a valid authorization from the individual pursuant
to Sec. 164.508 that states whether the protected health information
can be further exchanged for remuneration by the entity receiving the
information. Section 13405(d)(2) sets forth several exceptions to the
authorization requirement. These exceptions are where the purpose of
the exchange of information for remuneration is for: (1) Public health
activities, as described in Sec. 164.512(b); (2) research purposes as
described in Sec. Sec. 164.501 and 164.512(i), if the price charged
for the information reflects the costs of preparation and transmittal
of the data; (3) treatment of the individual; (4) the sale, transfer,
merger, or consolidation of all or part of a covered entity and for
related due diligence; (5) services rendered by a business associate
pursuant to a business associate agreement and at the specific request
of the covered entity; (6) providing an individual with access to his
or her protected health information pursuant to Sec. 164.524; and (7)
such other purposes as the Secretary determines to be necessary and
appropriate by regulation. Section 13405(d)(4) of the Act provides that
the prohibition on sale of protected health information shall apply to
disclosures occurring 6 months after the date of the promulgation of
final regulations implementing this section.
To implement section 13405(d) of the HITECH Act, we propose to add
new provisions at Sec. 164.508(a)(4) regarding the sale of protected
health information. In proposed Sec. 164.508(a)(4)(i), we propose to
require a covered entity to obtain an authorization for any disclosure
of protected health information in exchange for direct or indirect
remuneration. This authorization must state that the disclosure will
result in remuneration to the covered entity. In proposed Sec.
164.508(a)(4)(ii), we propose to except several disclosures of
protected health information, made in exchange for remuneration, from
this authorization requirement. These exceptions, as discussed more
fully below, generally follow the statutory exceptions described in the
above paragraph.
The proposed language in Sec. 164.508(a)(4)(i) generally follows
the statutory language of section 13405(d)(1) in prohibiting the
disclosure of protected health information without an authorization if
the covered entity receives direct or indirect remuneration from or on
behalf of the recipient of the protected health information. As
required by the Act, this proposed provision would apply to business
associates as well as to covered entities.
We do not include language in proposed Sec. 164.508(a)(4) to
require that the authorization under Sec. 164.508 specify whether the
protected health information disclosed by the covered entity for
remuneration can be further exchanged for remuneration by the entity
receiving the information. We believe the intent of this statutory
language was to ensure that, as currently required by Sec. 164.508 for
marketing, the authorization include a statement as to whether
remuneration will be received by the covered entity with respect to the
disclosures subject to the authorization. Otherwise, the individual
would not be put on notice that the disclosure involves remuneration
and thus, would not be making an informed decision as to whether to
sign the authorization. Accordingly, we propose to require that the
Sec. 164.508(a)(4)(i) authorization include a statement that the
covered entity is receiving direct or indirect remuneration in exchange
for the protected health information. This requirement would ensure
that individuals can make informed decisions regarding whether to
authorize disclosure of their protected health information when the
disclosure
[[Page 40891]]
will result in remuneration to the covered entity. We also note, with
respect to the recipient of the information, if protected health
information is disclosed for remuneration by a covered entity or
business associate to another covered entity or business associate in
compliance with the authorization requirements at proposed Sec.
164.508(a)(4)(i), the recipient covered entity or business associate
could not redisclose that protected health information in exchange for
remuneration unless a valid authorization is obtained in accordance
with proposed Sec. 164.508(a)(4)(i) with respect to such redisclosure.
We request comment on these provisions.
In proposed Sec. 164.508(a)(4)(ii), we set forth the exceptions to
the authorization requirement of proposed paragraph (a)(4)(i). We
propose the exceptions provided for by section 13405(d)(2) of the
HITECH Act, but we also propose to exercise the authority granted to
the Secretary in section 13405(d)(2)(G) to include an additional
exception that we deem to be similarly necessary and appropriate. We
invite public comment on the proposed exceptions to this authorization
requirement and whether there are additional exceptions that should be
included in the final regulation.
The exception at proposed Sec. 164.508(a)(4)(ii)(A) covers
exchanges for remuneration for public health activities pursuant to
Sec. Sec. 164.512(b) or 164.514(e). This exception largely tracks the
statutory language; however, we have added a reference to Sec.
164.514(e), to ensure that a covered entity or business associate that
discloses protected health information for public health activities in
limited data set form is also excepted from the authorization
requirement. We believe it is consistent with the statutory language to
also except the disclosure of a limited data set where Congress has
already excepted the disclosure of fully identifiable protected health
information for the same purpose from the remuneration prohibition.
With respect to the exception for public health disclosures, section
13405(d)(3)(A) of the HITECH Act requires that the Secretary evaluate
the impact of restricting this exception to require that the price
charged for the data reflects only the costs of preparation and
transmittal of the data on research or public health activities,
including those conducted by or for the use of the Food and Drug
Administration (FDA). Section 13405(d)(3)(B) further provides that if
the Secretary finds that such further restriction will not impede such
activities, the Secretary may include the restriction in the
regulations. While we do not propose to include such a restriction on
the remuneration that may be received for disclosures for public health
purposes at this time, we request public comment on this issue to
assist us in evaluating the impact of any such restriction.
The proposed exception at Sec. 164.508(a)(4)(ii)(B) generally
tracks the statutory language and excepts from the authorization
requirement disclosures of protected health information for research
purposes, pursuant to Sec. Sec. 164.512(i) or 164.514(e), in which the
covered entity receives remuneration, as long as the remuneration
received by the covered entity is a reasonable, cost-based fee to cover
the cost to prepare and transmit the information for research purposes.
We request public comment on the types of costs that should be
permitted under this provision. As discussed above with respect to the
exception for public health activities, we also propose to add a
reference to Sec. 164.514(e) to ensure that this exception likewise
applies to the disclosure of protected health information in limited
data set form for research purposes.
Proposed Sec. 164.508(a)(4)(ii)(C) would create an exception from
the authorization requirement for disclosures of protected health
information for treatment and payment purposes, in which the covered
entity receives remuneration. Though the Act only addressed treatment,
we have expressly included disclosures for payment purposes and have
also included reference to Sec. 164.506(a), which sets forth the
standard for disclosures of protected health information for treatment
and payment purposes. We also propose to except disclosures made for
payment for health care from the remuneration limitation to make clear
that we do not consider the exchange of protected health information to
obtain ``payment,'' as such term is defined in the Privacy Rule at
Sec. 164.501, to be a sale of protected health information and thus,
subject to the authorization requirements in this section.
Section 13405(d)(2)(D) of the HITECH Act excepts from the
authorization requirement disclosures described in paragraph (6)(iv) of
the definition of health care operations at Sec. 164.501, i.e.,
disclosures for the sale, transfer, merger, or consolidation of all or
part of a covered entity with another covered entity, or an entity that
following such activity will become a covered entity, and due diligence
related to such activity. Proposed Sec. 164.508(a)(4)(ii)(D) would
accordingly except from the authorization requirement disclosures of
protected health information for the events described in paragraph
(6)(iv). We also add a reference to Sec. 164.506(a), the provision
which permits a covered entity to disclose protected health information
for health care operations purposes.
Proposed Sec. 164.508(a)(4)(ii)(E) would except from the
authorization requirements disclosures of protected health information
to or by a business associate for activities that the business
associate undertakes on behalf of a covered entity pursuant to
Sec. Sec. 164.502(e) and 164.504(e), as long as the only remuneration
provided is by the covered entity to the business associate for the
performance of such activities. We have modified the statutory language
to provide specific references to the provisions of the Privacy Rule
that set forth the standards through which covered entities may make
disclosures of protected health information to business associates and
the standards for business associate contracts which govern the
relationship between covered entities and their business associates.
This proposed exception would exempt from the authorization requirement
in Sec. 164.508(a)(4)(i) a disclosure of protected health information
by a covered entity to a business associate or by a business associate
to a third party on behalf of the covered entity as long as any
remuneration received by the business associate was for payment for the
activities performed by the business associate pursuant to a business
associate contract.
Proposed Sec. 164.508(a)(4)(ii)(F) would except from the
authorization requirement disclosures of protected health information
by a covered entity to an individual when requested under Sec. Sec.
164.524 or 164.528. While section 13405(d)(2)(F) explicitly refers only
to disclosures under Sec. 164.524, we are exercising our authority
under section 13405(d)(2)(G) of the HITECH Act (discussed below) to
include in this proposed section disclosures under Sec. 164.528 as
necessary and appropriate. Section 164.502(a)(2)(i) requires covered
entities to disclose protected health information relating to an
individual to that individual upon request pursuant to Sec. Sec.
164.524 or 164.528. Section 164.524 permits a covered entity to impose
a reasonable, cost-based fee for the provision of access to an
individual's protected health information, upon request. Section
164.528 requires a covered entity to provide a requesting individual
with an accounting of disclosures without
[[Page 40892]]
charge in any 12-month period but permits a covered entity to impose a
reasonable, cost-based fee for each subsequent request for an
accounting of disclosures during that 12-month period. Therefore, as a
disclosure of protected health information under Sec. 164.528 is
similar to a disclosure under Sec. 164.524 in that a covered entity
may be paid a fee for making the disclosure, we have included
disclosures pursuant to requests for accountings of disclosures in this
exception. We note that this exception would not permit a covered
entity to require that an individual pay a fee that is not otherwise
permitted by Sec. Sec. 164.524 or 164.528.
We propose an additional exception at Sec. 164.508(a)(4)(ii)(G),
pursuant to the authority granted to the Secretary in section
13405(d)(2)(G) of the HITECH Act to except from the authorization
requirements at proposed Sec. 164.508(a)(4)(i) disclosures that are
required by law as permitted under Sec. 164.512(a). Section 164.512(a)
permits covered entities to use or disclose protected health
information to the extent that such use or disclosure is required by
law. We propose to add this exception to ensure that a covered entity
can continue to disclose protected health information, where required
by law, even if the covered entity receives remuneration for the
disclosure. We request comment on the inclusion of such an exception.
Finally, we propose an additional exception at Sec.
164.508(a)(4)(ii)(H), pursuant to the authority granted to the
Secretary in section 13405(d)(2)(G), to except from the authorization
requirements at proposed Sec. 164.508(a)(4)(i) a disclosure of
protected health information for any other purpose permitted by and in
accordance with the applicable requirements of subpart E, as long as
the only remuneration received by the covered entity is a reasonable,
cost-based fee to cover the cost to prepare and transmit the protected
health information for such purpose or is a fee otherwise expressly
permitted by other law. We have included this proposed exception as
necessary and appropriate to ensure that the proposed authorization
requirement does not deter covered entities from disclosing protected
health information for permissible purposes under subpart E just
because they routinely receive payment equal to the cost of preparing,
producing, or transmitting the protected health information. We
emphasize that this exception would not apply if a covered entity
received remuneration above the actual cost incurred to prepare,
produce, or transmit the protected health information for the permitted
purpose, unless such fee is expressly permitted by other law.
We recognize that many States have laws in place to limit the fees
a health care provider can charge to prepare, copy, and transmit
medical records. Some States simply require any reasonable costs
incurred by the provider in making copies of the medical records to be
paid for by the requesting party, while other States set forth specific
cost limitations with respect to retrieval, labor, supplies, and
copying costs and allow charges equal to actual mailing or shipping
costs. Many of these State laws set different cost limitations based on
the amount and type of information to be provided, taking into account
whether the information is in paper or electronic form as well as
whether the requested material includes x-rays, films, disks, tapes, or
other diagnostic imaging. We intend that the reference in proposed
Sec. 164.508(a)(4)(ii)(H) to fees expressly permitted by other laws to
include fees permitted by such State laws. Therefore, if a covered
entity discloses protected health information in exchange for
remuneration that conforms to an applicable State law with respect to
such fees, the exception would apply and no authorization pursuant to
Sec. 164.508(a)(4)(i) would be required. We do note, however, that of
the States that do have such laws in place, there is great variation
regarding the types of document preparation activities for which a
provider can charge as well as the permissible fee schedules for such
preparation activities. We invite public comment on our proposal to
include in Sec. 164.508(a)(4)(ii)(H) a general exception for
disclosures made for permissible purposes for which the covered entity
received remuneration that was consistent with applicable State law.
We propose a conforming change to Sec. 164.508(b)(1)(i) to include
a reference to the authorization requirement in proposed Sec.
164.508(a)(4)(i).
2. Research
a. Compound Authorizations
Section 164.508(b)(4) of the Privacy Rule prohibits covered
entities from conditioning treatment, payment, enrollment in a health
plan, or eligibility for benefits on the provision of an authorization.
This limitation is intended to prevent covered entities from coercing
individuals into signing an authorization for a use or disclosure that
is not necessary to carry out the services that the covered entity
provides to the individual. However, this section permits a covered
entity to condition the provision of research-related treatment on
obtaining the individual's authorization in limited situations, such as
for a clinical trial. Permitting the use of protected health
information is part of the decision to receive care through a clinical
trial, and health care providers conducting such trials are able to
condition research-related treatment on the individual's willingness to
authorize the use or disclosure of protected health information for
research associated with the trial.
Section 164.508(b)(3) generally prohibits what are termed
``compound authorizations,'' i.e., where an authorization for the use
and disclosure of protected health information is combined with any
other legal permission. However, Sec. 164.508(b)(3)(i) carves out an
exception to this general prohibition, permitting the combining of an
authorization for a research study with any other written permission
for the same study, including another authorization or consent to
participate in the research. Nonetheless, Sec. 164.508(b)(3)(iii)
prohibits combining an authorization that conditions treatment,
payment, enrollment in a health plan, or eligibility for benefits with
an authorization for another purpose for which treatment, payment,
enrollment, or eligibility may not be conditioned. This limitation on
certain compound authorizations was intended to help ensure that
individuals understand that they may decline the activity described in
the unconditioned authorization yet still receive treatment or other
benefits or services by agreeing to the conditioned authorization.
The impact of these authorization requirements and limitations can
be seen during clinical trials that are associated with a corollary
research activity, such as when protected health information is used or
disclosed to create or to contribute to a central research database or
repository. For example, Sec. 164.508(b)(3)(iii) prevents covered
entities from obtaining a single authorization for the use or
disclosure of protected health information for a research study that
includes both treatment as part of a clinical trial and tissue banking
of specimens (and associated protected health information) collected,
since a research-related treatment authorization generally is
conditioned and a tissue banking authorization generally is not
conditioned. Various groups, including researchers and professional
organizations, have expressed concern at this lack of integration. The
Secretary's Advisory Committee for Human Research Protections in 2004
[[Page 40893]]
(Recommendation V, in a letter to the Secretary of HHS, available at
http://www.hhs.gov/ohrp/sachrp/hipaalettertosecy090104.html), as well
as the Institute of Medicine (IOM) in its 2009 Report, ``Beyond the
HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through
Research'' (Recommendation II.B.2), also made specific recommendations
to allow combined authorizations for clinical trials and biospecimen
storage. Research-related treatment offered through a clinical trial is
nearly always conditioned upon signing the informed consent to
participate in the trial and the authorization to use or disclose the
individual's protected health information for the trial. Thus, covered
entities must obtain separate authorizations from research participants
for a clinical trial that also collects specimens with associated
protected health information for a central repository. For clinical
research trials that may have thousands of participants, documenting
and storing twice as many authorizations is a major concern. There is
also a concern that multiple forms may be confusing for research
subjects. The Department has received reports that recruitment into
clinical trials has been hampered, in part, because the multiplicity of
forms for research studies dissuades individuals from participating in
research. We have also heard that redundant information provided by two
authorization forms (one for the clinical study and another for related
research) diverts an individual's attention from other content that
describes how and why the personal health information may be used.
While seeking Institutional Review Board (IRB) or Privacy Board
waiver of the authorization requirement is an option under Sec.
164.512 of the Privacy Rule, an IRB or Privacy Board is less likely to
approve a request for a waiver of authorization for a foreseeable use
or disclosure of protected health information to create and maintain or
contribute to a central tissue or information repository if the covered
entity is planning to seek informed consent from the individual for
this purpose. Accordingly, the waiver provisions generally do not
resolve concerns expressed by the research community.
We agree that allowing a covered provider to combine research
authorizations would streamline the process for obtaining an
individual's authorization for research and would make the
documentation responsibilities of these covered entities more
manageable. Such a modification would also result in an authorization
that would be simpler and, therefore, more meaningful to the individual
(in contrast to the individual receiving multiple forms that may be
confusing). We, therefore, propose to amend Sec. 164.508(b)(3)(i) and
(iii) to allow a covered entity to combine conditioned and
unconditioned authorizations for research, provided that the
authorization clearly differentiates between the conditioned and
unconditioned research components and clearly allows the individual the
option to opt in to the unconditioned research activities. These
provisions would allow covered entities to combine authorizations for
scenarios that often occur in research studies. For example, a covered
entity would be able to combine an authorization permitting the use and
disclosure of protected health information associated with a specimen
collection for a central repository and authorization permitting use
and disclosure of protected health information for clinical research
that conditions research-related treatment on the execution of a HIPAA
authorization.
While the proposed modifications do not alter the core elements or
required statements integral to a valid authorization, covered entities
would have some flexibility with respect to how they met the
authorization requirements. For example, covered entities could
facilitate an individual's understanding of a compound authorization by
describing the unconditioned research activity on a separate page of a
compound authorization. They could also cross-reference relevant
sections of a compound authorization to minimize the potential for
redundant language. In addition, a covered entity could use a separate
check-box for the unconditioned research activity to signify whether an
individual has opted-in to the unconditioned research activity, while
maintaining one signature line for the authorization. Alternatively, a
covered entity could choose to provide a distinct signature line for
the unconditioned authorization to signal that the individual is
authorizing optional research that will not affect research-related
treatment. We request comment on additional methods that would clearly
differentiate to the individual the conditioned and unconditioned
research activities on the compound authorization.
b. Authorizing Future Research Use or Disclosure
Research often involves obtaining health information and biological
specimens to create a research database or repository for future
research. For example, this frequently occurs where clinical trials are
paired with corollary research activities, such as the creation of a
research database or repository where information and specimens
obtained from a research participant during the trial are transferred
and maintained for future research. It also is our understanding that
IRBs in some cases may approve an informed consent document for a
clinical trial that also asks research participants to permit future
research on their identifiable information or specimens obtained during
the course of the trial, or may review an informed consent for a prior
clinical trial to determine whether a subsequent research use is
encompassed within the original consent.
The Department has interpreted the Privacy Rule, however, to
require that authorizations for research be study specific for purposes
of complying with the Rule's requirement at Sec. 164.508(c)(1)(iv)
that an authorization must include a description of each purpose of the
requested use or disclosure. See 67 FR 53182, 53226, Aug. 14, 2002. In
part, the Department's interpretation was based on a concern that
patients could lack necessary information in the authorization to make
an informed decision about the future research, due to a lack of
information about the future research at the time the authorization was
obtained. In addition, it was recognized that not all uses and
disclosures of protected health information for a future research
purpose would require a covered entity to re-contact the individual to
obtain another authorization, to the extent other conditions in the
Privacy Rule were met. For example, a covered entity could obtain a
waiver of authorization from an IRB or Privacy Board as provided under
Sec. 164.512(i) or use or disclose only a limited data set pursuant to
a data use agreement under Sec. 164.514(e) for the future research
purpose.
Subsequent to its issuing this interpretation, the Department has
heard concerns from covered entities and researchers that the
Department's interpretation encumbers secondary research, and limits an
individual's ability to agree to the use or disclosure of their
protected health information for future research without having to be
re-contacted to sign multiple authorization forms at different points
in the future. In addition, many commenters noted that the Department's
interpretation limiting the scope of a HIPAA authorization for research
appeared to diverge from the current practice under the Common Rule
with respect to the
[[Page 40894]]
ability of a researcher to seek subjects' consent to future research so
long as the future research uses are described in sufficient detail to
allow an informed consent. These commenters, as well as the Secretary's
Advisory Committee for Human Research Protections in 2004
(Recommendation IV, in a letter to the Secretary of HHS, available at
http://www.hhs.gov/ohrp/sachrp/hipaalettertosecy090104.html) and the
IOM in its 2009 Report entitled ``Beyond the HIPAA Privacy Rule:
Enhancing Privacy, Improving Health Through Research'' (Recommendation
II.B.1), have urged the Department to allow the HIPAA authorization to
permit future research use and disclosure of protected health
information or, at a minimum, for the Department to modify its
interpretation to allow the authorization to encompass certain future
use and disclosure of protected health information for research,
provided certain parameters are met.
Given these concerns, in addition to the modifications mentioned in
the prior section, the Department is considering whether to modify its
interpretation that an authorization for the use or disclosure of
protected health information for research be research-study specific.
In particular, the Department is considering a number of options and
issues in this area, including whether: (1) The Privacy Rule should
permit an authorization for uses and disclosures of protected health
information for future research purposes to the extent such purposes
are adequately described in the authorization such that it would be
reasonable for the individual to expect that his or her protected
health information could be used or disclosed for such future research;
(2) the Privacy Rule should permit an authorization for future research
only to the extent the description of the future research included
certain elements or statements specified by the Privacy Rule, and if
so, what should those be; and (3) the Privacy Rule should permit option
(1) as a general rule but require certain disclosure statements on the
authorization in cases where the future research may encompass certain
types of sensitive research activities, such as research involving
genetic analyses or mental health research, that may alter an
individual's willingness to participate in the research. We request
comment on each of these options, including their impact on the conduct
of research and patient understanding of authorizations.
We note that any modification in this area would not alter an
individual's right to revoke the authorization for the use or
disclosure of protected health information for future research at any
time and that the authorization would have to include a description of
how the individual may do so. We request comment on how a revocation
would operate with respect to future downstream research studies.
The Department does not propose any specific modifications to the
Privacy Rule at this time but requests public comment on the options
identified above, as well as any others, for purposes of addressing
this issue at the time the final rule is issued, if appropriate. In
addition, any change in interpretation will be closely coordinated with
the HHS Office for Human Research Protections (OHRP) and the FDA to
ensure the Privacy Rule policies are appropriately harmonized with
those under the HHS human subjects protections regulations (45 CFR part
46) and FDA human subjects protections regulations governing informed
consent for research (21 CFR part 50).
E. Protected Health Information About Decedents
1. Section 164.502(f)--Period of Protection for Decedent Information
Section 164.502(f) requires covered entities to protect the privacy
of a decedent's protected health information generally in the same
manner and to the same extent that is required for the protected health
information of living individuals. Thus, if an authorization is
required for the use or disclosure of protected health information, a
covered entity may use or disclose a decedent's protected health
information in that situation only if the covered entity obtains an
authorization from the decedent's personal representative. The personal
representative for a decedent is the executor, administrator, or other
person who has authority under applicable law to act on behalf of the
decedent or the decedent's estate. The Department has heard a number of
concerns since the publication of the Privacy Rule that it can be
difficult to locate a personal representative to authorize the use or
disclosure of the decedent's protected health information, particularly
after an estate is closed. Furthermore, archivists, biographers and
historians have expressed frustration regarding the lack of access to
ancient or old records of historical value held by covered entities,
even when there are likely few remaining individuals concerned with the
privacy of such information. Archives and libraries may hold medical
records that are centuries old. Furthermore, fragments of health
information may be found throughout all types of archival holdings,
such as correspondence files, diaries, and photograph collections, that
are also in some cases centuries old. Currently, to the extent such
information is maintained by a covered entity, it is subject to the
Privacy Rule. For example, currently the Privacy Rule would apply in
the same manner to the casebook of a 19th century physician as it would
to the medical records of current patients of a physician.
Accordingly, we propose to amend Sec. 164.502(f) to require a
covered entity to comply with the requirements of the Privacy Rule with
regard to the protected health information of a deceased individual for
a period of 50 years following the date of death. We also propose to
modify the definition of ``protected health information'' at Sec.
160.103 to make clear that the individually identifiable health
information of a person who has been deceased for more than 50 years is
not protected health information under the Privacy Rule. We believe
that fifty years is an appropriate time span, because by approximately
covering the span of two generations we believe it will both protect
the privacy interests of most, if not all, living relatives, or other
affected individuals, and it reflects the difficulty of obtaining
authorizations from personal representatives as time passes. A fifty-
year period of protection also was suggested at a prior National
Committee for Vital and Health Statistics (NCVHS) (the public advisory
committee which advises the Secretary on the implementation of the
Administrative Simplification provisions of HIPAA, among other issues)
meeting, at which committee members heard testimony from archivists
regarding the problems associated with applying the Privacy Rule to
very old records. See http://ncvhs.hhs.gov/050111mn.htm. We request
public comment on the appropriateness of this time period.
We note that these proposed modifications would have no impact on a
covered entity's permitted disclosures related to decedents for law
enforcement purposes (Sec. 164.512(f)(4)), to coroners or medical
examiners and funeral directors (Sec. 164.512(g)), for research that
is solely on the protected health information of decedents (Sec.
164.512(i)(1)(iii)), and for organ procurement organizations or other
entities engaged in the procurement, banking, or transplantation of
cadaveric organs, eyes, or tissue for the purpose of facilitating
organ, eye or tissue donation and transplantation (Sec. 164.512(h)).
[[Page 40895]]
These disclosures are governed by other provisions of the Privacy Rule.
2. Section 164.510(b)--Disclosures About a Decedent to Family Members
and Others Involved in Care
Section 164.510(b) describes how a covered entity may use or
disclose protected health information to persons, such as family
members or others, who are involved in an individual's care or payment
related to the individual's health care. We have received a number of
questions about the scope of the section, specifically with regard to
the protected health information of decedents. We have heard concerns
that family members, relatives, and others, many of whom may have had
access to the health information of the deceased individual prior to
death, have had difficulty obtaining access to such information after
the death of the individual, because many do not qualify as a
``personal representative'' under Sec. 164.502(g)(4).
As such, we propose to amend Sec. 164.510(b) to add a new
paragraph (5), which would permit covered entities to disclose a
decedent's information to family members and others who were involved
in the care or payment for care of the decedent prior to death, unless
doing so is inconsistent with any prior expressed preference of the
individual that is known to the covered entity. We propose to add
conforming cross-references to paragraphs (b)(1)(i) and (ii) and
(b)(4). We note that this disclosure would be permitted, but would not
be required. We request comment on any unintended consequences that
this permissive disclosure provision might cause.
We also note that these modifications do not change the authority
of a decedent's personal representative with regard to the decedent's
protected health information. Thus, a personal representative may
continue to request access to or an accounting of a decedent's
protected health information, and may continue to authorize uses and
disclosures of the decedent's protected health information that are not
otherwise permitted or required by the Privacy Rule.
F. Section 164.512(b)--Disclosure of Student Immunizations to Schools
The Privacy Rule, in Sec. 164.512(b), recognizes that covered
entities must balance protecting the privacy of health information with
sharing health information with those responsible for ensuring public
health and safety, and permits covered entities to disclose the minimum
necessary protected health information to public health authorities or
other designated persons or entities without an authorization for
public health purposes specified by the Rule. Covered entities may
disclose protected health information: (1) To a public health authority
that is legally authorized to collect or receive the information for
the purpose of preventing or controlling disease, injury, or disability
(such as reporting communicable diseases, births, and deaths, or
conducting public health interventions, investigations, and
surveillance); (2) to a public health authority or other appropriate
government authority to report child abuse if the authority is legally
authorized to receive such reports; (3) to a person or entity subject
to the jurisdiction of the FDA about the quality, safety, or
effectiveness of an FDA-regulated product or activity for which the
person or entity has responsibility (such as reporting adverse drug
events to the drug manufacturer); (4) to notify a person that (s)he is
at risk of contracting or spreading a disease or condition, as
authorized by law, to carry out a public health intervention or
investigation; and (5) to an employer under limited circumstances and
conditions when the employer needs the information to comply with
Occupational Safety and Health Administration (OSHA) or Mine Safety and
Health Administration (MSHA) requirements. Any other disclosures that
do not conform to these provisions, and that are not otherwise
permitted by the Rule, require the individual's prior written
authorization.
Schools play an important role in preventing the spread of
communicable diseases among students by ensuring that students entering
classes have been immunized. Most States have ``school entry laws''
which prohibit a child from attending school unless the school has
proof that the child has been appropriately immunized. Typically,
schools ensure compliance with those requirements by requesting the
immunization records from parents (rather than directly from a health
care provider), particularly because the Privacy Rule generally
requires written authorization by the child's parent before a covered
health care provider may disclose protected health information directly
to the school. Some States allow a child to enter school provisionally
for a period of 30 days while the school waits for the necessary
immunization information.
We have heard concerns that the Privacy Rule may make it more
difficult for parents to provide, and for schools to obtain, the
necessary immunization documentation for students, which may prevent
students' admittance to school. The NCVHS submitted these concerns to
the HHS Secretary and recommended that HHS regard disclosure of
immunization records to schools to be a public health disclosure. See
http://www.ncvhs.hhs.gov/040617l2.htm.
As such, we propose to amend Sec. 164.512(b)(1) by adding a new
paragraph that permits covered entities to disclose proof of
immunization to schools in States that have school entry or similar
laws. While written authorization that complies with Sec. 164.508
would no longer be required for disclosure of such information, the
covered entity would still be required to obtain agreement, which may
be oral, from a parent, guardian or other person acting in loco
parentis for the individual, or from the individual him- or herself, if
the individual is an adult or emancipated minor. Because the proposed
provision would permit a provider to accept a parent's oral agreement
to disclose immunization results to a school--as opposed to a written
agreement--there is a potential for a miscommunication and later
objection by the parent. We, therefore, request comment on whether the
Privacy Rule should require that a provider document any oral agreement
under this provision to help avoid such problems, or whether a
requirement for written documentation would be overly cumbersome, on
balance. We also request comment on whether the rule should mandate
that the disclosures go to a particular school official and if so, who
that should be.
In addition, the Privacy Rule does not currently define the term
``school'' and we understand that the types of schools subject to the
school entry laws may vary by State. For example, depending on the
State, such laws may apply to public and private elementary or primary
schools and secondary schools (kindergarten through 12th grade), as
well as daycare and preschool facilities, and post-secondary
institutions. Thus, we request comment on the scope of the term
``school'' for the purposes of this section and whether we should
include a specific definition of ``school'' within the regulation
itself. In addition, we request comment on the extent to which schools
that may not be subject to these school entry laws but that may also
require proof of immunization have experienced problems that would
warrant their being included in this category of public health
disclosures.
Finally, we note that once a student's immunization records are
obtained and maintained by an educational institution or agency to
which the Family Educational Rights and Privacy
[[Page 40896]]
Act (FERPA) applies, the records are protected by FERPA, rather than
the HIPAA Privacy Rule. See paragraphs (2)(i) and (2)(ii) of the
definition of ``protected health information'' at Sec. 160.103, which
exclude from coverage under the Privacy Rule student records protected
by FERPA. In addition, for more information on the intersection of
FERPA and HIPAA, readers are encouraged to consult the Joint HHS/ED
Guidance on the Application of FERPA and HIPAA to Student Health
Records, available at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hipaaferpajointguide.pdf.
G. Section 164.514(d)--Minimum Necessary
Section 164.502(b)(1) of the Privacy Rule requires covered entities
to limit uses and disclosures of, and requests for, protected health
information to ``the minimum necessary to accomplish the intended
purpose of the use, disclosure, or request.'' Section 164.502(b)(2)
outlines situations in which the minimum necessary rule does not apply.
With respect to uses of protected health information, Sec.
164.514(d)(2) requires covered entities to identify workforce members
who need access to protected health information, to identify the
categories and conditions of such access, and to make reasonable
efforts to limit access consistent with such policies. With respect to
disclosures of, and requests for, protected health information, Sec.
164.514(d)(3) and (4) require that covered entities adopt policies and
procedures addressing minimum necessary, including with regard to uses
and disclosures that occur routinely.
Section 13405(b)(1)(A) of the HITECH Act provides that a covered
entity shall be treated as being in compliance with the minimum
necessary requirements with respect to the use or disclosure of or the
request for protected health information ``only if the covered entity
limits such protected health information, to the extent practicable, to
the limited data set (as defined in section 164.514(e)(2) of such
title) or, if needed by such entity, to the minimum necessary.''
Section 13405(b)(1)(B) requires the Secretary to issue guidance on what
constitutes ``minimum necessary'' within 18 months after the date of
enactment. This guidance must take into account the guidance required
by section 13424(c), relating to the de-identification of protected
health information, as well as ``the information necessary to improve
patient outcomes and to detect, prevent, and manage chronic disease.''
Section 13405(b)(1)(C) provides that the provisions of paragraph (A) no
longer apply as of the effective date of the guidance issued under
paragraph (B).
Section 13405(b)(2) provides that, with respect to disclosures of
protected health information, the covered entity or business associate
making the disclosure shall determine what constitutes the minimum
necessary. Section 13405(b)(3) provides that section 13405(b)(1) does
not affect the application of the exceptions to the minimum necessary
requirement, while section 13405(b)(4) provides that nothing in
subsection (b) is to be construed as affecting the use or disclosure of
or request for de-identified health information.
Section 13405(b)(1)(A) requires that covered entities consider the
feasibility of utilizing the limited data set in complying with the
minimum necessary requirements of the Privacy Rule. However, that
provision also permits a covered entity to employ its traditional
minimum necessary policies and procedures if it decides that the
limited data set will not meet the needs of the particular use,
disclosure, or request in question. The requirement of this section,
moreover, is an interim one; under section 13405(b)(1)(C), issuance of
the guidance required by section 13405(b)(1)(B) effectively sunsets the
requirement of section 13405(b)(1)(A).
For purposes of the required guidance, we take this opportunity to
solicit public comment on what aspects of the minimum necessary
standard covered entities and business associates believe would be most
helpful to have the Department address in the guidance and the types of
questions entities may have about how to appropriately determine the
minimum necessary for purposes of complying with the Privacy Rule. We
propose to leave the current regulatory text unchanged in this
rulemaking as the issuance of the required guidance will obviate the
need to make any regulatory modifications in this area.
H. Section 164.514(f)--Fundraising
Section 164.514(f)(1) of the Privacy Rule permits a covered entity
to use, or disclose to a business associate or an institutionally
related foundation, the following protected health information for its
own fundraising purposes without an individual's authorization: (1)
Demographic information relating to an individual; and (2) the dates of
health care provided to an individual. Section 164.514(f)(2) of the
Privacy Rule requires a covered entity that plans to use or disclose
protected health information for fundraising under this paragraph to
inform individuals in its notice of privacy practices that it may
contact them to raise funds for the covered entity. In addition, Sec.
164.514(f)(2) requires that a covered entity include in any fundraising
materials it sends to an individual a description of how the individual
may opt out of receiving future fundraising communications and that a
covered entity must make reasonable efforts to ensure that individuals
who do opt out are not sent future fundraising communications.
Section 13406(b) of the HITECH Act, which became effective on
February 18, 2010, requires the Secretary to provide by rule that a
covered entity provide the recipient of any fundraising communication
with a clear and conspicuous opportunity to opt out of receiving any
further fundraising communications. Additionally, section 13406(b)
states that if an individual does opt out of receiving further
fundraising communications, the individual's choice to opt out must be
treated as a revocation of authorization under Sec. 164.508 of the
Privacy Rule.
We propose a number of changes to the Privacy Rule's fundraising
requirements to implement these statutory provisions. First, we propose
to strengthen the opt out by requiring that a covered entity provide,
with each fundraising communication sent to an individual under these
provisions, a clear and conspicuous opportunity for the individual to
elect not to receive further fundraising communications. To satisfy
this requirement, we also propose to require that the method for an
individual to elect not to receive further fundraising communications
may not cause the individual to incur an undue burden or more than
nominal cost. We encourage covered entities to consider the use of a
toll-free phone number, an e-mail address, or similar opt out mechanism
that would provide individuals with a simple, quick, and inexpensive
way to opt out of receiving future communications. We note that we
would consider requiring individuals to write and send a letter to the
covered entity asking not to receive future fundraising communications
to constitute an undue burden on the individual for purposes of this
proposed requirement.
We also propose to provide that a covered entity may not condition
treatment or payment on an individual's choice with respect to
receiving fundraising communications. We believe this modification
would implement the language in section 13406(b) of the HITECH Act that
provides that an election by an
[[Page 40897]]
individual not to receive further fundraising communications shall be
treated as a revocation of authorization under the Privacy Rule. The
legislative history of the HITECH Act indicates that it was Congress'
intent with this language that the protections that apply under Sec.
164.508 to an individual who has revoked an authorization similarly
apply to an individual who has opted out of fundraising communications,
``including the right not to be denied treatment as a result of making
that choice.'' See H.R. Conf. Rep. 111-16, p. 498. Therefore, we make
clear in this proposed rule that a covered entity would not be
permitted to condition treatment or payment for care on an individual's
choice of whether to receive fundraising communications.
Further, we propose to provide that a covered entity may not send
fundraising communications to an individual who has elected not to
receive such communications. This proposed language would strengthen
the current requirement at Sec. 164.514(f)(2)(iii) that a covered
entity make ``reasonable efforts'' to ensure that those individuals who
have opted out of receiving fundraising communications are not sent
such communications. We have proposed stronger language to make clear
the expectation that covered entities abide by an individual's decision
not to receive fundraising communications, as well as to make the
fundraising opt out operate more like a revocation of authorization,
consistent with the statutory language and legislative history of
section 13406(b) of the HITECH Act discussed above.
With respect to the operation of the opt out, we request comment
regarding to what fundraising communications the opt out should apply.
For example, if an individual receives a fundraising letter and opts
out of receiving future fundraising communications, should the opt out
apply to all future fundraising communications or should and can the
opt out be structured in a way to only apply to the particular
fundraising campaign described in the letter? In addition, given that
we would require the opt out method to be simple and quick for the
individual to exercise, such as the use of a phone number or e-mail
address, we request comment on whether the Rule should allow a similar
method, short of the individual signing an authorization, by which an
individual who has previously opted out can put his or her name back on
an institution's fundraising list.
We propose to retain the requirement that a covered entity that
intends to contact the individual to raise funds under these provisions
must include a statement to that effect in its notice of privacy
practices. However, we do propose to modify the required statement
slightly, as indicated below in the discussion of the notice
requirements at Sec. 164.520, by requiring that the notice also inform
individuals that they have a right to opt out of receiving such
communications. We also propose to move all of the fundraising
requirements described above to Sec. 164.514(f)(1), given that the
proposed provisions for subsidized treatment communications discussed
above now would be located at Sec. 164.514(f)(2).
In addition to the above modifications proposed in response to the
HITECH Act, we also solicit public comment on the requirement at Sec.
164.514(f)(1) which limits the information a covered entity may use or
disclose for fundraising demographic information about and dates of
health care service provided to an individual. Since the promulgation
of the Privacy Rule, certain covered entities have raised concerns
regarding this limitation, maintaining that the Privacy Rule's
prohibition on the use or disclosure of certain treatment information
without an authorization, such as the department of service where care
was received and outcomes information, harms their ability to raise
funds from often willing and grateful patients. In particular, covered
entities have argued that the restrictions in the Privacy Rule prevent
them from targeting their fundraising efforts and avoiding
inappropriate solicitations to individuals who may have had a bad
treatment outcome, and obtaining an individual's authorization for
fundraising as the individual enters or leaves the hospital for
treatment is often impracticable or inappropriate. NCVHS also held a
hearing and heard public testimony on this issue in July 2004. After
considering the testimony provided, the NCVHS recommended to the
Secretary that the Privacy Rule should allow covered entities to use or
disclose information related to the patient's department of service
(broad designations, such as surgery or oncology, but not narrower
designations or information relating to diagnosis or treating
physician) for fundraising activities without patient authorization.
NCVHS also recommended that a covered entity's notice of privacy
practices inform patients that their department of service information
may be used in fundraising, and that patients should be afforded the
opportunity to opt out of the use of their department of service
information for fundraising or all fundraising contacts altogether. See
http://www.ncvhs.hhs.gov/040902lt1.htm.
In light of these concerns and the prior recommendation of the
NCVHS, the Department takes this opportunity to solicit public comment
on whether and how the current restriction on what information may be
used and disclosed should be modified to allow covered entities to more
effectively target fundraising and avoid inappropriate solicitations to
individuals, as well as to reduce the need to send solicitations to all
patients. In particular, we solicit comment on: (1) Whether the Privacy
Rule should allow additional categories of protected health information
to be used or disclosed for fundraising, such as department of service
or similar information, and if so, what those categories should be; (2)
the adequacy of the minimum necessary standard to appropriately limit
the amount of protected health information that may be used or
disclosed for fundraising purposes; or (3) whether the current
limitation should remain unchanged. We also solicit comment on whether,
if additional information is permitted to be used or disclosed for
fundraising absent an authorization, covered entities should be
required to provide individuals with an opportunity to opt out of
receiving any fundraising communications before making the first
fundraising solicitation, in addition to the opportunity to opt out
with every subsequent communication. We invite public comment on
whether such a pre-solicitation opt out would be workable for covered
entities and individuals and what mechanisms could be put into place to
implement the requirement.
I. Section 164.520--Notice of Privacy Practices for Protected Health
Information
Section 164.520 of the Privacy Rule sets out the requirements for
most covered entities to have and to distribute a notice of privacy
practices (NPP). The NPP must describe the uses and disclosures of
protected health information a covered entity is permitted to make, the
covered entity's legal duties and privacy practices with respect to
protect protected health information, and the individual's rights
concerning protected health information.
With regard to the description of permitted uses and disclosures,
Sec. 164.520(b)(1)(ii) requires a covered entity to include separate
statements about the uses and disclosures that the covered entity
intends to make for certain treatment, payment, or health care
operations activities. Further, Sec. 164.520(b)(1)(ii)(E) currently
requires
[[Page 40898]]
that the NPP contain a statement that any uses and disclosures other
than those permitted by the Privacy Rule will be made only with the
written authorization of the individual, and that the individual has
the right to revoke an authorization pursuant to Sec. 164.508(b)(5).
The purpose of this statement is to put individuals on notice that
covered entities may make certain uses and disclosures only with an
authorization from the individual.
Section 164.520(b)(1)(iv) requires that the NPP contain statements
regarding the rights of individuals with respect to their protected
health information and a brief description of how individuals may
exercise such rights. Section 164.520(b)(1)(iv)(A) currently requires a
statement and a brief description addressing an individual's right to
request restrictions on the uses and disclosures of protected health
information pursuant to Sec. 164.522(a), including the fact that the
covered entity is not required to agree to this request.
We propose to amend Sec. 164.520(b)(1)(ii)(E) to require that the
NPP include a statement that describes the uses and disclosures of
protected health information that require an authorization under Sec.
164.508(a)(2) through (a)(4), and to provide that other uses and
disclosures not described in the notice will be made only with the
individual's authorization. The proposed provision would ensure that
covered entities provide notice to individuals indicating that most
disclosures of protected health information for which the covered
entity receives remuneration would require the authorization of the
individual. Such uses and disclosures may have previously been
permitted under other provisions of the Rule but now require
authorization, as discussed in connection with proposed Sec.
164.508(a)(4).
We propose to require, in addition, that covered entities provide
notice that most uses and disclosures of psychotherapy notes and for
marketing purposes require an authorization so that individuals will be
made aware of all situations in which authorization is required. We are
concerned that omission of such a specific statement may be somewhat
misleading or confusing, in that the NPP would state that the covered
entity may use or disclose protected health information without
authorization for purposes of treatment, payment, and health care
operations and some individuals might assume that psychotherapy notes
and marketing would be covered by these permissions.
Section 164.520(b)(1)(iii) requires a covered entity to include in
its NPP separate statements about certain activities if the covered
entity intends to engage in any of the activities. In particular, Sec.
164.520(b)(1)(iii) requires a separate statement in the notice if the
covered entity intends to contact the individual to provide appointment
reminders or information about treatment alternatives or other health-
related benefits or services; to contact the individual to fundraise
for the covered entity; or, with respect to a group health plan, to
disclose protected health information to the plan sponsor.
We propose the following changes to these provisions. First, we
propose to modify Sec. 164.520(b)(1)(iii)(A) to align the required
statement with the proposed modifications related to marketing and
subsidized treatment communications. A covered health care provider
that intends to send treatment communications to the individual in
accordance with proposed Sec. 164.514(f)(2) concerning treatment
alternatives or other health-related products or services where the
provider receives financial remuneration in exchange for making the
communication would be required to inform the individual in advance in
the NPP, as well as inform the individual that he or she has the
opportunity to opt out of receiving such communications. Second, at
Sec. 164.520(b)(1)(iii)(B) we propose to require that if a covered
entity intends to contact the individual to raise funds for the entity
as permitted under Sec. 164.514(f)(1), the covered entity must not
only inform the individual in the NPP of this intention but also that
the individual has the right to opt out of receiving such
communications.
We also propose to modify the requirement of Sec.
164.520(b)(1)(iv)(A) which requires covered entities to notify
individuals of the individuals' right to request restrictions. This
provision currently includes a requirement that the NPP state that the
covered entity is not required to agree to such a request. Since this
statement will no longer be accurate when the modifications to proposed
Sec. 164.522(a)(1)(vi) that are required by the HITECH Act are made
(see discussion in the following section), proposed Sec.
160.520(b)(1)(iv)(A) would require, in addition, that the statement
include an exception for requests under Sec. 164.522(a)(1)(vi).
Under subpart D of part 164, covered entities now have new
obligations to comply with the requirements for notification to
affected individuals, the media, and the Secretary following a breach
of unsecured protected health information. We request comment on
whether the Privacy Rule should require a specific statement regarding
this new legal duty and what particular aspects of this new duty would
be important for individuals to be notified of in the NPP.
The proposed modifications to Sec. 164.520 represent material
changes to the NPP of covered entities. Section 164.520(b)(3) requires
that when there is a material change to the NPP, covered entities must
promptly revise and distribute the NPP as outlined by Sec. 164.520(c).
Section 164.520(c)(1)(i)(C) requires that health plans provide notice
to individuals covered by the plan within 60 days of any material
revision to the NPP. We recognize that revising and redistributing a
NPP may be costly for health plans and request comment on ways to
inform individuals of this change to privacy practices without unduly
burdening health plans. In particular, we are considering a number of
options in this area: (1) Replace the 60-day requirement with a
requirement for health plans to revise their NPPs and redistribute them
(or at least notify members of the material change to the NPP and how
to obtain the revised NPP) in their next annual mailing to members
after a material revision to the NPP, such as at the beginning of the
plan year or during the open enrollment period; (2) provide a specified
delay or extension of the 60-day timeframe for health plans; (3) retain
the provision generally to require health plans to provide notice
within 60-days of a material revision but provide that the Secretary
will waive the 60-day timeframe in cases where the timing or substance
of modifications to the Privacy Rule call for such a waiver; or (4)
make no change, and thus, require that health plans provide notice to
individuals within 60 days of the material change to the NPP that would
be required by this proposed rule. We request comment on these options,
as well as on any other options for informing individuals in a timely
manner of this proposed or other material changes to the NPP.
Section 164.520(c)(2)(iv) requires that when a health care provider
with a direct treatment relationship with an individual revises the
NPP, the health care provider must make the NPP available upon request
on or after the effective date of the revision and must comply with the
requirements of Sec. 164.520(c)(2)(iii) to have the NPP available at
the delivery site and to post the notice in a clear and prominent
location. We do not believe these requirements will be overly
burdensome on health care providers and do not propose changes to them,
but we request comment on this issue.
[[Page 40899]]
J. Section 164.522(a)--Right To Request Restriction of Uses and
Disclosures
Section 164.522(a) of the Privacy Rule requires covered entities to
permit individuals to request that a covered entity restrict uses or
disclosures of their protected health information for treatment,
payment, and health care operations purposes, as well as for
disclosures to family members and certain others permitted under Sec.
164.510(b). While covered entities are not required to agree to such
requests for restrictions, if a covered entity does agree to restrict
the use or disclosure of an individual's protected health information,
the covered entity must abide by that restriction, except in emergency
circumstances when the information is required for the treatment of the
individual. Section 164.522 also includes provisions for the
termination of such a restriction and requires that covered entities
that have agreed to a restriction document the restriction in writing.
Section 13405(a) of the HITECH Act, which became effective February
18, 2010, requires that when an individual requests a restriction on
disclosure pursuant to Sec. 164.522, the covered entity agree to the
requested restriction unless otherwise required by law, if the request
for restriction is on disclosures of protected health information to a
health plan for the purpose of carrying out payment or health care
operations and if the restriction applies to protected health
information that pertains solely to a health care item or service for
which the health care provider involved has been paid out of pocket in
full. This statutory requirement overrides the provision in Sec.
164.522(a)(1)(ii) that the covered entity is not required to agree to
requests for restrictions and requires that we modify the regulation.
To implement section 13405(a), we propose to add a new Sec.
164.522(a)(1)(vi) to describe the elements of the required restriction.
We also propose to add conforming language to Sec. 164.522(a)(1)(ii)
to reflect the mandatory nature of the restriction as required by the
statute. Finally, we propose conforming modifications to Sec.
164.522(a)(2) and (3), which address terminating and documentation of
restrictions. We discuss these modifications in more detail below.
We propose to add a new paragraph (vi) to Sec. 164.522(a)(1),
which would require a covered entity, upon request from an individual,
to agree to a restriction on the disclosure of protected health
information to a health plan if: (A) the disclosure is for the purposes
of carrying out payment or healthcare operations and is not otherwise
required by law; and (B) the protected health information pertains
solely to a health care item or service for which the individual, or
person on behalf of the individual other than the health plan, has paid
the covered entity in full. We also propose to modify the language in
Sec. 164.522(a)(1)(ii), which states that a covered entity is not
required to agree to a restriction, to refer to this exception to that
general rule. We note that under the Privacy Rule, a covered entity may
make a disclosure to a business associate of another covered entity
only where the disclosure would be permitted directly to the other
covered entity. Thus, in cases where an individual has exercised his or
her right to have a restriction placed under this paragraph on a
disclosure to a health plan, the covered entity is also prohibited from
making such disclosure to a business associate of the health plan.
Section 13405(a) makes clear that an individual has a right to have
disclosures regarding certain health care items or services for which
the individual pays out of pocket in full restricted from a health
plan. We believe the Act provides the individual with the right to
determine for which health care items or services the individual wishes
to pay out of pocket and restrict. Thus, we do not believe a covered
entity could require individuals who wish to restrict disclosures about
only certain health care items or services to a health plan to restrict
disclosures of protected health information regarding all health care
to the health plan--i.e., to require an individual to have to pay out
of pocket for all services to take advantage of this right regardless
of the particular health care item or service about which the
individual requested the restriction. We believe such a policy would be
contrary to Congressional intent, in that it would discourage
individuals from requesting restrictions in situations where Congress
clearly intended they be able to do so. For example, an individual who
regularly visits the same provider for the treatment of both asthma and
diabetes must be able to request, and have the provider honor, a
restriction on the disclosure of diabetes-related treatment to the
health plan as long as the individual pays out of pocket for this care.
The provider cannot require that the individual apply the restriction
to all care given by the provider and, as a result, cannot require the
individual to pay out of pocket for both the diabetes and asthma-
related care in order to have the restriction on the diabetes care
honored. We encourage covered entities to work with individuals who
wish to restrict certain information from disclosure to health plans to
determine the best method for ensuring that the appropriate information
is restricted from disclosure to a health plan.
Due to the myriad of treatment interactions between covered
entities and individuals, we recognize that this provision may be more
difficult to implement in some circumstances than in others, and we
request comment on the types of interactions between individuals and
covered entities that would make requesting or implementing a
restriction more difficult. For example, an individual visits a
provider for treatment of a condition, and the individual requests the
provider not disclose information about the condition to the health
plan and pays out of pocket for the care. The provider prescribes a
medication to treat the condition, and the individual also wishes to
restrict the health plan from receiving information about the
medication. Many providers electronically send prescriptions to the
pharmacy to be filled so that the medication is ready when the
individual arrives to pick it up; however, at the point the individual
arrives at the pharmacy, the pharmacy would have already sent the
information to the health plan for payment, not permitting the
individual an opportunity to request a restriction at the pharmacy. A
provider who knows that an individual intends to request such a
restriction can always provide the individual with a paper prescription
to take to the pharmacy, allowing the individual an opportunity to
request that the pharmacy restrict the disclosure of information
relating to the medication. However, this might not be practical in
every case, especially as covered entities begin to replace paper-based
systems with electronic systems. We request comment on this issue, and
we ask specifically for suggestions of methods through which a
provider, using an automated electronic prescribing tool, could alert
the pharmacy that the individual may wish to request that a restriction
be placed on the disclosure of their information to the health plan and
that the individual intends to pay out of pocket for the prescription.
Additionally, we request comment on the obligation of covered
health care providers that know of a restriction to inform other health
care providers downstream of such restriction. For example, a provider
has been treating an individual for an infection for several
[[Page 40900]]
months pursuant to the individual's requested restriction that none of
the protected health information relating to the treatment of the
infection be disclosed to the individual's health plan. If the
individual requests that the provider send a copy of his medical
records to another health care provider for treatment, what, if any,
obligation should the original provider have to notify the recipient
provider (including a pharmacy filling the individual's prescription)
that the individual has placed a restriction upon much of the protected
health information in the medical record? We request comment on whether
a restriction placed upon certain protected health information should
apply to, and the feasibility of it continuing to attach to, such
information as it moves downstream, or if the restriction should no
longer apply until the individual visits the new provider for treatment
or services, requests a restriction, and pays out of pocket for the
treatment. In addition, we request comment on the extent to which
technical capabilities exist that would facilitate notification among
providers of restrictions on the disclosure of protected health
information, how widely these technologies are currently utilized, and
any limitations in the technology that would require additional manual
or other procedures to provide notification of restrictions.
In accordance with the HITECH Act, proposed Sec.
164.522(a)(1)(vi)(A) would permit a covered entity to disclose
protected health information to a health plan if such disclosure is
required by law, despite an individual's request for a restriction. We
note that the term ``required by law'' is defined at Sec. 164.103. We
request comment on examples of types of disclosures that may fall under
this provision.
With respect to the proposed requirement in Sec.
164.522(a)(1)(vi)(B) that the covered entity be paid in full for the
health care item or service for which the individual requests a
restriction, we have added some language to the statutory provision to
ensure that this requirement not be limited to solely the individual as
the person paying the covered entity for the individual's care. There
are many situations in which family members or other persons may pay
for the individual's treatment. Thus, this proposed paragraph would
provide that as long as the covered entity is paid for the services by
the individual or another person on behalf of the individual other than
the health plan, the covered entity would be required to abide by the
restriction.
With regard to proposed Sec. 164.522(a)(1)(vi)(B), we emphasize
that when an individual requests a restriction of information to a
health plan and pays out of pocket for the treatment or service, the
individual should not expect that this payment will count towards the
individual's out of pocket threshold with respect to his or her health
plan benefits. As the very nature of this provision is to restrict
information from flowing to the health plan, the health plan will be
unaware of any payment for treatment or services for which the
individual has requested a restriction, and thus, this out of pocket
payment cannot be used to reach the threshold for benefits a health
plan offers.
We request public comment on how this provision will function with
respect to HMOs. A provider who contracts with an HMO generally
receives a fixed payment from an HMO based on the number of patients
seen and not based on the treatment or service provided, and an
individual patient of that provider pays a flat co-payment for every
visit regardless of the treatment or service received. Therefore, it is
our understanding that under most current HMO contracts with providers
an individual could not pay the provider for the treatment or service
received. Thus, individuals who belong to an HMO may have to use an
out-of-network provider if they wish to ensure that certain protected
health information is not disclosed to the HMO. We request public
comment on this issue.
Finally, with respect to proposed Sec. 164.522(a)(1)(vi)(B), we
emphasize that if an individual's out of pocket payment for a health
care item or service to restrict disclosure of the information to a
health plan is not honored (for example, the individual's check
bounces), the covered entity may then submit the information to the
health plan for payment as the individual has not fulfilled the
requirements necessary to obtain a restriction. We do not believe that
the statutory intent was to permit individuals to avoid payment to
providers for the health care services they provide. Therefore, if an
individual does not pay in full for the treatment or services provided
to the individual, then the provider is under no obligation to restrict
the information and may disclose the protected health information to
the health plan to receive payment. However, we expect covered entities
to make some attempt to resolve the payment issue with the individual
prior to sending the protected health information to the health plan,
such as by notifying the individual that his or her payment did not go
through and to give the individual an opportunity to submit payment. We
request comment on the extent to which covered entities must make
reasonable efforts to secure payment from the individual prior to
submitting protected health information to the health plan for payment.
We propose to modify Sec. 164.522(a)(2) and (3) regarding
terminating restrictions and documentation of restrictions to reflect
the addition of these new requirements. First, we would modify the
language in Sec. 164.522(a)(2) to remove the term ``its agreement to''
to clarify that the termination provisions apply to all restrictions,
even those which are mandatory for the covered entity. Similarly, we
would modify the language in Sec. 164.522(a)(3) regarding
documentation to remove the words ``that agrees to a restriction'' to
make clear that the documentation requirements apply to all
restrictions, including those that would be required by proposed
paragraph (a)(1)(vi).
Additionally, we propose to modify Sec. 164.522(a)(2)(iii) to
conform to proposed paragraph (a)(1)(vi), requiring the mandatory
restrictions for certain disclosures to health plans. In particular, in
cases in which a covered entity is required to agree to a restriction
under this section, we propose to add a new paragraph (A) to paragraph
(a)(2)(iii) to clarify that a covered entity may not unilaterally
terminate such a restriction.
The proposed modifications would operate as follows with respect to
termination of a restriction under proposed paragraph (a)(1)(vi). For
example, an individual who has requested a restriction on the
disclosure of protected health information to a health plan about a
particular health care service visits the provider for follow-up
treatment, asks the provider to bill the health plan for the follow-up
visit, and does not request a restriction at the time, nor pays out of
pocket for the follow-up treatment. In such circumstances, there is no
restriction in effect with respect to the follow-up treatment. However,
the provider may need to submit information about the original
treatment to the health plan so that it can determine the medical
appropriateness or medical necessity of the follow-up care provided to
the individual. At this time, we would consider the lack of a
restriction with respect to the follow-up treatment to extend to any
protected health information necessary to effect payment for such
treatment, even if such information pertained to prior treatment that
was subject to a restriction. We encourage covered entities to have an
open dialogue with individuals to
[[Page 40901]]
ensure that they are aware that protected health information may be
disclosed to the health plan unless they request an additional
restriction and pay out of pocket for the follow-up care. We request
public comment on this issue.
K. Section 164.524--Access of Individuals to Protected Health
Information
Section 164.524 of the Privacy Rule currently establishes, with
limited exceptions, an enforceable means by which individuals have a
right to review or obtain copies of their protected health information,
to the extent such information is maintained in the designated record
set(s) of a covered entity. An individual's right of access exists
regardless of the format of the protected health information, and the
standards and implementation specifications that address individuals'
requests for access and timely action by the covered entity (i.e.,
provision of access, denial of access, and documentation) apply to an
electronic environment in a similar manner as they do to a paper-based
environment. See The HIPAA Privacy Rule's Right of Access and Health
Information Technology (providing guidance with respect to how Sec.
164.524 applies in an electronic environment and how health information
technology can facilitate providing individuals with this important
privacy right), available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/eaccess.pdf.
Section 13405(e) of the HITECH Act, which became effective February
18, 2010, strengthens the Privacy Rule's right of access with respect
to covered entities that use or maintain an electronic health record on
an individual. Section 13405(e) provides that when a covered entity
uses or maintains an electronic health record with respect to protected
health information of an individual, the individual shall have a right
to obtain from the covered entity a copy of such information in an
electronic format and the individual may direct the covered entity to
transmit such copy directly to the individual's designee, provided that
any such choice is clear, conspicuous, and specific. Section 13405(e)
also provides that any fee imposed by the covered entity for providing
such an electronic copy shall not be greater than the entity's labor
costs in responding to the request for the copy.
Section 13405(e) applies by its terms only to protected health
information in electronic health records. However, incorporating these
new provisions in such a limited manner in the Privacy Rule could
result in a complex set of disparate requirements for access to
protected health information in electronic health records systems
versus other types of electronic records systems. As such, the
Department proposes to use its authority under section 264(c) of HIPAA
to prescribe the rights individuals should have with respect to their
individually identifiable health information to strengthen the right of
access as provided under section 13405(e) of the HITECH Act more
uniformly to all protected health information maintained in one or more
designated record sets electronically, regardless of whether the
designated record set is an electronic health record. We discuss our
proposed amendments to each provision implicated by section 13405(e)
more specifically below.
Section 164.524(c)(2) of the Privacy Rule requires a covered entity
to provide the individual with access to the protected health
information in the form or format requested by the individual, if it is
readily producible in such form or format, or, if not, in a readable
hard copy form or such other form or format as agreed to by the covered
entity and the individual. Section 13405(e) of the HITECH Act expands
this requirement by explicitly requiring a covered entity that uses or
maintains an electronic health record with respect to protected health
information to provide the individual with a copy of such information
in an electronic format.
We propose to implement this statutory provision, in conjunction
with our broader authority under section 264(c) of HIPAA, by requiring,
in proposed Sec. 164.524(c)(2)(ii), that if the protected health
information requested is maintained electronically in one or more
designated record sets, the covered entity must provide the individual
with access to the electronic information in the electronic form and
format requested by the individual, if it is readily producible, or, if
not, in a readable electronic form and format as agreed to by the
covered entity and the individual. This provision would require any
covered entity that electronically maintains the protected health
information about an individual, in one or more designated record sets,
to provide the individual with an electronic copy of such information
(or summary or explanation if agreed to by the individual in accordance
with proposed Sec. 164.524(c)(2)(iii)) in the electronic form and
format requested or in an otherwise agreed upon form and format. While
an individual's right of access to an electronic copy of protected
health information is currently limited under the Privacy Rule by
whether the form or format requested is readily producible, covered
entities that maintain such information electronically in a designated
record set would be required under these proposed modifications to
provide some type of electronic copy, if requested by an individual.
Because we do not want to bind covered entities to standards that
may not yet be technologically mature, we propose to permit covered
entities to make some other agreement with individuals as to an
alternative means by which they may provide a readable electronic copy,
to the extent the requested means is not readily producible. If, for
example, a covered entity received a request to provide electronic
access via a secure Web-based portal, but the only readily producible
version of the protected health information was in portable document
format (PDF), proposed Sec. 164.524(c)(2)(ii) would require the
covered entity to provide the individual with a PDF copy of the
protected health information, if agreed to by the covered entity and
the individual. We note that while there may be circumstances where a
covered entity determines that it can comply with the Privacy Rule's
right of access by providing individuals with limited access rights to
their electronic health record, such as through a secure Web-based
portal, nothing under the current Rule or proposed modifications would
require a covered entity to do so where the covered entity determines
it is not reasonable or appropriate.
We note that the option of arriving at an alternative agreement
that satisfies both parties is already part of the requirement to
provide access under Sec. 164.524(c)(2)(i), so extension of such a
requirement to electronic access should present few implementation
difficulties. Further, as with other disclosures of protected health
information, in providing the individual with an electronic copy of
protected health information through a Web-based portal, e-mail, on
portable electronic media, or other means, covered entities should
ensure that reasonable safeguards are in place to protect the
information. We also note that the proposed modification presumes that
covered entities have the capability of providing an electronic copy of
protected health information maintained in their designated record
set(s) electronically through a secure Web-based portal, via e-mail, on
portable electronic media, or other manner. We invite public comment on
this presumption.
[[Page 40902]]
Section 164.524(c)(3) of the Privacy Rule currently requires the
covered entity to provide the access requested by the individual in a
timely manner, which includes arranging with the individual for a
convenient time and place to inspect or obtain a copy of the protected
health information, or mailing the copy of protected health information
at the individual's request. The Department has previously interpreted
this provision as requiring a covered entity to mail the copy of
protected health information to an alternative address requested by the
individual, provided the request was clearly made by the individual and
not a third party. Section 13405(e)(1) of the HITECH Act provides that
if the individual chooses, he or she shall have a right to direct the
covered entity to transmit an electronic copy of protected health
information in an electronic health record directly to an entity or
person designated by the individual, provided that such choice is
clear, conspicuous, and specific.
Based on section 13405(e)(1) of the HITECH Act and our authority
under section 264(c) of HIPAA, we propose to expand Sec. 164.524(c)(3)
to expressly provide that, if requested by an individual, a covered
entity must transmit the copy of protected health information directly
to another person designated by the individual. This proposed amendment
is consistent with the Department's prior interpretation on this issue
and would apply without regard to whether the protected health
information is in electronic or paper form. We propose to implement the
requirement of section 13405(e)(1) that the individual's ``choice [be]
clear, conspicuous, and specific'' by requiring that the individual's
request be ``in writing, signed by the individual, and clearly identify
the designated person and where to send the copy of protected health
information.'' We note that the Privacy Rule allows for electronic
documents to qualify as written documents for purposes of meeting the
Rule's requirements, as well as electronic signatures to satisfy any
requirements for a signature, to the extent the signature is valid
under applicable law. Thus, a covered entity could employ an electronic
process for receiving an individual's request to transmit a copy of
protected health information to his or her designee under this proposed
provision. Whether the process is electronic or paper-based, a covered
entity must implement reasonable policies and procedures under Sec.
164.514(h) to verify the identity of any person who requests protected
health information, as well as implement reasonable safeguards under
Sec. 164.530(c) to protect the information that is used or disclosed.
Section 164.524(c)(4) of the Privacy Rule currently permits a
covered entity to impose a reasonable, cost-based fee for a copy of
protected health information (or a summary or explanation of such
information). However, such a fee may only include the cost of: (1) The
supplies for, and labor of, copying the protected health information;
(2) the postage associated with mailing the protected health
information, if applicable; and (3) the preparation of an explanation
or summary of the protected health information, if agreed to by the
individual. With respect to providing a copy (or summary or
explanation) of protected health information from an electronic health
record in electronic form, however, section 13405(e)(2) of the HITECH
Act provides that a covered entity may not charge more than its labor
costs in responding to the request for the copy.
In response to section 13405(e)(2) of the HITECH Act, we propose to
amend Sec. 164.524(c)(4)(i) to identify separately the labor for
copying protected health information, whether in paper or electronic
form, as one factor that may be included in a reasonable cost-based
fee. While we do not propose more detailed considerations for this
factor within the regulatory text, we retain all prior interpretations
of labor with respect to paper copies--that is, that the labor cost of
copying may not include the costs associated with searching for and
retrieving the requested information. With respect to electronic
copies, we believe that a reasonable cost-based fee includes costs
attributable to the labor involved to review the access request and to
produce the electronic copy, which we expect would be negligible.
However, we would not consider a reasonable cost-based fee to include a
standard ``retrieval fee'' that does not reflect the actual labor costs
associated with the retrieval of the electronic information or that
reflects charges that are unrelated to the individual's request (e.g.,
the additional labor resulting from technical problems or a workforce
member's lack of adequate training). We invite public comment on this
aspect of our rulemaking, specifically with respect to what types of
activities related to managing electronic access requests should be
compensable aspects of labor.
We also propose to amend Sec. 164.524(c)(4)(ii) to provide
separately for the cost of supplies for creating the paper copy or
electronic media (i.e., physical media such as a compact disc (CD) or
universal serial bus (USB) flash drive), if the individual requests
that the electronic copy be provided on portable media. This
reorganization and the addition of the phrase ``electronic media''
reflects our understanding that since section 13405(e)(2) of the HITECH
Act permits only the inclusion of labor costs in the charge for
electronic copies, it by implication excludes charging for the supplies
that are used to create an electronic copy of the individual's
protected health information, such as the hardware (computers,
scanners, etc.) or software that is used to generate an electronic copy
of an individual's protected health information in response to an
access request. We note this limitation is in contrast to a covered
entity's ability to charge for supplies for hard copies of protected
health information (e.g., the cost of paper, the prorated cost of toner
and wear and tear on the printer). See 65 FR 82462, 82735, Dec. 28,
2000 (responding to a comment seeking clarification on ``capital cost
for copying'' and other supply costs by indicating that a covered
entity was free to recoup all of their reasonable costs for copying).
We believe this interpretation is consistent with the fact that, unlike
a hard copy, which generally exists on paper, an electronic copy exists
independent of media, and can be transmitted securely via multiple
methods (e.g., e-mail, a secure Web-based portal, or an individual's
own electronic media) without accruing any ancillary supply costs.
We also note, however, that our interpretation of the statute would
permit a covered entity to charge a reasonable and cost-based fee for
any electronic media it provided, as requested or agreed to by an
individual who does not provide their own. For example, a covered
entity can offer to make protected health information available on an
encrypted USB flash drive, and can charge a reasonable cost-based fee
for the flash drive. If, however, an individual has brought his or her
own electronic media (such as a recordable CD), requested that an
electronic copy be placed on it, and the covered entity's systems are
readily able to do so, then the covered entity would not be allowed to
require the individual to purchase an encrypted USB flash drive
instead. Likewise, if an individual requests that an electronic copy be
sent via unencrypted e-mail, the covered entity should advise the
individual of the risks associated with unencrypted e-mail, but the
covered entity would not be allowed to require the individual to
instead purchase a USB flash drive.
While we propose to renumber the remaining factors in Sec.
164.524(c)(4), we
[[Page 40903]]
do not propose to amend their substance. With respect to Sec.
164.524(c)(4)(iii), however, we note that our interpretation of the
statute would permit a covered entity to charge for postage if an
individual requests that the covered entity transmit portable media
containing an electronic copy through mail or courier (e.g., if the
individual requests that the covered entity save protected health
information to a CD and then mail the CD to a designee).
Finally, we are requesting comment on one aspect of the right to
access and obtain a copy of protected health information which the
HITECH Act did not amend. In particular, the HITECH Act did not change
the timeliness requirements for provision of access in Sec.
164.524(b). Under the current requirements, a request for access must
be approved or denied, and if approved, access or a copy of the
information provided, within 30 days of the request. In cases where the
records requested are only accessible from an off-site location, the
covered entity has an additional 30 days to respond to the request. In
extenuating circumstances where access cannot be provided within these
timeframes, the covered entity may have a one-time 30-day extension if
the individual is notified of the need for the extension within the
original timeframes.
With regard to the timeliness of the provision of access, we are
aware that with the advance of electronic health records, there is an
increasing expectation and capacity to provide individuals with almost
instantaneous electronic access to the protected health information in
those records through personal health records or similar electronic
means. On the other hand, we are not proposing to limit the right to
electronic access of protected health information to certified
electronic health records, and the variety of electronic systems that
are subject to this proposed requirement would not all be able to
comply with a timeliness standard based on personal health record
capabilities. It is our assumption that a single timeliness standard
that would address a variety of electronic systems, rather than having
a multitude of standards based on system capacity, would be the
preferred approach to avoid workability issues for covered entities.
Even under a single standard, nothing would prevent electronic health
record systems from being developed through the HITECH Act's standards
and certification process with the technological capabilities to exceed
the Privacy Rule's timeliness requirements for providing access to
individuals. Based on the assumption that a single standard would be
the preferred approach, we are interested in public comment on an
appropriate, common timeliness standard for the provision of access by
covered entities with electronic designated record sets generally. We
would appreciate comment on aspects of existing systems that would
create efficiencies in processing of requests for electronic
information, as well as those aspects of electronic systems that would
provide little change from the time required for processing a paper
record. Alternatively, we request comment on whether the current
standard could be altered for all systems, paper and electronic, such
that all requests for access should be responded to without
unreasonable delay and not later than 30 days.
We are also interested in public comment on whether, contrary to
our assumption, a variety of timeliness standards based on the type of
electronic designated record set is the preferred approach and if so,
how we should operationalize such an approach. For example, how should
we identify and characterize the various electronic designated record
sets to which the different standards would apply, such as personal
health records, electronic health records, and others? What
functionality within these electronic systems would drive the need for
more or less time to provide an individual with electronic access? What
timeliness standards would be appropriate for the different systems?
What timeliness standard(s) would be required of entities with
protected health information spread across hybrid systems that have
different functionalities? What would be the impact of and challenges
to having multiple timeliness standards for access?
Finally, we request comment on the time necessary for covered
entities to review access requests and make necessary determinations,
such as whether the granting of access would endanger the individual or
other persons so as to better understand how the time needed for these
reviews relates to the overall time needed to provide the individual
with access. Further, we request comment generally on whether the
provision which allows a covered entity an additional 30 days to
provide access to the individual if the protected health information is
maintained off-site should be eliminated altogether for both paper and
electronic records, or at least for protected health information
maintained or archived electronically because the physical location of
electronic data storage is not relevant to its accessibility.
L. Other Technical and Conforming Changes
We propose to make a number of technical and conforming changes to
the Privacy Rule to fix minor problems such as incorrect cross-
references, mistakes of grammar, and typographical errors. Technical
and conforming changes of this nature are described and explained in
the table below.
----------------------------------------------------------------------------------------------------------------
Regulation Sec. Current language Proposed change Reason for change
----------------------------------------------------------------------------------------------------------------
164.510(b)(2)(iii)................ ``based the Insert ``on'' Correct typographical error.
exercise of after ``based''.
professional
judgment''.
164.512(b)(1)..................... ``Permitted Insert ``uses Correct inadvertent omission.
disclosures'' and'' and ``use
and ``may or'' before
disclose''. ``disclosures''
and
``disclose,''
respectively.
164.512(e)(1)(iii)................ ``seeking Change Correct typographical error.
protecting ``protecting''
health to
information''. ``protected''.
164.512(e)(1)(vi)................. ``paragraph Change Correct cross-reference.
(e)(1)(iv) of ``(e)(1)(iv)''
this section''. to
``(e)(1)(v)''.
164.512(k)(3)..................... ``authorized by Remove the comma Correct typographical errors.
18 U.S.C. 3056, after ``U.S.C.
or to foreign 3056'' and the
heads of state ``to'' before
. . ., or to ``for''.
for the conduct
of
investigations'
'.
----------------------------------------------------------------------------------------------------------------
In addition to the technical changes listed in the table above, we
propose to make a few changes that are technical or conforming in
nature, but for which the reason for the change is more programmatic in
nature. These are as follows:
[[Page 40904]]
Section 164.506(c)(5) permits a covered entity to disclose
protected health information ``to another covered entity that
participates in the organized health care arrangement.'' We propose to
change the words ``another covered entity that participates'' to
``other participants'' because not all participants in an organized
health care arrangement may be covered entities; for example, some
physicians with staff privileges at a hospital may not be covered
entities.
Section 164.510(a)(1)(ii) permits the disclosure of directory
information to members of the clergy and other persons who ask for the
individual by name. We propose to add the words ``use or'' to this
permission, to cover the provision of such information to clergy who
are part of a facility's workforce.
Section 164.510(b)(3) covers uses and disclosures of protected
health information when the individual is not present to agree or
object to the use or disclosure, and, as pertinent here, permits
disclosure to persons only of ``the protected health information that
is directly relevant to the person's involvement with the individual's
health care.'' We propose to delete the last two quoted words and
substitute therefore the following: ``care or payment related to the
individual's health care or needed for notification purposes.'' This
change would align the text of paragraph (b)(3) with the permissions
provided for at paragraph (b)(1) of this section.
Where an employer needs protected health information to comply with
workplace medical surveillance laws, such as OSHA or MSHA, Sec.
164.512(b)(1)(v)(A) permits a covered entity to disclose, subject to
certain conditions, protected health information of an individual to
the individual's employer if the covered entity is a covered health
care provider ``who is a member of the workforce of such employer or
who provides health care to the individual at the request of the
employer.'' We propose to amend the quoted language by removing the
words ``who is a member of the workforce of such employer or'', as the
language is unnecessary.
In Sec. 164.512(k)(1)(ii), we propose to replace the word
``Transportation'' with ``Homeland Security.'' The language regarding a
component of the Department of Transportation was included to refer to
the Coast Guard; however, the Coast Guard was transferred to the
Department of Homeland Security in 2003. In addition, at Sec.
164.512(k)(5)(i)(E), we propose to replace the word ``and'' after the
semi-colon with the word ``or.'' The intent of Sec. 164.512(k)(5)(i)
is not that the existence of all of the conditions is necessary to
permit the disclosure, but rather that the existence of any would
permit the disclosure.
VII. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact statement in compliance with
Executive Order 12866 (September 1993, Regulatory Planning and Review),
the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-
354), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), and
Executive Order 13132 on Federalism.
1. Executive Order 12866
Executive Order 12866 directs agencies to assess all costs and
benefits of available regulatory alternatives and, if regulation is
necessary, to select regulatory approaches that maximize net benefits
(including potential economic, environmental, public health and safety
effects, distributive impacts, and equity). A regulatory impact
analysis must be prepared for major rules that have economically
significant effects ($100 million or more in any one year) or adversely
affect in a material way the economy, a sector of the economy,
productivity, competition, jobs, the environment, public health or
safety, or State, local, or Tribal government or communities (58 FR
51741).
We estimate that the effects of the requirement for covered
entities (including indirect costs incurred by third party
administrators, which frequently send out notices on behalf of health
plans) to issue new notices of privacy practices, will result in new
costs of $166.1 million within 12 months of the effective date of the
final rule. We estimate that the private sector will bear approximately
71 percent of the costs, with State and Federal plans bearing the
remaining 29 percent of the costs. As a result of the economic impact,
and other costs that are expected but not quantified in the regulatory
analysis below, we determined that this proposed rule is an
economically significant regulatory action within the meaning of
section 3(f)(4) of Executive Order 12866. We present our analysis of
the costs of the proposed rule in section C below.
2. Regulatory Flexibility Act
The RFA requires agencies to analyze options for regulatory relief
of small businesses if a rule has a significant impact on a substantial
number of small entities. We present our regulatory flexibility
analysis of this proposed rule in section E below.
The Act generally defines a ``small entity'' as (1) a proprietary
firm meeting the size standards of the Small Business Administration
(SBA), (2) a nonprofit organization that is not dominant in its field,
or (3) a small government jurisdiction with a population of less than
50,000. Because 90 percent or more of all health care providers meet
the SBA size standard for a small business or are nonprofit
organizations, we generally treat all health care providers as small
entities for purposes of performing a regulatory flexibility analysis.
The SBA size standard for health care providers ranges between $7.0
million and $34.5 million in annual receipts.
With respect to health insurers and third party administrators, the
SBA size standard is $7.0 million in annual receipts. While some
insurers are classified as nonprofit, it is possible they are dominant
in their market. For example, a number of Blue Cross/Blue Shield
insurers are organized as nonprofit entities; yet they dominate the
health insurance market in the States where they are licensed. In
addition, we lack the detailed information on annual receipts for
insurers and plan administrators and, therefore, we do not know how
many firms qualify as small entities. We welcome comments on the number
of small entities in the health insurer and health plan administrator
market.
3. Unfunded Mandates Reform Act
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipated costs and benefits before
issuing any rule whose mandates would require spending in any one year
$100 million in 1995 dollars, updated annually for inflation. In 2010,
that threshold is approximately $135 million. UMRA does not address the
total cost of a rule. Rather, it focuses on certain categories of cost,
mainly those ``Federal mandate'' costs resulting from: (1) Imposing
enforceable duties on State, local, or Tribal governments, or on the
private sector; or (2) increasing the stringency of conditions in, or
decreasing the funding of, State, local, or Tribal governments under
entitlement programs.
We are able to identify approximately $166.1 million in costs on
both the private sector and State and Federal health plans. There may
be other costs we are not able to monetize because we lack data, and
the proposed rule may produce savings that may offset some or all of
the added costs. For this purpose, we must also separately identify
costs to
[[Page 40905]]
be incurred by the private sector and those incurred by State and
Federal entities.
As noted above, of the costs we can identify, we estimate that
approximately 71 percent or $118.1 million of new costs will fall on
the private sector. For the purpose of this calculation, we included
all $46 million in provider costs as private sector costs. While we
recognize that some providers are State or Federal entities, we do not
have adequate information to estimate the number of public providers,
but we believe the number to be significantly less than 10% of all
providers shown in Table 1. Therefore, as we did for the RFA analysis
and for ease of calculation, we assumed that all provider costs are
private sector costs. We welcome comment on this assumption and any
information regarding the number of the public sector providers for
future analysis. With regard to identifying the costs to private sector
health plans, based on the data discussed in section C below, we
estimate that 60 percent of policy holders are served by private sector
health plans and, therefore, have allocated 60 percent of the costs to
be incurred by all health plans as private sector costs, or $72.1
million.
Similarly, we estimate that approximately 29 percent or $48 million
of the new costs will fall on State and Federal plans. As noted above,
based on the data discussed in section C below, we estimate that 40
percent of policy holders are served by public sector plans and,
therefore, have allocated 40 percent of the costs for all health plans
as public sector costs, or $48 million. Because the amount of unfunded
mandates incurred separately by either the private sector or by State,
local, and Tribal governments will not exceed the unfunded mandates
threshold of $133 million, we are not required to perform a cost-
benefit analysis under the UMRA. Nonetheless, we have prepared a cost-
benefit analysis of the proposed rule in sections C and D, below, as
required by Executive Order 12866 for an economically significant
regulation. We welcome public comment on the analysis as it bears upon
our assumptions and calculations under the UMRA.
4. Federalism
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a proposed rule (and subsequent
final rule) that imposes substantial direct requirement costs on State
and local governments, preempts State law, or otherwise has Federalism
implications.
The Federalism implications of the Privacy and Security Rules were
assessed as required by Executive Order 13132 and published as part of
the preambles to the final rules on December 28, 2000 (65 FR 82462,
82797) and February 20, 2003 (68 FR 8334, 8373), respectively.
Regarding preemption, the preamble to the final Privacy Rule explains
that the HIPAA statute dictates the relationship between State law and
Privacy Rule requirements, and the Rule's preemption provisions do not
raise Federalism issues. The HITECH Act, at section 13421(a), provides
that the HIPAA preemption provisions shall apply to the HITECH
provisions and requirements. While we have made minor technical changes
to the preemption provisions in Subpart B of Part 160 to conform to and
incorporate the HITECH Act preemption provisions, these changes do not
raise new Federalism issues. The proposed changes include: (1) Amending
the definitions of ``contrary'' and ``more stringent'' to reference
business associates; and (2) further amending the definition of
contrary to provide that State law would be contrary to the HIPAA
Administrative Simplification provisions if it stands as an obstacle to
the accomplishment and execution of the full purposes and objectives of
not only HIPAA, but also the HITECH Act.
We do not believe that this rule will impose substantial direct
compliance costs on State and local governments that are not required
by statute. It is our understanding that State and local government
covered entities do not engage in marketing, the sale of protected
health information, or fundraising. Therefore, the proposed
modifications in these areas would not cause additional costs to State
and local governments. We anticipate that the most significant direct
costs on State and local governments will be the cost for State and
local government-owned covered entities of drafting, printing, and
distributing revised notices of privacy practices, which would include
the cost of mailing these notices for State health plans, such as
Medicaid. However, the costs involved can be attributed to the
statutory requirements.
In considering the principles in and requirements of Executive
Order 13132, the Department has determined that these proposed
modifications to the Privacy and Security Rules will not significantly
affect the rights, roles, and responsibilities of the States.
B. Why is This Rule Needed?
The proposed rule is needed to implement several provisions of the
HITECH Act that require us to amend our regulations at 45 CFR Parts 160
and 164. These amendments primarily strengthen the privacy and security
protections for protected health information, as well as broaden the
privacy rights of individuals.
C. Costs
1. Notifying Individuals of Their New Privacy Rights
Covered entities must provide individuals with NPPs that detail how
the covered entity may use and disclose protected health information
and individuals' rights with respect to their own health information.
Due to the proposed modifications pursuant to the HITECH Act, covered
entities must modify their NPPs and distribute them to affected
individuals to advise them of the following strengthened privacy
protections: (1) The addition of the sale of protected health
information as a use or disclosure that requires the express written
authorization of the individual; (2) a separate statement that provides
advance notice to the individual if the healthcare provider receives
financial remuneration from a third party to send treatment
communications to the individual about that party's products or
services, and the right of the individual to elect not to receive such
communications; and (3) the right of the individual to restrict
disclosures of protected health information to a health plan with
respect to treatment services for which the individual has paid out of
pocket in full.
For providers, the cost of developing a new NPP consists of
drafting and printing the notice. The costs of distribution are minimal
because providers will hand out the NPPs when patients come for their
appointments. We estimate that drafting the updated NPPs will require
approximately one-third of an hour of professional, legal time at
approximately $90 per hour--or $30--that includes hourly wages of $60
plus 50 percent \5\. The total cost for attorneys for the approximately
697,000 \6\ health care providers in the
[[Page 40906]]
U.S. is, therefore, expected to be approximately $21 million. Printing
the NPPs will require paper and clerical time at a cost of $0.10 per
notice. We estimate that within 12 months from the effective date of
the final rule, providers will print approximately 250 million NPPs to
hand to patients who visit their offices. Printing costs for 250
million NPPs will be $25 million. The total cost for providers is
approximately $46 million.
---------------------------------------------------------------------------
\5\ http://www.bls.gov/oes/2008/may/oes231011.htm for lawyers.
\6\ We identified 701,325 entities that must prepare and deliver
NPPs that are shown in Table 1 below. This includes 696,758 HIPAA
covered entities that are health care providers, including
hospitals, nursing facilities, doctor offices, outpatient care
centers, medical diagnostic, imaging service, home health service
and other ambulatory care service covered entities, medical
equipment suppliers, and pharmacies. For the purposes of our
calculation, we have rounded this number to 697,000. Table 1 also
includes 4,567 health insurance carriers and third party
administrators working on behalf of covered health plans. The cost
estimates for these entities are addressed later.
---------------------------------------------------------------------------
For health plans, the cost of developing a new NPP consists of
drafting, printing and mailing the notice. With the exception of a few
large health plans, most health plans do not self-administer their
plans. The majority of plans are either health insurance issuers
(approximately 1,000) or utilize third party administrators that act on
their behalf in the capacity as business associates. We identified
approximately 3,500 third party administrators acting as business
associates for approximately 446,400 ERISA plans identified by the
Department of Labor. In addition, the Department of Labor identified
20,300 public non-Federal health plans that may use third party
administrators. Almost all of the public and ERISA plans, we believe,
employ third party administrators to administer their health plans.
While the third party administrators will bear the direct costs of
issuing the revised NPPs, the costs will generally be passed on to the
plans that contract with them. Those plans that self-administer their
own plans will also incur the costs of issuing the revised NPPs. We do
not know how many plans administer as well as sponsor health plans and
invite comments on the number of self-administered plans; however,
unless there were many such plans it would not have much effect on
these estimates.
For the approximately 4,500 health insurance issuers and health
plan administrators, the cost of composing and printing the NPPs will
be a similar amount per NPP to the amount calculated for providers.
However, health insurers and plan administrators will have to mail the
NPPs to policy holders. The costs for the mailing will consist of
postage and clerical time. The cost, therefore, depends on the estimate
of the number of policy holders who must receive NPPs. We did not
assume that health plans would communicate with policy holders by e-
mail because we have no data that indicate the extent to which
insurance plans and third party administrators communicate currently
with their policy holders through e-mail. We request public comment on
this assumption.
Because the Privacy Rule requires that only the named insured or
policy holder be notified of changes to the health plans' privacy
practices even if that policy also covers dependents, we expect that
only policy holders will receive the revised NPPs mandated by this
rule. For public programs such as Medicare, where each individual is a
policy holder, Medicare has a policy of mailing one notice or a set of
program materials to a household of four or fewer beneficiaries at the
same address. Although there are 45.6 million individual Medicare
beneficiaries, the program only sends out 38.8 million pieces of mail
per mailing.
Actuarial Research Corporation (ARC), our consultant, estimated the
number of policy holders for all classes of insurance products to be
approximately 183.6 million, including all public programs. The data
comes from the Medical Expenditure Panel Survey from 2004-2006
projected to 2010. ARC estimated 112.6 million private sector policy
holders and 71.0 million public ``policy holders.'' The total,
including more recent Medicare data, is 188.3 million persons (which
results in roughly a split of 60 percent private policy holders and 40
percent public ``policy holders''), whom we expect to receive NPPs from
their plans. The estimates do not capture policy holders who are in
hospitals or nursing homes at the time of the survey, or individuals
who may have been insured under more than one plan in a year, for
example, because their job status changed, they have supplemental
policies, or they have more than one employer, creating duplicate
coverage. Therefore, ARC recommended we use 200 million for the number
of NPPs that will actually be sent.
The costs of drafting, printing, and distributing the NPP are
estimated to be the following. First, drafting the NPP is estimated to
require one-third hour of legal services at a cost of $30 x 4,500
insurance plans and insurance administrative entities, which equals
$135,000. Second, the cost of printing the NPP, which includes the cost
of paper and actual printing, is estimated to be $0.10 per notice x 200
million notices, which equals $20 million. Third, the cost of
distributing the NPPs would involve clerical time to prepare the
mailings and the cost of postage, which we estimate to be a unit cost
of $0.50 per NPP for postage and handling using the rate of $0.44 per
stamp and $0.06 for labor (the same rates we used in the Breach
Notification for Unsecured Protected Health Information Regulations
published in the Federal Register at 74 FR 42763), results in an
estimated $100 million cost for distribution. The total cost for all
plans for drafting, printing, and distributing the NPP therefore, is
approximately $120.1 million. We note that this total may be an
overestimation of the costs because many insurers may use bulk mailing
rates to distribute their NPPs which would reduce their mailing costs.
The total estimated cost for both providers and health plans to
notify individuals and policy holders of changes in their privacy
rights is approximately $166.1 million in the first year following
implementation of the rule. Annualized over 10 years at three percent
and seven percent, the cost equals $194,720 and $236,489, respectively.
Table 1 below shows the number of covered entities by class of
provider and insurer that would be required to issue NPPs under the
proposed rule.
Table 1--Number of Entities by NAICS CODE\1\ Expected To Prepare and
Distribute Revised NPPs
------------------------------------------------------------------------
NAICS Providers/Suppliers Entities
------------------------------------------------------------------------
622................. Hospitals (General Medical and 4,060
Surgical, Psychiatric, Substance
Abuse, Other Specialty).
623................. Nursing Facilities (Nursing Care 34,400
Facilities, Residential Mental
Retardation Facilities, Residential
Mental Health and Substance Abuse
Facilities, Community Care
Facilities for the Elderly,
Continuing Care Retirement
Communities).
6211-6213........... Office of MDs, DOs, Mental Health 419,286
Practitioners, Dentists, PT, OT, ST,
Audiologists.
6214................ Outpatient Care Centers (Family 13,962
Planning Centers, Outpatient Mental
Health and Drug Abuse Centers, Other
Outpatient Health Centers, HMO
Medical Centers, Kidney Dialysis
Centers, Freestanding Ambulatory
Surgical and Emergency Centers, All
Other Outpatient Care Centers).
6215................ Medical Diagnostic, and Imaging 7,879
Service Covered Entities.
6216................ Home Health Service Covered Entities. 15,329
6219................ Other Ambulatory Care Service Covered 5,879
Entities (Ambulance and Other).
n/a................. Durable Medical Equipment 107,567
Suppliers\2\.
[[Page 40907]]
4611................ Pharmacies\3\........................ 88,396
524114.............. Health Insurance Carriers............ 1,045
524292.............. Third Party Administrators Working on 3,522
Behalf of Covered Health Plans.
Total Entities....................... 701,325
------------------------------------------------------------------------
\1\ Office of Advocacy, SBA, http://www.sba.gov/advo/research/data.html.
\2\ Centers for Medicare & Medicaid Services covered entities.
\3\ The Chain Pharmacy Industry http://www.nacds.org/wmspage.cfm?parm1=507.
2. Authorization and Other Requirements for Disclosures Related to
Marketing and Sale of Protected Health Information
The proposed rule would make modifications to the definition of
``marketing,'' such that some communications to individuals about
health-related products or services that are made under health care
operations would now be considered marketing communications if the
covered entity receives financial remuneration by a third party to make
the communication. For marketing communications, individual
authorization is required. In addition, the proposal would require that
a health care provider that receives financial remuneration by a third
party in exchange for sending a treatment communication to an
individual about the third party's product or service must disclose the
fact of remuneration in the communication and provide the individual
with a clear and conspicuous opportunity to opt out of receiving future
subsidized communications. Although this proposed rule would modify the
current definition of ``marketing,'' because we do not have information
on the extent to which covered entities currently receive financial
remuneration from third parties in exchange for sending information to
individuals about the third parties' health-related products or
services, we do not know how these modifications would change how
covered entities operate. We invite public comment on this issue.
In addition, the proposed rule would require an individual
authorization before a covered entity could disclose protected health
information in exchange for remuneration (i.e., ``sell'' protected
health information). The proposal includes several exceptions to this
authorization requirement. On its face, this proposed modification
would appear to increase the burden to covered entities by requiring
them to obtain authorizations in situations in which no authorization
is currently required. However, we believe such a scenario is unlikely
to occur. Even if covered entities attempted to obtain authorizations
in compliance with the proposed modifications, we believe most
individuals would not authorize these types of disclosures. It would
not be worthwhile for covered entities to continue to attempt to obtain
such authorizations, and as a result, we believe covered entities would
simply discontinue making such disclosures. Therefore, we believe this
proposed modification would have little to no impact on covered
entities. We request comment on this issue.
The proposed provision requiring individual authorization prior to
the sale of protected health information contains several exceptions in
which protected health information could be disclosed in exchange for
remuneration without first obtaining individual authorization. Most of
the excepted disclosures would not impose additional requirements and,
therefore, would not impose any additional burden on covered entities
to implement. However, the exception for research disclosures may
impose an additional burden on researchers. The exception applies to
disclosure of protected health information for research as long as the
remuneration received does not exceed the cost to produce and transmit
the information. Researchers who purchase data from covered entities
may now incur additional costs as a result of the proposed rule, in
order to obtain newly required authorizations, if they are currently
paying a covered entity more than the cost to produce and transmit the
protected health information (unless the covered entity is willing to
reduce its charges for the data). The proposed change would classify
such transactions as a sale, and as such would require an individual's
authorization prior to the covered entity's disclosure. This
authorization requirement also may have additional effects on research,
such that the need for authorization may skew the sample, or if the
researcher does not have the resources to obtain the authorizations
from the research subjects, the research may be jeopardized. Since we
have no information on the amounts currently paid to covered entities
by researchers for protected health information, we have no way to
estimate the impact of the provision. We welcome any comments and
information on the impact of these provisions.
3. Authorization for Compound Disclosures
The proposed rule would permit compound authorizations for research
purposes as long as it is clear to individuals that they do not have to
agree to both the conditioned and unconditioned components of an
authorization in order to receive research-related treatment. We
believe that the proposed provision would reduce burden on the research
community by eliminating the need for multiple forms for research
studies involving both a clinical trial and a related research
repository or study. However we have no data which would permit us to
estimate the amount of burden reduction associated with this proposal.
We welcome public comment on this issue.
4. Uses and Disclosures of Decedents' Protected Health Information
The proposed rule would modify the current rule to limit the period
for which a covered entity must protect an individual's health
information to 50 years after the individual's death. We believe this
will reduce the burden on both covered entities and on those seeking
the protected health information of persons who have been deceased for
many years by eliminating the need to search for and find a personal
representative of the decedent, who in many cases may not be known or
even exist after so many years, to authorize the disclosure. We believe
this change would benefit family members and historians who may seek
access to the medical information of these decedents for personal and
public interest reasons. However, we lack any data to be able to
estimate the benefits or costs of this
[[Page 40908]]
provision. We welcome comments on this proposed change.
5. Uses and Disclosures for Care and Notification Purposes
The proposed rule would permit covered entities to disclose a
decedent's protected health information to family members, or other
persons involved in the individual's care or payment for care before
the individual's death, unless doing so would be inconsistent with any
prior expressed preference of the individual that is known to the
covered entity. The rights of the decedent's personal representative to
have access to the protected health information of the decedent would
remain unchanged. We believe the proposed change would reduce burden by
permitting covered entities to continue to disclose protected health
information to family members and other persons who were involved in an
individual's care while the individual was alive after the death of the
individual without needing to obtain authorization from the decedent's
personal representative, who may not be known or even exist. However,
we have no data to permit us to estimate the reduction in burden and we
welcome comment on this change.
6. Public Health Disclosures
The proposed rule would create a new public health provision to
permit disclosure of proof of a child's immunization by a covered
entity to a school in States that have school entry or similar laws.
This proposed change would allow a covered health care provider to
release proof of immunization to a school without having to obtain a
written authorization, provided the provider obtained the agreement
(oral or otherwise) to the disclosure from either the parent or
guardian, or the individual, if the individual is an adult or
emancipated minor. We expect the proposed change to the regulations may
reduce the burden on covered entities and parents in obtaining and
providing written authorizations but it is unclear by how much. Since
the proposed rule would require the covered entity and the responsible
party for the student to agree that the covered entity may release
proof of immunization, some covered entities may request the agreement
in writing. In these cases, there may be little change from the current
authorization requirement in terms of the burden. Because we lack data
on the burden reduction, we cannot provide an estimate of the possible
savings. We welcome comment on the proposed change.
7. Fundraising Requirements
The proposed rule would require that any fundraising communication
sent to an individual must provide the recipient with a clear and
conspicuous opportunity to opt out of receiving any further fundraising
communications. If an individual elects to opt out, the fundraising
entity must not send that individual additional fundraising
communications. We believe that the strengthened language from the
HITECH Act that requires fundraisers to clearly and conspicuously
provide the recipient an opt-out choice from receiving future
communication and to treat such a choice as a revocation of
authorization will result in fewer unwanted fundraising communications.
However, we lack the data to estimate the effects of this change. We
request comment on the extent to which the requirement that the
opportunity to elect not to receive further fundraising communications
be clear and conspicuous would have an impact on covered entities and
their current fundraising materials.
8. Individuals' Access to Protected Health Information
Under the proposed regulations, if a covered entity maintains
protected health information electronically and the recipient requests
copies of his or her protected health information in an electronic
format, the covered entity or business associate must provide the
information in the electronic format requested by the individual if
readily producible in that format, or, if not, in a different
electronic format agreed to by the covered entity and the individual.
If the covered entity provides an individual with electronic access to
protected health information, the proposed rule would only allow the
covered entity to charge the costs of labor associated with the
preparation of the request. The proposed rule clarifies the labor and
supply costs applicable to preparation of electronic requests vs. paper
requests. Labor costs to produce an electronic copy involve the cost of
reviewing and preparing the copy. Supplies for an electronic copy apply
only to the cost of the media, if applicable, for providing the
information to the individual. If the individual provides the media
(e.g., a CD or flash drive), there would be no cost for the media.
Similarly, if the information is transmitted via e-mail or some other
electronic mode, there would be no charge for media.
It is unclear whether there will be any cost increase or decrease
to either the individual or the covered entity with respect to the
individual's increased access to their electronic protected health
information. The fact that the proposed rule requires the covered
entity to provide information in an electronic format may be, in
practice, no different than the current requirement to provide
protected health information to the individual in electronic format, if
readily producible in such format. Both the current and proposed rules
continue to permit the covered entity and individual to negotiate over
the format and delivery of protected health information. By emphasizing
the provision of protected health information electronically, the
proposed rule may lower costs because postage costs are eliminated or
reduced and labor and supply costs are significantly reduced. In
conclusion, there may be some savings that result from the greater use
of electronic access to protected health information, but we cannot
quantify them.
9. Business Associates and Covered Entities and Their Contractual
Relationships
The proposed rule would extend liability for failure to comply with
the Privacy and Security Rules directly to business associates and
business associate subcontractors in a manner similar to how they now
apply to covered entities. The proposed rule would subject business
associates to many of the same standards and implementation
specifications, and to the same penalties, that apply to covered
entities under the Security Rule and to some of the same standards and
implementation specifications, and to the same penalties, that apply to
covered entities under the Privacy Rule. Additionally, business
associates would also be required to obtain satisfactory assurances in
the form of a business associate agreement from subcontractors that the
subcontractors will safeguard any protected health information in their
possession. If the business associate learns of a pattern of activity
or practice of a subcontractor that constitutes a material breach or
violation of the contract, the business associate would be required to
make reasonable attempts to repair the breach or correct the violation.
If unsuccessful, the business associate would be required to terminate
the contract, if feasible. In addition, a business associate would be
required to furnish any information the Secretary requires to
investigate whether the business associate is in compliance with the
regulations.
In the absence of reliable data to the contrary, we assume that
business associates' compliance with their
[[Page 40909]]
contracts range from the minimal compliance to avoid contract
termination to being fully compliant. The burden of the proposed rules
on business associates depends on the terms of the contract between the
covered entity and business associate, and the degree to which a
business associate established privacy policies and adopted security
measures that comport with the HIPAA Rules. For business associates
that have already taken HIPAA-compliant measures to protect the privacy
and security of the protected health information in their possession,
the proposed rules with their increased penalties would impose limited
burden.
We assume that business associates in compliance with their
contracts would have already designated personnel to be responsible for
formulating the organization's privacy and security policies, performed
a risk analysis, and invested in hardware and software to prevent and
monitor for internal and external breaches of protected health
information. We expect that most business associates make a good-faith
effort to follow the terms of their contracts and comply with current
security and privacy standards.
For those business associates that have not already adopted HIPAA-
compliant privacy and security standards for protected health
information, the risk of criminal and/or civil monetary penalties may
spur them to increase their efforts to comply with the privacy and
security standards. Up to this point, the consequences of failing to
meet the privacy and security standards were limited to a business loss
in the form of a terminated contract. In the context of the business
associate's overall business, the risk of losing the contract may not
be a sufficient incentive to warrant investing in added security or
establishing privacy policies potentially at significant expense. There
may be other more benign reasons such as ignorance of potential threats
or lack of knowledgeable personnel on staff. Regardless of the reason,
to avoid the risk of the far more serious penalties in this proposed
rule, we expect that business associates and subcontractors that have
been lax in their complying with the privacy and security standards may
now take steps to enhance their security procedures and strengthen
their policies for protecting the privacy of the protected health
information under their control.
As stated above, we have no information on the degree of contract
enforcement and compliance among business associates. We also lack
information regarding the size or type of business associates that
contract with covered entities. We have only rough estimates as to the
overall number of business associates, which ranges from approximately
one million to two million depending upon the number of business
associates which serve multiple covered entities. As the area of health
information technology expands, we note that the proposed rule also
includes in the definition of business associates entities such as e-
prescribing gateways, health information organizations or other
organizations that provide data transmission services with respect to
protected health information to a covered entity.
As a result of the lack of information, we can only assume that
some business associates and subcontractors comply with existing
privacy and security standards. For them, the proposed rules would
impose only a limited burden. For business associates that do not have
HIPAA-compliant privacy policies and security procedures, the proposed
rules imposing criminal and civil monetary penalties directly on
business associates and their subcontractors may incentivize these
organizations to bolster their security and privacy policies. Depending
on the current level of compliance, for some business associates, the
proposed rule could impose significant burdens. We welcome comments on
our analysis and especially invite information regarding the amount of
burden and the number of affected business associates.
The cost to renegotiate contracts between covered entities and
business associates and between business associates and subcontractors
may be minimal if we assume that all parties are living up to their
current contractual agreements. At the same time, we anticipate that an
unknown number of contracts will have to be modified to reflect the
changes in law and in the rules we propose. The time involved in
modifying a contract is estimated to be one hour of a legal
professional's time. Based on the Bureau of Labor Statistics reports,
the average hourly wage of $60 plus an estimated additional 50 percent
for benefits brings the hourly rate to $90.
Because we are allowing contracts to be phased in over one year
from the compliance date or 18 months from the effective date of the
final rule, we expect that the costs of modifying contracts will be
incorporated into the normal renegotiation of contracts as the
contracts expire. We believe that most contracts will be renegotiated
over the phase-in period. In addition, the Department expects to issue
revised sample business associate contract language when these rules
are finalized, which may help to lessen the costs associated with
contract modifications. Under these assumptions, the costs will be
minimal. We request comments on the number of contracts and covered
entities that will not be able to complete renegotiation of their
contracts with their business associates within 18 months.
Even with the phase-in period for renegotiating contracts, we
expect there will be an unknown number of covered entities and business
associates that will have to renegotiate their contracts before the
term of their current contracts expire because: (1) some contracts may
extend beyond the eighteen month period, (2) fear of incurring civil or
criminal penalties may motivate the parties to ensure they are in
compliance with the new rules, and (3) the covered entity and business
associate may have established only the minimum requirements and seek
to strengthen their compliance under the new rules.
As stated previously, we are unsure which of these scenarios
applies. We welcome comments on the extent of cost to renegotiate
contracts.
D. Benefits
The proposed modifications pursuant to the HITECH Act would provide
benefits to individuals. The benefits for individuals include added
information on their rights through an expanded NPP and greater control
over the uses and disclosures of their personal health information by
expanding the requirements to obtain authorization before a covered
entity or business associate can disclose their protected health
information in exchange for remuneration and to restrict certain
disclosures at the request of the individual. Under the proposed rule,
individuals would also have easier access to their protected health
information in an electronic format, and relatives and friends of
deceased persons would be able to obtain the person's protected health
information when there is no personal representative or without
obtaining authorization under some circumstances. In addition, covered
entities would only need to protect the health information of decedents
for 50 years after their death, as opposed to protecting the
information in perpetuity as is required by the current rule. This
would also mean that the personal health information of persons who had
been deceased for many years would be available to historians,
researchers, and family members. Also, individuals' rights with respect
to fundraising communications would be strengthened. In States that
[[Page 40910]]
require immunization information for school attendance, schools would
have an easier time obtaining immunization records because the proposed
rule would eliminate the need for written authorization.
Under the proposed rule, pursuant to the HITECH Act, an
individual's health information will be afforded greater protection
since business associates of covered entities would share
responsibility with the covered entity for safeguarding against
impermissible disclosures of protected health information. Business
associates and subcontractors would be subject to criminal and civil
penalties for violating the privacy and security of protected health
information entrusted to them.
While we are certain that the proposed regulatory changes represent
distinct benefits, we cannot monetize their value. We have no measure
for valuing the benefit an individual would gain from the authorization
requirement when a covered entity or business associate exchanges
protected health information for remuneration. Neither do we know how
much value would be added when an individual receives their protected
health information in an electronic format nor the amount of time saved
as a result of the public health disclosure provision for student
immunizations. Also, the value that relatives and friends of a deceased
person would gain from obtaining the protected health information of
the decedent that they would not otherwise be able to obtain because
there is no personal representative or, if there is a personal
representative, without the delay of obtaining authorization, is beyond
our ability to measure. We welcome comments and information that could
improve our analysis of the benefits of the proposed rule.
E. Regulatory Flexibility Analysis
The Regulatory Flexibility Act requires agencies that issue a
proposed rule to analyze and consider options for reducing regulatory
burden if the regulation will impose a significant burden on a
substantial number of small entities. The Act requires the head of the
agency to either certify that the rule would not impose such a burden
or perform a regulatory flexibility analysis and consider alternatives
to lessen the burden.
The proposed rule would have an impact on covered providers of
health care, health insurance issuers, and third party administrators
acting on behalf of health plans, which we estimate to total 701,325.
Of the approximately $166.1 million in costs we are able to identify,
the private sector will incur approximately 71 percent of the costs or
$118.1 million. The average cost per covered entity is therefore
approximately $168. We do not view this as a significant burden. We
note that the 3,500 third party administrators included in this
calculation serve as business associates to the approximately 446,000
ERISA plans, most of which are small entities. We have no information
on how many of these plans self-administer, and we request any data the
public may provide on this question. Based on the relatively small cost
per covered entity, the Secretary certifies that the proposed rule
would not have a significant impact on a substantial number of small
entities. However, because we are not certain of all the costs this
rule may impose or the exact number of small health insurers or third
party administrators, we welcome comments that may further inform our
analysis.
Although we certify that the proposed rule will not impose a
significant burden on a substantial number of small entities, in
drafting the proposed provisions of the rule, we considered
alternatives for reducing the burden on small entities.
First, in the rule we are proposing to allow covered entities and
business associates with existing HIPAA compliant contracts twelve
months from the compliance date to renegotiate their contracts unless
the contract is renewed or modified before such date. This amount of
time plus the six months from the effective date of the rule to the
compliance date generally gives the parties 18 months to renegotiate
their agreements. We believe that the added time will reduce the cost
to revise agreements because the changes the rule requires will be
incorporated into the routine updating of covered entities and business
associates contracts.
Second, as we did in the final Privacy Rule published August 14,
2002 (67 FR 53182, 53264-53266) we will provide sample language for
revising the contracts between covered entities and business
associates. While the language is generic and may not suit complex
organizations with complex agreements, we believe that it will help
small entities with their contract revisions and save them time and
money in redrafting their contracts to conform to the new rules.
VIII. Collection of Information Requirements
Under the Paperwork Reduction Act of 1995 (PRA), agencies are
required to provide a 60-day notice in the Federal Register and solicit
public comment before a collection of information requirement is
submitted to the Office of Management and Budget (OMB) for review and
approval. In order to fairly evaluate whether an information collection
should be approved by OMB, section 3506(c)(2)(A) of the PRA requires
that we solicit comment on the following issues:
a. Whether the information collection is necessary and useful to
carry out the proper functions of the agency;
b. The accuracy of the agency's estimate of the information
collection burden;
c. The quality, utility, and clarity of the information to be
collected; and
d. Recommendations to minimize the information collection burden on
the affected public, including automated collection techniques.
Under the PRA, the time, effort, and financial resources necessary
to meet the information collection requirements referenced in this
section are to be considered. We explicitly seek, and will consider,
public comment on our assumptions as they relate to the PRA
requirements summarized in this section. To comment on this collection
of information or to obtain copies of the supporting statement and any
related forms for the proposed paperwork collections referenced above,
e-mail your comment or request, including your address and phone number
to [email protected], or call the Reports Clearance Office
on (202) 690-6162. Written comments and recommendations for the
proposed information collections must be directed to the OS Paperwork
Clearance Officer at the above e-mail address within 60 days.
A. Abstract
As a result of the Health Information Technology for Economic and
Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of
Division B of the American Recovery and Reinvestment Act of 2009 (ARRA)
(Pub. L. 111-5), the Office for Civil Rights (OCR) is required to
revise its information collection under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) Privacy and Security
Rules (45 CFR Parts 160 and 164). ARRA was enacted on February 17,
2009. This supporting statement revises a previously approved OCR data
collection, OMB 0990-0294. The HITECH Act requires
modification of the Health Insurance Portability and Accountability Act
of 1996 (HIPAA) (Pub. L. 104-191) implementing regulations at 45 CFR
Parts 160 and 164, the HIPAA Privacy and Security Rules, to extend
jurisdiction to business associates and to strengthen privacy and
[[Page 40911]]
security protections for health information.
We have integrated this PRA notice into the Notice of Proposed
Rulemaking, because these costs represent costs to be incurred as one-
time, first year implementation costs. The estimated annualized burden
table below was developed using the same estimates and workload
assumptions in the impact statement in the section regarding Executive
Order 12866, above. Because the HIPAA Privacy and Security Rules have
been in effect for several years, these numbers, as revised pursuant to
the HITECH modifications, are based on past experience with the current
information collection.
With respect to the Sec. 164.520 requirement to revise the Notice
of Privacy Practices, the ``Number of Respondents'' column represents
the number of covered entities that would be required to revise their
Notices of Privacy Practices pursuant to the HITECH modifications. As
such, 701,500 covered entities would be required to modify their
Notices of Privacy Practices. Each covered entity would have to revise
one Notice of Privacy Practices, which is represented by the ``Average
Number of Responses per Respondent'' column. We estimate that each
revision would require 20 minutes to complete. As such, it would take
233,833 total burden hours for 701,500 covered entities to revise their
Notices of Privacy Practices. With respect to the Sec. 164.520
requirement for health plans to disseminate the revised Notice of
Privacy Practices, the ``Number of Respondents'' column represents the
200 million individuals to whom the revised Notice of Privacy Practices
would be sent. Each individual would receive one Notice of Privacy
Practices, which is represented by the ``Average Number of Responses
per Respondent'' column. We estimate that each health plan would need
one hour to prepare 100 Notices of Privacy Practices for mailing to
individuals. As such, the total burden hours it would take health plans
to disseminate Notices of Privacy Practices to 200 million individuals
would be two million.
With regard to the proposed business associate provisions, as
discussed in Section VI of this proposed rule, we assume that business
associates currently comply with the HIPAA Privacy and Security Rules,
and that their contracts range from the minimal compliance to avoid
contract termination to being fully compliant. Because the proposed
rule provides that most business associates may renegotiate their
contracts during the compliance period in the normal course of
business, we anticipate no or minimal additional burden. However, for
those business associates with subcontractors, we anticipate an
increased burden associated with bringing their subcontractors into
compliance with the HIPAA Privacy and Security Rules, specifically with
regard to business associate agreements.
Currently, business associates must obtain satisfactory assurance
from their subcontractors regarding their compliance with the HIPAA
Privacy and Security Rules. We assume that business associates obtained
this satisfactory assurance via contract with their subcontractors.
This proposed rule contains a new explicit requirement that business
associates enter into contracts with their subcontractors to ensure
compliance with the HIPAA Privacy and Security Rules. Because most
business associates already have contracts in place, this new
requirement creates a minimal additional burden associated with
modification of these contracts. As discussed in Section VI above, we
estimated that it will require one hour of a legal professional's time
to modify these contracts. We estimate the number of business
associates that may have to bring subcontractors into compliance to be
1,500,000. Our estimate is based on an average of one to two million
business associates. This correlates to 1,500,000 burden hours.
The overall total for respondents to comply with the information
collection requirements of the Rules is 3,733,833 burden hours. We
request comment on this estimate.
As discussed in the above paragraph, we consider the majority of,
if not all of, the burden associated with this proposed rule to result
from the requirements with regard to the Notice of Privacy Practices
and costs for business associates. However, as there may be an
additional minimal burden associated with other provisions of the
proposed rule, we request comment on the impacts of such provisions, as
follows.
With regard to the proposed marketing, sale, fundraising, and
access provisions discussed above in Section VI of this proposed rule,
we do not anticipate any significant increase in the burden to covered
entities and business associates, because covered entities already have
in place routine business policies, procedures, and forms to address
the current requirements regarding an opt-out for fundraising,
authorizations for marketing and sale of protected health information,
and the provision of access to electronic protected health information.
While the proposed rule strengthens consumer protections in each of
these areas, we do not have sufficient data on the current marketing,
sale, fundraising, and access activities of covered entities and their
business associates to calculate the impact of the increased
protections on the use of these forms and processes.
B. Estimated Annualized Burden Table
----------------------------------------------------------------------------------------------------------------
Average number Average burden
Section Type of Number of of responses hours per Total burden
respondent respondents per respondent response hours
----------------------------------------------------------------------------------------------------------------
164.504....................... Business 1,500,000 1 1 1,500,000
Associates.
164.520....................... Revision of 701,500 1 20/60 233,833
Notice of
Privacy
Practices for
Protected
Health
Information
(drafting
revised
language).
164.520....................... Dissemination of 200,000,000 1 1 per 100 2,000,000
Notice of
Privacy
Practices for
Protected
Health
Information
(health plans).
---------------------------------------------------------------------------------
Total..................... ................ .............. .............. .............. 3,733,833
----------------------------------------------------------------------------------------------------------------
List of Subjects
45 CFR Part 160
Administrative practice and procedure, Computer technology,
Electronic information system, Electronic transactions, Employer
benefit plan, Health, Health care, Health facilities, Health insurance,
Health records, Hospitals, Investigations, Medicaid, Medical research,
Medicare, Penalties, Privacy, Reporting and record keeping
requirements, Security.
[[Page 40912]]
45 CFR Part 164
Administrative practice and procedure, Computer technology,
Electronic information system, Electronic transactions, Employer
benefit plan, Health, Health care, Health facilities, Health insurance,
Health records, Hospitals, Medicaid, Medical research, Medicare,
Privacy, Reporting and record keeping requirements, Security.
For the reasons set forth in the preamble, the Department proposes
to amend 45 CFR Subtitle A, Subchapter C, parts 160 and 164, as set
forth below:
PART 160--GENERAL ADMINISTRATIVE REQUIREMENTS
1. The authority citation for part 160 is revised to read as
follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-8; sec. 264,
Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); 5
U.S.C. 552; and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.
2. Revise Sec. 160.101 to read as follows:
Sec. 160.101 Statutory basis and purpose.
The requirements of this subchapter implement sections 1171-1179 of
the Social Security Act (the Act), as added by section 262 of Public
Law 104-191, section 264 of Public Law 104-191, and sections 13400-
13424 of Public Law 111-5.
3. Amend Sec. 160.102 as follows:
a. Redesignate paragraph (b) as paragraph (c); and
b. Add new paragraph (b) to read as follows:
Sec. 160.102 Applicability.
* * * * *
(b) Where provided, the standards, requirements, and implementation
specifications adopted under this subchapter apply to a business
associate.
* * * * *
4. Amend Sec. 160.103 as follows:
a. Revise the definitions of ``business associate'', ``compliance
date'', ``disclosure'', ``electronic media'', paragraph (2) of
``protected health information,'' and the definitions of ``standard'',
``State'', and ``workforce''; and
b. Add, in alphabetical order, new definitions of ``administrative
simplification provision'', ``ALJ'', ``civil money penalty or
penalty'', ``respondent'', ``subcontractor'', and ``violation or
violate''.
The revisions and additions read as follows:
Sec. 160.103 Definitions.
* * * * *
Administrative simplification provision means any requirement or
prohibition established by:
(1) 42 U.S.C. 1320d-1320d-4, 1320d-7, and 1320d-8;
(2) Section 264 of Pub. L. 104-191;
(3) Sections 13400-13424 of Public Law 111-5; or
(4) This subchapter.
ALJ means Administrative Law Judge.
* * * * *
Business associate: (1) Except as provided in paragraph (4) of this
definition, business associate means, with respect to a covered entity,
a person who:
(i) On behalf of such covered entity or of an organized health care
arrangement (as defined in this section) in which the covered entity
participates, but other than in the capacity of a member of the
workforce of such covered entity or arrangement, performs, or assists
in the performance of:
(A) A function or activity involving the use or disclosure of
protected health information, including claims processing or
administration, data analysis, processing or administration,
utilization review, quality assurance, patient safety activities listed
at 42 CFR 3.20, billing, benefit management, practice management, and
repricing; or
(B) Any other function or activity regulated by this subchapter; or
(ii) Provides, other than in the capacity of a member of the
workforce of such covered entity, legal, actuarial, accounting,
consulting, data aggregation (as defined in Sec. 164.501 of this
subchapter), management, administrative, accreditation, or financial
services to or for such covered entity, or to or for an organized
health care arrangement in which the covered entity participates, where
the provision of the service involves the disclosure of protected
health information from such covered entity or arrangement, or from
another business associate of such covered entity or arrangement, to
the person.
(2) A covered entity may be a business associate of another covered
entity.
(3) Business associate includes:
(i) A Health Information Organization, E-prescribing Gateway, or
other person that provides data transmission services with respect to
protected health information to a covered entity and that requires
access on a routine basis to such protected health information.
(ii) A person that offers a personal health record to one or more
individuals on behalf of a covered entity.
(iii) A subcontractor that creates, receives, maintains, or
transmits protected health information on behalf of the business
associate.
(4) Business associate does not include:
(i) A health care provider, with respect to disclosures by a
covered entity to the health care provider concerning the treatment of
the individual.
(ii) A plan sponsor, with respect to disclosures by a group health
plan (or by a health insurance issuer or HMO with respect to a group
health plan) to the plan sponsor, to the extent that the requirements
of Sec. 164.504(f) of this subchapter apply and are met.
(iii) A government agency, with respect to determining eligibility
for, or enrollment in, a government health plan that provides public
benefits and is administered by another government agency, or
collecting protected health information for such purposes, to the
extent such activities are authorized by law.
(iv) A covered entity participating in an organized health care
arrangement that performs a function or activity as described by
paragraph (1)(i) of this definition for or on behalf of such organized
health care arrangement, or that provides a service as described in
paragraph (1)(ii) of this definition to or for such organized health
care arrangement by virtue of such activities or services.
Civil money penalty or penalty means the amount determined under
Sec. 160.404 of this part and includes the plural of these terms.
* * * * *
Compliance date means the date by which a covered entity or
business associate must comply with a standard, implementation
specification, requirement, or modification adopted under this
subchapter.
* * * * *
Disclosure means the release, transfer, provision of access to, or
divulging in any manner of information outside the entity holding the
information.
* * * * *
Electronic media means:
(1) Electronic storage material on which data is or may be recorded
electronically, including, for example, devices in computers (hard
drives) and any removable/transportable digital memory medium, such as
magnetic tape or disk, optical disk, or digital memory card;
(2) Transmission media used to exchange information already in
electronic storage media. Transmission media include, for example, the
Internet (wide-open), extranet or intranet (using Internet technology
to link a business with information accessible only to collaborating
parties), leased lines, dial-
[[Page 40913]]
up lines, private networks, and the physical movement of removable/
transportable electronic storage media. Certain transmissions,
including of paper, via facsimile, and of voice, via telephone, are not
considered to be transmissions via electronic media if the information
being exchanged did not exist in electronic form before the
transmission.
* * * * *
Protected health information * * *
(2) Protected health information excludes individually identifiable
health information:
(i) In education records covered by the Family Educational Rights
and Privacy Act, as amended, 20 U.S.C. 1232g;
(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);
(iii) In employment records held by a covered entity in its role as
employer; and
(iv) Regarding a person who has been deceased for more than 50
years.
* * * * *
Respondent means a covered entity or business associate upon which
the Secretary has imposed, or proposes to impose, a civil money
penalty.
* * * * *
Standard means a rule, condition, or requirement:
(1) Describing the following information for products, systems,
services, or practices:
(i) Classification of components;
(ii) Specification of materials, performance, or operations; or
(iii) Delineation of procedures; or
(2) With respect to the privacy of protected health information.
* * * * *
State refers to one of the following:
(1) For a health plan established or regulated by Federal law,
State has the meaning set forth in the applicable section of the United
States Code for such health plan.
(2) For all other purposes, State means any of the several States,
the District of Columbia, the Commonwealth of Puerto Rico, the Virgin
Islands, Guam, American Samoa, and the Commonwealth of the Northern
Mariana Islands.
Subcontractor means a person who acts on behalf of a business
associate, other than in the capacity of a member of the workforce of
such business associate.
* * * * *
Violation or violate means, as the context may require, failure to
comply with an administrative simplification provision.
Workforce means employees, volunteers, trainees, and other persons
whose conduct, in the performance of work for a covered entity or
business associate, is under the direct control of such covered entity
or business associate, whether or not they are paid by the covered
entity or business associate.
5. Add Sec. 160.105 to subpart A to read as follows:
Sec. 160.105 Compliance dates for implementation of new or modified
standards and implementation specifications.
In accordance with Sec. 160.104, with respect to new standards and
implementation specifications or modifications to standards and
implementation specifications in this subchapter that become effective
after [DATE OF PUBLICATION OF THE FINAL RULE IN THE FEDERAL REGISTER],
except as otherwise provided, covered entities and business associates
must comply with the applicable new standards and implementation
specifications or modifications to standards and implementation
specifications no later than 180 days from the effective date of any
such standards or implementation specifications.
6. Revise Sec. 160.201 to read as follows:
Sec. 160.201 Statutory basis.
The provisions of this subpart implement section 1178 of the Act,
as added by section 262 of Public Law 104-191, section 264(c) of Public
Law 104-191, and section 13421(a) of Public Law 111-5.
7. In Sec. 160.202, revise the definition of ``contrary'' and
paragraph (1)(i) of the definition of ``more stringent'' to read as
follows:
Sec. 160.202 Definitions.
* * * * *
Contrary, when used to compare a provision of State law to a
standard, requirement, or implementation specification adopted under
this subchapter, means:
(1) A covered entity or business associate would find it impossible
to comply with both the State and Federal requirements; or
(2) The provision of State law stands as an obstacle to the
accomplishment and execution of the full purposes and objectives of
part C of title XI of the Act, section 264 of Public Law 104-191, or
sections 13400-13424 of Public Law 111-5, as applicable.
More stringent * * *
(1) * * *
(i) Required by the Secretary in connection with determining
whether a covered entity or business associate is in compliance with
this subchapter; or
* * * * *
8. Revise Sec. 160.300 to read as follows:
Sec. 160.300 Applicability.
This subpart applies to actions by the Secretary, covered entities,
business associates, and others with respect to ascertaining the
compliance by covered entities and business associates with, and the
enforcement of, the applicable provisions of this part 160 and parts
162 and 164 of this subchapter.
Sec. 160.302 [Removed and Reserved]
9. Remove and reserve Sec. 160.302.
10. Revise Sec. 160.304 to read as follows:
Sec. 160.304 Principles for achieving compliance.
(a) Cooperation. The Secretary will, to the extent practicable and
consistent with the provisions of this subpart, seek the cooperation of
covered entities and business associates in obtaining compliance with
the applicable administrative simplification provisions.
(b) Assistance. The Secretary may provide technical assistance to
covered entities and business associates to help them comply
voluntarily with the applicable administrative simplification
provisions.
11. In Sec. 160.306, revise paragraphs (a) and (c) to read as
follows:
Sec. 160.306 Complaints to the Secretary.
(a) Right to file a complaint. A person who believes a covered
entity or business associate is not complying with the administrative
simplification provisions may file a complaint with the Secretary.
* * * * *
(c) Investigation.
(1) The Secretary will investigate any complaint filed under this
section when a preliminary review of the facts indicates a possible
violation due to willful neglect.
(2) The Secretary may investigate any other complaint filed under
this section.
(3) An investigation under this section may include a review of the
pertinent policies, procedures, or practices of the covered entity or
business associate and of the circumstances regarding any alleged
violation.
(4) At the time of the initial written communication with the
covered entity or business associate about the complaint, the Secretary
will describe the acts and/or omissions that are the basis of the
complaint.
12. Revise Sec. 160.308 to read as follows:
[[Page 40914]]
Sec. 160.308 Compliance reviews.
(a) The Secretary will conduct a compliance review to determine
whether a covered entity or business associate is complying with the
applicable administrative simplification provisions when a preliminary
review of the facts indicates a possible violation due to willful
neglect.
(b) The Secretary may conduct a compliance review to determine
whether a covered entity or business associate is complying with the
applicable administrative simplification provisions in any other
circumstance.
13. Revise Sec. 160.310 to read as follows:
Sec. 160.310 Responsibilities of covered entities and business
associates.
(a) Provide records and compliance reports. A covered entity or
business associate must keep such records and submit such compliance
reports, in such time and manner and containing such information, as
the Secretary may determine to be necessary to enable the Secretary to
ascertain whether the covered entity or business associate has complied
or is complying with the applicable administrative simplification
provisions.
(b) Cooperate with complaint investigations and compliance reviews.
A covered entity or business associate must cooperate with the
Secretary, if the Secretary undertakes an investigation or compliance
review of the policies, procedures, or practices of the covered entity
or business associate to determine whether it is complying with the
applicable administrative simplification provisions.
(c) Permit access to information.
(1) A covered entity or business associate must permit access by
the Secretary during normal business hours to its facilities, books,
records, accounts, and other sources of information, including
protected health information, that are pertinent to ascertaining
compliance with the applicable administrative simplification
provisions. If the Secretary determines that exigent circumstances
exist, such as when documents may be hidden or destroyed, a covered
entity or business associate must permit access by the Secretary at any
time and without notice.
(2) If any information required of a covered entity or business
associate under this section is in the exclusive possession of any
other agency, institution, or person and the other agency, institution,
or person fails or refuses to furnish the information, the covered
entity or business associate must so certify and set forth what efforts
it has made to obtain the information.
(3) Protected health information obtained by the Secretary in
connection with an investigation or compliance review under this
subpart will not be disclosed by the Secretary, except if necessary for
ascertaining or enforcing compliance with the applicable administrative
simplification provisions, if otherwise required by law, or if
permitted under 5 U.S.C. 552a(b)(7).
14. Revise Sec. 160.312 to read as follows:
Sec. 160.312 Secretarial action regarding complaints and compliance
reviews.
(a) Resolution when noncompliance is indicated.
(1) If an investigation of a complaint pursuant to Sec. 160.306 or
a compliance review pursuant to Sec. 160.308 indicates noncompliance,
the Secretary may attempt to reach a resolution of the matter
satisfactory to the Secretary by informal means. Informal means may
include demonstrated compliance or a completed corrective action plan
or other agreement.
(2) If the matter is resolved by informal means, the Secretary will
so inform the covered entity or business associate and, if the matter
arose from a complaint, the complainant, in writing.
(3) If the matter is not resolved by informal means, the Secretary
will--
(i) So inform the covered entity or business associate and provide
the covered entity or business associate an opportunity to submit
written evidence of any mitigating factors or affirmative defenses for
consideration under Sec. Sec. 160.408 and 160.410 of this part. The
covered entity or business associate must submit any such evidence to
the Secretary within 30 days (computed in the same manner as prescribed
under Sec. 160.526 of this part) of receipt of such notification; and
(ii) If, following action pursuant to paragraph (a)(3)(i) of this
section, the Secretary finds that a civil money penalty should be
imposed, inform the covered entity or business associate of such
finding in a notice of proposed determination in accordance with Sec.
160.420 of this part.
(b) Resolution when no violation is found. If, after an
investigation pursuant to Sec. 160.306 or a compliance review pursuant
to Sec. 160.308, the Secretary determines that further action is not
warranted, the Secretary will so inform the covered entity or business
associate and, if the matter arose from a complaint, the complainant,
in writing.
15. In Sec. 160.316, revise the introductory text to read as
follows:
Sec. 160.316 Refraining from intimidation or retaliation.
A covered entity or business associate may not threaten,
intimidate, coerce, harass, discriminate against, or take any other
retaliatory action against any individual or other person for--
* * * * *
16. In Sec. 160.401, revise the definition of reasonable cause to
read as follows:
Sec. 160.401 Definitions.
* * * * *
Reasonable cause means an act or omission in which a covered entity
or business associate knew, or by exercising reasonable diligence would
have known, that the act or omission violated an administrative
simplification provision, but in which the covered entity or business
associate did not act with willful neglect.
* * * * *
17. Revise Sec. 160.402 to read as follows:
Sec. 160.402 Basis for a civil money penalty.
(a) General rule. Subject to Sec. 160.410, the Secretary will
impose a civil money penalty upon a covered entity or business
associate if the Secretary determines that the covered entity or
business associate has violated an administrative simplification
provision.
(b) Violation by more than one covered entity or business
associate.
(1) Except as provided in paragraph (b)(2) of this section, if the
Secretary determines that more than one covered entity or business
associate was responsible for a violation, the Secretary will impose a
civil money penalty against each such covered entity or business
associate.
(2) A covered entity that is a member of an affiliated covered
entity, in accordance with Sec. 164.105(b) of this subchapter, is
jointly and severally liable for a civil money penalty for a violation
of part 164 of this subchapter based on an act or omission of the
affiliated covered entity, unless it is established that another member
of the affiliated covered entity was responsible for the violation.
(c) Violation attributed to a covered entity or business associate.
(1) A covered entity is liable, in accordance with the Federal common
law of agency, for a civil money penalty for a violation based on the
act or omission of any agent of the covered entity, including a
workforce member or business associate, acting within the scope of the
agency.
[[Page 40915]]
(2) A business associate is liable, in accordance with the Federal
common law of agency, for a civil money penalty for a violation based
on the act or omission of any agent of the business associate,
including a workforce member or subcontractor, acting within the scope
of the agency.
18. In Sec. 160.404, revise the introductory text of paragraphs
(b)(2)(i), (b)(2)(iii), and (b)(2)(iv) to read as follows:
Sec. 160.404 Amount of a civil money penalty.
* * * * *
(b) * * *
(2) * * *
(i) For a violation in which it is established that the covered
entity or business associate did not know and, by exercising reasonable
diligence, would not have known that the covered entity or business
associate violated such provision,
* * * * *
(iii) For a violation in which it is established that the violation
was due to willful neglect and was corrected during the 30-day period
beginning on the first date the covered entity or business associate
liable for the penalty knew, or, by exercising reasonable diligence,
would have known that the violation occurred,
* * * * *
(iv) For a violation in which it is established that the violation
was due to willful neglect and was not corrected during the 30-day
period beginning on the first date the covered entity or business
associate liable for the penalty knew, or, by exercising reasonable
diligence, would have known that the violation occurred,
* * * * *
19. Revise Sec. 160.406 to read as follows:
Sec. 160.406 Violations of an identical requirement or prohibition.
The Secretary will determine the number of violations of an
administrative simplification provision based on the nature of the
covered entity's or business associate's obligation to act or not act
under the provision that is violated, such as its obligation to act in
a certain manner, or within a certain time, or to act or not act with
respect to certain persons. In the case of continuing violation of a
provision, a separate violation occurs each day the covered entity or
business associate is in violation of the provision.
20. Revise Sec. 160.408 to read as follows:
Sec. 160.408 Factors considered in determining the amount of a civil
money penalty.
In determining the amount of any civil money penalty, the Secretary
will consider the following factors, which may be mitigating or
aggravating as appropriate:
(a) The nature and extent of the violation, consideration of which
may include but is not limited to:
(1) The number of individuals affected; and
(2) The time period during which the violation occurred;
(b) The nature and extent of the harm resulting from the violation,
consideration of which may include but is not limited to:
(1) Whether the violation caused physical harm;
(2) Whether the violation resulted in financial harm;
(3) Whether the violation resulted in harm to an individual's
reputation; and
(4) Whether the violation hindered an individual's ability to
obtain health care;
(c) The history of prior compliance with the administrative
simplification provisions, including violations, by the covered entity
or business associate, consideration of which may include but is not
limited to:
(1) Whether the current violation is the same or similar to
previous indications of noncompliance;
(2) Whether and to what extent the covered entity or business
associate has attempted to correct previous indications of
noncompliance;
(3) How the covered entity or business associate has responded to
technical assistance from the Secretary provided in the context of a
compliance effort; and
(4) How the covered entity or business associate has responded to
prior complaints;
(d) The financial condition of the covered entity or business
associate, consideration of which may include but is not limited to:
(1) Whether the covered entity or business associate had financial
difficulties that affected its ability to comply;
(2) Whether the imposition of a civil money penalty would
jeopardize the ability of the covered entity or business associate to
continue to provide, or to pay for, health care; and
(3) The size of the covered entity or business associate; and
(e) Such other matters as justice may require.
21. Revise Sec. 160.410 to read as follows:
Sec. 160.410 Affirmative defenses.
(a) The Secretary may not:
(1) Prior to February 18, 2011, impose a civil money penalty on a
covered entity or business associate for an act that violates an
administrative simplification provision if the covered entity or
business associate establishes that the violation is punishable under
42 U.S.C. 1320d-6.
(2) On or after February 18, 2011, impose a civil money penalty on
a covered entity or business associate for an act that violates an
administrative simplification provision if the covered entity or
business associate establishes that a penalty has been imposed under 42
U.S.C. 1320d-6 with respect to such act.
(b) For violations occurring prior to February 18, 2009, the
Secretary may not impose a civil money penalty on a covered entity for
a violation if the covered entity establishes that an affirmative
defense exists with respect to the violation, including the following:
(1) The covered entity establishes, to the satisfaction of the
Secretary, that it did not have knowledge of the violation, determined
in accordance with the Federal common law of agency, and by exercising
reasonable diligence, would not have known that the violation occurred;
or
(2) The violation is--
(i) Due to circumstances that would make it unreasonable for the
covered entity, despite the exercise of ordinary business care and
prudence, to comply with the administrative simplification provision
violated and is not due to willful neglect; and
(ii) Corrected during either:
(A) The 30-day period beginning on the first date the covered
entity liable for the penalty knew, or by exercising reasonable
diligence would have known, that the violation occurred; or
(B) Such additional period as the Secretary determines to be
appropriate based on the nature and extent of the failure to comply.
(c) For violations occurring on or after February 18, 2009, the
Secretary may not impose a civil money penalty on a covered entity or
business associate for a violation if the covered entity or business
associate establishes to the satisfaction of the Secretary that the
violation is--
(1) Not due to willful neglect; and
(2) Corrected during either:
(i) The 30-day period beginning on the first date the covered
entity or business associate liable for the penalty knew, or, by
exercising reasonable diligence, would have known that the violation
occurred; or
[[Page 40916]]
(ii) Such additional period as the Secretary determines to be
appropriate based on the nature and extent of the failure to comply.
22. Revise Sec. 160.412 to read as follows:
Sec. 160.412 Waiver.
For violations described in Sec. 160.410(b)(2) or (c) that are not
corrected within the period specified under such paragraphs, the
Secretary may waive the civil money penalty, in whole or in part, to
the extent that the payment of the penalty would be excessive relative
to the violation.
23. Revise Sec. 160.418 to read as follows:
Sec. 160.418 Penalty not exclusive.
Except as otherwise provided by 42 U.S.C. 1320d-5(b)(1) and 42
U.S.C. 299b-22(f)(3), a penalty imposed under this part is in addition
to any other penalty prescribed by law.
PART 164--SECURITY AND PRIVACY
24. The authority citation for part 164 is revised to read as
follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d--1320d-8; sec.
264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320-2(note));
and secs. 13400--13424, Pub. L. 111-5, 123 Stat. 258-279.
25. Revise Sec. 164.102 to read as follows:
Sec. 164.102 Statutory basis.
The provisions of this part are adopted pursuant to the Secretary's
authority to prescribe standards, requirements, and implementation
specifications under part C of title XI of the Act, section 264 of
Public Law 104-191, and sections 13400--13424 of Public Law 111-5.
26. In Sec. 164.104, revise paragraph (b) to read as follows:
Sec. 164.104 Applicability.
* * * * *
(b) Where provided, the standards, requirements, and implementation
specifications adopted under this part apply to a business associate.
27. Amend Sec. 164.105 as follows:
a. Revise the introductory text of paragraph (a)(1), the
introductory text of paragraph (a)(2)(i), paragraph (a)(2)(ii), the
introductory text of paragraph (a)(2)(iii), and paragraphs
(a)(2)(iii)(A) and (B);
b. Redesignate paragraph (a)(2)(iii)(C) as paragraph (a)(2)(iii)(D)
and add new paragraph (a)(2)(iii)(C); and
c. Revise paragraph (b).
The revisions read as follows:
Sec. 164.105 Organizational requirements.
(a)(1) Standard: Health care component. If a covered entity is a
hybrid entity, the requirements of this part, other than the
requirements of this section, Sec. 164.314, and Sec. 164.504, apply
only to the health care component(s) of the entity, as specified in
this section.
(2) * * *
(i) Application of other provisions. In applying a provision of
this part, other than the requirements of this section, Sec. 164.314,
and Sec. 164.504, to a hybrid entity:
* * * * *
(ii) Safeguard requirements. The covered entity that is a hybrid
entity must ensure that a health care component of the entity complies
with the applicable requirements of this part. In particular, and
without limiting this requirement, such covered entity must ensure
that:
(A) Its health care component does not disclose protected health
information to another component of the covered entity in circumstances
in which subpart E of this part would prohibit such disclosure if the
health care component and the other component were separate and
distinct legal entities;
(B) Its health care component protects electronic protected health
information with respect to another component of the covered entity to
the same extent that it would be required under subpart C of this part
to protect such information if the health care component and the other
component were separate and distinct legal entities;
(C) If a person performs duties for both the health care component
in the capacity of a member of the workforce of such component and for
another component of the entity in the same capacity with respect to
that component, such workforce member must not use or disclose
protected health information created or received in the course of or
incident to the member's work for the health care component in a way
prohibited by subpart E of this part.
(iii) Responsibilities of the covered entity. A covered entity that
is a hybrid entity has the following responsibilities:
(A) For purposes of subpart C of part 160 of this subchapter,
pertaining to compliance and enforcement, the covered entity has the
responsibility of complying with this part.
(B) The covered entity is responsible for complying with Sec.
164.316(a) and Sec. 164.530(i), pertaining to the implementation of
policies and procedures to ensure compliance with applicable
requirements of this part, including the safeguard requirements in
paragraph (a)(2)(ii) of this section.
(C) The covered entity is responsible for complying with Sec.
164.314 and Sec. 164.504 regarding business associate arrangements and
other organizational requirements.
* * * * *
(b)(1) Standard: Affiliated covered entities. Legally separate
covered entities that are affiliated may designate themselves as a
single covered entity for purposes of this part.
(2) Implementation specifications.
(i) Requirements for designation of an affiliated covered entity.
(A) Legally separate covered entities may designate themselves
(including any health care component of such covered entity) as a
single affiliated covered entity, for purposes of this part, if all of
the covered entities designated are under common ownership or control.
(B) The designation of an affiliated covered entity must be
documented and the documentation maintained as required by paragraph
(c) of this section.
(ii) Safeguard requirements. An affiliated covered entity must
ensure that it complies with the applicable requirements of this part,
including, if the affiliated covered entity combines the functions of a
health plan, health care provider, or health care clearinghouse, Sec.
164.308(a)(4)(ii)(A) and Sec. 164.504(g), as applicable.
* * * * *
28. Revise Sec. 164.106 to read as follows:
Sec. 164.106 Relationship to other parts.
In complying with the requirements of this part, covered entities
and, where provided, business associates, are required to comply with
the applicable provisions of parts 160 and 162 of this subchapter.
29. The authority citation for subpart C of part 164 is revised to
read as follows:
Authority: 42 U.S.C. 1320d-2 and 1320d-4; sec. 13401, Pub. L.
111-5, 123 Stat. 260.
30. Revise Sec. 164.302 to read as follows:
Sec. 164.302 Applicability.
A covered entity or business associate must comply with the
applicable standards, implementation specifications, and requirements
of this subpart with respect to electronic protected health information
of a covered entity.
31. In Sec. 164.304, revise the definitions of Administrative
safeguards and Physical safeguards to read as follows:
Sec. 164.304 Definitions.
* * * * *
[[Page 40917]]
Administrative safeguards are administrative actions, and policies
and procedures, to manage the selection, development, implementation,
and maintenance of security measures to protect electronic protected
health information and to manage the conduct of the covered entity's or
business associate's workforce in relation to the protection of that
information.
* * * * *
Physical safeguards are physical measures, policies, and procedures
to protect a covered entity's or business associate's electronic
information systems and related buildings and equipment, from natural
and environmental hazards, and unauthorized intrusion.
* * * * *
32. Amend Sec. 164.306 as follows:
a. Revise the introductory text of paragraph (a) and paragraph
(a)(1);
b. Revise paragraph (b)(1), the introductory text of paragraph
(b)(2), and paragraphs (b)(2)(i) and (b)(2)(ii);
c. Revise paragraph (c);
d. Revise paragraph (d)(2), the introductory text of paragraph
(d)(3), paragraph (d)(3)(i), and the introductory text of paragraph
(d)(3)(ii); and
e. Revise paragraph (e).
The revisions read as follows:
Sec. 164.306 Security standards: General rules.
(a) General requirements. Covered entities and business associates
must do the following:
(1) Ensure the confidentiality, integrity, and availability of all
electronic protected health information the covered entity or business
associate creates, receives, maintains, or transmits.
* * * * *
(b) * * * (1) Covered entities and business associates may use any
security measures that allow the covered entity or business associate
to reasonably and appropriately implement the standards and
implementation specifications as specified in this subpart.
(2) In deciding which security measures to use, a covered entity or
business associate must take into account the following factors:
(i) The size, complexity, and capabilities of the covered entity or
business associate.
(ii) The covered entity's or the business associate's technical
infrastructure, hardware, and software security capabilities.
* * * * *
(c) Standards. A covered entity or business associate must comply
with the applicable standards as provided in this section and in Sec.
164.308, Sec. 164.310, Sec. 164.312, Sec. 164.314 and Sec. 164.316
with respect to all electronic protected health information.
(d) * * *
(2) When a standard adopted in Sec. 164.308, Sec. 164.310, Sec.
164.312, Sec. 164.314, or Sec. 164.316 includes required
implementation specifications, a covered entity or business associate
must implement the implementation specifications.
(3) When a standard adopted in Sec. 164.308, Sec. 164.310, Sec.
164.312, Sec. 164.314, or Sec. 164.316 includes addressable
implementation specifications, a covered entity or business associate
must--
(i) Assess whether each implementation specification is a
reasonable and appropriate safeguard in its environment, when analyzed
with reference to the likely contribution to protecting electronic
protected health information; and
(ii) As applicable to the covered entity or business associate--
* * * * *
(e) Maintenance. A covered entity or business associate must review
and modify the security measures implemented under this subpart as
needed to continue provision of reasonable and appropriate protection
of electronic protected health information, and update documentation of
such security measures in accordance with Sec. 164.316(b)(2)(iii).
33. Amend Sec. 164.308 as follows:
a. Revise the introductory text of paragraph (a), paragraph
(a)(1)(ii)(A), paragraph (a)(1)(ii)(C), paragraph (a)(2), paragraph
(a)(3)(ii)(C), paragraph (a)(4)(ii)(C), paragraph (a)(6)(ii), and
paragraph (a)(8); and
b. Revise paragraph (b).
The revisions read as follows:
Sec. 164.308 Administrative safeguards.
(a) A covered entity or business associate must, in accordance with
Sec. 164.306:
(1) * * *
(ii) * * *
(A) Risk analysis (Required). Conduct an accurate and thorough
assessment of the potential risks and vulnerabilities to the
confidentiality, integrity, and availability of electronic protected
health information held by the covered entity or business associate.
* * * * *
(C) Sanction policy (Required). Apply appropriate sanctions against
workforce members who fail to comply with the security policies and
procedures of the covered entity or business associate.
* * * * *
(2) Standard: Assigned security responsibility. Identify the
security official who is responsible for the development and
implementation of the policies and procedures required by this subpart
for the covered entity or business associate.
(3) * * *
(ii) * * *
(C) Termination procedures (Addressable). Implement procedures for
terminating access to electronic protected health information when the
employment of, or other arrangement with, a workforce member ends or as
required by determinations made as specified in paragraph (a)(3)(ii)(B)
of this section.
(4) * * *
(ii) * * *
(C) Access establishment and modification (Addressable). Implement
policies and procedures that, based upon the covered entity's or the
business associate's access authorization policies, establish,
document, review, and modify a user's right of access to a workstation,
transaction, program, or process.
* * * * *
(6) * * *
(ii) Implementation specification: Response and reporting
(Required). Identify and respond to suspected or known security
incidents; mitigate, to the extent practicable, harmful effects of
security incidents that are known to the covered entity or business
associate; and document security incidents and their outcomes.
* * * * *
(8) Standard: Evaluation. Perform a periodic technical and
nontechnical evaluation, based initially upon the standards implemented
under this rule and, subsequently, in response to environmental or
operational changes affecting the security of electronic protected
health information, that establishes the extent to which a covered
entity's or business associate's security policies and procedures meet
the requirements of this subpart.
(b)(1) Business associate contracts and other arrangements. A
covered entity may permit a business associate to create, receive,
maintain, or transmit electronic protected health information on the
covered entity's behalf only if the covered entity obtains satisfactory
assurances, in accordance with Sec. 164.314(a), that the business
associate will appropriately safeguard the information. A covered
entity is not required to obtain such satisfactory assurances from a
business associate that is a subcontractor.
(2) A business associate may permit a business associate that is a
[[Page 40918]]
subcontractor to create, receive, maintain, or transmit electronic
protected health information on its behalf only if the business
associate obtains satisfactory assurances, in accordance with Sec.
164.314(a), that the subcontractor will appropriately safeguard the
information.
(3) Implementation specifications: Written contract or other
arrangement (Required). Document the satisfactory assurances required
by paragraph (b)(1) or (b)(2) of this section through a written
contract or other arrangement with the business associate that meets
the applicable requirements of Sec. 164.314(a).
34. Revise the introductory text of Sec. 164.310 to read as
follows:
Sec. 164.310 Physical safeguards.
A covered entity or business associate must, in accordance with
Sec. 164.306:
* * * * *
35. Revise the introductory text of Sec. 164.312 to read as
follows:
Sec. 164.312 Technical safeguards.
A covered entity or business associate must, in accordance with
Sec. 164.306:
* * * * *
36. Amend Sec. 164.314 by revising paragraphs (a) and (b)(2)(iii)
to read as follows:
Sec. 164.314 Organizational requirements.
(a)(1) Standard: Business associate contracts or other
arrangements. The contract or other arrangement required by Sec.
164.308(b)(4) must meet the requirements of paragraph (a)(2)(i),
(a)(2)(ii), or (a)(2)(iii) of this section, as applicable.
(2) Implementation specifications (Required).
(i) Business associate contracts. The contract must provide that
the business associate will--
(A) Comply with the applicable requirements of this subpart;
(B) In accordance with Sec. 164.308(b)(2), ensure that any
subcontractors that create, receive, maintain, or transmit electronic
protected health information on behalf of the business associate agree
to comply with the applicable requirements of this subpart by entering
into a contract or other arrangement that complies with this section;
and
(C) Report to the covered entity any security incident of which it
becomes aware, including breaches of unsecured protected health
information as required by Sec. 164.410.
(ii) Other arrangements. The covered entity is in compliance with
paragraph (a)(1) of this section if it has another arrangement in place
that meets the requirements of Sec. 164.504(e)(3).
(iii) Business associate contracts with subcontractors. The
requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section
apply to the contract or other arrangement between a business associate
and a subcontractor required by Sec. 164.308(b)(4) in the same manner
as such requirements apply to contracts or other arrangements between a
covered entity and business associate.
(b) * * *
(2) * * *
(iii) Ensure that any agent to whom it provides this information
agrees to implement reasonable and appropriate security measures to
protect the information; and
* * * * *
37. Revise the introductory text of Sec. 164.316 and the third
sentence of paragraph (a) to read as follows:
Sec. 164.316 Policies and procedures and documentation requirements.
A covered entity or business associate must, in accordance with
Sec. 164.306:
(a) * * * A covered entity or business associate may change its
policies and procedures at any time, provided that the changes are
documented and are implemented in accordance with this subpart.
* * * * *
38. The authority citation for subpart E of part 164 is revised to
read as follows:
Authority: 42 U.S.C. 1320d-2 and 1320d-4; sec. 264 of Pub. L.
104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)); and secs.
13400-13424, Pub. L. 111-5, 123 Stat. 258-279.
39. In Sec. 164.500, redesignate paragraph (c) as paragraph (d)
and add new paragraph (c) to read as follows:
Sec. 164.500 Applicability.
* * * * *
(c) Where provided, the standards, requirements, and implementation
specifications adopted under this subpart apply to a business associate
with respect to the protected health information of a covered entity.
* * * * *
40. Amend Sec. 164.501 as follows:
a. Revise paragraph (1) of the definition of ``health care
operations''; and
b. Revise the definition of ``marketing''.
The revisions read as follows:
Sec. 164.501 Definitions.
* * * * *
Health care operations * * *
(1) Conducting quality assessment and improvement activities,
including outcomes evaluation and development of clinical guidelines,
provided that the obtaining of generalizable knowledge is not the
primary purpose of any studies resulting from such activities; patient
safety activities (as defined in 42 CFR 3.20); population-based
activities relating to improving health or reducing health care costs,
protocol development, case management and care coordination, contacting
of health care providers and patients with information about treatment
alternatives; and related functions that do not include treatment;
* * * * *
Marketing: (1) Except as provided in paragraph (2) of this
definition, marketing means to make a communication about a product or
service that encourages recipients of the communication to purchase or
use the product or service.
(2) Marketing does not include a communication made:
(i) For treatment of an individual by a health care provider,
including case management or care coordination for the individual, or
to direct or recommend alternative treatments, therapies, health care
providers, or settings of care to the individual, provided, however,
that if the communication is in writing and the health care provider
receives financial remuneration in exchange for making the
communication, the requirements of Sec. 164.514(f)(2) are met.
(ii) To provide refill reminders or otherwise communicate about a
drug or biologic that is currently being prescribed for the individual,
only if any financial remuneration received by the covered entity in
exchange for making the communication is reasonably related to the
covered entity's cost of making the communication.
(iii) For the following health care operations activities, except
where the covered entity receives financial remuneration in exchange
for making the communication:
(A) To describe a health-related product or service (or payment for
such product or service) that is provided by, or included in a plan of
benefits of, the covered entity making the communication, including
communications about: The entities participating in a health care
provider network or health plan network; replacement of, or
enhancements to, a health plan; and health-related products or services
available only to a health plan enrollee that add value to, but are not
part of, a plan of benefits; or
(B) For case management or care coordination, contacting of
individuals with information about treatment alternatives, and related
functions to the extent these activities do not fall within the
definition of treatment.
[[Page 40919]]
(3) Financial remuneration means direct or indirect payment from or
on behalf of a third party whose product or service is being described.
Direct or indirect payment does not include any payment for treatment
of an individual.
* * * * *
41. In Sec. 164.502, revise paragraphs (a), (b)(1), (e), and (f)
to read as follows:
Sec. 164.502 Uses and disclosures of protected health information:
General rules.
(a) Standard. A covered entity or business associate may not use or
disclose protected health information, except as permitted or required
by this subpart or by subpart C of part 160 of this subchapter.
(1) Covered entities: Permitted uses and disclosures. A covered
entity is permitted to use or disclose protected health information as
follows:
(i) To the individual;
(ii) For treatment, payment, or health care operations, as
permitted by and in compliance with Sec. 164.506;
(iii) Incident to a use or disclosure otherwise permitted or
required by this subpart, provided that the covered entity has complied
with the applicable requirements of Sec. Sec. 164.502(b), 164.514(d),
and 164.530(c) with respect to such otherwise permitted or required use
or disclosure;
(iv) Pursuant to and in compliance with a valid authorization under
Sec. 164.508;
(v) Pursuant to an agreement under, or as otherwise permitted by,
Sec. 164.510; and
(vi) As permitted by and in compliance with this section, Sec.
164.512, Sec. 164.514(e), (f), or (g).
(2) Covered entities: Required disclosures. A covered entity is
required to disclose protected health information:
(i) To an individual, when requested under, and required by Sec.
164.524 or Sec. 164.528; and
(ii) When required by the Secretary under subpart C of part 160 of
this subchapter to investigate or determine the covered entity's
compliance with this subchapter.
(3) [Reserved]
(4) Business associates: Permitted uses and disclosures. (i) A
business associate may use or disclose protected health information
only as permitted or required by its business associate contract or
other arrangement pursuant to Sec. 164.504(e), or as required by law.
The business associate may not use or disclose protected health
information in a manner that would violate the requirements of this
subpart, if done by the covered entity, except for the purposes
specified under Sec. 164.504(e)(2)(i)(A) or (B) if such uses or
disclosures are permitted by its contract or other arrangement.
(5) Business associates: Required uses and disclosures. A business
associate is required to disclose protected health information:
(i) When required by the Secretary under subpart C of part 160 of
this subchapter to investigate or determine the business associate's
compliance with this subchapter.
(ii) To the covered entity, individual, or individual's designee,
as necessary to satisfy a covered entity's obligations under Sec.
164.524(c)(2)(ii) and (3)(ii) with respect to an individual's request
for an electronic copy of protected health information.
(b) * * * (1) Minimum necessary applies. When using or disclosing
protected health information or when requesting protected health
information from another covered entity, a covered entity or business
associate must make reasonable efforts to limit protected health
information to the minimum necessary to accomplish the intended purpose
of the use, disclosure, or request.
* * * * *
(e)(1) Standard: Disclosures to business associates. (i) A covered
entity may disclose protected health information to a business
associate and may allow a business associate to create or receive
protected health information on its behalf, if the covered entity
obtains satisfactory assurance that the business associate will
appropriately safeguard the information. A covered entity is not
required to obtain such satisfactory assurances from a business
associate that is a subcontractor.
(ii) A business associate may disclose protected health information
to a business associate that is a subcontractor and may allow the
subcontractor to create or receive protected health information on its
behalf, if the business associate obtains satisfactory assurances, in
accordance with Sec. 164.504(e)(1)(i), that the subcontractor will
appropriately safeguard the information.
(2) Implementation specification: Documentation. The satisfactory
assurances required by paragraph (e)(1) of this section must be
documented through a written contract or other written agreement or
arrangement with the business associate that meets the applicable
requirements of Sec. 164.504(e).
(f) Standard: Deceased individuals. A covered entity must comply
with the requirements of this subpart with respect to the protected
health information of a deceased individual for a period of 50 years
following the death of the individual.
* * * * *
42. In Sec. 164.504, revise paragraphs (e) and (f)(2)(ii)(B) to
read as follows:
Sec. 164.504 Uses and disclosures: Organizational requirements.
* * * * *
(e)(1) Standard: Business associate contracts. (i) The contract or
other arrangement required by Sec. 164.502(e)(2) must meet the
requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as
applicable.
(ii) A covered entity is not in compliance with the standards in
Sec. 164.502(e) and this paragraph, if the covered entity knew of a
pattern of activity or practice of the business associate that
constituted a material breach or violation of the business associate's
obligation under the contract or other arrangement, unless the covered
entity took reasonable steps to cure the breach or end the violation,
as applicable, and, if such steps were unsuccessful, terminated the
contract or arrangement, if feasible.
(iii) A business associate is not in compliance with the standards
in Sec. 164.502(e) and this paragraph, if the business associate knew
of a pattern of activity or practice of a subcontractor that
constituted a material breach or violation of the subcontractor's
obligation under the contract or other arrangement, unless the business
associate took reasonable steps to cure the breach or end the
violation, as applicable, and, if such steps were unsuccessful,
terminated the contract or arrangement, if feasible.
(2) Implementation specifications: Business associate contracts. A
contract between the covered entity and a business associate must:
(i) Establish the permitted and required uses and disclosures of
protected health information by the business associate. The contract
may not authorize the business associate to use or further disclose the
information in a manner that would violate the requirements of this
subpart, if done by the covered entity, except that:
(A) The contract may permit the business associate to use and
disclose protected health information for the proper management and
administration of the business associate, as provided in paragraph
(e)(4) of this section; and
(B) The contract may permit the business associate to provide data
aggregation services relating to the health care operations of the
covered entity.
(ii) Provide that the business associate will:
[[Page 40920]]
(A) Not use or further disclose the information other than as
permitted or required by the contract or as required by law;
(B) Use appropriate safeguards and comply, where applicable, with
subpart C of this part with respect to electronic protected health
information, to prevent use or disclosure of the information other than
as provided for by its contract;
(C) Report to the covered entity any use or disclosure of the
information not provided for by its contract of which it becomes aware,
including breaches of unsecured protected health information as
required by Sec. 164.410;
(D) In accordance with Sec. 164.502(e)(1)(ii), ensure that any
subcontractors that create or receive protected health information on
behalf of the business associate agree to the same restrictions and
conditions that apply to the business associate with respect to such
information;
(E) Make available protected health information in accordance with
Sec. 164.524;
(F) Make available protected health information for amendment and
incorporate any amendments to protected health information in
accordance with Sec. 164.526;
(G) Make available the information required to provide an
accounting of disclosures in accordance with Sec. 164.528;
(H) To the extent the business associate is to carry out a covered
entity's obligation under this subpart, comply with the requirements of
this subpart that apply to the covered entity in the performance of
such obligation.
(I) Make its internal practices, books, and records relating to the
use and disclosure of protected health information received from, or
created or received by the business associate on behalf of, the covered
entity available to the Secretary for purposes of determining the
covered entity's compliance with this subpart; and
(J) At termination of the contract, if feasible, return or destroy
all protected health information received from, or created or received
by the business associate on behalf of, the covered entity that the
business associate still maintains in any form and retain no copies of
such information or, if such return or destruction is not feasible,
extend the protections of the contract to the information and limit
further uses and disclosures to those purposes that make the return or
destruction of the information infeasible.
(iii) Authorize termination of the contract by the covered entity,
if the covered entity determines that the business associate has
violated a material term of the contract.
(3) Implementation specifications: Other arrangements. (i) If a
covered entity and its business associate are both governmental
entities:
(A) The covered entity may comply with this paragraph and Sec.
164.314(a)(1), if applicable, by entering into a memorandum of
understanding with the business associate that contains terms that
accomplish the objectives of paragraph (e)(2) of this section and Sec.
164.314(a)(2), if applicable.
(B) The covered entity may comply with this paragraph and Sec.
164.314(a)(1), if applicable, if other law (including regulations
adopted by the covered entity or its business associate) contains
requirements applicable to the business associate that accomplish the
objectives of paragraph (e)(2) of this section and Sec. 164.314(a)(2),
if applicable.
(ii) If a business associate is required by law to perform a
function or activity on behalf of a covered entity or to provide a
service described in the definition of business associate in Sec.
160.103 of this subchapter to a covered entity, such covered entity may
disclose protected health information to the business associate to the
extent necessary to comply with the legal mandate without meeting the
requirements of this paragraph and Sec. 164.314(a)(1), if applicable,
provided that the covered entity attempts in good faith to obtain
satisfactory assurances as required by paragraph (e)(2) of this section
and Sec. 164.314(a)(1), if applicable, and, if such attempt fails,
documents the attempt and the reasons that such assurances cannot be
obtained.
(iii) The covered entity may omit from its other arrangements the
termination authorization required by paragraph (e)(2)(iii) of this
section, if such authorization is inconsistent with the statutory
obligations of the covered entity or its business associate.
(4) Implementation specifications: Other requirements for contracts
and other arrangements. (i) The contract or other arrangement between
the covered entity and the business associate may permit the business
associate to use the protected health information received by the
business associate in its capacity as a business associate to the
covered entity, if necessary:
(A) For the proper management and administration of the business
associate; or
(B) To carry out the legal responsibilities of the business
associate.
(ii) The contract or other arrangement between the covered entity
and the business associate may permit the business associate to
disclose the protected health information received by the business
associate in its capacity as a business associate for the purposes
described in paragraph (e)(4)(i) of this section, if:
(A) The disclosure is required by law; or
(B)(1) The business associate obtains reasonable assurances from
the person to whom the information is disclosed that it will be held
confidentially and used or further disclosed only as required by law or
for the purposes for which it was disclosed to the person; and
(2) The person notifies the business associate of any instances of
which it is aware in which the confidentiality of the information has
been breached.
(5) Implementation specifications: Business associate contracts
with subcontractors. The requirements of Sec. 164.504(e)(2) through
(e)(4) apply to the contract or other arrangement required by Sec.
164.502(e)(1)(ii) between a business associate and a business associate
that is a subcontractor in the same manner as such requirements apply
to contracts or other arrangements between a covered entity and
business associate.
(f) * * *
(2) * * *
(ii) * * *
(B) Ensure that any agents to whom it provides protected health
information received from the group health plan agree to the same
restrictions and conditions that apply to the plan sponsor with respect
to such information;
* * * * *
43. Revise Sec. 164.506(c)(5) to read as follows:
Sec. 164.506 Uses and disclosures to carry out treatment, payment, or
health care operations.
* * * * *
(c) * * *
(5) A covered entity that participates in an organized health care
arrangement may disclose protected health information about an
individual to other participants in the organized health care
arrangement for any health care operations activities of the organized
health care arrangement.
44. Amend Sec. 164.508 as follows:
a. Revise the headings of paragraphs (a), (a)(1), and (a)(2);
b. Revise paragraph (a)(3)(ii);
c. Add new paragraph (a)(4); and
d. Revise paragraphs (b)(1)(i), and (b)(3).
The revisions and additions read as follows:
[[Page 40921]]
Sec. 164.508 Uses and disclosures for which an authorization is
required.
(a) Standard: Authorizations for uses and disclosures--(1)
Authorization required: General rule. * * *
(2) Authorization required: Psychotherapy notes. * * *
(3) * * *
(ii) If the marketing involves direct or indirect financial
remuneration, as defined in paragraph (3) of the definition of
marketing at Sec. 164.501, to the covered entity from a third party,
the authorization must state that such remuneration is involved.
(4) Authorization required: Sale of protected health information.
(i) Notwithstanding any provision of this subpart, a covered entity
must obtain an authorization for any disclosure of protected health
information for which the disclosure is in exchange for direct or
indirect remuneration from or on behalf of the recipient of the
protected health information. Such authorization must state that the
disclosure will result in remuneration to the covered entity.
(ii) Paragraph (a)(4)(i) of this section does not apply to
disclosures of protected health information:
(A) For public health purposes pursuant to Sec. 164.512(b) or
Sec. 164.514(e);
(B) For research purposes pursuant to Sec. 164.512(i) or Sec.
164.514(e), where the only remuneration received by the covered entity
is a reasonable cost-based fee to cover the cost to prepare and
transmit the protected health information for such purposes;
(C) For treatment and payment purposes pursuant to Sec.
164.506(a);
(D) For the sale, transfer, merger, or consolidation of all or part
of the covered entity and for related due diligence as described in
paragraph (6)(iv) of the definition of health care operations and
pursuant to Sec. 164.506(a);
(E) To or by a business associate for activities that the business
associate undertakes on behalf of a covered entity pursuant to
Sec. Sec. 164.502(e) and 164.504(e), and the only remuneration
provided is by the covered entity to the business associate for the
performance of such activities;
(F) To an individual, when requested under Sec. 164.524 or Sec.
164.528;
(G) Required by law as permitted under Sec. 164.512(a); and
(H) Permitted by and in accordance with the applicable requirements
of this subpart, where the only remuneration received by the covered
entity is a reasonable, cost-based fee to cover the cost to prepare and
transmit the protected health information for such purpose or a fee
otherwise expressly permitted by other law.
(b) * * *
(1) * * *
(i) A valid authorization is a document that meets the requirements
in paragraphs (a)(3)(ii), (a)(4)(i), (c)(1), and (c)(2) of this
section, as applicable.
* * * * *
(3) Compound authorizations. An authorization for use or disclosure
of protected health information may not be combined with any other
document to create a compound authorization, except as follows:
(i) An authorization for the use or disclosure of protected health
information for a research study may be combined with any other type of
written permission for the same or another research study. This
exception includes combining an authorization for the use or disclosure
of protected health information for a research study with another
authorization for the same research study, with an authorization for
the creation or maintenance of a research database or repository, or
with a consent to participate in research. Where a covered health care
provider has conditioned the provision of research-related treatment on
the provision of one of the authorizations, as permitted under
paragraph (b)(4)(i) of this section, any compound authorization created
under this paragraph must clearly differentiate between the conditioned
and unconditioned components and provide the individual with an
opportunity to opt in to the research activities described in the
unconditioned authorization.
(ii) An authorization for a use or disclosure of psychotherapy
notes may only be combined with another authorization for a use or
disclosure of psychotherapy notes.
(iii) An authorization under this section, other than an
authorization for a use or disclosure of psychotherapy notes, may be
combined with any other such authorization under this section, except
when a covered entity has conditioned the provision of treatment,
payment, enrollment in the health plan, or eligibility for benefits
under paragraph (b)(4) of this section on the provision of one of the
authorizations. The prohibition in this paragraph on combining
authorizations where one authorization conditions the provision of
treatment, payment, enrollment in a health plan, or eligibility for
benefits under paragraph (b)(4) of this section does not apply to a
compound authorization created in accordance with paragraph (b)(3)(i)
of this section.
* * * * *
45. Amend Sec. 164.510 as follows:
a. Revise paragraph (a)(1)(ii) introductory text;
b. Revise paragraph (b)(1)(i), the second sentence of paragraph
(b)(1)(ii), paragraph (b)(2)(iii), the first sentence of paragraph
(b)(3), and paragraph (b)(4); and
c. Add new paragraph (b)(5).
The revisions and additions read as follows:
Sec. 164.510 Uses and disclosures requiring an opportunity for the
individual to agree or to object.
* * * * *
(a) * * *
(1) * * *
(ii) Use or disclose for directory purposes such information:
* * * * *
(b) * * *
(1) * * *
(i) A covered entity may, in accordance with paragraphs (b)(2),
(b)(3), or (b)(5) of this section, disclose to a family member, other
relative, or a close personal friend of the individual, or any other
person identified by the individual, the protected health information
directly relevant to such person's involvement with the individual's
health care or payment related to the individual's health care.
(ii) * * * Any such use or disclosure of protected health
information for such notification purposes must be in accordance with
paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as
applicable.
* * * * *
(2) * * *
(iii) Reasonably infers from the circumstances, based on the
exercise of professional judgment, that the individual does not object
to the disclosure.
(3) * * * If the individual is not present, or the opportunity to
agree or object to the use or disclosure cannot practicably be provided
because of the individual's incapacity or an emergency circumstance,
the covered entity may, in the exercise of professional judgment,
determine whether the disclosure is in the best interests of the
individual and, if so, disclose only the protected health information
that is directly relevant to the person's involvement with the
individual's care or payment related to the individual's health care or
needed for notification purposes. * * *
(4) Uses and disclosures for disaster relief purposes. A covered
entity may use or disclose protected health information to a public or
private entity authorized by law or by its charter to assist in
disaster relief efforts, for the purpose of coordinating with such
entities the uses or disclosures
[[Page 40922]]
permitted by paragraph (b)(1)(ii) of this section. The requirements in
paragraphs (b)(2), (b)(3), or (b)(5) of this section apply to such uses
and disclosures to the extent that the covered entity, in the exercise
of professional judgment, determines that the requirements do not
interfere with the ability to respond to the emergency circumstances.
(5) Uses and disclosures when the individual is deceased. If the
individual is deceased, a covered entity may disclose protected health
information of the individual to a family member, or other persons
identified in paragraph (b)(1) of this section who were involved in the
individual's care or payment for health care prior to the individual's
death, unless doing so is inconsistent with any prior expressed
preference of the individual that is known to the covered entity.
46. Amend Sec. 164.512 as follows:
a. Revise the introductory text of paragraph (b)(1) and the
introductory text of paragraph (b)(1)(v)(A);
b. Add new paragraph (b)(1)(vi);
c. Revise the introductory text of paragraph (e)(1)(iii) and
paragraph (e)(1)(vi);
d. Revise paragraph (i)(2)(iii); and
e. Revise paragraphs (k)(1)(ii), (k)(3), and (k)(5)(i)(E).
The revisions and additions read as follows:
Sec. 164.512 Uses and disclosures for which an authorization or
opportunity to agree or object is not required.
* * * * *
(b) Standard: Uses and disclosures for public health activities.
(1) Permitted uses and disclosures. A covered entity may use or
disclose protected health information for the public health activities
and purposes described in this paragraph to:
* * * * *
(v) * * *
(A) The covered entity is a covered health care provider who
provides health care to the individual at the request of the employer:
* * * * *
(vi) A school, about an individual who is a student or prospective
student of the school, if:
(A) The protected health information that is disclosed is limited
to proof of immunization;
(B) The school is required by State or other law to have such proof
of immunization prior to admitting the individual; and
(C) The covered entity obtains the agreement to the disclosure from
either:
(1) A parent, guardian, or other person acting in loco parentis of
the individual, if the individual is an unemancipated minor; or
(2) The individual, if the individual is an adult or emancipated
minor.
* * * * *
(e) * * *
(1) * * *
(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section,
a covered entity receives satisfactory assurances from a party seeking
protected health information if the covered entity receives from such
party a written statement and accompanying documentation demonstrating
that: * * *
* * * * *
(vi) Notwithstanding paragraph (e)(1)(ii) of this section, a
covered entity may disclose protected health information in response to
lawful process described in paragraph (e)(1)(ii) of this section
without receiving satisfactory assurance under paragraph (e)(1)(ii)(A)
or (B) of this section, if the covered entity makes reasonable efforts
to provide notice to the individual sufficient to meet the requirements
of paragraph (e)(1)(iii) of this section or to seek a qualified
protective order sufficient to meet the requirements of paragraph
(e)(1)(v) of this section.
* * * * *
(i) * * *
(2) * * *
(iii) Protected health information needed. A brief description of
the protected health information for which use or access has been
determined to be necessary by the IRB or privacy board, pursuant to
paragraph (i)(2)(ii)(C) of this section;
* * * * *
(k) * * *
(1) * * *
(ii) Separation or discharge from military service. A covered
entity that is a component of the Departments of Defense or Homeland
Security may disclose to the Department of Veterans Affairs (DVA) the
protected health information of an individual who is a member of the
Armed Forces upon the separation or discharge of the individual from
military service for the purpose of a determination by DVA of the
individual's eligibility for or entitlement to benefits under laws
administered by the Secretary of Veterans Affairs.
* * * * *
(3) Protective services for the President and others. A covered
entity may disclose protected health information to authorized Federal
officials for the provision of protective services to the President or
other persons authorized by 18 U.S.C. 3056 or to foreign heads of state
or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct
of investigations authorized by 18 U.S.C. 871 and 879.
* * * * *
(5) * * *
(i) * * *
(E) Law enforcement on the premises of the correctional
institution; or
* * * * *
47. In Sec. 164.514, revise paragraphs (e)(4)(ii)(C)(4) and (f) to
read as follows:
Sec. 164.514 Other requirements relating to uses and disclosures of
protected health information.
* * * * *
(e) * * *
(4) * * *
(ii) * * *
(C) * * *
(4) Ensure that any agents to whom it provides the limited data set
agrees to the same restrictions and conditions that apply to the
limited data set recipient with respect to such information; and
* * * * *
(f) Fundraising and remunerated treatment communications.
(1)(i) Standard: Uses and disclosures for fundraising. Subject to
the conditions of paragraph (f)(1)(ii) of this section, a covered
entity may use, or disclose to a business associate or to an
institutionally related foundation, the following protected health
information for the purpose of raising funds for its own benefit,
without an authorization meeting the requirements of Sec. 164.508:
(A) Demographic information relating to an individual; and
(B) Dates of health care provided to an individual.
(ii) Implementation specifications: Fundraising requirements. (A) A
covered entity may not use or disclose protected health information for
fundraising purposes as otherwise permitted by paragraph (f)(1)(i) of
this section unless a statement required by Sec. 164.520(b)(1)(iii)(B)
is included in the covered entity's notice of privacy practices.
(B) With each fundraising communication sent to an individual under
this paragraph, a covered entity must provide the individual with a
clear and conspicuous opportunity to elect not to receive any further
fundraising communications. The method for an individual to elect not
to receive further fundraising communications may not cause the
individual to incur an undue burden or more than a nominal cost.
(C) A covered entity may not condition treatment or payment on the
individual's choice with respect to the receipt of fundraising
communications.
(D) A covered entity may not send fundraising communications to an
[[Page 40923]]
individual under this paragraph where the individual has elected not to
receive such communications under paragraph (f)(1)(ii)(B) of this
section.
(2) Standard: Uses and disclosures for remunerated treatment
communications. Where a covered health care provider receives financial
remuneration, as defined in paragraph (3) of the definition of
marketing at Sec. 164.501, in exchange for making a treatment
communication to an individual about a health-related product or
service, such communication is not marketing and does not require an
authorization meeting the requirements of Sec. 164.508, only if the
following requirements are met:
(i) The covered health care provider has included the information
required by Sec. 164.520(b)(1)(iii)(A) in its notice of privacy
practices; and
(ii) The communication discloses the fact that the covered health
care provider is receiving financial remuneration in exchange for
making the communication and provides the individual with a clear and
conspicuous opportunity to elect not to receive any further such
communications. The method for an individual to elect not to receive
further such communications may not cause the individual to incur an
undue burden or more than a nominal cost.
* * * * *
48. In Sec. 164.520, revise paragraphs (b)(1)(ii)(E), (b)(1)(iii),
and (b)(1)(iv)(A) to read as follows:
Sec. 164.520 Notice of privacy practices for protected health
information.
* * * * *
(b) * * *
(1) * * *
(ii) * * *
(E) A description of the types of uses and disclosures that require
an authorization under Sec. 164.508(a)(2)-(a)(4), a statement that
other uses and disclosures not described in the notice will be made
only with the individual's written authorization, and a statement that
the individual may revoke an authorization as provided by Sec.
164.508(b)(5).
(iii) Separate statements for certain uses or disclosures. If the
covered entity intends to engage in any of the following activities,
the description required by paragraph (b)(1)(ii)(A) of this section
must include a separate statement informing the individual of such
activities, as applicable:
(A) In accordance with Sec. 164.514(f)(2), the covered health care
provider may send treatment communications to the individual concerning
treatment alternatives or other health-related products or services
where the provider receives financial remuneration, as defined in
paragraph (3) of the definition of marketing at Sec. 164.501, in
exchange for making the communications, and the individual has a right
to opt out of receiving such communications;
(B) In accordance with Sec. 164.514(f)(1), the covered entity may
contact the individual to raise funds for the covered entity and the
individual has a right to opt out of receiving such communications; or
(C) In accordance with Sec. 164.504(f), the group health plan, or
a health insurance issuer or HMO with respect to a group health plan,
may disclose protected health information to the sponsor of the plan.
(iv) * * *
(A) The right to request restrictions on certain uses and
disclosures of protected health information as provided by Sec.
164.522(a), including a statement that the covered entity is not
required to agree to a requested restriction, except in case of a
disclosure restricted under Sec. 164.522(a)(1)(vi);
* * * * *
49. Amend Sec. 164.522 as follows:
a. Revise paragraph (a)(1)(ii);
b. Add new paragraph (a)(1)(vi); and
c. Revise the introductory text of paragraph (a)(2), and paragraphs
(a)(2)(iii), and paragraph (a)(3).
The revisions and additions read as follows:
Sec. 164.522 Rights to request privacy protection for protected
health information.
(a)(1) * * *
(ii) Except as provided in paragraph (a)(1)(vi) of this section, a
covered entity is not required to agree to a restriction.
* * * * *
(vi) A covered entity must agree to the request of an individual to
restrict disclosure of protected health information about the
individual to a health plan if:
(A) The disclosure is for the purpose of carrying out payment or
health care operations and is not otherwise required by law; and
(B) The protected health information pertains solely to a health
care item or service for which the individual, or person other than the
health plan on behalf of the individual, has paid the covered entity in
full.
(2) Implementation specifications: Terminating a restriction. A
covered entity may terminate a restriction, if:
* * * * *
(iii) The covered entity informs the individual that it is
terminating its agreement to a restriction, except that such
termination is:
(A) Not effective for protected health information restricted under
paragraph (a)(1)(vi) of this section; and
(B) Only effective with respect to protected health information
created or received after it has so informed the individual.
(3) Implementation specification: Documentation. A covered entity
must document a restriction in accordance with Sec. 160.530(j) of this
subchapter.
* * * * *
50. Amend Sec. 164.524 as follows:
a. Revise paragraph (c)(2)(i);
b. Redesignate paragraph (c)(2)(ii) as paragraph (c)(2)(iii);
c. Add new paragraph (c)(2)(ii);
d. Revise paragraphs (c)(3) and (c)(4)(i);
e. Redesignate paragraphs (c)(4)(ii) and (c)(4)(iii) as paragraphs
(c)(4)(iii) and (c)(4)(iv), respectively; and
f. Add new paragraph (c)(4)(ii).
The revisions and additions read as follows:
Sec. 164.524 Access of individuals to protected health information.
* * * * *
(c) * * *
(2) Form of access requested. (i) The covered entity must provide
the individual with access to the protected health information in the
form and format requested by the individual, if it is readily
producible in such form and format; or, if not, in a readable hard copy
form or such other form and format as agreed to by the covered entity
and the individual.
(ii) Notwithstanding paragraph (c)(2)(i) of this section, if the
protected health information that is the subject of a request for
access is maintained in one or more designated record sets
electronically and if the individual requests an electronic copy of
such information, the covered entity must provide the individual with
access to the protected health information in the electronic form and
format requested by the individual, if it is readily producible in such
form and format; or, if not, in a readable electronic form and format
as agreed to by the covered entity and the individual.
* * * * *
(3) Time and manner of access. (i) The covered entity must provide
the access as requested by the individual in a timely manner as
required by paragraph (b)(2) of this section, including arranging with
the individual for a convenient time and place to inspect or obtain a
copy of the protected health information, or mailing the copy of the
protected health information at the individual's request. The covered
entity may discuss the scope, format,
[[Page 40924]]
and other aspects of the request for access with the individual as
necessary to facilitate the timely provision of access.
(ii) If an individual's request for access directs the covered
entity to transmit the copy of protected health information directly to
another person designated by the individual, the covered entity must
provide the copy to the person designated by the individual. The
individual's request must be in writing, signed by the individual, and
clearly identify the designated person and where to send the copy of
protected health information.
(4) * * *
(i) Labor for copying the protected health information requested by
the individual, whether in paper or electronic form;
(ii) Supplies for creating the paper copy or electronic media if
the individual requests that the electronic copy be provided on
portable media;
* * * * *
51. In Sec. 164.532, revise paragraphs (d), (e)(1) and (e)(2) to
read as follows:
Sec. 164.532 Transition provisions.
* * * * *
(d) Standard: Effect of prior contracts or other arrangements with
business associates. Notwithstanding any other provisions of this part,
a covered entity, or business associate with respect to a
subcontractor, may disclose protected health information to a business
associate and may allow a business associate to create, receive, or use
protected health information on its behalf pursuant to a written
contract or other written arrangement with such business associate that
does not comply with Sec. Sec. 164.308(b), 164.314(a), 164.502(e), and
164.504(e), only in accordance with paragraph (e) of this section.
(e) Implementation specification: Deemed compliance. (1)
Qualification. Notwithstanding other sections of this part, a covered
entity, or business associate with respect to a subcontractor, is
deemed to be in compliance with the documentation and contract
requirements of Sec. Sec. 164.308(b), 164.314(a), 164.502(e), and
164.504(e), with respect to a particular business associate
relationship, for the time period set forth in paragraph (e)(2) of this
section, if:
(i) Prior to [DATE OF PUBLICATION OF THE FINAL RULE IN THE FEDERAL
REGISTER], such covered entity, or business associate with respect to a
subcontractor, has entered into and is operating pursuant to a written
contract or other written arrangement with the business associate that
complies with the applicable provisions of Sec. Sec. 164.314(a) or
164.504(e) that were in effect on such date; and
(ii) The contract or other arrangement is not renewed or modified
from [DATE THAT IS 60 DAYS AFTER DATE OF PUBLICATION OF THE FINAL RULE
IN THE FEDERAL REGISTER], until [DATE THAT IS 240 DAYS AFTER DATE OF
PUBLICATION OF THE FINAL RULE IN THE FEDERAL REGISTER].
(2) Limited deemed compliance period. A prior contract or other
arrangement that meets the qualification requirements in paragraph (e)
of this section shall be deemed compliant until the earlier of:
(i) The date such contract or other arrangement is renewed or
modified on or after [DATE THAT IS 240 DAYS AFTER DATE OF PUBLICATION
OF THE FINAL RULE IN THE FEDERAL REGISTER]; or
(ii) [DATE THAT IS ONE YEAR AND 240 DAYS AFTER DATE OF PUBLICATION
OF THE FINAL RULE IN THE FEDERAL REGISTER].
* * * * *
Dated: April 9, 2010.
Kathleen Sebelius,
Secretary.
Editorial Note: This document was received in the Office of the
Federal Register on July 2, 2010.
[FR Doc. 2010-16718 Filed 7-8-10; 8:45 am]
BILLING CODE 4153-01-P