5566

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

DEPARTMENT OF HEALTH AND
HUMAN SERVICES

I. Executive Summary and Backgroundii. Summary of Major Provisions

A. Executive Summary

Office of the Secretary

i. Purpose of the Regulatory Action

This omnibus final rule is comprisedof the following four final rules:
1. Final modifications to the HIPAA
Privacy, Security, and Enforcement
Rules mandated by the Health
Information Technology for Economic
and Clinical Health (HITECH) Act, andcertain other modifications to improve
the Rules, which were issued as aproposed rule on July 14, 2010. These
modifications:• Make business associates of covered
entities directly liable for compliancewith certain of the HIPAA Privacy andSecurity Rules’ requirements.
• Strengthen the limitations on theuse and disclosure of protected healthinformation for marketing andfundraising purposes, and prohibit thesale of protected health information
without individual authorization.
• Expand individuals’ rights toreceive electronic copies of their healthinformation and to restrict disclosures
to a health plan concerning treatment
for which the individual has paid out of
pocket in full.
• Require modifications to, andredistribution of, a covered entity’s
notice of privacy practices.
• Modify the individual authorizationand other requirements to facilitate
research and disclosure of child
immunization proof to schools, and toenable access to decedent information
by family members or others.
• Adopt the additional HITECH Act
enhancements to the Enforcement Rulenot previously adopted in the October30, 2009, interim final rule (referenced
immediately below), such as theprovisions addressing enforcement of
noncompliance with the HIPAA Rules
due to willful neglect.
2. Final rule adopting changes to the
HIPAA Enforcement Rule to incorporate
the increased and tiered civil money
penalty structure provided by the
HITECH Act, originally published as aninterim final rule on October 30, 2009.
3. Final rule on Breach Notification
for Unsecured Protected Health
Information under the HITECH Act,
which replaces the breach notification
rule’s ‘‘harm’’ threshold with a moreobjective standard and supplants aninterim final rule published on August24, 2009.
4. Final rule modifying the HIPAA
Privacy Rule as required by the Genetic
Information Nondiscrimination Act(GINA) to prohibit most health plansfrom using or disclosing genetic
information for underwriting purposes,
which was published as a proposed ruleon October 7, 2009.

Need for the Regulatory Action

45 CFR Parts 160 and 164
RIN 0945–AA03

Modifications to the HIPAA Privacy,
Security, Enforcement, and Breach
Notification Rules Under the Health
Information Technology for Economic
and Clinical Health Act and the Genetic
Information Nondiscrimination Act;
Other Modifications to the HIPAA
Rules
AGENCY: Office for Civil Rights,

Department of Health and Human
Services.
ACTION: Final rule.
SUMMARY: The Department of Health andHuman Services (HHS or ‘‘theDepartment’’) is issuing this final rule
to: Modify the Health Insurance
Portability and Accountability Act(HIPAA) Privacy, Security, andEnforcement Rules to implement
statutory amendments under the Health
Information Technology for Economic
and Clinical Health Act (‘‘the HITECH
Act’’ or ‘‘the Act’’) to strengthen theprivacy and security protection for
individuals’ health information; modify
the rule for Breach Notification for
Unsecured Protected Health Information(Breach Notification Rule) under the
HITECH Act to address public comment
received on the interim final rule;
modify the HIPAA Privacy Rule tostrengthen the privacy protections forgenetic information by implementing
section 105 of Title I of the Genetic
Information Nondiscrimination Act of2008 (GINA); and make certain othermodifications to the HIPAA Privacy,
Security, Breach Notification, andEnforcement Rules (the HIPAA Rules) toimprove their workability andeffectiveness and to increase flexibility
for and decrease burden on theregulated entities.

sroberts on DSK5SPTVN1PROD withDATES: Effective date: This final rule iseffective on March 26, 2013.
Compliance date: Covered entities
and business associates must comply
with the applicable requirements of thisfinal rule by September 23, 2013.
FOR FURTHER INFORMATION CONTACT:

Andra Wicks 202–205–2292.
SUPPLEMENTARY INFORMATION:

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

This final rule is needed to strengthen
the privacy and security protections
established under the Health Insurance
Portability and Accountability of 1996
Act (HIPAA) for individual’s healthinformation maintained in electronic
health records and other formats. This
final rule also makes changes to the
HIPAA rules that are designed toincrease flexibility for and decrease
burden on the regulated entities, as wellas to harmonize certain requirementswith those under the Department’s
Human Subjects Protections regulations.
These changes are consistent with, andarise in part from, the Department’s
obligations under Executive Order
13563 to conduct a retrospective review
of our existing regulations for the
purpose of identifying ways to reduce
costs and increase flexibilities under the
HIPAA Rules. We discuss our specificburden reduction efforts more fully in
the Regulatory Impact Analysis.
This final rule is comprised of four
final rules, which have been combined
to reduce the impact and number oftimes certain compliance activities need
to be undertaken by the regulated
entities.
Legal Authority for the Regulatory
ActionThe final rule implements changes tothe HIPAA Rules under a number ofauthorities. First, the final rule modifies
the Privacy, Security, and Enforcement
Rules to strengthen privacy and security
protections for health information andto improve enforcement as provided forby the Health Information Technology
for Economic and Clinical Health(HITECH) Act, enacted as part of theAmerican Recovery and Reinvestment
Act of 2009 (ARRA). The rule also
includes final modifications to the
Breach Notification Rule, which will
replace an interim final rule originallypublished in 2009 as required by the
HITECH Act. Second, the final rule
revises the HIPAA Privacy Rule toincrease privacy protections for genetic
information as required by the Genetic
Information Nondiscrimination Act of2008 (GINA). Finally, the Department
uses its general authority under HIPAA
to make a number of changes to theRules that are intended to increase
workability and flexibility, decrease
burden, and better harmonize therequirements with those under other
Departmental regulations.

PO 00000

Frm 00002

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
iii. Costs and Benefits
This final rule is anticipated to havean annual effect on the economy of $100
million or more, making it an
economically significant rule under
Executive Order 12866. Accordingly, we
have prepared a Regulatory Impact
Analysis that presents the estimatedcosts and benefits of the proposed rule.
The total cost of compliance with therule’s provisions is estimated to be
between $114 million and $225.4
million in the first year of
implementation and approximately$14.5 million annually thereafter. Costs
associated with the rule include: (i)Costs to HIPAA covered entities ofrevising and distributing new notices ofprivacy practices to inform individualsof their rights and how their information
is protected; (ii) costs to covered entities
related to compliance with breach
notification requirements; (iii) costs to a
portion of business associates to bring
their subcontracts into compliance withbusiness associate agreement
requirements; and (iv) costs to a portionof business associates to achieve fullcompliance with the Security Rule. We
summarize these costs in Table 1 below
and explain the components anddistribution of costs in detail in theRegulatory Impact Analysis.
We are not able to quantify thebenefits of the rule due to lack of data

5567

and the impossibility of monetizing thevalue of individuals’ privacy anddignity, which we believe will beenhanced by the strengthened privacy
and security protections, expanded
individual rights, and improved
enforcement enabled by the rule. We
also believe that some entities affectedby the rule will realize cost savings as
a result of provisions that simplify andstreamline certain requirements, andincrease flexibility, under the HIPAA
Rules. However, we are unable toquantify such cost savings due to a lackof data. We describe such benefits in theRegulatory Impact Analysis.

TABLE 1—ESTIMATED COSTS OF THE FINAL RULE
Cost element

Approximate number of affected entities

Notices of Privacy Practices ...........
Breach Notification Requirements ..
Business Associate Agreements ....
Security Rule Compliance by Business Associates.

700,000 covered entities .......................................................................
19,000 covered entities .........................................................................
250,000–500,000 business associates of covered entities ...................
200,000–400,000 business associates of covered entities ...................

$55.9 million.
14.5 million.1
21 million–42 million.
22.6 million–113 million.

Total .........................................

................................................................................................................

114 million–225.4 million.

sroberts on DSK5SPTVN1PROD with

B. Statutory and Regulatory Backgroundi. HIPAA and the Privacy, Security, andEnforcement Rules
The HIPAA Privacy, Security, andEnforcement Rules implement certain of
the Administrative Simplification
provisions of title II, subtitle F, of the
Health Insurance Portability andAccountability Act of 1996 (HIPAA)(Pub. L. 104–191), which added a newpart C to title XI of the Social Security
Act (sections 1171–1179 of the Social
Security Act, 42 U.S.C. 1320d–1320d–
8). The HIPAA Administrative
Simplification provisions provided forthe establishment of national standards
for the electronic transmission of certain
health information, such as standards
for certain health care transactions
conducted electronically and code setsand unique identifiers for health careproviders and employers. The HIPAA
Administrative Simplification
provisions also required theestablishment of national standards toprotect the privacy and security of
personal health information andestablished civil money penalties forviolations of the Administrative
Simplification provisions. The
Administrative Simplification
provisions of HIPAA apply to three
types of entities, which are known as
1 The costs associated with breach notification
will be incurred on an annual basis. All other costs
are expected in the first year of implementation.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001‘‘covered entities’’: health care providers
who conduct covered health caretransactions electronically, health plans,
and health care clearinghouses.
The HIPAA Privacy Rule, 45 CFR Part
160 and Subparts A and E of Part 164,
requires covered entities to havesafeguards in place to ensure theprivacy of protected health information,
sets forth the circumstances underwhich covered entities may use or
disclose an individual’s protected
health information, and gives
individuals rights with respect to theirprotected health information, including
rights to examine and obtain a copy of
their health records and to request
corrections. Covered entities that engage
business associates to work on theirbehalf must have contracts or otherarrangements in place with theirbusiness associates to ensure that thebusiness associates safeguard protected
health information, and use anddisclose the information only as
permitted or required by the Privacy
Rule.
The HIPAA Security Rule, 45 CFRPart 160 and Subparts A and C of Part
164, applies only to protected healthinformation in electronic form andrequires covered entities to implementcertain administrative, physical, andtechnical safeguards to protect thiselectronic information. Like the Privacy
Rule, covered entities must havecontracts or other arrangements in place

PO 00000

Frm 00003

Fmt 4701

Sfmt 4700

Total costwith their business associates thatprovide satisfactory assurances that thebusiness associates will appropriately
safeguard the electronic protected
health information they create, receive,
maintain, or transmit on behalf of thecovered entities.
The HIPAA Enforcement Rule, 45
CFR Part 160, Subparts C–E, establishes
rules governing the complianceresponsibilities of covered entities withrespect to the enforcement process,including the rules governinginvestigations by the Department, rules
governing the process and grounds forestablishing the amount of a civil money
penalty where a violation of a HIPAA
Rule has been found, and rules
governing the procedures for hearings
and appeals where the covered entity
challenges a violation determination.
Since the promulgation of the HIPAA
Rules, legislation has been enacted
requiring modifications to the Rules. In
particular, the Health Information
Technology for Economic and Clinical
Health (HITECH) Act, which wasenacted on February 17, 2009, as title
XIII of division A and title IV of division
B of the American Recovery andReinvestment Act of 2009 (ARRA),
Public Law 111–5, modifies certain
provisions of the Social Security Act
pertaining to the HIPAA Rules, as well
as requires certain modifications to theRules themselves, to strengthen HIPAA
privacy, security, and enforcement. The

E:\FR\FM\25JAR2.SGM

25JAR2

5568

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with

Act also provides new requirements for
notification of breaches of unsecured
protected health information by covered
entities and business associates. In
addition, the Genetic Information
Nondiscrimination Act of 2008 (GINA)
calls for changes to the HIPAA Privacy
Rule to strengthen privacy protections
for genetic information. This final rule
implements the modifications requiredby GINA, as well as most of the privacy,
security, and enforcement provisions of
the HITECH Act. This final rule also
includes certain other modifications to
the HIPAA Rules to improve theirworkability and effectiveness.
ii. The Health Information Technology
for Economic and Clinical Health Act
The HITECH Act is designed topromote the widespread adoption andinteroperability of health information
technology. Subtitle D of title XIII,
entitled ‘‘Privacy,’’ supports this goal byadopting amendments designed tostrengthen the privacy and security
protections for health information
established by HIPAA. These provisions
include extending the applicability ofcertain of the Privacy and Security
Rules’ requirements to the businessassociates of covered entities; requiringthat Health Information Exchange
Organizations and similar organizations,as well as personal health record
vendors that provide services to covered
entities, shall be treated as businessassociates; requiring HIPAA covered
entities and business associates toprovide for notification of breaches of‘‘unsecured protected healthinformation’’; establishing new
limitations on the use and disclosure ofprotected health information formarketing and fundraising purposes;
prohibiting the sale of protected healthinformation; and expanding individuals’
rights to access their protected healthinformation, and to obtain restrictions
on certain disclosures of protected
health information to health plans. In
addition, subtitle D adopts provisions
designed to strengthen and expand
HIPAA’s enforcement provisions.
We discuss these statutory provisions
in more detail below where we describe
section-by-section how this final rule
implements the provisions. We do notaddress in this rulemaking theaccounting for disclosures requirement
in section 13405 of the Act, which is the
subject of a separate proposed rule
published on May 31, 2011, at 76 FR
31426, or the penalty distribution
methodology requirement in section
13410(c) of the Act, which will be thesubject of a future rulemaking.
Since enactment of the HITECH Act a
number of steps have been taken to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

implement the strengthened privacy,
security, and enforcement provisions
through rulemakings and related
actions. On August 24, 2009, theDepartment published interim final
regulations to implement the breach
notification provisions at section 13402
of the HITECH Act (74 FR 42740),
which were effective September 23,
2009. Similarly, the Federal Trade
Commission (FTC) published final
regulations implementing the breach
notification provisions at section 13407
for personal health record vendors andtheir third party service providers on
August 25, 2009 (74 FR 42962), effective
September 24, 2009. For purposes ofdetermining to what information the
HHS and FTC breach notification
regulations apply, the Department also
issued, first on April 17, 2009
(published on April 27, 2009, 74 FR
19006), and then later with its interim
final rule, the guidance required by the
HITECH Act under 13402(h) specifying
the technologies and methodologies that
render protected health information
unusable, unreadable, or indecipherable
to unauthorized individuals.
Additionally, to conform the provisionsof the Enforcement Rule to the HITECH
Act’s tiered and increased civil money
penalty structure, which became
effective on February 18, 2009, theDepartment published an interim final
rule on October 30, 2009 (74 FR 56123),
effective November 30, 2009.
The Department published a notice ofproposed rulemaking (NPRM) on July
14, 2010, (75 FR 40868) to implement
many of the remaining privacy, security,and enforcement provisions of the
HITECH Act. The public was invited tocomment on the proposed rule for 60
days following publication. The
comment period closed on September
13, 2010. The Department received
about 300 comments on the NPRM.
The NPRM proposed to extend theapplicability of certain of the Privacy
and Security Rules’ requirements to thebusiness associates of covered entities,
making business associates directly
liable for violations of theserequirements. Additionally, the NPRM
proposed to define a subcontractor as abusiness associate to ensure any
protected health information thesubcontractor creates or receives onbehalf of the business associate isappropriately safeguarded. The NPRM
proposed to establish new limitations
on the use and disclosure of protected
health information for marketing andfundraising purposes and to prohibit thesale of protected health information
without an authorization. The NPRM
also proposed to expand an individual’s
right to obtain an electronic copy of an

PO 00000

Frm 00004

Fmt 4701

Sfmt 4700

individual’s protected healthinformation, and the right to restrictcertain disclosures of protected healthinformation to a health plan for
payment or health care operations
purposes. In addition, the NPRM
proposed to further modify the
Enforcement Rule to implement more of
the HITECH Act’s changes to HIPAA
enforcement.
In addition to the proposed
modifications to implement the HITECH
Act, the NPRM also proposed certain
other modifications to the HIPAA Rules.
The NPRM proposed to permit the useof compound authorizations forconditioned and unconditioned
research activities and requested
comment regarding permitting
authorizations for future research.
Additionally, the NPRM proposed tomodify the Privacy Rule’s application to
the individually identifiable healthinformation of decedents and to permit
covered entities that obtain theagreement of a parent to provide proofof immunization without written
authorization to schools that are
required to have such information.
iii. The Genetic Information
Nondiscrimination Act
The Genetic Information
Nondiscrimination Act of 2008(‘‘GINA’’), Pub. L. 110–233, 122 Stat.
881, prohibits discrimination based on
an individual’s genetic information inboth the health coverage (Title I) andemployment (Title II) contexts. In
addition to the nondiscrimination
provisions, section 105 of Title I of
GINA contains new privacy protections
for genetic information, which require
the Secretary of HHS to revise thePrivacy Rule to clarify that genetic
information is health information and toprohibit group health plans, healthinsurance issuers (including HMOs),and issuers of Medicare supplemental
policies from using or disclosing genetic
information for underwriting purposes.
On October 7, 2009, the Department
published a proposed rule to strengthen
the privacy protections for genetic
information under the HIPAA Privacy
Rule by implementing the protections
for genetic information required by
GINA and making related changes to theRule. The 60-day public comment
period for the proposed rule closed on
December 7, 2009. The Department
received about 25 comments on the
proposed rule.
II. Overview of the Final RuleIn this final rule the Department
finalizes the modifications to the HIPAA
Privacy, Security, and Enforcement
Rules to implement many of the

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulationsprivacy, security, and enforcement
provisions of the HITECH Act and makeother changes to the Rules; modifies the
Breach Notification Rule; finalizes themodifications to the HIPAA Privacy
Rule to strengthen privacy protections
for genetic information; and responds tothe public comments received on the
proposed and interim final rules.
Section III below describes the effective
and compliance dates of the final rule.
Section IV describes the changes to the
HIPAA Privacy, Security, andEnforcement Rules under the HITECH
Act and other modifications that were
proposed in July 2010, as well as themodifications to the Enforcement Ruleunder the HITECH Act that wereaddressed in the interim final rule
published in October 2009. Section V
describes the changes to the Breach
Notification Rule. Section VI discusses
the changes to the HIPAA Privacy Ruleto strengthen privacy protections forgenetic information.

sroberts on DSK5SPTVN1PROD with

III. Effective and Compliance Dates
With respect to the HITECH Act
requirements, section 13423 of the Act
provides that the provisions in subtitle
D took effect one year after enactment,i.e., on February 18, 2010, except as
specified otherwise. However, there are
a number of exceptions to this general
rule. For example, the tiered andincreased civil money penalty
provisions of section 13410(d) wereeffective for violations occurring after
the date of enactment, and sections
13402 and 13407 of the Act regarding
breach notification required interim
final rules within 180 days ofenactment, with effective dates 30 days
after the publication of such rules. Other
provisions of the Act have later effective
dates. For example, the provision at
section 13410(a)(1) of the Act providingthat the Secretary’s authority to impose
a civil money penalty will only bebarred to the extent a criminal penalty
has been imposed, rather than in cases
in which the offense in question merely
constitutes an offense that is criminallypunishable, became effective forviolations occurring on or after February
18, 2011. The discussion below
generally pertains to the statutory
provisions that became effective on
February 18, 2010, or, in a few cases, ona later date.
Proposed Rule
We proposed that covered entities andbusiness associates would have 180
days beyond the effective date of the
final rule to come into compliance withmost of the rule’s provisions. We
believed that a 180-day complianceperiod would suffice for future

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

modifications to the HIPAA Rules, andwe proposed to add a provision at§ 160.105 to address the compliance
date generally for implementation of
new or modified standards in the
HIPAA Rules. We proposed that§ 160.105 would provide that withrespect to new standards or
implementation specifications ormodifications to standards or
implementation specifications in the
HIPAA Rules, except as otherwise
provided, covered entities and businessassociates would be required to comply
with the applicable new or modified
standards or implementation
specifications no later than 180 days
from the effective date of any suchchange. For future modifications to the
HIPAA Rules necessitating a longer
compliance period, we would specify alonger period in the regulatory text.
Finally, we proposed to retain thecompliance date provisions at§§ 164.534 and 164.318, which provide
the compliance dates of April 14, 2003,
and April 20, 2005, for initial
implementation of the HIPAA Privacy
and Security Rules, respectively, forhistorical purposes only.
Overview of Public Comments
Most of the comments addressing the
proposed compliance periods as
outlined above fell into three categories.
First, several commenters supported the
proposed compliance timelines andagreed that 180 days is sufficient time
for covered entities, business associates,and subcontractors of all sizes to comeinto compliance with the final rule.
Second, a few commenters supported
the proposed 180-day complianceperiod, but expressed concern that the
Department may wish to extend the 180day compliance period in the future, if
it issues modifications or new
provisions that require a longer
compliance period. Third, several
commenters requested that the
Department extend the 180-day
compliance period both with regard to
the modifications contained in this final
rule and with regard to the more general
proposed compliance deadline, as they
believe 180 days is an insufficientamount of time for covered entities,business associates, and subcontractors
to come into compliance with themodified rules, particularly with regard
to changes in technology.
Final Rule
The final rule is effective on March
26, 2013. Covered entities and businessassociates of all sizes will have 180 days
beyond the effective date of the final
rule to come into compliance with mostof the final rule’s provisions, including

PO 00000

Frm 00005

Fmt 4701

Sfmt 4700

5569

the modifications to the Breach
Notification Rule and the changes to the
HIPAA Privacy Rule under GINA. We
understand that some covered entities,business associates, and subcontractors
remain concerned that a 180-day period
does not provide sufficient time to comeinto compliance with the modifications.
However, we believe not only thatproviding a 180-day compliance period
best comports with section 1175(b)(2) of
the Social Security Act, 42 U.S.C.
1320d–4, and our implementing
provision at § 160.104(c)(1), which
require the Secretary to provide at leasta 180-day period for covered entities tocomply with modifications to standards
and implementation specifications in
the HIPAA Rules, but also thatproviding a 180-day compliance period
best protects the privacy and security ofpatient information, in accordance withthe goals of the HITECH Act.
In addition, to make clear to theindustry our expectation that going
forward we will provide a 180-day
compliance date for future
modifications to the HIPAA Rules, we
adopt the provision we proposed at§ 160.105, which provides that withrespect to new or modified standards or
implementation specifications in the
HIPAA Rules, except as otherwise
provided, covered entities and businessassociates must comply with theapplicable new or modified standards or
implementation specifications no later
than 180 days from the effective date ofany such change. In cases where afuture modification necessitates a longer
compliance period, the Department will
expressly provide for one, as it has donein this rulemaking with respect to thetime permitted for business associateagreements to be modified.
For the reasons proposed, the final
rule also retains the compliance dateprovisions at §§ 164.534 and 164.318,
which provide the compliance dates ofApril 14, 2003, and April 20, 2005, for
initial implementation of the HIPAA
Privacy and Security Rules,
respectively. We note that § 160.105
regarding the compliance date of new or
modified standards or implementation
specifications does not apply tomodifications to the provisions of the
HIPAA Enforcement Rule, because suchprovisions are not standards or
implementation specifications (as theterms are defined at § 160.103). Suchprovisions are in effect and apply at thetime the final rule becomes effective oras otherwise specifically provided. In
addition, as explained above, ourgeneral rule for a 180-day complianceperiod for new or modified standards
would not apply where we expressly
provide a different compliance period in

E:\FR\FM\25JAR2.SGM

25JAR2

5570

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

the regulation for one or more
provisions. For purposes of this rule, the180-day compliance period would notgovern the time period required tomodify those business associateagreements that qualify for the longer
transition period in § 164.532, as we
discuss further below.
Finally, the provisions of section
13402(j) of the HITECH Act apply tobreaches of unsecured protected healthinformation discovered on or after
September 23, 2009, the date of the
publication of the interim final rule.
Thus, during the 180 day period before
compliance with this final rule isrequired, covered entities and businessassociates are still required to comply
with the breach notification
requirements under the HITECH Act
and must continue to comply with therequirements of the interim final rule.
We believe that this transition period
provides covered entities and businessassociates with adequate time to comeinto compliance with the revisions inthis final rule and at the same time tocontinue to fulfill their breach
notification obligations under the
HITECH Act.
IV. Modifications to the HIPAA
Privacy, Security, and Enforcement
Rules Under the HITECH Act; Other
Modifications to the HIPAA Rules
The discussion below provides asection-by-section description of the
final rule, as well as responds to publiccomments where substantive comments
were received regarding particularprovisions.
A. Subparts A and B of Part 160:
Statutory Basis and Purpose,
Applicability, Definitions, andPreemption of State Law
Subpart A of Part 160 of the HIPAA
Rules contains general provisions that
apply to all of the HIPAA Rules. Subpart
B of Part 160 contains the regulatory
provisions implementing HIPAA’s
preemption provisions. We proposed toamend a number of these provisions.
Some of the proposed, and now final,changes are necessitated by the statutorychanges made by the HITECH Act and
GINA, while others are of a technical or
conforming nature.

sroberts on DSK5SPTVN1PROD with

1. Subpart A—General Provisions,
Section 160.101—Statutory Basis andPurposeThis section sets out the statutory
basis and purpose of the HIPAA Rules.
We proposed and include in this final
rule a technical change to include
references to the provisions of GINA
and the HITECH Act upon which most

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

of the regulatory changes below are
based.
2. Subpart A—General Provisions,
Section 160.102—Applicability
This section sets out to whom the
HIPAA Rules apply. We proposed to
add and include in this final rule a newparagraph (b) to make clear, consistent
with the HITECH Act, that certain of thestandards, requirements, andimplementation specifications of thesubchapter apply to business associates.
3. Subpart A—General Provisions,
Section 160.103—Definitions
Section 160.103 contains definitionsof terms that appear throughout the
HIPAA Rules. The final rule modifies a
number of these definitions to
implement the HITECH Act and makeother needed changes.
a. Definition of ‘‘Business Associate’’The HIPAA Privacy and Security
Rules permit a covered entity to disclose
protected health information to abusiness associate, and allow a businessassociate to create, receive, maintain, ortransmit protected health information
on its behalf, provided the covered
entity obtains satisfactory assurances in
the form of a contract or otherarrangement that the business associate
will appropriately safeguard theinformation. The HIPAA Rules define‘‘business associate’’ generally to meana person who performs functions or
activities on behalf of, or certain
services for, a covered entity thatinvolve the use or disclosure ofprotected health information. We
proposed a number of modifications to
the definition of ‘‘business associate’’ toimplement the HITECH Act, to conformthe term to the statutory provisions of
the Patient Safety and Quality
Improvement Act of 2005 (PSQIA), 42
U.S.C. 299b–21, et seq., and to makeother changes to the definition.
i. Inclusion of Patient Safety
Organizations
Proposed Rule
We proposed to add patient safety
activities to the list of functions andactivities a person may undertake onbehalf of a covered entity that give rise
to a business associate relationship.
PSQIA, at 42 U.S.C. 299b–22(i)(1),
provides that Patient Safety
Organizations (PSOs) must be treated asbusiness associates when applying thePrivacy Rule. PSQIA provides for theestablishment of PSOs to receive reportsof patient safety events or concerns fromproviders and provide analyses of
events to reporting providers. A
reporting provider may be a HIPAA

PO 00000

Frm 00006

Fmt 4701

Sfmt 4700

covered entity and, thus, information
reported to a PSO may include
protected health information that the
PSO may analyze on behalf of thecovered provider. The analysis of suchinformation is a patient safety activity
for purposes of PSQIA and the Patient
Safety Rule, 42 CFR 3.10, et seq. While
the HIPAA Rules as written would treat
a PSO as a business associate when the
PSO was performing quality analyses
and other activities on behalf of acovered health care provider, we
proposed this change to the definition of‘‘business associate’’ to more clearlyalign the HIPAA and Patient Safety
Rules.
Overview of Public Comment
Commenters on this topic supported
the express inclusion of patient safety
activities within the definition of‘‘business associate.’’Final Rule
The final rule adopts the proposed
modification.
ii. Inclusion of Health Information
Organizations (HIO), E-Prescribing
Gateways, and Other Persons That
Facilitate Data Transmission; as Well as
Vendors of Personal Health Records
Proposed Rule
Section 13408 of the HITECH Act
provides that an organization, such as a
Health Information Exchange
Organization, E-prescribing Gateway, or
Regional Health Information
Organization, that provides datatransmission of protected healthinformation to a covered entity (or its
business associate) and that requires
access on a routine basis to suchprotected health information must betreated as a business associate forpurposes of the Act and the HIPAA
Privacy and Security Rules. Section
13408 also provides that a vendor that
contracts with a covered entity to allow
the covered entity to offer a personal
health record to patients as part of thecovered entity’s electronic health record
shall be treated as a business associate.
Section 13408 requires that suchorganizations and vendors enter into a
written business associate contract orother arrangement with the covered
entity in accordance with the HIPAA
Rules.
In accordance with the Act, we
proposed to modify the definition of‘‘business associate’’ to explicitly
designate these persons as businessassociates. Specifically, we proposed toinclude in the definition: (1) A Health
Information Organization, E-prescribing
Gateway, or other person that provides
data transmission services with respect

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withto protected health information to acovered entity and that requires routine
access to such protected healthinformation; and (2) a person who offersa personal health record to one or moreindividuals on behalf of a covered
entity.
We proposed to refer to ‘‘Health
Information Organization’’ in the NPRM
rather than ‘‘Health Information
Exchange Organization’’ as used in the
Act because it is our understanding that‘‘Health Information Organization’’ isthe more widely recognized andaccepted term to describe anorganization that oversees and governs
the exchange of health-related
information among organizations.2 The
Act also specifically refers to Regional
Health Information Organizations;however, we did not believe theinclusion of the term in the definitionof ‘‘business associate’’ was necessary as
a Regional Health Information
Organization is simply a Health
Information Organization that governs
health information exchange amongorganizations within a defined
geographic area.3 Further, the specificterms of ‘‘Health Information
Organization’’ and ‘‘E-prescribing
Gateway’’ were included as merely
illustrative of the types of organizations
that would fall within this paragraph ofthe definition of ‘‘business associate.’’We requested comment on the use of
these terms within the definition andwhether additional clarifications oradditions were necessary.
Section 13408 also provides that thedata transmission organizations that the
Act requires to be treated as businessassociates are those that require accessto protected health information on aroutine basis. Conversely, datatransmission organizations that do not
require access to protected healthinformation on a routine basis would
not be treated as business associates.
This is consistent with our priorinterpretation of the definition of‘‘business associate,’’ through which wehave stated that entities that act as mere
conduits for the transport of protected
health information but do not access theinformation other than on a random or
infrequent basis are not businessassociates. See http://www.hhs.gov/ocr/
privacy/hipaa/faq/providers/business/
245.html. In contrast, entities thatmanage the exchange of protected
2 Department of Health and Human Services
Office of the National Coordinator for Health
Information Technology, The National Alliance for
Health Information Technology Report to the Officeof the National Coordinator for Health Information
Technology: Defining Key Health Information
Terms, Pg. 24 (2008).
3 Id. at 25.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

5571

health information through a network,
including providing record locator
services and performing various
oversight and governance functions forelectronic health information exchange,
have more than ‘‘random’’ access toprotected health information and thus,
would fall within the definition of‘‘business associate.’’that a vendor offering a personal healthrecord to a patient on behalf of acovered entity only acts as a conduit
because there is no access by the vendor
to protected health information; anothercommenter suggested that personal
health record vendors be businessassociates only when they have routine
access to protected health information.

Overview of Public Comments
Commenters generally supported theinclusion of Health Information
Organizations, personal health record
vendors, and similar entities in thedefinition of ‘‘business associate.’’However, commenters sought various
clarifications as discussed below.
Commenters generally supported useof the term Health Information
Organization in lieu of more restrictive
terms, such as Regional Health
Information Organization. Some
commenters suggested that the term
Health Information Organization be
defined, so as to avoid confusion as theindustry develops, and suggested
various alternatives for doing so. Several
commenters recommended that the
Office for Civil Rights (OCR) maintain a
Web site link that lists current terms forentities that OCR considers to be Health
Information Organizations.
Other commenters requested
clarification on what it means to have‘‘access on a routine basis’’ to protected
health information for purposes of thedefinition and determining whether
certain entities are excluded as mere
conduits. For example, commenters
asked whether the definition of businessassociate would include broadband
suppliers or internet service providers,
vendors that only have the potential tocome into contact with protected healthinformation, or entities contracted on acontingency basis that may at somepoint in the future have access toprotected health information. Several
document storage companies argued
that entities like theirs should becharacterized as conduits, as they do notview the protected health information
they store.
Several commenters soughtclarification regarding when personal
health record vendors would beconsidered business associates. For
example, commenters asked whether
personal health record vendors would
be business associates when the vendor
provided the personal health record incollaboration with the covered entity,
when the personal health record islinked to a covered entity’s electronic
health record, or when the personal
health record is offered independently
to the individual, among otherscenarios. One commenter suggested

Final Rule
The final rule adopts the languagethat expressly designates as businessassociates: (1) A Health Information
Organization, E-prescribing Gateway, orother person that provides datatransmission services with respect toprotected health information to acovered entity and that requires routine
access to such protected healthinformation; and (2) a person who offersa personal health record to one or moreindividuals on behalf of a covered
entity.
We decline to provide a definition for
Health Information Organization. We
recognize that the industry continues todevelop and thus the type of entities
that may be considered Health
Information Organizations continues to
evolve. For this reason, we do not think
it prudent to include in the regulationa specific definition at this time. We
anticipate continuing to issue guidancein the future on our web site on thetypes of entities that do and do not fallwithin the definition of businessassociate, which can be updated as theindustry evolves.
Regarding what it means to have‘‘access on a routine basis’’ to protected
health information with respect todetermining which types of datatransmission services are businessassociates versus mere conduits, such a
determination will be fact specific basedon the nature of the services provided
and the extent to which the entity needs
access to protected health information
to perform the service for the covered
entity. The conduit exception is anarrow one and is intended to exclude
only those entities providing mere
courier services, such as the U.S. Postal
Service or United Parcel Service andtheir electronic equivalents, such as
internet service providers (ISPs)
providing mere data transmission
services. As we have stated in priorguidance, a conduit transports
information but does not access it otherthan on a random or infrequent basis asnecessary to perform the transportation
service or as required by other law. For
example, a telecommunications
company may have occasional, random
access to protected health information
when it reviews whether the datatransmitted over its network is arriving

PO 00000

Frm 00007

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5572

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulationsat its intended destination. Suchoccasional, random access to protected
health information would not qualify
the company as a business associate. In
contrast, an entity that requires access toprotected health information in order toperform a service for a covered entity,
such as a Health Information
Organization that manages the exchangeof protected health information througha network on behalf of covered entities
through the use of record locator
services for its participants (and otherservices), is not considered a conduit
and, thus, is not excluded from thedefinition of business associate. We
intend to issue further guidance in thisarea as electronic health informationexchange continues to evolve.
We note that the conduit exception islimited to transmission services(whether digital or hard copy),
including any temporary storage oftransmitted data incident to suchtransmission. In contrast, an entity thatmaintains protected health information
on behalf of a covered entity is abusiness associate and not a conduit,
even if the entity does not actually view
the protected health information. We
recognize that in both situations, theentity providing the service to thecovered entity has the opportunity toaccess the protected health information.
However, the difference between thetwo situations is the transient versus
persistent nature of that opportunity.
For example, a data storage company
that has access to protected healthinformation (whether digital or hardcopy) qualifies as a business associate,
even if the entity does not view the
information or only does so on arandom or infrequent basis. Thus,
document storage companies
maintaining protected healthinformation on behalf of covered
entities are considered businessassociates, regardless of whether they
actually view the information they hold.
To help clarify this point, we havemodified the definition of ‘‘businessassociate’’ to generally provide that abusiness associate includes a person
who ‘‘creates, receives, maintains, ortransmits’’ (emphasis added) protected
health information on behalf of acovered entity.
Several commenters soughtclarification on when a personal healthrecord vendor would be providing apersonal health record ‘‘on behalf of’’ acovered entity and thus, would be abusiness associate for purposes of the
HIPAA Rules. As with data transmission
services, determining whether apersonal health record vendor is abusiness associate is a fact specificdetermination. A personal health record

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

vendor is not a business associate of acovered entity solely by virtue ofentering into an interoperability
relationship with a covered entity. For
example, when a personal health record
vendor and a covered entity establish
the electronic means for a covered
entity’s electronic health record to send
protected health information to thepersonal health record vendor pursuant
to the individual’s written
authorization, it does not mean that thepersonal health record vendor isoffering the personal health record on
behalf of the covered entity, even if
there is an agreement between the
personal health record vendor and thecovered entity governing the exchangeof data (such as an agreement specifying
the technical specifications forexchanging of data or specifying thatsuch data shall be kept confidential). In
contrast, when a covered entity hires avendor to provide and manage apersonal health record service thecovered entity wishes to offer its
patients or enrollees, and provides thevendor with access to protected healthinformation in order to do so, thepersonal health record vendor is abusiness associate.
A personal health record vendor may
offer personal health records directly toindividuals and may also offer personal
health records on behalf of covered
entities. In such cases, the personal
health record vendor is only subject to
HIPAA as a business associate withrespect to personal health records thatare offered to individuals on behalf ofcovered entities.
We also clarify that, contrary to one
commenter’s suggestion, a personal
health record vendor that offers apersonal health record to a patient onbehalf of a covered entity does not act
merely as a conduit. Rather, thepersonal health record vendor ismaintaining protected healthinformation on behalf of the covered
entity (for the benefit of the individual).
Further, a personal health record vendor
that operates a personal health recordon behalf of a covered entity is abusiness associate if it has access toprotected health information, regardlessof whether the personal health record
vendor actually exercises this access.
We believe the revisions to thedefinition of ‘‘business associate’’discussed above clarify these points. As
with other aspects of the definition of‘‘business associate,’’ we intend toprovide future guidance on when apersonal health record vendor is abusiness associate for purposes of the
HIPAA Rules.

PO 00000

Frm 00008

Fmt 4701

Sfmt 4700

Response to Other Public Comments
Comment: One commenter
recommended that the term ‘‘person’’used in describing who provides
transmission services to a covered entity
be clarified to apply also to entities andorganizations.
Response: The term ‘‘person’’ asdefined at § 160.103 includes entities aswell as natural persons.
Comment: One commenter asked
whether subcontractors that support
business associates with personal healthrecord related functions are subject tothe breach notification requirements
under the HIPAA Breach Notification
Rule or that of the FTC.
Response: As discussed below, asubcontractor that creates, receives,maintains, or transmits protected healthinformation on behalf of a businessassociate, including with respect topersonal health record functions, is a
HIPAA business associate and thus, issubject to the HIPAA Breach
Notification Rule and not that of theFTC. The analysis of whether asubcontractor is acting on behalf of abusiness associate is the same analysis
as discussed above with respect towhether a business associate is acting
on behalf of a covered entity.
iii. Inclusion of Subcontractors
Proposed Rule
We proposed in the definition of‘‘business associate’’ to provide that
subcontractors of a covered entity, i.e.,
those persons that perform functions foror provide services to a businessassociate other than in the capacity asa member of the business associate’s
workforce, are also business associates
to the extent that they require access toprotected health information. We also
proposed to define ‘‘subcontractor’’ in§ 160.103 as a person who acts on behalfof a business associate, other than in thecapacity of a member of the workforceof such business associate. Even though
we used the term ‘‘subcontractor,’’which implies there is a contract inplace between the parties, the definition
would apply to an agent or other person
who acts on behalf of the businessassociate, even if the business associate
has failed to enter into a businessassociate contract with the person. We
requested comment on the use of theterm ‘‘subcontractor’’ and its proposed
definition.
The intent of the proposed extensionof the Rules to subcontractors was to
avoid having privacy and security
protections for protected healthinformation lapse merely because afunction is performed by an entity thatis a subcontractor rather than an entity

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with

with a direct relationship with acovered entity. Allowing such a lapse in
privacy and security protections could
allow business associates to avoid
liability imposed upon them by sections
13401 and 13404 of the Act. Further,
applying HIPAA privacy and security
requirements directly to subcontractors
also ensures that the privacy andsecurity protections of the HIPAA Rules
extend beyond covered entities to thoseentities that create or receive protected
health information in order for thecovered entity to perform its health carefunctions. Therefore, we proposed that
downstream entities that work at thedirection of or on behalf of a businessassociate and handle protected healthinformation would also be required tocomply with the applicable Privacy andSecurity Rule provisions in the samemanner as the primary businessassociate, and likewise would incur
liability for acts of noncompliance. This
proposed modification would not
require the covered entity to have acontract with the subcontractor; rather,
the obligation would remain on eachbusiness associate to obtain satisfactory
assurances in the form of a written
contract or other arrangement that a
subcontractor will appropriately
safeguard protected health information.
For example, if a business associate,such as a third party administrator,
hires a company to handle document
and media shredding to securely
dispose of paper and electronic
protected health information, then theshredding company would be directly
required to comply with the applicablerequirements of the HIPAA Security
Rule (e.g., with respect to proper
disposal of electronic media) and thePrivacy Rule (e.g., with respect tolimiting its uses and disclosures of theprotected health information inaccordance with its contract with thebusiness associate).
Overview of Public Comments
While some commenters generally
supported extending the businessassociate provisions of the Rules tosubcontractors, many opposed such an
extension arguing, among other things,
that doing so was not the intent ofCongress and beyond the statutory
authority of the Department, that
confusion may ensue with covered
entities seeking to establish directbusiness associate contracts with
subcontractors or prohibiting businessassociates from establishingsubcontractor relationships altogether,
and/or that creating direct liability forsubcontractors will discourage such
entities from operating and participatingin the health care industry. Some

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

commenters asked how far down the‘‘chain’’ of subcontractors do the HIPAA
Rules apply—i.e., do the Rules apply
only to the first tier subcontractor or to
all subcontractors down the chain.
In response to our request forcomment on this issue, several
commenters were concerned that use of
the term subcontractor was confusing
and instead suggested a different term
be used, such as business associate
contractor or downstream businessassociate, to avoid confusion between
primary business associates of a covered
entity and subcontractors. Other
commenters suggested changes to thedefinition of subcontractor itself tobetter clarify the scope of the definition.
Several commenters requested
specific guidance on who is and is nota subcontractor under the definitions of‘‘business associate’’ and‘‘subcontractor.’’ For example, onecommenter asked whether an entity thatshreds documents for a businessassociate for the business associate’s
activities and not for the covered entity,
would qualify as a subcontractor.
Another commenter asked whether
disclosures by a business associate ofprotected health information for its own
management and administration or legal
needs creates a subcontractor
relationship. Other commenters
recommended that subcontractors
without routine access to protected
health information, or who do notaccess protected health information at
all for their duties, not be consideredbusiness associates.
Final Rule
The final rule adopts the proposal toapply the business associate provisionsof the HIPAA Rules to subcontractors
and thus, provides in the definition of‘‘business associate’’ that a businessassociate includes a ‘‘subcontractor thatcreates, receives, maintains, or transmits
protected health information on behalfof the business associate.’’ In response
to comments, we clarify the definitionof ‘‘subcontractor’’ in § 160.103 toprovide that subcontractor means: ‘‘aperson to whom a business associatedelegates a function, activity, or service,other than in the capacity of a memberof the workforce of such businessassociate.’’ Thus, a subcontractor is aperson to whom a business associate hasdelegated a function, activity, or service
the business associate has agreed toperform for a covered entity or businessassociate. A subcontractor is then abusiness associate where that function,
activity, or service involves the creation,
receipt, maintenance, or transmission ofprotected health information. We also
decline to replace the term

PO 00000

Frm 00009

Fmt 4701

Sfmt 4700

5573‘‘subcontractor’’ with another, as wewere not persuaded by any of thealternatives suggested by commenters(e.g., ‘‘business associate contractor,’’‘‘downstream business associate,’’ or‘‘downstream entity’’).
We disagree with the commenters thatsuggested that applying the businessassociate provisions of the HIPAA Rules
to subcontractors is beyond theDepartment’s statutory authority. In the
HITECH Act, Congress created direct
liability under the HIPAA Privacy andSecurity Rules for persons that are notcovered entities but that create orreceive protected health information inorder for a covered entity to perform its
health care functions, to ensure
individuals’ personal health information
remains sufficiently protected in thehands of these entities. As stated in the
NPRM, applying the business associateprovisions only to those entities thathave a direct relationship with acovered entity does not achieve that
intended purpose. Rather, it allows
privacy and security protections forprotected health information to lapse
once a subcontractor is enlisted to assistin performing a function, activity, orservice for the covered entity, while atthe same time potentially allowing
certain primary business associates toavoid liability altogether for theprotection of the information the
covered entity has entrusted to thebusiness associate. Further, section
13422 of the HITECH Act provides thateach reference in the Privacy subtitle of
the Act to a provision of the HIPAA
Rules refers to such provision as ineffect on the date of enactment of the
Act or to the most recent update of suchprovision (emphasis added). Thus, theAct does not bar the Department frommodifying definitions of terms in the
HIPAA Rules to which the Act refers.
Rather, the statute expressly
contemplates that modifications to theterms may be necessary to carry out theprovisions of the Act or for otherpurposes.
Further, we do not agree that covered
entities will be confused and seek toestablish direct business associate
contracts with subcontractors or willprohibit business associates fromengaging subcontractors to performfunctions or services that require accessto protected health information. The
final rule makes clear that a covered
entity is not required to enter into acontract or other arrangement with abusiness associate that is asubcontractor. See §§ 164.308(b)(1) and
164.502(e)(1)(i). In addition, as
commenters did not present direct
evidence to the contrary, we do notbelieve that covered entities will begin

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5574

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

prohibiting business associates fromengaging subcontractors as a result of
the final rule, in cases where they were
not doing so before. Rather, we believethat making subcontractors directly
liable for violations of the applicableprovisions of the HIPAA Rules will help
to alleviate concern on the part ofcovered entities that protected healthinformation is not adequately protected
when provided to subcontractors.
The Department also believes that theprivacy and security protections for anindividual’s personal health information
and associated liability fornoncompliance with the Rules should
not lapse beyond any particularbusiness associate that is asubcontractor. Thus, under the final
rule, covered entities must ensure thatthey obtain satisfactory assurances
required by the Rules from theirbusiness associates, and businessassociates must do the same with regard
to subcontractors, and so on, no matter
how far ‘‘down the chain’’ theinformation flows. This ensures that
individuals’ health information remains
protected by all parties that create,
receive, maintain, or transmit the
information in order for a covered entity
to perform its health care functions. For
example, a covered entity may contract
with a business associate (contractor),
the contractor may delegate to a
subcontractor (subcontractor 1) one ormore functions, services, or activities
the business associate has agreed toperform for the covered entity that
require access to protected healthinformation, and the subcontractor may
in turn delegate to anothersubcontractor (subcontractor 2) one ormore functions, services, or activities it
has agreed to perform for the contractor
that require access to protected healthinformation, and so on. Both thecontractor and all of the subcontractors
are business associates under the final
rule to the extent they create, receive,
maintain, or transmit protected healthinformation.
With respect to requests for specificguidance on who is and is not a
subcontractor, we believe the abovechanges to the definition provide further
clarity. We also provide the following in
response to specific comments.
Disclosures by a business associatepursuant to § 164.504(e)(4) and its
business associate contract for its own
management and administration or legal
responsibilities do not create a businessassociate relationship with the recipientof the protected health information
because such disclosures are madeoutside of the entity’s role as a businessassociate. However, for such disclosuresthat are not required by law, the Rule

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

requires that the business associate
obtain reasonable assurances from theperson to whom the information isdisclosed that it will be held
confidentially and used or further
disclosed only as required by law or forthe purposes for which it was disclosed
to the person and the person notifies thebusiness associate of any instances ofwhich it is aware that theconfidentiality of the information has
been breached. See§ 164.504(e)(4)(ii)(B).
In contrast, disclosures of protected
health information by the businessassociate to a person who will assist thebusiness associate in performing afunction, activity, or service for acovered entity or another businessassociate may create a businessassociate relationship depending on thecircumstances. For example, an entity
hired by a business associate toappropriately dispose of documents that
contain protected health information is
also a business associate and subject tothe applicable provisions of the HIPAA
Rules. If the documents to be shredded
do not contain protected healthinformation, then the entity is not abusiness associate. We also clarify thatthe same interpretations that apply todetermining whether a first tiercontractor is a business associate also
apply to determining whether asubcontractor is a business associate.
Thus, our interpretation of who is andis not excluded from the definition ofbusiness associate as a conduit also
applies in the context of subcontractors
as well. We refer readers to the above
discussion regarding transmission
services and conduits.
iv. Exceptions to Business Associate
Proposed Rule
Sections 164.308(b)(2) and
164.502(e)(1)(ii) of the HIPAA Rules
currently describe certain
circumstances, such as when a covered
entity discloses protected healthinformation to a health care provider
concerning the treatment of anindividual, in which a covered entity is
not required to enter into a businessassociate contract or other arrangementwith the recipient of the protected
health information. We proposed tomove these provisions to the definitionof ‘‘business associate’’ itself as
exceptions to make clear that the
Department does not consider therecipients of the protected healthinformation in these circumstances to bebusiness associates. The movement ofthese exceptions also was intended tohelp clarify that a person or an entity isa business associate if the person or

PO 00000

Frm 00010

Fmt 4701

Sfmt 4700

entity meets the definition of ‘‘businessassociate,’’ even if a covered entity, or
business associate with respect to a
subcontractor, fails to enter into therequired business associate contract
with the person or entity.
Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule includes the
exceptions within the definition of‘‘business associate.’’v. Technical Changes to the Definition
Proposed Rule
For clarity and consistency, we also
proposed to change the term‘‘individually identifiable healthinformation’’ in the current definition of‘‘business associate’’ to ‘‘protected
health information,’’ since a businessassociate has no obligation under the
HIPAA Rules with respect toindividually identifiable healthinformation that is not protected healthinformation.
Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule adopts the
proposed modification to the definition.
Additionally, as indicated above, wehave revised the definition of businessassociate to clarify that a businessassociate includes an entity that‘‘creates, receives, maintains, ortransmits’’ protected health information
on behalf of a covered entity. Thischange is intended to make thedefinition more consistent withlanguage at § 164.308(b) of the Security
Rule and § 164.502(e) of the Privacy
Rule, as well as to clarify that entities
that maintain or store protected healthinformation on behalf of a covered
entity are business associates, even if
they do not actually view the protected
health information.
vi. Response to Other Public Comments
Comment: One commenter suggested
that some covered entities do not treat
third party persons that handle
protected health information onsite as abusiness associate.
Response: A covered entity may treat
a contractor who has his or her duty
station onsite at a covered entity andwho has more than incidental access toprotected health information as either amember of the covered entity’s
workforce or as a business associate forpurposes of the HIPAA Rules.
Comment: A few commenters asked
for confirmation that researchers are notconsidered business associates. In
addition, the Secretary’s Advisory

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Committee on Human ResearchProtections, in its November 23, 2010,
letter to the Secretary providing
comments on the NPRM, asked theDepartment to confirm that outsourced
research review, approval, andcontinuing oversight functions (such as
through using an external or
independent Institutional Review
Board) similarly do not give rise to abusiness associate relationship.
Response: A person or entity is abusiness associate only in cases where
the person or entity is conducting afunction or activity regulated by the
HIPAA Rules on behalf of a covered
entity, such as payment or health care
operations, or providing one of theservices listed in the definition of‘‘business associate,’’ and in theperformance of such duties the personor entity has access to protected healthinformation. Thus, an external
researcher is not a business associate ofa covered entity by virtue of its research
activities, even if the covered entity has
hired the researcher to perform theresearch. See http://www.hhs.gov/ocr/
privacy/hipaa/faq/business_associates/
239.html. Similarly, an external or
independent Institutional Review Board
is not a business associate of a covered
entity by virtue of its performing
research review, approval, andcontinuing oversight functions.
However, a researcher may be abusiness associate if the researcher
performs a function, activity, or service
for a covered entity that does fall within
the definition of business associate,such as the health care operations
function of creating a de-identified orlimited data set for the covered entity.
See paragraph (6)(v) of the definition of‘‘health care operations.’’ Where theresearcher is also the intended recipientof the de-identified data or limited dataset, the researcher must return or
destroy the identifiers at the time thebusiness associate relationship to create
the data set terminates and theresearcher now wishes to use the deidentified data or limited data set(subject to a data use agreement) for a
research purpose.
Comment: A few commenters asked
for clarification as to whether thebusiness associate provisions applied tobanking and financial institutions.
Commenters sought clarification as towhether the exemption at § 1179 of the
HIPAA statute for financial institutions
was applicable to subcontractors.
Response: This final rule is notintended to affect the status of financial
institutions with respect to whether
they are business associates. The HIPAA
Rules, including the business associateprovisions, do not apply to banking and

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

financial institutions with respect to thepayment processing activities identified
in § 1179 of the HIPAA statute, forexample, the activity of cashing a checkor conducting a funds transfer. Section
1179 of HIPAA exempts certain
activities of financial institutions fromthe HIPAA Rules, to the extent thatthese activities constitute authorizing,processing, clearing, settling, billing,transferring, reconciling, or collecting
payments for health care or health plan
premiums. However, a banking or
financial institution may be a businessassociate where the institution performs
functions above and beyond thepayment processing activities identified
above on behalf of a covered entity,
such as performing accounts receivablefunctions on behalf of a health careprovider.
We clarify that our inclusion of
subcontractors in the definition ofbusiness associate does not impact theexclusion of financial institutions fromthe definition of ‘‘business associates’’
when they are only conducting payment
processing activities that fall under§ 1179 of the HIPAA statute.
Accordingly, a business associate need
not enter into a business associateagreement with a financial institutionthat is solely conducting payment
activities that are excluded under§ 1179.
Comment: One commenter soughtclarification of the status of a risk
management group or malpracticeinsurance company that receives
protected health information whencontracted with a covered entity to
mitigate the covered entity’s risk andthen contracts with legal groups torepresent the covered entity duringmalpractice claims.
Response: A business associateagreement is not required where acovered entity purchases a health plan
product or other insurance, such as
medical liability insurance, from aninsurer. However, a business associate
relationship could arise if the insurer isperforming a function on behalf of, or
providing services to, the covered entitythat does not directly relate to theprovision of insurance benefits, such as
performing risk management orassessment activities or legal services
for the covered entity, that involve
access to protected health information.
b. Definition of ‘‘Electronic Media’’
Proposed Rule
The term ‘‘electronic media’’ wasoriginally defined in the Transactions
and Code Sets Rule issued on August17, 2000 (65 FR 50312) and wasincluded in the definitions at § 162.103.

PO 00000

Frm 00011

Fmt 4701

Sfmt 4700

5575

That definition was subsequently
revised and moved to § 160.103. The
purpose of that revision was to clarify
that the physical movement ofelectronic media from place to place is
not limited to magnetic tape, disk, orcompact disk, so as to allow for futuretechnological innovation. We further
clarified that transmission of
information not in electronic form
before the transmission (e.g., paper or
voice) is not covered by this definition.
See 68 FR 8339, Feb. 20, 2003.
In the NPRM, we proposed to revise
the definition of ‘‘electronic media’’ inthe following ways. First, we proposed
to revise paragraph (1) of the definition
to replace the term ‘‘electronic storage
media’’ with ‘‘electronic storage
material’’ to conform the definition of‘‘electronic media’’ to its current usage,
as set forth in the National Institute forStandards and Technology (NIST)‘‘Guidelines for Media Sanitization’’(Definition of Medium, NIST SP 800–88,
Glossary B, p. 27 (2006)). The NIST
definition, which was updated
subsequent to the issuance of thePrivacy and Security Rules, wasdeveloped in recognition of thelikelihood that the evolution of thedevelopment of new technology would
make use of the term ‘‘electronic storage
media’’ obsolete in that there may be‘‘storage material’’ other than ‘‘media’’that house electronic data. Second, we
proposed to add to paragraph (2) of thedefinition of ‘‘electronic media’’ areference to intranets, to clarify that
intranets come within the definition.
Third, we proposed to change the word‘‘because’’ to ‘‘if’’ in the final sentenceof paragraph (2) of the definition of‘‘electronic media.’’ The definition
assumed that no transmissions made byvoice via telephone existed in electronic
form before transmission; the evolutionof technology has made this assumption
obsolete since some voice technology isdigitally produced from an information
system and transmitted by phone.
Overview of Public Comments
The Department received comments
in support of the revised definition andthe flexibility created to account forlater technological developments.
Certain other commenters raised
concerns that changes to the definition
could have unintended impacts whenapplied to the administrativetransaction and code set requirements.
One commenter specifically supported
the change in language from ‘‘because’’to ‘‘if,’’ noting the distinction was
important to provide protection for
digital audio recordings containing
protected health information. One
commenter suggested including the

E:\FR\FM\25JAR2.SGM

25JAR2

5576

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withword ‘‘immediately’’ in the final
sentence of paragraph (2) to indicatethat fax transmissions are excluded fromthe definition of electronic media if theinformation being exchanged did notexist in electronic form immediately
before the transmission. Several
commenters sought clarification as towhether data that is retained in officemachines, such as facsimiles andphotocopiers, is subject to the Privacy
and Security Rules.
Final Rule
The final rule adopts the definition as
proposed with two additional
modifications. First, in paragraph (2) weremove the parenthetical language
referring to ‘‘wide open’’ with respect tothe Internet and ‘‘using Internet
technology to link a business withinformation accessible only tocollaborating parties’’ with respect toextranets and intranets. The
parenthetical language initially helped
clarify what was intended by key words
within the definition. As these key
words have become more generally
understood and guidance has become
available through the NIST regarding
specific key terms, such as intranet,
extranet, and internet, (see, for example,
NIST IR 7298 Revision 1, Glossary of
Key Information Security Terms,
February 2011, available at http://
csrc.nist.gov/publications/nistir/ir7298rev1/nistir-7298-revision1.pdf), we
believe the parenthetical language is nolonger helpful. Second, we do accept
the recommendation that we alter the
language in paragraph (2) to include theword ‘‘immediately,’’ to exclude
transmissions when the informationexchanged did not exist in electronic
form immediately before transmission.
This modification clarifies that a
facsimile machine accepting a hardcopy
document for transmission is not acovered transmission even though the
document may have originated fromprinting from an electronic file.
We do not believe these changes will
have unforeseen impacts on theapplication of the term in thetransactions and code sets requirements
at Part 162.
In response to commenters’ concernsthat photocopiers, facsimiles, and otheroffice machines may retain electronic
data, potentially storing protected
health information when used bycovered entities or business associates,
we clarify that protected healthinformation stored, whether
intentionally or not, in photocopier,facsimile, and other devices is subject to
the Privacy and Security Rules.
Although such devices are not generally
relied upon for storage and access to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

stored information, covered entities andbusiness associates should be aware of
the capabilities of these devices to store
protected health information and mustensure any protected health information
stored on such devices is appropriately
protected and secured frominappropriate access, such as bymonitoring or restricting physical accessto a photocopier or a fax machine thatis used for copying or sending protected
health information. Further, before
removal of the device from the covered
entity or business associate, such as at
the end of the lease term for a
photocopier machine, proper safeguards
should be followed to remove theelectronic protected health informationfrom the media.
c. Definition of ‘‘Protected Health
Information’’
Proposed Rule
For consistency with the proposed
modifications to the period of protection
for decedent information at § 164.502(f)(discussed below), the Department
proposed to modify the definition of‘‘protected health information’’ at§ 160.103 to provide that the Privacy
and Security Rules do not protect theindividually identifiable healthinformation of persons who have been
deceased for more than 50 years.
Overview of Public Comment
The public comments received on this
proposal are discussed and responded
to below in the section describing themodifications to § 164.502(f).
Final Rule
For the reasons stated in the section
regarding § 164.502(f), the final rule
adopts the proposed modification to thedefinition of ‘‘protected healthinformation.’’d. Definition of ‘‘State’’
Proposed Rule
The HITECH Act at section 13400
includes a definition of ‘‘State’’ to mean‘‘each of the several States, the Districtof Columbia, Puerto Rico, the Virgin
Islands, Guam, American Samoa, andthe Northern Mariana Islands.’’ Thisdefinition varies from paragraph (2) ofthe HIPAA definition of ‘‘State’’ at§ 160.103, which does not include
reference to American Samoa and theNorthern Mariana Islands. Thus, forconsistency with the definition applied
to the HIPAA Rules by the HITECH Act,
we proposed to add reference toAmerican Samoa and theCommonwealth of the Northern Mariana
Islands in paragraph (2) of the definitionof ‘‘State’’ at § 160.103.

PO 00000

Frm 00012

Fmt 4701

Sfmt 4700

Final RuleThe Department did not receive
substantive public comment on this
proposal and the final rule adopts the
proposed modifications to the definitionof ‘‘State.’’e. Other Changes to the Definitions in
Section 160.103
In addition to the changes discussed
above, the final rule makes thefollowing changes as proposed in the
NPRM to various definitions in§ 160.103:(1) Relocates the definitions of‘‘administrative simplification
provision,’’ ‘‘ALJ,’’ ‘‘civil money
penalty,’’ ‘‘respondent,’’ and ‘‘violationor violate’’ from § 160.302 to § 160.103
for ease of reference;(2) Adds a reference to sections
13400–13424 of the HITECH Act to thedefinition of ‘‘administrative
simplification provision’’;(3) Removes a comma from thedefinition of ‘‘disclosure’’ inadvertently
inserted into the definition in a priorrulemaking;(4) Replaces the term ‘‘individually
identifiable health information’’ with‘‘protected health information’’ in thedefinition of ‘‘standard’’ to better reflect
the scope of the Privacy and Security
Rules;(5) Adds a reference to ‘‘businessassociate’’ following the reference to‘‘covered entity’’ in the definitions of‘‘respondent’’ and ‘‘compliance date,’’in recognition of the potential liability
imposed on business associates forviolations of certain provisions of thePrivacy and Security Rules by sections
13401 and 13404 of the Act; and(6) Revises the definition of‘‘workforce member’’ in § 160.103 to
make clear that the term includes theemployees, volunteers, trainees, andother persons whose conduct, in theperformance of work for a businessassociate, is under the direct control ofthe business associate, because someprovisions of the Act and the Privacy
and Security Rules place obligations on
the business associate with respect toworkforce members.
4. Subpart B—Preemption of State Law
a. Section 160.201—Statutory Basis
Proposed Rule
We proposed to modify § 160.201
regarding the statutory basis for thepreemption of State law provisions to
add a reference to section 264(c) of
HIPAA, which contains the statutory
basis for the exception to preemption at§ 160.203(b) for State laws that are more
stringent than the HIPAA Privacy Rule.
We also proposed to add a reference to

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
section 13421(a) of the HITECH Act,
which applies HIPAA’s preemption
rules to the HITECH Act’s privacy andsecurity provisions. Finally, we
proposed to re-title the provision to read‘‘Statutory basis’’ instead of‘‘Applicability.’’
Overview of Public Comments

Final Rule
The final rule adopts the proposed
modifications. In response to thecomments concerned with the lack of
uniform Federal and State privacy laws,
we note that the preemption provisionsof the HIPAA Rules are based on section
1178 of the Social Security Act andsection 264(c)(2) of HIPAA. Throughthese statutory provisions, Congress
made clear that the HIPAA privacy
requirements are to supersede only
contrary provisions of State law, and noteven in all such cases, such as where
the provision of State law provides more
stringent privacy protections than the
HIPAA Privacy Rule. Accordingly, the
HIPAA Privacy Rule provides a Federal
floor of privacy protections, with States
free to impose more stringent privacy
protections should they deem
appropriate.
b. Section 160.202—Definitions
i. Definition of ‘‘Contrary’’sroberts on DSK5SPTVN1PROD with

Proposed Rule
The term ‘‘contrary’’ is defined in§ 160.202 to make clear when thepreemption provisions of HIPAA apply
to State law. For the reasons set forth on
page 40875 of the July 2010 NPRM, we
proposed to amend the definition of‘‘contrary’’ by inserting references tobusiness associates in paragraph (1) of
the definition. We also expanded thereference to the HITECH statutory
provisions in paragraph (2) of thedefinition to encompass all of thesections of subtitle D of the HITECH
Act, rather than merely to section
13402, which was added by the breach
notifications interim final rule. These

18:57 Jan 24, 2013

Jkt 229001

Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule adopts the
proposed modifications.
ii. Definition of ‘‘More Stringent’’

Several commenters expressed
concerns about the lack of uniform
Federal and State privacy laws and theresultant confusion and expense
associated with determining which laws
apply to a given circumstance,
particularly as more and more healthcare entities operate across multiple
state lines. Commenters recommended
that the Department make efforts toengage States and other partners to
examine divergent Federal and Staterequirements and to attempt tocoordinate various disclosure rules todrive Federal-State consensus.

VerDate Mar<15>2010changes would give effect to section
13421(a).

Proposed Rule
The term ‘‘more stringent’’ is part ofthe statutory preemption language
under HIPAA. HIPAA preempts Statelaw that is contrary to a HIPAA privacy
standard unless, among otherexceptions, the State law is more
stringent than the contrary HIPAA
privacy standard. We proposed toamend the definition to add a reference
to business associates.
Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule adopts the
proposed modification.
B. Subparts C and D of Part 160:
Amendments to the Enforcement Rule
Section 13410 of the HITECH Act
made several amendments to the Social
Security Act to strengthen the HIPAA
Enforcement Rule, which applies to theSecretary’s enforcement of all of the
HIPAA Administrative Simplification
Rules, as well as the Breach Notification
Rule.
On October 30, 2009, the Department
issued an interim final rule (IFR)
revising the Enforcement Rule toincorporate the provisions of section
13410(d) of the HITECH Act that tookeffect immediately to apply to violationsof the HIPAA Rules occurring after theenactment date of February 18, 2009.
See 74 FR 56123. In general, section
13410(d) of the HITECH Act revised
section 1176(a) of the Social Security
Act to establish four categories ofviolations that reflect increasing levelsof culpability and four correspondingtiers of penalty amounts thatsignificantly increased the minimum
penalty amount for each violation, witha maximum penalty amount of $1.5
million annually for all violations of an
identical provision. Section 13410(d)also amended section 1176(b) of theSocial Security Act by removing theprevious affirmative defense to theimposition of penalties if the covered
entity did not know and with theexercise of reasonable diligence would
not have known of the violation (these
violations are now punishable under thelowest tier of penalties), and byproviding a prohibition on theimposition of penalties for any violation

PO 00000

Frm 00013

Fmt 4701

Sfmt 4700

5577

that is timely corrected, as long as theviolation was not due to willful neglect.
The IFR updated the HIPAA
Enforcement Rule to reflect thesestatutory amendments. The IFR did not
make amendments with respect to those
enforcement provisions of section 13410
of the HITECH Act that were noteffective immediately upon enactment.
In its July 2010 NPRM, theDepartment proposed a number of
additional modifications to the
Enforcement Rule to reflect otherprovisions of section 13410 of the
HITECH Act, some of which became
effective on February 18, 2010, or were
to become effective at a later date: (1)Requiring that the Secretary formallyinvestigate complaints indicating
violations due to willful neglect, andimpose civil money penalties upon
finding violations due to willful neglect;(2) making business associates ofcovered entities directly liable for civil
money penalties for violations of certain
provisions of the HIPAA Rules; (3)requiring the Secretary to determine
civil money penalty amounts based
upon the nature and extent of the harm
resulting from a violation; and (4)providing that the Secretary’s authority
to impose a civil money penalty will bebarred only to the extent a criminal
penalty has been imposed with respect
to an act under Section 1177, rather
than in cases in which the act
constitutes an offense that is criminallypunishable under Section 1177.
The following discussion describes
the enforcement provisions of the IFR
and the NPRM, responds to publiccomment received by the Department on
both rules, and describes the final
modifications to the Enforcement Ruleadopted by this final rule. In addition to
the modifications discussed below, thisfinal rule also adopts the NPRM
proposal to add the term ‘‘businessassociate’’ to the following provisions of
the Enforcement Rule: §§ 160.300;
160.304; 160.306(a) and (c); 160.308;
160.310; 160.312; 160.316; 160.401;
160.402; 160.404(b); 160.406; 160.408(c)and (d); and 160.410(a) and (c). This isdone to implement sections 13401 and
13404 of the Act, which impose direct
civil money penalty liability on
business associates for their violationsof certain provisions of the HIPAA
Rules.

E:\FR\FM\25JAR2.SGM

25JAR2

5578

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

1. Subpart C of Part 160—Complianceand Investigations
a. Sections 160.304, 160.306, 160.308,
and 160.312—Noncompliance Due toWillful Neglectsroberts on DSK5SPTVN1PROD with

Proposed Rule
Section 13410(a) of the HITECH Act
adds a new subsection (c) to section
1176 of the Social Security Act, which
requires the Department to formallyinvestigate a complaint if a preliminary
investigation of the facts of thecomplaint indicates a possible violation
due to willful neglect (section
1176(c)(2)) and to impose a civil money
penalty for a violation due to willful
neglect (section 1176(c)(1)). The
Department proposed a number ofmodifications to Subpart C of the
Enforcement Rule to implement theseprovisions.
First, § 160.306(c) of the Enforcement
Rule currently provides the Secretarywith discretion to investigate HIPAA
complaints through the use of the word‘‘may.’’ As a practical matter, however,the Department currently conducts apreliminary review of every complaint
received and proceeds with theinvestigation in every eligible casewhere its preliminary review of the facts
indicates a possible violation of the
HIPAA Rules. Nonetheless, toimplement section 1176(c)(2), theDepartment proposed to add a newparagraph (1) to § 160.306(c) (and to
make conforming changes to theremainder of § 160.306(c)) to make clearthat the Secretary will investigate any
complaint filed under this section whena preliminary review of the facts
indicates a possible violation due towillful neglect. Under proposed§ 160.306(c)(2), the Secretary would
have continued discretion with respect
to investigating any other complaints.
Second, the Department proposed tomodify § 160.308 by adding a newparagraph (a) to provide that the
Secretary will conduct a compliancereview to determine whether a covered
entity or business associate iscomplying with the applicableadministrative simplification provision
when a preliminary review of the facts
indicates a possible violation due towillful neglect. Like § 160.306(c) withrespect to complaints, the current§ 160.308(c) provides the Secretary withdiscretion to conduct compliancereviews. While section 13410(a) of the
HITECH Act specifically mentions
complaints and not compliance reviews
with respect to willful neglect, theDepartment proposed to treat
compliance reviews in the same manner
because it believed doing so would

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

strengthen enforcement with respect topotential violations of willful neglect
and would ensure that investigations,
whether or not initiated by a complaint,
would be handled in a consistentmanner. Under proposed § 160.308(b),the Secretary would continue to havediscretion to conduct compliancereviews in circumstances not indicating
willful neglect.
Third, given the HITECH Act’s
requirement that the Secretary impose apenalty for any violation due to willful
neglect, the Department proposedchanges to § 160.312, which currently
requires the Secretary to attempt toresolve investigations or compliancereviews indicating noncompliance by
informal means. The NPRM proposed toprovide instead in § 160.312(a) that the
Secretary ‘‘may’’ rather than ‘‘will’’attempt to resolve investigations orcompliance reviews indicating
noncompliance by informal means. Thischange would permit the Department toproceed with a willful neglect violation
determination as appropriate, while also
permitting the Department to seek
resolution of complaints andcompliance reviews that did notindicate willful neglect violations by
informal means (e.g., where the covered
entity or business associate did notknow and by exercising reasonablediligence would not have known of aviolation, or where the violation is due
to reasonable cause).
Finally, the Department proposed a
conforming change to § 160.304(a),which currently requires the Secretary
to seek, to the extent practicable, thecooperation of covered entities in
obtaining compliance with the HIPAA
Rules. The NPRM proposed to clarify
that the Secretary would continue to doso ‘‘consistent with the provisions of
this subpart’’ in recognition of the new
HITECH Act requirement to impose a
civil money penalty for a violation due
to willful neglect. While the Secretaryoften will still seek to correct
indications of noncompliance throughvoluntary corrective action, there may
be circumstances (such as
circumstances indicating willful
neglect), where the Secretary may
proceed directly to formal enforcement.
Overview of Public Comments
One commenter supported
maintaining the current language at§§ 160.306 and 160.308 of the
Enforcement Rule, providing theSecretary with discretion to conduct
complaint investigations andcompliance reviews, regardless of
indications of willful neglect. One
commenter suggested that OCR look towhether facts indicate a ‘‘probable,’’PO 00000

Frm 00014

Fmt 4701

Sfmt 4700

rather than ‘‘possible,’’ violation due towillful neglect to limit the likelihood of
unnecessary formal investigations orcompliance reviews. While onecommenter supported the proposal torequire a compliance review incircumstances indicating a possible
violation due to willful neglect, othersargued that requiring compliancereviews in such circumstances is not
required by the statute, will detract fromresources to investigate complaints, andwill be duplicative if a formal complaintinvestigation is also underway.
Several commenters expressed
concern over the proposal at§ 160.312(a) to give the Secretary
discretion, rather than to require theSecretary, to attempt to resolve
investigations or compliance reviews
indicating noncompliance by informalmeans, even in cases of noncompliancethat did not involve willful neglect (e.g.,cases involving reasonable cause or lackof knowledge of a violation).
Commenters indicated support for the
Department’s seeking compliancethrough voluntary corrective action as
opposed to formal enforcement
proceedings and argued that the
Department should retain therequirement for the Secretary to attempt
informal resolution in all circumstances
except those involving willful neglect.
One commenter recommended that the
Secretary be able to assess penalties
regardless of whether corrective action
was obtained.
Final Rule
The final rule adopts themodifications to §§ 160.304, 160.306,
160.308, and 160.312, as proposed in
the NPRM. The Department believes
these changes to the enforcement
provisions to be appropriate given the
HITECH Act’s requirements at section
13410(a) with respect to circumstancesindicating or involving noncompliancedue to willful neglect. We do notprovide in the Rule that the Secretary
will investigate when a preliminary
review of the facts indicates a‘‘probable’’ rather than ‘‘possible’’
violation due to willful neglect as thestatute requires an investigation even incases indicating a ‘‘possible’’ violation
due to willful neglect. In response tocommenters concerned about requiring
the Secretary to conduct compliancereviews in circumstances in which facts
indicate a possible violation due towillful neglect, we continue to believe
that, while not expressly required by thestatute, doing so appropriately
strengthens enforcement with respect toviolations due to willful neglect andensures consistency in the handling ofcomplaints and compliance reviews in

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
which violations due to willful neglect
are indicated. We emphasize that the
Department retains discretion to decide
whether to conduct a compliancereview (or complaint investigation)
where a preliminary review of the facts
indicates a degree of culpability lessthan willful neglect. Further, withrespect to commenter concerns about
duplication between complaintinvestigations and compliance reviews,
we clarify that the Department generally
conducts compliance reviews toinvestigate allegations of violations of
the HIPAA Rules brought to the
Department’s attention through amechanism other than a complaint. For
example, the Department may use acompliance review to investigate
allegations of violations of the Rules
brought to our attention through amedia report, or from a State or another
Federal agency. If the Department
initiates an investigation of a complaint
because its preliminary review of thefacts indicates a possible violation due
to willful neglect, the Department is notalso required to initiate a compliancereview under § 160.308 because doing
so would initiate a duplicative
investigation.
With respect to § 160.312, where theRule previously mandated that the
Secretary attempt to resolve indicatedviolations of the HIPAA Rules by
informal means, the final rule now
provides the Secretary with thediscretion to do so, to reflect Section
13410 of the HITECH Act with regard to
violations due to willful neglect.
Nothing in Section 13410 of the
HITECH Act limits the Secretary’s
ability to resolve such cases by informalmeans. However, through its
introduction of higher penalties and its
mandate for formal investigations withregard to possible violations due towillful neglect, Section 13410
strengthens enforcement andaccordingly we have revised § 160.312
so that the Secretary may move directly
to a civil money penalty without
exhausting informal resolution efforts at
her discretion, particularly in cases
involving willful neglect violations.

sroberts on DSK5SPTVN1PROD with

Response to Other Public Comments
Comment: A number of commenters
requested further clarification on thescope and depth of what constitutes a‘‘preliminary review of the facts’’ forpurposes of determining whether facts
indicate a possible violation due towillful neglect and thus, warrant aformal complaint investigation orcompliance review. Certain commenterssuggested that a preliminary review ofthe facts should go beyond merely a

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

review of the allegations asserted in acomplaint.
Response: As noted above, currently
the Department conducts a preliminary
review of every complaint received andproceeds with the investigation in every
eligible case where its preliminary
review of the facts indicates a possible
violation of the HIPAA Rules. The
Department anticipates that somecomplaints, on their face, or reports orreferrals that form the basis of apotential compliance review, willcontain sufficient information toindicate a possible violation due towillful neglect, and some may not. In
any event, the Department may on acase-by-case basis expand thepreliminary review and conduct
additional inquiries for purposes ofidentifying a possible violation due towillful neglect. Notwithstanding thescope of a preliminary review, OCR will
determine if an indicated violation was
due to willful neglect based on theevidence from its investigation of theallegations, even if a violation due towillful neglect was not indicated at the
preliminary review stage.
b. Section 160.310—Protected Health
Information Obtained by the Secretary
Proposed Rule
Section 160.310 requires that covered
entities make information available toand cooperate with the Secretary during
complaint investigations andcompliance reviews. Section
160.310(c)(3) provides that any
protected health information obtainedby the Secretary in connection with aninvestigation or compliance review will
not be disclosed by the Secretary, except
as necessary for determining andenforcing compliance with the HIPAA
Rules or as otherwise required by law.
In the proposed rule, we proposed tomodify this paragraph to also allow the
Secretary to disclose protected healthinformation if permitted under thePrivacy Act at 5 U.S.C. 552a(b)(7).
Section 5 U.S.C. 552a(b)(7) permits thedisclosure of a record on an individual
contained within a government systemof records protected under the Privacy
Act to another agency or instrumentalityof any governmental jurisdiction withinor under the control of the United States
for a civil or criminal law enforcement
activity if the activity is authorized bylaw and if the agency has made awritten request to the agency thatmaintains the record. The proposedchange would permit the Secretary tocoordinate with other law enforcement
agencies, such as the State Attorneys
General pursuing civil actions to enforce
the HIPAA Rules on behalf of State

PO 00000

Frm 00015

Fmt 4701

Sfmt 4700

5579

residents pursuant to section 13410(e) of
the Act, or the FTC pursuing remedies
under other consumer protection
authorities.
Overview of Public Comments
One commenter requested
clarification and transparency on how
or if Federal regulators such as OCR and
the FTC will collaborate, when suchinformation sharing will be initiated oroccur as a routine process, or whether
Federal and State agencies will work
together to enforce suspected violations.
Final Rule
To facilitate cooperation between the
Department and other law enforcement
agencies, the final rule adopts themodifications to § 160.310(c)(3) as
proposed in the NPRM. In response to
the comment regarding transparency in
how the Department is or will cooperatewith other agencies in enforcement, wenote that the Department’s web site at
http://www.hhs.gov/ocr/enforcement/
contains information about how the
Department coordinates with the
Department of Justice to refer cases
involving possible criminal HIPAA
violations and how the Department has
worked with the FTC to coordinate
enforcement actions for violations that
implicate both HIPAA and the FTC Act.
Further, the Department will be working
closely with State Attorneys General tocoordinate enforcement in appropriate
cases, as provided under section
13410(e) of the HITECH Act. The
Department will continue to update its
web site as necessary and appropriate tomaintain transparency with the public
and the regulated community about
these coordinated activities and its otherenforcement actions and activities.
2. Subpart D—Imposition of Civil
Money Penalties
a. Section 160.401—Definitions
Section 160.401 defines ‘‘reasonablecause,’’ ‘‘reasonable diligence,’’ and‘‘willful neglect.’’ Given that section
13410(d) of the HITECH Act uses theseterms to describe the increasing levels of
culpability for which increasing
minimum levels of penalties may be
imposed, the Department moved thesedefinitions in the IFR from their priorplacement at § 160.410, which pertains
only to affirmative defenses, to§ 160.401, so that they would apply tothe entirety of Subpart D of Part 160 andthe provisions regarding the impositionof civil money penalties. The IFR did
not modify the definitions themselves as
the HITECH Act did not amend thedefinitions.
Even though the HITECH Act did notamend the definitions of these terms,

E:\FR\FM\25JAR2.SGM

25JAR2

5580

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

the Department in its NPRM proposed
certain modifications to the definition of‘‘reasonable cause’’ to clarify the mensrea (state of mind) required for thiscategory of violations, and to avoid thesituation where certain violations would
not fall within one of the establishedpenalty tiers. This modification is
discussed below. The Department did
not propose modifications to thedefinitions of ‘‘reasonable diligence’’and ‘‘willful neglect.’’
In the NPRM, the Department also
included examples and guidance as to
how the Department planned to apply
the definitions of ‘‘reasonable cause,’’‘‘reasonable diligence,’’ and ‘‘willful
neglect’’ to distinguish among the tiersof culpability. 75 FR 40877–40879. As
commenters generally found thisguidance helpful, the Department
intends to publish the guidance on its
web site.
Modifications to the Definition of‘‘Reasonable Cause’’sroberts on DSK5SPTVN1PROD with

Proposed Rule
Reasonable cause is currently definedat § 160.401 to mean: ‘‘circumstancesthat would make it unreasonable for thecovered entity, despite the exercise ofordinary business care and prudence, tocomply with the administrative
simplification provision violated.’’ Thisdefinition is consistent with theSupreme Court’s ruling in United Statesv. Boyle, 469 U.S. 241, 245 (1985),
which focused on whether
circumstances were beyond theregulated person’s control, thereby
making compliance unreasonable. See
70 FR 20224, 20238. Prior to the
HITECH Act, section 1176 of the Social
Security Act provided an affirmative
defense to the imposition of a civil
money penalty if the covered entity
established that its violation was due toreasonable cause and not willful neglect
and was corrected within a 30-day
period (or such additional period
determined by the Secretary to beappropriate).
As described above, section 13410(d)of the HITECH Act revised section 1176
of the Social Security Act to establish
four tiers of increasing penalty amounts
to correspond to the levels of culpability
associated with the violation. The firstcategory of violation (and lowest
penalty tier) covers situations where thecovered entity or business associate did
not know, and by exercising reasonablediligence would not have known, of aviolation. The second category of
violation (and next highest penalty tier)applies to violations due to reasonablecause and not to willful neglect. The
third and fourth categories apply to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

circumstances where the violation was
due to willful neglect that is corrected
within a certain time period (second
highest penalty tier) and willful neglectthat is not corrected (highest penaltytier). The mens rea, or state of mind,
associated with the tiers is clear withrespect to the first, third, and fourthcategories, in that there is no mens rea
with respect to the lowest category of
violation, while the existence of mens
rea is presumed with respect to the thirdand fourth categories of violation.
However, the current definition of‘‘reasonable cause’’ does not address
mens rea with respect to the second
category of violations. Therefore, theDepartment proposed to amend thedefinition of ‘‘reasonable cause’’ at§ 160.401 to clarify the mens rea
associated with the reasonable cause
category of violations and to clarify thefull scope of violations that will comewithin the category. Specifically, theDepartment proposed to modify thedefinition of ‘‘reasonable cause’’ tomean ‘‘an act or omission in which acovered entity or business associateknew, or by exercising reasonablediligence would have known, that theact or omission violated anadministrative simplification provision,
but in which the covered entity or
business associate did not act withwillful neglect.’’ Thus, the proposed
definition would now include violations
due both to circumstances that would
make it unreasonable for the covered
entity or business associate, despite theexercise of ordinary business care andprudence, to comply with theadministrative simplification provision
violated, as well as to othercircumstances in which a covered entity
or business associate has knowledge ofa violation but lacks the conscious
intent or reckless indifference
associated with the willful neglect
category of violations.
Overview of Public Comments
Commenters addressing the definitionof ‘‘reasonable cause’’ expressed general
support for the proposed clarifications
to the scope of this category of
violations.
Final Rule
The final rule adopts the proposed
modifications to the definition.
b. Section 160.402—Basis for a Civil
Money Penalty
Proposed Rule
Section 160.402(a) states generallythat the Secretary will impose a civil
money penalty upon a covered entity if
the Secretary determines that thecovered entity violated an

PO 00000

Frm 00016

Fmt 4701

Sfmt 4700

administrative simplification provision.
Section 164.402, in paragraphs (b) and(c), provides the basis for a civil money
penalty against a covered entity wheremore than one covered entity is
responsible for a violation, where anaffiliated covered entity is responsible
for a violation, and where an agent of acovered entity is responsible for aviolation.
The proposed rule proposed toremove the exception at § 160.402(c) forcovered entity liability for the acts of its
agent in cases where the agent is abusiness associate, the relevant contract
requirements have been met, thecovered entity did not know of a patternor practice of the business associate inviolation of the contract, and thecovered entity did not fail to act as
required by the Privacy or Security Rulewith respect to such violations. The
proposed rule also proposed to add aparallel provision in a new paragraph(2) at § 160.402(c) that would provide
for civil money penalty liability against
a business associate for the acts of its
agent. The existing language of§ 160.402(c) regarding the liability ofcovered entities for the acts of theiragents would be re-designated asparagraph (1).
These proposed changes would makecovered entities and business associates
liable under § 160.402(c) for the acts of
their business associate agents, inaccordance with the Federal common
law of agency, regardless of whether thecovered entity has a compliant businessassociate agreement in place. Section
160.402(c) closely tracks the language insection 1128A(l) of the Social Security
Act, which is made applicable to HIPAA
by section 1176(a)(2) of such Act, whichstates that ‘‘a principal is liable forpenalties * * * under this section for
the actions of the principal’s agentsacting within the scope of the agency.’’
One reason for removing the exception
to the general provision at § 160.402(c),as we explained in the NPRM, is toensure, where a covered entity or
business associate has delegated out anobligation under the HIPAA Rules, thata covered entity or business associate
would remain liable for penalties for the
failure of its business associate agent toperform the obligation on the covered
entity or business associate’s behalf.
Overview of Public Comments
Several commenters requested thatthe Department clarify and provide
additional guidance regarding how theFederal common law of agency applies
to business associate relationships.
These commenters expressed an overall
concern that applying the Federal
common law of agency to business

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withassociate relationships would add
unnecessary confusion to and place an
undue burden on business associate
relationships. Several commentersargued that the proposed change would
require covered entities and businessassociates to determine whether theirbusiness associates or business associate
subcontractors are agents, resulting incostly and burdensome challenges whendrafting business associate contracts andmonitoring ongoing relationships. One
commenter argued that the Federal
common law of agency should not beapplied to covered entity and businessassociate relationships because it does
not generally control when the parties
have entered into a contractual
agreement that specifies their respective
rights and obligations. Instead, thecommenter argued, the contractual
provisions control, and are interpreted
and enforced in accordance with Statelaw specified by the contract.
Final Rule
This final rule adopts the proposed
modifications to § 160.402(c). We do notbelieve that this change will place an
undue burden on covered entities andbusiness associates. As we explained in
the NPRM, a covered entity’s liability
for acts of its agents is customary undercommon law. See 75 FR 40880. Further,section 1128A(l) of the Social Security
Act, applicable to HIPAA covered
entities and now business associates bysection 1176(a)(2) of the Act, states thata principal is liable for civil money
penalties for the actions of theprincipal’s agent acting within the scopeof agency. Before the changes to§ 160.402(c) were finalized in this rule,
if a covered entity failed to comply withthe business associate provisions in the
HIPAA Rules, a covered entity
potentially would have been liable forthe actions of its business associate
agent. Thus, we believe that the notionthat a principal is liable for the acts of
its agent should not be an unfamiliar
concept to covered entities and businessassociates. However, we appreciate andunderstand the commenters’ concerns
and take this opportunity to provide
additional guidance.
While section 1128A(l) is silent as to
how to define ‘‘principal,’’ ‘‘agent,’’ and‘‘scope of agency,’’ § 160.402(c)references the Federal common law ofagency. As we explained in the
Enforcement Rule preamble, 71 FR
8390, 8403–04, adopting the Federal
common law to determine thedefinitions and application of theseterms achieves nationwide uniformity
in the implementation of the HIPAA
Rules. We believe that relying on theFederal common law is particularly

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

important because of HIPAA’s express
objective of furthering the efficiency andeffectiveness of the health care system
as a whole. Further, adopting theFederal common law here is consistent
with the precept that Federal statutes
are meant to have uniform nationwide
application. Therefore, we disagree withthe comment that argued that Federal
common law should not be applied withrespect to relationships between
covered entities and business associates.
An analysis of whether a businessassociate is an agent will be fact
specific, taking into account the terms ofa business associate agreement as wellas the totality of the circumstances
involved in the ongoing relationshipbetween the parties. The essential factor
in determining whether an agency
relationship exists between a covered
entity and its business associate (orbusiness associate and its subcontractor)
is the right or authority of a covered
entity to control the business associate’s
conduct in the course of performing aservice on behalf of the covered entity.
The right or authority to control thebusiness associate’s conduct also is theessential factor in determining whether
an agency relationship exists between abusiness associate and its businessassociate subcontractor. Accordingly,
this guidance applies in the samemanner to both covered entities (withregard to their business associates) andbusiness associates (with regard to theirsubcontractors).
The authority of a covered entity togive interim instructions or directions is
the type of control that distinguishes
covered entities in agency relationships
from those in non-agency relationships.
A business associate generally would
not be an agent if it enters into abusiness associate agreement with acovered entity that sets terms andconditions that create contractual
obligations between the two parties.
Specifically, if the only avenue ofcontrol is for a covered entity to amend
the terms of the agreement or sue forbreach of contract, this generallyindicates that a business associate is not
acting as an agent. In contrast, abusiness associate generally would bean agent if it enters into a businessassociate agreement with a covered
entity that granted the covered entity
the authority to direct the performanceof the service provided by its businessassociate after the relationship wasestablished. For example, if the terms ofa business associate agreement between
a covered entity and its businessassociate stated that ‘‘a businessassociate must make available protected
health information in accordance with§ 164.524 based on the instructions to be

PO 00000

Frm 00017

Fmt 4701

Sfmt 4700

5581

provided by or under the direction of acovered entity,’’ then this would createan agency relationship between the
covered entity and business associate
for this activity because the covered
entity has a right to give interim
instructions and direction during thecourse of the relationship. An agency
relationship also could exist between acovered entity and its business associate
if a covered entity contracts out ordelegates a particular obligation underthe HIPAA Rules to its businessassociate. As discussed above, whether
or not an agency relationship exists inthis circumstance again would dependon the right or authority to control thebusiness associate’s conduct in theperformance of the delegated service
based on the right of a covered entity togive interim instructions.
While these principles are wellestablished under the Federal common
law of agency, we again note that any
analysis regarding scope of agency
depends on the facts of eachcircumstance. Several factors areimportant to consider in any analysis todetermine the scope of agency: (1) The
time, place, and purpose of a businessassociate agent’s conduct; (2) whether abusiness associate agent engaged in acourse of conduct subject to a covered
entity’s control; (3) whether a businessassociate agent’s conduct is commonly
done by a business associate toaccomplish the service performed onbehalf of a covered entity; and (4)whether or not the covered entity
reasonably expected that a businessassociate agent would engage in the
conduct in question.
The terms, statements, or labels given
to parties (e.g., independent contractor)
do not control whether an agency
relationship exists. Rather, the mannerand method in which a covered entity
actually controls the service provided
decides the analysis. As mentioned
above, an analysis of whether a businessassociate is an agent will be fact specificand consider the totality of thecircumstances involved in the ongoing
relationship between the parties. We
note here several circumstances that areimportant. The type of service and skill
level required to perform the service are
relevant factors in determining whether
a business associate is an agent. For
example, a business associate that is
hired to perform de-identification ofprotected health information for a small
provider would likely not be an agent
because the small provider likely would
not have the expertise to provide
interim instructions regarding thisactivity to the business associate. Also,an agency relationship would not likely
exist when a covered entity is legally or

E:\FR\FM\25JAR2.SGM

25JAR2

5582

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withotherwise prevented from performing
the service or activity performed by its
business associate. For example, theaccreditation functions performed by abusiness associate cannot be performed
by a covered entity seeking
accreditation because a covered entity
cannot perform an accreditation survey
or award accreditation. We also notethat a business associate can be an agentof a covered entity: (1) Despite the factthat a covered entity does not retain theright or authority to control every aspectof its business associate’s activities; (2)even if a covered entity does not
exercise the right of control but
evidence exists that it holds theauthority to exercise that right; and (3)even if a covered entity and its businessassociate are separated by physicaldistance (e.g., if a covered entity andbusiness associate are located indifferent countries).
Response to Other Public Comments
Comment: One commenter asked
whether the Department intends toeliminate the exceptions afforded by theFederal common law of agency. This
commenter also argued that if a businessassociate were an agent of a covered
entity, and a HIPAA compliant businessassociate agreement was in place, any
deviation from the terms in theagreement would be by definition
outside the scope of agency.
Response: As we discussed above,§ 160.402(c) provides that covered
entities and business associates areliable for the acts of their businessassociate agents, in accordance with theFederal common law of agency. Section
160.402(c) is derived from section
1128A(l) of the Social Security Act
which states that ‘‘a principal is liablefor penalties * * * under this section
for the actions of the principal’s agentsacting within the scope of the agency.’’
Accordingly, § 160.402(c) incorporates
the Federal common law of agency,
which includes the understanding thatfor a principal to be liable for theactions of an agent, the agent must be
acting within the scope of agency. Thus,
the exceptions to the Federal common
law of agency (as the commenter
identified them) are incorporated in the
final rule at § 160.402(c).
We do not agree with the commenter
that any deviation from the terms in abusiness associate contract would be bydefinition outside the scope of agency.
A business associate agent’s conduct
generally is within the scope of agency
when its conduct occurs during theperformance of the assigned work or
incident to such work, regardless ofwhether the work was done carelessly,
a mistake was made in the performance,

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

or the business associate disregarded acovered entity’s specific instruction. For
example, a business associate agent
would likely be acting within the scopeof agency if it impermissibly disclosed
more than the minimum necessary
information to a health plan for
purposes of payment, even if thedisclosure is contrary to clear
instructions of the covered entity. In
contrast, a business associate agent’s
conduct generally is outside the scopeof agency when its conduct is solely for
its own benefit (or that of a third party),or pursues a course of conduct notintended to serve any purpose of thecovered entity.
Comment: One commenter stated thatthe proposed change would impose
strict liability on covered entities for theactions of third parties not under theircontrol. Another commenter stated thatan agent would always fall within thescope of a workforce member, which bydefinition is not a business associate.
Response: We disagree with bothcomments and believe that thecomments may reflect a
misunderstanding of the proposedchange. First, as explained above,§ 160.402(c) closely tracks the language
in section 1128A(l) of the Social
Security Act, which is made applicable
to HIPAA by section 1176(a)(2) of such
Act. It does not make a covered entity
or business associate liable for the actsof third parties that are not under its
control because such third parties are
not its agents. With regard to the second
comment, an agent could always fallwithin the definition of a workforce
member because of the direct control
requirement in that definition, but thedefinition of business associate excludes
a workforce member. This definitional
exclusion allows the covered entity todetermine whether, for example, toprovide training to the agent under thePrivacy Rule. A covered entity would be
required to provide training to aworkforce member but not to a businessassociate agent. However, the covered
entity is required to enter into abusiness associate agreement with abusiness associate agent that it does nottreat as a workforce member. The
proposed change to § 160.402(c) simply
makes the covered entity or businessassociate liable for the acts of its agentsacting within the scope of agency,
whether the agents are workforce
members or business associates. See thedefinitions of ‘‘business associate’’ and‘‘workforce member’’ at § 160.103.

PO 00000

Frm 00018

Fmt 4701

Sfmt 4700

c. Section 160.404—Amount of a Civil
Monetary Penalty
Interim Final Rule
The IFR amended § 160.404 to revise
the range of potential civil money
penalty amounts a covered entity (orbusiness associate) will be subject to forviolations occurring on or after February
18, 2009, as a result of section 13410(d)of the HITECH Act.
Prior to the HITECH Act, section
1176(a) of the Social Security Act
authorized the Secretary to impose a
civil money penalty of not more than$100 for each violation, with the total
amount imposed on a covered entity for
all violations of an identicalrequirement or prohibition during acalendar year not to exceed $25,000. As
described above, section 13410(d) of the
HITECH Act modified section 1176(a) toestablish tiers of increasing penalty
amounts for violations based onincreasing levels of culpability
associated with each tier.
Accordingly, the IFR adopted at§ 160.404(b) the new penalty scheme
provided for at section 13410(d) of the
HITECH Act for violations occurring on
or after February 18, 2009. The IFR
retained the pre-HITECH maximum
penalty amounts of not more than $100
per violation and $25,000 for identical
violations during a calendar year, forviolations occurring before February 18,
2009.
In adopting the HITECH Act’s penalty
scheme, the Department recognized that
section 13410(d) contained apparently
inconsistent language (i.e., its reference
to two penalty tiers ‘‘for each violation,’’each of which provided a penalty
amount ‘‘for all such violations’’ of an
identical requirement or prohibition ina calendar year). To resolve thisinconsistency, with the exception ofviolations due to willful neglect that are
not timely corrected, the IFR adopted arange of penalty amounts between theminimum given in one tier and the
maximum given in the second tier foreach violation and adopted the amountof $1.5 million as the limit for all
violations of an identical provision of
the HIPAA rules in a calendar year. For
violations due to willful neglect that are
not timely corrected, the IFR adopted
the penalty amount of $50,000 as theminimum for each violation and $1.5
million for all such violations of an
identical requirement or prohibition ina calendar year.
Specifically, the IFR revised § 160.404
to provide, for violations occurring on
or after February 18, 2009, the new
HITECH penalty scheme, as follows: (1)
For violations in which it is establishedthat the covered entity did not know

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
and, by exercising reasonable diligence,
would not have known that the covered
entity violated a provision, an amount
not less than $100 or more than $50,000
for each violation; (2) for a violation inwhich it is established that the violation
was due to reasonable cause and not towillful neglect, an amount not less than

$1000 or more than $50,000 for eachviolation; (3) for a violation in which itis established that the violation was due
to willful neglect and was timely
corrected, an amount not less than
$10,000 or more than $50,000 for eachviolation; and (4) for a violation inwhich it is established that the violation

5583

was due to willful neglect and was nottimely corrected, an amount not lessthan $50,000 for each violation; exceptthat a penalty for violations of the samerequirement or prohibition under any ofthese categories may not exceed$1,500,000 in a calendar year. See Table
2 below.

TABLE 2—CATEGORIES OF VIOLATIONS AND RESPECTIVE PENALTY AMOUNTS AVAILABLE
Violation category—Section 1176(a)(1)Each violation

sroberts on DSK5SPTVN1PROD with(A) Did Not Know .............................................................................................................................
(B) Reasonable Cause ....................................................................................................................
(C)(i) Willful Neglect-Corrected ........................................................................................................
(C)(ii) Willful Neglect-Not Corrected ................................................................................................

In applying these amounts, theDepartment will not impose themaximum penalty amount in all cases
but rather will determine the penalty
amounts as required by the statute at
section 1176(a)(1) and the regulations at§ 160.408 (i.e., based on the nature andextent of the violation, the nature andextent of the resulting harm, and theother factors set forth at § 160.408).
Further, for counting violations, theDepartment continues to utilize themethodology discussed in priorpreambles of the Enforcement Rule. See
70 FR 20224, 20233–55 (April 18, 2005)
and 71 FR 8390, 8404–07 (February 16,2006). For violations that began prior to
February 18, 2009, and continue afterthat date, the Department will treat
violations occurring before February 18,
2009, as subject to the penalties in effectprior to February 18, 2009, andviolations occurring on or after February
18, 2009, as subject to the penalties in
effect on or after February 18, 2009.

Some commenters specifically
expressed concern about the maximum
penalty amounts set forth for eachviolation (i.e., $50,000) and for all
violations of an identical provision in acalendar year ($1,500,000). Commentersargued that the IFR’s penalty scheme isinconsistent with the HITECH Act’s
establishment of different tiers based on
culpability because the outside limits
were the same for all culpability
categories and this ignored the outside
limits set forth by the HITECH Act
within the lower penalty tiers, rendering
those limits meaningless. A few
commenters expressed particularconcern with what they believed to be
the unfair ability of the Secretary to
impose the maximum penalty amounts
to violations falling within the twolowest categories of culpability (i.e., did
not know violations and violations due
to reasonable cause and not willful
neglect).

Overview of Public Comments

This final rule retains the revised
penalty structure in § 160.404(b) as
implemented by the IFR. We continue tobelieve the penalty amounts areappropriate and reflect the most logicalreading of the HITECH Act, which
provides the Secretary with discretion
to impose penalties for each category of
culpability up to the maximum amountdescribed in the highest penalty tier.
With respect to those comments
expressing concern about the discretion
available to the Secretary under the
adopted scheme we emphasize againthat the Department will not impose themaximum penalty amount in all cases
but will rather determine the amount ofa penalty on a case-by-case basis,
depending on the nature and extent of
the violation and the nature and extent
of the resulting harm, as required by the
HITECH Act, as well as the other factors

Most comments on the civil money
penalty amounts expressed concern
with the new penalty structure set forthin the IFR. A few of these commenters
expressed a generalized concern about
the potential impact the available
penalty amounts might have on covered
entities, particularly smaller entities.
One commenter argued that the
Secretary should not fine entities forviolations of which a covered entity had
no knowledge or those due toreasonable cause, and that civil money
penalties should only be imposed as alast resort. A few commenters expressed
concern with the Secretary’s wide rangeof discretion in determining a civil
money penalty amount and suggested
that the regulations or guidance should
further define how the Secretary would
determine such an amount.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Final RulePO 00000

Frm 00019

Fmt 4701

Sfmt 4700$100–$50,000
1,000–50,000
10,000–50,000
50,000All such violations of
an identical provision
in a calendar year
$1,500,000
1,500,000
1,500,000
1,500,000

set forth at § 160.408. In response to
those commenters particularly
concerned about the impact of penalties
on smaller entities, we note that theother factors include both the financial
condition and size of the covered entity
or business associate. These factors are
discussed more fully below.
In addition, with respect to comments
expressing specific concern about
fairness regarding those violations ofwhich an entity did not know or by
exercising reasonable diligence would
not have known or for which there wasa reasonable cause and not willful
neglect, we note that in both cases anentity may establish that an affirmative
defense applies under § 160.410, where
the entity corrects the violation within
30 days from the date the entity had
knowledge of the violation or with theexercise of reasonable diligence would
have had knowledge of the violation, or
during a period determined appropriateby the Secretary based upon the natureand extent of the entity’s failure tocomply. These affirmative defenses aredescribed more fully below.
In addition, Section 13410(d) of the
HITECH Act and Section 1176(a) of theSocial Security Act, give the Secretary
further ability to waive a civil money
penalty, in whole or in part, undercertain circumstances. Thus, to theextent an entity fails to correct such
violations within the mandated
timeframe, the Secretary may alsoutilize her waiver authority provided forat § 160.412, to waive the penalty
amount in whole or in part, to the extent
that payment of the penalty would be
excessive relative to the violation.
Further, pursuant to 42 U.S.C. 1320a–
7a(f), the Secretary always has thediscretion to settle any issue or case or
to compromise the amount of a civil
money penalty assessed for a violationof the HIPAA Rules.

E:\FR\FM\25JAR2.SGM

25JAR2

5584

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

Finally, in the event an entity believes
that a civil money penalty has been
imposed unfairly, the entity could
exercise its right under § 160.504 to
appeal the imposition of a civil money
penalty in a hearing before an
administrative law judge.

sroberts on DSK5SPTVN1PROD with

Response to Other Public Comments
Comment: We received a few
comments in response to the IFR and
NPRM requesting clarification as to how
the Secretary will count violations forpurposes of calculating civil money
penalties. One commenter requested
clarification as to how the numbers of‘‘occurrences’’ are determined,suggesting that penalties could be verysignificant, and vary significantly,
depending on the counting methodology
utilized. The Department also received
one comment asking whether a violation
is defined as one event. This commenter
queried, for example, whether the lossof unsecured electronic media would beconsidered as a single violation, even if
the media contained several hundred
records. The commenter also asked for
confirmation that $1,500,000 is theaggregate limit of all fines for all
violations in a given calendar year
which would apply across an entire
enterprise, regardless of violations
occurring in different business units.
Response: How violations are counted
for purposes of calculating a civil
money penalty vary depending on thecircumstances surrounding thenoncompliance. Generally speaking,where multiple individuals are affectedby an impermissible use or disclosure,
such as in the case of a breach of
unsecured protected health information,
it is anticipated that the number ofidentical violations of the Privacy Rulestandard regarding permissible uses anddisclosures would be counted by the
number of individuals affected. Further,with respect to continuing violations,such as lack of appropriate safeguards
for a period of time, it is anticipated thatthe number of identical violations of thesafeguard standard would be counted ona per day basis (i.e., the number of days
the entity did not have appropriate
safeguards in place to protect theprotected health information). Note alsothat in many breach cases, there will beboth an impermissible use or disclosure,
as well as a safeguards violation, foreach of which the Department may
calculate a separate civil money penalty.
We refer readers to prior Enforcement
Rule preambles for additional
discussion on the counting
methodology. See 70 FR 20224, 20233–
55 (April 18, 2005) and 71 FR 8390,
8404–07 (February 16, 2006).

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

With respect to whether the aggregate
CMP limit of $1.5 million would apply
to all violations in a given calendar year,
across an entire enterprise, regardless ofviolations occurring in different
business units of the enterprise, we notethat the Enforcement Rule’s penalty
scheme, and thus the limit for identical
violations in a calendar year applies tothe legal entity that is a covered entity
or business associate. However, as we
indicated above, a covered entity or
business associate may be liable formultiple violations of multiple
requirements, and a violation of eachrequirement may be counted separately.
As such, one covered entity or businessassociate may be subject to multiple
violations of up to a $1.5 million cap foreach violation, which would result in a
total penalty above $1.5 million.
d. Section 160.408—Factors Consideredin Determining the Amount of a Civil
Money Penalty
Proposed Rule
Section 160.408 implements section
1176(a)(2) of the Social Security Act,
which requires the Secretary, when
imposing a civil money penalty, toapply the provisions of section 1128A of
the Social Security Act ‘‘in the samemanner as such provisions apply to theimposition of a civil money penalty
under section 1128A.’’ In determining apenalty amount, section 1128A requires
the Secretary to take into account thenature of the claims and thecircumstances under which they were
presented; the degree of culpability,
history of prior offenses and financial
condition of the person presenting theclaims; and such other matters as justice
may require.
Section 160.408 adopted these factors
and provided a more specific list of
circumstances within each. Because theEnforcement Rule applies to a numberof rules, which apply to an enormous
number of entities and circumstances,
the Secretary has the discretion todecide whether and how to consider thefactors (i.e., as either aggravating or
mitigating) in determining the amountof a civil money penalty.
As previously indicated, section
13410(d) of the HITECH Act modified
section 1176(a)(1) of the Social Security
Act to require that the Department basedeterminations of appropriate penalty
amounts on the nature and extent of theviolation and the nature and extent of
the harm resulting from such violation.
However, the HITECH Act did notmodify section 1176(a)(2),which
continues to require application of thefactors in section 1128A.

PO 00000

Frm 00020

Fmt 4701

Sfmt 4700

The proposed rule proposed to revise
the structure and list of factors at§ 160.408 to make explicit the new
HITECH Act requirement that the
Secretary consider the nature and extent
of the violation and the nature andextent of the harm resulting from theviolation, in addition to those factors
enumerated in section 1128A. We
proposed to exclude, however, thefactor at § 160.408(c) regarding thedegree of culpability of the covered
entity, which originated in section
1128A, because culpability is now
reflected in the penalty tiers.
Specifically, the Department proposed
to revise § 160.408(a) to identify ‘‘thenature and extent of the violation,’’ ‘‘thenature and extent of the harm resulting
from the violation,’’ and the ‘‘history ofprior compliance with theadministrative simplification provision,
including violations by the covered
entity or business associate,’’ the‘‘financial condition of the covered
entity or business associate,’’ and ‘‘suchother matters as justice may require,’’ as
the five general factors the Secretary
will consider in determining a civil
money penalty. Under each of thesecategories, we proposed to reorganize
and list the specific factors that may beconsidered.
In addition, in the first, second, andthird factors, we proposed to add certain
circumstances which may be considered
in determining a penalty amount. Under
the first factor, we proposed to add ‘‘thenumber of individuals affected’’ asrelevant to the extent of a violation.
Under the second factor, we proposed toadd ‘‘reputational harm’’ to the specificcircumstances which may beconsidered, to make clear that
reputational harm is as cognizable aform of harm as physical or financial
harm. Finally, in the third factor, theDepartment proposed to modify thephrase ‘‘prior violations’’ to‘‘indications of noncompliance,’’because use of the term ‘‘violation’’ isgenerally reserved for instances where
the Department has made a formal
finding of a violation through a noticeof proposed determination. However, acovered entity’s general history of
HIPAA compliance is relevant indetermining the amount of a civil
money penalty within the penalty range.
The Department did not propose tomodify the Secretary’s discretion in how
to apply the factors—i.e., as either
mitigating or aggravating.
Overview of Public Comments
We received one comment requestingthat the Department limit the number of
mitigating factors it will consider when
determining penalty amounts and apply

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
civil money penalties in every case ofnoncompliance, including where
resolution and compliance have beenachieved by informal means. The
commenter also argued that a covered
entity’s or business associate’s financial
condition or financial difficulties
should not be considered as mitigating
factors in determining the amount ofcivil money penalties. The commenter
recommended that penalties should
apply to all violators except those who
despite due diligence could not discover
the violation, who reported the violation
immediately, and who fully corrected
the problem within 30 days of
discovery.
We received two comments insupport of considering reputationalharm in the computation of civil money
penalties. One commenter emphasizedthat reputational harm addresses harm
to individuals’ dignity interest andrecommended the inclusion of ‘‘other’’harm as well. However, another covered
entity expressed concern that damages
for reputational harm are difficult toquantify and, therefore, claims mightlead to protracted litigation and
expensive settlements, ultimately
increasing the costs of health care.
Finally, we received one comment
requesting examples of situations
involving a cognizable claim of
reputational harm.
We also received several comments
requesting that the Department continue
to consider the degree of culpability
when determining the amount of a civil
money penalty. One commenter
specifically recommended that the
Department consider whether
unauthorized access has occurred when
determining civil money penalty
amounts. We also received one
comment suggesting that the
Department revise proposed§ 160.408(c) to recognize as a mitigating
factor whether the current violation isinconsistent with an entity’s priorhistory of compliance.
With respect to the evaluation of acovered entity’s or business associate’s
history of prior compliance, we received
a number of comments expressing
concern that replacing ‘‘violations’’ with‘‘indications of noncompliance’’ would
create ambiguity, and would notadequately inform covered entities andbusiness associates of the factors thatthe Department will consider when
determining civil money penalty
amounts. The commenters expressed
concern that expanding the evaluationof prior compliance beyond
documented, formal findings ofnoncompliance would permit the
Department to rely on information of
dubious credibility. Commenters

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

requested that, to prevent uncertainty,
the Department either retain the term‘‘violations’’ or provide a clear
definition, including examples, of‘‘indications of noncompliance.’’
Finally, we received several
comments requesting additional
examples and guidance on how the
Department will apply the factors inassessing penalty amounts.
Final Rule
The final rule adopts the proposed
modifications. We do not eliminate thefactors concerning an entity’s financial
condition, as such factors are based on
the requirement in section 1128A(d) of
the Social Security Act. We emphasizethat the goal of enforcement is to ensurethat violations do not recur without
impeding access to care. Further, wenote that an entity’s financial condition
can affect a civil money penalty ineither direction, that is, while an entity
in poor financial condition may face alesser penalty if its financial condition
affected its ability to comply, an entitywith greater financial resources could be
subject to higher penalties forviolations, in part because it had theresources to maintain compliance.
When considering the nature of theviolation, the Department intends toconsider factors such as the time period
during which the violation(s) occurred
and the number of individuals affected.
Such considerations reflect the nature of
the violation, specifically with respect
to potential violations that affect a large
number of individuals, for example,
where disclosure of protected healthinformation in multiple explanation of
benefits statements (EOBs) that were
mailed to the wrong individuals
resulted from one inadequate safeguard
but affected a large number ofbeneficiaries. However, we do recognizethat these specific circumstances mightalso be considered under § 160.406,
with respect to counting violations. See
71 FR 8390, 8409.
Whether reputational harm is
implicated in a HIPAA violation will bea fact-specific inquiry. We emphasize,
however, that we do not consider
reputational harm to arise solely fromthe unlawful disclosure of protected
health information relating to medical
diagnoses that may be consideredespecially sensitive, such as sexuallytransmitted infections or mental healthdisorders. Rather, the facts of thesituation will determine whether
reputational harm has occurred, such aswhether the unlawful disclosure
resulted in adverse effects on
employment, standing in thecommunity, or personal relationships.
With respect to requests to consider

PO 00000

Frm 00021

Fmt 4701

Sfmt 4700

5585‘‘other’’ harm or whether unauthorizedaccess has occurred, we reiterate that, in
determining the nature and extent of theharm involved, we may consider all
relevant factors, not just those expressly
included in the text of the regulation.
Regarding the shift in terminology
from ‘‘history of violations’’ to ‘‘priorindications of noncompliance,’’ we notethat use of the terms ‘‘violation’’ or‘‘violate’’ generally indicates that the
Department has made a formal findingof a violation through a notice ofproposed determination. Because theDepartment has a number ofenforcement tools, such as informal
resolution through a corrective action
plan, the number of ‘‘violations’’
incurred by a covered entity or businessassociate does not constitute an accurate
picture of a covered entity’s or businessassociate’s general history ofcompliance with all HIPAA Rules,
which is relevant in determining theamount of a civil money penalty within
the penalty range. See 71 FR 8390, 8408.
As such, the Department modified theprovision to reflect the Department’s
policy of considering the covered
entity’s or business associate’s general
history of compliance with the HIPAA
Rules when determining a civil money
penalty.
With regard to the phrase ‘‘indicationsof noncompliance,’’ we first clarify thata mere complaint does not constitute anindication of noncompliance. Instead,prior indications of noncompliance may
refer to the number of times the
Department has investigated an entity inthe past and discovered indications ofnoncompliance that the Department
resolved by informal means, such as
satisfactory corrective action voluntarily
taken by the covered entity. Finally, we
agree that an entity’s history ofcompliance—not only a history of
noncompliance—is important, and willconsider such a factor.
e. Section 160.410—Affirmative
Defenses
Interim Final Rule and Proposed RuleAs noted above, the IFR made changes
to the affirmatives defenses found in the
Enforcement Rule at § 160.410 to
implement the modifications to section
1176(b) of the Social Security Act madeby section 13410(d) of the HITECH Act.
Specifically, the IFR removed theprevious affirmative defense to theimposition of penalties if the covered
entity did not know and with theexercise of reasonable diligence would
not have known of the violation (sincesuch violations are now punishable
under the lowest tier of penalties), andby providing a prohibition on the

E:\FR\FM\25JAR2.SGM

25JAR2

5586

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

imposition of penalties for any violationthat is corrected within a 30-day time
period, as long as the violation was notdue to willful neglect.
The proposed rule included
additional modifications to § 160.410 toconform to the changes made to section
1176(b) by the HITECH Act.
Specifically, we proposed to implement
the revision of section 1176(b)(1) of theSocial Security Act by providing in§ 160.410(a)(1) and (2) that theaffirmative defense of criminally‘‘punishable’’ is applicable to penalties
imposed prior to February 18, 2011, andon or after February 18, 2011, theSecretary’s authority to impose a civil
money penalty will only be barred tothe extent a covered entity or businessassociate can demonstrate that acriminal penalty has been imposed.
Additionally, the Department also
proposed modifications to theaffirmative defenses in § 160.410 for
violations occurring prior to February
18, 2009, to ensure the prior definitionof ‘‘reasonable cause’’ continued toapply in such circumstances andavoiding any potential issues regarding
a retroactive application of the revisedterm.

sroberts on DSK5SPTVN1PROD with

Final Rule
The final rule adopts the proposed
modifications to § 160.410. The
Department did not receive any
comments in response to the NPRM’s
proposed revisions to this section.

Overview of Public Comments

f. Section 160.412—Waiver
Prior to February 18, 2009, § 160.412
stated that ‘‘[f]or violations described in§ 160.410(b)(3)(i) that are not corrected
within the period described in§ 160.410(b)(3)(ii), the Secretary may
waive the civil money penalty, in whole
or in part, to the extent that payment of
the penalty would be excessive relative
to the violation.’’ This language
implicitly recognized a covered entity’s
ability to claim an affirmative defense to
the imposition of a civil money penalty,
under what was then § 160.410(b)(2), by
establishing that it did not haveknowledge of the violation, determinedin accordance with the Federal common
law of agency, and by exercisingreasonable diligence, would not have
known that the violation occurred.
While section 13410(d) of the HITECH
Act revised section 1176(b) of the Social
Security Act to eliminate the affirmative
defense for such violations, absent
corrective action during a 30-day
period, it did not revise the Secretary’s
waiver authority. As a result, theEnforcement IFR amended § 160.412 toreflect the revisions made to § 160.410
to provide that ‘‘[r]egardless of whether

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

violations occur before, on, or after
February 18, 2009, the Secretary had theauthority to provide a waiver forviolations due to reasonable cause andnot willful neglect that are not timely
corrected (pursuant to the correction
period in revised § 160.410(a)(3)(ii) or(b)(2)(ii), as applicable).’’ See 74 FR
56129.
The proposed rule included
conforming changes to § 160.412 toalign the provision with the revisions to§ 160.410. See 75 FR 40881. The
proposed revision would effectively
provide the Secretary with the authority
to waive a civil money penalty, inwhole or in part, for violations
described in § 160.410(b)(2) (occurring
prior to February 18, 2009, and due tocircumstances that would make it
unreasonable for the covered entity,
despite the exercise of ordinary businesscare and prudence, to comply with theadministrative simplification provision
violated) or § 160.410(c) (occurring on
or after February 18, 2009, andinvolving an establishment to thesatisfaction of the Secretary that theviolation is not due to willful neglect)
and that are not corrected within the
period specified under such paragraphs.

The Department received a few
comments in response to the IFR
regarding the Secretary’s authority towaive the imposition of a civil money
penalty for violations occurring on orafter February 18, 2009, each of whichurged that the Secretary’s waiverauthority be extended to apply also to
penalties for violations of which acovered entity did not know, or throughthe exercise of reasonable diligence,
would not have known, in addition toreasonable cause violations, because‘‘did not know’’ violations are a lessculpable category of violation thanreasonable cause violations.
Final Rule
The final rule adopts themodifications to § 160.412 proposed in
the NPRM, which addresses theconcerns of the above commenters on
the IFR.
g. Section 160.418—Penalty Not
Exclusive
Proposed Rule
We proposed to revise this section toincorporate a reference to the provisionof PSQIA at 42 U.S.C. 299b–22 thatprovides that penalties are not to be
imposed under both PSQIA and the
HIPAA Privacy Rule for the same
violation.

PO 00000

Frm 00022

Fmt 4701

Sfmt 4700

Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule adopts the
proposed modification to § 160.418.
h. Section 160.420—Notice of Proposed
Determination
Interim Final Rule
The Enforcement IFR also amended§ 160.420(a)(4) to add the requirement
that, in addition to the proposed penalty
amount, the Secretary identify in a
notice of proposed determination theapplicable violation category in§ 160.404 upon which the proposed
penalty amount is based. While notstatutorily required, the Enforcement
IFR included this amendment toprovide covered entities and businessassociates with additional informationthat would increase their understandingof the violation findings in the notice ofproposed determination.
Overview of Public Comment
The Department received threecomments supporting this amendment.
Final Rule
The final rule retains the provision as
modified in the IFR.
i. Calculation of the 30-Day Cure Period
for Willful Neglect Violations
Interim Final Rule
In its discussion of the HITECH Act’s
revision of affirmative defenses, theDepartment noted that section
1176(b)(2)(A) of the Social Security Act
still operates to exclude violations due
to willful neglect from those that, if
timely corrected, would be exempt fromthe Secretary’s imposition of a civil
money penalty. However, a covered
entity’s timely action to correct still
would be determinative with respect towhich of the two tiers of willful neglect
penalty amounts would apply. To
determine the appropriate penalty tierfor such violations, the Department
stated it would calculate the 30-day cure
period in the same manner as describedfor determining whether an affirmative
defense applied. That is, the Department
would look at when a covered entity
first had actual or constructive
knowledge of a violation due to willful
neglect, based on evidence gathered
during its investigation, on a case-bycase basis. See 74 FR 56128 (October 30,2009), 70 FR 20224, 20237–8 (April 18,2005) and 71 FR 8390, 8410 (February
16, 2006) for prior, more detailed
discussions about the Department’s
determination of when knowledge
exists.

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Because the Department recognizedthat the minimum penalty amountunder the HITECH Act of a violation
due to willful neglect that is correctedduring the 30-day cure period issignificantly less than that for aviolation due to willful neglect that is
not timely corrected (equating to a
$40,000 minimum penalty amountdifference), the IFR specificallyrequested comment on whether there
are alternative approaches to calculating
the beginning of the 30-day cure period
for this purpose.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
While a few commenters expressed
support for utilizing the current scheme
in determining which tier should apply
to a violation due to willful neglect,
other commenters expressed concernswith this approach due to theuncertainty with determining exactly
when the cure period begins and that abusiness associate’s knowledge of aviolation could be imputed to thecovered entity prior to the businessassociate notifying the covered entity, as
well as concerns if the Secretary does
not notify an entity of a potential
violation in a timely manner. A few
commenters suggested that the 30-day
cure period begin once the Department
notifies the covered entity of acomplaint.
Final Rule
The final rule retains the policy thatthe 30-day cure period for violations
due to willful neglect, like those not due
to willful neglect, begins on the datethat an entity first acquires actual orconstructive knowledge of the violation
and will be determined based onevidence gathered by the Department
during its investigation, on a case-bycase basis.
First, the requirement that an entity
have knowledge that a ‘‘violation’’ hasoccurred, and not only of the facts
underlying the violation, is a higher
standard than that which is often
required by other law. Also, as apractical matter, the date an entity has
actual or constructive knowledge of aviolation will vary depending on thecircumstances involved, and may be theresult of notice by a workforce member
or business associate, a complaint
received by a health care consumer, or
notification by the Department that acomplaint has been filed. However,other sources of information exist that
could establish knowledge, includinginternal indications of a potential
noncompliance such as unusual accessor audit log activity.
While we understand commenters’
concerns relating to the uncertainty

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

inherent to constructive knowledge, we
believe that it provides an appropriate
incentive that is consistent with thestrengthened enforcement of the HIPAA
Rules, as provided in the HITECH Act.
Reliance on notification by acomplainant or the Department would
not encourage self-correction or anentity’s establishment of a complianceprogram that proactively prevents,
detects and corrects indications ofnoncompliance. If the cure period weresolely based on external notification, it
is quite possible that entities would
have little or no incentive to makecorrections of noncompliance until longafter an incident occurred, if ever. In
response to concerns that constructive
knowledge may be imputed to theprincipal when an agent fails to notify
the responsible entity, we note that an
agent must be acting within the scope ofagency for a covered entity or a businessassociate to be liable for the agent’s acts
or failures to act. An agent that fails to
notify a covered entity or businessassociate may be acting outside its scopeof authority as an agent. In such a
circumstance, the agent’s knowledge is
not imputed to the principal under theFederal Common Law of Agency.
Finally, an entity will have theopportunity to submit evidence
establishing its knowledge or lack ofknowledge, during the Department’s
investigation. Entities will also have aright to request a hearing to appeal afinding about knowledge in a notice ofproposed determination to the extent
they believe the finding is not based ona preponderance of the evidence. An
administrative law judge would thenreview the finding and affirm or modify
it.
Response to Other Public Comments
Comment: A few commenterssuggested that 30 days may not be
sufficient for a covered entity tocomplete corrective action, particularly
with respect to large organizations withcomplex systems, structures andrelationships. One commenter suggested
there should be a process available toallow an organization to apply for areasonable extension to complete thecure.
Response: In response to commenters’
concern about the length of the 30-day
cure period, we note that this time
period is defined by statute at section
1176(b) of the Social Security Act, andwas not modified by section 13410(d) of
the HITECH Act. Thus, we believe there
is no authority upon which to base a
modification to the length of the cure
period.
Comment: One commenter requested
that the Department clarify whether the

PO 00000

Frm 00023

Fmt 4701

Sfmt 4700

5587

new enforcement provisions will apply
to violations of all HIPAA
Administrative Simplification
provisions or just to the privacy andsecurity requirements.
Response: The enforcement
regulations at 45 CFR Part 160, Subparts
C, D, and E, relate to compliance with,and the enforcement of, all of the
Administrative Simplification
regulations adopted under subtitle F of
Title II of HIPAA, including theStandards for Electronic Transactions
and Code Sets (Transactions and CodeSets Rule(s) (referred to in both asingular and plural sense); Standards forPrivacy of Individually Identifiable
Health Information (HIPAA Privacy
Rule); Standard Unique Employer
Identifier (EIN Rule); Security Standards(HIPAA Security Rule); and Standard
Unique Health Identifier for Health Care
Providers (NPI Rule). In addition, theEnforcement Rule applies to the Breach
Notification Rule for HIPAA covered
entities and business associates.
C. Subparts A and C of Part 164:
General Provisions and Modifications to
the Security Rule
We proposed implementing
modifications to the Security Rule as aresult of the HITECH Act and to makecertain other changes. Below we
respond to comments received on the
proposed changes as well as describe
the final rule provisions. We also
discuss the final technical andconforming changes to the generalprovisions in Subpart A of Part 164,
which applies to the Security, Privacy,
and Breach Notification Rules, andrespond to comments where substantive
comments were received on thesechanges.
1. Technical Changes to Subpart A—
General Provisions
a. Section 164.102—Statutory BasisThis section sets out the statutory
basis of Part 164. We proposed andinclude in this final rule a technicalchange to include a reference to theprovisions of sections 13400 through13424 of the HITECH Act upon which
the regulatory changes discussed below
are based.
b. Section 164.104—Applicability
This section sets out to whom Part
164 applies. We proposed to replace theexisting paragraph (b) with anapplicability statement for businessassociates, consistent with theprovisions of the HITECH Act.
Paragraph (b) makes clear that, where
provided, the standards, requirements,
and implementation specifications of
the HIPAA Privacy, Security, and

E:\FR\FM\25JAR2.SGM

25JAR2

5588

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

Breach Notification Rules apply tobusiness associates. We also proposed toremove as unnecessary the existinglanguage in § 164.104(b) regarding theobligation of a health care clearinghouseto comply with § 164.105 relating toorganizational requirements of covered
entities. This final rule adopts thesechanges as proposed.
c. Section 164.105—Organizational
Requirements
Section 164.105 outlines theorganizational requirements andimplementation specifications for healthcare components of covered entities andfor affiliated covered entities. As§ 164.105 now also applies to Subpart D
of Part 164 regarding breach notification
for unsecured protected healthinformation, we proposed to remove
several specific references to Subparts C
and E throughout this section to makeclear that the provisions of this section
also apply to Subpart D of Part 164. The
final rule adopts these modifications.
In addition, we proposed thefollowing modifications to this section.
i. Section 164.105(a)(2)(ii)(C)–(E)sroberts on DSK5SPTVN1PROD with

Proposed RuleAs a covered entity’s obligation toensure that a health care component
complies with the Privacy and Security
Rules is already set out at§ 164.105(a)(2)(ii), we proposed tomodify this section to remove as
unnecessary paragraphs (C) and (D),which pertain to the obligation of acovered entity to ensure that any
component that performs businessassociate-like activities and is includedin the health care component complies
with the requirements of the Privacy
and Security Rules, and to re-designate
paragraph (E) as (C). Additionally, werequested comment on whether weshould require, rather than permit as
was the case at § 164.105(a)(2)(iii)(C), a
covered entity that is a hybrid entity toinclude a component that performs
business associate-like activities within
its health care component so that suchcomponents are directly subject to theRules.
Overview of Public Comments
Several commenters recommended
that hybrid entities should retain theflexibility to either include or exclude
business associates from the healthcarecomponent. Two of these commentersstated this option would allow thecovered entity to distinguish thefunctions and responsibilities of thebusiness associate as separate from thehealth care component, which would
result in better compliance, as covered
entities would evaluate each business

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

associate separately for compliancepurposes. Further, commenters argued
that, as the covered entity is ultimately
legally liable for compliance on the partof the organization, such a modification
is not necessary.
Additionally, several commentersstated that requiring a hybrid entity toinclude business associate departments
is excessive and burdensome. Some ofthese commenters further stated thatbusiness associate departments of a
hybrid entity will likely commit limited
time, personnel, and staff hours to
Privacy and Security Rule complianceand suggested that the hybrid entity
should implement applicable entitywide policies and procedures andseparately ensure that business associate
departments implement specificpractices scaled to the businessassociate’s use or disclosure of protected
health information.
In contrast, several commenters
supported the proposed change. Severalof these commenters suggested that themodification would better facilitate
compliance, because requiring thecovered entity to include the businessassociate department in the health carecomponent would better protect theprotected health information held by thebusiness associate and would ensure
consistent standards within the healthcare component of the covered entity.
Final Rule
Many covered entities perform bothcovered and non-covered functions aspart of their business operations. For
such covered entities, the entire entity
is generally required to comply with thePrivacy Rule. However, the hybrid
entity provisions of the HIPAA Rules
permit the entity to limit the applicationof the Rules to the entity’s componentsthat perform functions that would makethe component a ‘‘covered entity’’ if thecomponent were a separate legal entity.
Specifically, this provision allows anentity to designate a health carecomponent by documenting thecomponents of its organization that
perform covered entity functions. The
effect of such a designation is that mostof the requirements of the HIPAA Rules
apply only to the designated health carecomponent of the entity and not to thefunctions the entity performs that are
not included in the health carecomponent. While most of the HIPAA
Rules’ requirements apply only to thehealth care component, the hybrid
entity retains certain oversight,
compliance, and enforcement
obligations.
We explained in the preamble to the2002 modifications to the Privacy Rulethat the Rule provides hybrid entities

PO 00000

Frm 00024

Fmt 4701

Sfmt 4700

with discretion as to whether or not toinclude business associate divisions
within the health care component.
However, a disclosure of protected
health information from the health carecomponent to any other division that is
not part of the health care component,
including a business associate division,is treated the same as a disclosure
outside the covered entity. As a result,because an entity generally cannot havea business associate agreement withitself, a disclosure from the health carecomponent to the business associate
division(s) of the entity likely would
require individual authorization. See 67
FR 53182, 53205 (Aug. 14, 2002).
Importantly, after this final rule,business associates, by definition, areseparately and directly liable forviolations of the Security Rule and forviolations of the Privacy Rule forimpermissible uses and disclosures
pursuant to their business associate
contracts. With respect to a hybrid
entity, however, not including businessassociate functions within the healthcare component of a hybrid entity could
avoid direct liability and complianceobligations for the business associatecomponent. Thus, we agree with thecommenters that supported requiring
inclusion of business associate
functions inside the health carecomponent of a hybrid entity. As such,the final rule requires that the healthcare component of a hybrid entity
include all business associate functions
within the entity.
Response to Other Public Comments
Comment: One commenter requested
that the Department revise thedefinitions of ‘‘hybrid entity’’ to permit
business associates to designate a healthcare component.
Response: A business associate
performs one or more functions onbehalf of a covered entity (or, in thisfinal rule, another business associate).
As a business associate is only subject
to the HIPAA Rules with respect to theprotected health information it
maintains, uses, or discloses on behalfof a covered entity (or businessassociate) and not to other information
it may maintain, including healthinformation, there is no need for abusiness associate to designate one ormore health care components.
Comment: One commenter asked
whether an employer that operates an
on-site clinic for the treatment of
employees functions as a hybrid entity.
Response: An entity that maintains an
on-site clinic to provide health care to
one or more employees may be a HIPAA
covered provider to the extent the clinic
performs one or more covered

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulationstransactions electronically, such as
billing a health plan for the services
provided. If covered, the entity need not
become a hybrid entity so as to avoid
applying the Privacy Rule to healthinformation the entity holds in its roleas employer, such as sick leave requestsof its employees. Such information isalready excluded from the definition of‘‘protected health information’’ asemployment records and thus, thePrivacy Rule does not apply to thisinformation. However, the identifiable
health information the entity holds as acovered health care provider (e.g., theinformation the clinic holds about
employees who have received
treatment) is protected healthinformation and generally may not beshared with the employer for
employment purposes without theindividual’s authorization.
ii. Section 164.105(a)(2)(iii)(C)We proposed to modify this section to
re-designate § 164.105(a)(2)(iii)(C) as(D), and to include a new paragraph (C),which makes clear that, with respect toa hybrid entity, the covered entity itself,
and not merely the health carecomponent, remains responsible forcomplying with §§ 164.314 and 164.504
regarding business associatearrangements and other organizational
requirements. Hybrid entities may needto execute legal contracts and conduct
other organizational matters at the levelof the legal entity rather than at the levelof the health care component. The final
rule adopts this change.
iii. Section 164.105(b)(1)
The final rule fixes a minor
typographical error in this paragraph byredesignating the second paragraph (1)as paragraph (2).
iv. Section 164.105(b)(2)(ii)
The final rule simplifies thisparagraph by collapsing subparagraphs(A), (B), and (C) regarding theobligations of an affiliated entity tocomply with the Privacy and Security
Rules into one provision.

sroberts on DSK5SPTVN1PROD withd. Section 164.106—Relationship to
Other Parts
The final rule adds a reference in thisprovision to business associates,consistent with their inclusion
elsewhere throughout the other HIPAA
Rules.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

2. Modifications to the HIPAA Security
Rule in Subpart C
a. Business Associates
Proposed Rule
Before the HITECH Act, the Security
Rule did not directly apply to businessassociates of covered entities. However,section 13401 of the HITECH Act
provides that the Security Rule’s
administrative, physical, and technicalsafeguards requirements in §§ 164.308,
164.310, and 164.312, as well as theRule’s policies and procedures anddocumentation requirements in§ 164.316, apply to business associates
in the same manner as theserequirements apply to covered entities,
and that business associates are civilly
and criminally liable for violations ofthese provisions.
To implement section 13401 of the
HITECH Act, we proposed to insert
references in Subpart C to ‘‘businessassociate’’ following references to‘‘covered entity,’’ as appropriate, tomake clear that these provisions of the
Security Rule also apply to businessassociates. In addition, we proposed
additional changes to §§ 164.306,
164.308, 164.312, 164.314, and 164.316
of the Security Rule, as discussed
below.
Overview of Public Comments
Some commenters argued that thetime, implementation expense,transaction cost, and liability costburdens on business associates andsubcontractors to comply with the
Security Rule, especially small and midsize entities, would be significant. Other
commenters supported the direct
application of the Security Rule tobusiness associates and subcontractors.
Final Rule
We adopt the modifications to the
Security Rule as proposed to implement
the HITECH Act’s provisions extending
direct liability for compliance with the
Security Rule to business associates. In
response to the concerns raised
regarding the costs of compliance, wenote that the Security Rule currently
requires a covered entity to establish abusiness associate agreement that
requires business associates toimplement administrative, physical, andtechnical safeguards that reasonably andappropriately protect theconfidentiality, integrity, andavailability of the electronic protected
health information that they create,
receive, maintain, or transmit on behalfof the covered entity as required by the
Security Rule; and to ensure that any
agent, including a subcontractor, towhom they provide such information

PO 00000

Frm 00025

Fmt 4701

Sfmt 4700

5589

agrees to implement reasonable andappropriate safeguards to protect it. See§ 164.314(a). Consequently, businessassociates and subcontractors should
already have in place security practices
that either comply with the Security
Rule, or that require only modest
improvements to come into compliancewith the Security Rule requirements.
Moreover, the requirements of the
Security Rule were designed to betechnology neutral and scalable to alldifferent sizes of covered entities andbusiness associates. Covered entities
and business associates have theflexibility to choose security measuresappropriate for their size, resources, andthe nature of the security risks they face,enabling them to reasonably implement
any given Security Rule standard. In
deciding which security measures touse, a covered entity or businessassociate should take into account its
size, capabilities, the costs of thespecific security measures, and theoperational impact. Thus, the costs ofimplementing the Security Rule forlarge, mid-sized, or small businessassociates will be proportional to theirsize and resources.
Notwithstanding the above, based on
the comments, we acknowledge thatsome business associates, particularly
the smaller or less sophisticatedbusiness associates that may have accessto electronic protected healthinformation for limited purposes, may
not have engaged in the formal
administrative safeguards such as
having performed a risk analysis,
established a risk management program,or designated a security official, andmay not have written policies andprocedures, conducted employee
training, or documented compliance as
the statute and these regulations would
now require. For these businessassociates, we include an estimate forcompliance costs below in theregulatory impact analysis. We also referthese business associates to our
educational papers and other guidanceon compliance with the HIPAA Security
Rule found at: http://www.hhs.gov/ocr/
privacy/hipaa/administrative/
securityrule. These materials provide
guidance on conducting risk analyses
and implementing the otheradministrative safeguards required by
the Security Rule, which may prove
helpful to these business associates andfacilitate their compliance efforts.
b. Section 164.306—Security Standards:
General Rules
Proposed Rule
Section 164.306 sets out the generalrules that apply to all of the security

E:\FR\FM\25JAR2.SGM

25JAR2

5590

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

standards and implementation
specifications that follow in the Security
Rule. We proposed technical revisions
to § 164.306(e) to more clearly indicatethat covered entities and businessassociates must review and modify
security measures as needed to ensure
the continued provision of reasonable
and appropriate protection of electronic
protected health information, andupdate documentation of such security
measures accordingly.
Final RuleThe Department did not receive
substantive public comment on this
proposal. The final rule adopts themodifications to § 164.306 as proposed.
c. Section 164.308—Administrative
Safeguards

sroberts on DSK5SPTVN1PROD with

Proposed Rule
We proposed a technical change to§ 164.308(a)(3)(ii)(C) regarding security
termination procedures for workforce
members, to add the words ‘‘or otherarrangement with’’ after ‘‘employmentof’’ in recognition of the fact that not all
workforce members are employees (e.g.,some may be volunteers) of a covered
entity or business associate. We also
proposed a number of modifications to§ 164.308(b) to conform to modifications
proposed in the definition of ‘‘businessassociate.’’ Section 164.308(b) provides
that a covered entity may permit abusiness associate to create, receive,
maintain, or transmit electronic
protected health information only if thecovered entity has a contract or otherarrangement in place to ensure thebusiness associate will appropriately
safeguard the protected healthinformation. Section164.308(b)(2)contains several exceptions to thisgeneral rule for certain situations that
do not give rise to a business associate
relationship, such as where a covered
entity discloses electronic protected
health information to a health careprovider concerning the treatment of anindividual. We proposed to remove
these exceptions from this provision,
since as discussed above, they would
now be established as exceptions to thedefinition of ‘‘business associate.’’In addition, we proposed to modify§ 164.308(b)(1) and (2) to clarify thatcovered entities are not required toobtain satisfactory assurances in theform of a contract or other arrangementwith a business associate that is asubcontractor; rather, it is the businessassociate that must obtain the required
satisfactory assurances from thesubcontractor to protect the security ofelectronic protected health information.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Finally, we proposed to remove theprovision at § 164.308(b)(3), which
provides that a covered entity that
violates the satisfactory assurances it
provided as a business associate ofanother covered entity will be innoncompliance with the Security Rule’s
business associate provisions, as acovered entity’s actions as a businessassociate of another covered entity
would now be directly regulated by the
Security Rule’s provisions that apply tobusiness associates.
Overview of Public Comments
One commenter asked for
confirmation that the changes to§ 164.308 would require a covered
entity to enter into a business associateagreement with its own businessassociate and not any subcontractors of
those business associates.
Final Rule
The final rule adopts the proposed
modifications to § 164.308. Section
164.308(b) expressly provides that acovered entity is not required to enter
into a business associate agreement witha business associate that is asubcontractor; rather, this is theobligation of the business associate thathas engaged the subcontractor toperform a function or service thatinvolves the use or disclosure ofprotected health information.
d. Section 164.314—Organizational
Requirements
Proposed Rule
While Section 13401 of the HITECH
Act does not expressly include§ 164.314 among the provisions forwhich business associates are directly
liable, it states that § 164.308 of the
Security Rule applies to businessassociates ‘‘in the same manner’’ thatthe provision applies to covered
entities. Section 164.308(b) requires acovered entity’s business associateagreements to conform to therequirements of § 164.314. Accordingly,
in order for § 164.308(b) to apply tobusiness associates in the same manner
as it applies to covered entities, we
proposed to revise § 164.314 to reflectthat it is also applicable to agreements
between business associates andsubcontractors that create, receive,
maintain, or transmit electronic
protected health information.
We also proposed a number ofmodifications to streamline therequirements of § 164.314. First, since abusiness associate for purposes of the
Security Rule is also always a businessassociate for purposes of the Privacy
Rule, we proposed to remove contract
provisions that were merely duplicative

PO 00000

Frm 00026

Fmt 4701

Sfmt 4700

of parallel provisions in the Privacy
Rule’s business associate contract
provisions at § 164.504. We also
proposed to remove the specificrequirements under § 164.314(a)(2)(ii)
for other arrangements, such as amemorandum of understanding whenboth a covered entity and businessassociate are governmental entities, andinstead simply refer to the parallel
Privacy Rule requirements at§ 164.504(e)(3).
Second, we proposed conforming
modifications to the remaining contract
requirements in § 164.314(a)(2)(i) toprovide that such contracts must requirea business associate to comply with the
Security Rule, to ensure any
subcontractors enter into a contract orother arrangement to protect the
security of electronic protected healthinformation; and with respect to thereporting of security incidents bybusiness associates to covered entities,
to report to the covered entity breaches
of unsecured protected healthinformation as required by § 164.410 of
the breach notification rules.
Third, we proposed to add a provisionat § 164.314(a)(2)(iii) that provides thatthe requirements of this section forcontracts or other arrangements between
a covered entity and business associate
would apply in the same manner tocontracts or other arrangements between
business associates and subcontractors
required by the proposed requirementsof § 164.308(b)(4). For example, underthese provisions, a business associate
contract between a business associate
and a business associate subcontractor
would need to provide that thesubcontractor report any security
incident of which it becomes aware,
including breaches of unsecured
protected health information as requiredby § 164.410, to the business associate.
This would mean that if a breach of
unsecured protected health information
occurs at or by a second tiersubcontractor, the subcontractor must
notify the business associate
subcontractor with which it contracts ofthe breach, which then must notify thebusiness associate which contracts withthe covered entity of the breach, whichthen must notify the covered entity ofthe breach. The covered entity thennotifies the affected individuals, theSecretary, and, if applicable, the media,
of the breach, unless it has delegatedsuch responsibilities to a businessassociate. Finally, we proposed toremove the reference to subcontractorsin § 164.314(b)(2)(iii) regarding
amendment of group health plan
documents as a condition of disclosureof protected health information to a plan
sponsor, as unnecessary and to avoid

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
confusion with the use of the term
subcontractor when referring tosubcontractors that are businessassociates.

sroberts on DSK5SPTVN1PROD with

Final RuleThe Department did not receive
substantive public comment on these
proposed changes. The final rule adopts
the modifications as proposed.
Response to Other Public Comments
Comment: One commenter suggested
that business associate agreements
should be an ‘‘addressable’’ requirement
under the Security Rule.
Response: The HITECH Act does notremove the requirements for businessassociate agreements under the HIPAA
Rules. Therefore, we decline to makethe execution of business associateagreements an ‘‘addressable’’requirement under the Security Rule.
Comment: One commenter
recommended that the Department
remove the ‘‘addressable’’ designationfrom the Security Rule, because suchdesignations lead to ambiguity in theapplication of the Security Rule in thehealth care industry.
Response: We decline to adopt thisrecommendation. The Security Rule isstructured to be both scalable andflexible, so that entities of different
types and sizes can implement thestandards and implementation
specifications in a manner that isreasonable and appropriate for theircircumstances. We do not mandate theuse of specific technologies, or require
uniform policies and procedures forcompliance, because we recognize thediversity of regulated entities andappreciate the unique characteristics oftheir environments.
Comment: Two commenters suggested
providing subcontractors withadditional time to comply with theprovisions of the Security Rule.
Response: We decline to delay
application of the requirements under
the Security Rule to subcontractors
beyond the compliance dates provided
by this final rule. As we emphasized
above, the Security Rule alreadyrequires covered entities to establish
business associate agreements that
require business associates to ensurethat their subcontractors implement
reasonable and appropriate safeguards
to protect the security of electronic
protected health information theyhandle.
Comment: A few commenters
proposed alternative ways to apply
security requirements to subcontractors,
such as exempting subcontractors fromcompliance with the Security Rule ifthey have already completed security

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

assessments and met the security
requirements under other State andFederal laws or only requiring
subcontractors to comply with theminimum necessary standard and toutilize ‘‘reasonable’’ security measureswith regard to protected healthinformation.
Response: We decline to adopt an
exemption or otherwise limit
subcontractors’ responsibility tosafeguard individuals’ electronic
protected health information. To ensure
appropriate and strong security
protections for electronic protected
health information, subcontractors are
required to comply with the Security
Rule to the same extent as businessassociates with a direct relationshipwith a covered entity.
D. Subpart E of Part 164: Modifications
to the Privacy Rule
The NPRM proposed a number ofchanges to the Privacy Rule toimplement certain provisions of the
HITECH Act, as well as certain
modifications to improve theworkability and effectiveness of theRule and to conform the Privacy Rule to
PSQIA. The section-by-section
description below of the final rule
discusses the proposed and final
changes and responds to publiccomments
1. Section 164.500—Applicability
Section 13404 of the HITECH Act
makes specific requirements of thePrivacy Rule applicable to businessassociates and creates direct liability fornoncompliance by business associateswith regard to those requirements.
Proposed RuleIn accordance with section 13404 of
the HITECH Act, we proposed languagein § 164.500 to clarify that, where
provided, the standards, requirements,
and implementation specifications of
the Privacy Rule apply to businessassociates.
Overview of Public Comments
One commenter suggested that the
Department expand the applicability of
the Privacy Rule to all entities that
handle individually identifiable healthinformation. Some commenters
requested clarification as to which
provisions of the Privacy Rule apply
directly to business associates, and one
commenter recommended applying allof the provisions of the Privacy Rule tobusiness associates, including requiring
business associates to implement
reasonable safeguards, train employees,
and designate a privacy official.

PO 00000

Frm 00027

Fmt 4701

Sfmt 4700

5591

Final Rule
The final rule implements the
proposed revisions to § 164.500. While
we understand commenters’ concerns
regarding the uses and disclosures ofhealth information by entities notcovered by the Privacy Rule, theDepartment is limited to applying the
HIPAA Rules to those entities coveredby HIPAA (i.e., health plans, health careclearinghouses, and health careproviders that conduct covered
transactions) and to business associates,
as provided under the HITECH Act.
As we discuss further below, section
13404 of the HITECH Act creates direct
liability for impermissible uses anddisclosures of protected healthinformation by a business associate of acovered entity ‘‘that obtains or creates’’protected health information ‘‘pursuant
to a written contract or otherarrangement described in§ 164.502(e)(2)’’ and for compliancewith the other privacy provisions in the
HITECH Act. Section 13404 does notcreate direct liability for businessassociates with regard to compliancewith all requirements under the Privacy
Rule (i.e., does not treat them as covered
entities). Therefore, under the final rule,a business associate is directly liable
under the Privacy Rule for uses anddisclosures of protected healthinformation that are not in accord withits business associate agreement or thePrivacy Rule. In addition, a businessassociate is directly liable for failing todisclose protected health information
when required by the Secretary to do sofor the Secretary to investigate anddetermine the business associate’s
compliance with the HIPAA Rules, andfor failing to disclose protected healthinformation to the covered entity,
individual, or individual’s designee, as
necessary to satisfy a covered entity’s
obligations with respect to anindividual’s request for an electronic
copy of protected health information.
See § 164.502(a)(3) and (a)(4). Further, abusiness associate is directly liable for
failing to make reasonable efforts tolimit protected health information to theminimum necessary to accomplish theintended purpose of the use, disclosure,or request. See § 164.502(b). Finally,business associates are directly liable for
failing to enter into business associateagreements with subcontractors thatcreate or receive protected healthinformation on their behalf. See§ 164.502(e)(1)(ii). As was the caseunder the Privacy Rule before the
HITECH Act, business associates remain
contractually liable for all other Privacy
Rule obligations that are included in

E:\FR\FM\25JAR2.SGM

25JAR2

5592

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

their contracts or other arrangementswith covered entities.
2. Section 164.501—Definitions
a. Definition of ‘‘Health Care
Operations’’
Proposed Rule
PSQIA provides, among other things,
that Patient Safety Organizations (PSOs)
are to be treated as business associatesof covered health care providers.
Further, PSQIA provides that the patient
safety activities of PSOs are deemed tobe health care operations of covered
health care providers under the Privacy
Rule. See 42 U.S.C. 299b–22(i). To
conform to these statutory provisions,
we proposed to amend paragraph (1) of
the definition of ‘‘health care
operations’’ to include an express
reference to patient safety activities, as
defined in the PSQIA implementing
regulation at 42 CFR 3.20. Many healthcare providers participating in thevoluntary patient safety program
authorized by PSQIA are HIPAA
covered entities. PSQIA acknowledges
that such providers must also comply
with the Privacy Rule and deems patient
safety activities to be health care
operations under the Privacy Rule.
While such types of activities are
already encompassed within paragraph(1) of the definition, which addresses
various quality activities, we proposed
to expressly include patient safety
activities within paragraph (1) of thedefinition of health care operations toconform the definition to PSQIA and toeliminate the potential for confusion.
This modification also addresses publiccomments the Department received
during the rulemaking period for the
PSQIA implementing regulations, whichurged the Department to modify thedefinition of ‘‘health care operations’’ inthe Privacy Rule to expressly reference
patient safety activities so that theintersection of the Privacy and PSQIA
Rules would be clear. See 73 FR 70732,
70780 (Nov. 21, 2008).
Overview of Public Comments
The Department received comments
supporting the inclusion of patient
safety activities in the definition of‘‘health care operations.’’
Final Rule
The final rule adopts the proposed
modification.
sroberts on DSK5SPTVN1PROD withb. Definition of ‘‘Marketing’’
Proposed Rule
The Privacy Rule requires covered
entities to obtain a valid authorizationfrom individuals before using or
disclosing protected health information

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

to market a product or service to them.
See § 164.508(a)(3). Section 164.501
defines ‘‘marketing’’ as making acommunication about a product orservice that encourages recipients of thecommunication to purchase or use theproduct or service. Paragraph (1) of thedefinition includes a number of
exceptions to marketing for certain
health-related communications: (1)Communications made to describe ahealth-related product or service (orpayment for such product or service)that is provided by, or included in aplan of benefits of, the covered entity
making the communications, including
communications about: The entities
participating in a healthcare provider
network or health plan network;
replacement of, or enhancements to, ahealth plan; and health-related products
or services available only to a healthplan enrollee that add value to, but are
not part of, a plan of benefits; (2)communications made for the treatmentof the individual; and (3)communications for case management
or care coordination for the individual,or to direct or recommend alternative
treatments, therapies, health careproviders, or settings of care to theindividual. A covered entity ispermitted to make these excepted
communications without anindividual’s authorization as either
treatment or health care operations
communications, as appropriate, under
the Privacy Rule. In addition, thePrivacy Rule does not require a covered
entity to obtain individual authorization
for face-to-face communications or toprovide only promotional gifts ofnominal value to the individual. See§ 164.508(a)(3)(i). However, a covered
entity must obtain prior written
authorization from an individual tosend communications to the individual
about non-health related products orservices or to give or sell theindividual’s protected healthinformation to a third party formarketing. Still, concerns haveremained about the ability under theseprovisions for a third party to pay acovered entity to send health-related
communications to an individual about
the third party’s products or services.
Section 13406(a) of the HITECH Act
limits the health-related
communications that may be consideredhealth care operations and thus, that are
excepted from the definition of‘‘marketing’’ under the Privacy Rule, tothe extent a covered entity receives or
has received direct or indirect payment
in exchange for making thecommunication. In cases where thecovered entity would receive such

PO 00000

Frm 00028

Fmt 4701

Sfmt 4700

payment, the HITECH Act at section
13406(a)(2)(B) and (C) requires that thecovered entity obtain the individual’s
valid authorization prior to making thecommunication, or, if applicable, prior
to its business associate making thecommunication on its behalf inaccordance with its written contract.
Section 13406(a)(2)(A) of the HITECH
Act includes an exception to thepayment limitation for communications
that describe only a drug or biologic thatis currently being prescribed to theindividual as long as any payment
received by the covered entity inexchange for making thecommunication is reasonable inamount. Section 13406(a)(3) of the Act
provides that the term ‘‘reasonable inamount’’ shall have the meaning given
to such term by the Secretary in
regulation. Finally, section 13406(a)(4)of the Act clarifies that the term ‘‘direct
or indirect payment’’ does not include
any payment for treatment of theindividual. We believe Congress
intended that these provisions curtail acovered entity’s ability to use theexceptions to the definition of‘‘marketing’’ in the Privacy Rule to sendcommunications to the individual thatare motivated more by commercial gainor other commercial purpose rather thanfor the purpose of the individual’s
health care, despite the communication
being about a health-related product orservice.
To implement the marketing
limitations of the HITECH Act, we
proposed a number of modifications to
the definition of ‘‘marketing’’ at§ 164.501. In paragraph (1) of thedefinition of ‘‘marketing,’’ we proposed
to maintain the general concept that‘‘marketing’’ means ‘‘to make acommunication about a product orservice that encourages recipients of thecommunication to purchase or use theproduct or service.’’ In paragraph (2) ofthe definition, we proposed to include
three exceptions to this definition toencompass certain treatment and healthcare operations communications about
health-related products or services.
First, we proposed to exclude from thedefinition of ‘‘marketing’’ certain healthcare operations communications, except
where, as provided by the HITECH Act,the covered entity receives financial
remuneration in exchange for making
the communication. This would
encompass communications to describea health-related product or service (orpayment for such product or service)that is provided by, or included in aplan of benefits of, the covered entity
making the communication, as well as
communications for case management

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
or care coordination, contacting ofindividuals with information about
treatment alternatives, and related
functions (to the extent these activities
did not constitute ‘‘treatment’’).
Although the HITECH Act uses theterm ‘‘direct or indirect payment’’ todescribe the limitation on permissible
health care operations disclosures, theproposed rule substituted the term‘‘financial remuneration’’ to avoid
confusion with the term ‘‘payment,’’
which is defined in the Privacy Rule tomean payment for health care, and forconsistency with the Privacy Rule’s
current authorization requirement formarketing at § 164.508(a)(3), which uses
the term ‘‘remuneration.’’ We proposed
to define ‘‘financial remuneration’’ inparagraph (3) of the definition of‘‘marketing’’ to mean direct or indirect
payment from or on behalf of a third
party whose product or service is being
described. We also proposed to makeclear, in accordance with section
13406(a)(4) of the HITECH Act, that
financial remuneration does not include
any direct or indirect payment for thetreatment of an individual.
Additionally, because the HITECH
Act refers expressly to ‘‘payment,’’
rather than remuneration moregenerally, the proposed rule specified
that only the receipt of financial
remuneration in exchange for making acommunication, as opposed to in-kindor any other type of remuneration, isrelevant for purposes of the definition ofmarketing. We also proposed a
conforming change to the required
authorization provisions for marketing
communications at § 164.508(a)(3) to
add the term ‘‘financial’’ before‘‘remuneration’’ and to refer to the new
definition of ‘‘financial remuneration.’’The proposed rule emphasized that
financial remuneration for purposes ofthe definition of ‘‘marketing’’ must be inexchange for making thecommunication itself and be from or on
behalf of the entity whose product orservice is being described. Thus, underthese proposed provisions, anauthorization would be required prior toa covered entity making acommunication to its patients regarding
the acquisition of, for example, newstate of the art medical equipment if theequipment manufacturer paid thecovered entity to send thecommunication to its patients; but not if
a local charitable organization, such asa breast cancer foundation, funded thecovered entity’s mailing to patients
about new state of the art
mammography screening equipment.
Furthermore, it would not constitutemarketing and no authorization would
be required if a hospital sent flyers to its

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

patients announcing the opening of a
new wing where the funds for the newwing were donated by a third party,
since the financial remuneration to thehospital from the third party was not in
exchange for the mailing of the flyers.
Second, we proposed to include thestatutory exception to marketing atsection 13406(a)(2)(A) for
communications regarding refill
reminders or otherwise about a drug or
biologic that is currently beingprescribed for the individual, provided
any financial remuneration received by
the covered entity for making thecommunication is reasonably related tothe covered entity’s cost of making thecommunication. The Act expressly
identifies these types ofcommunications as being exempt fromthe remuneration limitation only to theextent that any payment received formaking the communication isreasonable in amount. We requested
comment on the scope of this exception,that is, whether communications about
drugs that are related to the drug
currently being prescribed, such ascommunications regarding genericalternatives or new formulations of thedrug, should fall within the exception.
We also requested comment on thetypes and amount of costs that shouldbe allowed under this provision. We
noted that we had considered proposinga requirement that a covered entity
could only receive financial
remuneration for making such a
communication to the extent it did notexceed the actual cost to make thecommunication. However, because wewere concerned that such a requirement
would impose the additional burden of
calculating the costs of making each
communication, we proposed to allow
costs that are reasonably related to acovered entity’s cost of making thecommunication.
Third, we proposed to exclude frommarketing treatment communications
about health-related products orservices by a health care provider to anindividual, including communications
for case management or carecoordination for the individual, or to
direct or recommend alternative
treatments, therapies, health careproviders, or settings of care to theindividual, provided, however, that if
the communications are in writing andfinancial remuneration is received in
exchange for making thecommunications, certain notice and opt
out conditions are met. While section
13406(a) of the HITECH Act expressly
provides that a communication to anindividual about a health-related
product or service where the covered
entity receives payment from a third

PO 00000

Frm 00029

Fmt 4701

Sfmt 4700

5593

party in exchange for making thecommunication shall not be considereda health care operation (emphasis
added) under the Privacy Rule, and thus
is marketing, it is unclear how Congress
intended these provisions to apply totreatment communications between ahealth care provider and a patient.
Specifically, it is unclear whether
Congress intended to restrict only thosesubsidized communications about
products and services that are lessessential to an individual’s health care(i.e., those classified as health care
operations communications) or all
subsidized communications about
products and services, including
treatment communications. Given thisambiguity and to avoid undue
interference with treatmentcommunications between the individual
and a health care provider, we proposed
to continue to allow subsidized
treatment communications, butconditioned on providing the individualwith notice and an opportunity to opt
out of receiving such communications.
Specifically, to ensure the individual isaware that he or she may receive
subsidized treatment communications
from his or her provider and has theopportunity to elect not to receive them,
the proposed rule would have requiredat § 164.514(f)(2) that: (1) The covered
health care provider’s notice of privacy
practices include a statement informing
individuals that the provider may send
treatment communications to theindividual concerning treatment
alternatives or other health-related
products or services where the provider
receives financial remuneration from athird party in exchange for making thecommunication, and the individual has
a right to opt out of receiving such
communications; and (2) the treatmentcommunication itself disclose the fact of
remuneration and provide theindividual with a clear and conspicuous
opportunity to elect not to receive any
further such communications. We
requested comment on how the opt out
should apply to future subsidized
treatment communications (i.e., should
the opt out prevent all future subsidized
treatment communications by theprovider or just those dealing with theparticular product or service describedin the current communication?). We
also requested comment on theworkability of requiring health careproviders that intend to send subsidized
treatment communications to
individuals to provide an individualwith the opportunity to opt out ofreceiving such communications prior to
the individual receiving the firstcommunication and what mechanisms

E:\FR\FM\25JAR2.SGM

25JAR2

5594

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withcould be put into place to implement
such a requirement.
Given that the new marketing
limitations on the receipt of
remuneration by a covered entity would
apply differently depending on whether
a communication is for treatment or
health care operations purposes, andthat distinguishing such
communications may in many cases callfor close judgments, we requested
comment on the alternatives of
excluding treatment communications
altogether even if they involve financial
remuneration from a third party or
requiring individual authorization forboth treatment and health care
operations communications made in
exchange for financial remuneration.
Finally, we proposed to remove thelanguage defining as marketing an
arrangement between a covered entityand any other entity in which thecovered entity discloses protected
health information to the other entity, in
exchange for remuneration, for the otherentity or its affiliate to make acommunication about its own productor service that encourages recipients ofthe communication to purchase or usethat product or service, since suchactivity would now constitute aprohibited ‘‘sale’’ of protected healthinformation under section 13405(d) of
the HITECH Act and the proposed rule.
Overview of Public Comments
Several commenters asked as a
general matter that the final rule retain
the current definition of ‘‘marketing’’
and that no changes to this provision be
implemented. With respect tosubsidized treatment communications,many commenters expressed support forthe decision in the NPRM to not requireauthorizations for such
communications, and several argued forremoving even the opt out requirement.
Other commenters believed that allcommunications in which the covered
entity receives financial remuneration
for making the communication,
regardless of whether thecommunication is for treatment
purposes, should be consideredmarketing and require authorization.
While many commenters weregenerally in support of not requiring
authorization for treatmentcommunications, at the same time,several commenters expressed concern
with the difficulty of distinguishing
between treatment communications andcommunications for health care
operations purposes. These commentersstated that additional clarification
regarding this distinction would beneeded to be able to implement the
NPRM’s marketing provisions. Several

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

commenters stated that while thedistinction may be clear in some limited
circumstances, there are othercircumstances where it may be difficult
for covered entities to determine what
type of communication they are sending
and whether authorization or justdisclosure in the notice of privacy
practices and the opportunity to opt out
would be required. For example, while
the NPRM stated that whether acommunication is being made fortreatment purposes or for health care
operations purposes would depend on
the extent to which the covered entity
is making the communication in a
population-based fashion (health care
operations) or to further the treatment of
a particular individual’s health carestatus or condition (treatment), many
commenters stated that there may becircumstances in which a covered entity
provides a population-based
communication to further the treatmentof the health care status or condition ofan entire group of individuals. Other
commenters suggested that thedistinction between communications fortreatment and those for health care
operations purposes should be madebased on the entity providing thecommunication: If a health careprovider is providing thecommunication, it should be deemed fortreatment purposes; however, if thecommunication is made by a covered
entity other than a health care provider,the determination should be based onwhether the communication is
individual (treatment) or population
based (health care operations).
With respect to the subsidized
treatment communications, commenters
opposed to the opt out notification
generally took one of three positions:
All such communications should
require authorizations to best protect
patient privacy; an opt in method would
better permit individuals to make more
informed choices about whether toreceive such communications; or acovered entity should be permitted tomake these communications without an
opportunity to opt out, because ofunintended effects that may adversely
affect the quality of care provided. Some
commenters asked, if the opt out
requirement is retained, that OCR
ensure that covered entities are given
significant flexibility in determining
how best to implement the opt out
requirement.
Additionally, the vast majority ofcommenters did not believe there
should be an opportunity to opt out ofreceiving subsidized treatmentcommunications prior to receipt of thefirst such communication. The
commenters believed that requiring an

PO 00000

Frm 00030

Fmt 4701

Sfmt 4700

opportunity to opt out prior to the firstcommunication would be too costly andburdensome for most covered entities.
Many also noted that the statement in
the notice of privacy practices, which
would inform individuals of theiroption to opt out of receiving subsidized
treatment communications, could serveas an opportunity to opt out before thefirst communication. Some commenters
expressed concern even with including
a statement in the notice of privacy
practices because of the cost associatedwith modifying notices to do so.
With respect to the scope of the
proposed opt out, most commentersbelieved that the opt out should apply
only to subsidized treatmentcommunications related to a specificproduct or service and should not apply
universally to all similar futurecommunications from the covered
entity. These commenters stated that it
would be difficult for an individual toelect, in a meaningful way, not toreceive all future subsidized treatmentcommunications because he or she
would not know exactly what he or she
is opting out of without receiving atleast one communication. Other
commenters believed that while a
product or service-specific applicationof the opt out would be ideal, it issimply unrealistic and infeasible forcovered entities to be able to implement
such a policy. These commenters statedthat a universal opt out, which would
apply to all future subsidized treatmentcommunications, would be much
simpler and easier for covered entities
to implement. Additionally, while somecommenters believed that individuals
should be able to decide whether theywant to opt out of specific subsidized
treatment communications or all futuresuch communications, mostcommenters supported giving covered
entities the flexibility to determine thescope of this opt out provision based on
their own specific capabilities. Many ofthese commenters also suggested thatthe final rule permit individuals who
have opted out of receiving such
communications to opt back in toreceive future notices using the same
methods through which the individuals
had opted out.
The Department also received several
comments on the definition of‘‘financial remuneration.’’ Several
commenters supported the NPRM’s
definition of ‘‘financial remuneration’’;however, many commenters asked forclarification regarding the scope of thedefinition and the meaning of thephrase ‘‘direct or indirect payment.’’ For
example, some commenters asked for
confirmation that non-financial benefits
did not constitute financial

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
remuneration, while other commenterswanted the exception for refill
reminders (that is, the communication is
not marketing as long as the financial
remuneration does not exceed therelated costs of the communication) toapply more broadly to all marketing
communications. Additionally, somecommenters suggested that the final rule
clarify that only financial remunerationin exchange for sending acommunication triggers either theauthorization or the statement of noticeand opt out requirement and not theexchange of financial remuneration forthe development or funding for
programs, which may include thesending of a communication. These
commenters generally suggested that the
final rule give covered entities theflexibility to determine whether thefinancial remuneration received is truly
in exchange for making thecommunication.
We received a great deal of publiccomment on the exception to thedefinition of ‘‘marketing’’ for providing
refill reminders or to otherwise
communicate about a drug or biologic
currently being prescribed for theindividual where the only financial
remuneration received by the covered
entity in exchange for making thecommunication is reasonably related tothe covered entity’s cost of making thecommunication. In general, mostcommenters supported this exception;
however, a few commenters disagreed
with the exception and felt that refill
reminders should be treated astreatment communications requiring astatement in the notice and an
opportunity to opt out if thecommunication is subsidized. Many
commenters expressed the need for
guidance on the scope of this exception
and stated that certain communications
should fall into the exception, such ascommunications about genericalternatives and drug adherence, andcommunications related to every
component of a drug or biologic
delivery system (especially where
patients must self-administer
medication). Some commentersspecifically asked that the final rule
exclude certain types ofcommunications from this exception.
With respect to the proposed costlimitation on the refill reminder
exception, while some commenterssuggested that the cost be limited toeither the actual cost or the fair market
value of providing the communication,
generally, most commenters supported
the position that reasonably related
costs should not be limited to actual
costs. Many of the commenters insupport of a broad interpretation of

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

costs ‘‘reasonably related’’ to providing
the communication suggested specificcosts that should be permitted under
this exception, such as costs ofpersonnel, data storage, data processing,data analysis, data security, software,
hardware, employee training, message
content development, clinical review,
postage, materials, drug adherence
program development, formularydevelopment, and the creation andimplementation of analytics to measure
the effectiveness of the communication.
Several commenters noted that it would
be unrealistic to expect a covered entity
to perform such non-essential functions
as sending refill reminders and otherrelated communications if they could
not recoup both their direct and indirect
costs as well as a modest profit.
Final Rule
The final rule significantly modifies
the proposed rule’s approach tomarketing by requiring authorization for
all treatment and health care operations
communications where the covered
entity receives financial remuneration
for making the communications from athird party whose product or service isbeing marketed. Many of the comments
we received in response to the proposed
marketing provisions concerned thedistinction between communications fortreatment and those for health care
operations purposes and soughtclarification on the line between such
communications. We acknowledge thatthe distinction between what constitutes
a treatment versus a health care
operations communication may bedifficult to make with precision in allcases, placing covered entities at risk forviolating the authorization requirement
for marketing communications. We,
therefore, believe that requiring
authorizations for all subsidized
communications that market a healthrelated product or service is the bestpolicy. Such a policy will ensure that all
such communications are treated as
marketing communications, instead ofrequiring covered entities to have twoprocesses in place based on whether thecommunication provided to individuals
is for a treatment or a health care
operations purpose. We decline to retain
the Privacy Rule’s definition of what
constitutes ‘‘marketing’’ unchanged, assuggested by some commenters, as
doing so would be inconsistent with theprovisions of the Section 13406(a) of the
HITECH Act.
Because the final rule treats
subsidized treatment communications
as marketing communications that
require authorization, we have not
adopted the notice requirement at
proposed § 164.520(b)(1)(iii)(A) that a

PO 00000

Frm 00031

Fmt 4701

Sfmt 4700

5595

covered entity’s notice of privacy
practices include a statement informing
individuals that the provider may send
treatment communications to theindividual concerning treatment
alternatives or other health-related
products or services where the provider
receives financial remuneration from athird party in exchange for making thecommunication, and the individual has
a right to opt out of receiving such
communications. We also do not retain
the notice requirement that existed at§ 164.520(b)(1)(iii) prior to this final rulethat a covered entity include in its
notice of privacy practices a statementthat the covered entity may contact theindividual to provide appointment
reminders or information about
treatment alternatives or other healthrelated benefits and services that may beof interest to the individual. Where thesending of such communications
involves financial remuneration, theindividual will be notified of such
communications through theauthorization process. Other
communications for such purposes that
do not involve financial remuneration
are adequately captured in a covered
entity’s description in its notice ofprivacy practices of treatment andhealth care operations. However,
covered entities that wish to continue toinclude such a specific statement intheir notices of privacy practices may doso. For further discussion about the
Notice of Privacy Practices, please see
the discussion addressing the provisionsat § 164.520 below.
We adopt the term ‘‘financial
remuneration’’ and its definition as
proposed without modification in the
final rule. Most commenters weregenerally satisfied with the proposed
use of the term and its definition. Therewas, however, some confusion amongcommenters as to what constitutes
direct or indirect payment from or on
behalf of a third party. We clarify that
under this provision direct payment
means financial remuneration that flows
from the third party whose product orservice is being described directly to thecovered entity. In contrast, indirect
payment means financial remunerationthat flows from an entity on behalf ofthe third party whose product or service
is being described to a covered entity.
We also clarify that where a businessassociate (including a subcontractor), as
opposed to the covered entity itself,
receives financial remuneration from athird party in exchange for making acommunication about a product orservice, such communication also
requires prior authorization from theindividual. The HITECH Act at Section
13406(a)(2)(C) provides that a business

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5596

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

associate may make such
communications on behalf of a covered
entity if consistent with the written
contract required by the Privacy Rule
between the business associate andcovered entity. The Privacy Rule a§ 164.504(e)(2)(i) provides that thecontract may not authorize the businessassociate to further use or disclose theprotected health information in amanner that would violate the Rule ifdone by the covered entity (except in
two limited circumstances not relevanthere). Thus, individual authorization
also must be obtained if a businessassociate is to send thesecommunications instead of the covered
entity.
We also confirm, in response tocomments, that the term ‘‘financial
remuneration’’ does not include nonfinancial benefits, such as in-kindbenefits, provided to a covered entity inexchange for making a communication
about a product or service. Rather,financial remuneration includes only
payments made in exchange for making
such communications. In addition, we
continue to emphasize that the financial
remuneration a covered entity receives
from a third party must be for the
purpose of making a communicationand such communication mustencourage individuals to purchase or
use the third party’s product or service.
If the financial remuneration received
by the covered entity is for any purpose
other than for making thecommunication, then this marketingprovision does not apply. For example,
if a third party provides financial
remuneration to a covered entity to
implement a program, such as a disease
management program, the covered
entity could provide individuals with
communications about the program
without obtaining individual
authorization as long as thecommunications are about the covered
entity’s program itself. There, thecommunications would only be
encouraging individuals to participate
in the covered entity’s disease
management program and would not be
encouraging individuals to use orpurchase the third party’s product orservice.
Under the final rule, for marketing
communications that involve financial
remuneration, the covered entity mustobtain a valid authorization from theindividual before using or disclosing
protected health information for such
purposes, and such authorization must
disclose the fact that the covered entity
is receiving financial remuneration froma third party. See § 164.508(a)(3). The
scope of the authorization need not belimited only to subsidized

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

communications related to a single
product or service or the products orservices of one third party, but rather
may apply more broadly to subsidized
communications generally so long as theauthorization adequately describes theintended purposes of the requested usesand disclosures (i.e., the scope of theauthorization) and otherwise contains
the elements and statements of a valid
authorization under § 164.508. This
includes making clear in theauthorization that the individual may
revoke the authorization at any time heor she wishes to stop receiving themarketing material.
Because the final rule will treat all
subsidized treatment communications
as marketing communications for which
an authorization is required, the final
rule also removes the language at
proposed § 164.514(f)(2), which
proposed to require that such
communications be accompanied by astatement in the notice and an
opportunity for the individual to opt outof receiving such communications. We
believe that the removal of the noticeand opt out requirements for such
communications and the addition of therequirement to obtain an authorization
will provide covered entities with amore uniform system for treating all
remunerated communications. Because
the individual must now sign an
authorization before the covered entity
can make subsidized treatmentcommunications, there is no longer any
need to require each such
communication to contain a clear andconspicuous opportunity for theindividual to elect not to receive any
more of these communications. Where
the individual signs an authorization toreceive such communications, thecovered entity may use and disclose theindividual’s protected healthinformation for the purposes of making
such communications unless or until
the individual revokes the authorization
pursuant to § 164.508(a)(5). If theindividual does not authorize thecovered entity to use and disclose theindividual’s protected healthinformation for the purposes of making
subsidized treatment communications,then the covered entity is prohibitedfrom doing so.
We clarify that the final rule doesnothing to modify the exceptions to theauthorization requirement for marketing
communications at § 164.508(a)(3)(i)(A)and (B). Therefore, no authorization isrequired where a covered entity receives
financial remuneration from a third
party to make a treatment or health care
operations communication (or othermarketing communication), if thecommunication is made face-to-face by

PO 00000

Frm 00032

Fmt 4701

Sfmt 4700

a covered entity to an individual orconsists of a promotional gift of nominal
value provided by the covered entity.
For example, a health care provider
could, in a face to face conversation
with the individual, recommend,
verbally or by handing the individual
written materials such as a pamphlet,that the individual take a specificalternative medication, even if theprovider is otherwise paid by a third
party to make such communications.
However, communications made overthe phone (as well as all
communications sent through the mailor via email) do not constitute face toface communications, and as such, thesecommunications require individual
authorization where the covered entity
receives remuneration in exchange formaking the communications.
With respect to the exception for refill
reminders or to otherwise communicate
about a drug or biologic currently beingprescribed to the individual, we adopt
the exception as proposed. We continue
to provide a stand-alone exception forrefill reminders, given that the HITECH
Act expressly does so. We therefore
decline to adopt the suggestions ofcommenters to consider thesecommunications to specifically betreatment communications (which
would have required, under theprovisions of the proposed rule, notice
and an opportunity to opt out where thecovered entity receives financial
remuneration), or health care operations
communications (which requireauthorization if financial remunerationis received).
Many commenters asked for guidanceand clarification regarding the scope of
this exception, and we received a widearray of examples of communications
that commenters suggested should fallwithin this exception. At this time, weclarify that we consider
communications about the genericequivalent of a drug being prescribed to
an individual as well as adherence
communications encouraging
individuals to take their prescribed
medication as directed fall within thescope of this exception. Additionally,
we clarify that where an individual isprescribed a self-administered drug or
biologic, communications regarding all
aspects of a drug delivery system,
including, for example, an insulin
pump, fall under this exception. With
respect to the array of other examples
and suggestions provided bycommenters as to what should fallwithin or outside of the exception, we
intend to provide future guidance toaddress these questions.
The proposed rule contained the Act’s
limitation that the financial

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
remuneration received in exchange forproviding a refill reminder or tootherwise communicate about a drug or
biologic currently being prescribed tothe individual must be ‘‘reasonable inamount,’’ by providing that such
remuneration must be reasonably
related to the covered entity’s cost of
making the communication for the
exception from marketing to apply. We
adopt this provision in the final rule. In
response to comments regarding whattypes of costs fall within permissible
remuneration, we clarify that we
consider permissible costs for which acovered entity may receive
remuneration under this exception arethose which cover only the costs oflabor, supplies, and postage to make thecommunication. Where the financial
remuneration a covered entity receives
in exchange for making thecommunication generates a profit or
includes payment for other costs, suchfinancial remuneration would run afoulof the Act’s ‘‘reasonable in amount’’language. Thus, under this final rule, if
a pharmacy receives financial
remuneration from a drug manufacturer
to provide refill reminders toindividuals taking a particular drug thatcovers only the pharmacy’s cost ofdrafting, printing, and mailing the refill
reminders, the exception would apply
and no authorization would be required.
However, where the drug manufacturer
also provides the pharmacy with afinancial incentive beyond the cost of
making the communication to
encourage the pharmacy’s continued
willingness to send such
communications on behalf of the drug
manufacturer, the exception would not
apply and the pharmacy must obtain
individual authorization. We note,however, that if a pharmacy provides
refill reminders to individuals only
when they visit the pharmacy (in face toface encounters), such communications
would be permitted under§ 164.508(a)(3)(i)(A) and thus,
authorization would not be required
even if the pharmacy receives financial
remuneration above and beyond what isreasonably related to the pharmacy’s
cost of making the communication.
Finally, in addition to thecommunications that fall within therefill reminder exception, two othertypes of communications continue to be
exempt from the marketing provisions.
First, as explained in the NPRM,
communications promoting health ingeneral and that do not promote a
product or service from a particularprovider, such as communications
promoting a healthy diet or encouraging
individuals to get certain routine

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

diagnostic tests, such as annual
mammograms, do not constitutemarketing and thus, do not require
individual authorization.
Second, communications about
government and government-sponsoredprograms do not fall within thedefinition of ‘‘marketing’’ as there is nocommercial component tocommunications about benefits throughpublic programs. Therefore, a covered
entity may use and disclose protected
health information to communicate withindividuals about eligibility for
programs, such as Medicare, Medicaid,or the State Children’s Health Insurance
Program (CHIP) without obtaining
individual authorization.
Response to Other Public Comments
Comment: One commenter asked
whether it is marketing where an entity
promotes its discounts on covered
benefits or member-exclusive valueadded health products and services bypaying a mailing house that is the healthplan’s business associate to send its
written promotional material to healthplan members. The commenter statedthat only the mailing house, and not thecovered entity, is paid to send thecommunications.
Response: Even where a businessassociate of a covered entity, such as a
mailing house, rather than the covered
entity itself, receives the financial
remuneration from the entity whose
product or service is being promoted tohealth plan members, thecommunication is a marketing
communication for which priorauthorization is required. As statedabove, under the Privacy Rule, abusiness associate generally may not use
or disclose protected health information
in a manner that would be
impermissible if done by the covered
entity. We note, however, that nonfinancial or in-kind remuneration may
be received by the covered entity or its
business associate and it would not
implicate the new marketing
restrictions. Thus, if the materials
describing a member-exclusive valueadded health product or service were
provided by the entity to the health planor its business associate and no payment
was made by the entity relating to themailing or distribution of the materials,
the covered entity or its businessassociate would be able to provide thematerial to its members without
requiring an authorization.

PO 00000

Frm 00033

Fmt 4701

Sfmt 4700

5597

3. Business Associates
a. Section 164.502(a) and (b)—Permitted
and Required Uses and Disclosures andMinimum Necessary
Before the HITECH Act, the Privacy
Rule did not govern business associates
directly. However, section 13404 of the
HITECH Act makes specificrequirements of the Privacy Rule
applicable to business associates, andcreates direct liability fornoncompliance by business associateswith regard to those Privacy Rulerequirements. Specifically, section
13404(a) of the HITECH Act creates
direct liability for uses and disclosuresof protected health information bybusiness associates that do not comply
with its business associate contract orother arrangement under the Privacy
Rule. Additionally, section 13404(a)applies the other privacy requirementsof the HITECH Act directly to businessassociates just as they apply to covered
entities. Section 13404(b) applies theprovision of § 164.504(e)(1)(ii) regardingknowledge of a pattern of activity orpractice that constitutes a material
breach or violation of a contract tobusiness associates. Finally, section
13404(c) applies the HIPAA civil andcriminal penalties to businessassociates. We discuss the modifications
to the Privacy Rule pursuant toparagraphs (a) and (b) of section 13404
of the HITECH Act below. We address
the modifications made to the
Enforcement Rule by section 13404(c)regarding the application of penalties toviolations by business associates abovein the discussion of the changes to the
Enforcement Rule.
We note that we have not addedreferences to ‘‘business associate’’ to allprovisions of the Privacy Rule that
address uses and disclosures by covered
entities. Such additions to the Privacy
Rule are unnecessary, as a businessassociate generally may only use or
disclose protected health information in
the same manner as a covered entity.
Therefore, any Privacy Rule limitation
on how a covered entity may use or
disclose protected health information
automatically extends to a businessassociate.
i. Permitted and Required Uses andDisclosures
Proposed Rule
We proposed to modify § 164.502(a)of the Privacy Rule containing thegeneral rules for uses and disclosures ofprotected health information to address
the permitted and required uses anddisclosures of protected healthinformation by business associates.
First, we proposed to modify

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5598

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations§ 164.502(a) to provide that a businessassociate, like a covered entity, may notuse or disclose protected healthinformation except as permitted or
required by the Privacy Rule or the
Enforcement Rule. Second, we proposed
to add new provisions at § 164.502(a)(4)and (5) to specify the permitted andrequired uses and disclosures ofprotected health information bybusiness associates.
In accordance with section 13404(a)of the HITECH Act, we proposed in§ 164.502(a)(4) to allow businessassociates to use or disclose protected
health information only as permitted or
required by their business associate
contracts or other arrangements
pursuant to § 164.504(e) or as requiredby law. Any other use or disclosure
would violate the Privacy Rule.
Proposed § 164.502(a)(4) also provided
that a business associate would not be
permitted to use or disclose protected
health information in a manner thatwould violate the Privacy Rule if doneby the covered entity, except that thebusiness associate would be permitted
to use or disclose protected healthinformation for the proper management
and administration of the businessassociate and to provide data
aggregation services for the covered
entity, as specified at§ 164.504(e)(2)(i)(A) and (B), if suchuses and disclosures are permitted by its
business associate contract or otherarrangement.
In § 164.502(a)(5), we proposed torequire that a business associate
disclose protected health information
either: (1) When required by the
Secretary under Subpart C of Part 160 toinvestigate or determine the businessassociate’s compliance with thissubchapter; or (2) to the covered entity,
individual, or individual’s designee, as
necessary to satisfy a covered entity’s
obligations under § 164.524(c)(2)(ii) and(3)(ii), as modified, with respect to anindividual’s request for an electronic
copy of protected health information.
Section 13405(e) of the HITECH Act
requires covered entities that maintainprotected health information in anelectronic health record to provide an
individual, or the individual’s designee,with a copy of such information in anelectronic format, if the individual sochooses. We proposed to include asimilar direct requirement on businessassociates in § 164.502(a)(5), as section
13404(a) of the HITECH Act also applies
section 13405(e) to business associates.
We also proposed a conforming
change to revise the titles of§ 164.502(a)(1) and (a)(2) to make clearthat these provisions setting out
permitted uses and disclosures of

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

protected health information apply only
to covered entities, as well as atechnical change to § 164.502(a)(2)(ii) toreplace the term ‘‘subpart’’ with‘‘subchapter’’ to make clear that acovered entity is required to disclose
protected health information to theSecretary as needed to determine
compliance with any of the HIPAA
Rules and not just the Privacy Rule.
Overview of Public Comments
Several commenters expressed
concern about the increased liability forbusiness associates under the rule andrequested clarification on whenbusiness associate liability forimpermissible uses and disclosureswould attach. Several commenters
asked for clarification as to what abusiness associate is directly liable forunder the Privacy Rule, and some
expressed specific confusion regarding
the liability of business associates forthe provision of e-access under the rule.
Final Rule
The final rule adopts the proposed
modifications to § 164.502(a). The
provisions specifying a businessassociate’s permitted and required usesand disclosures of protected healthinformation are renumbered from§ 164.502(a)(4) and (a)(5), as proposed,to § 164.502(a)(3) and (a)(4), as§ 164.502(a)(5) of the final rule now
includes provisions to address
prohibited uses and disclosures. Section
164.502(a)(5) is discussed below in thesections describing the prohibitions on
the sale of protected health informationand the use or disclosure of genetic
information for underwriting purposes.
In response to specific comments
asking for clarification regarding whenbusiness associate liability would
attach, we provide the following. As wediscussed above, the final rule provides
that a business associate is a person who
performs functions or activities onbehalf of, or certain services for, acovered entity or another businessassociate that involve the use or
disclosure of protected healthinformation. The final rule establishes
that a person becomes a businessassociate by definition, not by the act ofcontracting with a covered entity orotherwise. Therefore, liability forimpermissible uses and disclosuresattaches immediately when a person
creates, receives, maintains, or transmits
protected health information on behalfof a covered entity or business associate
and otherwise meets the definition of abusiness associate.
Liability also does not depend on thetype of protected health informationthat a business associate creates,

PO 00000

Frm 00034

Fmt 4701

Sfmt 4700

receives, maintains, or transmits onbehalf of a covered entity or anotherbusiness associate, or on the type ofentity performing the function orservice, except to the extent the entity
falls within one of the exceptions atparagraph 4 of the definition of businessassociate. First, protected healthinformation created, received,
maintained, or transmitted by a businessassociate may not necessarily include
diagnosis-specific information, such as
information about the treatment of anindividual, and may be limited todemographic or other information notindicative of the type of health careservices provided to an individual. If
the information is tied to a covered
entity, then it is protected healthinformation by definition since it isindicative that the individual received
health care services or benefits from thecovered entity, and therefore it must be
protected by the business associate inaccordance with the HIPAA Rules andits business associate agreement.
Second, the definition of businessassociate is contingent on the fact thatthe business associate performs certain
activities or functions on behalf of, or
provides certain services to, a covered
entity or another business associate thatinvolve the use or disclosure ofprotected health information. Therefore,
any person, defined in the HIPAA Rules
as a natural person, trust or estate,partnership, corporation, professional
association or corporation, or otherentity, public or private, who performs
these functions or activities or services
is a business associate for purposes ofthe HIPAA Rules, regardless of whether
such person has other professional or
privilege-based duties or
responsibilities.
Finally, while we understandcommenters’ concerns about theincreased liability for businessassociates under the HIPAA Rules, suchdirect liability for violations of certain
HIPAA provisions is expressly provided
for by the HITECH Act.
In response to comments requesting
clarification on with which HIPAA
provisions a business associate is
directly liable for compliance, we
provide the following. Businessassociates are directly liable under the
HIPAA Rules for impermissible usesand disclosures,4 for a failure to provide
breach notification to the covered
entity,5 for a failure to provide access toa copy of electronic protected healthinformation to either the covered entity,
the individual, or the individual’s
designee (whichever is specified in the
4 See § 164.502(a)(3).
5 See § 164.410.

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
business associate agreement),6 for a
failure to disclose protected healthinformation where required by the
Secretary to investigate or determine thebusiness associate’s compliance with
the HIPAA Rules,7 for a failure toprovide an accounting of disclosures,8and for a failure to comply with therequirements of the Security Rule.9
Business associates remain
contractually liable for otherrequirements of the business associateagreement (see below for a discussion of
the business associate agreement
provisions).
With respect to a business associate’s
direct liability for a failure to provide
access to a copy of electronic protected
health information, business associates
are liable for providing electronic accessin accordance with their businessassociate agreements. Therefore,business associates may provide
electronic access directly to individuals
or their designees, or may provide theelectronic protected health information
to the covered entity (which thenprovides the electronic access toindividuals or their designees). As withmany other provisions in the HIPAA
Rules, the Department leaves the details
to the contracting parties, and isconcerned only that access is provided
to the individual, not with which party
provides the access.
ii. Minimum Necessary

sroberts on DSK5SPTVN1PROD with

Proposed Rule
We proposed to modify the minimum
necessary standard at § 164.502(b) torequire that when business associatesuse, disclose, or request protected
health information from anothercovered entity, they limit protected
health information to the minimum
necessary to accomplish the intended
purpose of the use, disclosure, orrequest. Applying the minimum
necessary standard is a condition of thepermissibility of many uses anddisclosures of protected healthinformation. Thus, a business associate
is not making a permitted use or
disclosure under the Privacy Rule if it
does not apply the minimum necessary
standard, where appropriate.
Additionally, the HITECH Act at section
13405(b) addresses the application ofminimum necessary and, in accordancewith 13404(a), also applies suchrequirements to business associates.
6 See § 164.502(a)(4)(ii).
7 See § 164.502(a)(4)(i).
8 See 76 FR 31426 (May 31, 2011).
9 See Subpart C of Part 164.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Overview of Public Comments
While the Department received
general support for application of theminimum necessary standard torequests and uses and disclosures bybusiness associates, several commenters
requested clarification on suchapplication.
Final Rule
The final rule adopts the proposal toapply the minimum necessary standard
directly to business associates whenusing or disclosing protected healthinformation or when requesting
protected health information fromanother covered entity. The final rulealso makes clear that requests directed
to another business associate, in
addition to those directed to anothercovered entity, must also be limited tothe minimum necessary. Covered
entities and business associates
disclosing protected health informationin response may reasonably rely on such
requests as requesting the minimum
necessary for the disclosure.
How a business associate will apply
the minimum necessary standard willvary based on the circumstances. As isthe case today, a business associateagreement must limit the businessassociate’s uses and disclosures ofprotected health information to beconsistent with the covered entity’s
minimum necessary policies andprocedures. We leave it to the discretionof the parties to determine to what
extent the business associate agreement
will include specific minimum
necessary provisions to ensure abusiness associate’s uses anddisclosures and requests for protected
health information are consistent withthe covered entity’s minimum necessary
policies and procedures. The
Department intends to issue future
guidance on the minimum necessary
standard in accordance with section
13405(b) of the HITECH Act that willconsider the specific questions posed bycommenters with respect to businessassociates’ application of the minimum
necessary standard.
b. Sections 164.502(e) and 164.504(e)—Business Associate Agreements
Proposed Rule
Section 164.502(e) permits a covered
entity to disclose protected healthinformation to a business associate andmay allow a business associate to create
or receive protected health information
on its behalf, if the covered entity
obtains satisfactory assurances, in theform of a written contract or otherwritten arrangement with the businessassociate that meets the requirements of

PO 00000

Frm 00035

Fmt 4701

Sfmt 4700

5599§ 164.504(e), that the business associate
will appropriately safeguard theinformation. We proposed a parallel
provision in § 164.502(e) that would
allow a business associate to disclose
protected health information to abusiness associate that is asubcontractor, and to allow thesubcontractor to create or receive
protected health information on its
behalf, if the business associate obtains
similar satisfactory assurances that thesubcontractor will appropriately
safeguard the information. Consistent
with the proposal with respect toSecurity Rule requirements andbusiness associates, we proposed tomake clear in § 164.502(e) that a covered
entity would not be required to obtainsatisfactory assurances from businessassociates that are subcontractors.
Rather, a business associate would be
required to obtain such assurances froma subcontractor. Thus, the proposed
provisions would not change the parties
to the contracts. For example, a covered
entity may choose to contract with abusiness associate (contractor) to use or
disclose protected health information on
its behalf, the business associate may
choose to obtain the services of (andexchange protected health informationwith) a subcontractor (subcontractor 1),
and that subcontractor may, in turn,contract with another subcontractor(subcontractor 2) for services involving
protected health information. The
contractor and subcontractors 1 and 2
would now be business associates withdirect liability under the HIPAA Rules,
and would be required to obtainbusiness associate agreements with theparties with whom they contract forservices that involve access to protected
health information. (Note, however, as
discussed above with respect to thedefinition of ‘‘business associate,’’ direct
liability under the HIPAA Rules would
attach regardless of whether thecontractor and subcontractors haveentered into the required businessassociate agreements.)
We also proposed to remove§ 164.502(e)(1)(iii), which provides thata covered entity that violates thesatisfactory assurances it provided as abusiness associate of another covered
entity will be in noncompliance with
the Privacy Rule’s business associateagreement provisions, given that
proposed changes to § 164.502 would
now restrict directly the uses anddisclosures of protected healthinformation by a business associate,including a covered entity acting as abusiness associate, to those uses anddisclosures permitted by its businessassociate agreement.

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5600

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

Finally, as discussed above withrespect to the definition of businessassociate, we proposed to move thecurrent exceptions to business associate
to the definition itself in § 160.103.
Section 164.504(e) contains the
specific requirements for businessassociate contracts and otherarrangements. We proposed a number ofmodifications to § 164.504(e) toimplement section 13404 of the HITECH
Act and to reflect the Department’s new
regulatory authority with respect tobusiness associates, as well as to reflect
a covered entity’s and businessassociate’s new obligations under
Subpart D of Part 164 of the Privacy
Rule to provide for notification in thecase of breaches of unsecured protected
health information.
Section 164.504(e)(1)(ii) provides thata covered entity is not in compliancewith the business associaterequirements if the covered entity knewof a pattern of activity or practice of thebusiness associate that constituted amaterial breach or violation of thebusiness associate’s obligation under thecontract or other arrangement, unlessthe covered entity took reasonable steps
to cure the breach or end the violation,
as applicable, and if such steps were
unsuccessful, terminated the contract orarrangement or, if termination is not
feasible, reported the problem to theSecretary. We proposed to remove therequirement that covered entities reportto the Secretary when termination of abusiness associate agreement is not
feasible. In light of a business associate’s
direct liability for civil money penalties
for certain violations of the businessassociate agreement and both a covered
entity’s and business associate’s
obligations under Subpart D to reportbreaches of unsecured protected healthinformation to the Secretary, we haveother mechanisms through which we
expect to learn of such breaches andmisuses of protected health information
by a business associate.
We also proposed to add a newprovision at § 164.504(e)(1)(iii)applicable to business associates withrespect to subcontractors to mirror therequirements on covered entities at§ 164.504(e)(1)(ii) (minus therequirement to report to the Secretary if
termination of a contract is not feasible).
Thus, a business associate that is awareof noncompliance by its businessassociate subcontractor would be
required to respond to the situation in
the same manner as a covered entitythat is aware of noncompliance by its
business associate. We believe thisprovision would implement section
13404(b) of the HITECH Act, and wouldalign the requirements for business

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

associates with regard to businessassociate subcontractors with therequirements for covered entities withregard to their business associates.
We also proposed changes to thespecific business associate agreement
provisions at § 164.504(e). First, we
proposed to revise § 164.504(e)(2)(ii)(B)
through (D) to provide that the contract
will require that: in (B), businessassociates comply, where applicable,with the Security Rule with regard toelectronic protected health information;in (C), business associates reportbreaches of unsecured protected healthinformation to covered entities, as
required by § 164.410; and in (D), in
accordance with § 164.502(e)(1)(ii),business associates ensure that any
subcontractors that create or receive
protected health information on behalfof the business associate agree to thesame restrictions and conditions that
apply to the business associate withrespect to such information. These
revisions were proposed to align therequirements for the business associateagreement with the requirements in the
HITECH Act and elsewhere within the
HIPAA Rules.
Additionally, we proposed to add a
new agreement provision at§ 164.504(e)(2)(ii)(H) (and to renumber
the current paragraphs (H) and (I)accordingly) to requires that, to theextent the business associate is to carryout a covered entity’s obligation under
this subpart, the business associate mustcomply with the requirements of thePrivacy Rule that apply to the covered
entity in the performance of suchobligation. This provision would clarify
that when a covered entity delegates a
responsibility under the Privacy Rule tothe business associate, the businessassociate would be contractuallyrequired to comply with therequirements of the Privacy Rule in thesame manner as they apply to thecovered entity. For example, if a third
party administrator, as a businessassociate of a group health plan, fails to
distribute the plan’s notice of privacy
practices to participants on a timely
basis, the third party administrator
would not be directly liable under the
HIPAA Rules, but would becontractually liable, for the failure.
However, even though the businessassociate is not directly liable under the
HIPAA Rules for failure to provide thenotice, the covered entity remains
directly liable for failure to provide theindividuals with its notice of privacy
practices because it is the covered
entity’s ultimate responsibility to do so,
despite its having hired a businessassociate to perform the function.

PO 00000

Frm 00036

Fmt 4701

Sfmt 4700

We also proposed to add a new§ 164.504(e)(5) that would apply therequirements at § 164.504(e)(2) through(e)(4) to the contract or otherarrangement between a businessassociate and its business associate
subcontractor as required by§ 164.502(e)(1)(ii) in the same manner assuch requirements apply to contracts orother arrangements between a covered
entity and its business associate. Thus,
a business associate would be requiredby § 164.502(e)(1)(ii) and by this section
to enter into business associateagreements or other arrangements thatcomply with the Privacy and Security
Rules with their business associate
subcontractors, in the same manner thatcovered entities are required to enter
into contracts or other arrangementswith their business associates.
Finally, we proposed a few otherminor changes. We proposed in§ 164.504(e)(3) regarding otherarrangements for governmental entities
to include references to the Security
Rule requirements for businessassociates to avoid having to repeat suchprovisions in the Security Rule. We also
proposed to remove the reference tosubcontractors in § 164.504(f)(2)(ii)(B)(regarding disclosures to plan sponsors)and in § 164.514(e)(4)(ii)(C)(4)(regarding data use agreements forlimited data sets) to avoid confusion
since the term ‘‘subcontractor’’ is now adefined term under the HIPAA Rules
with a particular meaning that is related
to business associates. The proposed
removal of the term was not intended asa substantive change to the provisions.
Overview of Public Comments
Several commenters expressed
confusion regarding the need forbusiness associate agreements,
considering the provisions for direct
liability from the HITECH Act and in
the proposed rule. Many of thesecommenters suggested that all of therequirements of the Privacy Rule apply
to business associates, as is the casewith the Security Rule.
A few commenters requested
clarification about what constitutes‘‘satisfactory assurances’’ pursuant to
the rule, asking whether, for example,
there were expectations on covered
entities to ensure that businessassociates (including subcontractors)
have appropriate controls in placebesides business associate agreements orwhether a covered entity must obtainfrom a business associate satisfactory
assurance that any business associate
subcontractors are complying with theRules. Several commenters requested
clarification on the appropriateness of

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withindemnification clauses in businessassociate agreements.
Finally, several commenters requested
that the Department provide a modelbusiness associate agreement.
Final Rule
The final rule adopts the proposed
modifications to §§ 164.502(e) and
164.504(e). As we discussed above,
while section 13404 of the HITECH Act
provides that business associates are
now directly liable for civil money
penalties under the HIPAA Privacy Rulefor impermissible uses and disclosuresand for the additional HITECH
requirements in Subtitle D that are madeapplicable to covered entities, it does
not apply all of the requirements of thePrivacy Rule to business associates andthus, the final rule does not. Therefore,business associates are not required tocomply with other provisions of thePrivacy Rule, such as providing a noticeof privacy practices or designating a
privacy official, unless the covered
entity has chosen to delegate such a
responsibility to the business associate,
which would then make it a contractual
requirement for which contractual
liability would attach.
Concerning commenters’ questions
about the continued need for businessassociate agreements given the new
direct liability on business associates forcompliance, we note that section 13404
of the HITECH Act expressly refers andties business associate liability to
making uses and disclosures inaccordance with the uses anddisclosures laid out in such agreements,
rather than liability for compliance with
the Privacy Rule generally. Further,section 13408 of the HITECH Act
requires certain data transmission andpersonal health record vendors to havein place business associate agreementswith the covered entities they serve. We
also continue to believe that, despite thebusiness associate’s direct liability forcertain provisions of the HIPAA Rules,
the business associate agreement isnecessary to clarify and limit, as
appropriate, the permissible uses anddisclosures by the business associate,given the relationship between theparties and the activities or services
being performed by the businessassociate. The business associateagreement is also necessary to ensurethat the business associate iscontractually required to perform
certain activities for which direct
liability does not attach (such as
amending protected health informationin accordance with § 164.526). In
addition, the agreement represents anopportunity for the parties to clarify
their respective responsibilities under

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

the HIPAA Rules, such as byestablishing how the business associateshould handle a request for access toprotected health information that it
directly receives from an individual.
Finally, the business associateagreement serves to notify the businessassociate of its status under the HIPAA
Rules, so that it is fully aware of its
obligations and potential liabilities.
With respect to questions about‘‘satisfactory assurances,’’ § 164.502(e)provides that covered entities andbusiness associates must obtain anddocument the ‘‘satisfactory assurances’’of a business associate through a written
contract or other agreement, such as amemorandum of understanding, withthe business associate that meets theapplicable requirements of § 164.504(e).
As discussed above, § 164.504(e)specifies the provisions required in thewritten agreement between covered
entities and business associates,
including a requirement that a businessassociate ensure that any subcontractors
agree to the same restrictions andconditions that apply to the businessassociate by providing similarsatisfactory assurances. Beyond therequired elements at § 164.504(e), aswith any contracting relationship,business associates and covered entities
may include other provisions or
requirements that dictate and describe
their business relationship, and that areoutside the governance of the Privacy
and Security Rules. These may or may
not include additional assurances ofcompliance or indemnification clauses
or other risk-shifting provisions.
We also clarify with respect to thesatisfactory assurances to be provided
by subcontractors, that the agreement
between a business associate and abusiness associate that is asubcontractor may not permit thesubcontractor to use or disclose
protected health information in amanner that would not be permissible ifdone by the business associate. For
example, if a business associateagreement between a covered entity anda contractor does not permit thecontractor to de-identify protected
health information, then the businessassociate agreement between thecontractor and a subcontractor (and theagreement between the subcontractor
and another subcontractor) cannot
permit the de-identification of protected
health information. Such a use may bepermissible if done by the covered
entity, but is not permitted by thecontractor or any subcontractors if it is
not permitted by the covered entity’sbusiness associate agreement with thecontractor. In short, each agreement in
the business associate chain must be as

PO 00000

Frm 00037

Fmt 4701

Sfmt 4700

5601

stringent or more stringent as theagreement above with respect to thepermissible uses and disclosures.
Finally, in response to the comments
requesting a model business associateagreement, we note that the Department
has published sample business associateprovisions on its web site. The sample
language is designed to help covered
entities comply with the businessassociate agreement requirements of thePrivacy and Security Rules. However,use of these sample provisions is not
required for compliance with the Rules,
and the language should be amended as
appropriate to reflect actual businessarrangements between the covered
entity and the business associate (or abusiness associate and a subcontractor).
Response to Other Public Comments
Comment: Commenters requested
guidance on whether a contract thatcomplies with the requirements of theGraham Leach Bliley Act (GLBA) andincorporates the required elements ofthe HIPAA Rules may satisfy both setsof regulatory requirements. The
commenters urged the Department topermit a single agreement rather thanrequiring business associates andbusiness associate subcontractors toenter into separate GLBA agreements
and business associate agreements.
Response: While meeting therequirements of the GLBA does notsatisfy the requirements of the HIPAA
Rules, covered entities may use one
agreement to satisfy the requirements ofboth the GLBA and the HIPAA Rules.
Comment: A few commenters
recommended adding an exception tohaving a business associate agreement
for a person that receives a limited
dataset and executes a data use
agreement for research, health care
operations, or public health purposes.
Response: We have prior guidance
that clarifies that if only a limited
dataset is released to a businessassociate for a health care operations
purpose, then a data use agreement
suffices and a business associateagreement is not necessary. To makethis clear in the regulation itself, we areadding to § 164.504(e)(3) a newparagraph (iv) that recognizes that a data
use agreement may qualify as a businessassociate’s satisfactory assurance that it
will appropriately safeguard the covered
entity’s protected health information
when the protected health information
disclosed for a health care operations
purpose is a limited data set. A similar
provision is not necessary or
appropriate for disclosures of limited
data sets for research or public healthpurposes since such disclosures would

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5602

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

not otherwise require business associateagreements.
Comment: A few commenters
requested that the Department delete§ 164.504(e)(2)(ii)(H), which provides
that to the extent the business associate
is to carry out a covered entity’s
obligation under the HIPAA Rules, thebusiness associate must comply withthe requirements of the HIPAA Rules
that apply to the covered entity in theperformance of the obligation on behalfof the covered entity. Alternatively,commenters suggested that the
Department clarify that therequirements of the section need not be
included in business associateagreements and that this section does
not limit the ability of covered entities
and business associates to negotiate
responsibilities with regard to othersections of the Privacy Rule.
Response: The Department declines todelete § 164.504(e)(2)(ii)(H). If abusiness associate contracts to provide
services to the covered entity withregard to fulfilling individual rights orother obligations of the covered entity
under the Privacy Rule, then thebusiness associate agreement must
require the business associate to fulfill
such obligation in accordance with thePrivacy Rule’s requirements. We doclarify, however, that if the covered
entity does not delegate any of its
responsibilities under the Privacy Ruleto the business associate, then
§ 164.504(e)(2)(ii)(H) is not applicableand the parties are not required toinclude such language.
Comment: One commenter requested
that the Department modify§ 164.502(a)(4)(i) to permit businessassociates to use and disclose protected
health information for their own healthcare operations purposes, and anothercommenter requested that the
Department clarify whether§ 164.504(e)(4) provides that a businessassociate may use or disclose protected
health information as a covered entity
would use or disclose the information.
Response: The Department declines tomake the suggested modification.
Business associates do not have theirown health care operations (see thedefinition of health care operations at§ 164.501, which is limited to activitiesof the covered entity). While a businessassociate does not have health care
operations, it is permitted by§ 164.504(e)(2)(i)(A) to use and disclose
protected health information asnecessary for its own management andadministration if the business associateagreement permits such activities, or tocarry out its legal responsibilities. Other
than the exceptions for the businessassociate’s management and

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

administration and for data aggregation
services relating to the health care
operations of the covered entity, thebusiness associate may not use or
disclose protected health information ina manner that would not be permissible
if done by the covered entity (even if
such a use or disclosure is permitted by
the business associate agreement).
Comment: One commenter suggested
requiring subcontractors to return or
destroy all protected health information
received from or created for a businessassociate when the contract with thebusiness associate is terminated.
Response: The final rule at§ 164.504(e)(5) does apply therequirements at § 164.504(e)(2) through(4) (which set forth the requirements foragreements between covered entities
and their business associates) toagreements between business associates
and their subcontractors. This includes§ 164.504(e)(2)(ii)(J), which requires thebusiness associate to return or destroy
all protected health information
received from, or created or received onbehalf of, the covered entity at thetermination of the contract, if feasible.
When this requirement is applied to theagreement between the businessassociate and its business associate
subcontractor, the effect is a contractual
obligation for the business associate
subcontractor to similarly return or
destroy protected health information at
the termination of the contract, if
feasible.
Comment: One commenter suggested
requiring a business associate todisclose all subcontractors of thebusiness associate to a covered entity
within thirty days of the covered
entity’s request.
Response: The Department declines toadopt this suggestion as a requirementof the HIPAA Rules, because such arequirement would impose an undue
disclosure burden on businessassociates. However, covered entities
and business associates may include
additional terms and conditions in theircontracts beyond those required by§ 164.504.
Comment: One commenter suggested
establishing a certification process ofbusiness associates and subcontractors
with regard to HIPAA compliance.
Response: The Department declines toestablish or endorse a certification
process for HIPAA compliance forbusiness associates and subcontractors.
Business associates and subcontractors
are free to enlist the services of outside
entities to assess their compliance with
the HIPAA Rules and certification may
be a useful compliance tool for entities,
depending on the rigor of the program.
However, certification does not

PO 00000

Frm 00038

Fmt 4701

Sfmt 4700

guarantee compliance and therefore‘‘certified’’ entities may still be subject
to enforcement by OCR.
Comment: One commenter requested
clarification on when it is not feasible
for a business associate to terminate acontract with a subcontractor.
Response: Whether it is feasible for abusiness associate to terminate anagreement with a business associate
subcontractor is a very fact-specificinquiry that must be examined on acase-by-case basis. For example,
termination is not feasible for a businessassociate with regard to a subcontractor
relationship where there are no otherviable business alternatives for thebusiness associate (when thesubcontractor, for example, provides aunique service that is necessary for thebusiness associate’s operations). See ourprior guidance on this issue as it applies
to covered entities and businessassociates in Frequently Asked Question#236, available at http://www.hhs.gov/
ocr/privacy/hipaa/faq/
business_associates/236.html.
c. Section 164.532—Transition
Provisions
Proposed Rule
We understand that covered entities
and business associates are concernedwith the anticipated administrative
burden and cost to implement therevised business associate agreement
provisions of the Privacy and Security
Rules. Covered entities may haveexisting contracts that are not set toterminate or expire until after thecompliance date of the modifications to
the Rules, and we understand that a six
month compliance period may notprovide enough time to reopen andrenegotiate all contracts. In response tothese concerns, we proposed to relieve
some of the burden on covered entities
and business associates in complying
with the revised business associateprovisions by adding a transition
provision to grandfather certain existing
contracts for a specified period of time.
The Department’s authority to add thetransition provision is set forth in§ 160.104(c), which allows the Secretary
to establish the compliance date for any
modified standard or implementation
specification, taking into account theextent of the modification and the timeneeded to comply with themodification. The proposed transition
period would prevent rushed and hastychanges to thousands of on-going
existing business associate agreements.
We addressed the issue of the businessassociate transition provisions asfollows.

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
We proposed new transition
provisions at § 164.532(d) and (e) toallow covered entities and businessassociates (and business associates andbusiness associate subcontractors) tocontinue to operate under certain
existing contracts for up to one year
beyond the compliance date of therevisions to the Rules. The additionaltransition period would be available toa covered entity or business associate if,
prior to the publication date of themodified Rules, the covered entity or
business associate had an existing
contract or other written arrangementwith a business associate or
subcontractor, respectively, thatcomplied with the prior provisions of
the HIPAA Rules and such contract orarrangement was not renewed or
modified between the effective date andthe compliance date of themodifications to the Rules. The
proposed provisions were intended toallow those covered entities andbusiness associates with valid contracts
with business associates andsubcontractors, respectively, to continue
to disclose protected health information
to the business associate or
subcontractor, or to allow the businessassociate or subcontractor to continue tocreate or receive protected healthinformation on behalf of the covered
entity or business associate, for up to
one year beyond the compliance date of
the modifications, regardless of whether
the contract meets the applicable
contract requirements in themodifications to the Rules. With respect
to business associates andsubcontractors, the proposal would
grandfather existing written agreements
between business associates andsubcontractors entered into pursuant to§ 164.504(e)(2)(ii)(D) (which requires thebusiness associate to ensure that its
agents with access to protected healthinformation agree to the same
restrictions and conditions that apply tothe business associate). The Department
proposed to deem such contracts to becompliant with the modifications to theRules until either the covered entity or
business associate has renewed or
modified the contract following thecompliance date of the modifications, oruntil the date that is one year after thecompliance date, whichever is sooner.
In cases where a contract renews
automatically without any change interms or other action by the parties (alsoknown as ‘‘evergreen contracts’’), theDepartment intended that suchevergreen contracts would be eligible forthe extension and that deemedcompliance would not terminate whenthese contracts automatically rolled

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

over. These transition provisions would
have applied to covered entities andbusiness associates only with respect towritten contracts or other written
arrangements as specified above, andnot to oral contracts or otherarrangements.
These transition provisions would
have only applied to the requirement toamend contracts; they would not affectany other compliance obligations underthe HIPAA Rules. For example,
beginning on the compliance date ofthis rule, a business associate may notuse or disclose protected healthinformation in a manner that is contrary
to the Privacy Rule, even if the businessassociate’s contract with the covered
entity has not yet been amended.
Overview of Public Comments
Many commenters supported the 1year extended timeframe for compliancewith the business associate agreement
provisions. Some commenters suggested
longer timeframes, citing cost andresource limitations. Some commenterssuggested that the Department should
deem compliant all business associateagreements that have been renegotiatedin good faith to meet the February 2010
effective date of the applicableprovisions in the HITECH Act. Some
commenters suggested that the
Department recognize as compliant
business associate agreements with
provisions requiring compliance withall applicable laws.
Final Rule
The final rule adopts the proposal,
adding new transition provisions at§ 164.532(d) and (e) to allow covered
entities and business associates (andbusiness associates and businessassociate subcontractors) to continue tooperate under certain existing contracts
for up to one year beyond thecompliance date of the revisions to theRules.
We decline to provide a longer time
for compliance with the businessassociate agreement provisions. We
provided a similar transition period forrevising agreements in the 2002
modifications to the HIPAA Rules, andit was our experience that such time
was sufficient to ease burden on theentities and allow most agreements to bemodified at the time they would
otherwise come up for renewal orrenegotiation.
With respect to those businessassociate agreements that already havebeen renegotiated in good faith to meet
the applicable provisions in the HITECH
Act, covered entities should review
such agreements to determine whether
they meet the final rule’s provisions. If

PO 00000

Frm 00039

Fmt 4701

Sfmt 4700

5603

they do not, these covered entities thenhave the transition period to makewhatever additional changes arenecessary to conform to the final rule.
The transition period is also available tothose agreements that requirecompliance with all applicable laws (tothe extent the agreements wereotherwise in compliance with the
HIPAA Rules prior to this final rule),
but that do not fully meet the newrequirements in this final rule.
However, we do not deem suchcontracts as compliant beyond thetransition period because they would
not sufficiently reflect the newrequirements.
4. Section 164.508—Uses andDisclosures for Which an Authorization
Is Requireda. Sale of Protected Health Information
Proposed Rule
Section 164.508 of the Privacy Rulepermits a covered entity to use anddisclose protected health information
for purposes not otherwise permitted by
the Rule if it has obtained a valid
written authorization from theindividual who is the subject of theinformation. This section also specifies
two circumstances in whichauthorization from the individual must
be obtained: (1) Most uses anddisclosures of psychotherapy notes; and(2) uses and disclosures for marketing
purposes.
Section 13405(d) of the HITECH Act
added a third circumstance that requires
authorization, specifically the sale ofprotected health information. Section
13405(d)(1) prohibits a covered entity or
business associate from receiving direct
or indirect remuneration in exchange forthe disclosure of protected healthinformation unless the covered entity
has obtained an individual’s
authorization pursuant to § 164.508 thatstates whether the protected healthinformation can be further exchanged
for remuneration by the entity receiving
the information.
Section 13405(d)(2) contains several
exceptions to the authorization
requirement for circumstances where
the purpose of the exchange is for: (1)Public health activities, as described at§ 164.512(b) of the Privacy Rule; (2)research purposes as described at§§ 164.501 and 164.512(i) of the Rule, if
the price charged for the informationreflects the cost of preparation andtransmittal of the data; (3) treatment of
the individual; (4) the sale, transfer,merger or consolidation of all or part ofa covered entity and for related due
diligence; (5) services rendered by abusiness associate pursuant to a

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5604

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

business associate agreement and at the
specific request of the covered entity; (6)providing an individual with access to
his or her protected health information
pursuant to § 164.524; and (7) otherpurposes as the Secretary deems
necessary and appropriate by regulation.
Section 13405(d)(4) of the Act provides
that the prohibition on sale of protected
health information applies todisclosures occurring six months after
the date of the promulgation of the final
regulations implementing this section.
To implement section 13405(d) of the
HITECH Act, we proposed to add ageneral rule at § 164.508(a)(4) requiringa covered entity to obtain an
authorization for any disclosure ofprotected health information in
exchange for direct or indirect
remuneration from or on behalf of therecipient of the information and torequire that the authorization state thatthe disclosure will result in
remuneration to the covered entity.
Consistent with the HITECH Act, the
NPRM proposed to exclude several
disclosures of protected healthinformation made in exchange forremuneration from this general rule. As
provided in the Act, these requirements
would also apply to business associatesof covered entities.
In the NPRM we did not include
language at § 164.508(a)(4) to requirethat the authorization under § 164.508
specify whether the protected healthinformation disclosed by the covered
entity for remuneration could be further
exchanged for remuneration by theentity receiving the information. The
statute refers to obtaining a valid
authorization that includes a
remuneration statement in accordancewith § 164.508. The remuneration
statement required by § 164.508 is
whether remuneration will be received
by the covered entity with respect to thedisclosures subject to the authorization.
This puts the individual on notice thatthe disclosure involves remunerationand thus, enables the individual to
make an informed decision as towhether to sign the authorization. Thus,
we interpreted the statute to mean thatthe authorization must include astatement that the covered entity isreceiving direct or indirect
remuneration in exchange for theprotected health information. We notethat these exact words do not need to be
used in the statement. We provide
discretion for covered entities to craft
appropriate language that reflects, forexample, the specific type of
remuneration they receive. As we
explained in the NPRM, with respect tothe recipient of the information, if
protected health information is

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

disclosed for remuneration by a covered
entity or business associate to anothercovered entity or business associate incompliance with the authorization
requirements at proposed§ 164.508(a)(4)(i), the recipient covered
entity or business associate could not
redisclose the protected healthinformation in exchange forremuneration unless a valid
authorization was obtained inaccordance with proposed§ 164.508(a)(4)(i). We requested
comment on these provisions.
At proposed § 164.508(a)(4)(ii), we set
forth the exceptions to the authorization
requirement. We proposed theexceptions provided for by section
13405(d)(2) of the HITECH Act, and also
proposed to exercise the authority
granted to the Secretary in section
13405(d)(2)(G) to include additional
exceptions that we deemed to be
similarly necessary and appropriate.
These exceptions are discussed below.
We requested comment on whether
there were additional exceptions thatshould be included in the final
regulation.
First, we proposed to include an
exception to cover exchanges forremuneration for public health activities
pursuant to §§ 164.512(b) or 164.514(e).
We added the reference to § 164.514(e)of the Privacy Rule to ensure that
disclosures of protected healthinformation for public health activities
in limited data set form would also be
excepted from the authorization
requirement, in addition to disclosuresthat may occur under § 164.512(b) withmore identifiable information. With
respect to the exception for publichealth disclosures, section
13405(d)(3)(A) of the HITECH Act
requires that the Secretary evaluate theimpact on public health activities ofrestricting this exception to require thatthe price charged for the data reflects
only the costs of preparation andtransmittal of the data, including those
conducted by or for the use of the Foodand Drug Administration (FDA). Section
13405(d)(3)(B) further provides that if
the Secretary finds that such further
restriction will not impede publichealth activities, the restriction may
then be included in the regulations. We
did not propose to include such a
restriction on remuneration in the Rule,but requested public comment to assist
us in evaluating the impact of doing so.
The NPRM also included an
exception for disclosures of protected
health information for research
purposes, pursuant to §§ 164.512(i) or
164.514(e), in exchange for which thecovered entity receives only areasonable, cost based fee to cover the

PO 00000

Frm 00040

Fmt 4701

Sfmt 4700

cost to prepare and transmit the
information for research purposes. Like
the public health exception, we
proposed to add a reference to§ 164.514(e) to ensure that thisexception would also apply to thedisclosure of protected healthinformation in limited data set form forresearch purposes. We requested publiccomment on the types of costs thatshould be permitted under thisprovision.
We proposed to create an exception
from the authorization requirement fordisclosures of protected healthinformation for treatment and payment
purposes. Though the Act only
addressed treatment, we proposed toalso except disclosures for payment for
health care from the remunerationprohibition to make clear that theexchange of protected healthinformation to obtain ‘‘payment,’’ assuch term is defined in the Privacy Ruleat § 164.501, would not be considered asale of protected health information.
Consistent with section
13405(d)(2)(D) of the HITECH Act, we
proposed to except from theauthorization requirement disclosuresdescribed in paragraph (6)(iv) of thedefinition of health care operations at§ 164.501, that is, disclosures for thesale, transfer, merger, or consolidationof all or part of a covered entity, or anentity that following such activity will
become a covered entity, and due
diligence related to such activity.
We proposed to provide an exception
from the authorization requirement fordisclosures of protected healthinformation to or by a business associate
for activities that the business associateundertakes on behalf of a covered entity
pursuant to §§ 164.502(e) and 164.504(e)of the Privacy Rule, as long as the only
remuneration provided is by thecovered entity to the business associate
for the performance of such activities.
This exception would exempt from theauthorization requirement at§ 164.508(a)(4)(i) a disclosure ofprotected health information by acovered entity to a business associate orby a business associate to a third party
on behalf of the covered entity as longas any remuneration received by thebusiness associate was for the activities
performed by the business associatepursuant to a business associate
contract.
We proposed to except from theauthorization requirement disclosures ofprotected health information by acovered entity to an individual whenrequested under §§ 164.524 (providing aright to access protected healthinformation) or 164.528 (providing aright to receive an accounting of

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
disclosures). While section
13405(d)(2)(F) of the HITECH Act
explicitly refers only to disclosures
under § 164.524, we exercised our
authority under section 13405(d)(2)(G)of the HITECH Act to likewise include
in the exception disclosures to theindividual under § 164.528. Section
164.524 permits a covered entity to
impose a reasonable, cost-based fee forthe provision of access to anindividual’s protected healthinformation upon request. Section
164.528 requires a covered entity toprovide a requesting individual with anaccounting of disclosures withoutcharge in any 12-month period but
permits a covered entity to impose areasonable, cost-based fee for eachsubsequent request for an accounting of
disclosures during that 12-month
period. Therefore, a disclosure ofprotected health information under§ 164.528 is similar to a disclosure
under § 164.524 in that a covered entity
may be paid a fee for making thedisclosure.
Pursuant to the authority granted to
the Secretary in section 13405(d)(2)(G)of the HITECH Act, we proposed an
additional exception for disclosures thatare required by law as permitted under§ 164.512(a) of the Privacy Rule.
Finally, we proposed an exception,
pursuant to the authority granted to theSecretary in section 13405(d)(2)(G), fordisclosures of protected healthinformation for any other purpose
permitted by and in accordance with theapplicable requirements of the Privacy
Rule, as long as the only remuneration
received by the covered entity is areasonable, cost based fee to cover thecost to prepare and transmit theprotected health information for such
purpose or is a fee otherwise expressly
permitted by other law. We proposed
this exception to ensure that theauthorization requirement would not
deter covered entities from disclosing
protected health information for
permissible purposes under the Privacy
Rule just because they routinely receive
payment equal to the cost of preparing,producing, and transmitting theprotected health information. Weemphasized that this proposed
exception would not apply if a covered
entity received remuneration above theactual cost incurred to prepare, produce,and transmit the protected healthinformation for the permitted purpose,
unless such fee is expressly permitted
by other law.
As explained in the NPRM, we
recognize that many States have laws inplace to limit the fees a health careprovider can charge to prepare, copy,
and transmit medical records. Under

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

these laws, there is great variation
regarding the types of document
preparation activities for which a
provider can charge as well as thepermissible fee schedules for suchpreparation activities. Some States
simply require any reasonable costs
incurred by the provider in making
copies of the medical records to be paid
for by the requesting party, while otherStates set forth specific cost limitations
with respect to retrieval, labor, supplies,
and copying costs and allow charges
equal to actual mailing or shipping
costs. Many of these State laws set
different cost limitations based on theamount and type of information to beprovided, taking into account whether
the information is in paper or electronic
form as well as whether the requested
material includes x-rays, films, disks,tapes, or other diagnostic imaging. The
proposed exception would permit
recoupment of fees expressly permitted
by these other laws.
Overview of Public Comments
Many commenters asked forclarification on the scope of activities
that constitute a ‘‘sale of protected
health information.’’ Several of thesecommenters asked that the final rule
include a definition of ‘‘sale of protected
health information’’ and argued that the
proposed language at § 164.508(a)(4)
was too broad and had the potential tocapture a number of activities thatshould not constitute a ‘‘sale’’ ofprotected health information.
Commenters made a variety ofsuggestions in this regard, including
suggesting that a definition of saleshould focus on the transfer ofownership of protected healthinformation and thus exclude
disclosures pursuant to an accessagreement, license, or lease thatappropriately limits a recipient’s uses ordisclosures of the information; or that adefinition of sale should more clearly
capture those disclosures where
remuneration is provided in exchange
for protected health information, rather
than all disclosures that may involve
remuneration. A number of commenterswere concerned that fees paid forservices or programs that involve thedisclosure of protected healthinformation but that are not fees topurchase the data themselves
nonetheless would turn such disclosure
into a sale of protected healthinformation. For example, somecommenters were concerned that thedisclosure of research results to a
research sponsor would be a sale ofprotected health information because
the sponsor paid the covered entity forits services in conducting the research

PO 00000

Frm 00041

Fmt 4701

Sfmt 4700

5605

study or project. Other commenters
expressed concern about theauthorization requirements for the saleof protected health information
applying to programs for which acovered entity receives funding and, asa condition of that funding, is required
to report data, such as under the
Medicare and Medicaid incentive
payment programs for meaningful usersof certified electronic health record
technology and certain State grant
programs. A few commenters wereconcerned that the exchange ofprotected health information through ahealth information exchange (HIE) thatis paid for through fees assessed on HIE
participants could be considered sale ofprotected health information.
Commenters also asked forclarification on the meaning and scopeof the term ‘‘direct and indirect
remuneration,’’ and some wereparticularly concerned that ‘‘indirect
remuneration’’ meant nonfinancial
benefits provided in exchange forprotected health information could turna disclosure into a sale of protected
health information. Some commentersstated that prohibiting the receipt ofindirect remuneration or nonfinancial
benefits may eliminate any incentive forcovered entities to participate in certain
collaborative research or quality
activities, in which covered entities
contribute data to a centralized databaseto create aggregate data sets and in
return may receive a number ofnonfinancial benefits, such as the ability
to use the aggregated information forresearch or access to quality assurance/
quality improvement tools. Certain
commenters argued that the term
indirect in the statute modifies the‘‘receipt’’ of remuneration (i.e., that thestatute also applies to the situation
where the remuneration is provided bya third party on behalf of the recipientof the protected health information) andnot the type of remuneration.
The public health exception to the
remuneration prohibition received asignificant amount of support fromcommenters. Several commenters
expressed specific support for the
proposal to expand the exception to also
apply to disclosures of limited data setsfor public health purposes. With respect
to the request for comment on theimpact of restricting this exception torequire that the price charged for thedata reflects on the costs of preparing
and transmitting the data, commenterswere generally opposed to imposing
such a restriction. Commenters statedthat it may be difficult and burdensome
to determine if some of a covered
entity’s routine public health reporting
involve any type of remuneration and

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5606

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

that a cost-based restriction on
remuneration would discourage andimpede covered entities from making
important public health disclosures.
One commenter was opposed to the
public health exception altogether,stating that it is a privacy loophole thateliminates consumer control over theirprotected health information.
Many respondents to the proposedsale prohibition commented on the
proposed exception for research. Whilemost commenters supported including
an exception for research disclosures,
including disclosures of limited data
sets for research, many argued that the
exception should not be limited to thereceipt of a reasonable cost-based fee toprepare and transmit the data as such a
fee limitation could impede importantresearch efforts. A number ofcommenters specifically opposed
imposing a fee limitation on thedisclosure of limited data sets. If a fee
limitation were retained, commentersargued that it should be broadly
construed. The majority of commenterson this issue supported the proposed
exceptions to the remunerationprohibition for treatment and healthcare payment purposes, as necessary so
as not to impede these core health carefunctions. Overall, support was also
expressed by those who commented on
the exception for the sale, transfer,merger, or consolidation of a covered
entity. Further, commenters generally
agreed that a covered entity should bepermitted to disclose protected healthinformation without individual
authorization as required by law, even
if remuneration is received in exchange
for the disclosure.
Commenters also submitted a numberof comments and questions regarding
the ability of business associates toreceive fees under both the proposed
exception specifically for fees paid by acovered entity to a business associate
and the general exception that would
allow a covered entity to receive areasonable, cost-based fee to cover thecosts to prepare and transmit the data ora fee otherwise expressly permitted byother law for any disclosure permitted
by the Privacy Rule. While commentersgenerally supported these exceptions,commenters were concerned that these
exceptions appeared not to cover thecommon situation where a businessassociate, rather than the covered entity,
receives remuneration from a third party
for making a permitted disclosure under
the Privacy Rule. For example, anumber of commenters stated thatcovered entities often outsource torelease of information (ROI) vendors theprocessing of requests for copies of
medical records from third parties and

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

that these vendors and not the covered
entities bill for the reasonable costs ofproviding the records to the requestors.
Commenters asked that the final rule
clarify that business associates cancontinue to receive payment of costs
from third parties for providing thisservice on behalf of covered entities.
Another commenter requested that the
final rule clarify that the exception for
remuneration to a business associate foractivities performed on behalf of acovered entity also applies toremuneration received bysubcontractors performing services onbehalf of business associates.
Finally, several commenters also
responded to the proposed rule’srequest for comment on the general
exception at § 164.508(a)(4)(ii)(H) bysuggesting costs that they believed
should be permitted, including but notlimited to costs for: preparing,producing, and transmitting protected
health information; retrieval, labor,
supplies, and copying costs; personnel
and overhead costs; investments andindirect costs; and any costs that are incompliance with State law.
Final Rule
The final rule adopts the HITECH
Act’s prohibition on the sale ofprotected health information but makes
certain changes to the provisions in the
proposed rule to clarify the scope of theprovisions and otherwise addresscertain of commenters’ concerns. First,
we have moved the general prohibitionon the sale of protected healthinformation by a covered entity or
business associate to § 164.502(a)(5)(ii)
and created a definition of ‘‘sale ofprotected health information.’’Numerous commenters requested that
the Privacy Rule include a definition ofsale to better clarify what types oftransactions fall within the scope of theprovisions. Accordingly,§ 164.502(a)(5)(ii)(B)(1) defines ‘‘sale ofprotected health information’’ togenerally mean ‘‘a disclosure ofprotected health information by acovered entity or business associate, if
applicable, where the covered entity or
business associate directly or indirectly
receives remuneration from or on behalfof the recipient of the protected healthinformation in exchange for theprotected health information.’’ Section
164.502(a)(5)(ii)(B)(2) then excludes
from the definition the various
exceptions that were in the proposed
rule (discussed further below).
We do not limit a ‘‘sale’’ to thosetransactions where there is a transfer ofownership of protected healthinformation as some commenterssuggested. The HITECH Act does not

PO 00000

Frm 00042

Fmt 4701

Sfmt 4700

include such a limitation and thePrivacy Rule rights and protections
apply to protected health information
without regard to ownership interests
over the data. Thus, the sale provisions
apply to disclosures in exchange forremuneration including those that are
the result of access, license, or leaseagreements.
In addition, we do not consider saleof protected health information in thisprovision to encompass payments acovered entity may receive in the formof grants, or contracts or otherarrangements to perform programs or
activities, such as a research study,
because any provision of protected
health information to the payer is a
byproduct of the service being provided.
Thus, the payment by a researchsponsor to a covered entity to conduct
a research study is not considered a saleof protected health information even if
research results that may include
protected health information aredisclosed to the sponsor in the course of
the study. Further, the receipt of a grantor funding from a government agency toconduct a program is not a sale ofprotected health information, even if, asa condition of receiving the funding, thecovered entity is required to report
protected health information to theagency for program oversight or otherpurposes. (Certain of these disclosureswould also be exempt from the salerequirements, depending on whether
the requirement to report data wasincluded in regulation or other law.)
Similarly, we clarify that the exchangeof protected health information througha health information exchange (HIE) thatis paid for through fees assessed on HIE
participants is not a sale of protected
health information; rather the
remuneration is for the services
provided by the HIE and not for the data
itself. (Such disclosures may also be
exempt from these provisions under the
exception for disclosures to or by abusiness associate that is being
compensated by a covered entity for its
services.) In contrast, a sale of protected
health information occurs when the
covered entity primarily is being
compensated to supply data it maintains
in its role as a covered entity (orbusiness associate). Thus, suchdisclosures require the individual’s
authorization unless they otherwise fallwithin an exception at§ 164.502(a)(5)(ii)(B)(2). For example, adisclosure of protected healthinformation by a covered entity to athird party researcher that is conducting
the research in exchange forremuneration would fall within theseprovisions, unless the only

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
remuneration received is a reasonable,
cost-based fee to cover the cost to
prepare and transmit the data for such
purposes (see below).
In response to questions bycommenters, we also clarify the scope ofthe term ‘‘remuneration.’’ The statuteuses the term ‘‘remuneration,’’ and not‘‘payment,’’ as it does in the marketingprovisions at section 13406(a). Because
the statute uses different terms, we donot believe that remuneration as applied
to the sale provisions is limited tofinancial payment in the same way it isso limited in the marketing provisions.
Thus, the prohibition on sale ofprotected health information applies tothe receipt of nonfinancial as well as
financial benefits. In response tocommenters who indicated that thestatute’s terms ‘‘direct and indirect’’apply to how the remuneration isreceived rather than the remuneration
itself, we agree and have moved theterms in the definition to further makeclear that the provisions prohibit thereceipt of remuneration not only fromthe third party that receives theprotected health information but also
from another party on behalf of therecipient of the protected healthinformation. However, this does notchange the scope of the term‘‘remuneration.’’ As discussed above,
we interpret the statute to mean that
nonfinancial benefits are included in
the prohibition. Thus, a covered entity
or business associate may not disclose
protected health information in
exchange for in kind benefits, unless thedisclosure falls within one of the
exceptions discussed below. Consider,for example, a covered entity that isoffered computers in exchange fordisclosing protected health information.
The provision of protected healthinformation in exchange for thecomputers would not be considered asale of protected health information if
the computers were solely used for the
purpose of preparing and transmitting
protected health information to theperson collecting it and were returned
when such disclosure was completed.
However, if the covered entity ispermitted to use the computers for otherpurposes or to keep the computers evenafter the disclosures have been made,then the covered entity has received in
kind remuneration in exchange for theprotected health information above
what is needed to make the actual
disclosures.
We retain in the final rule the broad
exception for disclosures for publichealth purposes made pursuant to§§ 164.512(b) and 164.514(e). Based on
the concerns from the public commentthat narrowing the exception could

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

discourage voluntary public healthreporting, we do not limit the exception
to only those disclosures where all thecovered entity receives as remuneration
is a cost-based fee to cover the cost to
prepare and transmit the data.
With respect to the exception forresearch disclosures, the final rule
adopts the language as proposed,
including the cost-based fee limitation
provided for in the HITECH Act. Thus,
disclosures for research purposes are
excepted from the remunerationprohibition to the extent that the only
remuneration received by the covered
entity or business associate is areasonable cost-based fee to cover thecost to prepare and transmit theprotected health information for such
purposes. We do not remove the fee
limitation as requested by somecommenters; the statutory language
included in Section 13405(d)(2)(B) of
the HITECH Act clearly states that any
remuneration received in exchange forresearch disclosures must reflect only
the cost of preparation and transmittalof the data for such purpose.
In response to comments about thetypes of costs that are permitted in thereasonable cost-based fee to prepare andtransmit the data, we clarify that thismay include both direct and indirect
costs, including labor, materials, andsupplies for generating, storing,
retrieving, and transmitting theprotected health information; labor andsupplies to ensure the protected healthinformation is disclosed in apermissible manner; as well as related
capital and overhead costs. However,fees charged to incur a profit from thedisclosure of protected healthinformation are not allowed. We believe
allowing a profit margin would not be
consistent with the language containedin Section 13405 of the HITECH Act. We
intend to work with the researchcommunity to provide guidance andhelp the research community reach acommon understanding of appropriate
cost-based limitations on remuneration.
We retain the exceptions proposed fortreatment and payment disclosures
without modification and agree withcommenters that these exceptions arenecessary to make clear that these core
health care functions may continue.
Similarly, we retain the exception to the
remuneration prohibition fordisclosures for the transfer, merger, or
consolidation of all or part of a covered
entity with another covered entity, or anentity that following such activity will
become a covered entity, and related
due diligence, to ensure that suchdisclosures may continue to occur inaccordance with the Privacy Rule. We
retain the proposed exception for

PO 00000

Frm 00043

Fmt 4701

Sfmt 4700

5607

disclosures that are otherwise requiredby law to ensure a covered entity cancontinue to meet its legal obligations
without imposing an authorization
requirement. We also retain the
exception for disclosures to theindividual to provide the individualwith access to protected healthinformation or an accounting of
disclosures, where the fees charged for
doing so are in accord with the Privacy
Rule.
We adopt the exceptions forremuneration paid by a covered entity
to a business associate for activities
performed on behalf of a covered entity,
as well as the general exception
permitting a covered entity to receive
remuneration in the form of areasonable, cost-based fee to cover thecost to prepare and transmit theprotected health information for any
disclosure otherwise permitted by thePrivacy Rule. However, we make anumber of clarifications to addresscommenters questions and concerns
regarding the ability of a businessassociate rather than a covered entity toreceive the permitted remuneration.
First, we add the term ‘‘businessassociate’’ in the general exception
permitting reasonable, cost-based fees toprepare and transmit data (or fees
permitted by State laws) to make clearthat business associates may continue torecoup fees from third party record
requestors for preparing andtransmitting records on behalf of acovered entity, to the extent such fees
are reasonable, cost-based fees to cover
the cost to prepare and transmit theprotected health information orotherwise expressly permitted by otherlaw. Second, we clarify in the businessassociate exception that the exception
would also cover remuneration by abusiness associate to its subcontractor
for activities performed by thesubcontractor on behalf of the businessassociate. Finally, we add the term‘‘business associate’’ to the generalprohibition on sale of protected healthinformation for consistency, eventhough, without the addition, a businessassociate still would not be permitted tosell protected health information as abusiness associate may generally only
make uses and disclosures of protected
health information in manners in whicha covered entity would be permitted
under the Privacy Rule.
With respect to the types of costs thatwould be permitted as part of areasonable, cost-based fee under thisprovision, we clarify that the final rule
permits the same types of costs under
this exception as the research exception,
as well as costs that are in compliancewith a fee schedule provided by State

E:\FR\FM\25JAR2.SGM

25JAR2

5608

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withlaw or otherwise expressly permitted byother applicable law. Thus, costs may
include the direct and indirect costs to
prepare and transmit the data, including
labor, materials, and supplies, but not a
profit margin. We intend to continue towork with interested stakeholders todevelop more guidance on direct andindirect costs and on remuneration.
Response to Other Public Comments
Comment: Several commenterssuggested that we make clear in the final
rule that redisclosures of information by
a recipient covered entity or businessassociate even for remuneration that are
set forth in the original authorization are
not restricted by this provision. Anothercommenter argued that the original
authorization form should indicate
whether the recipient of the protected
health information will further
exchange the information for
remuneration.
Response: It is expected to be theusual case that if a covered entity or
business associate that receives
protected health information in
exchange for remuneration wishes tofurther disclose that information in
exchange for remuneration, then an
additional authorization in accordancewith § 164.508 must be obtained
because such disclosures will not be
encompassed by the original
authorization. However, it may bepossible that redisclosures of
information for remuneration by arecipient covered entity or businessassociate do not require an additional
authorization, provided it is sufficiently
clear to the individual in the original
authorization that the recipient covered
entity or business associate will further
disclose the individual’s protected
health information in exchange forremuneration. In response to thecommenter that argued that the original
authorization form should indicate
whether the recipient of the protected
health information will further
exchange the information for
remuneration, as explained above webelieve the language included in Section
13405 of the HITECH Act was to alert
the individual as to whether thedisclosures he or she was authorizing at
the time involved remuneration. Where
the recipient of protected healthinformation pursuant to an
authorization is a third party that is nota covered entity or business associate,
we do not have authority to require that
entity to disclose to the disclosing
covered entity or business associate
whether it plans to further exchange theprotected health information for
remuneration for purposes of including
such information on the authorization

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

form. However, covered entities that are
informed of such information may
include it on the authorization form ifthey wish to. In any event, the Privacy
Rule retains the requirement that an
authorization inform the individual of
the potential for information disclosed
pursuant to the authorization to be
subject to redisclosure by the recipient
and to no longer be subject to thePrivacy Rule.
Comment: Several commenters asked
for clarification on the effect the final
rule will have on existing research
efforts and some suggested that HHSshould grandfather in all Privacy Ruleauthorizations for research obtained
under existing law before the effective
date of the final rule. These commentersbelieved addressing current researchwould be necessary to ensure the rulewould not frustrate ongoing research
efforts.
Response: We agree that ongoing
research studies that are based on aprior permission under the Privacy Rulefor the research use or disclosure ofprotected health information should be
grandfathered so as not to disrupt theseongoing studies. We have added areference to the authorization
requirements that apply to the sale ofprotected health information at§ 164.508(a)(4) to make clear that thetransition provisions in § 164.532 apply
to permissions existing prior to theapplicable compliance date of the Rule.
Thus, a covered entity may continue torely on an authorization obtained froman individual prior to the compliance
date even if remuneration is involved
but the authorization does not indicatethat the disclosure is in exchange forremuneration. This would apply toauthorizations for any permissible
purpose under the Rule and not just for
research purposes. Further, in the
research context, where a covered entity
obtained documentation of a waiver ofauthorization from an Institutional
Review Board or Privacy Board prior tothe compliance date for this final rule,the covered entity may continue to relyon that documentation to release
protected health information to a
researcher, even if the covered entity
receives remuneration in the form of
more than a reasonable, cost based fee
to prepare and transmit the data.
Finally, we also provide at new§ 164.532(f) that a covered entity may
continue to use or disclose a limited
data set in accordance with an existingdata use agreement that meets therequirements of § 164.514(e), including
for research purposes, until the data use
agreement is renewed or modified or
until one year from the compliance dateof this final rule, whichever is earlier,

PO 00000

Frm 00044

Fmt 4701

Sfmt 4700

even if such disclosure would otherwise
constitute a sale of protected healthinformation upon the effective date ofthis rule.
Comment: Some commenters wereconcerned that the sale prohibition
would apply to a covered entity’s saleof accounts receivable including
protected health information to acollection agency, arguing that suchdisclosures should remain permissible
without authorization as a payment
disclosure.
Response: Disclosures of protected
health information for payment
collection activities are permitted
without authorization as a payment
disclosure under the Privacy Rule (see§§ 164.501 and 164.506(a)) and thus, areexcepted from the remunerationprohibition at§ 164.502(a)(5)(ii)(B)(2)(iii).
Comment: A few commenters asked
that the final rule clarify that transfersof value among entities under common
control does not implicate theauthorization requirements. Similarly,
some commenters sought clarification
on whether business transfers on thebooks for internal reorganization would
also be excluded under the transfer,merger, and consolidation exception to
the final rule.
Response: First, we clarify that uses ofprotected health information within acovered entity that is a single legal
entity are not implicated by the
remuneration prohibition as theprohibition applies only to disclosuresoutside of a covered entity. Second, theuse of protected health information
among legally separate covered entities
under common ownership or control
that have designated themselves as anaffiliated covered entity (i.e., a single
covered entity for purposes ofcompliance with the HIPAA Rules) is
not implicated. See the requirements foraffiliated covered entities at§ 164.105(b). Thus, to the extent thatwhat the commenters contemplate is anotherwise permissible use of protected
health information within a single legal
entity that is a covered entity or anaffiliated covered entity, such use ofdata is not impacted by theseprovisions. Third, disclosures ofprotected health information for thesale, transfer, merger, or consolidationof all or part of a covered entity withanother covered entity, or with an entitythat following such activity will becomea covered entity and due diligence
related to such activity are exceptedfrom the definition of sale of protected
health information at§ 164.502(a)(5)(ii)(B)(2)(iv).
Comment: Some commenters
expressed concern over the role the

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Institutional Review Board will play indetermining reasonable costs, andseveral commenters asked that the final
rule clarify that the Institutional Review
Board is not responsible for making adetermination regarding thepermissibility of the fees paid in
exchange for a disclosure of protected
health information for research
purposes.
Response: We clarify that a covered
entity, or business associate if
applicable, is responsible fordetermining whether any fees paid tothe entity in exchange for protected
health information covers the covered
entity’s or business associate’s costs to
prepare and transmit protected healthinformation for research.
Comment: A few commenters soughtclarification on how to differentiate
access to protected health informationfrom access to statistical data,
particularly when remuneration isprovided for access to a database but the
party is solely interested in a population
study, not an individual’s protected
health information.
Response: Disclosures of healthinformation that has been de-identified
in accordance with the Privacy Rule at§ 164.514(b)–(d) are not subject to the
remuneration prohibition as suchinformation is not protected healthinformation under the Rule. However, acovered entity that allows a third party
access to a database containing
protected health information in
exchange for remuneration is subject tothese provisions unless an exception
applies (e.g., the remuneration received
is limited to a reasonable, cost-based fee
to prepare and make available the data).
Comment: A number of commentersargued that limited data sets should be
exempted entirely from the
remuneration prohibition because they
are not fully identifiable data sets andare subject to protections under data use
agreements.
Response: We decline to completely
exempt limited data sets from theseprovisions as, unlike de-identified data,
they are still protected healthinformation. However, disclosures oflimited data sets for purposes permitted
under the Rule would be exempt fromthe authorization requirements to theextent the only remuneration received
in exchange for the data is a reasonable,
cost-based fee to prepare and transmit
the data or a fee otherwise expressly
permitted by other law. We also provide
at new § 164.532(f) that a covered entity
may continue to use or disclose alimited data set in accordance with anexisting data use agreement that meetsthe requirements of § 164.514(e),including for research purposes, until

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

the data use agreement is renewed or
modified or until one year from thecompliance date of this final rule,
whichever is earlier, even if suchdisclosure would otherwise constitute asale of protected health information
upon the effective date of this rule.
b. Researchi. Compound Authorizations
Proposed Rule
Section 164.508(b)(4) of the Privacy
Rule prohibits covered entities fromconditioning treatment, payment,
enrollment in a health plan, or
eligibility for benefits on the provisionof an authorization. This limitation isintended to ensure that authorizationfrom an individual for a use or
disclosure of protected healthinformation is voluntarily provided.
However, there are exceptions to thisgeneral rule for certain circumstances,including in the research context, wherea covered entity may condition theprovision of research-related treatment,such as in a clinical trial, on obtaining
the individual’s authorization for theuse or disclosure of protected healthinformation for such research.
Permitting the use of protected healthinformation is part of the decision toreceive care through a clinical trial, andhealth care providers conducting suchtrials are able to condition researchrelated treatment on the individual’s
willingness to authorize the use or
disclosure of protected healthinformation for research associated withthe trial.
Section 164.508(b)(3) generally
prohibits what are termed ‘‘compound
authorizations,’’ i.e., where an
authorization for the use and disclosureof protected health information is
combined with any other legal
permission. However, § 164.508(b)(3)(i)carves out an exception to this generalprohibition, permitting the combining of
an authorization for a research study
with any other written permission forthe same study, including anotherauthorization or informed consent toparticipate in the research. Nonetheless,§ 164.508(b)(3)(iii) prohibits combining
an authorization that conditions
treatment, payment, enrollment in ahealth plan, or eligibility for benefits(conditioned authorization) with anauthorization for another purpose forwhich treatment, payment, enrollment,
or eligibility may not be conditioned(unconditioned authorization). This
limitation on certain compound
authorizations was intended to help
ensure that individuals understand thatthey may decline the activity describedin the unconditioned authorization yet

PO 00000

Frm 00045

Fmt 4701

Sfmt 4700

5609

still receive treatment or other benefits
or services by agreeing to theconditioned authorization.
The impact of these authorization
requirements and limitations can beseen during clinical trials that areassociated with a corollary research
activity, such as when protected healthinformation is used or disclosed tocreate or to contribute to a central
research database or repository. For
example, § 164.508(b)(3)(iii) prohibits
covered entities from obtaining a single
authorization for the use or disclosure ofprotected health information for a
research study that includes both
treatment as part of a clinical trial andtissue banking of specimens (andassociated protected health information)collected, since the individual generally
must sign the authorization for the useof his or her protected healthinformation in the clinical trial in orderto receive the research-related treatment(conditioned authorization) but whether
the individual also signs the tissuebanking authorization is completely
voluntary and will not affect theindividual receiving the research-related
treatment (unconditioned
authorization). Thus, covered entities
must obtain separate authorizations
from research participants for a clinical
trial that also collects specimens withassociated protected health information
for a central repository.
As stated in the NPRM, various
groups, including researchers andprofessional organizations, haveexpressed concern at this lack ofintegration. A number of persons in the
research community have stated that
requiring separate forms for thesecorollary research activities isinconsistent with current practice under
the Common Rule (45 CFR Part 46) withrespect to obtaining informed consent
and creates unnecessary documentation
burdens. Persons have also indicatedthat the multiple authorization forms
are potentially confusing to researchsubjects and/or may dissuade themaltogether from participating in aclinical trial, and that redundant
information on the forms diverts an
individual’s attention from othercontent that describes how and why the
personal health information may be
used. In light of these concerns, theSecretary’s Advisory Committee on
Human Research Protections in 2004
(Recommendation V, in a letter to theSecretary of HHS, available at http://
www.hhs.gov/ohrp/sachrp/
hipaalettertosecy090104.html), as wellas the Institute of Medicine in its 2009
Report, ‘‘Beyond the HIPAA Privacy
Rule: Enhancing Privacy, Improving
Health Through Research’’

E:\FR\FM\25JAR2.SGM

25JAR2

5610

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with

(Recommendation II.B.2), made specificrecommendations to allow combined
authorizations for clinical trials andbiospecimen storage.
To address these concerns andstreamline the process in the Privacy
Rule for obtaining an individual’s
authorization for research, we proposed
to amend § 164.508(b)(3)(i) and (iii) toallow a covered entity to combine
conditioned and unconditioned
authorizations for research, provided
that the authorization clearly
differentiates between the conditioned
and unconditioned researchcomponents and clearly allows theindividual the option to opt in to theunconditioned research activities. These
provisions would allow covered entities
to combine authorizations for the use
and disclosure of protected healthinformation for clinical trials andrelated biospecimen banking activities,
as well as other scenarios that often
occur in research studies.
While we did not propose to alter thecore elements or required statements
integral to a valid authorization, we
stated that covered entities would havesome flexibility with respect to how
they met the authorization
requirements. For example, covered
entities could facilitate an individual’s
understanding of a compound
authorization by describing theunconditioned research activity on a
separate page of a compound
authorization and could also crossreference relevant sections of acompound authorization to minimize
the potential for redundant language. In
addition, a covered entity could use aseparate check-box for theunconditioned research activity tosignify whether an individual has
opted-in to the unconditioned research
activity, while maintaining one
signature line for the authorization, or
alternatively provide a distinct signatureline for the unconditioned authorization
to signal that the individual isauthorizing optional research that will
not affect research-related treatment. We
requested comment on additional
methods that would clearly differentiate
to the individual the conditioned andunconditioned research activities on thecompound authorization.
Overview of Public Comments
Almost all commenters on this topic
strongly supported the proposal to allow
combined authorizations forconditioned and unconditioned
research activities. Many commenters
supported allowing flexibility forinstitutions to determine how best todifferentiate the unconditioned
authorization for the voluntary research

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

activity, including whether to use acheck box with a single signature line,
or separate signature lines. Several
commenters suggested that an opt out
method should be permitted as analternative to an opt in approach.
A few commenters opposed the
proposal to allow compound
authorizations for conditioned andunconditioned research activities. These
commenters generally felt that separate
authorizations are appropriate and that
there is not sufficient evidence tosuggest that combining the forms will bebeneficial to individuals.
The Secretary’s Advisory Committeeon Human Research Protections, in its
letter of comment on the Department’s
NPRM, indicated its support for the
proposal to permit compound
authorizations for conditioned andunconditioned research activities, andexpressed particular appreciation for thegoal of harmonization with the Common
Rule. The Secretary’s Advisory
Committee on Human ResearchProtections also supported flexibility inthe manner that the conditioned andunconditioned research activities aredifferentiated. The Secretary’s Advisory
Committee on Human ResearchProtections requested clarification thatthe compound authorizations permitted
under this proposal would bepermissible for any type of combined
research studies, and not exclusively forclinical trials with a biospecimenbanking component.
Final Rule
The final rule adopts the proposal toamend § 164.508(b)(3)(i) and (iii) toallow a covered entity to combine
conditioned and unconditioned
authorizations for research, provided
that the authorization clearly
differentiates between the conditioned
and unconditioned researchcomponents and clearly allows theindividual the option to opt in to theunconditioned research activities. We
intend this provision to allow for theuse of compound authorizations for any
type of research activities, and notsolely to clinical trials and biospecimenbanking, except to the extent the
research involves the use or disclosureof psychotherapy notes. For researchthat involves the use or disclosure of
psychotherapy notes, an authorization
for a use or disclosure of psychotherapy
notes may only be combined withanother authorization for a use or
disclosure of psychotherapy notes. See§ 164.508(b)(3)(ii). Thus, aside from theuse of psychotherapy notes, combined
authorizations could be obtained for theuse of protected health information in aclinical trial and optional sub-studies,

PO 00000

Frm 00046

Fmt 4701

Sfmt 4700

as well as for biospecimen banking that
also permits future secondary use of thedata (to the extent the future use
authorization is aligned with thediscussion in the following section
regarding authorizations for future
research). Also, this provision continues
to allow for a covered entity to combine
such authorizations with informed
consent documents for the researchstudies.
The final rule provides covered
entities, institutions, and Institutional
Review Boards with flexibility todetermine the best approach for clearly
differentiating the conditioned andunconditioned research activities andgiving research participants the option
to opt in to the unconditioned research
activities. We decline to permit a
combined authorization that only allows
the individual the option to opt out of
the unconditioned research activities(e.g., ‘‘check here if you do NOT wantyour data provided to the biospecimen
bank’’) because an opt out option does
not provide individuals with a clear
ability to authorize the optional research
activity, and may be viewed as coercive
by individuals. The final rule does notremove the requirement that anindividual affirmatively authorize theunconditioned research activities; itmerely provides flexibility to streamline
the authorization process by combining
the forms.
With respect to the commenters that
believed there is insufficient evidence
that combining conditioned andunconditioned research activities into acompound authorization would be
beneficial, and that such compound
authorizations may be confusing forpatients, as indicated above, there havebeen anecdotal reports to the
Department that the use of multiple
authorization forms has caused
confusion among research subjects.
Further, we note that thesemodifications do not remove therequired elements of an authorizationthat are necessary to inform theindividual about the study (e.g.,
description of the information to be
used or disclosed, description of the
purpose, etc.); they merely introduce
flexibility to avoid redundant languagethat would otherwise be necessary toinclude in the authorizations for themultiple research activities. In addition,these changes are intended to align the
HIPAA Privacy Rule’s authorization
requirements with what has beencommon and ongoing practice in termsof the informed consent form under the
Common Rule.
We note that covered entities are
permitted but not required by themodifications adopted at

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with§ 164.508(b)(3)(i) and (iii) to createcompound authorizations forconditioned and unconditioned
research activities. Previously approved,
ongoing studies may continue to rely on
the separate authorization forms thatwere obtained under the priorprovisions. For new studies, covered
entities and researchers may continue to
use separate authorizations forconditioned and unconditioned
research activities, or may transition tocompound authorizations as they deem
appropriate, which can be used
beginning on the effective date of thisrule.
Response to Other Public Comments
Comment: The Secretary’s Advisory
Committee on Human ResearchProtections asked whether the following
approaches for distinguishing between
conditioned and unconditioned
research activities would be acceptable:
Using (1) a combined consent/
authorization form for a clinical trial
and optional banking component, witha check-box for the individual to havethe choice to opt in to the optionalbanking component, and one signature;(2) a combined consent/authorization
form for a clinical trial and optionalbanking component, with one signature
for the clinical trial and anothersignature to indicate the individual
agrees to the optional banking
component; and (3) a combined
consent/authorization form for a clinical
trial and optional banking component,with a check box for the individual tohave the choice to opt in to the banking
component, and one signature, but withdetailed information about the banking
component presented in a separate
brochure or information sheet that isreferenced directly in the consent/
authorization form.
Response: Covered entities andresearchers have flexibility in themethods used to distinguish theconditioned and unconditioned
research activities and to provide theindividual with a clear opportunity to
opt in to the unconditioned portion, andall of the above approaches would be
acceptable provided, with respect to thethird approach, that the brochure or
information sheet is incorporated byreference into the authorization/consent
form such that it is considered to be partof the form (even if not physicallyattached to the form). In addition, if thebrochure or information sheet includes
required elements of the authorization(or informed consent), andauthorization/consent has not beenaltered by an Institutional Review
Board, then the brochure or information
sheet must be made available to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

potential research participants before
they are asked to sign the authorization/consent document (unless theauthorization form itself includes therequired elements). Finally, in suchcases, a covered entity must keep not
only the signed authorization/consent
form, but also a copy of the brochure or
information sheet, in order to be incompliance with the documentation
requirements at § 164.530(j).
Comment: The Secretary’s Advisory
Committee on Human ResearchProtections requested confirmation thatthe compound authorization proposal
would not affect the waiver provisions
currently existing in the Privacy Rule,
such that such provisions could be
used, if appropriate, for new studies
distinct from both the original study andthe banking activity.
Response: The new compound
authorization provision does not affectthe waiver of authorization provisions
in the Privacy Rule. A covered entity
may continue to use or disclose
protected health information forresearch purposes based on
documentation that meets therequirements at § 164.512(i), indicatingthat an Institutional Review Board orPrivacy Board has waived the obtainingof individual authorization for such
purposes, based on a determination that(1) the use or disclosure of protected
health information involves no morethan a minimal risk to the privacy of
individuals; (2) the research could notpracticably be conducted without thewaiver; and (3) the research could notpracticably be conducted without accessto and use of the protected healthinformation.
Comment: The Secretary’s Advisory
Committee on Human ResearchProtections requested clarification on
the effect of revoking only one part ofa compound authorization. For
example, if an individual signs a
combined authorization for conditioned
and unconditioned research activities
and later specifically revokes only theunconditioned research activity (e.g.,
the banking component), then the
covered entity may continue to act inreliance on the authorization for theconditioned component (e.g., theclinical trial).
Response: Where it is clear that anindividual is revoking only one part ofa compound authorization, such
revocation does not equate to a
revocation of the entire authorization to
include the other studies. However,where it is not clear exactly to which
research activities the individual’s
revocation applies, written clarificationmust be obtained from the individual inorder for the revocation to apply only to

PO 00000

Frm 00047

Fmt 4701

Sfmt 4700

5611

certain of the research activities
identified in the authorization, or theentire authorization must be treated as
revoked. Further, such revocations must
be maintained and documented in amanner that will ensure uses anddisclosures of protected healthinformation for the activity to which therevocation applies discontinue, except
to the extent the covered entity has
already acted in reliance on theauthorization, which would permit
certain limited, continued use anddisclosure, such as necessary tomaintain the integrity of the researchstudy.
ii. Authorizing Future Research Use or
Disclosure
Prior Interpretation
Research often involves obtaining
health information and biological
specimens to create a research databaseor repository for future research. For
example, this frequently occurs whereclinical trials are paired with corollary
research activities, such as the creationof a research database or repository
where information and specimens
obtained from a research participant
during the trial are transferred andmaintained for future research. It is ourunderstanding that Institutional Review
Boards in some cases may approve an
informed consent document for aclinical trial that also asks research
participants to permit future research on
their identifiable information or
specimens obtained during the course of
the trial. It is also our understandingthat an Institutional Review Board may
in some cases review an informed
consent for a prior clinical trial todetermine whether a subsequent
research use is encompassed within theoriginal consent.
The Department has previouslyinterpreted the Privacy Rule, however,to require that authorizations forresearch be study specific for purposesof complying with the Rule’s
requirement at § 164.508(c)(1)(iv) that
an authorization must include a
description of each purpose of therequested use or disclosure. See 67 FR
53182, 53226, Aug. 14, 2002. In part, theDepartment’s interpretation was basedon a concern that patients could lacknecessary information in theauthorization to make an informed
decision about the future research. In
addition, it was recognized that not alluses and disclosures of protected healthinformation for a future research
purpose would require a covered entity
to re-contact the individual to obtain
another authorization (e.g., uses ordisclosures with a waiver of

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5612

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

authorization from an Institutional
Review Board or Privacy Board asprovided under § 164.512(i) or of alimited data set pursuant to a data use
agreement under § 164.514(e) for the
future research purpose).
Subsequent to issuing thisinterpretation, the Department heard
concerns from covered entities andresearchers that the Department’s
interpretation encumbers secondary
research, and limits an individual’sability to agree to the use or disclosureof their protected health information for
future research. In addition, many
commenters noted that the Department’s
interpretation limiting the scope of a
HIPAA authorization for researchappeared to diverge from the current
practice under the Common Rule withrespect to the ability of a researcher toseek subjects’ informed consent tofuture research so long as the future
research uses are described in sufficientdetail to allow an informed consent.
These commenters, as well as the
Secretary’s Advisory Committee on
Human Research Protections in 2004
(Recommendation IV, in a letter to theSecretary of HHS, available at http://
www.hhs.gov/ohrp/sachrp/
hipaalettertosecy090104.html) and theInstitute of Medicine in its 2009 Report
entitled ‘‘Beyond the HIPAA Privacy
Rule: Enhancing Privacy, Improving
Health Through Research’’(Recommendation II.B.1), had urged theDepartment to allow the HIPAA
authorization to permit future research
use and disclosure of protected healthinformation.
Given these concerns, the Department
explained in the NPRM that it wasconsidering a number of options
regarding authorizations for future
research, including whether the Privacy
Rule should: permit an authorization foruses and disclosures of protected healthinformation for future research purposes
to the extent such purposes areadequately described in theauthorization such that it would bereasonable for the individual to expectthat his or her protected healthinformation could be used or disclosed
for such future research; or permit anauthorization for future research but
require certain specific elements orstatements with respect to the future
research, particularly where the future
research may encompass certain typesof sensitive research activities, such as
research involving genetic analyses ormental health research, that may alter
an individual’s willingness toparticipate in the research. We
requested comment on these options
and on how a revocation would operate

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

with respect to future downstream
research studies.
Overview of Public Comments
Almost all commenters on this topic
supported the proposal to allow
authorizations for future research. Many
commenters indicated this flexibility to
be important, particularly considering
evolving technologies and discoveries.
About half of these commentersspecifically advocated for providing
investigators and Institutional Review
Boards with the maximum flexibility todetermine the appropriateness of thedescriptions for future research and feltthat this would best align with theCommon Rule. These commenters werethus against requiring specificstatements in the Privacy Rule about the
future research, including for sensitive
research. Other commenters were infavor of requiring the additional
statements about sensitive categories ofresearch, stating that this would better
inform individuals and give themgreater choice in determining their
willingness to participate in certain
types of future research. A couple ofthese commenters recommended
working with National Committee on
Vital and Health Statistics on the
categories of sensitive research, however
no further examples of specific types ofresearch were given beyond theexamples provided in the proposed rule(genetic analyses or mental healthresearch). Several commentersspecifically advised against requiring
specific statements for sensitive
research, citing concerns of variability
in what is considered sensitive
information and practicality challenges
due to the changing nature of theconcept over time.
A few commenters opposed the
proposal to allow authorizations for
future research altogether. Some of thesecommenters felt strongly that studyspecific authorizations are critical toprotect patients, and are the only way
that individuals can make a truly
informed decision. These commenterssuggested that outreach to patients andpotential research participants to solicit
feedback, as well as a study on thepotential burdens that enhanced
authorizations may have on
stakeholders, were necessary before anychanges were made.
In its comment letter on the NPRM,
the Secretary’s Advisory Committee on
Human Research Protections supported
the proposal to harmonize HIPAA
authorizations with the Common Ruleinformed consent requirements, andalso requested consultation with the
FDA to ensure that authorizations for
future research align not only with the

PO 00000

Frm 00048

Fmt 4701

Sfmt 4700

Common Rule standards but also FDA
standards for informed consent. They
indicated that the authorization should
be reasonably specific such that
individuals are aware of the types ofresearch that may be conducted.
However, the Secretary’s Advisory
Committee on Human ResearchProtections emphasized the need forflexibility to rely on Institutional
Review Board judgment andrecommended against requiring
prescribed statements about certain
types of ‘‘sensitive’’ research, sincethese concepts change over time andrequiring prescribed authorization
statements may conflict with
Institutional Review Boards’ judgments
about how to appropriately describe theresearch in the informed consent.
Modified Interpretation
We modify the prior Departmental
interpretation that researchauthorizations must be study specific.
This modification does not make anychanges to the authorization
requirements at § 164.508. A HIPAA
authorization for future research muststill address each of the core elements
and statements required at § 164.508(c).
However, the Department no longer
interprets the ‘‘purpose’’ provision at§ 164.508(c)(1)(iv) as requiring that an
authorization for the use or disclosure ofprotected health information forresearch purposes be study specific. In
order to satisfy the requirement that an
authorization include a description ofeach purpose of the requested use or
disclosure, an authorization for uses anddisclosures of protected healthinformation for future research purposesmust adequately describe such purposessuch that it would be reasonable for theindividual to expect that his or her
protected health information could be
used or disclosed for such future
research. This could include specificstatements with respect to sensitive
research to the extent such research iscontemplated. However, we do notprescribe specific statements in theRule. We agree that it is difficult todefine what is sensitive and that thisconcept changes over time. We also
agree with commenters that thisapproach best harmonizes with practiceunder the Common Rule regarding
informed consent for future research,
and allows covered entities, researchers
and Institutional Review Boards to haveflexibility in determining what
adequately describes a future research
purpose depending on thecircumstances. We have consulted with
Office for Human Research Protections(OHRP) and the FDA on this approachto ensure consistency and

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withharmonization with the HHS and FDA
human subjects protections regulations,where appropriate.
With respect to commenters thatstated it is impossible for individuals tobe truly informed about future research,
we note that we are aligning withexisting practice under the Common
Rule in regard to informed consent andstill require that all required elements ofauthorization be included in an
authorization for future research, even if
they are to be described in a moregeneral manner than is done for specificstudies.
Pursuant to this modified
interpretation, covered entities thatwish to obtain individual authorization
for the use or disclosure of protected
health information for future research
may do so at any time after the effective
date of this final rule. Alternatively,
covered entities may continue to use
only study-specific authorizations forresearch if they choose.
Response to Other Public Comments
Comment: The Secretary’s Advisory
Committee on Human ResearchProtections requested flexibility
regarding the description in theauthorization of the information to be
used or disclosed for future research aswell as to whom the covered entity may
make the requested use or disclosure as
there may be some uncertainty of theidentity of future researchers. The
Secretary’s Advisory Committee on
Human Research Protections alsosuggested that the description of
information to be collected be allowed
to reference information beyond thetime of the original study, for example‘‘your future medical records [atHospital]’’ or ‘‘your future medical
records [relating to diseases/
conditions].’’Response: Covered entities andresearchers have flexibility to describe
the information to be used or disclosed
for the future research, so long as it isreasonable from such description tobelieve that the individual would expect
the information to be used or disclosed
for the future research. We also clarify
that a description of the protected
health information to be used for the
future research may include informationcollected beyond the time of the original
study. Further, the Privacy Ruleauthorization requirements allow a‘‘class of persons’’ to be described for
purposes of identifying in theauthorization the recipients of theprotected health information. Thus,
covered entities and researchers haveflexibility in the manner in which theydescribe the recipients of the protected
health information for the future

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

research, so long as it is reasonable fromsuch description to believe that theindividual would expect his or her
protected health information to beshared with such persons for the future
research.
Comment: The Secretary’s Advisory
Committee on Human ResearchProtections requested that the
Department allow for grandfathering ofexisting, ongoing studies that involve
the possibility of future/secondary
research, if an Institutional Review
Board-approved consent reasonably
informed the individuals of the future
research. In these situations, researchers
would have needed to obtain a studyspecific authorization or waiver ofauthorization before commencing thefuture/secondary research that wasencompassed in the original informed
consent.
Response: Covered entities andresearchers may rely on an Institutional
Review Board-approved consent
obtained prior to the effective date ofthis final rule that reasonably informed
individuals of the future research,
provided the informed consent was
combined with a HIPAA authorization(even though the authorization itself
was specific to the original study or
creation and maintenance of arepository).
Comment: One commenter advocatedfor the use of time-limited
authorizations for future research.
Response: This modification in
Departmental interpretation does notchange the requirement at§ 164.508(c)(1)(v), which states that an
authorization must contain an
expiration date or an expiration eventthat relates to the individual or the
purpose of the use or disclosure. This
statement may be a specific time limit,
or be ‘‘end of the research study,’’‘‘none,’’ or similar language for a
research study.
Comment: Several commenterssuggested that revocation of
authorizations should continue to bepermitted in the same manner that it iscurrently allowed under the Privacy
Rule. The Secretary’s Advisory
Committee on Human ResearchProtections recommended thatrevocations of authorization for future
research be permitted orally, rather thanin writing, as is currently required for
all authorizations under §§ 164.508(b)(5)and (c)(2)(i) of the Rule.
Response: Covered entities may
continue to rely on existing guidance
regarding how revocations ofauthorizations operate in the researchcontext. Such guidance is published inseveral materials available at http://
www.hhs.gov/ocr/privacy/hipaa/

PO 00000

Frm 00049

Fmt 4701

Sfmt 4700

5613

understanding/special/research/index.html (see, e.g., the fact sheet
entitled, ‘‘Health Services Research andthe HIPAA Privacy Rule’’). The
Department may issue additional
guidance in the future with respect torevocation policies in the context ofauthorizations that specify, and underwhich protected health information has
been disclosed for, future research uses.
In response to the Secretary’s
Advisory Committee on Human
Research Protections recommendation,
we also clarify that while the Privacy
Rule requires that a revocation of
authorization from an individual be inwriting, uses and disclosures pursuant
to an authorization are permissive andnot required, and thus, a covered entity
may cease using or disclosing protected
health information pursuant to an
authorization based on an individual’s
oral request if it chooses to do so.
5. Protected Health Information About
Decedents
a. Section 164.502(f)—Period ofProtection for Decedent Information
Proposed Rule
Section 164.502(f) requires covered
entities to protect the privacy of a
decedent’s protected health information
generally in the same manner and to thesame extent that is required for theprotected health information of living
individuals. Thus, if an authorization isrequired for a particular use or
disclosure of protected healthinformation, a covered entity may use or
disclose a decedent’s protected healthinformation in that situation only if thecovered entity obtains an authorizationfrom the decedent’s personal
representative. The personal
representative for a decedent is theexecutor, administrator, or other person
who has authority under applicable law
to act on behalf of the decedent or the
decedent’s estate. The Department heard
a number of concerns since thepublication of the Privacy Rule that it
can be difficult to locate a personal
representative to authorize the use or
disclosure of the decedent’s protected
health information, particularly after an
estate is closed. Furthermore, archivists,
biographers, and historians had
expressed frustration regarding the lackof access to ancient or old records ofhistorical value held by covered entities,
even when there are likely few
surviving individuals concerned withthe privacy of such information.
Archives and libraries may holdmedical records, as well as
correspondence files, physician diaries
and casebooks, and photographcollections containing fragments of

E:\FR\FM\25JAR2.SGM

25JAR2

5614

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withidentifiable health information, that are
centuries old. Currently, to the extent
such information is maintained by acovered entity, it is subject to thePrivacy Rule.
Accordingly, we proposed to amend§ 164.502(f) to require a covered entity
to comply with the requirements of thePrivacy Rule with regard to theprotected health information of a
deceased individual for a period of 50
years following the date of death. We
also proposed to modify the definitionof ‘‘protected health information’’ at§ 160.103 to make clear that theindividually identifiable healthinformation of a person who has been
deceased for more than 50 years is notprotected health information under thePrivacy Rule. We proposed 50 years tobalance the privacy interests of living
relatives or other affected individuals
with a relationship to the decedent,with the difficulty of obtaining
authorizations from personal
representatives as time passes. A 50year period of protection had also beensuggested at a National Committee for
Vital and Health Statistics (the public
advisory committee which advises the
Secretary on the implementation of the
Administrative Simplification
provisions of HIPAA, among otherissues) meeting, at which committee
members heard testimony fromarchivists regarding the problems
associated with applying the Privacy
Rule to very old records. See http://
ncvhs.hhs.gov/050111mn.htm. We
requested public comment on theappropriateness of this time period.
Overview of Public Comments
The majority of public comment on
this proposal was in favor of limiting
the period of protection for decedent
health information to 50 years past thedate of death. Some of thesecommenters specifically cited thepotential benefits to research. A few
commenters stated that the 50-year
period was too long and should beshortened to, for example, 25 years.
Some supporters of limiting privacy
protection for decedent information
indicated that the date of death is often
difficult to determine, and thus
suggested an alternative time period(e.g., 75, 100, 120, 125 years) startingfrom the last date in the medical record,
if the date of death is unknown.
Some commenters were opposed tolimiting the period of protection fordecedent health information due to thecontinued privacy interests of living
relatives as well as the decedent,
particularly when highly sensitive
information is involved, including HIV/AIDS status, or psychiatric or substance

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

abuse treatment. A couple ofcommenters recommended that there
should be no time limit on theprotection of psychotherapy notes. One
commenter expressed concern that thismodification may encourage covered
entities to retain records that theywould not have otherwise in order toprofit from the data after the 50-year
period. One commenter suggested thatthe period of protection should be
extended to 100 years, if protections areto be limited at all. A few commenterswere opposed to the 50-year period ofprotection because they interpreted thisprovision to be a proposed record
retention requirement.
Final Rule
After considering the publiccomments, the final rule adopts the
proposal. We believe 50 years is anappropriate period of protection fordecedent health information, taking into
account the remaining privacy interestsof living individuals after the span ofapproximately two generations havepassed, and the difficulty of obtaining
authorizations from a personal
representative of a decedent as the sameamount of time passes. For the same
reason, we decline to shorten the periodof protection as suggested by somecommenters or to adopt a 100-year
period of protection for decedent
information. We also believe the 50-year
period of protection to be long enoughso as not to provide an incentive forcovered entities to change their record
retention policies in order to profit fromthe data about a decedent once 50 years
has elapsed.
With respect to commenters’ concerns
regarding protected health information
about decedents that is sensitive, suchas HIV/AIDS, substance abuse, or
mental health information, or thatinvolves psychotherapy notes, weemphasize that the 50-year period ofprotection for decedent healthinformation under the Privacy Rule does
not override or interfere with State orother laws that provide greater
protection for such information, or the
professional responsibilities of mental
health or other providers. Covered
entities may continue to provide privacy
protections to decedent information
beyond the 50-year period, and may berequired to do so under other applicablelaws or as part of their professional
responsibility. Alternatively, covered
entities may choose to destroy decedent
information although other applicablelaw may prescribe or limit such
destruction.
We also decline to limit protections
under the Privacy Rule to a certain
period beyond the last date in the

PO 00000

Frm 00050

Fmt 4701

Sfmt 4700

medical record. While we appreciate thechallenges that may be present indetermining the date of death of anindividual in cases in which it is not
sufficiently clear from the age of therecord whether the individual isdeceased, we believe that thisdetermination is necessary in closer
cases to protect the individual, as wellas living relatives and others, who may
be affected by disclosure of theinformation. Further, as we stated in the
NPRM, this modification has no impact
on a covered entity’s disclosurespermitted under other provisions of thePrivacy Rule. For example, a covered
entity is permitted to disclose protected
health information of decedents forresearch that is solely on theinformation of decedents in accordancewith § 164.512(i)(1)(iii), without regard
to how long the individual has been
deceased.
Finally, we clarify that the 50-year
period of protection is not a record
retention requirement. The HIPAA
Privacy Rule does not include medical
record retention requirements andcovered entities may destroy suchrecords at the time permitted by State orother applicable law. (We note thatcovered entities are subject to theaccounting requirements at § 164.528
and, thus, would need to retain orrecord certain information regarding
their disclosures of protected healthinformation.) However, if a covered
entity does maintain decedent healthinformation for longer than 50 years
following the date of death of theindividual, this information will nolonger be subject to the Privacy Rule.
b. Section 164.510(b)—Disclosures
About a Decedent to Family Members
and Others Involved in Care
Proposed Rule
Section 164.510(b) describes how acovered entity may use or disclose
protected health information to persons,such as family members or others, who
are involved in an individual’s care or
payment related to the individual’s
health care. The Department hadreceived a number of questions about
the scope of the section, specificallywith regard to disclosing protected
health information when the individual
who is the subject of the information
was deceased. We had additionally
heard concerns that family members,
relatives, and others, many of whom
may have had access to the healthinformation of the deceased individual
prior to death, have had difficulty
obtaining access to such information
after the death of the individual,
because many do not qualify as a

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with‘‘personal representative’’ of the
decedent under the Privacy Rule at§ 164.502(g)(4).
As such, we proposed to amend§ 164.510(b) to add a new paragraph (5),which would permit covered entities todisclose a decedent’s information tofamily members and others who wereinvolved in the care or payment for careof the decedent prior to death, unlessdoing so is inconsistent with any prior
expressed preference of the individualthat is known to the covered entity. Weemphasized that these modifications
would not change the authority of a
decedent’s personal representative withregard to the decedent’s protected
health information. Thus, a personal
representative would continue to have aright to access the decedent’s protected
health information relevant to such
personal representation, and haveauthority to authorize uses anddisclosures of the decedent’s protected
health information that are nototherwise permitted or required by thePrivacy Rule. We requested comment on
any unintended consequences that this
proposed disclosure provision mightcause.
Overview of Public Comments
Most commenters supported the
proposal to permit disclosures to family
members and others involved in thecare or payment for care of the decedent
prior to death, unless doing so isinconsistent with any prior expressed
preference of the individual that is
known to the covered entity. These
commenters felt that such permissive
disclosures would help facilitate
important and appropriate
communications with family members
and others who had been involved in
the individual’s care or payment for
health care prior to the individual’s
death but who may not rise to the levelof personal representative. Some
commenters stated that the provision
recognizes the legitimate interest thatfamily members may have in a
decedent’s health information as it
affects their own health care.
A few commenters opposed the
proposal to expressly permit
communications with family members
and other persons who had been
involved with the individual’s care or
payment for care prior to death. Twocommenters felt it would be a large
burden on covered entities to determine
the legitimacy of a requestor as a family
member or individual involved in thecare or payment for care. One
commenter questioned the need forfamily members to have access to
decedent health information and thelikelihood of anyone other than the

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

personal representative to have been
meaningfully involved in the care or
payment for care of the decedent.
Final Rule
The final rule adopts the proposal toamend § 164.510(b) to permit covered
entities to disclose a decedent’s
protected health information to family
members and others who were involvedin the care or payment for care of the
decedent prior to death, unless doing so
is inconsistent with any prior expressed
preference of the individual that is
known to the covered entity.
In response to commenters who
opposed this provision, we believe theprovision strikes the appropriatebalance in allowing communications
with family members and other persons
who were involved in the individual’scare or payment for care prior to death,unless doing so is inconsistent with theprior expressed wishes of theindividual. This will ensure family
members and others can find out about
the circumstances surrounding thedeath of their loved ones, unless theindividual prior to his or her deathobjected to the covered entity making
such communications. Further, thePrivacy Rule limits such disclosures,
similar to the other disclosurespermitted under § 164.510(b), to theprotected health information relevant to
the family member or other person’s
involvement in the individual’s healthcare or payment for health care. For
example, a covered health care provider
could describe the circumstances that
led to an individual’s passing with the
decedent’s sister who is asking about
her sibling’s death. In addition, acovered health care provider could
disclose billing information to a family
member of a decedent who is assistingwith wrapping up the decedent’s estate.
However, in both of these cases, theprovider generally should not share
information about past, unrelated
medical problems. Finally, these
disclosures are permitted and not
required, and thus, a covered entity thatquestions the relationship of the person
to the decedent or otherwise believes,based on the circumstances, that
disclosure of the decedent’s protected
health information would not beappropriate, is not required to make thedisclosure.
Response to Other Public Comments
Comment: Commenters requested
guidance on what it means for a person
to have been ‘‘involved in the care’’ ofthe decedent prior to death. One
commenter suggested including
language in the final rule that would put
the burden of proof of ‘‘involvement in

PO 00000

Frm 00051

Fmt 4701

Sfmt 4700

5615

the individual’s care’’ on the requestor
and not the covered entity, and would
hold the covered entity harmless whendisclosing decedent information in goodfaith in accordance with this new
permission.
Response: We interpret this phrase in
the same manner as we have withrespect to disclosures of protected
health information of living individuals
under § 164.510(b). See theDepartment’s existing guidance at
http://www.hhs.gov/ocr/privacy/hipaa/
understanding/coveredentities/
provider_ffg.pdf. Subject to the specified
conditions, disclosures may be madeunder this provision to family members,
as well as to other persons provided thecovered entity has reasonable assurance
the individual prior to death was
involved in the individual’s care or
payment for care. Depending on thecircumstances, this could include
disclosures to spouses, parents,
children, domestic partners, otherrelatives, or friends of a decedent. As
with similar disclosures concerning
living individuals under§ 164.510(b)(1)(i), this provision does
not generally apply to disclosures tohealth care providers, health plans,
public health authorities, law
enforcement officials, and others whose
access to protected health information isgoverned by other provisions of thePrivacy Rule.
We decline to include language in the
final rule placing the burden of proof on
the requestor to demonstrate they wereinvolved in the individual’s care. In
some cases, it will be readily apparent
to the covered entity that a person is afamily member or was involved in theindividual’s care prior to death because
the person would have made themselves
known to the covered entity prior to theindividual’s death by either visiting
with or inquiring about the individual,or the individual would have identified
such person as being involved in theircare or payment for care to a member ofthe covered entity’s workforce. In othercases, the covered entity need just havereasonable assurance that the person isa family member of the decedent orother person who was involved in theindividual’s care or payment for careprior to death. For example, the person
may indicate to the covered entity how
he or she is related to the decedent oroffer sufficient details about the
decedent’s circumstances prior to death
to indicate involvement in the
decedent’s care prior to death. As statedabove, a covered entity that is
uncomfortable disclosing protected
health information under this provisionbecause of questions about the person’s

E:\FR\FM\25JAR2.SGM

25JAR2

5616

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

relationship to the decedent is not
required to do so.
Comment: Several commenters
requested and offered suggested
clarifications on the scope of the terms‘‘personal representative’’ and ‘‘family
member.’’Response: The Privacy Rule alreadyidentifies the persons who qualify as apersonal representative of a decedent at§ 164.502(g)(4). Further, this final rule
includes a definition of ‘‘family
member’’ at § 160.103.
Comment: A few commenterssuggested extending this provision toallow disclosures to the decedent’s
health care ‘‘proxy,’’ ‘‘medical power ofattorney,’’ ‘‘power of attorney,’’ and‘‘estate executor.’’Response: We decline to expand theprovision as suggested. Under thePrivacy Rule, a person with authority
under applicable law to act on behalf ofthe decedent or the decedent’s estate is
the personal representative of the
decedent. Thus, certain of these
persons, such as the executor of theestate, already have a right of access tothe decedent’s protected healthinformation. In cases where a person
does not rise to the level of a personal
representative, the final rule at§ 164.510(b) permits, subject to any
prior expressed preference of theindividual, a covered entity to disclose
relevant protected health information of
the decedent to family members of the
decedent or persons who otherwise
were involved in the individual’s careor payment for care prior to theindividual’s death, which may include
persons who held a health care proxy
for the individual or a medical power ofattorney.
6. Section 164.512(b)—Disclosure ofStudent Immunizations to Schools

sroberts on DSK5SPTVN1PROD with

Proposed Rule
The Privacy Rule, at § 164.512(b),recognizes that covered entities must
balance protecting the privacy of healthinformation with sharing healthinformation with those responsible for
ensuring public health and safety, andpermits covered entities to disclose theminimum necessary protected healthinformation to public health authorities
or other designated persons or entities
without an authorization for publichealth purposes specified by the Rule.
Schools play an important role inpreventing the spread of communicablediseases among students by ensuringthat students entering classes have been
immunized. Most States have ‘‘school
entry laws’’ which prohibit a child from
attending school unless the school has
proof that the child has been

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

appropriately immunized. Some Statesallow a child to enter school
provisionally for a certain period of time
while the school waits for the necessary
immunization information. Typically,
schools ensure compliance with thoserequirements by requesting theimmunization records from parents(rather than directly from a health careprovider). However, where a covered
health care provider is requested to send
the immunization records directly to aschool, the Privacy Rule generally
requires written authorization by thechild’s parent before a covered healthcare provider may do so.
Since the Privacy Rule went into
effect, we had heard concerns that therequirement for covered entities toobtain authorization before disclosing
student immunization information may
make it more difficult for parents toprovide, and for schools to obtain, thenecessary immunization documentation
for students, which may prevent
students’ admittance to school. The
National Committee on Vital and Health
Statistics submitted these concerns to
the HHS Secretary and recommended
that HHS regard disclosure of
immunization records to schools to be apublic health disclosure, thus
eliminating the requirement for
authorization. See http://
www.ncvhs.hhs.gov/04061712.html. As
such, we proposed to amend§ 164.512(b)(1) by adding a newparagraph that permits covered entities
to disclose proof of immunization toschools in States that have school entry
or similar laws.10 While written
authorization that complies with§ 164.508 would no longer have beenrequired for disclosure of suchinformation under the proposal, thecovered entity would still have beenrequired to obtain agreement, which
may have been oral, from a parent,
guardian or other person acting in loco
parentis for the individual, or from theindividual him- or herself, if theindividual is an adult or emancipatedminor. Because the proposed provision
would have permitted a provider to
10 We note that once a student’s immunization
records are obtained and maintained by aneducational institution or agency to which the
Family Educational Rights and Privacy Act (FERPA)
applies, the records are protected by FERPA, rather
than the HIPAA Privacy Rule. See paragraphs (2)(i)and (2)(ii) of the definition of ‘‘protected healthinformation’’ at § 160.103, which exclude fromcoverage under the Privacy Rule student records
protected by FERPA. In addition, for more
information on the intersection of FERPA andHIPAA, readers are encouraged to consult the Joint
HHS/ED Guidance on the Application of FERPA
and HIPAA to Student Health Records, available at
http://www.hhs.gov/ocr/privacy/hipaa/
understanding/coveredentities/
hipaaferpajointguide.pdf.

PO 00000

Frm 00052

Fmt 4701

Sfmt 4700

accept a parent’s oral agreement todisclose immunization results to aschool—as opposed to a writtenagreement—the NPRM acknowledged apotential for a miscommunication andlater objection by the parent. We,
therefore, requested comment onwhether the Privacy Rule should requirethat a provider document any oral
agreement under this provision to help
avoid such problems, or whether arequirement for written documentation
would be overly cumbersome, onbalance. We also requested comment onwhether the rule should mandate thatthe disclosures go to a particular school
official and if so, who that should be.
In addition, the Privacy Rule does notdefine the term ‘‘school’’ and the typesof schools subject to the school entry
laws may vary by State. For example,
depending on the State, such laws may
apply to public and private elementaryor primary schools and secondary
schools (kindergarten through 12th
grade), as well as daycare and preschool
facilities, and post-secondary
institutions. Thus, we requested
comment on the scope of the term‘‘school’’ for the purposes of this section
and whether we should include a
specific definition of ‘‘school’’ within
the regulation itself. In addition, werequested comment on the extent towhich schools that may not be subject
to these school entry laws but that may
also require proof of immunization haveexperienced problems that would
warrant their being included in thiscategory of public health disclosures.
Overview of Public Comments
Most commenters were generally infavor of permitting covered entities todisclose student immunization records
based on obtaining agreement, which
may be oral, from a parent, guardian orother person acting in loco parentis forthe individual, or from the individual
himself or herself, if the individual is an
adult or emancipated minor, rather thanwritten authorization. Commenters
supported the intent to facilitate thetransmission of immunization records toease the burden on parents, schools andcovered entities, and to minimize theamount of school missed by students.
Some commenters opposed the
proposal to require oral or writtenagreement, claiming that a new form of‘‘agreement’’ would introduce
unnecessary complexity and confusion,
and would not help to reduce burden.
These commenters asserted that covered
entities would document the verbal
agreements for their own liability
purposes, even if not required by thePrivacy Rule. In this manner, thedocumentation burden would still be

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
present. Some commenters
recommended that instead of an oral
agreement or authorization requirement,
disclosure of immunization records toschools should be considered an exempt
public health disclosure. A small
minority of commenters felt that thecurrent authorization system should bemaintained as it is the best way toensure patient safety and privacy while
avoiding miscommunications andmisunderstandings.
Commenters were divided on theissue of requiring written
documentation of the agreement. Some
commenters were in favor of
documenting oral agreements, citingthat the documentation would be lesscumbersome than obtaining written
authorizations while also helping to
avoid miscommunications. On the other
hand, some commenters felt that
requiring written documentation would
be burdensome and would eliminate thebenefits introduced by permitting oral
agreements. Some commenters also
requested flexibility for covered entities
to determine whether or not written
documentation is appropriate andnecessary for their purposes.
The majority of commenters requested
that a designated recipient of thestudent immunization records not be
defined, and that schools be allowed
flexibility to identify the appropriate
individual(s) that can act as the school
official permitted to receive the records.
Commenters indicated that while thedisclosures would ideally be made to anurse or licensed health professional at
the school, such a health professional
may not always be present. In such
instances, it should be permissible thatthe immunization records be disclosed
to another official designated by theschool as a suitable representative. One
commenter recommended that theschool nurse be designated as therecipient and custodian of the records.
Most commenters recommended thatthe definition of ‘‘school’’ be interpreted
broadly in order to best support publichealth efforts. Commenters provided
suggestions on the types of schools thatshould be included, for example, K–12
schools, public and private schools, andpost-secondary schools. Many
commenters also suggested that daycare,preschool and nursery school facilities
be encompassed in the definition ofschool. One commenter expressly
recommended that child care facilities
or day care programs not be included in
the definition of school, despite
acknowledging the need to protect thehealth of these children, due to the factthat many States have different laws forthese settings and are separate fromschool systems. Two commenters

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

suggested defining schools as being
open to children up to age 18, since
students become adults at age 18 andcan authorize the disclosure of theirown information. A few commenterssuggested that the definition include allschools that require immunization
documentation as a prerequisite toenrollment, not just those that are
subject to State entry laws, in order toprotect public health in all school
settings, since the threat of unimmunized children exists regardless ofState school entry laws. Additionally,some commenters recommended thatthe term ‘‘school’’ not be defined in the
Privacy Rule due to the variation acrossStates in the types of schools that are
subject to the entry laws.
Final Rule
The final rule adopts the proposal toamend § 164.512(b)(1) by adding a newparagraph that permits a covered entity
to disclose proof of immunization to aschool where State or other law requires
the school to have such information
prior to admitting the student. While
written authorization will no longer berequired to permit this disclosure,covered entities will still be required toobtain agreement, which may be oral,from a parent, guardian or other person
acting in loco parentis for theindividual, or from the individual
himself or herself, if the individual is an
adult or emancipated minor. We believethat the option to provide oral
agreement for the disclosure of student
immunization records will relieveburden on parents, schools, and covered
entities, and greatly facilitate the rolethat schools play in public health, whilestill giving parents the opportunity toconsider whether to agree to thedisclosure of this information.
The final rule additionally requiresthat covered entities document theagreement obtained under thisprovision. The final rule does notprescribe the nature of the
documentation and does not requiresignature by the parent, allowing
covered entities the flexibility todetermine what is appropriate for their
purposes. The documentation must only
make clear that agreement was obtained
as permitted under this provision. For
example, if a parent or guardian submits
a written or email request to a covered
entity to disclose his or her child’s
immunization records to the child’s
school, a copy of the request would
suffice as documentation of theagreement. Likewise, if a parent or
guardian calls the covered entity andrequests over the phone that his or her
child’s immunization records bedisclosed to the child’s school, a

PO 00000

Frm 00053

Fmt 4701

Sfmt 4700

5617

notation in the child’s medical record or
elsewhere of the phone call would
suffice as documentation of theagreement. We emphasize that theagreement is not equivalent to a HIPAAcompliant authorization, and covered
entities are not required to document a
signature as part of this requirement. We
disagree with comments that
documentation would be as burdensome
on covered entities as written
authorization, since an authorization
form contains many required statements
and elements, including a signature by
the appropriate individual, which are
not required for the agreement anddocumentation contemplated here.
Furthermore, we believe that
documentation of oral agreements will
help to prevent miscommunications andpotential future objections by parents orindividuals, and the concerns thatcovered entities may have regarding
liability, penalty or other enforcement
actions for disclosures made pursuant toan oral agreement.
Several commenters recommended
that in lieu of an oral agreement,
disclosure of immunization records toschools are presumed to be permitted,
while giving individuals the option to
opt out of this presumption or request
a restriction to the disclosure. One
commenter advocated for this publichealth exemption for disclosure of
immunization records as being
particularly critical for children who
may be, for example, homeless, livingwith someone other than a parent orlegal guardian, or living with a parent
that does not speak English. We remove
the written authorization requirement tohelp facilitate these disclosures with asmuch flexibility as possible. However,
we do not intend this provision tochange the current practice of parents,
guardians, or other persons acting inloco parentis contacting a child’s healthcare provider to request proof of
immunization be sent to the child’s
school. Therefore, we still require active
agreement from the appropriate
individual, and a health care provider
may not disclose immunization records
to a school under this provision without
such agreement. The agreement must be
an affirmative assent or request by aparent, guardian, or other person acting
in loco parentis (or by an adultindividual or emancipated minor, if
applicable) to the covered entity, which
may be oral and over the phone, toallow the disclosure of theimmunization records. A mere request
by a school to a health care provider for
the immunization records of a student
would not be sufficient to permit
disclosure under this provision (andE:\FR\FM\25JAR2.SGM

25JAR2

5618

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withsuch a request by a school might also
raise implications under other laws,
such as FERPA).
We decline to include definitions of‘‘school official’’ and ‘‘school’’ in the
final rule. The motivation for this new
permissive disclosure is to promote
public health by reducing the burden
associated with providing schools withstudent immunization records and we
do not wish to create additionaldifficulties or confusion in doing so. We
therefore agree with commenters that
schools are best equipped to determine
the appropriate individual to receive
student immunization records at theirlocation and will benefit from having
this flexibility. We also agree withcommenters that ‘‘school’’ should
remain undefined in the Privacy Ruledue to the variation across States in thetypes of schools that are subject to theentry laws. We believe that this will bestalign with State law and cause the least
amount of confusion. We did notreceive sufficient comment regarding
the breadth of schools that are notsubject to school entry laws or theburden that these institutions face tojustify expanding this provision to allow
disclosure of proof of immunization tosuch schools without an authorization.
Response to Other Public Comments
Comment: Several commenters raised
concerns about the dynamic between
the Privacy Rule requirements and Statelaw requirements regarding
immunization disclosures. Commenters
indicated that some State laws require
providers to directly shareimmunization records with schools andprovide parents with the opportunity to
opt out of this direct sharing.
Commenters also indicated the use ofState immunization registries in many
States, to which schools are permitted
direct access. One commenter suggested
that the Privacy Rule permit State law
to determine what is the minimum
necessary for proof of immunization.
Response: We take this opportunity toclarify that the Privacy Rule at§ 164.512(a) permits a covered entity touse or disclose protected healthinformation to the extent that such use
or disclosure is required by law and theuse or disclosure complies with and islimited to the relevant requirements ofsuch law. As such, the Privacy Ruledoes not prohibit immunization
disclosures that are mandated by State
law, nor does it require authorization forsuch disclosures. With regard to Statelaws that require covered entities todisclose immunization records toschools and allow parents to opt out,
this is not in any way prohibited by thePrivacy Rule. However, with regard to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

State laws that permit but do not require
covered entities to disclose
immunization records to schools, thisdoes not meet the requirements of theprovisions at § 164.512(a), anddisclosures of immunization records are
subject to the Privacy Rule agreementand documentation requirements
described in this part. We also note that
the Privacy Rule at § 164.512(b) permitsa covered entity to disclose protected
health information for public healthactivities. Disclosures of protected
health information to Stateimmunization registries are therefore
permitted by the Privacy Rule and also
do not require authorization. The
Privacy Rule at § 164.514(d)(3)(iii)(A)provides that a covered entity, when
making a permitted disclosure pursuant
to § 164.512 to a public official, may
determine, if such a determination isreasonable under the circumstances,that information requested by a public
official is the minimum necessary
information for the stated purpose, if the
public official represents that the
information requested is the minimum
necessary for the stated purpose(s).
Under this provision, a covered entity
may rely on State law or a State
official’s determination of the minimum
necessary information required for proofof immunization, unless suchdetermination is unreasonable.
Comment: Commenters requested
guidance on when and how often to
obtain agreement for immunization
disclosures.
Response: We anticipate that covered
entities will obtain agreement for thedisclosure of immunization records on acase-by-case basis as needed. For
example, a parent may call and requestthat a covered entity provide his or her
child’s immunization records before thechild begins elementary school, if
required by State school entry laws. If
that child moves to a different school
and is unable to transfer theirimmunization records to the newschool, the parent may need to requestthat the covered entity provide his or
her child’s immunization records to the
new school, if required by State school
entry laws. A parent might also
generally indicate to a covered entitythat he or she affirmatively agrees to theimmediate or future disclosure of his or
her child’s immunization records to thechild’s school as necessary, or thecontinued disclosure of suchinformation if, for example, updates are
required by the school when a series ofvaccinations have been completed.
Comment: Commenters requested
clarification on the length of time anagreement may be relied upon.

PO 00000

Frm 00054

Fmt 4701

Sfmt 4700

Response: An agreement to permit thedisclosure of immunization records is
considered effective until revoked by
the parent, guardian or other person
acting in loco parentis for theindividual, or by the individual himself
or herself, if the individual is an adultor emancipated minor.
Comment: Commenters requested
clarification regarding any requirement
for schools to maintain the
immunization records.
Response: The Privacy Rule does not
require schools to keep student
immunization records; however
individual State or other laws may
require this.
7. Section 164.514(f)—Fundraising
Proposed Rule
Section 164.514(f)(1) of the Privacy
Rule permits a covered entity to use, ordisclose to a business associate or an
institutionally related foundation, thefollowing protected health information
about an individual for the covered
entity’s fundraising from that individual
without the individual’s authorization:(1) Demographic information relating toan individual; and (2) the dates ofhealth care provided to an individual.
Section 164.514(f)(2) of the Privacy Rulerequires a covered entity that plans touse or disclose protected healthinformation for fundraising under thisparagraph to inform individuals in its
notice of privacy practices that it may
contact them to raise funds for thecovered entity. In addition,§ 164.514(f)(2) requires that a covered
entity include in any fundraisingmaterials it sends to an individual a
description of how the individual may
opt out of receiving future fundraisingcommunications and that a covered
entity must make reasonable efforts toensure that individuals who do opt out
are not sent future fundraisingcommunications.
Section 13406(b) of the HITECH Act
requires the Secretary to provide by rulethat a covered entity provide therecipient of any fundraisingcommunication with a clear andconspicuous opportunity to opt out ofreceiving any further fundraisingcommunications. Additionally, section
13406(b) states that if an individual
does opt out of receiving further
fundraising communications, theindividual’s choice to opt out must betreated as a revocation of authorization
under § 164.508 of the Privacy Rule.
In the NPRM, we proposed a numberof changes to the Privacy Rule’s
fundraising requirements to implement
the statutory provisions. First, we
proposed to strengthen the opt out by

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
requiring that a covered entity provide,with each fundraising communication
sent to an individual under theseprovisions, a clear and conspicuous
opportunity for the individual to electnot to receive further fundraisingcommunications. To satisfy thisrequirement, we also proposed torequire that the method for anindividual to elect not to receive further
fundraising communications may notcause the individual to incur an undue
burden or more than nominal cost. We
encouraged covered entities to consider
the use of a toll-free phone number, anemail address, or similar opt out
mechanism that would provide
individuals with a simple, quick, andinexpensive way to opt out of receiving
future communications. We noted that
we considered requiring individuals towrite a letter to opt out to constitute anundue burden on the individual.
We also proposed to provide that acovered entity may not condition
treatment or payment on an individual’s
choice with respect to receiving
fundraising communications. We
believed this modification would
implement the language in section
13406(b) of the HITECH Act thatprovides that an election by anindividual not to receive further
fundraising communications shall betreated as a revocation of authorization
under the Privacy Rule.
Further, we proposed to provide thata covered entity may not send
fundraising communications to anindividual who has elected not toreceive such communications. This
would strengthen the current
requirement at § 164.514(f)(2)(iii) that acovered entity make ‘‘reasonable
efforts’’ to ensure that those individuals
who have opted out of receiving
fundraising communications are notsent such communications. The NPRM
proposed stronger language to makeclear the expectation that covered
entities abide by an individual’s
decision not to receive fundraisingcommunications, as well as to make thefundraising opt out operate more like a
revocation of authorization, consistent
with the statutory language andlegislative history of section 13406(b) of
the HITECH Act discussed above.
With respect to the operation of the
opt out, we requested comment
regarding to what fundraisingcommunications the opt out should
apply (i.e., should the opt out apply to
all future fundraising communications
or should and can the opt out be
structured in a way to apply only to theparticular fundraising campaign
described in the letter). We also
requested comment on whether the Rule

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

should allow a similar method, short ofthe individual signing an authorization,by which an individual who has
previously opted out can put his or her
name back on an institution’sfundraising list.
We proposed to retain therequirement that a covered entity that
intends to contact the individual to raise
funds under these provisions include astatement to that effect in its notice ofprivacy practices. However, we
proposed that the required statement
also inform individuals that they have aright to opt out of receiving such
communications.
In addition to the above
modifications, we requested publiccomment on the requirement at§ 164.514(f)(1) which limits theinformation a covered entity may use or
disclose for fundraising to demographic
information about and dates of healthcare service provided to an individual.
Since the promulgation of the Privacy
Rule, we acknowledged that certain
covered entities have raised concerns
regarding this limitation, maintainingthat the Privacy Rule’s prohibition on
the use or disclosure of certain
treatment information without an
authorization, such as the department ofservice where care was received andoutcomes information, impedes theirability to raise funds from often willingand grateful patients because they areunable to target their fundraising efforts
and avoid inappropriate solicitations to
individuals who may have had a badtreatment outcome. Such entities haveargued that obtaining an individual’s
authorization for fundraising as theindividual enters or leaves the hospitalfor treatment is often impracticable orinappropriate. The proposed rule also
discussed the fact that the National
Committee on Vital and Health
Statistics held a hearing and heard
public testimony on this issue in July
2004 and recommended to the Secretarythat the Privacy Rule should allow
covered entities to use or disclose
information related to the patient’s
department of service (broad
designations, such as surgery or
oncology, but not narrower designations
or information relating to diagnosis ortreating physician) for fundraising
activities without patient authorization.
The National Committee on Vital and
Health Statistics also recommended thata covered entity’s notice of privacy
practices inform patients that theirdepartment of service information may
be used in fundraising, and that patientsshould be afforded the opportunity to
opt out of the use of their department
of service information for fundraising or
all fundraising contacts altogether. See

PO 00000

Frm 00055

Fmt 4701

Sfmt 4700

5619

http://www.ncvhs.hhs.gov/
040902lt1.htm.
In light of these concerns and theprior recommendation of the National
Committee on Vital and Health
Statistics, we asked for public comment
on whether and how the current
restriction on what information may be
used and disclosed should be modified
to allow covered entities to more
effectively target fundraising and avoid
inappropriate solicitations to
individuals, as well as to reduce theneed to send solicitations to all patients.
In particular, we solicited comment on:(1) Whether the Privacy Rule should
allow additional categories of protected
health information to be used ordisclosed for fundraising, such as
department of service or similar
information, and if so, what thosecategories should be; (2) the adequacy ofthe minimum necessary standard to
appropriately limit the amount ofprotected health information that may
be used or disclosed for fundraising
purposes; or (3) whether the current
limitation should remain unchanged.
We also solicited comment on whether,
if additional information is permitted to
be used or disclosed for fundraisingabsent an authorization, covered entities
should be required to provide
individuals with an opportunity to opt
out of receiving any fundraisingcommunications before making the first
fundraising solicitation, in addition tothe opportunity to opt out with every
subsequent communication. We invited
public comment on whether such a presolicitation opt out would be workablefor covered entities and individuals andwhat mechanisms could be put into
place to implement the requirement.
Overview of Public Comments
In general, the public comments
received in response to the NPRM were
supportive of the proposed
modifications but many asked that the
final rule give covered entities
flexibility with respect tooperationalizing these requirements.
Several commenters provided examplesof routine communications andexpressed the need for guidance andclarification about what constitutes afundraising communication.
Generally, most commenters
supported the NPRM’s proposed
requirement that the method throughwhich the covered entity permits
individuals to opt out of receiving
future fundraising communications notcause individuals to incur an undue
burden or more than a nominal cost.
Many commenters stated that the final
rule should give covered entities theflexibility to determine which opt out

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5620

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

methods will work best given theircircumstances, instead of requiring all
covered entities to employ specific opt
out methods. These commenters notedthat depending on the size of thecovered entity and type of population it
serves, certain opt out methods might
not be feasible, such as one that requires
the establishment of a toll-free number,which may be cost prohibitive for somesmall entities. Similarly, somecommenters noted that because not allindividuals have access to a computer
and the Internet, providing individuals
with the opportunity to opt out via
email alone may not be sufficient.
With respect to the scope of the opt
out, the commenters were generally
split on whether the opt out should
apply to communications related to a
specific fundraising campaign or to all
future fundraising communications. The
commenters in support of applying the
opt out to a specific fundraising
campaign stated that it would be too
difficult for individuals to make ameaningful decision about whether theywanted to opt out of all future
fundraising communications, andallowing individuals to opt out of all
futurefundraising communications
would greatly hinder a covered entity’s
ability to raise funds. Those commentersin favor of implementing an all or
nothing opt out stated that it would be
too difficult for covered entities,
especially large facilities, to track
campaign-specific opt outs for eachindividual, so applying the opt out
universally would make it much easierfor covered entities to implement. Other
commenters asked that the final ruletake a flexible approach and permit
covered entities to decide the scope ofthe opt out, while others stated that the
final rule should require covered
entities to include both opt out options
on each fundraising communicationleaving the decision to individuals.
Additionally, while most commenters
supported the prohibition on
conditioning treatment or payment on
an individual’s choice regarding thereceipt of fundraising communications,most commenters opposed the NPRM’s
proposal that prohibited covered
entities from sending future fundraisingcommunications to those individuals
who had opted out and stated that it
was too strict. The majority of thesecommenters suggested that the final rule
retain the Privacy Rule’s original‘‘reasonable efforts’’ language and statedthat while covered entities have every
incentive not to send fundraisingcommunications to those individuals
who have opted out of receiving them,
it is very difficult for covered entities toensure 100 percent accuracy with this

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

policy. Several commenters stated that
there are lag times between the periodof time in which a fundraising mailinglist is compiled and the time in whicha fundraising communication is sentout, so if an individual has opted out
during the interim time period, covered
entities may not be able to prevent the
prepared fundraising communicationfrom being sent. Other commentersstated that it may be difficult toimplement an opt out across all records
belonging to that individual wherecomplications, such as name changes
and variation, address changes, andmultiple addresses are involved.
For those individuals who have opted
out of receiving fundraisingcommunications, commenters generally
supported allowing those individuals to
opt back in to receiving such
communications. Some suggested that
individuals be able to opt back in using
the same methods they used to opt out,
while others suggested that any
communication indicating a willingness
to resume receiving fundraisingcommunications, such as making a
donation to the covered entity, should
function as an opt in. Other commenterssuggested that the final rule limit theamount of time that an individual can
opt out, such that after this period oftime the individual automatically begins
receiving fundraising communications
again. A few commenters were opposedto permitting individuals to opt back in
to receive fundraising communications,
stating that this would be too costly andburdensome for covered entities totrack.
With respect to the requests for publiccomments regarding the potential use or
disclosure of additional protected healthinformation to provide more targeted
fundraising communications, the vast
majority of commenters supported
allowing the use or disclosure ofadditional protected health information
for fundraising. These commentersstated that the use of additional
protected health information would
streamline their fundraising efforts andensure that individuals were sent
communications about campaigns thatwould be meaningful to theirexperiences. These commenters also
stated that it would eliminate theconcern of sending a communication to
an individual or family that suffered anegative outcome. Commenterssuggested several categories of protected
health information that covered entities
should be able to use to target theirfundraising efforts, including
department or site of service, genericarea of treatment, department where lastseen, outcome information, treating
physician, diagnosis, whether the

PO 00000

Frm 00056

Fmt 4701

Sfmt 4700

individual was a pediatric or adultpatient, medical record number, Social
Security number, or other unique
identifier, and any other informationthat reflects the fact that the individual
was served by the covered entity.
With respect to the minimum
necessary standard, a few commenters
supported its use to limit any additional
categories of protected healthinformation that can be used to target acovered entity’s fundraising efforts.
These commenters supported the use of
the standard because of how familiarand comfortable most covered entities
are at applying the minimum necessary
standard. However, another commenter
was opposed to the use of the minimum
necessary standard, stating that it is not
uniformly applied across covered
entities.
Despite the general support for theuse of additional protected healthinformation, a small minority ofcommenters opposed allowing the useof additional protected healthinformation to target fundraising efforts,
citing privacy concerns with doing so.
One commenter opposed expanding theinformation that could be used for
fundraising in cases where outsidefundraising entities are used, including
those with whom the covered entity has
executed business associate agreements.
All commenters were opposed torequiring covered entities to provide a
pre-solicitation opt out to individuals
and stated that permitting individuals to
opt out in the first fundraisingcommunication is sufficient. Several
commenters noted that the proposed
revision to the notice of privacy
practices to require a covered entity to
inform individuals of their right to opt
out of receiving fundraisingcommunications effectively functions asa pre-solicitation opt out, so individuals
who wish to opt out of receiving such
communications immediately can do soupon receipt of the notice.
Final Rule
We generally adopt the proposals in
the final rule, as well as allow certain
additional types of protected healthinformation to be used or disclosed for
fundraising purposes.
With respect to the commenters who
expressed confusion over what
constitutes a fundraisingcommunication, we emphasize that the
final rule does nothing to modify thetypes of communications that are
currently considered to be for
fundraising purposes. A communication
to an individual that is made by acovered entity, an institutionally related
foundation, or a business associate on
behalf of the covered entity for the

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
purpose of raising funds for the covered
entity is a fundraising communication
for purposes of § 164.514(f). The
Department has stated that‘‘[p]ermissible fundraising activities
include appeals for money, sponsorshipof events, etc. They do not include
royalties or remittances for the sale ofproducts of third parties (except
auctions, rummage sales, etc.).’’ See 65
FR 82718. Additionally, the Privacy
Rule has always required that such
communications contain a descriptionof how the individual may opt out ofreceiving further fundraisingcommunications (§ 164.514(f)(2)(ii)).
With respect to the proposed
requirement that the method for anindividual to elect not to receive further
fundraising communications should notcause the individual to incur an undue
burden or more than a nominal cost, we
generally agree with the commenters
who suggested that the final rule beflexible and not prescriptive. Under the
final rule, covered entities are free todecide what methods individuals canuse to opt out of receiving further
fundraising communications, as long as
the chosen methods do not impose anundue burden or more than a nominal
cost on individuals. Covered entities
should consider the use of a toll-freephone number, an email address, orsimilar opt out mechanisms that provide
individuals with simple, quick, andinexpensive ways to opt out of receiving
further fundraising communications.
Covered entities may employ multiple
opt out methods, allowing individuals
to determine which opt out method is
the simplest and most convenient forthem, or a single method that isreasonably accessible to all individuals
wishing to opt out.
In response to commenters who
expressed concern about the cost ofsetting up a toll-free phone number, weclarify that covered entities may require
individuals who wish to opt out offurther fundraising communications to
do so through other methods, (e.g.,through the use of a local phone
number), where appropriate, as long as
the method or methods adopted do not
impose an undue burden or cost on theindividual. We encourage covered
entities to consider the size of the
population to which they are sending
the communications, the geographic
distribution, and any other factors that
may help determine which opt out
method(s) is most appropriate and leastburdensome to individuals.
We continue to consider requiring
individuals to write and send a letter tothe covered entity asking not to receive
further fundraising communications toconstitute an undue burden. However,

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

requiring that individuals opt out offurther fundraising communications bysimply mailing a pre-printed, pre-paid
postcard would not constitute an undue
burden under the final rule and is anappropriate alternative to the use of aphone number or email address.
Regarding the scope of the opt out, thecommenters were split on whether the
opt out should apply to all future
fundraising communications or to a
specific fundraising campaign. The final
rule leaves the scope of the opt out tothe discretion of covered entities. For
those covered entities that expressed
concern about the ability to track
campaign-specific opt outs, they havethe discretion to apply the opt out to all
future fundraising communications.
Likewise, those covered entities that
prefer, and have the ability to track,campaign-specific opt outs are free toapply the opt out to specific fundraising
campaigns only. Covered entities arealso free to provide individuals with the
choice of opting out of all future
fundraising communications or just
campaign-specific communications.
Whatever method is employed, thecommunication should clearly inform
individuals of their options and any
consequences of electing to opt out offurther fundraising communications.
Despite the commenters who did notsupport the strengthened language in
the NPRM prohibiting covered entities
from sending further fundraisingcommunications to those individuals
who have already opted out, the final
rule adopts this provision without
modification. While many commenters
supported the current ‘‘reasonable
efforts’’ standard and cited several
reasons that may make it difficult toattain the proposed standard, we adopt
the proposed standard because it isconsistent with the statute and more
protective of an individual’s right toelect not to receive further fundraisingcommunications. For example, somecommenters cited lag times between thecreation of mailing lists and the receipt
or update of opt out lists and difficultyin accurately identifying individuals on
the fundraising lists due to namechanges or variations and multiple
addresses. These issues are common to
the management of the medical orbilling records and effectuating
revocations of authorization, requests
for access, and other generalcommunications between the entity andthe individual. We expect the same care
and attention to the handling ofprotected health information in
fundraising communications as isnecessary for the proper handling of thisinformation in all other health care
operations performed by the covered

PO 00000

Frm 00057

Fmt 4701

Sfmt 4700

5621

entity. Covered entities voluntarilychoosing to send fundraisingcommunications to individuals musthave data management systems andprocesses in place to timely track andflag those individuals who have opted
out of receiving fundraisingcommunications to ensure that they are
not sent additional fundraisingcommunications.
The majority of commenters
supported allowing a process forindividuals who have opted out ofreceiving further fundraisingcommunications to opt back in and thefinal rule at § 164.514(f)(2)(v) permits
covered entities have one. Like thediscretion given to covered entities
regarding the methods through which
an individual can opt out, the final rule
gives covered entities the discretion todetermine how individuals should be
able to opt back in. For example, acovered entity could include as a part ofa routine newsletter sent to all patientsa phone number individuals can call tobe put on a fundraising list.
While some commenters suggested
that opt outs should be time limited
such that an individual automatically
opts back in after a certain period oftime, we do not believe that anindividual’s election not to receive
further fundraising communications issomething that should automaticallylapse. Because the individual has
actively chosen to opt out, only asimilar active decision by the individual
to opt back in will suffice. Additionally,
where an individual who has opted out
of fundraising communications makes adonation to a covered entity, it does notserve, absent a separate election to opt
back in, to automatically add theindividual back onto the mailing list for
fundraising communications.
The Privacy Rule currently permits
covered entities to use or disclose only
demographic information relating to theindividual and dates of health careprovided to the individual for
fundraising communications. In
response to several commenters who
asked for clarification regarding thescope of demographic information, thefinal rule, at § 164.514(f)(1)(i), clarifies
that demographic information relating
to an individual includes names,
addresses, other contact information,age, gender, and dates of birth. Althoughmuch of this information was listed in
the preamble to the 2000 final rule (65FR 82718) as being demographic
information with respect to thefundraising provisions, we have added
this information to the regulatory text
for clarity. Additionally, we haveincluded date of birth as demographic
information, instead of merely age. We

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5622

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

believe that date of birth may be useful
to covered entities because they are
more likely to maintain a record of anindividual’s date of birth, rather thanhis or her static age. We also note thatthe 2000 preamble identifies insurance
status as falling within the category of
demographic information. The final rule
continues to allow covered entities touse or disclose information about anindividual’s health insurance status for
fundraising purposes; however, we list
this category of information separately
in the regulatory text, as we do notbelieve this information truly
constitutes demographic information.
In addition to demographic
information, health insurance status,and dates of health care provided to theindividual (which is currently permitted
under the Rule), this final rule also
allows covered entities to use anddisclose department of service
information, treating physician
information, and outcome information
for fundraising purposes. These three
categories of information were mostfrequently identified by commenters as
the most needed for covered entities tofurther target fundraisingcommunications to appropriate
individuals. Although we do not define
these terms, we clarify that department
of service information includes
information about the general
department of treatment, such as
cardiology, oncology, or pediatrics.
Additionally, we clarify that outcome
information includes information
regarding the death of the patient or any
sub-optimal result of treatment orservices. In permitting its use for
fundraising purposes, we intend for it to
be used by the covered entity itself toscreen and eliminate from fundraising
solicitations those individuals
experiencing a sub-optimum outcome,and for its disclosure to a businessassociate or institutionally related
foundation only where such screening
function is done by those parties. We
also emphasize that as with any use or
disclosure under the Privacy Rule, acovered entity must apply the minimum
necessary standard at § 164.502(b) toensure that only the minimum amountof protected health informationnecessary to accomplish the intended
purpose is used or disclosed.
We adopt in the final rule theprovision prohibiting the conditioningof treatment or payment on an
individual’s choice with respect to thereceipt of fundraising communications.
We also adopt at § 164.520(b)(1)(iii)(A)the requirement that the notice ofprivacy practices inform individuals
that a covered entity may contact themto raise funds for the covered entity and

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

an individual has a right to opt out ofreceiving such communications. The
final rule does not require covered
entities to send pre-solicitation opt outs
to individuals prior to the first
fundraising communication. We believethat because the individual will be on
notice of the opportunity to opt out ofreceiving fundraising communications
through the notice of privacy practices
and the first fundraising communication
itself will contain a clear andconspicuous opportunity to opt out,
there is no need to require covered
entities to incur the additional burden
and cost of sending pre-solicitation opt
outs.
Under the Privacy Rule fundraisingcommunications can take many forms,
including communications made overthe phone. Despite the fact that the
HITECH Act refers only to written
fundraising communications, because
the Privacy Rule applies tocommunications made over the phone,
we believe it would be counterintuitive
to apply the strengthened opt out
requirement to only written fundraisingcommunications. Therefore, likefundraising communications made inwriting, covered entities that makefundraising communications over thephone must clearly inform individuals
that they have a right to opt out offurther solicitations. Accordingly, tomake clear that the opt out requirement
applies to fundraising solicitations
made over the phone, the final ruleprovides that the opt out requirement
applies to each fundraisingcommunication ‘‘made’’ rather than‘‘sent’’ to an individual.
We also emphasize that the notice andopt out requirements for fundraisingcommunications apply only where thecovered entity is using or disclosing
protected health information to target
the fundraising communication. If thecovered entity does not use protected
health information to send fundraisingmaterials, then the notice and opt out
requirements do not apply. For
example, if a covered entity uses a
public directory to mail fundraisingcommunications to all residents in aparticular geographic service area, thenotice and opt out requirements are notapplicable.
Response to Other Public Comments
Comment: A few commenterssuggested that, to better protect anindividual’s privacy, particularly where
sensitive health information may be
used to target solicitations, the final ruleshould require an opt in process rather
than an opt out process for consenting
to fundraising communications.

PO 00000

Frm 00058

Fmt 4701

Sfmt 4700

Response: We decline to require an
opt in process. The HITECH Act did not
replace the right to opt out offundraising communications with an
opt in process. Further, we continue tobelieve that the opt out process,particularly as it has been strengthenedby the HITECH Act and this final rule,provides individuals with appropriate
control over the use of their information
for these purposes.
Comment: One commenter asked that
if an individual opts out of receiving
further fundraising communications
through a mailed communication, mustthe covered entity also remove theindividual’s name from the list throughwhich the covered entity sends email
fundraising communications, or mustthe individual opt out of receiving such
email communications separately.
Response: A covered entity may
choose to provide individuals with theopportunity to select their preferred
method for receiving fundraisingcommunications. If an individual elects
to opt out of future fundraisingcommunications, then the opt out iseffective for all forms of fundraisingcommunications. Thus, the individual
must be removed from all such lists.
8. Section 164.520—Notice of Privacy
Practices for Protected Health
Information
Proposed Rule
Section 164.520 of the Privacy Rulesets out the requirements for most
covered entities to have and distributea notice of privacy practices (NPP). The
NPP must describe the uses anddisclosures of protected healthinformation a covered entity ispermitted to make, the covered entity’s
legal duties and privacy practices withrespect to protected health information,and the individual’s rights concerning
protected health information.
Section 164.520(b)(1)(ii) requires acovered entity to include separate
statements about permitted uses anddisclosures that the covered entity
intends to make, including uses anddisclosures for certain treatment,
payment, or health care operations
purposes. Further, § 164.520(b)(1)(ii)(E)currently requires that the NPP containa statement that any uses anddisclosures other than those permitted
by the Privacy Rule will be made onlywith the written authorization of theindividual, and that the individual has
the right to revoke an authorization
pursuant to § 164.508(b)(5).
We proposed to amend§ 164.520(b)(1)(ii)(E) to require that the
NPP describe the uses and disclosuresof protected health information that

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
require an authorization under§ 164.508(a)(2) through (a)(4) (i.e.,
including a statement that most usesand disclosures of psychotherapy notes
and of protected health information formarketing purposes and the sale ofprotected health information require an
authorization), and provide that otheruses and disclosures not described in
the notice will be made only with theindividual’s authorization.
Section 164.520(b)(1)(iii) requires acovered entity to include in its NPP
separate statements about certain
activities if the covered entity intends toengage in any of the activities. In
particular, § 164.520(b)(1)(iii) requires aseparate statement in the notice if thecovered entity intends to contact theindividual to provide appointment
reminders or information about
treatment alternatives or other healthrelated benefits or services; to contact
the individual to fundraise for thecovered entity; or, with respect to agroup health plan, to disclose protected
health information to the plan sponsor.
First, with respect to this provision,
the NPRM proposed to modify§ 164.520(b)(1)(iii)(A) to align therequired statement with the proposed
modifications related to marketing andsubsidized treatment communications.
The provision would have required acovered health care provider that
intends to send treatmentcommunications to individuals and hasreceived financial remuneration in
exchange for making thecommunication to, in its NPP, notify
individuals of this intention and to
inform them that they can opt out ofreceiving such communications.
Second, at § 164.520(b)(1)(iii)(B) we
proposed to require that if a covered
entity intends to contact the individual
to raise funds for the entity as permitted
under § 164.514(f)(1), the covered entity
must not only inform the individual in
the NPP of this intention but also must
inform the individual that he or she has
the right to opt out of receiving such
communications.
Section 164.520(b)(1)(iv) requires that
the NPP contain statements regarding
the rights of individuals with respect totheir protected health information and abrief description of how individuals
may exercise such rights. Section
164.520(b)(1)(iv)(A) currently requires astatement and a brief description
addressing an individual’s right torequest restrictions on the uses anddisclosures of protected healthinformation pursuant to § 164.522(a),including the fact that the covered
entity is not required to agree to thisrequest.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

The NPRM proposed to modify§ 164.520(b)(1)(iv)(A) to require astatement explaining that the covered
entity is required to agree to a request
to restrict disclosure of protected healthinformation to a health plan if thedisclosure is for payment or health care
operations and pertains to a health care
item or service for which the individual
has paid out of pocket in full, as
provided at § 164.522(a)(1)(vi).
Under Subpart D of Part 164, covered
entities now have new breach
notification obligations. We requested
comment on whether the Privacy Ruleshould require a specific statement
regarding this new legal duty and whatparticular aspects of this new duty
would be important for individuals tobe notified of in the NPP.
The NPRM stated that modifications
to § 164.520 would represent materialchanges to covered entities’ NPPs.
Section 164.520(b)(3) requires that when
there is a material change to the NPP,
covered entities must promptly revise
and distribute the NPP as outlined at§ 164.520(c). Section 164.520(c)(1)(i)(C)
requires that health plans provide notice
to individuals covered by the plan
within 60 days of any material revision
to the NPP. Because we acknowledgedthat revising and redistributing a NPP
may be costly for health plans, werequested comment on ways to inform
individuals of this change to privacy
practices without unduly burdening
health plans. We requested comment on
options for informing individuals in atimely manner of this proposed or othermaterial changes to the NPP. We also
requested comment on this issue in the
proposed changes to the Privacy Rulepursuant to the Genetic Information
Nondiscrimination Act (GINA), as
discussed below in Section VI. In
particular, the Department requested
comment on the following options: (1)Replace the 60-day requirement with arequirement for health plans to revise
their NPPs and redistribute them (or atleast notify members of the materialchange to the NPP and how to obtain
the revised NPP) in their next annual
mailing to members after a material
revision to the NPP, such as at the
beginning of the plan year or during theopen enrollment period; (2) provide a
specified delay or extension of the 60day timeframe for health plans (3) retain
the provision generally to require healthplans to provide notice within 60 daysof a material revision but provide that
the Secretary will waive the 60-day
timeframe in cases where the timing or
substance of modifications to thePrivacy Rule call for such a waiver; or(4) make no change and thus, requirethat health plans that perform

PO 00000

Frm 00059

Fmt 4701

Sfmt 4700

5623

underwriting provide notice toindividuals within 60 days of thematerial change to the NPP that would
be required by this proposed rule. The
Department requested comment onthese options, as well as any otheroptions for informing individuals in atimely manner of material changes to
the NPP.
Section 164.520(c)(2)(iv) requires thatwhen a health care provider with adirect treatment relationship with anindividual revises the NPP, the healthcare provider must make the NPP
available upon request on or after theeffective date of the revision and mustcomply with the requirements of§ 164.520(c)(2)(iii) to have the NPP
available at the delivery site and to post
the notice in a clear and prominent
location. We did not propose changes tothese provisions because we did not
believe these requirements to be overly
burdensome but we requested commenton the issue.
Overview of Public Comments
We received several comments
expressing support for the proposed
requirement that the NPP include astatement about the uses anddisclosures that require authorization.
However, other commenters opposed
this requirement, arguing that because
not all uses and disclosures will apply
to every individual, the statement willcause confusion and unnecessary
concern. Additionally, thesecommenters argued that the cost oflisting all of the situations requiring
authorization would be significant.
We received several comments insupport of the proposed requirementthat the NPP include a specificstatement about authorization for usesand disclosures of psychotherapy notes.
Some of these commenters requested
that the final rule require covered
providers to describe in their NPPs theirrecordkeeping practices with regard to
psychotherapy notes and how thosepractices affect what information can beused and disclosed. Several commentersargued that only covered entities thatrecord psychotherapy notes should be
required to include a statement about
the authorization requirement forpsychotherapy notes in their NPPs.
We also received several comments
expressing concern regarding the
proposed requirement to include
information in the NPP about theindividual’s right to opt out of receiving
certain communications. These
commenters argued that information
notifying individuals that they could
opt out of receiving further subsidized
treatment or fundraisingcommunications would provide little

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5624

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

value to individuals at a significant costto covered entities. These commenters
felt that including this information
would be unnecessary because all
subsidized treatment and fundraisingcommunications themselves will
include an opt-out mechanism, and assuch, including the information in the
NPP may cause unnecessary concern for
consumers.
We received one comment in supportof the requirement to include in the NPP
a statement about an individual’s rightto restrict certain uses and disclosuresof protected health information if theindividual pays for treatment or services
out-of-pocket in full. We also received
one comment suggesting that only
health care providers should be required
to include such a statement in their
NPP.
We received a number of comments
supporting a requirement to include astatement in the NPP about the right tobe notified following a breach of
unsecured protected health information.
One commenter suggested that
explaining breach notification
requirements in the NPP would help
entities handle customer service issues
that arise when customers become upset
upon receipt of such a breach
notification. However, a number ofother commenters expressed opposition
to this proposal due to concern thatsuch a statement would cause
unnecessary concern and fear amongindividuals who may believe thatcovered entities cannot appropriately
secure their protected healthinformation. Finally, we received one
comment requesting that HHS specify
the required elements of a breach
notification statement for a NPP.
We also received several comments
arguing that the proposed changes
should not constitute material changes
to privacy practices requiring a new
NPP, particularly where covered entities
have already revised their NPPs tocomply with the HITECH Act or Statelaw requirements. Two additionalcommenters argued that each covered
entity should determine whether achange is material or not, depending on
its existing privacy practices.
We received a number of comments
regarding the appropriate timing andmanner for distributing new NPPs. The
majority of the comments received
generally fell into three categories: (1)Support for a requirement to revise anddistribute notices within 60 days of amaterial change; (2) a recommendationfor HHS to require that covered entities
promptly post a revised NPP on their
Web site in conjunction with arequirement to send a notice of thechange by mail within a specified

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

period; and (3) a request for HHS toextend the compliance deadline andpermit the distribution of the revised
NPP through a quarterly newsletter,annual mailing, after 18 months oftransition, or in a triennial mailing. In
addition, many commenters supported
electronic distribution of an NPP or a
notice of material changes to the NPP.
While not proposed, somecommenters suggested eliminating oralternatives to the current requirements
for health care providers with direct
treatment relationships to hand the NPP
to every individual patient and make agood faith attempt to obtainacknowledgement of receipt.
A few commenters also expressed
concern regarding the cost burden
associated with revising anddistributing a new NPP. One commenterargued that considerations of cost do notjustify a delay in distributing a revised
NPP.
Final RuleFirst, the final rule adopts themodification to § 164.520(b)(1)(ii)(E),
which requires certain statements in the
NPP regarding uses and disclosures that
require authorization. We note that,
contrary to some commenter concerns,
the final rule does not require the NPP
to include a list of all situations
requiring authorization. Instead, the
NPP must contain a statement
indicating that most uses anddisclosures of psychotherapy notes(where appropriate), uses anddisclosures of protected healthinformation for marketing purposes, anddisclosures that constitute a sale ofprotected health information requireauthorization, as well as a statementthat other uses and disclosures notdescribed in the NPP will be made onlywith authorization from the individual.
The final rule does not require the
NPP to include a description of acovered entity’s recordkeeping practices
with respect to psychotherapy notes;
however, covered entities are free toinclude such additional information in
their NPP if they choose. Additionally,in response to requests by somecommenters, we clarify that covered
entities that do not record or maintain
psychotherapy notes are not required toinclude a statement in their NPPs about
the authorization requirement for usesand disclosures of psychotherapy notes.
Second, because the final rule treats
all subsidized treatmentcommunications as marketing
communications, we have not adopted
the proposal to require a statement in
the NPP about such communications
and the ability of an individual to opt
out. For further discussion on the

PO 00000

Frm 00060

Fmt 4701

Sfmt 4700

decision to treat all subsidized
treatment communications as marketing
communications requiring an
authorization, please see the above
discussion regarding § 164.501.
The final rule, however, adopts the
proposed requirement for a statement in
the NPP regarding fundraisingcommunications and an individual’s
right to opt out of receiving such
communications, if a covered entity
intends to contact an individual to raise
funds for the covered entity. Because
individuals will be provided theopportunity to opt out of fundraisingcommunications with each solicitation,
the final rule does not require the NPP
to include the mechanism forindividuals to opt out of receiving
fundraising communications, although
covered entities are free to include suchinformation if they choose to do so.
The final rule also adopts the
proposal that the NPP inform
individuals of their new right to restrictcertain disclosures of protected healthinformation to a health plan where theindividual pays out of pocket in full forthe health care item or service. Only
health care providers are required toinclude such a statement in the NPP;
other covered entities may retain theexisting language indicating that acovered entity is not required to agree
to a requested restriction.
The final rule also requires covered
entities to include in their NPP a
statement of the right of affectedindividuals to be notified following abreach of unsecured protected healthinformation. We believe that individuals
should be informed of their right toreceive and the obligations of covered
entities to provide notification following
a breach. We disagree with thecommenters who argued that such astatement would cause individuals
unnecessary concern and would create
unfounded fear that covered entities
cannot appropriately secure protected
health information. Such advance noticeof their rights should provide helpful
context for individuals should they later
receive a breach notification. In
response to comments, we also clarify
that a simple statement in the NPP thatan individual has a right to or will
receive notifications of breaches of hisor her unsecured protected healthinformation will suffice for purposes ofthis requirement. We do not intend forthis requirement to add undue
complexity or length to a covered
entity’s NPP. Thus, the statement neednot be entity-specific, such as bydescribing how the covered entity willconduct a risk assessment, include theregulatory descriptions of ‘‘breach’’ or‘‘unsecured PHI,’’ or describe the types

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulationsof information to be provided in theactual breach notification to theindividual. However, covered entities
that wish to include additional or moredetailed information may do so.
These changes represent materialchanges to the NPP of covered entities.
We disagree with the few commenters
who argued that such modifications to§ 164.520 do not constitute materialchanges of privacy practices requiring
the distribution of new NPPs. The
modifications to § 164.520 are
significant and are important to ensurethat individuals are aware of the
HITECH Act changes that affect privacy
protections and individual rights
regarding protected health information.
Section 164.520(c)(1) of the final rule
requires a health plan that currently
posts its NPP on its Web site inaccordance with § 164.520(c)(3)(i) to: (1)Prominently post the material change or
its revised notice on its web site by theeffective date of the material change tothe notice (e.g., the compliance date ofthis final rule) and (2) provide therevised notice, or information about thematerial change and how to obtain therevised notice, in its next annual
mailing to individuals then covered by
the plan, such as at the beginning of theplan year or during the open enrollment
period. Health plans that do not havecustomer service web sites are required
to provide the revised NPP, orinformation about the material change
and how to obtain the revised notice, toindividuals covered by the plan within
60 days of the material revision to thenotice. These requirements apply to allmaterial changes including, whereapplicable, the rule change adopted
pursuant to GINA to prohibit mosthealth plans from using or disclosing
genetic information for underwriting
purposes.
We believe these distribution
requirements best balance the right ofindividuals to be informed of theirprivacy rights with the burden on healthplans to provide the revised NPP. We
also note that health plans should
provide both paper- and web-based
notices in a way accessible to all
beneficiaries, including thoseindividuals with disabilities. These
modifications provide an avenue for anindividual to be informed of materialchanges upon their effective date while
better aligning the NPP distribution
with health plans’ normal mailings toindividuals.
For health care providers, the final
rule does not modify the current
requirements to distribute revisions to
the NPP. As such, § 164.520(c)(2)(iv)
requires that when a health careprovider with a direct treatment

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

relationship with an individual revises
the NPP, the health care provider must
make the NPP available upon request on
or after the effective date of the revisionand must comply with the requirementsof § 164.520(c)(2)(iii) to have the NPP
available at the delivery site and to post
the notice in a clear and prominent
location. In response to several
comments expressing concern about
printing costs for new NPPs, we clarify
that providers are not required to print
and hand out a revised NPP to allindividuals seeking treatment; providers
must post the revised NPP in a clear andprominent location and have copies of
the NPP at the delivery site forindividuals to request to take with them.
Providers are only required to give a
copy of the NPP to, and obtain a goodfaith acknowledgment of receipt from,new patients. As a result, we do notbelieve that the current requirement isoverly burdensome to providers, nor isit overly costly. We also clarify thatwhile health care providers are required
to post the NPP in a clear andprominent location at the delivery site,
providers may post a summary of thenotice in such a location as long as thefull notice is immediately available(such as on a table directly under theposted summary) for individuals to pickup without any additional burden on
their part. It would not be appropriate,however, to require the individual tohave to ask the receptionist for a copyof the full NPP.
To the extent that some covered
entities have already revised their NPPs
in response to the enactment of the
HITECH Act or State law requirements,
we clarify that as long as a covered
entity’s current NPP is consistent withthis final rule and individuals have been
informed of all material revisions madeto the NPP, the covered entity is not
required to revise and distribute another
NPP upon publication of this final rule.
Finally, we note that to the extent a
covered entity is required to comply
with Section 504 of the Rehabilitation
Act of 1973 or the Americans with
Disabilities Act of 1990, the covered
entity has an obligation to take steps
that may be necessary to ensure
effective communication withindividuals with disabilities, which
could include making the revised NPPor notice of material changes to the NPP
available in alternate formats, such as
Braille, large print, or audio.
Response to Other Public Comments
Comment: One commenter expressed
concern about the addition of more
information to the NPP when it isalready very long and complex, while
several commenters recommended that

PO 00000

Frm 00061

Fmt 4701

Sfmt 4700

5625

the final rule require NPPs to be
shortened, simplified, and written in aclear, easily understandable manner. In
addition, while a few commenterssuggested that HHS provide a sample or
standard NPP, many more commenters
requested flexibility in developing thecontent of their respective NPPs.
Response: We believe that theadditions to the NPP required by the
final rule are necessary to fully inform
individuals of the covered entity’s
privacy practices and their rights. The
NPP should be provided in a clear,concise, and easy to understandmanner, and we clarify that covered
entities may use a ‘‘layered notice’’ toimplement the Rule’s provisions, solong as the elements required at§ 164.520(b) are included in the
document that is provided for theindividual. For example, a covered
entity may satisfy the NPP provisions byproviding the individual with both ashort notice that briefly summarizes theindividual’s rights, as well as otherinformation, and a longer notice,layered beneath the short notice that
contains all the elements required by
the Rule. Additionally, the Privacy Rulerequires that the NPP be written in plain
language, and we note that somecovered entities may have obligations
under other laws with respect to theircommunication with affectedindividuals. For example, to the extent
a covered entity is obligated to comply
with Title VI of the Civil Rights Act of1964, the covered entity must takereasonable steps to ensure meaningfulaccess for Limited English Proficientpersons to the services of the covered
entity, which could include translating
the NPP into frequently encounteredlanguages. In addition, we agree withthe commenters who suggested thatcovered entities have flexibility anddiscretion to determine how to draft andprepare their NPPs. Because each NPP
will vary based on the functions of theindividual covered entity, there is no‘‘one size fits all’’ approach. However,
we continue to explore options formaking model or best practice language
available.
Comment: One commenter requested
elimination of the requirement thatcovered entities obtain agreement fromindividuals (an opt in) before electronic
distribution while another commenter
requested that HHS clarify that acovered entity may obtain an electronic
agreement from an individual to receive
an NPP electronically.
Response: The Privacy Rule permits
covered entities to distribute their NPPs
or notices of material changes by email,provided the individual has agreed toreceive an electronic copy. Although

E:\FR\FM\25JAR2.SGM

25JAR2

5626

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

internet access is a convenience of daily
life for many individuals, maintaining
the opt-in requirement ensures that
individuals who are not able to or
choose not to receive informationelectronically are fully informed of how
their protected health information is
being used and disclosed and of theirindividual rights with respect to thisinformation. We clarify that agreement
to receive electronic notice can beobtained electronically pursuant to therequirements at § 164.520(c)(3).

sroberts on DSK5SPTVN1PROD with

9. Section 164.522(a)—Right To Request
a Restriction of Uses and Disclosures
Section 164.522(a) of the Privacy Rulerequires covered entities to permit
individuals to request that a covered
entity restrict uses or disclosures of
their protected health information fortreatment, payment, and health care
operations purposes, as well as fordisclosures to family members andcertain others permitted under§ 164.510(b). While covered entities are
not required to agree to such requests
for restrictions, if a covered entity does
agree to restrict the use or disclosure of
an individual’s protected healthinformation, the covered entity mustabide by that restriction, except inemergency circumstances when theinformation is required for the treatmentof the individual. Section 164.522 also
includes provisions for the terminationof such a restriction and requires thatcovered entities that have agreed to a
restriction document the restriction inwriting.
Proposed Rule
Section 13405(a) of the HITECH Act
sets forth certain circumstances inwhich a covered entity now mustcomply with an individual’s request for
restriction of disclosure of his or her
protected health information.
Specifically, section 13405(a) of the
HITECH Act requires that when an
individual requests a restriction on
disclosure pursuant to § 164.522, thecovered entity must agree to therequested restriction unless thedisclosure is otherwise required by law,
if the request for restriction is on
disclosures of protected healthinformation to a health plan for the
purpose of carrying out payment or
health care operations and if therestriction applies to protected healthinformation that pertains solely to ahealth care item or service for which thehealth care provider has been paid outof pocket in full.
To implement section 13405(a) of the
HITECH Act, we proposed a number ofchanges to the Privacy Rule’s provisions
regarding an individual’s right to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

request restrictions of certain uses anddisclosures. First, we proposed at§ 164.522(a)(1)(vi) to require a covered
entity to agree to a request by anindividual to restrict the disclosure ofprotected health information about theindividual to a health plan if: (A) the
disclosure is for the purposes ofcarrying out payment or health care
operations and is not otherwise requiredby law; and (B) the protected healthinformation pertains solely to a healthcare item or service for which theindividual, or person on behalf of theindividual other than the health plan,
has paid the covered entity in full. In
recognition that there are many
situations in which family members orother persons may pay for theindividual’s treatment, we proposed toinclude language to the provision toensure that this requirement not belimited to solely the individual paying
for the health care item or service but
would also include payment made byanother person, other than the healthplan, on behalf of the individual.
We proposed to modify§ 164.522(a)(1)(ii), which states that acovered entity is not required to agree
to a restriction, to refer to this exception
to that general rule. We noted in the
NPRM that in cases where an individual
has exercised his or her right to restrict
disclosure to a health plan under theabove circumstances, the covered entity
is also prohibited from making suchdisclosures to a business associate of thehealth plan, because a covered entity
may only disclose protected healthinformation to a business associate ofanother covered entity if the disclosure
would be permitted directly to the othercovered entity. We also proposed
conforming modifications to§ 164.522(a)(2) and (3) regarding
terminating restrictions anddocumentation of restrictions to reflect
these new requirements, and to makeclear that, unlike other agreed torestrictions, a covered entity may notunilaterally terminate a required
restriction to a health plan under§ 164.522(a)(1)(ii).
We provided a number ofclarifications, and solicited publiccomment on a number of issues,
regarding these proposed provisions, as
follows. We stated that we interpret
section 13405(a) as giving the individuala right to determine for which healthcare items or services the individual
wishes to pay out of pocket and restrict.
Thus, section 13405(a) would not
permit a covered entity to require
individuals who wish to restrict
disclosures about only certain healthcare items or services to a health plan
to restrict disclosures of protected

PO 00000

Frm 00062

Fmt 4701

Sfmt 4700

health information regarding all healthcare to the health plan. We requested
comment on the types of treatment
interactions between individuals andcovered entities that would make
implementing a restriction moredifficult and ways to address suchdifficult situations, such as where an
individual wishes to restrict a
disclosure regarding a prescription to ahealth plan but because the provider
electronically sends prescriptions to thepharmacy to be filled, the pharmacy
may have already billed the health planby the time the patient arrives at thepharmacy. We requested comment
generally on whether covered healthcare providers that know of a restriction
should inform other health careproviders downstream of such
restriction, including pharmacies, andwhether technology could facilitatesuch notification. We requested
comment on examples of the types of
disclosures that may fall under this‘‘required by law’’ exception. With
respect to an individual, or someone on
behalf of the individual, paying out of
pocket for the health care item orservice, we noted that the individual
should not expect that this payment
would count towards the individual’sout of pocket threshold with respect tohis or her health plan benefits. We
requested comment on how thisprovision will function with respect toHMOs, given our understanding that
under most current HMO contracts with
providers an individual could not pay
the provider in full for the treatment orservice received. We clarified in the
NPRM that if an individual’s out of
pocket payment for a health care item orservice is not honored (e.g., theindividual’s check bounces), thecovered entity is not obligated tocontinue to abide by the requested
restriction because the individual has
not fulfilled the requirements necessary
to obtain the restriction. Additionally,
we stated our expectation in such casesthat covered entities make some attempt
to resolve any payment issues with theindividual prior to sending theprotected health information to thehealth plan, such as by notifying theindividual that his or her payment did
not go through and giving the individual
an opportunity to submit payment andrequesting comment on the extent towhich covered entities must makereasonable efforts to secure payment
from the individual prior to billing thehealth plan. We requested comment on
the scope of a restriction and in whatcircumstances it should apply to a
subsequent, but related, treatment

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
encounter, such as follow-up care fortreatment of a particular condition.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
We received many comments on these
proposed provisions and our questions
as to how they should apply. A numberof commenters generally supported theprovisions as being an important rightfor health care consumers. However,many commenters expressed concernswith these new requirements. Many
commenters raised concerns with, andrequested guidance on, how to
operationalize a restriction. Several
commenters were concerned withhaving to create separate records toensure that restricted data is not
inadvertently sent to or accessible by
the health plan or to manually redact
information from the medical record
prior to disclosure to a health plan.
Commenters argued that having tosegregate restricted and unrestricted
information or redact restricted
information prior to disclosure would
be burdensome as such a process would
generally have to occur manually, andmay result in difficulties with ensuringthat treating providers continue to haveaccess to the entire medical record.
Some commenters were concerned
specifically with having to manuallyredact or create separate records prior toa health plan audit, or otherwise withwithholding information from a plan
during an audit, to ensure a health plan
would not see restricted information.
With respect to the exception to a
restriction for disclosures that are
required by law, several commenters
supported this exception but requested
clarification on how such an exception
would affect providers’ existing legal
obligations. Many commenterssuggested that providers would beprohibited from receiving cash payment
from individuals for items or services
otherwise covered by State or Federally
funded programs, such as Medicare andMedicaid, and thus, requested that
disclosures to such State or Federally
funded programs not be eligible forrestriction. Similarly, some commenterssought clarification on the effect of thisprovision where certain State laws
prohibit ‘‘balance billing,’’ making it
illegal for the provider to bill the patient
for any covered services over and above
any permissible copayment,coinsurance or deductible amounts.
Some commenters asked that we clarify
that the ‘‘required by law’’ exception
allows providers to disclose protected
health information subject to a
restriction for Medicare and Medicaid
audits, because those insurers requirecomplete, accurate records for audits.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Other commenters were concernedwith applying a restriction to only
certain health care items or services
provided during a single patientencounter or visit. Commenters argued
that split billing is not possible for mostproviders or that it may be obvious toa health plan if one item or service outof a bundle is restricted and thatunbundling services may be costly. One
commenter suggested that individuals
should only be able to restrict certain
types of services/treatment (e.g.,cosmetic surgery and family planning
services) as such services are moreeasily segregable from other health careservices.
In response to our question regarding
available electronic methods throughwhich a prescribing provider could alerta pharmacy that an individual intends
to pay out of pocket for a prescription
and restrict disclosure to a health plan,commenters indicated they weregenerally unaware of any system thatwould alert a pharmacy of restrictions
electronically, and many agreed that thecost and burden of flagging records
manually would not be feasible for all
covered entities. In general, commenters
agreed that paper prescriptions would
provide individuals with an opportunity
to request a restriction when they arriveat the pharmacy. However, commenters
also noted that returning to the use of
paper prescriptions over electronicprescribing would be a step in thewrong direction, as there are many
benefits to electronic prescribing, and it
is important not to limit these benefits.
Almost all of the comments we
received regarding the obligation
generally of health care providers thatknow of a restriction to informdownstream health care providers of therestriction argued that it should be theindividual’s and not the provider’s
responsibility to inform downstream
providers of any requested restriction.
While a few commenters stated that theprovider should bear this responsibility,
the majority believed that this obligation
would be difficult and burdensome fora provider. Some commenters
acknowledged that in time, moreadvanced electronic and automatedsystems may allow providers to notify
other providers downstream of a
restriction, but these commentersstressed that such systems are notwidely available at this time.
With respect to the requirement’s
application to health care providers
providing care within an HMO context,
many commenters expressed support forthe suggestion that HMO patients would
have to use an out-of-network provider
for treatment to ensure that the
restricted information would not be

PO 00000

Frm 00063

Fmt 4701

Sfmt 4700

5627

disclosed to the HMO. Some
commenters indicated that State laws
and/or provider contracts with an HMO
may prohibit the provider fromreceiving a cash payment from an HMO
patient above the patient’s cost-sharing
amount for the health care item orservice. Conversely, some commentersstated that individuals should not haveto go out-of-network when requesting a
restriction and instead, providers could
and should treat the services as noncovered services and accept payment
directly from the patient. Several
commenters also suggested thatmanaged care contracts would have tobe revised or renegotiated in order tocomply with this provision and as such,ample time for renegotiation should be
provided.
Commenters generally supported thelanguage in the proposed rule making
clear that a restriction would apply
where an individual requests a
restriction, but someone other than theindividual (other than the health plan),such as a family member, pays for theindividual’s care on behalf of theindividual. One commenter asked forclarification that payment by any healthplan would not constitute payment outof pocket by the individual. The
commenter stated that such clarification
was necessary to avoid the situation
where an individual has coverage undermultiple plans, pays for care with asecondary plan, requests a restriction on
disclosure to the primary plan, and thenthe secondary plan proceeds to obtainreimbursement from the primary plan
disclosing the protected healthinformation at issue. Anothercommenter asked that we clarify that aclinical research participant whose
health care services are paid for by aresearch grant can still qualify for a
restriction to the individual’s healthplan.
Most commenters supported nothaving to abide by a requested
restriction in cases where theindividual’s method of payment isreturned or otherwise does not go
through. A few commenters suggested
that a covered entity should include
information to this effect in its notice ofprivacy practices. A number ofcommenters expressed concern with theability of a provider to bill a health planfor services following an individual’s
inability to pay. For example, a provider
may find it difficult to be reimbursed forservices if the provider did not obtain
the plan’s required pre-certification forservices because the individual initiallyagreed to pay out of pocket for theservices.
Several commenters asked for
guidance on what constitutes a

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5628

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations‘‘reasonable effort’’ to obtain payment
from an individual prior to billing ahealth plan for health care services
where an individual’s original form of
payment fails, and argued that the effort
required should not be too burdensome
on providers. A number of commenterssuggested various alternatives. A few
commenters suggested that providers
should be able to set a deadline forpayment and then bill the plan if thepatient fails to pay; others requested
that the regulation set a specifictimeframe in which providers must be
paid or the requested restriction is
terminated. Some commenterssuggested that a ‘‘reasonable effort’’should be based upon a covered entity
making one or two attempts to contact
the patient and obtain payment.
Another commenter recommended thatreasonable efforts should require theprovider to make a good faith effort toobtain payment based on their usual
debt collection practices. Other
commenters requested clarification thatreasonable efforts would not require a
provider sending a bill to a collection
agency. Some commenters weregenerally concerned with requiring aprovider to wait too long for payment,
as the provider could risk the plan not
paying for the treatment if it is billed toolate. Certain commenters argued thatproviders should not have to engage inany attempts to resolve payment issues
if an individual’s payment fails prior tobilling the health plan for the services.
Finally, a number of commenters asked
whether a provider could require
payment in full at the time of therequest for a restriction to avoid
payment issues altogether.
Finally, many commenters responded
to the NPRM’s approach to follow-up
care. The majority of commenters
supported the idea that if an individual
does not request a restriction and pay
out of pocket for follow up care, thenthe covered entity may disclose theprotected health information necessary
to obtain payment from the health planfor such follow up care, recognizing thatsome of the protected healthinformation may relate to and/orindicate that the individual received theunderlying health care item or service towhich a restriction applied. A few
commenters asked whether individual
authorization would be required todisclose previously restricted protected
health information to a health plan if
the individual does not want to restrict
the follow up care. A number ofcommenters expressed support forproviders counseling patients on theconsequences of not restricting followup care. A few commenters were

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

concerned as to how a provider would
know when such counseling wasneeded and what it should include, andasked whether giving the individual awritten statement explaining theconsequences would suffice.
Final Rule
We adopt the modifications to§ 164.522 as proposed in the NPRM to
implement section 13405(a) of the
HITECH Act. In response to questions
and comments regarding how to
operationalize these requirements, we
provide the following clarifications. We
clarify that these provisions do not
require that covered health careproviders create separate medical
records or otherwise segregate protected
health information subject to a restricted
health care item or service. Covered
health care providers will, however,need to employ some method to flag or
make a notation in the record withrespect to the protected healthinformation that has been restricted toensure that such information is not
inadvertently sent to or made accessible
to the health plan for payment or healthcare operations purposes, such as audits
by the health plan. Covered entities
should already have in place, and thus
be familiar with applying, minimum
necessary policies and procedures,
which require limiting the protected
health information disclosed to a healthplan to the amount reasonably necessary
to achieve the purpose of the disclosure.
Thus, covered entities should alreadyhave mechanisms in place toappropriately limit the protected healthinformation that is disclosed to a healthplan.
With respect to commenters who wereconcerned about providers being able tocontinue to meet their legal obligations,such as disclosing protected healthinformation to Medicare or Medicaid forrequired audits, we note that the statuteand final rule continue to allow
disclosures that are otherwise requiredby law, notwithstanding that anindividual has requested a restriction onsuch disclosures. Thus, a covered entity
may disclose the protected healthinformation necessary to meet therequirements of the law. Under thePrivacy Rule, ‘‘required by law’’ isdefined at § 164.103 as a mandate
contained in law that compels a covered
entity to make a use or disclosure ofprotected health information and that is
enforceable in a court of law. For
purposes of this definition, ‘‘required bylaw’’ includes Medicare conditions ofparticipation with respect to health careproviders participating in the program,and statutes and regulations that require
the production of information if

PO 00000

Frm 00064

Fmt 4701

Sfmt 4700

payment is sought under a government
program providing public benefits.
Therefore, if a covered entity is requiredby law to submit protected healthinformation to a Federal health plan, it
may continue to do so as necessary tocomply with that legal mandate. With
respect to commenters’ concerns withprohibitions in State law and under
Medicare and Medicaid that prevent
providers from billing, and receiving
cash payment from, an individual forcovered services over and above any
permissible cost sharing amounts, we
provide the following guidance. If a
provider is required by State or otherlaw to submit a claim to a health plan
for a covered service provided to theindividual, and there is no exception orprocedure for individuals wishing to
pay out of pocket for the service, thenthe disclosure is required by law and is
an exception to an individual’s right torequest a restriction to the health planpursuant to § 154.522(a)(1)(vi)(A) of theRule. With respect to Medicare, it is ourunderstanding that when a physician or
supplier furnishes a service that iscovered by Medicare, then it is subject
to the mandatory claim submission
provisions of section 1848(g)(4) of theSocial Security Act (the Act), which
requires that if a physician or suppliercharges or attempts to charge abeneficiary any remuneration for aservice that is covered by Medicare,then the physician or supplier must
submit a claim to Medicare. However,there is an exception to this rule wherea beneficiary (or the beneficiary’s legal
representative) refuses, of his/her own
free will, to authorize the submission ofa bill to Medicare. In such cases, aMedicare provider is not required tosubmit a claim to Medicare for thecovered service and may accept an outof pocket payment for the service fromthe beneficiary. The limits on what theprovider may collect from thebeneficiary continue to apply to charges
for the covered service, notwithstanding
the absence of a claim to Medicare. See
the Medicare Benefit Policy Manual,Internet only Manual pub. 100–2, ch.
15, sect. 40, available at http://
www.cms.gov/manuals/Downloads/
bp102c15.pdf. Thus, if a Medicare
beneficiary requests a restriction on thedisclosure of protected healthinformation to Medicare for a covered
service and pays out of pocket for theservice (i.e., refuses to authorize thesubmission of a bill to Medicare for theservice), the provider must restrict thedisclosure of protected healthinformation regarding the service to
Medicare in accordance with§ 164.522(a)(1)(vi).

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Certain commenters raised concernswith an individual requesting a
restriction with respect to only one ofseveral health care items or services
provided in a single patient encounter,and a provider being prohibited fromunbundling, or it being more costly tounbundle, the services for purposes ofbilling a health plan. In such cases, we
expect providers to counsel patients on
the ability of the provider to unbundle
the items or services and the impact of
doing so (e.g., the health plan still may
be able to determine that the restricted
item or service was performed based on
the context). If a provider is able tounbundle the items or services andaccommodate the individual’s wishes
after counseling the individual on theimpact of unbundling, it should do so.
If a provider is not able to unbundle agroup of items or services, the provider
should inform the individual and givethe individual the opportunity torestrict and pay out of pocket for theentire bundle of items or services.
Where a provider is not able tounbundle a group of bundled items orservices, we view such group ofbundled items or services as one item orservice for the purpose of applying§ 164.522(a)(1)(v). However, we would
expect a provider to accommodate anindividual’s request for a restriction forseparable and unbundled health care
items or services, even if part of thesame treatment encounter, such as in
the prior example with respect to thepatient receiving both treatment forasthma and diabetes. Thus, we decline
to provide as a general rule that anindividual may only restrict either all ornone of the health care items or services
that are part of one treatment encounter.
In response to the question we posedin the NPRM regarding methods throughwhich a provider could electronically(such as through an e-prescribing tool)
notify a pharmacist of an individual’s
restriction request, the majority ofcommenters indicated that there
currently is not a widely available
method for electronically notifying apharmacy that a patient has requested a
restriction. Further, commentersgenerally argued that it would be costly,burdensome, and unworkable for aprovider to attempt to notify all
subsequent providers of an individual’s
restriction request, particularly given
the lack of automated tools to makesuch notifications, and thus, it should
remain the obligation of the individual
to notify downstream providers if theindividual wants to restrict protected
health information to a health plan. We
agree that it would be unworkable atthis point, given the lack of automated

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

technologies to support such arequirement, to require health careproviders to notify downstream
providers of the fact that an individual
has requested a restriction to a healthplan. However, we do encourage
providers to counsel patients that theywould need to request a restriction andpay out of pocket with other providers
for the restriction to apply to thedisclosures by such providers. In thecase of an individual who wants torestrict disclosures to a health plan
concerning a prescribed medication, theprescribing provider can provide thepatient with a paper prescription toallow the individual an opportunity torequest a restriction and pay for theprescription with the pharmacy before
the pharmacy has submitted a bill to thehealth plan. However, while we do not
require it, providers are permitted andencouraged to assist individuals as
feasible in alerting downstream
providers of the individual’s desire to
request a restriction and pay out of
pocket for a particular health care itemor service.
For example, consider an individual
who is meeting with her primary
physician and requests a restriction on
tests that are being administered todetermine if she has a heart condition.
If, after conducting the tests, thepatient’s primary physician refers thepatient to a cardiologist, it is thepatient’s obligation to request a
restriction from the subsequent
provider, the cardiologist, if she wishes
to pay out of pocket rather than have herhealth plan billed for the visit. Although
the primary physician in this example
would not be required to alert the
cardiologist of the patient’s potential
desire to request a restriction, we
encourage providers to do so if feasible
or in the very least, to engage in a
dialogue with the patient to ensure thathe or she is aware that it is the patient’s
obligation to request restrictions from
subsequent providers. In response tocommenters who were confused about
whether the individual or the provider
would have the obligation of notifying
subsequent providers when a Health
Information Exchange is involved, weclarify that the responsibility to notify
downstream providers of a restriction
request in this situation also remains
with the individual, and not theprovider.
With respect to HMOs, we clarify thata provider providing care in such asetting should abide by an individual’srequested restriction unless doing sowould be inconsistent with State orother law. Thus, if a provider within an
HMO is prohibited by law fromaccepting payment from an individual

PO 00000

Frm 00065

Fmt 4701

Sfmt 4700

5629

above the individual’s cost-sharing
amount (i.e., the provider cannot accept
an out of pocket payment from theindividual for the service), then theprovider may counsel the individualthat he or she will have to use an outof-network provider for the health care
item or service in order to restrict thedisclosure of protected healthinformation to the HMO for the healthcare. Providers operating within an
HMO context and who are able under
law to treat the health care services towhich the restriction would apply as
out-of-network services should do so inorder to abide by the requested
restriction. We would not consider acontractual requirement to submit aclaim or otherwise disclose protected
health information to an HMO toexempt the provider from his or her
obligations under this provision.
Further, the final rule provides a 180day compliance period beyond theeffective date of these revisions to thePrivacy Rule, during which provider
contracts with HMOs can be updated asneeded to be consistent with these newrequirements.
As proposed in the NPRM, under the
final rule, a covered entity must apply
a restriction not only where an
individual pays in full for the healthcare
item or service, but also where a family
member or other person pays for theitem or service on behalf of theindividual. We decline to modify theregulation, as suggested by one
commenter, to provide that payment
from ‘‘any’’ health plan, rather than the
one to which the disclosure is restricted,
should not constitute payment on behalfof the individual. In response to thecommenter’s concern about difficulties
in coordination of benefits forindividuals with coverage undermultiple plans, we note that thisprovision does not impede a healthplan’s ability to disclose protected
health information as necessary toanother health plan for coordination of
benefits. Thus, health plans may
continue to make such disclosures.
Many commenters supported thediscussion in the NPRM regarding not
abiding by a restriction if an
individual’s payment is dishonored. Insuch cases, we continue to expect thatproviders will make a reasonable effort
to contact the individual and obtain
payment prior to billing a health plan.
We do not prescribe the efforts a healthcare provider must make but leave thatup to the provider’s policies andindividual circumstances. While we
require the provider to make areasonable effort to secure payment
from the individual, this requirement is
not intended to place an additional

E:\FR\FM\25JAR2.SGM

25JAR2

5630

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withburden on the provider but is instead
intended to align with its current
policies for contacting individuals to
obtain an alternative form of payment to
one that was dishonored. We do not
require that the individual’s debt beplaced in collection before a provider ispermitted to bill a health plan for thehealth care services. Further, a provider
may choose to require payment in fullat the time of the request for a
restriction to avoid payment issues
altogether. Similarly, where
precertification is required for a healthplan to pay for services, a provider may
require the individual to settle
payments for the care prior to providing
the service and implementing a
restriction to avoid the situation where
the provider is unable to be reimbursed
by either the individual or the healthplan.
We also recognize that a provider may
not be able to implement a restriction
where an individual waits until care has
been initiated to make such a request,
such as in the case of a hospital stay, inwhich case the individual’s protected
health information may have alreadybeen disclosed to the health plan.
With respect to restrictions andfollow-up care, we continue to maintainthe approach discussed in the NPRM. If
an individual has a restriction in placewith respect to a health care service but
does not pay out of pocket and request
a restriction with regard to follow-up
treatment, and the provider needs toinclude information that was previously
restricted in the bill to the health planin order to have the service deemed
medically necessary or appropriate,
then the provider is permitted todisclose such information so long as
doing so is consistent with theprovider’s minimum necessary policies
and procedures. We also clarify thatsuch a disclosure would continue to bepermitted for payment purposes andthus, would not require the individual’s
written authorization. However, as we
did in the NPRM, we highly encouragecovered entities to engage in open
dialogue with individuals to ensure thatthey are aware that previously restricted
protected health information may bedisclosed to the health plan unless they
request an additional restriction and pay
out of pocket for the follow-up care.
Response to Other Public Comments
Comment: Several commenters asked
that the provision be limited to justproviders and not to covered entities ingeneral. Commenters also asked forclarification on whether the restriction
prohibits providers from giving
protected health information to healthplans solely for payment or health care

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

operations purposes in such cases or all
entities that may receive protected
health information for payment or
health care operations.
Response: We clarify that thisprovision, in effect, will apply only tocovered health care providers. However,the provisions of § 164.522(a) apply tocovered entities generally and thus, wedecline to alter the regulatory text. In
response to commenters’ concerns
regarding disclosure for payment or
health care operations purposes toentities other than the health plan, weclarify that this provision does not affectdisclosures to these other entities aspermitted by the Privacy Rule.
Comment: Commenters asked what
the liability is for a provider who
discloses restricted protected healthinformation to a plan.
Response: A provider who discloses
restricted protected health information
to the health plan is making a disclosurein violation of the Privacy Rule and the
HITECH Act, which, as with otherimpermissible disclosures is subject tothe imposition of possible criminal
penalties, civil money penalties, orcorrective action.
Comment: Several commenters asked
that we clarify that the ‘‘required bylaw’’ exception allows providers to
respond to subpoenas, court orders, andjudicial proceedings.
Response: The ‘‘required by law’’
exception in § 164.522(a)(1)(vi) does
allow health care providers to respondto court orders and subpoenas issued bya court requiring disclosure of protected
health information to a health plan. See
the definition of ‘‘required by law’’ at§ 164.103. Further, § 164.522(a)(1)(vi)
does not affect the disclosure ofprotected health information to entities
that are not health plans and thus,
disclosures to these other entities madeas required by law, for judicial andadministrative proceedings, or for law
enforcement activities in accordancewith §§ 164.512(a), 164.512(e), and164.512(f), respectively, continue to bepermitted.
Comment: Several commenterssuggested that the final rule be written
to ensure that there are no conflicts with
the Fair Debt Collection Practices Act
and similar State laws regarding thelegal obligation to validate a debt that is
disputed by a debtor. Commenterssought clarification on whether theprovider can still disclose protected
health information for the recovery ofdebts.
Response: The final rule does not
impact a provider’s ability to disclose
protected health information for
payment purposes to a collection agency
or otherwise for collection activities

PO 00000

Frm 00066

Fmt 4701

Sfmt 4700

related to an individual’s debt to theprovider. Section 164.522(a) restricts
disclosures to a health plan for payment
purposes where the individual has paidout of pocket for the health care item orservice that is the subject of thedisclosure and requests such a
restriction.
Comment: Commenters asked that weclarify whether payment with a Flexible
Spending Account (FSA) or Health
Savings Account (HSA) is considered apayment by a person on behalf of theindividual.
Response: An individual may use an
FSA or HSA to pay for the health care
items or services that the individual
wishes to have restricted from anotherplan; however, in doing so theindividual may not restrict a disclosure
to the FSA or HSA necessary toeffectuate that payment.
Comment: When a restriction isrequested, the provider is also
prohibited from making disclosures of
the restricted protected healthinformation to the business associate of
the health plan. One commentersuggested that the final rule make it thepriority of the business associate to
inform the provider that they are acting
as the business associate of the healthplan to ensure provider compliancewith the rule. Other comments
misconstrued the preamble statementson this issue and commented that aprovider should be allowed to provide
restricted protected health information
to its own business associates.
Response: A provider that isprohibited from disclosing protected
health information to a health plan may
not disclose such information to thehealth plan’s business associate. We do
not include a requirement that thebusiness associate inform the provider
that they are acting as a businessassociate of the health plan as it is theprovider’s responsibility to know towhom and for what purposes it ismaking a disclosure. We also clarify thata provider is not prohibited fromdisclosing protected health information
restricted from a health plan to its own
business associates for the provider’sown purposes.
Comment: One commenter expressed
concern about the number of workforce
members who must know about the
restriction and indicated that this may
create a risk for potential error withregard to the information.
Response: Covered entities must
identify those workforce members orclass of persons who need access toparticular protected health information,
and appropriately train their workforce
members as necessary to comply withthese new requirements.

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD with

10. Section 164.524—Access of
Individuals to Protected Health
Information
Proposed Rule
Section 164.524 of the Privacy Rulecurrently establishes, with limited
exceptions, an enforceable means bywhich individuals have a right to review
or obtain copies of their protected
health information to the extent suchinformation is maintained in thedesignated record set(s) of a covered
entity. An individual’s right of accessexists regardless of the format of theprotected health information, and thestandards and implementation
specifications that address individuals’
requests for access and timely action by
the covered entity (i.e., provision ofaccess, denial of access, anddocumentation) apply to an electronic
environment in a similar manner as they
do to a paper-based environment. See
The HIPAA Privacy Rule’s Right ofAccess and Health Information
Technology (providing guidance withrespect to how § 164.524 applies in anelectronic environment and how healthinformation technology can facilitate
providing individuals with thisimportant privacy right), available at:
http://www.hhs.gov/ocr/privacy/hipaa/
understanding/special/healthit/eaccess.pdf.
Section 13405(e) of the HITECH Act
strengthens the Privacy Rule’s right ofaccess with respect to covered entities
that use or maintain an electronic healthrecord (EHR) on an individual. Section
13405(e) provides that when a covered
entity uses or maintains an EHR withrespect to protected health informationof an individual, the individual shallhave a right to obtain from the covered
entity a copy of such information in anelectronic format and the individual
may direct the covered entity totransmit such copy directly to theindividual’s designee, provided that any
such choice is clear, conspicuous, andspecific. Section 13405(e) also provides
that any fee imposed by the covered
entity for providing such an electronic
copy shall not be greater than theentity’s labor costs in responding to therequest for the copy.
Section 13405(e) applies by its terms
only to protected health information in
EHRs. However, incorporating thesenew provisions in such a limited
manner in the Privacy Rule could resultin a complex set of disparate
requirements for access to protected
health information in EHR systems
versus other types of electronic records
systems. As such, the Department
proposed to use its authority under
section 264(c) of HIPAA to prescribe the

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

rights individuals should have withrespect to their individually identifiable
health information to strengthen theright of access as provided under
section 13405(e) of the HITECH Act
more uniformly to all protected healthinformation maintained in one or moredesignated record sets electronically,
regardless of whether the designatedrecord set is an EHR. The publiccomments and final regulation on thescope are discussed here. The proposed
amendments to each provision
implicated by section 13405(e), together
with the public comments and final
regulation, are discussed more
specifically in separate sections below.
Overview of Public Comments
Most commenters were opposed tothe proposal to expand the scope of theindividual access provision to include
all electronic designated record sets andfavored limiting the requirement to
EHRs. These commenters felt that
limiting the access provision to EHRs
was consistent with congressional intent
and questioned the authority of the
Department to expand the scope.
Commenters also argued that having
disparate requirements for different
systems would not be confusing, andrequiring electronic access to electronic
designated record sets that are not EHRs
would be highly burdensome forcovered entities. Specifically,
commenters stated that the proposed
requirement for electronic access would
include numerous types of legacy
systems, many of which are incapable ofproducing reports in easily readable
formats that can be transmitted
electronically. These commenters
indicated that a significant amount of
information technology development
and investment would be needed tocomply with this requirement if it
applies to all electronic designatedrecord sets.
A number of consumer advocates
supported the expanded scope toinclude all electronic designated records
sets in addition to EHRs. These
commenters felt that this would provide
complete transparency for consumers,
help individuals gain access to their
medical records and make betterinformed decisions about their healthcare, and promote consistent anduniform practices.
Final Rule
The final rule adopts the proposal toamend the Privacy Rule at§ 164.524(c)(2)(ii) to require that if an
individual requests an electronic copy
of protected health information that ismaintained electronically in one ormore designated record sets, the covered

PO 00000

Frm 00067

Fmt 4701

Sfmt 4700

5631

entity must provide the individual withaccess to the electronic information in
the electronic form and format
requested by the individual, if it isreadily producible, or, if not, in areadable electronic form and format asagreed to by the covered entity and theindividual. In such cases, to the extent
possible, we expect covered entities toprovide the individual with a machinereadable copy of the individual’s
protected health information. The
Department considers machine readable
data to mean digital information stored
in a standard format enabling theinformation to be processed andanalyzed by computer. For example,
this would include providing theindividual with an electronic copy ofthe protected health information in theformat of MS Word or Excel, text,
HTML, or text-based PDF, among otherformats.
We disagree with commenters thatquestioned the Department’s authority
to extend the strengthened electronic
access right to all protected healthinformation maintained electronicallyin designated record sets, and believethat this extended electronic right ofaccess is important for individuals ascovered entities increasingly transition
from paper to electronic records. With
regard to the additional burdens oncovered entities, we note that providing
access to protected health information
held in electronic designated record sets
was already required under the Privacy
Rule at § 164.524, which applies toprotected health information in both
paper and electronic designated record
sets, and which requires providing the
copy in the form and format requestedby the individual, including
electronically, if it is readily produciblein such form and format. We anticipate
the additional burden to be small due tothe flexibility permitted in satisfying
this new requirement, as discussed in
the section on Form and Format.
Response to Other Public Comments
Comment: Some commenters worried
that giving individuals access toadministrative systems (in contrast to
clinical systems) would present a
security concern to covered entities.
Response: Covered entities are notrequired by this provision to provide
individuals with direct access to theirsystems. They must only provide
individuals with an electronic copy of
their protected health information.
Comment: Commenters requested
clarification on what constitutes an
EHR.
Response: Under this final rule, therequirement to provide individuals withaccess to an electronic copy includes all

E:\FR\FM\25JAR2.SGM

25JAR2

5632

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

protected health information
maintained in an electronic designatedrecord set held by a covered entity.
Because we are not limiting the right ofelectronic access to EHRs, we do notbelieve there is a need to define or
further clarify the term at this time.
Comment: One commenter requested
clarification that this electronic accessrequirement preempts State laws thatdiminish, block, or limit individual
access to their records.
Response: We clarify that this HIPAA
electronic right of access requirement
does preempt contrary State law unlesssuch law is more stringent. In the caseof right of access, more stringent meansthat such State law permits greaterrights of access to the individual.
Comment: Several commenters soughtclarification of how the new e-accessprovisions would apply to businessassociates. One commenter asked
whether business associates could
continue to provide patients access torecords when permitted and acting on
behalf of a covered entity. Anothercommenter asked whether businessassociates are required to provide
information to covered entities and not
to individuals directly. One commenter
was opposed to direct access from abusiness associate because of security
concerns and increased burden on
business associates if corrections areneeded.
Response: How and to what extent abusiness associate is to support or fulfill
a covered entity’s obligation to provide
individuals with electronic access totheir records will be governed by thebusiness associate agreement between
the covered entity and the businessassociate. For example, the businessassociate agreement may provide for thebusiness associate to give copies of therequested information directly to theindividual, or to the covered entity forthe covered entity to provide the copies
to the individual. There is no separate
requirement on business associates toprovide individuals with direct accessto their health records, if that is notwhat has been agreed to between the
covered entity and the businessassociate in the business associateagreement.
a. Form and Format

sroberts on DSK5SPTVN1PROD with

Proposed Rule
Section 164.524(c)(2) of the Privacy
Rule currently requires a covered entity
to provide the individual with access tothe protected health information in theform or format requested by theindividual, if it is readily producible insuch form or format, or, if not, in areadable hard copy form or such other

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

form or format as agreed to by thecovered entity and the individual.
Section 13405(e) of the HITECH Act
expands this requirement by explicitly
requiring a covered entity that uses ormaintains an EHR with respect toprotected health information to provide
the individual with a copy of suchinformation in an electronic format.
We proposed to implement thisstatutory provision, in conjunction withour broader authority under section
264(c) of HIPAA, by requiring, in
proposed § 164.524(c)(2)(ii), that if theprotected health information requested
is maintained electronically in one ormore designated record sets, the covered
entity must provide the individual withaccess to the electronic information in
the electronic form and format
requested by the individual, if it isreadily producible, or, if not, in areadable electronic form and format asagreed to by the covered entity and theindividual. This provision would
require any covered entity thatelectronically maintains the protected
health information about an individual,
in one or more designated record sets,
to provide the individual with anelectronic copy of such information (orsummary or explanation if agreed to by
the individual in accordance withproposed § 164.524(c)(2)(iii)) in theelectronic form and format requested orin an otherwise agreed upon electronic
form and format. While an individual’s
right of access to an electronic copy ofprotected health information iscurrently limited under the Privacy Ruleby whether the form or format requested
is readily producible, covered entities
that maintain such informationelectronically in a designated record set
would be required under these proposed
modifications to provide some type ofelectronic copy, if requested by anindividual.
Because we did not want to bindcovered entities to standards that may
not yet be technologically mature, we
proposed to permit covered entities tomake some other agreement withindividuals as to an alternative meansby which they may provide a readable
electronic copy to the extent therequested means is not readily
producible. If, for example, a covered
entity received a request to provide
electronic access via a secure web-based
portal, but the only readily producible
version of the protected healthinformation was in portable document
format (PDF), proposed§ 164.524(c)(2)(ii) would require thecovered entity to provide the individualwith a PDF copy of the protected healthinformation, if agreed to by the covered
entity and the individual. We noted that

PO 00000

Frm 00068

Fmt 4701

Sfmt 4700

while a covered entity may provide
individuals with limited access rights totheir EHR, such as through a secure
web-based portal, nothing under thecurrent Rule or proposed modifications
would require a covered entity to havethis capability.
We noted that the option of arriving
at an alternative agreement that satisfies
both parties is already part of therequirement to provide access under§ 164.524(c)(2)(i), so extension of such arequirement to electronic access shouldpresent few implementation difficulties.
Further, as with other disclosures ofprotected health information, in
providing the individual with anelectronic copy of protected healthinformation through a web-based portal,
email, on portable electronic media, orother means, covered entities should
ensure that reasonable safeguards are inplace to protect the information. We
also noted that the proposed
modification presumes that covered
entities have the capability of providing
an electronic copy of protected healthinformation maintained in theirdesignated record set(s) electronicallythrough a secure web-based portal, via
email, on portable electronic media, orother manner. We invited publiccomment on this presumption.
Overview of Public Comments
We received many comments andrequests for clarification and guidance
regarding the permitted methods foroffering protected health information onelectronic media, and the acceptableform and format of the electronic copy.
Several commenters suggested thatcovered entities be permitted flexibility
in determining available electronic
formats and requested clarification onwhat is considered ‘‘readily
producible.’’ These commenters
expressed concerns that a limited
number of permissible electronic
formats may result in a situation where
protected health information could not
be converted from a particularelectronic system. Other commenters
indicated that there should be minimum
standards and clearly defined media
that are permissible to meet thisrequirement. One commenter felt that
this requirement is important but
should be deferred until covered entities
have improved their technologicalcapabilities.
Many commenters requested guidanceon how to proceed if a covered entityand an individual are unable to come toan agreement on the medium of choice
and what is expected in terms ofaccommodating the individual’s
medium of choice. Some commenterssuggested various alternate solutions if

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withan agreement cannot be reached,including any readily producible
format, PDF, or hard copy protected
health information. Some covered
entities felt that individuals should nothave an unlimited choice in terms of theelectronic media they are willing toaccept, and should only be permitted toconfine their choices of electronic
media to a couple of options that thecovered entity has available.
Final Rule
The final rule adopts the proposal torequire covered entities to provide
electronic information to an individualin the electronic form and format
requested by the individual, if it isreadily producible, or, if not, in areadable electronic form and format asagreed to by the covered entity and theindividual. We recognize that what isavailable in a readable electronic form
and format will vary by system and thatcovered entities will continue toimprove their technological capabilities
over time. We therefore allow covered
entities the flexibility to provide readily
producible electronic copies ofprotected health information that are
currently available on their various
systems. A covered entity is not
required to purchase new software orsystems in order to accommodate anelectronic copy request for a specificform that is not readily producible by
the covered entity at the time of therequest, provided that the covered entity
is able to provide some form ofelectronic copy. We note that some
legacy or other systems may not becapable of providing any form ofelectronic copy at present and anticipate
that some covered entities may need tomake some investment in order to meet
the basic requirement to provide someform of electronic copy.
We agree with covered entities that
individuals should not have an
unlimited choice in the form ofelectronic copy requested. However,
covered entities must still provide
individuals with some kind of readable
electronic copy. If an individual
requests a form of electronic copy thatthe covered entity is unable to produce,
the covered entity must offer otherelectronic formats that are available on
their systems. If the individual declines
to accept any of the electronic formats
that are readily producible by thecovered entity, the covered entity must
provide a hard copy as an option to
fulfill the access request. While weremain neutral on the type oftechnology that covered entities may
adopt, a PDF is a widely recognized
format that would satisfy the electronic
access requirement if it is the

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

individual’s requested format or if theindividual agrees to accept a PDF
instead of the individual’s requested
format. Alternatively, there may becircumstances where an individual
prefers a simple text or rich text file andthe covered entity is able toaccommodate this preference. A hard
copy of the individual’s protected
health information would not satisfy theelectronic access requirement. However,a hard copy may be provided if theindividual decides not to accept any ofthe electronic formats offered by thecovered entity.
Response to Other Public Comments
Comment: Several covered entities
commented on the form of a request foraccess to electronic protected healthinformation. Some expressed
appreciation for permitting an electronic
request process, including e-signatures
and authentication. Some expressed
opposition to the requirement for asigned request in writing, as it would behighly burdensome and cause delays.
Covered entities sought guidance onelements that would be required or
permitted in a request form forindividuals.
Response: We clarify that therequirement at § 164.524(b)(1), whichstates that the covered entity may
require individuals to make requests foraccess in writing, provided that it
informs individuals of such arequirement, remains unchanged.
Therefore, covered entities may at theiroption require individuals to makerequests for electronic copies of theirprotected health information in writing.
We note that the Privacy Rule allows forelectronic documents to qualify as
written documents, as well as electronic
signatures to satisfy any requirements
for a signature, to the extent thesignature is valid under applicable law.
If the covered entity chooses to require
a written request, it has flexibility indetermining what information to put
into the request form. However, therequest form may not be in any way
designed to discourage an individualfrom exercising his or her right. A
covered entity may also choose toaccept an individual’s oral request for
an electronic copy of their protected
health information without written
signature or documentation.
Comment: We received several
comments on the content that covered
entities are required to provide in
response to an electronic access request.
Some commenters felt that there should
be a defined minimum set of data
elements to satisfy this requirement,
particularly for non-EHR data. Covered
entities also requested clarification on

PO 00000

Frm 00069

Fmt 4701

Sfmt 4700

5633

how to handle links to images or otherdata.
Response: We clarify that just as iscurrently required for hard copy
protected health information accessrequests, covered entities must provide
an electronic copy of all protected
health information about the individualin an electronically maintained
designated record set, except asotherwise provided at § 164.524(a). If
the designated record set includes
electronic links to images or other data,
the images or other data that is linked
to the designated record set must also be
included in the electronic copy
provided to the individual. The
electronic copy must contain all
protected health informationelectronically maintained in thedesignated record set at the time therequest is fulfilled. The individual may
request, however, only a portion of theprotected health informationelectronically maintained in thedesignated record set, in which case thecovered entity is only required toprovide the requested information.
Comment: One commenter asserted
that the request for protected healthinformation should only apply toprotected health information the
covered entity has at the time of therequest, not any additional protected
health information that it obtains while
processing the request.
Response: We clarify that theelectronic copy must reflect allelectronic protected health information
held by the covered entity in adesignated record set, or the subset ofelectronic protected health information
specifically requested by the individual,
at the time the request is fulfilled.
Comment: One commenter asked for
confirmation that the new electronic
requirement does not include arequirement to scan paper and provide
electronic copies of records held in
paper form.
Response: We clarify that covered
entities are not required to scan paper
documents to provide electronic copies
of records maintained in hard copy. We
note that for covered entities that havemixed media, it may in some cases beeasier to scan and provide all records inelectronic form rather than provide a
combination of electronic and hardcopies, however this is in no way
required.
Comment: Many commenters
expressed security concerns related tothis new requirement. Covered entities
felt that they should not have to use
portable devices brought by individuals(particularly flash drives), due to thesecurity risks that this would introduce
to their systems. Some covered entities

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5634

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

additionally asserted that requiring theuse of individually-supplied media isprohibited by the Security Rule, basedon the risk analysis determination of an
unacceptable risk to the confidentiality,
integrity and availability of the covered
entity’s electronic protected healthinformation.
Response: We acknowledge thesesecurity concerns and agree withcommenters that it may not beappropriate for covered entities to
accept the use of external portable
media on their systems. Covered entities
are required by the Security Rule toperform a risk analysis related to thepotential use of external portable media,
and are not required to accept theexternal media if they determine there
is an unacceptable level of risk.
However, covered entities are not thenpermitted to require individuals topurchase a portable media device fromthe covered entity if the individual does
not wish to do so. The individual may
in such cases opt to receive analternative form of the electronic copyof the protected health information,such as through email.
Comment: Several commentersspecifically commented on the option toprovide electronic protected healthinformation via unencrypted email.
Covered entities requested clarificationthat they are permitted to send
individuals unencrypted emails if they
have advised the individual of the risk,
and the individual still prefers the
unencrypted email. Some felt that the‘‘duty to warn’’ individuals of risks
associated with unencrypted email
would be unduly burdensome oncovered entities. Covered entities also
requested clarification that they would
not be responsible for breach
notification in the event thatunauthorized access of protected healthinformation occurred as a result ofsending an unencrypted email based on
an individual’s request. Finally, onecommenter emphasized the importancethat individuals are allowed to decide if
they want to receive unencryptedemails.
Response: We clarify that covered
entities are permitted to send
individuals unencrypted emails if they
have advised the individual of the risk,
and the individual still prefers the
unencrypted email. We disagree that the‘‘duty to warn’’ individuals of risks
associated with unencrypted email
would be unduly burdensome oncovered entities and believe this is anecessary step in protecting theprotected health information. We do not
expect covered entities to educate
individuals about encryption
technology and the information

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

security. Rather, we merely expect thecovered entity to notify the individualthat there may be some level of risk thatthe information in the email could beread by a third party. If individuals arenotified of the risks and still prefer
unencrypted email, the individual has
the right to receive protected healthinformation in that way, and covered
entities are not responsible forunauthorized access of protected healthinformation while in transmission to theindividual based on the individual’srequest. Further, covered entities are notresponsible for safeguarding information
once delivered to the individual.
b. Third Parties
Proposed Rule
Section 164.524(c)(3) of the Privacy
Rule currently requires the covered
entity to provide the access requested by
the individual in a timely manner,which includes arranging with theindividual for a convenient time andplace to inspect or obtain a copy of theprotected health information, or mailingthe copy of protected health information
at the individual’s request. The
Department had previously interpreted
this provision as requiring a covered
entity to mail the copy of protected
health information to an alternative
address requested by the individual,
provided the request was clearly madeby the individual and not a third party.
Section 13405(e)(1) of the HITECH Act
provides that if the individual chooses,
he or she has a right to direct thecovered entity to transmit an electronic
copy of protected health information in
an EHR directly to an entity or person
designated by the individual, provided
that such choice is clear, conspicuous,and specific.
Based on section 13405(e)(1) of the
HITECH Act and our authority under
section 264(c) of HIPAA, we proposed
to expand § 164.524(c)(3) to expressly
provide that, if requested by anindividual, a covered entity must
transmit the copy of protected healthinformation directly to another person
designated by the individual. This
proposed amendment is consistent with
the Department’s prior interpretation on
this issue and would apply without
regard to whether the protected healthinformation is in electronic or paper
form. We proposed to implement therequirement of section 13405(e)(1) thatthe individual’s ‘‘choice [be] clear,conspicuous, and specific’’ by requiringthat the individual’s request be ‘‘inwriting, signed by the individual, andclearly identify the designated person
and where to send the copy of protected
health information.’’ We noted that the

PO 00000

Frm 00070

Fmt 4701

Sfmt 4700

Privacy Rule allows for electronic
documents to qualify as written
documents for purposes of meeting theRule’s requirements, as well as
electronic signatures to satisfy any
requirements for a signature, to theextent the signature is valid underapplicable law. Thus, a covered entity
could employ an electronic process forreceiving an individual’s request totransmit a copy of protected healthinformation to his or her designee under
this proposed provision. Whether theprocess is electronic or paper-based, acovered entity must implement
reasonable policies and procedures
under § 164.514(h) to verify the identityof any person who requests protected
health information, as well as
implement reasonable safeguards under§ 164.530(c) to protect the informationthat is used or disclosed.
Overview of Public Comments
Commenters requested clarification
regarding the proposal to transmit anelectronic copy of protected healthinformation to another person
designated by the individual. In
particular, covered entities soughtclarification on whether or not an
authorization is required prior totransmitting the requested electronic
protected health information to a third
party designated by the individual.
Some commenters supported the ability
to provide electronic protected healthinformation access to third parties
without individual authorization, whileothers felt that authorization should be
required. Covered entities requested
clarification that they are not liable
when making reasonable efforts to verify
the identity of a third party recipient
identified by the individual.
Final Rule
The final rule adopts the proposed
amendment § 164.524(c)(3) to expressly
provide that, if requested by anindividual, a covered entity must
transmit the copy of protected healthinformation directly to another person
designated by the individual. In contrast
to other requests under § 164.524, when
an individual directs the covered entity
to send the copy of protected healthinformation to another designatedperson, the request must be made inwriting, signed by the individual, andclearly identify the designated person
and where to send the copy of theprotected health information. If a
covered entity has decided to require allaccess requests in writing, the third
party recipient information andsignature by the individual can be
included in the same written request; noadditional or separate written request is

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
required. This written request forprotected health information to be sent
to a designated person is distinct froman authorization form, which contains
many additional required statements
and elements (see § 164.508(c)). Covered
entities may rely on the information
provided in writing by the individual
when providing protected healthinformation to a third party recipient
identified by the individual, but mustalso implement reasonable policies andprocedures under § 164.514(h) to verify
the identity of any person who requests
protected health information, as well as
implement reasonable safeguards under§ 164.530(c) to protect the informationthat is used or disclosed. For example,
reasonable safeguards would not require
the covered entity to confirm that theindividual provided the correct email
address of the third party, but would
require reasonable procedures to ensurethat the covered entity correctly entersthe email address into its system.

sroberts on DSK5SPTVN1PROD withc. Fees
Proposed Rule
Section 164.524(c)(4) of the Privacy
Rule currently permits a covered entity
to impose a reasonable, cost-based fee
for a copy of protected healthinformation (or a summary or
explanation of such information).
However, such a fee may only include
the cost of: (1) The supplies for, andlabor of, copying the protected healthinformation; (2) the postage associatedwith mailing the protected healthinformation, if applicable; and (3) the
preparation of an explanation orsummary of the protected healthinformation, if agreed to by theindividual. With respect to providing a
copy (or summary or explanation) ofprotected health information from an
EHR in electronic form, however,section 13405(e)(2) of the HITECH Act
provides that a covered entity may not
charge more than its labor costs in
responding to the request for the copy.
In response to section 13405(e)(2) ofthe HITECH Act, we proposed to amend§ 164.524(c)(4)(i) to identify separately
the labor for copying protected healthinformation, whether in paper orelectronic form, as one factor that may
be included in a reasonable cost-based
fee. While we did not propose moredetailed considerations for this factor
within the regulatory text, we retained
all prior interpretations of labor withrespect to paper copies—that is, that thelabor cost of copying may not include
the costs associated with searching forand retrieving the requested
information. With respect to electronic
copies, we asserted that a reasonable

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

cost-based fee includes costs
attributable to the labor involved toreview the access request and to
produce the electronic copy, which we
expected would be negligible. However,
we did not consider a reasonable costbased fee to include a standard‘‘retrieval fee’’ that does not reflect theactual labor costs associated with theretrieval of the electronic information orthat reflects charges that are unrelated tothe individual’s request (e.g., theadditional labor resulting from technicalproblems or a workforce member’s lackof adequate training). We invited publiccomment on this aspect of ourrulemaking, specifically with respect towhat types of activities related to
managing electronic access requests
should be compensable aspects of labor.
We also proposed to amend§ 164.524(c)(4)(ii) to provide separately
for the cost of supplies for creating thepaper copy or electronic media (i.e.,
physical media such as a compact disc(CD) or universal serial bus (USB) flash
drive), if the individual requests that theelectronic copy be provided on portable
media. This reorganization and the
addition of the phrase ‘‘electronic
media’’ reflected our understanding thatsince section 13405(e)(2) of the HITECH
Act permits only the inclusion of laborcosts in the charge for electronic copies,
it by implication excludes charging forthe supplies that are used to create anelectronic copy of the individual’s
protected health information, such as
the hardware (computers, scanners, etc.)
or software that is used to generate anelectronic copy of an individual’s
protected health information in
response to an access request. We notedthat this limitation is in contrast to acovered entity’s ability to charge forsupplies for hard copies of protected
health information (e.g., the cost of
paper, the prorated cost of toner andwear and tear on the printer). See 65 FR
82462, 82735, Dec. 28, 2000 (responding
to a comment seeking clarification on‘‘capital cost for copying’’ and othersupply costs by indicating that acovered entity was free to recoup all of
their reasonable costs for copying). We
asserted that this interpretation wasconsistent with the fact that, unlike ahard copy, which generally exists on
paper, an electronic copy exists
independent of media, and can betransmitted securely via multiple
methods (e.g., email, a secure web-based
portal, or an individual’s own electronic
media) without accruing any ancillary
supply costs. We also noted, however,that our interpretation of the statutewould permit a covered entity to chargea reasonable and cost-based fee for any

PO 00000

Frm 00071

Fmt 4701

Sfmt 4700

5635

electronic media it provided, as
requested or agreed to by an individual.
While we proposed to renumber theremaining factors at § 164.524(c)(4), we
did not propose to amend theirsubstance. With respect to§ 164.524(c)(4)(iii), however, we notedthat our interpretation of the statutewould permit a covered entity to charge
for postage if an individual requests thatthe covered entity transmit portable
media containing an electronic copy
through mail or courier (e.g., if theindividual requests that the covered
entity save protected health information
to a CD and then mail the CD to a
designee).
Overview of Public Comments
Commenters generally supported andappreciated the inclusion of areasonable, cost-based fee that includes
both labor and, in some cases, supply
costs to support the new electronic
access requirement. Several commentersdisagreed that the cost related toreviewing and responding to requests
would be negligible, particularly if thescope includes information indesignated record sets and not only
EHRs, since more technically trained
staff would be necessary to perform thisfunction.
Commenters provided manysuggestions of costs that should bepermitted in the fees, including those
associated with labor, materials,
systems, retrieval (particularly for olddata maintained in archives, backup
media or legacy systems), copying,transmission, and capital to recoup thesignificant investments made for data
access, storage and infrastructure.
Commenters offered additionalsuggestions on labor-related costs,
including: skilled technical staff time;
time spent recovering, compiling,
extracting, scanning and burning
protected health information to media,
and distributing the media; andpreparation of an explanation orsummary if appropriate. Suggestions ofmaterials-related costs included: CDs,
flash drives, tapes or other portable
media; new types of technology needed
to comply with individual requests;
office supplies; and mail copies.
Systems-related costs included: softwarenecessary to conduct protected healthinformation searches; andimplementation and maintenance of
security systems and secureconnectivity.
Final Rule
The final rule adopts the proposed
amendment at § 164.524(c)(4)(i) to
identify separately the labor for copying
protected health information, whether

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5636

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

in paper or electronic form, as one factor
that may be included in a reasonable
cost-based fee. We acknowledgecommenters’ assertions that the cost
related to searching for and retrieving
electronic protected health informationin response to requests would be not be
negligible, as opposed to what we had
anticipated, particularly in regards todesignated record set access that will
require more technically trained staff toperform this function. We clarify thatlabor costs included in a reasonable
cost-based fee could include skilled
technical staff time spent to create andcopy the electronic file, such ascompiling, extracting, scanning andburning protected health information to
media, and distributing the media. This
could also include the time spent
preparing an explanation or summary of
the protected health information, if
appropriate.
The final rule also adopts the
proposed amendment at§ 164.524(c)(4)(ii) to provide separately
for the cost of supplies for creating thepaper copy or electronic media (i.e.,
physical media such as a compact disc(CD) or universal serial bus (USB) flash
drive), if the individual requests that theelectronic copy be provided on portable
media. We do not require that covered
entities obtain new types of technology
needed to comply with specificindividual requests, and therefore thecost of obtaining such new technologies
is not a permissible fee to include in the
supply costs.
With respect to § 164.524(c)(4)(iii), we
clarify that a covered entity is permitted
to charge for postage if an individual
requests that the covered entity transmit
portable media containing an electronic
copy through mail or courier (e.g., if theindividual requests that the covered
entity save protected health information
to a CD and then mail the CD to a
designee).
Fees associated with maintaining
systems and recouping capital for data
access, storage and infrastructure are notconsidered reasonable, cost-based fees,
and are not permissible to include
under this provision. Covered entities
are not required to adopt or purchasenew systems under this provision, andthus any costs associated withmaintaining them are present regardlessof the new electronic access right.
Additionally, although the proposed
rule indicated that a covered entity
could charge for the actual labor costs
associated with the retrieval ofelectronic information, in this final rule
we clarify that a covered entity may not
charge a retrieval fee (whether it be astandard retrieval fee or one based on
actual retrieval costs). This

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

interpretation will ensure that the fee
requirements for electronic access are
consistent with the requirements forhard copies, which do not allow
retrieval fees for locating the data.
Response to Other Public Comments
Comment: Commenters requested
clarification on how to proceed whenState laws designate fees.
Response: When a State law provides
a limit on the fee that a covered entity
may charge for a copy of protected
health information, this is relevant indetermining whether a covered entity’s
fee is ‘‘reasonable’’ under§ 164.524(c)(4). A covered entity’s fee
must be both reasonable and cost-based.
For example, if a State permits a chargeof 25 cents per page, but a covered
entity is able to provide an electronic
copy at a cost of five cents per page,then the covered entity may not charge
more than five cents per page (since thatis the reasonable and cost-based
amount). Similarly, if a covered entity’s
cost is 30 cents per page but the Statelaw limits the covered entity’s charge to
25 cents per page, then the covered
entity may not charge more than 25
cents per page (since charging 30 cents
per page would be the cost-based
amount, but would not be reasonable inlight of the State law).
Comment: One commenter suggested
that labor-related costs should include
preparation of an affidavit certifyingthat the information is a true and correct
copy of the records.
Response: We do not consider the cost
to prepare an affidavit to be a copying
cost. Thus, where an individual requests
that an affidavit accompany the copy ofprotected health information requestedby the individual for litigation purposesor otherwise, a covered entity may
charge the individual for the
preparation of such affidavit and is not
subject to the reasonable, cost-based fee
limitations of § 164.524(c)(4). However,a covered entity may not withhold anindividual’s copy of his or her protected
health information for failure by theindividual to pay any fees for services
above and beyond the copying, such as
for preparing an affidavit.
Comment: Some commenters
recommended defining the following
terms: ‘‘preparing,’’ ‘‘producing,’’ and‘‘transmitting.’’
Response: We decline to define theterms ‘‘preparing,’’ ‘‘producing,’’ and‘‘transmitting,’’ as we believe the terms
have been adequately understood andutilized in the context of hard copy
access to protected health information.

PO 00000

Frm 00072

Fmt 4701

Sfmt 4700

d. Timeliness
Proposed RuleWe requested comment on one aspectof the right to access and obtain a copy
of protected health information which
the HITECH Act did not amend. In
particular, the HITECH Act did notchange the timeliness requirements forprovision of access at § 164.524(b).
Under the current requirements, arequest for access must be approved ordenied, and if approved, access or a
copy of the information provided,
within 30 days of the request. In cases
where the records requested are only
accessible from an off-site location, thecovered entity has an additional 30 days
to respond to the request. In extenuating
circumstances where access cannot beprovided within these timeframes, thecovered entity may have a one-time 30day extension if the individual isnotified of the need for the extension
within the original timeframes.
With regard to the timeliness of theprovision of access, we recognized thatwith the advance of EHRs, there is anincreasing expectation and capacity toprovide individuals with almost
instantaneous electronic access to theprotected health information in thoserecords through personal health records
or similar electronic means. On theother hand, we did not propose to limit
the right to electronic access ofprotected health information to certified
EHRs, and the variety of electronicsystems that are subject to this proposed
requirement would not all be able tocomply with a timeliness standard
based on personal health record
capabilities. It was our assumption thata single timeliness standard that would
address a variety of electronic systems,
rather than having a multitude ofstandards based on system capacity,
would be the preferred approach to
avoid workability issues for covered
entities. Even under a single standard,nothing would prevent users of EHR
systems from exceeding the Privacy
Rule’s timeliness requirements forproviding access to individuals.
Additionally, the Medicare andMedicaid EHR Incentive Programs (the‘‘meaningful use’’ programs) require
users of Certified EHR Technology toprovide individuals with expedited
access to information. Based on theassumption that a single standard would
be the preferred approach under thePrivacy Rule, we requested publiccomment on an appropriate, common
timeliness standard for the provision ofaccess by covered entities withelectronic designated record sets
generally. We specifically requested
comment on aspects of existing systems

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withthat would create efficiencies inprocessing of requests for electronic
information, as well as those aspects ofelectronic systems that would provide
little change from the time required forprocessing a paper record. Alternatively,
we requested comment on whether thecurrent standard could be altered for all
systems, paper and electronic, such that
all requests for access should be
responded to without unreasonable
delay and not later than 30 days.
We also requested public comment onwhether, contrary to our assumption, avariety of timeliness standards based on
the type of electronic designated record
set is the preferred approach and if so,
how such an approach should be
implemented.
Finally, we requested comment on thetime necessary for covered entities toreview access requests and makenecessary determinations, such aswhether the granting of access would
endanger the individual or otherpersons so as to better understand how
the time needed for these reviews
relates to the overall time needed toprovide the individual with access.
Further, we requested comment
generally on whether the provision
which allows a covered entity an
additional 30 days to provide access tothe individual if the protected healthinformation is maintained off-siteshould be eliminated altogether for both
paper and electronic records, or at least
for protected health information
maintained or archived electronicallybecause the physical location ofelectronic data storage is not relevant to
its accessibility.
Overview of Public Comments
Commenters generally supported
maintaining the same timeframe forresponse for both paper and electronic
records and not modifying the existing
timeframes for response. Commentersespoused many rationales formaintaining a single standard and theexisting response standards, includingthat off-site electronic storage with backup tapes will require time to obtain theelectronic media, multiple electronicsystems may need to be accessed, somesystems may not have data stored inuseable formats requiring time toconvert data, and time may be required
to obtain data from business associates
and subcontractors.
Some commenters acknowledged thatelectronic records may be easier toaccess, but review of records andverification processes would stillrequire time that cannot be shortcut
because a record is electronic. One
commenter acknowledged that shorter
times may be achievable when specific

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

data set standards are established andcovered entities have electronic records
in place. One commenter believed thatelectronic records could be furnished ina much shorter timeframe, such as twobusiness days.
Several commenters suggested
responses be done in much shorter
timeframes, such as instantly, within
one day or three days. One commenter
noted that meaningful use standards
required access within three days for 50
percent of patients. These commenterssuggested alternative timeframes for
adoption, such as allowing 60 days forresponse due to off-site storage issues
and potential for multiple requests. One
commenter suggested 30 and 60 day
times were unworkable and anothercommenter suggested eliminating the 30
day extension for off-site record storage.
One commenter suggested 30 days may
be longer than is necessary, but
cautioned against mandates that would
unreasonably divert provider resources(e.g., five days would be unreasonable
when a provider must take time toinclude explanatory notes).
Final Rule
The final rule modifies the timeliness
requirements for right to access and toobtain a copy of protected healthinformation at § 164.524(b). We remove
the provision at § 164.524(b)(2)(ii) that
permits 60 days for timely action when
protected health information for accessis not maintained or accessible to thecovered entity on-site. We retain andrenumber as necessary the provision at§ 164.524(b)(2)(iii) that permits acovered entity a one-time extension of
30 days to respond to the individual’srequest (with written notice to theindividual of the reasons for delay andthe expected date by which the entity
will complete action on the request).
We believe the 30 day timeframe foraccess is appropriate and achievable bycovered entities given the increasing
expectation and capacity to provide
individuals with almost instantaneouselectronic access to the protected healthinformation in those records throughpersonal health records or similarelectronic means. While a covered
entity is permitted 30 days to provide
access (with a 30-day extension whennecessary), we encourage covered
entities to provide individuals withaccess to their information sooner, andto take advantage of technologies thatprovide individuals with immediate
access to their health information.
Nevertheless, for covered entities that
continue to make use of off-site storage
or have additional time constraints toproviding access, the 30 day extension
remains available for a covered entity to

PO 00000

Frm 00073

Fmt 4701

Sfmt 4700

5637

exercise. This means, for example, thata covered entity must provide an
individual with access to off-site records
within 30 days of the individual’srequest when possible, with a 30-day
extension available (for a total of 60days, in contrast to the current law that
permits up to 90 days to provide theindividual with access to such records).
We decline to establish separate
timeframes for timely access based upon
whether the protected healthinformation to be accessed is paper orelectronic. Commenters generally
supported adoption of a single standard
rather than differing standards based
upon whether a record is paper orelectronic and no comments provided
compelling reasons to establish differing
standards.
Response to Other Public Comments
Comment: One commenter asked forclarification as to when the time period
for responding to a response begins if
the parties spend significant time
attempting to reach agreement on theformat of the electronic copy.
Response: We confirm that the time
period for responding to a request foraccess begins on the date of the request.
Covered entities that spend significant
time before reaching agreement on theelectronic format for a response areusing part of the 30 days permitted for
response.
Comment: One commenter suggested
there should be a transition period for
those covered entities that do notcurrently have the capability to meet theelectronic access requirement.
Response: We decline to implement atransition period for access to electronic
copies of protected health information.
Covered entities are already subject tothe hard copy access requirement for all
information held in designated record
sets, including electronic designatedrecord sets, and the new requirement forelectronic copies gives covered entities
the flexibility to provide an electronic
copy in a form that is readily
producible. We do not believe
additional time is needed to provide
electronic copies of protected healthinformation that are readily producible.
11. Other Technical Changes andConforming Changes
Proposed Rule
We proposed to make a number oftechnical and conforming changes to thePrivacy Rule to fix minor problems,such as incorrect cross-references,mistakes of grammar, and typographicalerrors. These changes are shown in
Table 3 below.

E:\FR\FM\25JAR2.SGM

25JAR2

5638

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
TABLE 3—TECHNICAL AND CONFORMING CHANGESRegulation section

Current language

Proposed change

164.510(b)(2)(iii) ..................

‘‘based the exercise of professional
Judgment’’.
‘‘Permitted disclosures’’ and ‘‘may
disclose’’.

Insert ‘‘on’’ after ‘‘based’’ .................

Correct typographical error.

Insert ‘‘uses and’’ and ‘‘use or’’ before ‘‘disclosures’’ and ‘‘disclose,’’respectively.
Change ‘‘protecting’’ to ‘‘protected’’Correct inadvertent omission.

164.512(b)(1) ......................
164.512(e)(1)(iii) ..................

sroberts on DSK5SPTVN1PROD with

164.512(e)(1)(vi) ..................
164.512(k)(3) .......................

‘‘seeking protecting health information’’.
‘‘paragraph (e)(1)(iv) of this section’’‘‘authorized by 18 U.S.C. 3056, or toforeign heads of state, or to forthe conduct of investigations’’.

In addition to the above technicalchanges, we proposed to make a few
clarifications to existing text in various
provisions of the regulation nototherwise addressed in the above
preamble. These are as follows.
1. Section 164.506(c)(5) permits acovered entity to disclose protected
health information ‘‘to another covered
entity that participates in the organized
health care arrangement.’’ We proposed
to change the words ‘‘another covered
entity that participates’’ to ‘‘otherparticipants’’ because not all
participants in an organized health carearrangement may be covered entities; forexample, some physicians with staff
privileges at a hospital may not becovered entities.
2. Section 164.510(a)(1)(ii) permits thedisclosure of directory information tomembers of the clergy and other persons
who ask for the individual by name. We
proposed to add the words ‘‘use or’’ tothis permission, to cover the provisionof such information to clergy who arepart of a facility’s workforce.
3. Section 164.510(b)(3) covers usesand disclosures of protected healthinformation when the individual is notpresent to agree or object to the use or
disclosure, and, as pertinent here,
permits disclosure to persons only of‘‘the protected health information that is
directly relevant to the person’s
involvement with the individual’s
health care.’’ We proposed to delete thelast two quoted words and substitute thefollowing: ‘‘care or payment related tothe individual’s health care or needed
for notification purposes.’’ This changealigns the text of paragraph (b)(3) withthe permissions provided for atparagraph (b)(1) of this section.
4. Where an employer needs protected
health information to comply withworkplace medical surveillance laws,
such as the Occupational Safety and
Health Administration or Mine Safety
and Health Administration
requirements, § 164.512(b)(1)(v)(A)permits a covered entity to disclose,

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Reason for change

Change ‘‘(e)(1)(iv)’’ to ‘‘(e)(1)(v)’’ .....
Remove the comma after ‘‘U.S.C.
3056’’ and the ‘‘to’’ before ‘‘for’’.

Correct typographical error.
Correct cross-reference.
Correct typographical errors.

subject to certain conditions, protected
health information of an individual tothe individual’s employer if the covered
entity is a covered health care provider‘‘who is a member of the workforce ofsuch employer or who provides healthcare to the individual at the request of
the employer.’’ We proposed to amend
the quoted language by removing thewords ‘‘who is a member of theworkforce of such employer or,’’ as thelanguage is unnecessary.
5. At § 164.512(k)(1)(ii), we proposed
to replace the word ‘‘Transportation’’with ‘‘Homeland Security.’’ The
language regarding a component of the
Department of Transportation was
included to refer to the Coast Guard;
however, the Coast Guard wastransferred to the Department ofHomeland Security in 2003.
6. At § 164.512(k)(5), which permits acovered entity to disclose to acorrectional institution or law
enforcement official having lawful
custody of an inmate or other individual
protected health information about theinmate or individual in certain
necessary situations, we proposed toreplace the word ‘‘and’’ after thesemicolon in paragraph (i)(E) with theword ‘‘or.’’ The intent of§ 164.512(k)(5)(i) is not that theexistence of all of the conditions isnecessary to permit the disclosure, butrather that the existence of any would
permit the disclosure.

OHCA may include only professional
staff members.

Overview of Public Comments
One commenter requested
clarification about whether businessassociates may participate in an
organized health care arrangement(OHCA) under § 164.506(c)(5). Anothercommenter recommended againstchanging the language of § 164.506(c)(5),arguing that such a change could bringentities like employers andpharmaceutical companies into OHCAs
that should not otherwise have access toprotected health information, andsuggested that the Department change
the language to make clear that an

V. Modifications to the Breach
Notification Rule Under the HITECH
Act

PO 00000

Frm 00074

Fmt 4701

Sfmt 4700

Final Rule
The final rule implements thetechnical, conforming, and clarifying
changes as proposed. In response to thecomments regarding which entities may
participate in an OHCA, we clarify thata covered entity participating in an
OHCA or the OHCA itself may contract
with a business associate to provide
certain functions, activities, or services
on its behalf that involve access toprotected health information, provided
the applicable requirements of§§ 164.502(e), 164.504(e), 164.308(b)and 164.314(a) are met. Further, thedefinition of an organized health carearrangement (OHCA) at § 160.103
includes a clinically integrated caresetting in which individuals typicallyreceive health care from more than one
health care provider. We modified§ 164.506(c)(5) as discussed above inrecognition of the fact that not all
participants in a clinically integrated
care setting may be covered entities(e.g., hospital with physicians with staff
privileges that are not workforce
members). Such change does not permit
employers and pharmaceuticalrepresentatives to receive access toprotected health information from or
through an OHCA in a manner theywould otherwise be prohibited fromnow.

A. Background
Section 13402 of the HITECH Act
requires HIPAA covered entities toprovide notification to affectedindividuals and to the Secretary of HHS
following the discovery of a breach of
unsecured protected health information.
In some cases, the Act requires covered
entities also to provide notification to
the media of breaches. In the case of abreach of unsecured protected health

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
information at or by a business associateof a covered entity, the Act requires thebusiness associate to notify the covered
entity of the breach. Finally, the Act
requires the Secretary to post on an HHS
Web site a list of covered entities thatexperience breaches of unsecured
protected health information involving
more than 500 individuals.
Section 13400(1) of the Act defines‘‘breach’’ to mean, generally, theunauthorized acquisition, access, use, ordisclosure of protected healthinformation which compromises the
security or privacy of such information.
The Act includes three exceptions tothis definition to encompass situations
Congress clearly intended not toconstitute breaches: (1) Unintentional
acquisition, access, or use of protected
health information by an employee orother person acting under the authorityof a covered entity or business associate
if such acquisition, access, or use wasmade in good faith and within thecourse and scope of the employment orother professional relationship of such
person with the covered entity or
business associate and such information
is not further acquired, accessed, used,or disclosed by any person (section
13400(1)(B)(i)); (2) inadvertent
disclosure of protected healthinformation from one person authorized
to access protected health information ata facility operated by a covered entity or
business associate to another person
similarly situated at the same facility
and the information received is notfurther acquired, accessed, used ordisclosed without authorization by any
person (section 13400(1)(B)(ii) and (iii));and (3) unauthorized disclosures inwhich an unauthorized person to whom
protected health information isdisclosed would not reasonably havebeen able to retain the information(section 13400(1)(A)).
Further, section 13402(h) of the Act
defines ‘‘unsecured protected healthinformation’’ as ‘‘protected healthinformation that is not secured throughthe use of a technology or methodology
specified by the Secretary in guidance’’and provides that the guidance specify
the technologies and methodologies that
render protected health information
unusable, unreadable, or indecipherable
to unauthorized individuals. Covered
entities and business associates that
implement the specified technologies
and methodologies with respect toprotected health information are notrequired to provide notifications in theevent of a breach of such information—that is, the information is notconsidered ‘‘unsecured’’ in such cases.
As required by the Act, the Secretary
initially issued this guidance on April

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

17, 2009 (it was subsequently published
at 74 FR 19006 on April 27, 2009). The
guidance listed and describedencryption and destruction as the twotechnologies and methodologies for
rendering protected health information
unusable, unreadable, or indecipherable
to unauthorized individuals.
In cases in which notification isrequired, the Act at section 13402
prescribes the timeliness, content, andmethods of providing the breach
notifications.
Section 13402 required HHS to issue
within 180 days of enactment interim
final regulations to implement thesebreach notification requirements. The
Department issued an interim final ruleon August 24, 2009, with a 60-day
public comment period (74 FR 42740).
The interim final rule became effective
on September 23, 2009. In the preamble
to the interim final rule, the Department
also re-issued without substantive
change its Guidance Specifying theTechnologies and Methodologies That
Render Protected Health Information
Unusable, Unreadable, orIndecipherable to Unauthorized
Individuals that was initially issued on
April 17, 2009. The Guidance continues
to specify encryption and destruction as
the two methods for rendering protected
health information unusable,
unreadable, or indecipherable tounauthorized individuals—or‘‘secured’’—and thus, exempt from thebreach notification obligations. See 74
FR 42741–43.
B. Overview of the Interim Final Rule
The interim final rule added a new
subpart D to part 164 of title 45 of theCode of Federal Regulations (CFR) to
implement the breach notification
provisions of section 13402 of the
HITECH Act. In developing the interim
final rule, the Department consulted
closely with the Federal Trade
Commission (FTC), which administers
similar breach notification requirements
on vendors of personal health records(PHRs) and their third party service
providers under section 13407 of the
HITECH Act. The interim final rule andFTC’s Health Breach Notification Rule
(74 FR 42962, published August 25,2009) made clear that entities operating
as HIPAA covered entities and businessassociates are subject to HHS’, and not
the FTC’s, breach notification rule.
Second, to address those limited cases
where an entity may be subject to both
HHS’ and the FTC’s rules, such as avendor that offers PHRs to customers ofa HIPAA covered entity as a businessassociate and also offers PHRs directly
to the public, both sets of regulations
were harmonized by including the same

PO 00000

Frm 00075

Fmt 4701

Sfmt 4700

5639

or similar language, within theconstraints of the statutory language.
The 60-day public comment period on
the interim final rule closed on October23, 2009. The Department received
approximately 120 comments during thecomment period from a variety ofentities, including health care providers,
hospital and medical associations,health plans, educational institutions,information technology companies,
privacy and security advocates,
consumer groups, state agencies, andseveral members of Congress. The
provisions of the interim final rule are
discussed in more detail below, alongwith the public comments received, andthe provisions of this final rule.
C. Section-by-Section Description of
Final Rule and Response to Comments
1. Section 164.402—Definitions
a. Definition of ‘‘Breach’’Interim Final Rule
Section 13400(1)(A) of the Act defines‘‘breach’’ as the ‘‘unauthorizedacquisition, access, use, or disclosure ofprotected health information which
compromises the security or privacy ofsuch information, except where an
unauthorized person to whom suchinformation is disclosed would notreasonably have been able to retain suchinformation.’’ Section 13400(1)(B) of the
Act provides two additional exceptions
to the definition of ‘‘breach.’’ The
interim final rule at 45 CFR 164.402
defined a ‘‘breach’’ to mean generally‘‘the acquisition, access, use, ordisclosure of protected healthinformation in a manner not permitted[by the Privacy Rule] which
compromises the security or privacy ofthe protected health information.’’ The
definition included the statutory
exceptions to the definition (discussed
below) and clarified that‘‘unauthorized’’ for purposes of thestatute meant in a manner not permitted
by the Privacy Rule.
In addition, for purposes of thisdefinition, the rule provided that‘‘compromises the security or privacy ofthe protected health information’’means poses a significant risk offinancial, reputational, or other harm to
the individual. The Department
included this standard regarding asignificant risk of harm to the individual(i.e., harm standard) after considering
public comment received in response to
the Department’s request for
information on the HITECH Act’s breach
notification provisions. See 74 FR
19006. The inclusion of the harmstandard was intended to align the
Department’s rule with many State

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5640

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

breach notification laws, as well as
existing obligations on Federal agencies
pursuant to OMB Memorandum M–07–
16, that have similar standards fortriggering breach notification. In
addition, the standard was intended toensure that consumers were not flooded
with breach notifications forinconsequential events, which could
cause unnecessary anxiety and eventual
apathy among consumers.
To determine whether animpermissible use or disclosure ofprotected health information constitutes
a breach under this standard, covered
entities and business associates wererequired to perform a risk assessment todetermine if there is a significant risk ofharm to the individual as a result of theimpermissible use or disclosure. In
conducting the risk assessment, covered
entities and business associates were toconsider a number or combination offactors, including who impermissiblyused the information or to whom theinformation was impermissibly
disclosed; whether the covered entity or
business associate had taken steps tomitigate or eliminate the risk of harm;
whether the protected healthinformation was actually accessed; andwhat type or amount of protected healthinformation was impermissibly used ordisclosed.
The rule provided further that animpermissible use or disclosure ofprotected health information that
qualifies as a limited data set but also
excludes dates of birth and zip codes(both identifiers that may otherwise be
included in a limited data set) does notcompromise the security or privacy ofthe protected health information. The
Department included this narrow
exception in the belief that it would bevery difficult to re-identify a limited
data set that excludes dates of birth andzip codes. Thus, a breach of suchinformation would pose a low level ofrisk of harm to an individual.
The interim final rule also included
the three statutory exceptions to thedefinition of breach. To implement
section 13400(1)(B)(i) of the Act, thefirst regulatory exception provided thata breach excludes any unintentional
acquisition, access, or use of protected
health information by a workforce
member or person acting under theauthority of a covered entity or businessassociate, if such acquisition, access, oruse was made in good faith and within
the scope of authority and does not
result in further use or disclosure in amanner not permitted by the Privacy
Rule. We substituted the term‘‘workforce members’’ for the statutory
term ‘‘employees’’ because ‘‘workforce
member’’ is a defined term for purposes

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

of the HIPAA Rules and means
employees, volunteers, trainees, andother persons whose conduct, in theperformance of work for a covered
entity or business associate, is under the
direct control of such covered entity or
business associate.
In addition to unintentional, goodfaith access to protected healthinformation by workforce members, thisexception covers similar access by abusiness associate of a covered entity or
subcontractor with respect to a businessassociate or other person acting on
behalf of a covered entity or businessassociate. The exception does not,however, cover situations involving
snooping employees, because access asa result of such snooping would beneither unintentional nor done in goodfaith.
To implement section 13400(1)(B)(ii)and (iii) of the Act, the second
regulatory exception provided that abreach excludes inadvertent disclosuresof protected health information from aperson who is authorized to accessprotected health information at acovered entity or business associate toanother person authorized to accessprotected health information at the same
covered entity, business associate, ororganized health care arrangement inwhich the covered entity participates.
The regulatory exception includes
reference to an ‘‘organized health carearrangement’’ to capture, among otherthings, clinically integrated care settings
in which individuals typically receive
health care from more than one healthcare provider, such as a hospital, andthe health care providers who have staff
privileges at the hospital.
In this regulatory exception, we alsointerpreted the statutory limitations thatthe disclosure be to ‘‘another person
similarly situated at the same facility’’
to mean that the disclosure be toanother person authorized to accessprotected health information (even if thetwo persons may not be authorized toaccess the same types of protected
health information) at the same covered
entity, business associate, or organized
health care arrangement in which thecovered entity participates (even if thecovered entity, business associate, ororganized health care arrangement has
multiple facilities or locations across thecountry).
Finally, to implement section
13400(1)(A) of the Act, the interim final
rule exempted disclosures of protected
health information where a covered
entity or a business associate has a goodfaith belief that an unauthorized person
to whom the disclosure was madewould not reasonably have been able toretain such information. For example, if

PO 00000

Frm 00076

Fmt 4701

Sfmt 4700

a covered entity, due to a lack ofreasonable safeguards, sends a numberof explanations of benefits (EOBs) to thewrong individuals and a few of the
EOBs are returned by the post office,unopened, as undeliverable, the covered
entity can conclude that the improper
addressees could not reasonably haveretained the information. The EOBs thatwere not returned as undeliverable,
however, and that the covered entity
knows were sent to the wrong
individuals, should be treated as
potential breaches. As another example,
if a nurse mistakenly hands a patient thedischarge papers belonging to another
patient, but she quickly realizes her
mistake and recovers the protected
health information from the patient, thiswould not constitute a breach if thenurse can reasonably conclude that thepatient could not have read or otherwise
retained the information.
With respect to any of the three
exceptions discussed above, a covered
entity or business associate has theburden of proof, pursuant to§ 164.414(b) (discussed below), forshowing why breach notification was
not required. Accordingly, the covered
entity or business associate must
document why the impermissible use or
disclosure falls under one of the above
exceptions.
Overview of Public Comments
Of the approximately 85 publiccomments received on the interim final
rule addressing the definition of breach,approximately 70 of those comments
addressed the harm standard and risk
assessment approach in the interim final
rule. We received approximately 60
comments in support of the harmstandard and the risk assessment
approach. The commenters in supportof this approach included providers,
health plans, professional associations,and certain members of Congress. These
commenters argued that the inclusion of
the harm standard and accompanying
risk assessment was consistent with thestatutory language, aligned the interim
final rule with many State breach
notification laws and Federal policies,
and appropriately placed the obligation
to determine if a breach had occurred on
covered entities and business associates
since they had the requisite knowledgeof the incident to best assess the likely
impact of the impermissible use or
disclosure.
The proponents of the harm standard
and risk assessment approach also
argued that its removal would increase
the cost and burden of implementing
the rule for covered entities, businessassociates, as well as HHS, and may
cause unnecessary anxiety and eventual

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
apathy among consumers if notifications
are sent when there is no risk of harmto the individual.
We also received approximately 10
comments opposed to the harmstandard. Generally, the commenters
opposed to this approach were membersof Congress and consumer advocacy
groups. Some opponents of the harmstandard argued that its addition to theinterim final rule set too high a bar for
triggering breach notification, which
was contrary to statutory intent. These
commenters argued that the final ruleshould adopt a bright line standard forbreach notification to ensure that
individuals are aware of allimpermissible uses and disclosures of
their health information regardless ofthe potential risk and to make
implementation and enforcement of therule more uniform by removing thediscretion and judgment given to
covered entities in the interim final rule.
These commenters argued that suchtransparency would better breed
consumer trust and would allow
individuals to assess the risk of harmthemselves and take necessary measures
to mitigate an impermissible use or
disclosure of their health information.
Other commenters, while opposed toa harm standard to trigger breach
notification, nonetheless agreed thatbreach notification should not be
required following every impermissible
use or disclosure of unsecured protected
health information no matter how
inconsequential the breach. These
commenters argued that, rather than asubjective standard measuring the riskof harm to an individual, the final ruleshould include a more objective
standard against which entities would
be required to assess risk. These
commenters suggested that the risk
assessment should focus on the risk thatthe protected health information wascompromised instead of on the risk ofharm to the individual. Additionally,
these commenters proposed four factorsthat should be considered to determine
whether the information wascompromised: (1) To whom theinformation was impermissibly
disclosed; (2) whether the information
was actually accessed or viewed; (3) the
potential ability of the recipient to
identify the subjects of the data; and (4)in cases where the recipient is thedisclosing covered entity’s businessassociate or is another covered entity,
whether the recipient took appropriate
mitigating action.
Some commenters stated that thedefault function of the rule was unclear.
In particular, these commentersquestioned whether the rule required
notification of a breach unless it is

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

determined that a significant risk ofharm does not exist, or alternatively,
required notification only in cases
where significant risk of harm can bedemonstrated. Other commenterssuggested that we include in thedefinition an express presumption of abreach unless an entity can show
otherwise.
Additionally, many commenters
responded to the treatment of limited
data sets in the interim final rule.
Although many commenters expressed
support for the assertion that limited
data sets that do not contain dates ofbirth and zip codes do not compromise
the security or privacy of protected
health information, most of thesecommenters expressed concern that theinterim final rule did not go far enoughand should exempt even those limited
data sets that contain dates of birth and/or zip codes from the breach notification
requirements. These commenters argued
that no impermissible use or disclosureof a limited data set should trigger
breach notification obligations because
without the 16 direct identifiers that thePrivacy Rule requires to be strippedfrom the information, there is minimalrisk of harm to the individual.
Additionally, commenters indicated it
would be costly and burdensome for
entities to have to re-identify the
information in a limited data set toprovide notification and that reidentifying the information could alsopose an additional risk of harm to theaffected individuals. Finally, othercommenters noted that because
researchers commonly rely on limited
data sets that contain dates of birth andzip codes, researchers would not be able
to take advantage of the exception forcertain limited data sets in the interim
final rule, which may have the effect ofdeterring research.
In contrast, some commenters
expressed concern regarding theinclusion of even the limited exception
to the definition of breach for limited
data sets that do not include dates ofbirth and zip codes. These commenters
supported requiring entities to performa risk assessment to determine whether
an impermissible use or disclosure ofsuch information compromised the
security or privacy of the information,
as there may be a risk of reidentification of this information
depending on who received theinformation.
Final Rule
After considering the publiccomments on the definition, theDepartment in this final rule amends thedefinition of ‘‘breach’’ at 45 CFR
164.402. Based on the comments, we

PO 00000

Frm 00077

Fmt 4701

Sfmt 4700

5641

recognize that the language used in theinterim final rule and its preamble
could be construed and implemented inmanners we had not intended.
Accordingly, this final rule modifies
and clarifies the definition of breachand the risk assessment approach
outlined in the interim final rule.
First, we have added language to thedefinition of breach to clarify that animpermissible use or disclosure ofprotected health information ispresumed to be a breach unless thecovered entity or business associate, asapplicable, demonstrates that there is alow probability that the protected healthinformation has been compromised. We
recognize that some persons may haveinterpreted the risk of harm standard in
the interim final rule as setting a muchhigher threshold for breach notification
than we intended to set. As a result, wehave clarified our position that breach
notification is necessary in all situations
except those in which the covered entity
or business associate, as applicable,
demonstrates that there is a low
probability that the protected healthinformation has been compromised (orone of the other exceptions to thedefinition of breach applies). We believethat the express statement of thispresumption in the final rule will help
ensure that all covered entities andbusiness associates interpret and apply
the regulation in a uniform manner andalso responds to commenters thatindicated the default function of therule was unclear. This new language isalso consistent with § 164.414, which
provides that covered entities andbusiness associates have the burden of
proof to demonstrate that all
notifications were provided or that animpermissible use or disclosure did notconstitute a breach (such as bydemonstrating through a risk assessmentthat there was a low probability that theprotected health information had been
compromised) and must maintaindocumentation sufficient to meet thatburden of proof.
Second, to further ensure that thisprovision is applied uniformly andobjectively by covered entities andbusiness associates, we have removed
the harm standard and modified the risk
assessment to focus more objectively on
the risk that the protected healthinformation has been compromised.
Thus, breach notification is not required
under the final rule if a covered entity
or business associate, as applicable,
demonstrates through a risk assessmentthat there is a low probability that theprotected health information has been
compromised, rather than demonstratethat there is no significant risk of harmto the individual as was provided under

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5642

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

the interim final rule. The final rule also
identifies the more objective factors
covered entities and business associates
must consider when performing a risk
assessment to determine if the protected
health information has been
compromised and breach notification isnecessary.
Although some commenters urged us
to implement a bright line standard,requiring notification for all
impermissible uses and disclosures
without any assessment of risk, we
believe that a risk assessment isnecessary. The statute acknowledges, by
including a specific definition of breachand identifying exceptions to thisdefinition, as well as by providing thatan unauthorized acquisition, access,use, or disclosure of protected healthinformation must compromise thesecurity or privacy of such information
to be a breach, that there are several
situations in which unauthorizedacquisition, access, use, or disclosure ofprotected health information is so
inconsequential that it does not warrant
notification. In addition to the statutory
exceptions that have been included inboth the interim final rule and this final
rule, there may be other similar
situations that do not warrant breach
notification. We agree with commentersthat providing notification in such cases
may cause the individual unnecessary
anxiety or even eventual apathy if
notifications of these types of incidents
are sent routinely. For example, if acovered entity misdirects a fax
containing protected health information
to the wrong physician practice, andupon receipt, the receiving physician
calls the covered entity to say he hasreceived the fax in error and has
destroyed it, the covered entity may beable to demonstrate after performing arisk assessment that there is a low riskthat the protected health information
has been compromised. Although this
scenario does not fit into any of thestatutory or regulatory exceptions, we
believe that, like the exceptions tobreach, notification should not be
required if the covered entity
demonstrates a low probability that thedata has been compromised.
Commenters argued that a rule
containing a bright line standard for
notification would be easier for both theregulated entities to implement and for
HHS to enforce. We disagree. Althougha rule that required notification
following every impermissible use or
disclosure may appear easier forcovered entities and business associates
to implement—as no determination of
the risk that the protected healthinformation has been compromised
would be required—in effect, a bright

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

line standard would be extremely
burdensome and costly for entities toimplement. With no risk assessment
following an impermissible use or
disclosure, entities may be required toprovide many notices each year forincidents that did not compromise thesecurity or privacy of an individual’s
protected health information.
Although we do not believe a brightline approach to breach notification isappropriate, we do agree with thecommenters who expressed concernthat the risk assessment focus on ‘‘harm
to an individual’’ in the interim final
rule was too subjective and would leadto inconsistent interpretations andresults across covered entities andbusiness associates. As a result, insteadof assessing the risk of harm to theindividual, covered entities andbusiness associates must assess theprobability that the protected healthinformation has been compromised
based on a risk assessment thatconsiders at least the following factors:(1) The nature and extent of theprotected health information involved,
including the types of identifiers andthe likelihood of re-identification; (2)the unauthorized person who used theprotected health information or towhom the disclosure was made; (3)whether the protected healthinformation was actually acquired or
viewed; and (4) the extent to which therisk to the protected health information
has been mitigated. We believe that theuse of these factors, which are derived
from the factors listed in the interim
final rule as well as many of the factors
suggested by commenters, will result ina more objective evaluation of the risk
to the protected health information anda more uniform application of the rule.
As we have modified andincorporated the factors that must be
considered when performing a risk
assessment into the regulatory text,
covered entities and business associates
should examine their policies to ensurethat when evaluating the risk of animpermissible use or disclosure they
consider all of the required factors. In
addition, given the circumstances of theimpermissible use or disclosure,additional factors may need to beconsidered to appropriately assess therisk that the protected healthinformation has been compromised. We
note that, although we have included
this risk assessment in the final rule,
this type of assessment of risk should
not be a new or different exercise forcovered entities and business associates.
Similar assessments of risk that data
have been compromised must be
performed routinely following security

PO 00000

Frm 00078

Fmt 4701

Sfmt 4700

breaches and to comply with certain
State breach notification laws.
The first factor requires covered
entities and business associates toevaluate the nature and the extent of theprotected health information involved,
including the types of identifiers andthe likelihood of re-identification of theinformation. To assess this factor,
entities should consider the type ofprotected health information involvedin the impermissible use or disclosure,
such as whether the disclosure involved
information that is of a more sensitive
nature. For example, with respect tofinancial information, this includes
credit card numbers, social security
numbers, or other information that
increases the risk of identity theft or
financial fraud. With respect to clinicalinformation, this may involve
considering not only the nature of theservices or other information 11 but also
the amount of detailed clinicalinformation involved (e.g., treatment
plan, diagnosis, medication, medical
history information, test results).
Considering the type of protected healthinformation involved in theimpermissible use or disclosure will
help entities determine the probability
that the protected health information
could be used by an unauthorizedrecipient in a manner adverse to theindividual or otherwise used to further
the unauthorized recipient’s own
interests. Additionally, in situations
where there are few, if any, direct
identifiers in the information
impermissibly used or disclosed,
entities should determine whether there
is a likelihood that the protected healthinformation released could be reidentified based on the context and theability to link the information withother available information.12 For
example, if a covered entity
impermissibly disclosed a list of patient
names, addresses, and hospital
identification numbers, the protected
health information is obviously
identifiable, and a risk assessment likely
would determine that there is more thana low probability that the information
has been compromised, dependent on
an assessment of the other factors
discussed below. Alternatively, if thecovered entity disclosed a list of patientdischarge dates and diagnoses, the11 We caution that many forms of healthinformation, not just information about sexuallytransmitted diseases or mental health or substanceabuse, are sensitive.
12 Information that has been de-identified inaccordance with 45 CFR 164.514(a)–(c) is notprotected health information, and thus, any
inadvertent or unauthorized use or disclosure ofsuch information is not considered a breach for
purposes of this rule.

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
entity would need to consider whether
any of the individuals could be
identified based on the specificity of thediagnosis, the size of the community
served by the covered entity, or whether
the unauthorized recipient of theinformation may have the ability to
combine the information with otheravailable information to re-identify theaffected individuals (considering thisfactor in combination with the second
factor discussed below). We emphasize,
however, that the entity must evaluate
all the factors, including those
discussed below, before making adetermination about the probability ofrisk that the protected healthinformation has been compromised.
The second factor requires covered
entities and business associates toconsider the unauthorized person who
impermissibly used the protected healthinformation or to whom theimpermissible disclosure was made.
Entities should consider whether theunauthorized person who received theinformation has obligations to protect
the privacy and security of theinformation. For example, as discussed
in the interim final rule, if protected
health information is impermissibly
disclosed to another entity obligated toabide by the HIPAA Privacy andSecurity Rules or to a Federal agency
obligated to comply with the Privacy
Act of 1974 and the Federal Information
Security Management Act of 2002, there
may be a lower probability that theprotected health information has been
compromised since the recipient of theinformation is obligated to protect theprivacy and security of the information
in a similar manner as the disclosing
entity. We also emphasize that thisfactor should be considered in
combination with the factor discussed
above regarding the risk of reidentification. If the information
impermissibly used or disclosed is not
immediately identifiable, entities
should determine whether theunauthorized person who received theprotected health information has theability to re-identify the information.
For example, if information containing
dates of health care service anddiagnoses of certain employees wasimpermissibly disclosed to theiremployer, the employer may be able todetermine that the information pertains
to specific employees based on otherinformation available to the employer,such as dates of absence from work. In
this case, there may be more than a low
probability that the protected healthinformation has been compromised.
Several commenters suggested that arisk assessment need be completed
following only impermissible

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

disclosures of protected healthinformation, since information
impermissibly ‘‘used’’ remains within
the covered entity or business associate.
We disagree. The final rule requires arisk assessment to be performed
following both impermissible uses anddisclosures (that do not otherwise fallwithin the other enumerated exceptions
to breach). However, the fact that
information only is impermissibly usedwithin a covered entity or businessassociate and the impermissible use
does not result in further impermissible
disclosure outside the entity, issomething that may be taken into
account in conducting the risk
assessment and may reduce theprobability that the protected healthinformation has been compromised.
The third factor requires covered
entities and business associates toinvestigate an impermissible use or
disclosure to determine if the protected
health information was actuallyacquired or viewed or, alternatively, if
only the opportunity existed for the
information to be acquired or viewed.
For example, as we discussed in theinterim final rule, if a laptop computer
was stolen and later recovered and aforensic analysis shows that theprotected health information on thecomputer was never accessed, viewed,
acquired, transferred, or otherwise
compromised, the entity could
determine that the information was not
actually acquired by an unauthorizedindividual even though the opportunity
existed. In contrast, however, if acovered entity mailed information to thewrong individual who opened theenvelope and called the entity to saythat she received the information inerror, then, in this case, theunauthorized recipient viewed andacquired the information because she
opened and read the information to theextent that she recognized it was mailed
to her in error.
The final factor included in the final
rule requires covered entities andbusiness associates to consider theextent to which the risk to the protected
health information has been mitigated.
Covered entities and business associates
should attempt to mitigate the risks tothe protected health information
following any impermissible use or
disclosure, such as by obtaining therecipient’s satisfactory assurances thatthe information will not be further usedor disclosed (through a confidentiality
agreement or similar means) or will be
destroyed, and should consider theextent and efficacy of the mitigation
when determining the probability thatthe protected health information has
been compromised. We note that thisPO 00000

Frm 00079

Fmt 4701

Sfmt 4700

5643

factor, when considered in combination
with the factor regarding theunauthorized recipient of theinformation discussed above, may leadto different results in terms of the risk
to the protected health information. For
example, a covered entity may be able
to obtain and rely on the assurances ofan employee, affiliated entity, businessassociate, or another covered entity thatthe entity or person destroyed
information it received in error, while
such assurances from certain third
parties may not be sufficient. As
described above, certain commenterssuggested that mitigation should only beconsidered where the recipient of theinformation is a business associate of
the covered entity or another covered
entity. We do not in this rule limit thisfactor to those circumstances but, as
discussed above, acknowledge that therecipient of the information will have an
impact on whether the covered entity
can conclude that an impermissible useor disclosure has been appropriately
mitigated.
A covered entity’s or businessassociate’s analysis of the probability
that protected health information has
been compromised following animpermissible use or disclosure must
address each factor discussed above.
Other factors may also be considered
where necessary. Covered entities andbusiness associates must then evaluate
the overall probability that the protected
health information has been
compromised by considering all thefactors in combination, and we expect
these risk assessments to be thorough,completed in good faith, and for theconclusions reached to be reasonable. If
an evaluation of the factors discussed
above fails to demonstrate that there isa low probability that the protected
health information has been
compromised, breach notification isrequired. We do note, however, that acovered entity or business associate has
the discretion to provide the required
notifications following an impermissible
use or disclosure of protected healthinformation without performing a risk
assessment. Because the final rule
clarifies the presumption that a breachhas occurred following every
impermissible use or disclosure ofprotected health information, entities
may decide to notify without evaluationof the probability that the protected
health information has been
compromised. In the future, we will
issue additional guidance to aid covered
entities and business associates in
performing risk assessments withrespect to frequently occurring
scenarios.

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5644

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

In addition to the removal of the harmstandard and the creation of moreobjective factors to evaluate theprobability that protected healthinformation has been compromised, we
have removed the exception for limited
data sets that do not contain any datesof birth and zip codes. In the final rule,
following the impermissible use or
disclosure of any limited data set, acovered entity or business associatemust perform a risk assessment that
evaluates the factors discussed above todetermine if breach notification is not
required.
The vast majority of commenters were
not supportive of the exception forcertain limited data sets outlined in theinterim final rule, either because they
believed the exception did not go far
enough and would chill research thatneeded access to birth dates and zip
codes in limited data sets, or because ofconcerns regarding the re-identifiabilityof the limited information to which the
exception applied. Based on thecomments, we believe it is appropriate
to require the impermissible use or
disclosure of a limited data set, eventhose that do not contain dates of birthand zip codes, to be subject to a risk
assessment to demonstrate that breach
notification is not required. The final
rule expressly includes a factor thatwould require consideration of the reidentifiability of the information, as
well a factor that requires an assessmentof the unauthorized person who used
the protected health information or towhom the disclosure was made (i.e.,
whether this person has the ability to reidentify the affected individuals). Thus,
the factors are particularly suited toaddress the probability that a data set
without direct identifiers has been
compromised following animpermissible use or disclosure.
Further, we believe in most cases thatthe result would be the same under thisfinal rule as under the interim final rulewith respect to whether animpermissible use or disclosure of alimited data set that also excludes datesof birth and zip codes constitutes abreach for which notification isrequired. Due to the lack of identifiers
present in the protected healthinformation, entities may reasonably
determine that there is a low probabilityof risk that the information has been
compromised; however, we stress that
this is a fact specific determination to bemade based on the circumstances of theimpermissible use or disclosure.
We encourage covered entities andbusiness associates to take advantage ofthe safe harbor provision of the breach
notification rule by encrypting limited
data sets and other protected health

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

information pursuant to the GuidanceSpecifying the Technologies andMethodologies that Render Protected
Health Information Unusable,
Unreadable, or Indecipherable to
Unauthorized Individuals (74 FR 42740,
42742). If protected health informationis encrypted pursuant to this guidance,then no breach notification is required
following an impermissible use or
disclosure of the information.
In addition to the comments
discussed above, it was suggested thatcovered entities be required to include
in their notice of privacy practices
information about how a risk
assessment will be conducted or theirinternal policies for determining
whether a breach has occurred andnotification is warranted. It was alsosuggested that the breach notice to theindividual following discovery of abreach of unsecured protected healthinformation contain information about
the covered entity or businessassociate’s risk assessment to help theindividual better assess the level of
threat posed by the breach and to better
determine the appropriate steps, if any,
to take.
We decline to require that the covered
entity’s notice of privacy practices
include a description of how a risk
assessment will be conducted, although
covered entities may include suchinformation in their notice of privacy
practices if they choose. While each risk
assessment will differ depending on thespecific facts and circumstances
surrounding the impermissible use or
disclosure, we believe that themodifications in this final rule will help
ensure that covered entities andbusiness associates perform risk
assessments more uniformly andobjectively. We also note that thecontent requirements for the notice tothe individual outlined in § 164.404(c)already require that the individual be
notified of the circumstances of abreach, as well as what steps
individuals should take to protect
themselves from potential harm
resulting from the breach.
One commenter suggested that we
require a covered entity to hire an
independent organization to assess therisk of an impermissible use or
disclosure to determine if breach
notification is required. We do notbelieve such a requirement is necessary,although covered entities are free toengage independent organizations toassist in making such determinations
provided that, if access to protected
health information is required, businessassociate agreements are entered into toprotect the information. Further, we
believe the modifications in this final

PO 00000

Frm 00080

Fmt 4701

Sfmt 4700

rule are conducive to more uniform risk
assessments across covered entities andbusiness associates. Additionally, aswith the interim final rule, we note thatcovered entities and business associates
have the burden of proof, pursuant to§ 164.414, to demonstrate that all
notifications were provided or that animpermissible use or disclosure did notconstitute a breach and to maintaindocumentation (e.g., of the risk
assessment demonstrating that there
was a low probability that the protected
health information had been
compromised or of the assessment thatthe impermissible use or disclosure falls
within one of the other exceptions tobreach), pursuant to 45 CFR
164.530(j)(1)(iv), as necessary to meetthis burden of proof. Thus, covered
entities and business associates haveadequate incentive to conduct
reasonable and diligent risk
assessments.
Finally, after reviewing andconsidering the comments received
regarding the exceptions to thedefinition of breach in the interim final
rule, the Department adopts these
exceptions without modification in thisfinal rule. Although the substance of
these exceptions has not changed, these
exceptions are now located at paragraph(1) of the definition of breach instead ofparagraph (2) to accommodate themodifications discussed above. We
respond to the public comments
addressing these exceptions, as well asother comments received on thedefinition of ‘‘breach,’’ below.
Response to Other Public Comments
Comment: Many commenters
expressed concern that violations of theminimum necessary standard maytrigger breach notification obligations.
Response: We do not believe it would
be appropriate to exempt minimum
necessary violations from the breach
notification obligations as we do notbelieve that all minimum necessary
violations present a low probability thatthe protected health information has
been compromised. Thus, uses ordisclosures that impermissibly involve
more than the minimum necessary
information, in violation of§§ 164.502(b) and 164.514(d), may
qualify as breaches. Such incidents
must be evaluated as any otherimpermissible uses or disclosures todetermine whether breach notification
is not required.
As explained above, there are several
factors to be considered when
determining the probability that theprotected health information involvedin an impermissible use or disclosure
has been compromised, including the

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
unauthorized person who used theinformation or to whom the disclosure
was made. Thus, where a minimum
necessary violation occurs in adisclosure to a business associate or as
an internal use within a covered entity
or business associate, the fact that the
information was not acquired by a third
party would be considered as part of therisk assessment and may help lead tothe conclusion that there is a low
probability that the protected healthinformation has been compromised.
Alternatively, covered entities andbusiness associates may determine thatcertain minimum necessary violations
fall within the exceptions to thedefinition of breach at § 164.402(1)(i) or(1)(ii).
We note that the Privacy Rule’s
minimum necessary standard requires acovered entity to make reasonable
efforts to limit access to protected healthinformation to those persons or classesof persons who need access to protected
health information to carry out theirduties and to disclose an amount ofprotected health information reasonably
necessary to achieve the purpose of adisclosure. The Privacy Rule requires
covered entities to determine and definein their policies and procedures how theminimum necessary standard applies totheir own uses and disclosures. Thus,
covered entities are in a good position
to know when such policies andprocedures have been violated and toassess the probability that the incident
has compromised the security or
privacy of the information. Finally, we
will consider including further guidance
regarding the interaction between theminimum necessary standard and thebreach notification requirements in theguidance required by section
13405(b)(1)(B) of the HITECH Act.
Comment: Several commenters asked
that we clarify the differences between‘‘acquisition,’’ ‘‘access,’’ ‘‘use,’’ and‘‘disclosure’’ in the exceptions in the
final rule. These commenters expressed
confusion regarding the use of theseterms in the first two exceptions to thedefinition of breach, stating that theterm ‘‘acquisition’’ connotes a
disclosure of information, and thus, theexception regarding unintentional
acquisition, access, or use of protected
health information by a workforce
member or person acting under theauthority of a covered entity or businessassociate implicitly includes disclosuresof protected health information.
Response: While the Privacy Rule
uses the terms ‘‘use’’ and ‘‘disclosure,’’we included both ‘‘acquisition’’ and‘‘access’’ in the regulatory text forconsistency with the statutory language.
We interpret ‘‘acquisition’’ and ‘‘access’’

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

to information based on their plain
meanings and believe that both terms
are encompassed within the current
definitions of ‘‘use’’ and ‘‘disclosure’’ inthe HIPAA Rules. For example, anacquisition may be a ‘‘use’’ or‘‘disclosure’’ depending on who
acquired the information—i.e., aworkforce member or someone outside
the covered entity, such as a businessassociate.
Comment: Several commenters
supported our interpretations of thestatutory terms ‘‘employee,’’ ‘‘same
facility,’’ and ‘‘similarly situatedindividual’’ with respect to the
exceptions to the definition of breach.
Response: We retain theseclarifications in this final rule.
Comment: Some commenters asked
that we use the term ‘‘use’’ instead of‘‘disclosure’’ to describe the type of
information exchange contemplated by
the exception for certain inadvertent
disclosures among persons similarly
authorized to access protected healthinformation at a covered entity or
business associate since the informationmust be shared within a covered entity
or business associate for the exception
to apply.
Response: We clarify that the
exception at paragraph (1)(ii) of thedefinition of ‘‘breach’’ is intended toapply to certain ‘‘disclosures’’ that may
occur ‘‘at’’ a covered entity, businessassociate, or organized health carearrangement in which the covered entity
participates—e.g., to persons onsite at acovered entity’s facility that are notworkforce members, such as physicianswith staff privileges at a hospital. For
impermissible ‘‘uses’’ of protected
health information among workforce
members of a covered entity or abusiness associate, a covered entity or
business associate should determine
whether the exception to breach atparagraph (1)(i) regarding certain
unintentional acquisition, access, or use
by a workforce member or person acting
under the authority of a covered entity
or business associate applies.
Comment: One commenter asked if
breach notification is required in cases
where an impermissible use or
disclosure originally qualifies for eitherof the exceptions to breach at§ 164.402(1)(i) or (1)(ii) at the time theincident occurs but later no longer fits
within the exception because theprotected health information is further
used or disclosed in an impermissible
manner.
Response: The applicability of an
exception to breach must be judged at
the time the incident is discovered andevaluated. If an exception to breach isdetermined to apply such that

PO 00000

Frm 00081

Fmt 4701

Sfmt 4700

5645

notification is not warranted, theinquiry into that breach ends; however,the covered entity or business associateshould take appropriate steps to ensurethat the information is not further usedor disclosed impermissibly. If, sometime
after making the determination that the
exception applied, the information isimpermissibly used or disclosed, thecovered entity or business associateshould treat that incident as a separate
impermissible use or disclosure thatwarrants evaluation as a breach on its
own. As explained more fully below, we
treat a breach as having occurred at thetime of the impermissible use or
disclosure, which in the case of the firsttwo exceptions to breach, is at the timeof the ‘‘further’’ impermissible use or
disclosure.
Comment: One commenter asked that
we broaden the application of the
inadvertent disclosure exception to
apply to all routine disclosures between
covered entities. Other commenters
asked that the rule exempt from thebreach notification obligations
situations in which a covered entity
discloses information to a businessassociate or another covered entity.
Commenters noted that because covered
entities and business associates are
required to protect the privacy ofprotected health information, there islittle risk that even an impermissible
disclosure between such entities would
compromise the security or privacy of
the information.
Response: We do not agree that suchsituations warrant a blanket exception
from the breach notification rules. In
appropriate cases, some of theseimpermissible disclosures among
covered entities and covered entities
and business associates may fall within
the existing exceptions to breach atparagraphs (1)(i) and (ii) of thedefinition. Otherwise, such disclosures
must be evaluated as to the probability
that the protected health information
has been compromised based on a risk
assessment of a number of factors.
While the fact that the recipient of animpermissible disclosure is a covered
entity or business associate withobligations to protect the privacy andsecurity of protected health information
is a consideration with respect toassessing the risk that the protected
health information has been
compromised, it is not the only factor.
For example, a covered entity or
business associate must also evaluate
the extent to which the risk to theprotected health information has been
mitigated.
Comment: Several commenterssuggested that the exceptions to breachshould not apply to situations where

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5646

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

workforce members or employees
further use or disclose information they
unintentionally or inadvertently
acquired, accessed, or used, even if such
further use or disclosure is permitted
under the Privacy Rule. Additionally,
these commenters suggested that thebreach exceptions should apply only incases in which the workforce member or
employee has taken appropriate steps tomitigate the unintentional acquisition,access, or use of protected healthinformation, such as by alerting thesender of the misdirected information, if
applicable, and returning or destroyingit.
Response: We do not believe it isappropriate to prohibit the sharing ofprotected health information for
permissible purposes following anunintentional or inadvertent error by aworkforce member or an employee.
Doing so would restrict access anddisclosure of the protected healthinformation for necessary treatment andother important purposes to the extent
the workforce member or employee
needed access to the information in the
future for authorized purposes, which
would adversely affect health caredelivery. We believe that the rule strikes
an appropriate balance by not allowing
workforce member errors to be exceptedfrom the definition of breach in cases
where the workforce member takes theinformation he or she has mistakenly
obtained and then misuses it.
With respect to requiring workforce
members or employees to takeappropriate steps to mitigate theirunintentional access to protected healthinformation, we note that the Privacy
Rule already requires covered entities toensure as part of their minimum
necessary policies and procedures thatworkforce members have appropriate
access to protected health information.
Therefore, covered entities should
ensure that workforce members who
gain access in an unauthorized manner
to protected health information do notcontinue to have such unauthorizedaccess. This may require having policies
which require workforce members toreturn or destroy the information towhich they obtained unauthorizedaccess. Further, covered entities must
implement reasonable safeguards toprotect against impermissible uses anddisclosures, including further
impermissible uses and disclosures by aworkforce member who has gained
unauthorized access to protected healthinformation.
Comment: One commenter asked that
we include an exception in the final
rule for situations in which a laptop is
lost and recovered and a forensic
analysis shows that the protected health

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

information on the computer was notaccessed. The commenter stated that
because the forensic analysis showedthat the information was notcompromised, a risk assessment should
not be required.
Response: We do not include an
explicit exception for this particularscenario. As we explained above, incases where a lost laptop is recovered,
the fact that a forensic analysis of thecomputer shows that its information
was not accessed is a relevant
consideration for the risk assessment,
and entities in such situations may beable to demonstrate a low probability
that the information has been
compromised. However, covered
entities and business associates stillmust document their risk assessments inthese cases. We also note, as we did in
the interim final rule, if a computer islost or stolen, we do not consider it
reasonable to delay breach notification
based on the hope that the computer
will be recovered.
Comment: Some commenters asked
that we create an exception to breach tocover certain routine impermissible
disclosures of protected healthinformation. For example, commenters
asked that we except from notification
disclosures made as a result of thecovered entity mailing information to apatient’s old address, faxing information
to the wrong number, disclosures madeas a result of leaving a voice message at
the wrong number reminding a patientof an upcoming appointment, or, insituations where patients have identicalor similar names, contacting the wrong
patient to inform him or her that lab
results were ready.
Response: We decline to create suchan exception. The ability of a covered
entity or business associate to
demonstrate that a particular situation
poses a low probability that theprotected health information wascompromised is very fact specific andwill depend on an assessment of all of
the factors discussed above, such as towhom the information was disclosed,
what information was disclosed, andwhat mitigation has taken place. We
also note that, in some cases, some ofthe situations contemplated by thecommenters may fall within an existing
exception. For example, if a covered
entity mails protected healthinformation about an individual to awrong address, the impermissible
disclosure may fall into the exception atparagraph (1)(iii) of the definition ofbreach if the information is returned,
undelivered and unopened, to thecovered entity, such that an
unauthorized recipient could notreasonably have retained the

PO 00000

Frm 00082

Fmt 4701

Sfmt 4700

information. If, however, theinformation was not returned or if thecovered entity was informed by theunauthorized recipient that he hadreceived and opened the mail in error,
the covered entity would need tocomplete a risk assessment to determine
the probability that the protected healthinformation had been compromised as aresult of the impermissible disclosure.
Comment: Several commenters asked
that we harmonize the final rule with
the FTC’s Health Breach Notification
final rule.
Response: Although the FTC and HHS
breach notification rules generally apply
to different entities, HHS has worked
closely with the FTC to ensure both setsof regulations were harmonized to thegreatest extent possible by including thesame or similar requirements within theconstraints of the statutory language. In
addition, in the few situations where an
entity provides PHRs to customers of a
HIPAA covered entity through abusiness associate arrangement but also
provides PHRs directly to the public
and a breach of its records occurs, incertain cases, the FTC will deem
compliance with certain provisions of
HHS’ rule as compliance with FTC’s
rule. See 74 FR 42964. In particular, insuch situations, it may be appropriate
for the vendor to provide the same
breach notice to all its PHR customers
since it has a direct relationship with all
the affected individuals. Thus, in thoselimited circumstances where a vendor
of PHRs (1) provides notice toindividuals on behalf of a HIPAA
covered entity, (2) has dealt directlywith these individuals in managing
their PHR accounts, and (3) provides
notice to its customers at the same time,
the FTC will deem compliance with
HHS requirements governing the timing,
method, and content of notice to becompliance with the corresponding FTC
rule provisions. Note, however, that thePHR vendor still must comply with allother FTC rule requirements, including
the requirement to notify the FTC
within ten business days after
discovering the breach.
b. Definition of ‘‘Unsecured Protected
Health Information’’Interim Final Rule
Section 13402(h)(1)(A) of the Act
defines ‘‘unsecured protected healthinformation’’ as ‘‘protected healthinformation’’ that is not secured throughthe use of a technology or methodology
specified by the Secretary in guidanceissued under [section 13402(h)(2)].’’ The
Act at section 13402(h)(2) requires that
the Secretary specify in the guidance thetechnologies and methodologies that

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
render protected health information
unusable, unreadable, or indecipherable
to unauthorized individuals.
Accordingly, the interim final ruledefined ‘‘unsecured protected healthinformation’’ as protected healthinformation that is not renderedunusable, unreadable, or indecipherable
to unauthorized individuals through theuse of a technology or methodology
specified by the Secretary in guidance.
This guidance, which was published in
updated form within the preamble tothe interim final rule and madeavailable on the HHS Web site, specifies
that only encryption and destruction,
consistent with National Institute ofStandards and Technology (NIST)
guidelines, renders protected healthinformation unusable, unreadable, or
indecipherable to unauthorizedindividuals such that notification is not
required in the event of a breach of suchinformation.
Overview of Public Comments
While we received a number oftechnical and other comments on theguidance, we did not receive any
comments on the language of the above
definition itself. We intend to address
the comments on the guidance in our
next update to the guidance.
Final Rule
The final rule modifies the interim
final rule’s definition of ‘‘unsecured
protected health information’’ to replace
the term ‘‘unauthorized individuals’’ inthe definition with ‘‘unauthorized
persons.’’ The term ‘‘individual’’ isdefined in § 160.103 to mean the person
who is the subject of the protected
health information, which is not what is
intended with the reference to‘‘individual’’ in the definition of‘‘unsecured protected healthinformation.’’ Accordingly, the final
rule uses more appropriately the term‘‘unauthorized persons.’’ The final rulealso modifies the definition to remove
the term ‘‘on the HHS Web site’’ as
unnecessary language. While we remove
the reference to the HHS Web site fromthe regulatory text, we do plan tocontinue to post updates to the guidanceon the Web site as they are issued.

sroberts on DSK5SPTVN1PROD with

2. Section 164.404—Notification to
Individuals
Interim Final Rule
Section 13402(a) of the Act provides
that a covered entity that accesses,
maintains, retains, modifies, records,
stores, destroys, or otherwise holds,
uses, or discloses unsecured protected
health information shall, in the case ofa breach of such information that is
discovered by the covered entity, notify

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

each affected individual whose
unsecured protected health information
has been, or is reasonably believed by
the covered entity to have been,accessed, acquired, or disclosed as aresult of such breach. Accordingly,§ 164.404(a)(1) of the interim final rule
included the general rule that a covered
entity shall, following the discovery ofa breach of unsecured protected healthinformation, notify each individual
whose unsecured protected healthinformation has been, or is reasonably
believed to have been accessed,
acquired, used, or disclosed as a resultof such breach.
Breaches Treated as Discovered
Section 13402(c) of the HITECH Act
states that a breach shall be treated as
discovered by a covered entity or
business associate as of the first day on
which such breach is known or should
reasonably have been known to thecovered entity or business associate.
The Act also specifies that this
discovery is triggered as soon as any
person, other than the individualcommitting the breach, who is an
employee, officer, or other agent of thecovered entity or business associate
knows or should reasonably have
known of the breach.
Section 164.404(a)(2) of the interim
final rule implemented the Act’s
discovery provision, with respect tocovered entities by stating that a breachshall be treated as discovered by acovered entity on the first day thebreach is known to the covered entity,
or by exercising reasonable diligencewould have been known to the covered
entity. The interim final rule
incorporated the term ‘‘by exercisingreasonable diligence,’’ which is used in
the HIPAA Enforcement Rule anddefined to mean the ‘‘business care andprudence expected from a person
seeking to satisfy a legal requirement
under similar circumstances.’’
Section 164.404(a)(2) of the interim
final rule further provided, in
accordance with the Act, that a covered
entity is deemed to have knowledge ofa breach if such breach is known, or by
exercising reasonable diligence would
have been known, to any person otherthan the person committing the breach,
who is a workforce member or agent of
the covered entity. Thus, the breach istreated as discovered by the covered
entity at the time the workforce memberor other agent has knowledge of thebreach. The rule also clarified that thefederal common law of agency controls
in determining who is an agent of thecovered entity, which is consistent withhow agency liability is determined
under the HIPAA Rules.

PO 00000

Frm 00083

Fmt 4701

Sfmt 4700

5647

Overview of Public Comments
Several commenters argued that abreach should be treated as discoveredby a covered entity only after
management has been notified of theincident. Commenters stated that the
Department should not hold an entity
responsible for knowing of a breach if
an appropriately trained employee fails
to inform the proper persons within theentity of a breach. Other commenters
asked for guidance and moreclarification regarding what it means fora covered entity or business associate to
be exercising reasonable diligence, suchas what frequency of monitoring forbreaches is expected or what types ofsystems must covered entities andbusiness associates have in place todetect breaches.
Final RuleWe retain § 164.404(a)(2) in this final
rule without modification. We decline
to adopt the suggestion that a covered
entity be deemed to have discovered abreach only when management is
notified of the breach. The HITECH Act
itself provides that a breach is to betreated as discovered by a covered entity
or business associate if ‘‘any person,
other than the individual committing
the breach, that is an employee, officer,
or other agent of such entity or
associate’’ knows or should reasonably
have known of the breach. This concept
is also consistent with the HIPAA
Enforcement Rule and the Federal
common law of agency. We encouragecovered entities and business associates
to ensure their workforce members andother agents are adequately trained on
the importance of prompt reporting ofprivacy and security incidents.
With respect to those commenters
asking for guidance on what it means fora covered entity to be exercisingreasonable diligence, we note that theterm reasonable diligence, as defined in§ 160.401, means the business care andprudence expected from a person
seeking to satisfy a legal requirement
under similar circumstances. The
determination of whether a person actedwith reasonable diligence is generally afactual one, since what is reasonabledepends on the circumstances. Factors
to be considered include whether acovered entity or business associate took
reasonable steps to learn of breaches
and whether there were indications ofbreaches that a person seeking to satisfy
the Rule would have investigated undersimilar circumstances. Covered entities
and business associates may wish tolook to how other covered entities andbusiness associates operating under

E:\FR\FM\25JAR2.SGM

25JAR2

5648

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

similar circumstances conduct
themselves for a standard of practice.
Timeliness
Section 13402(d) of the Act and theimplementing regulations at§ 164.404(b) require covered entities to
notify individuals of a breach without
unreasonable delay but in no case later
than 60 calendar days from thediscovery of the breach, except incertain circumstances where law
enforcement has requested a delay.
Under this rule, the time period forbreach notification begins when theincident is first known, not when theinvestigation of the incident iscomplete, even if it is initially unclear
whether the incident constitutes abreach as defined in the rule. A covered
entity is expected to make theindividual notifications as soon asreasonably possible after the covered
entity takes a reasonable time toinvestigate the circumstances
surrounding the breach in order tocollect and develop the information
required to be included in the notice tothe individual. The 60 days is an outer
limit and therefore, in some cases, it
may be an ‘‘unreasonable delay’’ to wait
until the 60th day to provide
notification.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
While some commenters generally
were supportive of this provision in theinterim final rule, others argued that the
60-day timeframe for notification toindividuals is unreasonable andrequested more time, such as 120 days,
to provide the notifications. Some
commenters argued that the clock on the
60-day timeframe should not begin to
run until after a covered entity hascompleted its investigation anddetermined that a breach has occurred.
Another commenter expressed the needfor clarification about the types ofdelays in notifying individuals thatwould be considered reasonable andwhether a covered entity’s resources
would be taken into account indetermining whether any delay wasreasonable.
Final RuleWe retain § 164.404(b) in this final
rule without modification. This is thestandard expressly provided for in thestatute and we otherwise do not believe
it necessary or prudent to extend thetimeframe. Covered entities andbusiness associates have been operating
under this timeliness standard since theissuance of the interim final rule and webelieve a longer time period to notify
individuals of breaches of unsecured
protected health information could

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

adversely impact affected individuals
and the ability to mitigate adverse
consequences. For the same reasons, we
continue to provide that the time period
begins to run when the incident
becomes known, not when it isdetermined that a breach as defined by
the rule has occurred. There is sufficient
time within this standard both to
conduct a prompt investigation of theincident and to notify affectedindividuals.
With respect to what constitutes areasonable versus unreasonable delay
within the 60-day timeframe, suchdeterminations are fact specific andthere are many factors that may be
relevant, including the nature of thebreach, number of individuals affected,
and resources of the covered entity.
Content of the Notification
Section 13402(f) of the HITECH Act
set forth the content requirements forthe breach notice to the individual.
Section 164.404(c) of the interim final
rule incorporated the statutory
elements, requiring the following
information be included in the notices,to the extent possible: (1) A brief
description of what happened,
including the date of the breach and thedate of the discovery of the breach, if
known; (2) a description of the types of
unsecured protected health informationthat were involved in the breach (suchas whether full name, social security
number, date of birth, home address,
account number, diagnosis, disability
code, or other types of information wereinvolved); (3) any steps individuals
should take to protect themselves frompotential harm resulting from thebreach; (4) a brief description of what
the covered entity involved is doing toinvestigate the breach, mitigate the harm
to individuals, and to protect against
any further breaches; and (5) contact
procedures for individuals to ask
questions or learn additional
information, which shall include a tollfree telephone number, an email
address, Web site, or postal address.
The interim final rule added the term‘‘diagnosis,’’ to the parenthetical listingof examples of types of protected healthinformation, which was not in thestatute, to make clear that, whereappropriate, a covered entity may needto indicate in the notification to theindividual whether and what types oftreatment information were involved ina breach. In addition, with respect to acovered entity’s mitigation, the interim
final rule replaced the statutory term‘‘mitigate losses’’ with ‘‘mitigate harm toindividuals’’ to make clear that the
notification should describe the steps
the covered entity is taking to mitigate

PO 00000

Frm 00084

Fmt 4701

Sfmt 4700

potential harm to individuals resulting
from the breach and that such harm is
not limited to economic loss.
To address the readability andaccessibility of the notice, the interim
final rule made a number ofclarifications. First, the Department
included in the interim final rule arequirement that the breach notices be
written in plain language so that
individuals will be able to understandthem more easily, which means thenotice should be written at an
appropriate reading level, using clear
language and syntax, and not include
any extraneous material that might
diminish the message it is trying toconvey.
Second, the interim final rule
explained that some covered entities
may have obligations under other lawswith respect to their communication
with affected individuals. For example,
to the extent a covered entity is
obligated to comply with Title VI of the
Civil Rights Act of 1964, the covered
entity must take reasonable steps toensure meaningful access for Limited
English Proficient persons to theservices of the covered entity, which
could include translating the notice intofrequently encountered languages.
Similarly, to the extent that a covered
entity is required to comply with
Section 504 of the Rehabilitation Act of1973 or the Americans with Disabilities
Act of 1990, the covered entity has an
obligation to take steps that may benecessary to ensure effective
communication with individuals withdisabilities, which could include
making the notice available in alternate
formats, such as Braille, large print, oraudio.
Overview of Public Comments
Several commenters stated that thecontent requirements for breach
notification were too vague. Some
commenters asked that we provide
templates or sample notices to be usedby covered entities. Other commenters
asked for more specific guidance about
particular required content elements of
the notice, such as what information
should be provided to individuals abouta covered entity’s or business associate’s
mitigation efforts and regarding any
employee sanctions, particularly if acompany has policies that require
certain employment actions be kept
confidential. It was also suggested that
we publish a list of actions to be
included in the notices based on thetype of breach with respect to the steps
individuals should take to protect
themselves from harm. Some
commenters also asked that the
Department clarify that the requirement

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withto include ‘‘a brief description of what
happened’’ would not require thecovered entity or business associate todescribe how the breach occurred suchthat it would create a roadmap for future
breaches.
Final RuleWe retain § 164.404(c) in this final
rule without modification. The content
requirements in the Rule generally
mirror the content requirements in thestatute and each element is an importantcomponent of the notice to ensure
individuals receive the information theyneed to protect themselves to the extent
possible from the consequences of abreach and to learn what is being done
to mitigate the breach and prevent
future breaches. At the same time, thecontent provisions are sufficiently
flexible to allow covered entities andbusiness associates to tailor the breachnotices based on the circumstances
surrounding the breach and of theentity. In our experience inadministering the Rule since 2009, theRule provides sufficient flexibility todescribe to the individual thecircumstances surrounding the breachin a more general manner that still
provides the individual with pertinent
information but that does not provide aroadmap to third parties for future
breaches. For example, the notice need
not explain the exact type ofvulnerability in the security of a covered
entity’s electronic records system that
led to unauthorized access and how thatvulnerability was exploited. Similarly, acovered entity has flexibility indescribing what the covered entity is
doing in response to a breach. Where
employee sanctions are relevant basedon the circumstances of the breach, acovered entity may determine that it
wants to describe the sanctions imposed
more generally and nothing in the Rulewould require that the notice include
the names of the employees involved.
For example, a covered entity may want
to indicate generally that the employees
involved have been appropriately
disciplined, particularly if multiple
employees received varying levels of
sanctions based on their degrees of
involvement in the breach. In othercases, it may benefit the covered entity
to be more specific so as to better assure
individuals that the entity isappropriately addressing the situation,such as indicating that an employee
who improperly accessed and soldpatient information was promptly
terminated.
With respect to templates, examples,or other guidance, the Department
anticipates providing additional
guidance in the future.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Methods of Notification
Section 13402(e)(1) of the HITECH
Act provides for both actual written
notice to affected individuals, as well as
substitute notice to affected individuals
if contact information is insufficient or
out-of-date. Specifically, the statuterequires breach notifications to be sent
by first-class mail at the last known
address of the individual or next of kin
if the individual is deceased, or byelectronic mail if specified as thepreferred method by the individual. The
Act also provides that the notification
may be provided in one or more
mailings as the information becomes
available. Where there is insufficient or
out-of-date contact information that
precludes direct written notice to theindividual, the statute requires that asubstitute form of notice be provided tothe individual. If there is insufficient
contact information for 10 or moreindividuals, the Act requires that thesubstitute notice be a conspicuous
posting on the home page of the covered
entity’s Web site or notice in major print
or broadcast media in the geographic
areas where the affected individuals
likely reside, and in either case, that atoll-free number be included whereindividuals can learn whether theirinformation was possibly included in
the breach. Finally, the Act provides
that a covered entity may provide noticeby telephone or other means to
individuals, in addition to direct written
notice by first-class mail or email, inurgent situations involving possible
imminent misuse of the individual’s
information.
Section 164.404(d) of the interim final
rule set forth these methods forproviding breach notification to affectedindividuals. Section 164.404(d)(1)(i) of
the interim final rule required a covered
entity to provide breach notice to anaffected individual in written form by
first-class mail at the individual’s last
known address. The interim final rulealso permitted covered entities toprovide this written notice in the formof electronic mail if the individual has
agreed to receive electronic notice andthat agreement has not been withdrawn.
The Department clarified that,consistent with § 164.502(g) of thePrivacy Rule, where the individual
affected by a breach is a minor orotherwise lacks legal capacity due to aphysical or mental condition, notice tothe parent or other person who is the
personal representative of theindividual would satisfy therequirements of § 164.404(d)(1).
Additionally, with respect to deceased
individuals, the interim final rule at§ 164.404(d)(1)(ii) provided that notice

PO 00000

Frm 00085

Fmt 4701

Sfmt 4700

5649

of a breach be sent to either theindividual’s next of kin or personal
representative, as such term is used for
purposes of the Privacy Rule,
recognizing that in some cases, acovered entity may have contact
information for a personal
representative of a deceased individual
rather than the next of kin. To addressadministrative and privacy concernswith a covered entity being required toobtain contact information for the nextof kin of a deceased patient in cases
where the individual did not otherwise
provide the information while alive, theinterim final rule also clarified that acovered entity is only required toprovide notice to the next of kin or
personal representative if the covered
entity both knows the individual isdeceased and has the address of the nextof kin or personal representative of the
decedent.
If a covered entity does not havesufficient contact information for someor all of the affected individuals, or ifsome notices are returned as
undeliverable, the interim final rule
required a covered entity to provide
substitute notice for the unreachable
individuals in accordance with§ 164.404(d)(2). The interim final rule
required that substitute notice be
provided as soon as reasonably possible
after the covered entity is aware that it
has insufficient or out-of-date contact
information for one or more affectedindividuals and that the notice containall the elements that § 164.404(c)requires be included in the direct
written notice to individuals. With
respect to decedents, however, theinterim final rule provided that acovered entity is not required to provide
substitute notice for the next of kin or
personal representative in cases where
the covered entity either does not havecontact information or has out-of-datecontact information for the next of kin
or personal representative.
Section 164.404(d)(2) of the interim
final rule required that, whatever
method used, the substitute form ofnotice be reasonably calculated to reachthe individuals for whom it is being
provided. If there are fewer than 10
individuals for whom the covered entity
has insufficient or out-of-date contact
information to provide the written
notice, § 164.404(d)(2)(i) of the interim
final rule permitted the covered entity
to provide substitute notice to suchindividuals through an alternative formof written notice, by telephone, or othermeans. For example, if a covered entity
learned that the home address it has forone of its patients was out-of-date, but
it had the patient’s email address or
telephone number, it could provide

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5650

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

substitute notice by email (even if thepatient had not agreed to electronic
notice) or by phone. Alternatively,
posting a notice on the Web site of thecovered entity or at another location
may be appropriate if the covered entity
lacks any current contact information
for the patients, so long as the postingis done in a manner that is reasonably
calculated to reach the individuals.
If a covered entity has insufficient or
out-of-date contact information for 10 ormore individuals, then
§ 164.404(d)(2)(ii) of the interim final
rule required the covered entity toprovide substitute notice through either
a conspicuous posting for a period of 90days on the home page of its Web siteor conspicuous notice in major print or
broadcast media in geographic areas
where the individuals affected by thebreach likely reside. For either method
involving 10 or more individuals, thecovered entity was also required to havea toll-free phone number, active for 90
days, where an individual can learn
whether the individual’s unsecured
protected health information may be
included in the breach and to include
the number in the notice.
If a covered entity chooses to provide
substitute notice on its Web site, thecovered entity may provide all theinformation described at § 164.404(c)directly on its home page (‘‘home page’’
includes the home page for visitors to
the covered entity’s Web site and thelanding page or login page for existingaccount holders) or may provide a
prominent hyperlink on its home pageto the notice containing suchinformation.
If the covered entity does not have ordoes not wish to use a Web site for thesubstitute notice, the interim final rule
required the covered entity to provide
substitute notice of the breach in major
print or broadcast media in geographic
areas where the individuals affected by
the breach likely reside. What is
considered major print or broadcast
media for a metropolitan area may bevery different from what is consideredmajor print or broadcast media in a ruralarea, such that the use of local, city, or
state-wide media may be appropriate
depending on the circumstances.
Further, multiple media outlets mayneed to be utilized to reasonably reachindividuals in different regions orStates. In any event, substitute media
notice, as with substitute Web notice,must be conspicuous and thus, covered
entities should consider the locationand duration of the notice to ensure thenotice is reasonably calculated to reachthe affected individuals.
Finally, we clarified that covered
entities with out-of-date or insufficient

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

contact information for someindividuals can attempt to update thecontact information so that they canprovide direct written notification, inorder to limit the number of individuals
for whom substitute notice is required
and, thus, potentially avoid theobligation to provide substitute noticethrough a Web site or major print or
broadcast media under§ 164.404(d)(2)(ii).
In accordance with the statute,§ 164.404(d)(3) makes clear that noticeto the individual by telephone or othermeans may be provided, in addition to
the direct written notice required by§ 164.404(d)(1), in cases deemed by thecovered entity to require urgency
because of possible imminent misuse of
unsecured protected health information.
Overview of Public Comments
Several commenters questioned
which entity has the responsibility forproviding notifications to individuals
when a breach occurs at or by a businessassociate and whether a covered entity
could delegate its breach notification
obligations to a business associate.
Some commenters asked about the
notification obligations in cases where acovered entity’s business associate thatexperiences a breach is also a covered
entity itself. Others requested
clarification regarding the obligations
for providing breach notification wheremultiple covered entities and businessassociates are involved in healthinformation exchange and it may beunclear where a breach occurred and/or
which entity has responsibility for thebreach.
Additionally, many commenterssuggested that covered entities bepermitted to provide notification toindividuals via telephone or orally
instead of via written communication,
or at a work address instead of a homeaddress, if the individual has specified
one of these alternative methods or
locations as preferred for receiving
breach notification. Commenters raised
potential privacy concerns with
communicating with individuals via
mail to their home, particularly where
the individual has received highly
confidential medical services, such as
substance abuse or mental healthservices, and others who may haveaccess to the mail may not otherwise beaware of such condition or treatment.
Some commenters argued that because
the Privacy Rule requires covered
entities to accommodate reasonable
requests by individuals to receive
communications by alternative means orat alternative locations, the same
standard should apply to the provisionof breach notification.

PO 00000

Frm 00086

Fmt 4701

Sfmt 4700

Finally, several commenters
expressed concern over the substitutenotice required in cases in which thecovered entity has insufficient or out-ofdate contact information for affectedindividuals. Many of these commentersstated that providing notification via
Web posting or media publication is an
inappropriate method of providing
substitute notice, except in cases inwhich the covered entity can reasonably
define the universe of affectedindividuals. In other cases, such notice
will not give individuals who view thenotice enough information to determine
if they are affected by a breach, and may
cause unaffected individuals
unnecessary alarm. Some commenters
recommended that covered entities
instead be required to use reasonable
efforts to identify alternative means ofproviding direct notice to the affectedindividuals, such as by phone or email,or to only require substitute media or
Web notice when a covered entity
cannot reach 10 or more individuals
directly by mail, phone, or email. Other
commenters argued that the substitutenotice requirements, particularly therequirement to establish a toll-freenumber, may be cost prohibitive tosmaller covered entities. It was alsosuggested that smaller covered entities,
particularly those in rural areas, shouldbe allowed to provide substitute notice
via handouts or postings at the covered
entity’s physical location even in cases
where the entity has insufficient contact
information for more than 10
individuals.
Final RuleWe retain § 164.404(d) in this final
rule without modification. In response
to questions raised with respect to abreach at or by a business associate, wenote that the covered entity ultimately
maintains the obligation to notify
affected individuals of the breach under§ 164.404, although a covered entity is
free to delegate the responsibility to thebusiness associate that suffered thebreach or to another of its businessassociates. This is the case even if thebreach of the covered entity’s protected
health information occurred at or by abusiness associate that is also a covered
entity. For example, if a covered
provider (Provider A) hires anothercovered provider’s practice (Provider B)
as a business associate to perform hisbilling and other back office functions,and a breach of Provider A’s protected
health information occurs at Provider B
while performing these functions for
Provider A, it remains Provider A’s
responsibility to provide breach
notification to the affected individuals,
although Provider A may delegate this

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
responsibility to Provider B as its
business associate.
Covered entities and businessassociates should consider which entity
is in the best position to provide noticeto the individual, which may depend on
various circumstances, such as thefunctions the business associate
performs on behalf of the covered entity
and which entity has the relationshipwith the individual.
Similarly, when multiple covered
entities participate in electronic healthinformation exchange and there is abreach of unsecured protected healthinformation at a Health Information
Organization (HIO), the obligation to
notify individuals of the breach falls to
the covered entities. We recognize thatit may be difficult to determine what
breached information is attributable towhich covered entity’s individuals. For
example, an HIO may store centralized
electronic health records (EHRs) for acommunity, with each EHR including
information generated by multiple
covered entities. In such circumstances,it may be necessary for the HIO to notify
all potentially affected covered entities
and for those covered entities todelegate to the HIO the responsibility of
sending the required notifications to theaffected individuals. This would avoid
the confusion of individuals receiving
more than one notification about thesame breach.
In response to the commenters who
suggested that covered entities bepermitted to accommodate reasonable
requests by individuals to receive
breach notifications by alternativemeans or at alternative locations, we
provide the following guidance. The
HITECH Act requires a covered entity toprovide breach notification to anaffected individual in written form
either at the last known address of theindividual or email address, if theindividual agrees to receive noticeelectronically, where the covered entity
has sufficient contact information to doso. The Act and this rule do not prohibita covered entity from sending a breachnotice to an alternative address rather
than a home address, such as a work
address or post office box, or theindividual’s email address of choice, if
the individual requests communications
be sent to such an address. Further, acovered health care provider (and healthplan, if potential endangerment is raisedby the individual) is required by thePrivacy Rule at § 164.522 toaccommodate any such reasonable
requests.
In response to those commenters who
urged that we allow breach notices to beprovided orally or via telephone toindividuals receiving highly

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

confidential treatment services where
the individual has requested to receive
communications in such a manner, wenote that the HITECH Act specificallyrefers to ‘‘written’’ notice to be provided
to individuals. However, we understandthe privacy concerns raised. We, thus,
clarify that in the limited circumstancesin which an individual has agreed only
to receive communications from acovered health care provider orally or
by telephone, the provider is permitted
under the Rule to telephone theindividual to request and have theindividual pick up their written breachnotice from the provider directly. In
cases in which the individual does notagree or wish to travel to the provider
to pick up the written breach notice, thehealth care provider should provide allof the information in the breach noticeover the phone to the individual,
document that it has done so, and theDepartment will exercise enforcement
discretion in such cases with respect tothe ‘‘written notice’’ requirement. We
stress that our enforcement discretion
applies only to cases where theindividual affirmatively chooses not toreceive communications from a covered
health care provider at any written
addresses or email addresses, and not tosituations where providing telephonicnotice is simply less burdensome oreasier on a provider and the entity has
a valid address, or email address if
applicable, on file for the affectedindividual.
Finally, with respect to commenters
who expressed concerns with thesubstitute media and Web noticeprovisions of the interim final rule, we
emphasize that these are statutory
requirements that have been
incorporated into the Rule. Section
13402(e)(1)(B) of the HITECH Act
expressly requires that a covered entitythat has insufficient or out-of-datecontact information for 10 or moreindividuals provide substitutenotification to such individuals via
posting on their Web site or notificationin major print or broadcast media in theareas in which the affected individuals
likely reside. Additionally, the statuterequires such ‘‘notice in media or web
posting will include a toll-free phone
number where an individual can learn
whether or not the individual’s
unsecured protected health informationis possibly included in the breach.’’Thus, we retain these requirements inthis final rule.
Response to Other Public Comments
Comment: One commenter expressed
concern about providing breach
notification to individuals by first-classmail because it could require some

PO 00000

Frm 00087

Fmt 4701

Sfmt 4700

5651

entities, such as those that have Webbased relationships with individuals, tocollect more information about
individuals (e.g., physical addresses)
than they currently do.
Response: The Rule allows a covered
entity to provide written breach notice
to an affected individual by email if theindividual agrees to electronic noticeand such agreement has not been
withdrawn. We would expect thatcovered entities that have primarily orsolely an online relationship withindividuals would ask and encourage
individuals to receive breach notices by
email and that generally individuals
would agree. However, an individualthat does not affirmatively agree toreceive breach notices by email, or thatwithdraws a prior agreement, has a rightto notice by first-class mail.
Comment: One commenter suggested
that we excuse a covered entity fromproviding notification of a breach to anindividual where a licensed health care
professional has determined in theexercise of professional judgment thatthe provision of such notice is likely tocause substantial harm to theindividual. The commenter appeared tobe concerned due to the nature of theservices it provides—mental healthservices—and the distress breach
notification could cause for certain of its
patients.
Response: The statute does notinclude such an exception to theprovision of breach notification, and we
do not include one in this Rule. An
affected individual has a right to be
informed of breaches of unsecured
protected health information so theindividual can take steps if appropriate
to protect themselves from theconsequences. In situations where ahealth care provider believes that theprovision of written breach notification
to an individual may cause extreme
anguish or distress, based on theindividual’s mental state or othercircumstances, the provider may
telephone the individual prior to thetime the breach notice is mailed or havethem come into the provider’s office todiscuss the situation. However, we notethat the breach notification must still bemailed without unreasonable delay andin no case later than 60 calendar days
after discovery of the breach. Where aprovider is aware that an individual hasa personal representative due toincapacity or other health condition, thebreach notification may be sent to thepersonal representative.
Comment: Many commenters
expressed support for allowing covered
entities to provide breach notification toa deceased individual’s personal
representative instead of to the next of

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5652

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

kin. One commenter suggested that we
also allow covered entities to provide
breach notification to the emergency
contact provided by a deceased
individual prior to death as this is theinformation they collect fromindividuals and yet this person may not
be the next of kin or a personal
representative of the deceased
individual.
Response: We do not believe it
appropriate to permit covered entities tosend breach notifications to a deceased
individual’s emergency contact wheresuch person is not a personal
representative (such as an executor or
administrator of the decedent’s estate)or next of kin of the decedent, as such
notices may convey information about
the decedent’s care the decedent neverwished the emergency contact to have
and/or may go to a person who has no
authority to act on the notice.
Comment: To reduce the costs
associated with sending breach
notifications, one commenter asked that
we adopt the Department of Labor’s
standard for providing COBRA Election
Notices to allow a covered entity to: (1)Where a breach affects both a plan
participant and the participant’s spouse,
send one breach notice addressed toboth if both spouses reside at the same
address; and (2) where a breach affects
a dependent child (of any age) under aplan, send a breach notice to either theplan participant and/or the participant’s
spouse, provided the dependent childresides at the same address. The
commenter stated the notice should
clearly identify the individuals orclasses of individuals to whom thenotice applies.
Response: A covered entity ispermitted to send one breach noticeaddressed to both a plan participant andthe participant’s spouse or otherdependents under the plan who are
affected by a breach, so long as they all
reside at a single address and thecovered entity clearly identifies on thenotice the individuals to which thenotice applies. Further, a covered entity
may send a notice regarding the breachof a dependent child’s protected healthinformation addressed to the plan
participant and/or participant’s spouseliving with the dependent child, so longas the participant and/or participant’s
spouse are the personal representativesof the dependent child and the noticeclearly identifies to whom it applies.
Such notices by first-class mail would
meet the written notice requirements of§ 164.404(d)(1)(i). However, one breachnotice covering both the plan
participant and the dependents under
the plan mailed to the plan participant’s
address would not suffice if the address

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

of one or more dependents affected by
the breach was different than theparticipant’s address. Further, where aplan participant (and/or spouse) is not
the personal representative of adependent under the plan, a covered
entity must address a breach notice tothe dependent himself or herself.
Comment: Several commenters
expressed support for the
acknowledgment in the preamble to theinterim final rule that some covered
entities may have obligations under
Civil Rights laws to ensure that breach
notifications are provided to individuals
in alternative languages, and inalternative formats, such as Braille, large
print, or audio, where appropriate.
Some commenters requested additional
guidance regarding how to ensurecompliance with these laws withrespect to breach notifications.
Response: Additional guidance on
how to comply with Title VI of the Civil
Rights Act of 1964, Section 504 of theRehabilitation Act of 1973, and theAmericans with Disabilities Act of 1990,
is available on the OCR Web site at
http://www.hhs.gov/ocr/civilrights/.
Further, covered entities with questions
on how to comply may contact one of
OCR’s ten regional offices. Contact
information is available at http://
www.hhs.gov/ocr/office/about/rgnhqaddresses.html.
Comment: Some commenterssuggested that the final rule adopt a
substitute notification provision similar
to that in many State laws that allows
for substitute notification, rather thandirect written notice, to the individualin the event of breaches affecting a verylarge number of individuals, such as
over 250,000 or 500,000, where the costs
of notification would be extremely high.
Response: The Act does not waive
direct written notice to the individual
when a breach has affected a threshold
number of individuals and we do not do
so in this rule.
Comment: One commenter requested
confirmation that a covered entity could
make multiple attempts to provide
direct written notice to individuals
within the 60-day timeframe before theindividual counts towards the 10 ormore threshold for providing substituteWeb or media notice.
Response: We clarify that a covered
entity can attempt to cure out-of-datecontact information on individuals
when notices are returned as
undeliverable by the United States
Postal Service to avoid substitute notice
so long as a covered entity does so
promptly upon receiving the returned
notices and no later than 60 calendar
days from discovery of the breach.
However, at the time the covered entity

PO 00000

Frm 00088

Fmt 4701

Sfmt 4700

is aware that it will be unable to reach
10 or more individuals with direct
written notice, the covered entity
should provide substitute Web or media
notice as soon as reasonably possible
thereafter, which may be prior to theend of the 60-day period depending on
the circumstances.
Comment: One commenter stated thatthe required content of the breach noticeitself, when made available to the publicthrough the Web or media, could leadto the identification of individuals
affected by the breach in some cases,
undermining the intent of HIPAA’s
privacy and security protections.
Response: It is unclear thecircumstances to which the commenter
refers. For example, the notificationmust include the types of protected
health information involved (e.g., social
security numbers, dates of birth, fullnames). However, this is not arequirement to include in the notice theactual names or other identifiers of theaffected individuals. We believe covered
entities are able to post breach notices
in a manner that does not identify
particular individuals affected by abreach and thus, must do so.
Comment: One commenter asked that
OCR engage in an educational campaign
to ensure that covered entities andbusiness associates understand their
obligations under the breach
notification rule.
Response: Published guidance is theprimary method that the Department
uses to educate and provide technicalassistance to covered entities andbusiness associates. We intend to issue
guidance on these requirements in the
future as questions are raised orclarifications sought.
3. Section 164.406—Notification to theMedia
Section 13402(e)(2) of the HITECH
Act, implemented at § 164.406 of theinterim final rule, requires that acovered entity provide notice of abreach to prominent media outlets
serving a State or jurisdiction, following
the discovery of a breach if theunsecured protected health informationof more than 500 residents of such Stateor jurisdiction is, or is reasonably
believed to have been, accessed,
acquired, or disclosed during suchbreach. This media notice is in addition
to, not a substitute for, individual
notice. In accordance with the Act,§ 164.406(b) of the interim final rule
required covered entities to notify
prominent media outlets without
unreasonable delay and in no case later
than 60 calendar days after discovery of
the breach. Section 164.406(c) of theinterim final rule required that the

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
notification to the media include thesame information required to be
included in the notification to theindividual under § 164.404(c).
The interim final rule did not define‘‘prominent media outlet’’ because what
constitutes a prominent media outlet
will differ depending upon the State or
jurisdiction affected. For a breachaffecting more than 500 individuals
across a particular state, a prominent
media outlet may be a major, generalinterest newspaper with a daily
circulation throughout the entire state.
In contrast, a newspaper serving only
one town and distributed on a monthly
basis, or a daily newspaper of
specialized interest (such as sports orpolitics) would not be viewed as aprominent media outlet. Where a breachaffects more than 500 individuals in alimited jurisdiction, such as a city, thena prominent media outlet may be amajor, general-interest newspaper withdaily circulation throughout the city,even though the newspaper does notserve the whole State.
With regard to the term ‘‘State,’’ theexisting definition of ‘‘State’’ at§ 160.103 of the HIPAA Rules applies.
Section § 160.103 defines ‘‘State’’ tomean ‘‘any one of the several States, theDistrict of Columbia, theCommonwealth of Puerto Rico, theVirgin Islands, and Guam.’’ We also
expressly provided in the regulationthat ‘‘State’’ for purposes of notice to themedia includes American Samoa andthe Northern Mariana Islands, because
they were included in the HITECH Act’s
definition of ‘‘State’’ in addition to what
appears in the definition at § 160.103.
With respect to what was meant by‘‘jurisdiction’’ as opposed to a ‘‘State,’’jurisdiction is a geographic area smaller
than a state, such as a county, city, or
town.
The interim final rule also clarified
that some breaches involving more than
500 individuals who are residents in
multiple States may not require noticeto the media. For example, if a covered
entity discovers a breach of 600
individuals, 200 of which reside in
Virginia, 200 of which reside in
Maryland, and 200 of which reside in
the District of Columbia, the breach did
not affect more than 500 residents ofany one State or jurisdiction, and assuch, notification is not required to beprovided to the media pursuant to§ 164.406. However, individual
notification under § 164.404 would be
required, as would notification to theSecretary under § 164.408 because thebreach involved 500 or moreindividuals.
The Department also recognized thatin some cases a breach may occur at a

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

business associate and involve theprotected health information of multiple
covered entities. In such cases, acovered entity involved would only berequired to provide notification to themedia if the information breachedincluded the protected healthinformation of more than 500
individuals located in any one State or
jurisdiction. For example, if a businessassociate discovers a breach affecting
800 individuals in a State, the businessassociate must notify the appropriate
covered entity (or covered entities)
subject to § 164.410 (discussed below).
If 450 of the affected individuals arepatients of one covered entity and theremaining 350 are patients of anothercovered entity, because the breach has
not affected more than 500 individuals
at either covered entity, there is no
obligation to provide notification to themedia under this section.
Section 164.406(c) requires that thenotice to the media include the samecontent as that required for notification
to the individual under § 164.404(c),and we emphasized that this provision
does not replace either direct written or
substitute notice to the individual under§ 164.404.
Overview of Public Comments
In general, we received few commentson this provision of the interim final
rule. One commenter expressed general
support for this provision because it
does not require the covered entity toincur the cost of printing or running themedia notice and asked for clarificationthat this policy places no requirementon the media to publically report the
information provided by a covered
entity. Another commenter asked
whether a covered entity could fulfill
the requirements for providing media
notification by posting a press releaseon the covered entity’s Web site.
Final RuleWe retain § 164.406 in this final rulewith one minor change. As described in
Section IV above, to align the definitionof ‘‘State’’ in the HIPAA Rules with thedefinition of the same term used in the
HITECH Act, the Department has
modified the definition of ‘‘State’’ at§ 160.103 to include reference toAmerican Samoa and the Northern
Mariana Islands. Given this change, it is
not necessary to include specificreference to American Samoa and theNorthern Mariana Islands at § 164.406
and we remove it in this final rule.
In response to public comments, weclarify that § 164.406 does not require acovered entity to incur any cost to print
or run media notice about a breach of
unsecured protected health information

PO 00000

Frm 00089

Fmt 4701

Sfmt 4700

5653(unlike the obligations for providing
substitute notice to individuals in§ 164.404(d)(2) if there is insufficient or
out-of-date contact information for 10 ormore affected individuals) nor does it
obligate prominent media outlets who
receive notification of a breach from acovered entity to print or run
information about the breach. We alsoemphasize that posting a press release
regarding a breach of unsecured
protected health information on thehome page of the covered entity’s Web
site will not fulfill the obligation toprovide notice to the media (although
covered entities are free to post a press
release regarding a breach on their Website). To fulfill the obligation,
notification, which may be in the formof a press release, must be provided
directly to prominent media outlets
serving the State or jurisdiction where
the affected individuals reside.
4. Section 164.408—Notification to theSecretary
Section 13402(e)(3) of the HITECH
Act requires covered entities to notify
the Secretary of breaches of unsecured
protected health information. The Act
requires covered entities to reportbreaches affecting 500 or moreindividuals to the Secretary
immediately. For breaches affecting
fewer than 500 individuals, covered
entities may maintain a log of all suchbreaches occurring during the year andannually submit such log to theSecretary.
To implement the statutory
provisions, § 164.408(a) contains thegeneral rule that requires a covered
entity to notify the Secretary following
the discovery of a breach of unsecured
protected health information. With
respect to breaches involving 500 or
more individuals, we interpreted theterm ‘‘immediately’’ in the statute torequire notification be sent to theSecretary concurrently with thenotification sent to the individual under§ 164.404 (i.e., without unreasonable
delay but in no case later than 60
calendar days following discovery of abreach). The rule provided that thesenotifications be provided in a manner tobe specified on the HHS Web site.
Further, as required by section
13402(e)(4) of the Act, the interim final
rule stated that the Secretary would
begin to post and maintain on the HHS
Web site a list of covered entities that
submit reports of breaches of unsecured
protected health information involving
more than 500 individuals.
Under these provisions, covered
entities must notify the Secretary of all
discovered breaches involving morethan 500 individuals, without regard to

E:\FR\FM\25JAR2.SGM

25JAR2

5654

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withwhether the breach involved more than
500 residents of a particular State or
jurisdiction (the threshold for triggering
notification to the media under§ 164.406 of the interim final rule).
Thus, where a covered entity has
discovered a breach involving 600
individuals, 300 of which reside in
Maryland and 300 of which reside in
the District of Columbia, notification of
the breach must be provided to theSecretary concurrently with notification
to the affected individuals. However, in
this example, the breach would not
trigger the requirement to notify the
media under § 164.406 because thebreach did not involve more than 500
residents of any one State or
jurisdiction.
For breaches involving less than 500
individuals, § 164.408(c) requires acovered entity to maintain a log or otherdocumentation of such breaches and to
submit information annually to theSecretary for breaches occurring during
the preceding calendar year. Theinterim final rule required thesubmission of this information to theSecretary no later than 60 days after theend of each calendar year. As with
notification of the larger breaches, theinterim final rule required that
information about breaches involving
less than 500 individuals be provided to
the Secretary in the manner specified on
the HHS Web site.
Although covered entities need only
provide notification to the Secretary of
breaches involving less than 500
individuals annually, they must still
provide notification of such breaches toaffected individuals without
unreasonable delay and not later than
60 days after discovery of the breachpursuant to § 164.404. In addition,
pursuant to § 164.414(a), a covered
entity must follow the documentation
requirements that otherwise apply to the
HIPAA Privacy Rule under § 164.530
with respect to the requirements of thisrule. Thus, pursuant to § 164.530(j)(2),covered entities must maintain theinternal log or other documentation forsix years. Further, as with otherrequired documentation, a covered
entity must make such information
available to the Secretary upon request
for compliance and enforcement
purposes in accordance with § 160.310.
Overview of Public Comments
Some commenters expressed concern
regarding the timing of providing
notification to the Secretary of breaches
affecting fewer than 500 individuals.
These commenters asked when
notification should be provided if acovered entity discovers, after thereporting deadline, a breach that

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

occurred in the previous year. Several
others commented on the interim final
rule’s process for providing theSecretary with breach notification.
Some commenters asked that thisprocess be revised to allow covered
entities to maintain a log of all breaches
affecting fewer than 500 individuals andthen submit that log, via attachment(such as an Excel spreadsheet), to theSecretary on an annual basis. These
commenters stated that submitting
reports of these smaller breaches in thismanner would be much lessburdensome than submitting the reports
individually. Other commenters asked
that we provide a template log forentities to use to document smaller
breaches for annual submission to theSecretary. Additionally, several
commenters suggested that there beaccess or authentication controls for
submitting breach reports because ofconcerns of false breach reports being
submitted to the Secretary without thecovered entity’s knowledge.
Final Rule
The final rule retains § 164.408(c)with one modification. The
modification clarifies that covered
entities are required to notify the
Secretary of all breaches of unsecured
protected health information affecting
fewer than 500 individuals not later
than 60 days after the end of thecalendar year in which the breaches
were ‘‘discovered,’’ not in which thebreaches ‘‘occurred.’’ We recognize that
there may be situations where, despite
having reasonable and appropriate
breach detection systems in place, abreach may go undetected for sometime. In these cases, if a breach of
unsecured protected health information
affecting fewer than 500 individuals that
occurred in the previous year is
discovered, the covered entity has until
60 days after the end of the calendar
year in which the breach was
discovered to provide notice to theSecretary. We emphasize, however, that
this modification does not alter acovered entity’s obligation to promptly
report the breach to affected individuals
without unreasonable delay but in nocases later than 60 calendar days after
discovery of the breach.
In response to the commentssuggesting that covered entities bepermitted to submit a log of all smaller
breaches to the Secretary instead ofsubmitting each breach individually
through the online form, we agree thatthe current process may be burdensome
for some entities and are considering
alternative ways to receive such reports.
With respect to the commenters who
asked that access or authentication

PO 00000

Frm 00090

Fmt 4701

Sfmt 4700

controls be added to the breach
reporting form, we do not believe this isnecessary at the present time. Since theDepartment began receiving andprocessing breach reports on September
23, 2009, we have not yet received areport that has been falsely submitted byan individual or entity not acting on
behalf of the covered entity.
Additionally, we emphasize that
following receipt of a breach report that
affects 500 or more individuals, we
contact the covered entity identified in
the breach report and verify the
information in the report before we post
any information about the breach on the
HHS Web site. If circumstances change
in the future, we will explore options
for modifying the process.
Response to Other Public Comments
Comment: One commenter asked thatthe final rule should not interpret theterm ‘‘immediately’’ in the statute tomean without unreasonable delay, but
in no case later than 60 days, but rather
to mean as soon as the breach is
discovered. Another commenter asked
that the final rule expand the timeframefor providing notification to theSecretary to no later than 120 days after
discovery of a breach.
Response: We believe that ourinterpretation of ‘‘immediately’’ withrespect to notification to the Secretaryfor breaches affecting 500 or moreindividuals is reasonable andappropriate and thus, retain theprovision that requires such notice be
provided contemporaneously with
notice to the individual. Requiringcontemporaneous notice allows thenotice to the Secretary to include all of
the information provided in the noticeto the individual and better ensures thata covered entity does not report
information to the Secretary that later
turns out to be incorrect because theentity did not have sufficient time to
conduct an investigation into the facts
surrounding the breach. In addition, thisinterpretation satisfies the statutory
requirement that notifications of larger
breaches be provided to the Secretary
immediately (as they occur) as
compared to the reports of smaller
breaches the statute allows be reported
annually to the Secretary.
Comment: Some commenters asked
for further guidance on submitting
online breach notifications to theSecretary. Additionally, somecommenters asked that HHS provide a
confirmation to submitters that an
initial breach report or an addendum toa breach report has been successfully
submitted.
Response: Since the publication of theinterim final rule, OCR has posted

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
instructions for filling out andsubmitting the breach form on its Web
site: http://www.hhs.gov/ocr/privacy/
hipaa/administrative/
breachnotificationrule/brinstruction.html. We will continue toexamine the instructions for submitting
breach notification to the Secretary andwill update this information, as
necessary, to ensure that covered
entities are able to navigate and submit
the form easily. The Department has
also made changes to the process toensure that covered entities receive a
confirmation following their submissionof breach notification to the Secretary.
Additionally, we note that the breach
reporting form does include an option
for indicating that a submission is anaddendum to a previous submission.
OCR updates the original breach report,
as appropriate, with any additional or
modified information submitted in an
addendum.
Comment: With respect to the postingof breaches affecting 500 or moreindividuals on the HHS Web site, somecommenters stated that these breachsubmissions must be verified with thecovered entity before they are posted
publicly. Other commenters asked forclarification of what information will be
posted, while another commenter asked
that we post only the name of thecovered entity involved in the breach.
Finally, one commenter suggested that
we only post these breaches on our Web
site for a six month period.
Response: To provide helpful
information to the public, OCR
currently posts the following
information regarding breaches affecting
500 or more individuals: name of thecovered entity (and if applicable, thebusiness associate) involved; State
where the covered entity is located;
number of individuals affected by thebreach; the date of the breach; type of
breach (e.g., theft, loss, unauthorizedaccess/disclosure); and location of thebreached information (e.g., laptop,
paper records, desktop computer). Prior
to posting this information, OCR verifies
the information in the breach
notification report with the covered
entity. We do not believe it would serve
the public to only disclose the name of
the covered entity involved in each of
the breaches, because the additional
information enables members of the
public to understand the nature of thebreach and to determine if the breachaffects them directly. In terms of how
long information about each of thebreaches is to remain posted, we intend
to maintain the information on our Web
site for as long as there is public interestand the data can remain posted in a

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

manner that gives the public accesseffectively and efficiently.
5. Section 164.410—Notification by aBusiness AssociateInterim Final Rule
Section 13402(b) of the HITECH Act
requires a business associate of acovered entity that accesses, maintains,retains, modifies, records, destroys, orotherwise holds, uses, or discloses
unsecured protected health information
to notify the covered entity when it
discovers a breach of such information.
The Act requires business associates toprovide such notification to covered
entities without unreasonable delay andin no case later than 60 days fromdiscovery of the breach. Additionally,
the Act requires business associates toprovide covered entities with theidentity of each individual whose
unsecured protected health information
has, or is reasonably believed to havebeen, affected by the breach. Section
164.410(a) implements section 13402(b)of the Act.
A business associate is required to
notify the covered entity of the breachof unsecured protected healthinformation so that the covered entity
can notify affected individuals. In theinterim final rule, we clarified that abusiness associate that maintains theprotected health information of multiple
covered entities need notify only thecovered entity(s) to which the breachedinformation relates. However, in cases
in which a breach involves theunsecured protected health informationof multiple covered entities and it isunclear to whom the breachedinformation relates, it may be necessary
to notify all potentially affected covered
entities.
Section 164.410(a)(2) provides that abreach shall be treated as discovered bya business associate as of the first day
on which such breach is known to thebusiness associate or, by exercisingreasonable diligence, would have been
known to the business associate. As
with a covered entity, a businessassociate shall be deemed to haveknowledge of a breach if the breach is
known, or by exercising reasonablediligence would have been known, to
any person, other than the person
committing the breach, who is an
employee, officer, or other agent of thebusiness associate (determined inaccordance with the Federal common
law of agency). Similarly, as withknowledge imputed to covered entities,
the Federal common law of agency
controls in determining who is an agentof the business associate.

PO 00000

Frm 00091

Fmt 4701

Sfmt 4700

5655

Section 164.410(b) requires that abusiness associate provide notice of abreach of unsecured protected healthinformation to a covered entity without
unreasonable delay and in no case later
than 60 days following the discovery ofa breach. With respect to timing, if abusiness associate is acting as an agentof a covered entity, then, pursuant to§ 164.404(a)(2), the business associate’s
discovery of the breach will be imputed
to the covered entity. In suchcircumstances, the covered entity must
provide notifications under § 164.404(a)based on the time the business associate
discovers the breach, not from the time
the business associate notifies thecovered entity. In contrast, if thebusiness associate is not an agent of thecovered entity, then the covered entity
is required to provide notification basedon the time the business associate
notifies the covered entity of the breach.
We encouraged covered entities andbusiness associates to address thetiming of this notification in theirbusiness associate contracts.
Section 164.410(c)(1) requires
business associates, to the extent
possible, to provide covered entities
with the identity of each individual
whose unsecured protected healthinformation has been, or is reasonably
believed to have been, breached.
Depending on the circumstances,business associates could provide thecovered entity with immediate
notification of the breach and thenfollow up with the required informationin § 164.410(c) when available but
without unreasonable delay and within
60 days.
Section 164.410(c)(1) requires
business associates to provide thisinformation ‘‘to the extent possible,’’recognizing that there may be situations
in which a business associate may be
unaware of the identification of theindividuals whose unsecured protected
health information was breached. For
example, a business associate that is arecord storage company that holds
hundreds of boxes of paper medical
records on behalf of a covered entity
may be unaware of the names of theindividuals whose records are stored.
Thus, if the business associate discovers
that several boxes are missing, it may beunable to provide the covered entitywith a list of the individuals whose
information has been breached. In suchcircumstances, it is not our intent thatthe business associate delay notificationof the breach to the covered entity,
when the covered entity may be better
able to identify the individuals affected.
Depending on the circumstances
surrounding a breach of unsecured
protected health information, a business

E:\FR\FM\25JAR2.SGM

25JAR2

5656

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withassociate may be in the best position togather the information the covered
entity is required by § 164.404(c) toinclude in the notification to theindividual about the breach. Therefore,
in addition to the identification ofaffected individuals, § 164.410(c)(2)requires a business associate to provide
the covered entity with any otheravailable information that the covered
entity is required to include in the
notification to the individual under§ 164.404(c), either at the time it
provides notice to the covered entity ofthe breach or promptly thereafter as
information becomes available. Because
we allow this information to beprovided to a covered entity after the
initial notification of the breach as it
becomes available, a business associateshould not delay the initial notification
to the covered entity of the breach inorder to collect information needed forthe notification to the individual. To
ensure the covered entity is aware of all
the available facts surrounding a breach,the Rule also requires that a businessassociate provide this information even
if it becomes available after notifications
have been sent to affected individuals orafter the 60-day period specified in§ 164.410(b) has elapsed.
We clarified that business associates
and covered entities would continue tohave the flexibility to set forth specificobligations for each party, such as whowill provide notice to individuals andwhen the notification from the businessassociate to the covered entity will be
required, following a breach of
unsecured protected health information,
so long as all required notifications areprovided and the other requirements of
the interim final rule were met. We
encouraged the parties to consider
which entity is in the best position toprovide notice to the individual, which
may depend on circumstances, such as
the functions the business associate
performs on behalf of the covered entity
and which entity has the relationshipwith the individual. We also encouraged
the parties to ensure the individual does
not receive notifications from both thecovered entity and the businessassociate about the same breach, which
may be confusing to the individual.
Overview of Public Comments
Many commenters expressed concern
over the interim final rule’s treatment ofa covered entity’s knowledge of a breachthat occurs at or by a business associate.
Some commenters stated that a covered
entity’s knowledge of a breach should
begin when the business associate
notifies them of the breach, regardless ofwhether the business associate is anagent of the covered entity or a non-

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

agent independent contractor. If
knowledge is imputed when thebusiness associate discovers the breach,
one commenter argued that a covered
entity would not have sufficient time toprovide the required notifications to
individuals in a timely manner. Other
commenters argued that all businessassociates should be treated as agents ofthe covered entity, such that thebusiness associate’s knowledge of abreach is imputed to the covered entity.
Finally, some commenters asked formore guidance on when a businessassociate is acting as an agent versus as
an independent contractor and how todetermine this status under the Federal
common law of agency.
Final Rule
The final rule modifies § 164.410 only
to make the following technical andnon-substantive correction: in paragraph(a)(2) of § 164.410, the first sentence isrevised to refer to paragraph (a)(1) rather
than paragraph (1).
With respect to the commenters who
expressed concern that a covered
entity’s knowledge of a breach depends
not only on a business associate’s
discovery of the breach but also on the
covered entity’s relationship with thebusiness associate, we acknowledge that
there are many different types ofrelationships that can develop between
covered entities and business associates
based upon the function the businessassociate performs on behalf of thecovered entity. In some situations, abusiness associate will be acting as anagent of the covered entity, and as such,it makes sense to treat the businessassociate’s knowledge of a breachanalogous to the knowledge of one of
the covered entity’s own employees.
However, in other situations, because abusiness associate may not be an agentof the covered entity, it would not bereasonable to impute the businessassociate’s knowledge directly to thecovered entity, and therefore, thecovered entity’s knowledge depends on
notification from the business associate.
Furthermore, the use of the Federal
common law of agency to determine thebusiness associate’s status with respect
to the covered entity is consistent withthe approach taken in the Enforcement
Rule for determining agency liability
under the HIPAA Rules. Thus, we
believe the use of the standard isappropriate here and should be familiar
to most entities. We provide additional
guidance regarding who is an agent
above in our response to comments on
the HITECH modifications to the HIPAA
Enforcement Rule. Because of theagency implications on the timing ofbreach notifications, we encourage

PO 00000

Frm 00092

Fmt 4701

Sfmt 4700

covered entities to discuss and define intheir business associate agreements therequirements regarding how, when, andto whom a business associate should
notify the covered entity of a potential
breach.
Response to Other Public Comments
Comment: Several commenters asked
OCR to provide sample businessassociate agreement language to outline
the covered entity’s and businessassociate’s obligations following abreach of unsecured protected healthinformation.
Response: A covered entity’s andbusiness associate’s obligations
following a breach of unsecured
protected health information will varydepending on the relationship. For
example, whether a business associate
will send the breach notices to affectedindividuals and/or to notify the
Secretary (and media, if applicable) on
behalf of a covered entity is a businessdecision of the parties and how quickly
a business associate is to notify acovered entity of a breach within therequired timeframe may be based on anumber of factors, such as whether thebusiness associate is an agent of thecovered entity. However, to help
covered entities and business associates
implement the new business associateagreement requirements generally underthe HITECH modifications to the HIPAA
Rules, the Department has publishedsample business associate agreement
provisions on its web site.
Comment: Some commenters asked
what happens if a covered entity and abusiness associate disagree about
whether an impermissible use or
disclosure is a breach that requires
notification. These commenters asked if
both parties must be in agreement before
breach notification obligations are
triggered.
Response: The covered entity is
ultimately responsible for providing
individuals with notification ofbreaches and, as indicated above, theclock for notifying individuals ofbreaches begins upon knowledge of theincident, even if it is not yet clear
whether the incident qualifies as abreach for purposes of this rule. Further,
this final rule clarifies that the default
presumption is that an impermissible
use or disclosure is a breach unless it
can be determined through a risk
assessment that there is a low
probability that the data may becompromised. This standard should
allow for more uniform application of
the risk assessment approach acrosscovered entities and business associates.
Comment: One commenter stated thatthe requirement that a business

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
associate notify a covered entity of abreach of unsecured protected healthinformation is duplicative of a businessassociate’s other obligations to notify
the covered entity of privacy violations
and security incidents.
Response: Business associates are
required to report to covered entities
any security incidents or uses ordisclosures of protected healthinformation not provided for by theirbusiness associate agreements, which
include but are broader than breaches of
unsecured protected health information
under this Rule. For example, a security
incident need not lead to unauthorizedaccess to protected health information(and thus, is not a breach) but is still an
event that should be reported to thecovered entity. Further, when a security
incident occurs that does rise to thelevel of a breach, the breach notice tothe covered entity suffices to meet therequirement to report the security
incident to the covered entity (however,a covered entity may require throughthe business associate agreement that
additional information be reported).
Therefore, these requirements are not
duplicative.

Similarly, § 164.412(b), based on 45
CFR 164.528(a)(2)(ii) of the Privacy
Rule, requires a covered entity or
business associate to temporarily delay
a notification, notice, or posting if a law
enforcement official states orally that a
notification would impede a criminal
investigation or cause damage tonational security. However, in this case,the covered entity or business associatemust document the statement and theidentity of the official and delay
notification for no longer than 30 days,
unless a written statement meeting theabove requirements is provided duringthat time. We interpreted theseprovisions as tolling the time within
which notification is required under§§ 164.404, 164.406, 164.408, and164.410, as applicable.

6. Law Enforcement Delay

Section 164.414(a) requires covered
entities to comply with theadministrative requirements of§ 164.530(b), (d), (e), (g), (h), (i), and (j)of the Privacy Rule with respect to thebreach notification provisions of thissubpart. These Privacy Rule provisions,for example, require covered entities
and business associates to develop anddocument policies and procedures, train
workforce members on and havesanctions for failure to comply withthese policies and procedures, permit
individuals to file complaints regardingthese policies and procedures or a
failure to comply with them, andrequire covered entities to refrain from
intimidating or retaliatory acts. Thus, acovered entity is required to consider
and incorporate the breach notification
requirements with respect to its
administrative compliance and otherobligations.
Section 164.414(b) provides that,
following an impermissible use or
disclosure under the Privacy Rule,covered entities and business associates
have the burden of demonstrating that
all notifications were made as requiredby this subpart. Additionally, as part ofdemonstrating that all required
notifications were made, a covered
entity or business associate, asapplicable, also must be able todemonstrate that an impermissible useor disclosure did not constitute a
breach, as such term is defined atsroberts on DSK5SPTVN1PROD with

Interim Final Rule
Section 13402(g) of the HITECH Act
provides that if a law enforcement
official determines that a notification,
notice, or posting required under thissection would impede a criminal
investigation or cause damage tonational security, such notification,
notice, or posting shall be delayed in thesame manner as provided under 45 CFR
164.528(a)(2) of the Privacy Rule in thecase of a disclosure covered under suchsection. Section 164.412 implements
section 13402(g) of the Act, requiring acovered entity or business associate totemporarily delay notification to theindividual, the media (if applicable), toa covered entity by a business associate,
and to the Secretary if instructed to do
so by a law enforcement official.
Section 164.412(a), based on therequirements of 45 CFR 164.528(a)(2)(i)of the Privacy Rule, provides for a
temporary delay of notification insituations in which a law enforcement
official provides a statement in writingthat the delay is necessary because
notification would impede a criminal
investigation or cause damage tonational security, and specifies the time
for which a delay is required. In such
instances, the covered entity is required
to delay the notification, notice, or
posting for the time period specified by
the official.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Final RuleThe Department did not receive
public comments on this provision of
the interim final rule. We retain§ 164.412 in this final rule without
modification.
7. Section 164.414—Administrative
Requirements and Burden of Proof
Interim Final RulePO 00000

Frm 00093

Fmt 4701

Sfmt 4700

5657§ 164.402, in cases where the covered
entity or business associate determinedthat notifications were not required. To
conform to these provisions, § 160.534
of the HIPAA Enforcement Rule makes
clear that, during any administrative
hearing, the covered entity has theburden of going forward and the burdenof persuasion with respect to theseissues.
Thus, when a covered entity or
business associate knows of animpermissible use or disclosure ofprotected health information, it should
maintain documentation that all
required notifications were made, or,alternatively, to demonstrate that
notification was not required: (1) Its risk
assessment (discussed above in§ 164.402) demonstrating a low
probability that the protected healthinformation has been compromised by
the impermissible use or disclosure or(2) the application of any otherexceptions to the definition of ‘‘breach.’’Overview of Public Comments
One commenter stated that it iscritical that all employees are trained
and knowledgeable about what
constitutes a breach, so that the covered
entity or business associate can provide
the required notifications within therequired timeframe. The commenter
also maintained that OCR shouldemphasize the necessity of this training.
With respect to the burden of proof
placed upon covered entities andbusiness associates, one commenter
agreed that covered entities andbusiness associates should have theburden to demonstrate that all
notifications were provided following abreach of unsecured protected healthinformation. However, the commenter
asked that we include a presumptionthat an impermissible use or disclosureof protected health information did notconstitute a breach if a covered entity or
business associate has implemented abreach notification policy, completed arisk assessment, and documented that it
followed its policy in reaching aconclusion that breach notification was
not required.
Final RuleWe retain § 164.414 in this final rule
without modification. We emphasize
the importance of ensuring that all
workforce members are appropriately
trained and knowledgeable about what
constitutes a breach and on the policies
and procedures for reporting, analyzing,and documenting a possible breach of
unsecured protected health information.
We note that because this final rule
modifies the definition of breach as
stated in the interim final rule, covered

E:\FR\FM\25JAR2.SGM

25JAR2

5658

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

entities will need to update theirpolicies and procedures and retrain
workforce members as necessary toreflect such modifications.
With respect to this burden of proof,
section 13402 of the statute places theburden of proof on a covered entity or
business associate, if applicable, todemonstrate that all notifications weremade as required. Therefore, section
164.530(j)(1)(iv) requires covered
entities to maintain documentation tomeet this burden of proof. This includes
documentation that all required
notifications have been provided or thatno breach occurred and notification was
not necessary. If a covered entity’s
determination with respect to whether abreach occurred is called into question,
the covered entity should produce thedocumentation that demonstrates thereasonableness of its conclusions basedon the findings of its risk assessment.
8. Technical Corrections
The interim final rule made several
technical changes to align the HIPAA
Rules in light of the new breach
notification requirements of subpart D.
See 74 FR 42755–56. We did not receive
comments on these changes. We retain
the technical corrections made in theinterim final rule and also make an
additional technical correction byadding ‘‘and’’ to the end of§ 160.534(b)(1)(iii) to make clear the
relationship between § 160.534(b)(1)(iii)and the new § 160.534(b)(1)(iv).
9. Preemption

sroberts on DSK5SPTVN1PROD with

Interim Final Rule
The interim final rule clarified that
contrary State law will be preempted bythese breach notification regulations.
Section 1178 of the Social Security Act,
42 U.S.C. 1320d–7, which was added by
HIPAA, provides that HIPAA
administrative simplification provisions
generally preempt conflicting State law.
Section 160.203 states that a standard,requirement, or implementation
specification that is adopted as
regulation at 45 CFR parts 160, 162, or
164 and that is ‘‘contrary to a provisionof State law preempts the provision ofState law.’’ Thus, whether a State law iscontrary to these breach notification
regulations is to be determined based on
the definition of ‘‘contrary’’ at § 160.202,
which states that a State law is contrary
if ‘‘[a] covered entity would find it
impossible to comply with both theState and Federal requirements’’ or if
the State law ‘‘stands as an obstacle tothe accomplishment and execution of
the full purposes and objectives’’ of thebreach notification provisions in theAct. Covered entities must analyze

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

relevant State laws with respect to thebreach requirements to understand theinteraction and apply this preemption
standard appropriately.
In the interim final rule, we stated ourbelief that, in general, covered entities
can comply with both the applicable
State laws and this regulation and thatin most cases, a single notification cansatisfy the notification requirements
under State laws and this regulation.
For example, if a State breach
notification law requires notification besent to the individual in a shorter timeframe than is required by thisregulation, a covered entity that sends
the notice within the time frame
required by the State law will also be incompliance with this regulation’stimeliness requirements.
Additionally, since the Act and rule
are flexible in terms of how theelements are to be described, and do notprohibit additional elements from being
included in the notice, in general,
Federal requirements contain flexibility
for covered entities to develop a noticethat satisfies both laws.
Overview of Public Comments
While some commenters were pleased
that the breach notification rule
preempts conflicting State law, othercommenters expressed confusion orconcern with this preemption standard.
Many commenters stated that despite
the fact that in most cases a covered
entity may only need to provide one
notification to satisfy both State andFederal law, there will be some cases inwhich a covered entity will have toprovide multiple notices to the same
individual to ensure compliance withall relevant laws. This will result in
confusion for the individual andincreased costs for the covered entity.
Some of these commenters suggested
that this Federal breach notification law
should preempt all State breach
notification laws, or alternatively, that
HHS should work with Congress andthe States to harmonize the breach
notification laws such that only one
notice is required following a breach.
Final Rule
We maintain the preemption standard
discussed in the interim final rule,
which is based on section 1128 of theSocial Security Act and applies to the
HITECH Act’s breach notification
provisions by virtue of section 13421 of
the HITECH Act. We continue to believe
that, generally, covered entities are able
to comply with both State and Federal
requirements for providing breach
notification with one breach noticebased on the flexibility provided toentities in this Rule. However, even in

PO 00000

Frm 00094

Fmt 4701

Sfmt 4700

the exceptional case, we do not haveauthority to preempt a State breach
notification law that is not contrary tothis Rule.
10. Responses to Other Public
Comments
Comment: One commenter asked
whether penalties are automaticallyassessed following a violation of thebreach notification rule or if this is done
at OCR’s discretion and whether civil
money penalties can be assessed for theunderlying cause of a breach of
unsecured protected health information
where a covered entity has provided all
required breach notifications.
Response: OCR’s enforcement of thebreach notification rule will be carriedout pursuant to the Enforcement Rule.
Pursuant to the Enforcement Rule, OCR
may impose a civil money penalty for a
failure to comply with the breach
notification rule. OCR also has thediscretion to work with the covered
entity to achieve voluntary compliancethrough informal resolution, except incases in which it has found a violation
due to willful neglect. Because every
breach of unsecured protected healthinformation must have an underlying
impermissible use or disclosure under
the Privacy Rule, OCR also has theauthority to impose a civil money
penalty for the underlying Privacy Ruleviolation, even in cases where all
required breach notifications were
provided.
VI. Modifications to the HIPAA Privacy
Rule Under GINA
A. Background
The Genetic Information
Nondiscrimination Act of 2008(‘‘GINA’’), Public Law 110–233, 122
Stat. 881, prohibits discrimination basedon an individual’s genetic informationin both the health coverage andemployment contexts. With respect tohealth coverage, Title I of GINA
generally prohibits discrimination inpremiums or contributions for group
coverage based on genetic information,
proscribes the use of genetic
information as a basis for determining
eligibility or setting premiums in theindividual and Medicare supplemental(Medigap) insurance markets, and limits
the ability of group health plans, healthinsurance issuers, and Medigap issuers
to collect genetic information or torequest or require that individuals
undergo genetic testing. Title II of GINA
generally prohibits use of genetic
information in the employment context,
restricts employers and other entities
covered by Title II from requesting,requiring, or purchasing genetic

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
information, and strictly limits such
entities from disclosing genetic
information. The Departments of Labor,
Treasury, and Health and Human
Services (HHS) are responsible foradministering and enforcing the GINA
Title I nondiscrimination provisions,and the Equal Employment Opportunity
Commission (EEOC) is responsible foradministering and enforcing the GINA
Title II nondiscrimination provisions.13
In addition to thesenondiscrimination provisions, section
105 of Title I of GINA contains new
privacy protections for genetic
information, which require theSecretary of HHS to revise the Privacy
Rule to clarify that genetic informationis health information and to prohibitgroup health plans, health insurance
issuers (including HMOs), and issuers ofMedicare supplemental policies fromusing or disclosing genetic information
for underwriting purposes.14
B. Overview of the Proposed RuleOn October 7, 2009, the Department
published a notice of proposed
rulemaking (NPRM or ‘‘proposed rule’’)to strengthen the privacy protections forgenetic information under the HIPAA
Privacy Rule by implementing theprotections for genetic information
required by GINA 15 and making relatedchanges to the Rule. In particular, in
accordance with section 105 of GINA
and the Department’s general authority
under sections 262 and 264 of HIPAA,
the Department proposed to: (1)Explicitly provide that genetic
information is health information forsroberts on DSK5SPTVN1PROD with

13 The Departments of Labor (Employee Benefits

Security Administration), Treasury (Internal
Revenue Service), and HHS (Centers for Medicare& Medicaid Services (CMS)) have issued regulations
in a separate rulemaking (at 74 FR 51664) toimplement sections 101–103 of GINA, whichamended: section 702 of the Employee Retirement
Income Security Act of 1974 (29 U.S.C. 1182);
section 2702 of the Public Health Service Act (42U.S.C. 300gg–1) (renumbered as section 2705 by the
Affordable Care Act); and section 9802 of theInternal Revenue Code of 1986. Section 104 of
GINA applies to Medigap issuers, which are subject
to the provisions of section 1882 of the Social
Security Act that are implemented by CMS, andwhich incorporate by reference certain provisions
in a model regulation of the National Associationof Insurance Commissioners (NAIC). The NAIC
amended its model regulation on September 24,
2008, to conform to section 104 of GINA, and theamended regulation was published by CMS in theFederal Register on April 24, 2009, at 74 FR 18808.
With respect to Title II of GINA, the EEOC issued
final regulations on November 9, 2010, at 75 FR
68912.
14 Section 105 of GINA, entitled ‘‘Privacy andConfidentiality,’’ amends Part C of Title XI of theSocial Security Act by adding section 1180 toaddress the application of the HIPAA Privacy Ruleto genetic information.
15 Any reference in this preamble to GINA is areference to Title I of GINA, except as otherwise
indicated.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

purposes of the Privacy Rule; (2)prohibit all health plans covered by the
HIPAA Privacy Rule from using or
disclosing protected health informationthat is genetic information forunderwriting purposes; (3) revise theprovisions relating to the Notice ofPrivacy Practices for health plans that
perform underwriting; (4) make anumber of conforming changes todefinitions and other provisions of theRule; and (5) make technical corrections
to update the definition of ‘‘healthplan.’’The 60-day public comment period
for the proposed rule closed on
December 7, 2009, and the Department
received approximately twenty-fivecomments in response to its proposal.16
After considering the public comments,
the Department is issuing this final rule
to strengthen the privacy protections forgenetic information in accordance with
GINA and the Department’s generalauthority under sections 262 and 264 of
HIPAA. In developing this rule, theDepartment consulted with the
Departments of Labor and Treasury, as
required by section 105(b)(1) of GINA,
to ensure, to the extent practicable,consistency across the regulations. In
addition, the Department coordinatedwith the EEOC in the development ofthese regulations.
The provisions of the proposed ruleand the public comments received thatwere within the scope of the proposed
rule are described in more detail below
in the section-by-section description of
the final rule.
C. Section-by-Section Description of
Final Rule and Response to Public
Comments
1. Scope: Extension of RequiredProtections to All Health Plans Subject
to the HIPAA Privacy Rule
Proposed Rule
Section 105 of GINA requires HHS tomodify the Privacy Rule to prohibit ‘‘acovered entity that is a group healthplan, health insurance issuer that issues
health insurance coverage, or issuer ofa medicare [sic] supplemental policy’’from using or disclosing genetic
information for underwriting purposes.
Section 105 of GINA provides that theterms ‘‘group health plan’’ and ‘‘healthinsurance coverage’’ have the meanings
given such terms under section 2791 of
the Public Health Service Act (PHSA)(42 U.S.C. 300gg–91), and that the term‘‘medicare [sic] supplemental policy’’has the meaning given such term in
section 1882(g) of the Social Security
16 The public comments are available at http://
www.regulations.gov.

PO 00000

Frm 00095

Fmt 4701

Sfmt 4700

5659

Act. In addition, the term ‘‘healthinsurance issuer,’’ as defined at 42
U.S.C. 300gg–91, includes a healthmaintenance organization (HMO). Thesefour types of entities (i.e., group healthplans, health insurance issuers, andhealth maintenance organizations, as
defined in the PHSA, as well as issuersof Medicare supplemental policies),
correspond to the types of covered
entities listed at subparagraphs (i)through (iii) and (vi) of paragraph (1) of
the definition of ‘‘health plan’’ at§ 160.103 in the HIPAA Privacy Rule,issued under HIPAA’s Administrative
Simplification provisions. These also
are the entities to which HIPAA’s
nondiscrimination provisions apply andto which the nondiscrimination
provisions of GINA Title I weredirected.
However, in addition to these fourtypes of entities, the HIPAA Privacy
Rule also includes a number of otherentities within the definition of ‘‘healthplan’’: (1) Long-term care policies(excluding nursing home fixedindemnity policies); (2) employee
welfare benefit plans or otherarrangements that are established or
maintained for the purpose of offeringor providing health benefits to theemployees of two or more employers (tothe extent that they are not group healthplans or health insurance issuers); (3)high risk pools that are mechanisms
established under State law to provide
health insurance coverage orcomparable coverage to eligible
individuals; (4) certain public benefit
programs, such as Medicare Part A and
B, Medicaid, the military and veterans’
health care programs, the Indian HealthService program, and others; as well as(5) any other individual or group plan,or combination of individual or groupplans that provides or pays for the costof medical care (as the term ‘‘medical
care’’ is defined in section 2791(a)(2) ofthe PHSA, 42 U.S.C. 300gg–91(a)(2)).
This last category includes, for example,
certain ‘‘excepted benefits’’ plansdescribed at 42 U.S.C. 300gg–91(c)(2),such as limited scope dental or vision
benefits plans. See the definition of‘‘health plan’’ at § 160.103.
In the NPRM, the Department, using
both its authority under GINA as well as
its broad authority under HIPAA,
proposed to apply the prohibition on
using and disclosing protected healthinformation that is genetic information
for underwriting to all health plans thatare subject to the Privacy Rule, rather
than solely to the plans GINA explicitly
requires be subject to the prohibition.
As explained in the proposed rule, the
HIPAA Administrative Simplification
provisions provide the Secretary with

E:\FR\FM\25JAR2.SGM

25JAR2

5660

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withbroad authority to craft privacy
standards that uniformly apply to all
health plans, regardless of whether such
health plans are governed by otherportions of the HIPAA statute. In
addition, the Department indicated in
the proposed rule that nothing in GINA
explicitly or implicitly curtails thisbroad authority of the Secretary to
promulgate privacy standards for any
and all health plans that are governedby the HIPAA Administrative
Simplification provisions.
Under the Privacy Rule, andconsistent with HIPAA, an individual’s
privacy interests and rights with respect
to the use and disclosure of protected
health information are protected
uniformly without regard to the type of
health plan that holds the information.
Thus, under the Privacy Rule,individuals can expect and benefit fromprivacy protections that do not diminish
based on the type of health plan fromwhich they obtain health coverage. In
developing the proposed rule, theDepartment believed that individuals’
interests in uniform protection under
the Privacy Rule against the use or
disclosure of their genetic information
for underwriting purposes would
outweigh any adverse impact on healthplans that are not covered by GINA,
particularly since it was not expectedthat all of the health plans subject to thePrivacy Rule use or disclose protected
health information that is genetic
information for underwriting (or evenperform underwriting generally, in thecase of some of the public benefit
plans). For these reasons, theDepartment proposed to apply theprohibition on using or disclosing
protected health information that is
genetic information for underwriting
purposes to all health plans that are
HIPAA covered entities.
Overview of Public Comments
The Department received comments
both in support of and against the
proposed application of the prohibition
on using or disclosing genetic
information for underwriting purposes
to all health plans covered by thePrivacy Rule. Several commenters
agreed that the extension of the
proposed requirements to all healthplans is an appropriate exercise of theSecretary’s discretion under HIPAA andis necessary to protect the privacy
interests of all individuals without
regard to the type of health plan holding
individuals’ health information, andstated that such an extension would
further encourage individuals to takeadvantage of genetic services. In
addition, one commenter in support ofthe proposal indicated that sixteen

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

States also regulate the use of genetic
information in disability insurance, andten States regulate its use in long-termcare insurance, and it is expected thatthese numbers will continue to increase.
The commenter stated that as States
move forward in this area it wasappropriate for the Federal government
to do so as well. However, this and one
other commenter, while generally insupport of extending the prohibition on
using or disclosing genetic information
for underwriting to all health plans, also
recommended that the Department
monitor the impact of such aprohibition on long-term care insurers.
A few commenters did not support
the Department’s proposal and argued
that the prohibition against using or
disclosing genetic information forunderwriting purposes in the Privacy
Rule should apply only to those plans
to which GINA expressly applies.
Commenters argued that applying theprohibition beyond the health plans
identified in GINA was contrary to
GINA and its intent.
Certain commenters expressed
particular disagreement and concern
with applying the prohibition on the useof genetic information for underwriting
to long-term care insurers. One
commenter argued that there was clear
Congressional intent in the legislative
history of GINA to exempt ‘‘excepted
benefits,’’ particularly long-term careinsurance, from any prohibitions under
GINA and thus, the Privacy Rule should
not apply the prohibition onunderwriting with genetic information
to issuers of long term care policies. The
commenter also argued that the GINA
prohibition should not apply to longterm care insurers because long-termcare plans have different characteristics
from other health plans and applying
the GINA prohibition to long-term careinsurers would jeopardize the ability oflong-term care insurers to adequately
underwrite and thus, the viability of thelong-term care insurance market. The
commenter explained that this would be
due to the fact that when underwriting,long term care insurers look todetermine an individual’s probability ofneeding long-term care in the future anddiagnosis of a particular condition is not
the only way this may be determined
and in some cases may not even be
relevant to such a determination. The
Department also heard similar concerns
about the potential negative impact ofan underwriting prohibition on theeconomic viability of the long-term
market, from certain members ofCongress who wrote to the Secretary on
this issue, as well as from certain
outside parties during fact finding
meetings held by the Department.

PO 00000

Frm 00096

Fmt 4701

Sfmt 4700

Final Rule
The final rule adopts the approach of
the proposed rule to apply theprohibition on using or disclosing
protected health information that is
genetic information for underwriting
purposes to all health plans that arecovered entities under the HIPAA
Privacy Rule, including those to which
GINA does not expressly apply, except
with regard to issuers of long term carepolicies. We continue to disagree withthe commenters that stated such an
extension would conflict with GINA
and is outside the scope of ourauthority. As explained more fully inthe proposed rule, the Department has
broad authority under HIPAA toregulate a health plan’s uses anddisclosures of protected healthinformation, including genetic
information, to protect an individual’s
privacy interests. See 74 FR 51698,
51699–51700. It does not follow that byexempting ‘‘excepted benefits’’ from theprohibitions under GINA that Congress
intended to restrict the Department’s
broad authority under HIPAA. Further,
there is no conflict with GINA in
extending the same privacy protections
outlined in GINA to those health plansthat are not covered by GINA but areotherwise covered by the HIPAA
Privacy Rule. GINA and section 264 of
HIPAA are not irreconcilablyinconsistent but rather operateconcurrently without conflict. Lastly,
GINA did not override HIPAA, and did
not displace the Department’s authority
to prohibit uses and disclosures ofgenetic information that GINA does nototherwise prohibit. Therefore, nothingin GINA explicitly or implicitly curtails
the broad authority of the Secretary to
promulgate privacy standards for any
and all health plans that are governedby the HIPAA Administrative
Simplification provisions.
We also continue to believe that
individuals have a strong privacy
interest in not having their genetic
information used in an adverse manner
for underwriting purposes and tobelieve that this privacy interest
outweighs any adverse impact on mosthealth plans covered by the Privacy
Rule. With respect to most health plans
not subject to GINA, the publiccomment did not indicate that aprohibition on using genetic
information for underwriting would
have significant adverse impacts on theviability of these plans. Nor did the
public comment generally provide
information showing that these healthplans actually use or disclose protected
health information that is genetic
information for underwriting, or plan to

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withdo so in the future (or even perform
underwriting generally, in the case ofsome of the public benefit plans).
However, as indicated above, theDepartment did hear from a number ofsources about the potential adverse
impact a prohibition on using genetic
information for underwriting would
have on the ability of a long-term careinsurer to effectively underwrite andthus, on the viability of the long-termcare insurance market generally. The
Department recognizes the importanceof long-term care insurance coverageand the need to ensure its continued
availability. The Department also
acknowledges that, at this time, it does
not have the information necessary tomore precisely and carefully measure
the extent of such an impact on thelong-term market in order toappropriately balance an individual’s
privacy interests with such an impact.
Thus, this final rule excludes long-termcare plans from the underwritingprohibition.
While we exempt long-term careplans from the underwriting prohibitionin this final rule, we continue to believe
an individual has a strong privacy
interest in the way his or her genetic
information is used for the underwritingof long-term care insurance. At thecurrent time, however, we do not havesufficient information to determine theproper balance between the individual’s
privacy interests and the industry’s
concerns about the cost effects of
excluding genetic information. For thatreason, we are looking into ways toobtain further information on this issue,
such as through a study by the National
Association of Insurance Commissioners(NAIC) on the tension between the useof genetic information for underwriting
and the associated privacy concerns in
the context of their model long-termcare rules. Based on the information the
Department may obtain, the Department
will reassess how best to move forwardin this area in the future.
Long-term care plans, while notsubject to the underwriting prohibition,
continue to be bound by the Privacy
Rule, as are all other covered healthplans, to protect genetic informationfrom improper uses and disclosures,and to only use or disclose genetic
information as required or expressly
permitted by the Rule, or as otherwise
authorized by the individual who is the
subject of the genetic information.
2. Section 160.101—Statutory Basis andPurposeWe have revised § 160.101, which
describes the statutory basis of the
HIPAA Rules, to include a reference tosection 1180 of the Social Security Act,

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

as added by section 105 of GINA (Pub.
L. 110–233).
3. Section 160.103—Definitions
The final rule modifies § 160.103 of
the Privacy Rule to: (1) Revise thedefinition of ‘‘health information’’ tomake clear that the term includes‘‘genetic information;’’ (2) add
definitions for the GINA-related terms of‘‘family member,’’ ‘‘genetic
information,’’ ‘‘genetic services,’’‘‘genetic test,’’ and ‘‘manifestation or
manifested;’’ and (3) make technicalcorrections to the definition of ‘‘healthplan.’’ With respect to the GINA-related
terms, the final rule adopts definitions
that are generally consistent with thedefinitions of such terms promulgatedin the implementing regulations for
sections 101–103 of GINA. This will
facilitate compliance for those healthplans subject to both the privacy as wellas the nondiscrimination provisions of
GINA.
a. Definition of ‘‘Health information’’
Proposed Rule
Prior to enactment of GINA, theDepartment issued guidance that genetic
information is health information
protected by the Privacy Rule to theextent that such information is
individually identifiable and held by acovered entity (subject to the general
exclusions from the definition of‘‘protected health information’’).17
Section 105 of GINA requires the
Secretary to revise the Privacy Rule to
make clear that genetic information ishealth information under the Rule.
Thus, the Department proposed tomodify the definition of ‘‘healthinformation’’ at § 160.103 to explicitly
provide that such term includes genetic
information.
Overview of Public Comments
The Department received a few
comments expressing specific support
for and one comment against the
proposed inclusion of the term ‘‘genetic
information’’ in the definition of ‘‘healthinformation.’’ The commenters
supporting the revision to the definitionof ‘‘health information’’ indicated thatsuch an inclusion was necessary to
clarify that genetic information is health
17 See, e.g., Frequently Asked Question number
354, available at http://www.hhs.gov/ocr/privacy/
hipaa/faq/protected_health_information/354.html,
which states: Question: Does the HIPAA Privacy
Rule protect genetic information? Answer: Yes,
genetic information is health information protectedby the Privacy Rule. Like other health information,
to be protected it must meet the definition ofprotected health information: it must be
individually identifiable and maintained by acovered health care provider, health plan, or healthcare clearinghouse. See also 45 CFR 160.103.

PO 00000

Frm 00097

Fmt 4701

Sfmt 4700

5661

information. The commenter against the
proposed inclusion to the definition
argued that although GINA directs the
Department to treat genetic information
as health information, the language of
GINA does not require a change to thedefinition of ‘‘health information,’’ andthis change would create costs forhealth plans, which would have to
update all their policies and procedures
to reflect the change.
Final Rule
The final rule adopts the proposed
modification to the definition of ‘‘healthinformation’’ at § 160.103. This
modification to the definition is anecessary clarification to the Privacy
Rule based on the statutory language.
Given that revising the definition of‘‘health information’’ to include genetic
information does not substantively
change the scope of the Privacy Rule, it
is unclear why such a change alone
would require revisions to a healthplan’s policies and procedures. Healthplans that perform underwriting willotherwise need to revise their policies
and procedures as necessary to comply
with this final rule, as well as themodifications to the HIPAA Rules
required by the Health Information
Technology for Economic and Clinical
Health (HITECH) Act. Thus, to theextent the concern about thismodification stems from the fact that ahealth plan’s policies and procedures
quote the prior regulatory definition of‘‘health information,’’ the health plancan revise the definition at the time itis otherwise updating its policies andprocedures to comply with these rules.
b. Definition of ‘‘Genetic Information’’
Proposed Rule
The term ‘‘genetic information’’ isdefined in GINA and establishes what
information is protected by the statute.
Section 105 of GINA provides that theterm ‘‘genetic information’’ in section
105 shall have the same meaning given
the term in section 2791 of the PHSA
(42 U.S.C. 300gg–91), as amended bysection 102 of GINA. Section 102(a)(4)of GINA defines ‘‘genetic information’’to mean, with respect to any individual,
information about: (1) Such individual’s
genetic tests; (2) the genetic tests offamily members of such individual; and(3) the manifestation of a disease ordisorder in family members of suchindividual (i.e., family medical history).
GINA also provides that the term‘‘genetic information’’ includes, withrespect to any individual, any request
for, or receipt of, genetic services, orparticipation in clinical research which
includes genetic services, by such

E:\FR\FM\25JAR2.SGM

25JAR2

5662

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulationsindividual or family member of suchindividual. GINA expressly provides
that the term ‘‘genetic information’’shall not include information about thesex or age of any individual. This basic
definition of ‘‘genetic information’’ insection 102(a)(4) of GINA (and that is to
apply for purposes of section 105) isalso expanded by section 102(a)(3),
which provides that any reference togenetic information concerning an
individual or family member in the
PHSA shall include: with respect to anindividual or family member of anindividual who is a pregnant woman,the genetic information of any fetus
carried by such pregnant woman; andwith respect to an individual or family
member utilizing an assisted
reproductive technology, the genetic
information of any embryo legally heldby the individual or family member.
The Department proposed to include
this statutory definition of ‘‘genetic
information’’ in § 160.103.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
Most commenters did not address the
proposed definition of ‘‘genetic
information’’ in their comments on the
proposed rule. However, onecommenter stated that it was unclear
what information may fall within thescope of the term ‘‘genetic information’’and whether such term may beconstrued to include traditional medical
information or medical tests used inunderwriting today.
Final Rule
The final rule adopts without
modification the definition of ‘‘genetic
information’’ proposed in the NPRM.
This definition is consistent with thedefinition found in the implementing
regulations for sections 101–103 of
GINA and with which compliance isalready required by most health plans.
The term ‘‘genetic information’’includes information about the genetic
tests of the individual or of theindividual’s family members and about
diseases or disorders manifested in an
individual’s family members (i.e.,family health history). Thus,
information about manifested diseases,
disorders, or conditions of theindividual or medical tests that do notmeet the rule’s definition of ‘‘genetic
test,’’ such as HIV tests, complete bloodcounts, cholesterol or liver function
tests, or tests to detect for the presenceof alcohol or drugs, are not genetic
information, and such information may
be used or disclosed for underwriting
purposes. Conversely, family healthhistories and information about genetic
tests, such as tests to determine whether
an individual or family member has a

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

gene variant associated with breast
cancer, are genetic information, andsuch information may not be used ordisclosed for underwriting purposes.
The definitions of ‘‘manifestation or
manifested’’ and ‘‘genetic test’’ arediscussed more fully below.
c. Definition of ‘‘Genetic Test’’
Proposed RuleAs explained above, GINA provides
that the term ‘‘genetic information’’includes information about anindividual’s genetic tests or the genetic
tests of family members of theindividual. Section 105 of GINA
provides that the term ‘‘genetic test’’shall have the same meaning as the term
has in section 2791 of the PHSA (42U.S.C. 300gg–91), as amended bysection 102 of GINA. Section 102(a)(4)of GINA amends section 2791(d) of the
PHSA to define ‘‘genetic test’’ to mean‘‘an analysis of human DNA, RNA,chromosomes, proteins, or metabolites,that detects genotypes, mutations, or
chromosomal changes.’’ GINA further
clarifies that the term ‘‘genetic test’’does not include an analysis of proteinsor metabolites that does not detect
genotypes, mutations, or chromosomalchanges, nor does it include an analysis
of proteins or metabolites that is directly
related to a manifested disease,
disorder, or pathological condition that
could reasonably be detected by a healthcare professional with appropriate
training and expertise in the field of
medicine involved.
Consistent with the statutory
definition, the Department proposed todefine ‘‘genetic test’’ at § 160.103 as ananalysis of human DNA, RNA,chromosomes, proteins, or metabolites,
if the analysis detects genotypes,
mutations, or chromosomal changes,
and to provide in the definition that‘‘genetic test’’ does not include ananalysis of proteins or metabolites thatis directly related to a manifested
disease, disorder, or pathologicalcondition. While the statute refers to a‘‘manifested’’ disease as one that could
reasonably be detected by a health care
professional with appropriate training
and expertise in the field of medicine
involved, the statute does not define‘‘manifested.’’ Consequently, for clarity,
the Department proposed a definition of‘‘manifested,’’ as described below.
Overview of Public Comments
The Department received one
comment requesting that the
Department include examples within
the regulatory text of the definition andanother comment stated that it is not

PO 00000

Frm 00098

Fmt 4701

Sfmt 4700

clear what constitutes a genetic test
under the definition.
Final Rule
The final rule adopts without
modification the definition of ‘‘genetic
test’’ as proposed in the NPRM. Thisdefinition is consistent with thedefinition found in the implementing
regulations for sections 101–103 of
GINA and with which compliance isalready required by most health plans.
Under this definition, a test to
determine whether an individual has agene variant associated with breast
cancer (such as the BRCA1 or BRCA2
variant) is a genetic test. Similarly, a test
to determine whether an individual has
a genetic variant associated withhereditary nonpolyposis colorectal
cancer is a genetic test. Such tests are
genetic in nature because they detect
genotypes, mutations, or chromosomalchanges. In contrast, medical tests that
do not detect genotypes, mutations, or
chromosomal changes, are not genetic
tests. For example, HIV tests, complete
blood counts, cholesterol tests, liverfunction tests, or tests for the presenceof alcohol or drugs are not genetic tests.
Consistent with the approach taken
generally with the HIPAA Privacy Rule,the Department declines to include
these examples in the regulatory text.
The Department intends to issue future
guidance on its web site about thisissue.
d. Definition of ‘‘Genetic Services’’
Proposed Rule
GINA provides that the term ‘‘genetic
information’’ includes, with respect toany individual, any request for, or
receipt of, genetic services, orparticipation in clinical research which
includes genetic services, by suchindividual or any family member ofsuch individual. Section 102(a)(4) of
GINA defines ‘‘genetic services’’ tomean: (1) A genetic test; (2) genetic
counseling (including obtaining,interpreting, or assessing genetic
information); or (3) genetic education.
Thus, the fact that an individual or afamily member of the individual
requested or received a genetic test,
counseling, or education is information
protected under GINA. Genetic
counseling and education are means bywhich individuals can obtain
information and support about potential
risks for genetic diseases and disorders.
The Department proposed to add thestatutory definition of ‘‘genetic services’’
to the Privacy Rule.
Overview of Public Comments
The Department received one
comment requesting that the

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Department add language to thedefinition to make clear that the genetic
tests, genetic counseling, or genetic
education of a family member of anindividual are specifically covered by
the term.
Final Rule
The final rule adopts without
modification the definition of ‘‘genetic
services’’ proposed in the NPRM. Thisdefinition is consistent with thedefinition found in the implementing
regulations for sections 101–103 of
GINA and with which compliance isalready required by most health plans.
The Department does not believe it
necessary to add the term ‘‘family
member’’ to the definition of ‘‘genetic
services’’ because the definition of‘‘genetic information’’ makes clear that
information about any request for, or
receipt of, genetic services by a family
member of an individual is protected
information.
e. Definition of ‘‘Family Member’’sroberts on DSK5SPTVN1PROD with

Proposed Rule
The term ‘‘family member’’ is used in
the definition of ‘‘genetic information’’in GINA to indicate that an individual’s
genetic information also includes
information about the genetic tests of
the individual’s family members, aswell as family medical history. Section
105 of GINA states that the term ‘‘family
member’’ shall have the meaning givensuch term in section 2791 of the PHSA
(42 U.S.C. 300gg–91), as amended by
GINA section 102(a)(4), which defines‘‘family member’’ to mean, with respect
to any individual: (1) A dependent (assuch term is used for purposes ofsection 2701(f)(2) of the PHSA, 42
U.S.C. 300gg(f)(2)) of such individual; or(2) any other individual who is a firstdegree, second-degree, third-degree, or
fourth-degree relative of such individual
or of a dependent of the individual.
Section 2701(f)(2) of the PHSA uses theterm ‘‘dependent’’ to mean an
individual who is or may become
eligible for coverage under the terms ofa group health plan because of a
relationship to the plan participant.
The Department proposed toincorporate GINA’s definition of ‘‘family
member’’ into the Privacy Rule. The
proposed rule also clarified within thedefinition that relatives by affinity (suchas by marriage or adoption) are to betreated the same as relatives by
consanguinity (that is, relatives whoshare a common biological ancestor)
and that, in determining the degree ofrelationship, relatives by less than fullconsanguinity (such as half-siblings,
who share only one parent) are treated

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

the same as relatives by fullconsanguinity (such as siblings whoshare both parents). The NPRM
explained that this broad interpretationof ‘‘family member’’ was consistent with
GINA’s legislative history, whichsuggests that the term ‘‘family member’’is to be broadly construed to provide themaximum protection against
discrimination.18 In addition, theDepartment proposed to include in thedefinition of ‘‘family member’’ nonexhaustive lists of persons who are
first-, second-, third-, or fourth-degree
relatives. Finally, within the definitionof ‘‘family member,’’ the Department
proposed to refer to the definition of‘‘dependent’’ contained in theimplementing regulations at 45 CFR
144.103 rather to the PHSA directly.
Overview of Public Comments
One commenter expressed support forincluding relatives by affinity and byless than full consanguinity, agreeingthat this interpretation is consistent
with Congressional intent and provides
the most privacy protection for
individuals. This commenter also was
supportive of including non-exhaustive
lists of persons who are first-,
second-, third-, and fourth-degree
relatives to add clarity to the definition.
Final RuleAs we received only support withregard to the definition of ‘‘family
member,’’ the final rule adopts without
modification the definition of ‘‘family
member’’ proposed in the NPRM. Thisdefinition also is consistent with thedefinition found in the implementing
regulations for sections 101–103 of
GINA and with which compliance isalready required by most health plans.
f. Definition of ‘‘Manifestation or
Manifested’’
Proposed Rule
Although not separately defined by
GINA, the terms ‘‘manifestation’’ or‘‘manifested’’ are used in GINA in threeimportant contexts. First, GINA uses theterm ‘‘manifestation’’ to incorporate‘‘family medical history’’ into thedefinition of ‘‘genetic information’’ bystating that ‘‘genetic information’’includes, with respect to an individual,
the manifestation of a disease ordisorder in family members of suchindividual. Second, GINA uses the term‘‘manifested’’ to exclude from thedefinition of ‘‘genetic test’’ those tests
that analyze a physical malady rather
than genetic makeup by excluding fromthe definition analyses of proteins or
metabolites that are directly related to a
18 See House Report 110–28, Part 2 at 27.

PO 00000

Frm 00099

Fmt 4701

Sfmt 4700

5663

manifested disease, disorder, or
pathological condition. Third, GINA
uses the term ‘‘manifestation’’ to clarify
that nothing in Title I of GINA should
be construed to limit the ability of ahealth plan to adjust premiums orcontribution amounts for a group healthplan based on the manifestation of adisease or disorder of an individual
enrolled in the plan.19 However, GINA
provides that, in such case, themanifestation of a disease or disorder in
one individual cannot also be used as
genetic information about other groupmembers and to further increase thepremium for the plan. Similarly, for theindividual health insurance market,
GINA clarifies that it does not prohibita health plan from establishing rules for
eligibility for an individual to enroll incoverage or from adjusting premium orcontribution amounts for an individual
based on the manifestation of a diseaseor disorder in that individual or in a
family member of such individual
where such family member is covered
under the individual’s policy. However,under GINA, the manifestation of adisease or disorder in one individual
cannot also be used as genetic
information about other individuals andto further increase premiums orcontribution amounts.
Given the importance of the term‘‘manifested’’ or ‘‘manifestation,’’ theDepartment proposed to define the term.
Although GINA does not define theterm, it is clear from the statutory
definition of ‘‘genetic test’’ that amanifested disease or disorder is one‘‘that could reasonably be detected by ahealth care professional withappropriate training and expertise in thefield of medicine involved.’’Accordingly, the proposed rule defined
the term ‘‘manifestation or manifested’’
to mean, with respect to a disease,
disorder, or pathological condition, thatan individual has been or could
reasonably be diagnosed with thedisease, disorder, or pathologicalcondition by a health care professionalwith appropriate training and expertisein the field of medicine involved. The
proposed definition also provided that a
disease, disorder, or pathologicalcondition is not manifested if thediagnosis is based principally on genetic
information. This clarification was
included due to the fact that variants ofgenes associated with diseases havevarying degrees of predictive power for
19 We note that the Affordable Care Act, enacted
on March 23, 2010, includes a provision effective
for plan years beginning on or after January 1, 2014,
that prohibits insurers from discriminating against
individuals or charging individuals higher rates
based on pre-existing conditions. See Public Law
111–148.

E:\FR\FM\25JAR2.SGM

25JAR2

5664

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

later development of the disease. In
some cases, an individual may have agenetic variant for a disease and yet
never develop the disease. In othercases, the presence of a genetic variant
indicates that the individual will
eventually develop the disease, such asis the case with Huntington’s disease.
However, an individual may obtain apositive test that shows the genetic
variant for Huntington’s disease decades
before any clinical symptoms appear.
Under the proposed definition, thepresence of a genetic variant alone
would not constitute the diagnosis of adisease even in cases where it is certain
the individual possessing the genetic
variant will eventually develop thedisease, such as with Huntington’sdisease.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
A few commenters expressed support
for adopting the proposed definition of‘‘manifestation or manifested’’ because
it would provide clarity to the rule andthe scope of the underwritingprohibition. One commenter requested
that the Department include theexamples provided in the preamble tothe proposed rule directly within theregulatory definition. A few commentersraised concerns about the inclusion in
the proposed definition of theclarification that ‘‘a disease, disorder, or
pathological condition is not manifested
if the diagnosis is based principally on
genetic information.’’ It was argued thatthe proposed definition was too narrow
because, for some diseases, disorders, or
pathological conditions, a genetic test is
the primary means of diagnosing thecondition and further that genetic tests
will more frequently be used todiagnose diseases or conditions in the
future given the continuing evolution ofgenetics. It was also argued that the
proposed definition went beyond GINA
by indicating how a manifested diseaseor disorder is diagnosed.
Final Rule
The final rule adopts without
modification the definition of‘‘manifestation or manifested’’ proposedin the NPRM. The definition isconsistent with the definition of‘‘manifestation or manifested’’ found in
the implementing regulations for the
non-discrimination provisions ofsections 101–103 of GINA and withwhich compliance is already required
for most health plans. In developing thisdefinition, the agencies consulted withtechnical experts at the National Human
Genome Research Institute within the
National Institutes of Health (NIH). In
addition, for the reasons stated above
regarding the varying degrees of

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

predictive power genes provide in terms
of ultimate development of a disease, as
well as of the fact that a genetic test fora disease may precede clinical signs or
symptoms by years or even decades, theDepartment does not believe that thedefinition is too narrow but rather that
it is consistent with the provisions of
GINA that protect genetic informationfrom being used for health coveragedeterminations. Finally, the definition
does not preclude a health care provider
from performing one or more genetic
tests to confirm a diagnosis so long as
the diagnosis is not based solely or
principally on the result of the genetic
test.
To illustrate the definition, we
provide the following examples, whichwere also included in the NPRM:• An individual may have a family
member that has been diagnosed with
Huntington’s disease and also have agenetic test result that indicates thepresence of the Huntington’s diseasegene variant in the individual. However,when the individual is examined by aneurologist (a physician withappropriate training and expertise fordiagnosing Huntington’s disease)because the individual has begun tosuffer from occasional moodiness anddisorientation (symptoms which areassociated with Huntington’s disease),and the results of the examination do
not support a diagnosis of Huntington’sdisease, then Huntington’s disease is not
manifested with respect to theindividual. In contrast, if the individual
exhibits additional neurological andbehavioral symptoms, and the results ofthe examination support a diagnosis ofHuntington’s disease by the neurologist,
then Huntington’s disease is manifested
with respect to the individual.
• An individual has had several
family members with colon cancer, oneof whom underwent genetic testing
which detected a mutation in the MSH2
gene associated with hereditary
nonpolyposis colorectal cancer(HNPCC). On the recommendation ofhis physician (a health care professionalwith appropriate training and expertisein the field of medicine involved), theindividual undergoes a targeted genetic
test to look for the specific mutation
found in the family member of theindividual to determine if theindividual himself is at increased risk
for cancer. The genetic test shows thatthe individual also carries the mutation
but the individual’s colonoscopy
indicates no signs of disease and theindividual has no symptoms. Because
the individual has no signs or symptomsof colorectal cancer that could be usedby the individual’s physician to
diagnose the cancer, HNPCC is not a

PO 00000

Frm 00100

Fmt 4701

Sfmt 4700

manifested disease with respect to theindividual. In contrast, if the individual
undergoes a colonoscopy or othermedical tests that indicate the presenceof HNPCC, and the individual’s
physician makes a diagnosis of HNPCC,
HNPCC is a manifested disease withrespect to the individual.
• If a health care professional withappropriate expertise makes a diagnosis
based on the symptoms of the patient,and uses genetic tests to confirm thediagnosis, the disease will beconsidered manifested, despite the useof genetic information. For example, if
a neurologist sees a patient withuncontrolled movements, a loss ofintellectual faculties, and emotional
disturbances, and the neurologist
suspects the presence of Huntington’sdisease, the neurologist may confirm thediagnosis with a genetic test. While
genetic information is used as part ofthe diagnosis, the genetic information is
not the sole or principal basis for the
diagnosis, and, therefore, theHuntington’s disease would beconsidered a manifested disease of thepatient.
As with the definition of ‘‘genetic
test,’’ the Department declines toinclude these examples in the regulatory
text as this is inconsistent with theapproach generally taken in the HIPAA
Privacy Rule. The Department intends
to issue future guidance on its web sitewith respect to the Rule’s protections forgenetic information.
g. Definition of ‘‘Health Plan’’Proposed RuleThe Department proposed to maketechnical corrections to update thedefinition of ‘‘health plan’’ by revisingand renumbering the definition to:
Include specific reference to the
Voluntary Prescription Drug Benefit
Program under Part D of title XVIII of
the Social Security Act, 42 U.S.C.
1395w–101 through 1395w–152; remove
the specific reference to the Civilian
Health and Medical Program of the
Uniformed Services (CHAMPUS) (asdefined in 10 U.S.C. 1072(4)), as thisprogram is now part of the TRICARE
health care program under title 10 of theUnited States Code, and revise thereference to the title 10 health careprogram accordingly to read moregenerally ‘‘health care program for theuniformed services’’ rather than ‘‘healthcare program for active military
personnel’’; and reflect that Part C of
title XVIII of the Social Security Act, 42
U.S.C. 1395w–21 through 1395w–28, is
now called the Medicare Advantage
program.

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Overview of Public Comments
The Department did not receive any
comments on the proposed technicalcorrections to the definition of ‘‘healthplan.’’
Final Rule
The final rule incorporates thetechnical corrections to the definition.
4. Section 164.501—Definitions
The Department proposed to modify§ 164.501 to add a definition of‘‘underwriting purposes’’ and to makeconforming changes to the definitions of‘‘payment’’ and ‘‘health care
operations.’’sroberts on DSK5SPTVN1PROD witha. Definition of ‘‘Underwriting
Purposes’’
Proposed Rule
Section 105 of GINA provides that theterm ‘‘underwriting purposes’’ means,with respect to a group health plan,
health insurance coverage, or Medicare
supplemental policy: (A) Rules for, or
determination of, eligibility (including
enrollment and continued eligibility)
for, or determination of, benefits under
the plan, coverage, or policy; (B) thecomputation of premium orcontribution amounts under the plan,
coverage, or policy; (C) the applicationof any pre-existing condition exclusion
under the plan, coverage, or policy; and(D) other activities related to thecreation, renewal, or replacement of acontract of health insurance or healthbenefits.
The Department proposed to adopt
GINA’s statutory definition of‘‘underwriting purposes’’ in § 164.501 of
the Privacy Rule, but also proposed toinclude certain clarifications forconsistency with the regulations
promulgated to implement thenondiscrimination provisions in
sections 101 through 103 of GINA. In
particular, the Department proposed toinclude a parenthetical to explain thatthe rules for, or determination ofeligibility for, or determination of,benefits under the plan include changes
in deductibles or other cost-sharing
mechanisms in return for activities suchas completing a health risk assessment
or participating in a wellness program.
The proposed rule also included aparenthetical to make clear that thecomputation of premium orcontribution amounts under the plan,
coverage, or policy includes discounts,
rebates, payments in kind, or otherpremium differential mechanisms inreturn for activities such as completinga health risk assessment or participating
in a wellness program. Finally, we
proposed a provision within the

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

definition to clarify that ‘‘underwriting
purposes’’ does not include
determinations of medical
appropriateness where an individual
seeks a benefit under the plan, coverage,or policy.
Overview of Public Comments
About ten commenters addressed the
proposed definition of ‘‘underwriting
purposes.’’ Four commenters generally
supported the proposed definition.
Other commenters expressed concern
with the definition’s inclusion of
discounts, rebates, payments in kind, orother premium differential mechanisms
in return for activities such ascompleting a health risk assessment(HRA) or participating in a wellness
program. These commenters wereconcerned that prohibiting the use ofgenetic information, particularly family
health history, for such purposes would
have a detrimental impact on wellness
and disease management programs. One
commenter was concerned that thedefinition would prohibit dental
insurance plans from offering
preventive prognostic features toenrollees as part of the plan that test forsusceptibility to dental decay andperiodontal diseases. Enrollees that test
positive would be provided withadditional plan benefits as a supplement
to the standard benefits to cover moreaggressive preventive services. Finally, a
few commenters were concerned thatthe broad definition of ‘‘underwriting
purposes’’ would preclude plans fromusing HRAs and offering wellness
programs even if no genetic informationis requested or used. For example, onecommenter was concerned that thedefinition would prohibit the use of‘‘personal habit’’ information, such as
information about smoking, or alcoholor drug use.
Final Rule
The final rule adopts the proposed
definition of ‘‘underwriting purposes’’
but moves the definition to within theunderwriting prohibition at§ 164.502(a)(5)(i). This makes clear thatthe definition applies only for purposesof the prohibition on a health plan’s use
or disclosure of genetic information forunderwriting purposes. As discussed
more fully below with respect to thedefinition of ‘‘health care operations,’’
we move the definition of‘‘underwriting purposes’’ and retain theterm ‘‘underwriting’’ within thedefinition of ‘‘health care operations’’ inresponse to several public comments
expressing concern that the proposed
rule would no longer allow health plans
to use or disclose any protected health

PO 00000

Frm 00101

Fmt 4701

Sfmt 4700

5665

information (i.e., even non-genetic
information) for underwriting.
The adopted definition is consistent
with the definition promulgated in theinterim final regulations to implement
sections 101–103 of GINA and withwhich compliance is already requiredby most health plans. We decline to
exclude wellness programs and the useof HRAs from the definition because, as
discussed in the interim final
regulations issued by DOL, Treasury,and HHS, GINA Title I does not include
an exception for wellness programs.20
However, we emphasize that healthplans may continue to provide
incentives for completing HRAs andparticipating in wellness programs inmanners that do not involve the use or
disclosure of genetic information. For
example, ‘‘personal habit’’ information
about an individual, such as smoking
status and alcohol and drug use, is not
genetic information and thus, may be
used by health plans for underwriting
purposes. Further, DOL has issued
guidance which makes clear that healthplans may continue to collect family
health history through the use of HRAs
that are not tied to any reward.21
In addition, the definition of‘‘underwriting purposes’’ includes an
exception for determinations of medical
appropriateness where an individual
seeks a benefit under the plan, coverage,or policy. Thus, to the extent that anindividual is seeking a particular benefit
under the plan and the health planneeds genetic information to determine
the medical appropriateness ofproviding the benefit to the individual,
the plan may use or disclose theminimum necessary genetic information
to determine the medical
appropriateness of providing thebenefit. For example, if a health plan
covers yearly mammograms forindividuals under age 40 only in cases
where the individual can demonstrate
she is at increased risk for breast cancer,
the plan can ask an individual underage 40 to provide the results of a genetic
test or family health history and use
such information to determine medical
appropriateness prior to paying a claim
for the mammogram. The medical
appropriateness exception would also
cover situations where a dental planrequires the results of a genetic test
prior to offering a supplemental benefit
for more aggressive preventive services
to the extent the individual seeks sucha benefit. For example, a dental plan
may provide information to all of its
enrollees about how to take advantage of
20 See 74 FR 51669, footnote 12.
21 See Q14 at http://www.dol.gov/ebsa/faqs/faqGINA.html.

E:\FR\FM\25JAR2.SGM

25JAR2

5666

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

such a benefit, and when an enrollee
contacts the plan about obtaining thebenefit, may require the individual totake and provide the results of a genetic
test to determine the medical
appropriateness of providing the
supplemental benefit to the individual.
b. Definition of ‘‘Health Care
Operations’’
Proposed Rule
The definition of ‘‘health care
operations’’ at § 164.501 includes atparagraph (3) ‘‘underwriting, premium
rating, and other activities relating to
the creation, renewal or replacement of
a contract of health insurance or
benefits * * *.’’ To avoid confusion
with the use of both ‘‘underwriting’’ and‘‘underwriting purposes’’ in the Privacy
Rule, and in recognition of the fact thatthe proposed definition of‘‘underwriting purposes’’ includes
activities that fall within both thedefinitions of ‘‘payment’’ and ‘‘healthcare operations’’ in the Rule, theDepartment proposed to remove theterm ‘‘underwriting’’ from the definitionof ‘‘health care operations.’’ We also
proposed to add the term ‘‘enrollment’’to the express list of health care
operations activities to make clear thatthe removal of the term ‘‘underwriting’’
would not impact the use or disclosureof protected health information that is
not genetic information for enrollment
purposes. These proposed revisions
were not intended to be substantive
changes to the definition and thus,
health plans would be permitted tocontinue to use or disclose protected
health information, except genetic
information, for underwriting purposes.

sroberts on DSK5SPTVN1PROD with

Overview of Public Comments
The Department received a few
comments on the proposed revisions to
the definition of ‘‘health care
operations.’’ One commenter supported
the inclusion of the word ‘‘enrollment.’’
A few commenters, however, expressed
concern and confusion that the removalof the term ‘‘underwriting’’ from thedefinition of ‘‘health care operations’’
would no longer permit uses ordisclosures of even non-genetic
protected health information forunderwriting.
Final Rule
Due to the confusion and concern
expressed by the commenters regarding
the removal of the term ‘‘underwriting’’
from the definition, we retain the term‘‘underwriting’’ within the definition of‘‘health care operations’’ at § 164.501
However, to make clear that a healthplan may continue to use or disclose
only protected health information that is

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

not genetic information forunderwriting, we include a reference tothe prohibition on using or disclosing
genetic information for underwriting
purposes within the definition. The
final rule also retains the term‘‘enrollment’’ within the definition
because we believe it is helpful toclarify that this is a permitted healthcare operations activity.
c. Definition of ‘‘Payment’’
Proposed Rule
The definition of ‘‘payment’’ in the
Privacy Rule at § 164.501 includes
activities, such as ‘‘determinations ofeligibility or coverage’’ by a health plan,some of which may fall within thedefinition of ‘‘underwriting purposes.’’
To avoid any implication that a healthplan would be permitted to use or
disclose protected health informationfor ‘‘payment’’ purposes that areotherwise prohibited by theunderwriting prohibition, we proposed
to include a cross-reference in thedefinition of ‘‘payment’’ to theprohibition. Further, we believed theinclusion of such a cross-reference to benecessary to properly align thedefinition of ‘‘payment’’ in the Privacy
Rule with the nondiscrimination
provisions of GINA Title I and theirimplementing regulations. GINA
provides a rule of construction at
section 102(a)(2), which adds paragraph2702(c)(3) of the PHSA, to make clearthat health plans are not prohibitedfrom obtaining and using the results ofa genetic test in making determinations
regarding payment, as such term isdefined by the HIPAA Privacy Rule.
Thus, the proposed exception would
make clear that GINA’s rule ofconstruction regarding payment does
not allow a health plan to use the resultsof genetic tests for activities that would
otherwise constitute ‘‘underwriting
purposes,’’ such as for determinations ofeligibility for benefits.
Overview of Public Comments
The Department received twocomments on the proposed change tothe definition of ‘‘payment,’’ one
supporting the change and one
indicating it is unnecessary.
Final Rule
For the reasons described above, thefinal rule adopts the proposed change tothe definition of ‘‘payment.’’

PO 00000

Frm 00102

Fmt 4701

Sfmt 4700

5. Section 164.502(a)—Uses andDisclosures of Protected Health
Information: General Rulesa. Prohibition
Proposed Rule
To implement section 105 of GINA,
the Department proposed a newprohibition on health plans using or
disclosing protected health informationthat is genetic information forunderwriting purposes at§ 164.502(a)(3). We made clear that sucha provision would operate
notwithstanding the other provisions in
the Privacy Rule permitting uses anddisclosures, and proposed a conforming
change to § 164.502(a)(1)(iv) to clarify
further that an authorization could not
be used to permit a use or disclosure ofgenetic information for underwriting
purposes.
Overview of Public Comments
Some commenters expressly
supported the proposed modification to
the Privacy Rule to include theprohibition, and the proposed
clarification that an authorization
cannot be used to otherwise permit aprohibited use or disclosure of genetic
information. One commenter suggested
adding the examples from the preamble
to the regulatory text, as well as
language to the regulatory text to clarify
that the prohibition applies to genetic
information obtained by a health planprior to the passage of GINA.
Final Rule
The final rule adopts the proposedprohibition on a health plan’s use or
disclosure of genetic information forunderwriting purposes, except withregard to health plans that are issuers oflong term care policies, as explained
above in section VI.C.1 regarding towhich plans the final rule applies. This
prohibition, located in this final rule at§ 164.502(a)(5), applies to all genetic
information from the compliance date ofthese modifications forward, regardlessof when or where the genetic
information originated. We do notbelieve a clarification of this fact in theregulatory text is necessary.
Consistent with Sec. 101(a) of thestatute, this prohibition should not be
construed to limit the ability of a healthplan to adjust premiums or contribution
amounts for a group health plan basedon the manifestation of a disease ordisorder of an individual enrolled in theplan, even though a health plan cannot
use the manifestation of a disease ordisorder in one individual as genetic
information about other group members
and to further increase the premium forthe plan. Similarly, for the individual

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
health insurance market, a health plan
is not prohibited from establishing rules
for eligibility for an individual to enroll
in coverage or from adjusting premiumor contribution amounts for anindividual based on the manifestation ofa disease or disorder in that individual
or in a family member of suchindividual where such family member iscovered under the individual’s policy,
even though the health plan cannot use
the manifestation of a disease ordisorder in one individual as genetic
information about other individuals tofurther increase premiums orcontribution amounts for those otherindividuals.
To illustrate how the prohibition
operates, we reiterate the following
examples (but for the reasons explained
above, decline to include them in theregulatory text). If a health insurance
issuer, with respect to an employersponsored group health plan, uses anindividual’s family medical history or
the results of genetic tests maintained in
the group health plan’s claims
experience information to adjust theplan’s blended, aggregate premium rate
for the upcoming year, the issuer would
be using protected health informationthat is genetic information forunderwriting purposes in violation of§ 164.502(a)(5)(i). Similarly, if a grouphealth plan uses family medical history
provided by an individual incidental tothe collection of other information on ahealth risk assessment to grant a
premium reduction to the individual,
the group health plan would be using
genetic information for underwriting
purposes in violation of§ 164.502(a)(5)(i).
The prohibition is limited to healthplans. A health care provider may use
or disclose genetic information as it sees
fit for treatment of an individual. If a
covered entity, such as an HMO, acts asboth a health plan and health careprovider, it may use genetic information
for purposes of treatment, to determine
the medical appropriateness of a benefit,
and as otherwise permitted by thePrivacy Rule, but may not use suchgenetic information for underwriting
purposes. Such covered entities, inparticular, should ensure thatappropriate staff members are trained on
the permissible and impermissible usesof genetic information.

sroberts on DSK5SPTVN1PROD with

6. Section 164.504(f)(1)(ii)—
Requirements for Group Health Plans
Proposed Rule
Section 164.504(f)(1)(ii) permits agroup health plan, or health insurance
issuer or HMO with respect to the grouphealth plan, to disclose summary health

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

information to the plan sponsor if theplan sponsor requests the information
for the purpose of obtaining premium
bids from health plans for providing
health insurance coverage under thegroup health plan, or for modifying,amending, or terminating the grouphealth plan. As this provision permits
activities that constitute ‘‘underwriting
purposes,’’ as defined by GINA and the
proposed rule, the Department proposed
to modify § 164.504(f)(1)(ii) to clarify
that § 164.504(f)(1)(ii) would not allow a
disclosure of protected healthinformation that is otherwise prohibitedby the underwriting prohibition.
Overview of Public Comments
The Department received one
comment in support of thismodification.
Final Rule
The final rule adopts the modificationto § 164.504(f)(1)(ii).
7. Section 164.506—Uses andDisclosures To Carry Out Treatment,
Payment, or Health Care Operations
Proposed Rule
Section 164.506(a) of the Privacy Rulesets out the uses and disclosures acovered entity is permitted to make tocarry out treatment, payment, or healthcare operations. In light of the fact thatthe proposed definition of‘‘underwriting purposes’’ encompasses
activities that fall both within thedefinitions of ‘‘payment’’ and ‘‘healthcare operations’’ under the Privacy Rule,the Department proposed to add a crossreference in § 164.506(a) to the newunderwriting prohibition to make clearthat § 164.506 of the Privacy Rule would
not permit health plans to use or
disclose an individual’s protected
health information that is genetic
information for underwriting, eventhough such a use or disclosure isconsidered payment or health care
operations.
Overview of Public Comments
The Department received one
comment in support of thismodification.
Final Rule
The final rule adopts the modificationto § 164.506(a).
8. Section 164.514(g)—Uses andDisclosures for Activities Relating to theCreation, Renewal, or Replacement of aContract of Health Insurance or Health
Benefits
Proposed Rule
Section 164.514(g) of the Privacy Rule
prohibits a health plan that receives

PO 00000

Frm 00103

Fmt 4701

Sfmt 4700

5667

protected health information forunderwriting, premium rating, or otheractivities relating to the creation,
renewal, or replacement of a contract for
health insurance or health benefits, fromusing or disclosing such protected
health information for any otherpurpose (except as required by law) if
the health insurance or health benefits
are not placed with the health plan. The
Department proposed conforming
amendments to § 164.514(g) to: (1)Remove the term ‘‘underwriting’’ toavoid confusion given the new
definition of ‘‘underwriting purposes,’’which encompasses the activities
described above; and (2) make clear thata health plan that receives protected
health information that is genetic
information for the above purposes is
not permitted to use or disclose suchinformation for underwriting purposes.
The proposed removal of the term‘‘underwriting’’ from § 164.514(g) was
not intended as a substantive change tothe scope of the provision.
Overview of Public Comments
One commenter suggested that the
Department reconsider the removal of
the term ‘‘underwriting’’ from thissection as it could be viewed as a
substantive change to the scope of theprovision, and expressed concern thatthe modification would prohibit ahealth plan from using or disclosing
genetic information as required by otherlaw.
Final Rule
The final rule modifies § 164.514(g) torefer to the prohibition, now at§ 164.502(a)(5). However, as with thedefinition of ‘‘health care operations,’’
we do not remove the term‘‘underwriting’’ to avoid unnecessary
confusion. We also clarify that a healthplan may continue to use or disclose
protected health information that is
genetic information as required by otherlaw, except to the extent doing so would
be inconsistent with the prohibition in
GINA and this final rule at§ 164.502(a)(5)(i) against using or
disclosing genetic information forunderwriting purposes.
9. Section 164.520—Notice of Privacy
Practices for Protected Health
Information
Proposed Rule
As discussed above in Section IV withregard to the changes made to § 164.520
pursuant to the HITECH Act, § 164.520of the Privacy Rule sets out therequirements for most covered entities
to have and distribute a Notice ofPrivacy Practices (NPP). With respect to
the NPP, the Department believes that

E:\FR\FM\25JAR2.SGM

25JAR2

5668

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withindividuals should be informed of their
new rights and protections under thisrule with respect to genetic informationin the health coverage context. Thus, theDepartment proposed in§ 164.520(b)(1)(iii)(D) to require healthplans that use or disclose protected
health information for underwriting toinclude a statement in their NPP thatthey are prohibited from using or
disclosing protected health informationthat is genetic information about anindividual for such purposes. Without
such a specific statement, individuals
would not be aware of this restriction
and the general statements regarding
permitted uses and disclosures fortreatment, payment, and health care
operations in the NPP of a health planthat performs underwriting would not
be accurate (i.e., the NPP would statethat the health plan may use or disclose
PHI for purposes of payment and healthcare operations, which would not betrue with respect to genetic information
when the use or disclosure is forunderwriting purposes).
The preamble explained that the
proposed prohibition on using or
disclosing genetic information forunderwriting and the proposed
requirement to explicitly include astatement regarding the prohibition
would represent a material change to
the NPP of health plans that perform
underwriting, and the Privacy Rulerequires at § 164.520(c)(1)(i)(C) thatplans provide notice to individuals
covered by the plan within 60 days ofany material revision to the NPP. As in
the NPRM issued to implement HITECH
Act provisions, the Department
requested comment on ways to inform
individuals of this change to privacy
practices without unduly burdening
health plans and provided several
possible alternatives. The Department
also explained that the obligation torevise the NPP for the reasons describedabove would fall only on health plansthat intend to use or disclose protected
health information for activities that
constitute ‘‘underwriting purposes.’’Thus, health care providers, as well as
health plans that do not perform
underwriting, would not be required torevise their NPPs.
Overview of Public Comments
One commenter supported informing
individuals in the NPP that health plans
are prohibited from using or disclosing
genetic information for underwriting
purposes. One commenter asked theDepartment to clarify that where ahealth plan has already made a change
to the NPP to comply with a statute,such as with GINA, and has sent therevised NPP to members, the health

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

plan would not be required to makeanother change to its NPP to comply
with the regulation.
A number of comments addressed theissue of the timing and manner of
distributing revised NPPs. In general,commenters recommended various
alternatives, including: (1) Require
health plans to provide a revised NPP tomembers in the next annual mailing; (2)require health plans to provide either arevised NPP or a supplement tomembers in the next annual mailing andto post the revised NPP or supplementon the health plan Web site
immediately; (3) retain the existing 60day deadline for providing a revised
NPP to individuals or provide for a 30day extension; and (4) allow for
distribution via electronic processes formore efficient delivery of NPPs tomembers.
Final Rule
The final rule adopts the requirement
for health plans that perform
underwriting to include in their NPPs astatement that they are prohibited fromusing or disclosing genetic information
for such purposes, except with regard toissuers of long term care policies, which
are not subject to the underwritingprohibition. Health plans that havealready modified and redistributed their
NPPs to reflect the statutory prohibition
are not required to do so again, provided
the changes to the NPP are consistent
with this rule. We also modify the NPP
distribution requirements for healthplans where there are material changes.
These modifications are discussed
above in Section IV with regard tomaterial changes to the NPP resulting
from changes pursuant to the HITECH
Act.
10. Other Comments
Comment: One commenter requested
clarification on preemption with regard
to the new underwriting prohibition.
Response: Pursuant to subpart B ofPart 160 of the HIPAA Administrative
Simplification Rules, to the extent thata provision of State law requires a use
or disclosure of genetic information for
an activity that would otherwise
constitute ‘‘underwriting purposes,’’such State law would be preempted by
the Privacy Rule unless an exception at§ 160.203 applies. In contrast, State lawsthat provide greater privacy protection
for genetic information than the Privacy
Rule continue to remain in place.
Comment: One commenter asked how
a health care provider should ensurethat releasing an individual’s
information to a health plan will not
result in an inappropriate disclosure to
the health plan for underwriting

PO 00000

Frm 00104

Fmt 4701

Sfmt 4700

purposes. This commenter also asked
what the rules are for access toprotected health information about anindividual by the individual’s extended
family members seeking to determine ifthey are affected by a genetic trait.
Response: With respect to the firstquestion, these rules do not apply tohealth care providers. A covered healthprovider may continue to disclose
protected health information, including
genetic information, where doing someets the minimum necessary standard,to health plans for payment purposes.
Under this Rule, the onus is on thehealth plan to not use or disclose
protected health information it receives
for such purposes for prohibited
underwriting purposes. Further, healthplans continue to be required by thePrivacy Rule to limit requests ofprotected health information to theminimum necessary when requestingsuch information from other covered
entities. The regulations implementing
sections 101–103 of GINA also restrict
the ability of health plans covered bythose rules to request genetic
information.
With respect to the second question,
to the extent that an individual’s genetic
information is needed for the treatment
purposes of a family member, a covered
health care provider is permitted todisclose such information, subject toany agreed-upon restriction, to anotherprovider for the treatment of the family
member. See FAQ #512 at http://
www.hhs.gov/ocr/privacy/hipaa/faq/
right_to_request_a_restriction/512.html,
which makes clear that a health careprovider may share genetic information
about an individual with providers
treating family members of theindividual who are seeking to identify
their own genetic health risks, provided
the individual has not requested and thehealth care provider has not agreed to a
restriction on such disclosure.
Comment: One commenter requested
that the rule require that health plans
conducting or sponsoring research
involving genetic information provide
research participants with an explicit
statement to ensure the individuals
understand that such information may
not and will not be used forunderwriting purposes.
Response: We decline to require sucha statement. The regulations
implementing sections 101–103 of GINA
already require a statement to that effectas a condition of the health plan
requesting that a research participant
undergo a genetic test as part of theresearch. See, e.g., 45 CFR 144.122(c)(5).
Further, this rule requires that healthplans that perform underwriting inform
individuals through their NPPs that the

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
plans may not use or disclose genetic
information for such purposes.
Comment: One commenter asked thatthe HIPAA de-identification standard bestrengthened to provide better
protection for health information,
including genetic information.
Response: The Privacy Rule’s deidentification standard is outside thescope of this rulemaking.
VII. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact
statement in compliance with Executive
Order 12866 (September 1993,
Regulatory Planning and Review),
Executive Order 13563 (January 2011,
Improving Regulation and Regulatory
Review), the Regulatory Flexibility Act(RFA) (September 19, 1980, Pub. L. 96–354), the Unfunded Mandates ReformAct of 1995 (UMRA) (March 22, 1995,
Pub. L. 104–4), and Executive Order13132 on Federalism. We begin with a
discussion of Executive Orders 12866
and 13563 and then present a moredetailed analysis of costs and benefits.
Finally, relying on information
explained in the cost-benefit analysis,
we discuss issues related to the RFA,
UMRA, and Federalism considerations.

sroberts on DSK5SPTVN1PROD with

1. Executive Order 12866 and Executive
Order 13563
Executive Orders 12866 and 13563
direct agencies to assess all costs andbenefits of available regulatory
alternatives and, if regulation isnecessary, to select regulatory
approaches that maximize net benefits(including potential economic,
environmental, public health and safety
effects, distributive impacts, andequity). Executive Order 13563
emphasizes the importance ofquantifying both costs and benefits, ofreducing costs, of harmonizing rules,
and of promoting flexibility. A
regulatory impact analysis must be
prepared for major rules that haveeconomically significant effects ($100
million or more in any one year) or
adversely affect in a material way the
economy, a sector of the economy,
productivity, competition, jobs, theenvironment, public health or safety, orState, local, or Tribal government orcommunities (58 FR 51741). Based on
the following analysis, this rule has
been designated as an economicallysignificant regulatory action within themeaning of section 3(f)(4) of Executive
Order 12866. Accordingly, the rule has
been reviewed by the Office ofManagement and Budget.
To summarize, we estimate that therule will result in new first-year costs of

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

between $114 million and $225.4
million. Annualizing the midpoints ofour cost estimates at three and sevenpercent over ten years produces costs of$35.2 million and $42.8 million,
respectively.22
We estimate that the effects of therequirement for covered entities(including indirect costs incurred bythird party administrators, which
frequently send out notices on behalf ofhealth plans) to issue new notices ofprivacy practices, as a result of the final
changes to the HIPAA Privacy Ruleunder both the HITECH Act and GINA,
will result in new costs of $55.9 million
within 12 months of the effective dateof the final rule. Annualizing the costs
over 10 years at 3 percent and 7 percent
results in annual NPP costs ofapproximately $6.6 million and $8
million, respectively. We have revised
our cost estimate for NPP revisions
since the proposed rule to reflect theincreased flexibility provided in the
final rule, which allows health plans toinclude their new NPPs in their usual,annual mailing rather than send them toindividuals in a separate mailing. We
also note that combining GINA andHITECH requirements into a single rule
results in lower costs than would beincurred if covered entities wererequired to revise their NPPs multiple
times to comply with separate
rulemakings.
Additionally, we have revised theannual estimated cost to comply withthe final breach notification provisions.
As we discuss below, we acknowledge
there may still be some underreportingof breaches, however we do anticipate
that the overall number of breaches will
decrease in the future. As such, Table 2
below shows the costs of complying
with the provisions of the breach
notification final rule, which have beenrevised based on our experience with
the number of breach notifications wehave received from covered entities
during calendar years 2010 and 2011.
We estimate the total annual cost for thebreach notification rule to beapproximately $14.5 million.
Annualizing over 10 years at 3% and
7% produces annual breach
implementation costs of approximately$17 million and $20.6 million.
With regard to the business associateprovisions of the final rule, we assume
that business associates currently
comply with the HIPAA Privacy Rule
22 The breach notification provisions are therule’s only source of ongoing, annual costs.
Therefore, with respect to breach, we annualize
costs incurred on an annual basis. For the otherprovisions, we calculate annualized opportunity
costs based on costs expended only in the first yearof implementation.

PO 00000

Frm 00105

Fmt 4701

Sfmt 4700

5669

use and disclosure provisions as
required by their business associate
contracts. However, with regard to the
Security Rule, while we continue tobelieve that most business associates
have implemented security protections
that meet the Security Rulerequirements as part of the assurances
provided to covered entities throughtheir contracts, we recognize that somesmaller or less sophisticated businessassociates may not have engaged in theformal administrative safeguards
required by the HIPAA Security Rule,and may not have written policies andprocedures for compliance. For thesebusiness associates, we estimate that thecosts to come into compliance with the
Security Rule will be between
approximately $22.6 million and $113
million. Annualizing the midpoint
estimate ($67.8 million) at 3 percent and7 percent produces costs of $7.9 million
and $9.7 million, respectively.
Although we also continue to believethat most business associates have madea good faith attempt to conform theiragreements with subcontractors to
HIPAA requirements, we acknowledge
the possibility that some businessassociates may make such efforts for the
first time now that they and theirsubcontractors are subject to direct
liability under the Rules. For thisfraction of business associates, weestimate that the costs to bring
subcontracts into compliance with thebusiness associate agreement
requirements will be between $21
million and $42 million. Annualizing
the midpoint of those estimates ($31.5
million) at 3 percent and 7 percent
results in costs of $3.7 million and $4.5
million, respectively.
There may be other costs we are notable to monetize because we lack data,
and the rule may produce savings that
may offset some or all of the added
costs. We discuss these unquantified
costs and benefits of the rule at the endof the Regulatory Impact Analysis.
As a result of the economic impact,and other costs that are described but
not quantified in the regulatory analysis
below, OMB has determined that thisrule is an economically significant
regulatory action within the meaning ofsection 3(f)(4) of Executive Order 12866.
We present our analysis of the costs andbenefits of the rule in sections C and D
below.
2. Entities Subject to the Rule
This rule impacts covered health careproviders, health insurance issuers, andthird party administrators acting on
behalf of health plans, which weestimate to total 698,238 entities. The
rule also applies to approximately 1–2

E:\FR\FM\25JAR2.SGM

25JAR2

5670

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

million business associates and an
unknown number of subcontractors.23

Table 1 below shows the number ofcovered entities by class of provider andinsurer that will be affected by the Rule.

TABLE 1—NUMBER OF COVERED ENTITIES BY NAICS CODE 24
Providers/suppliers

622 ...................................................................................

Hospitals (General Medical and Surgical, Psychiatric, Substance Abuse, Other Specialty).
Nursing Facilities (Nursing Care Facilities,
Residential Mental Retardation Facilities,
Residential Mental Health and Substance
Abuse Facilities, Community Care Facilities
for the Elderly, Continuing Care Retirement
Communities).
Office of MDs, DOs, Mental Health Practitioners, Dentists, PT, OT, ST, Audiologists.
Outpatient Care Centers (Family Planning
Centers, Outpatient Mental Health and Drug
Abuse Centers, Other Outpatient HealthCenters, HMO Medical Centers, Kidney Dialysis Centers, Freestanding Ambulatory
Surgical and Emergency Centers, All Other
Outpatient Care Centers).
Medical Diagnostic, and Imaging Service Covered Entities.
Home Health Service Covered Entities ............
Other Ambulatory Care Service Covered Entities (Ambulance and Other).
Durable Medical Equipment Suppliers 26 ..........
Pharmacies 27 ...................................................
Health Insurance Carriers 28 .............................
Third Party Administrators Working on Behalfof Covered Health Plans 29.

623 ...................................................................................

6211–6213 .......................................................................
6214 .................................................................................

6215 .................................................................................
6216 .................................................................................
6219 .................................................................................
N/A ...................................................................................
4611 .................................................................................
524114 .............................................................................
524292 .............................................................................
Total Entities .............................................................

B. Why is this rule needed?
This final rule is needed to strengthen
and expand the privacy and security
protections for individuals’ healthinformation and privacy rights
established under the HIPAA, as
mandated by the HITECH Act and
GINA. These enhancements arenecessary to ensure continued adequate
protections for health information, as
well as trust in the health care system,
particularly as the adoption and use ofelectronic health records increases.
Importantly, among other changes, therule makes business associates ofcovered entities directly liable forFederal penalties for failures to comply
with certain provisions of the rule. This
expansion in liability closes a large gap
in protection that existed prior to thesesroberts on DSK5SPTVN1PROD with

Number ofentities

NAICS

23 Although we do not have data on the numbersof business associates, our enforcement experienceleads us to believe that each covered entity has, on
average, two to three business associates, for a totalof 1–2 million business associates. This number
likely overestimates the number of businessassociates, as some entities may be businessassociates to multiple covered entities. We do not

VerDate Mar<15>2010

20:19 Jan 24, 2013

Jkt 229001...........................................................................

Estimated
number of small
entities 25

4,060

4,060

34,40034,400419,286

419,286

13,962

13,962

7,879

7,879

15,3295,879

15,3295,879

107,567
88,396730
750

107,567
88,396276
750

698,238

697,784

modifications with respect to businessassociates, which are the cause of manyof the security breaches for which the
Department receives breach reports.
The final rule also lays out standards
for when individuals and the Secretarymust be informed that a breach ofprotected health information has
occurred so that individuals may takemeasures to protect themselves fromrisks associated with the breach. By
establishing requirements for notifying
individuals and making businessassociates directly liable for complying
with certain provisions of the Privacy
and Security rules, we expect the
number of breaches of protected healthinformation to decline over time.
This final rule also makes changes tothe HIPAA rules, such as those thatstreamline the research authorization
process, that are designed to increase

flexibility for, and decrease burden on,
the regulated entities, as well as toharmonize certain requirements withthose under the Department’s Human
Subjects Protections regulations.

have a basis for estimating the number ofsubcontractors that will be subject to the rule.
24 Office of Advocacy, SBA, http://www.sba.gov/
advo/research/data.html.
25 Because the vast majority of covered providers
are small entities, we include all providers in ourestimates of small providers.
26 Centers for Medicare & Medicaid Services
covered entities.

27 The Chain Pharmacy Industry http://
www.nacds.org/wmspage.cfm?parm1=507.
28 Source: HHS ASPE analysis of 2010 NAIC
Supplemental Health Care Exhibit data.
29 We include third party administrators in ourcount of covered entities, although they arebusiness associates, because the nature of theirrepresentation of the majority of ERISA plans makes
them an appropriate ‘‘surrogate’’ for those plans.

PO 00000

Frm 00106

Fmt 4701

Sfmt 4700

C. Costs
1. Breach Notification Costs
The preamble to the interim final rule
published on August 24, 2009,
contained a regulatory impact statement
estimating the economic burden of
implementing the rule. We are revisingthat impact statement in this final rule
based upon our experience withcollecting breach notifications fromcovered entities during calendar years
2010 and 2011.
The analysis that follows is very
similar to the analysis set forth in thepreamble to the interim final rule;
however, instead of using information

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
from http://www.datalossdb.org toestimate the number of breaches thatwould occur each year, we have used
the breach notifications provided to theSecretary during calendar years 2010
and 2011 to project the ongoing, annual
costs to covered entities for
implementing the breach notification
provisions. Several commenters notedthat significantly more breaches would
occur each year than the interim final
rule anticipated, and we acknowledge
that the estimates provided in theinterim final rule were significantly
lower than our experience has been todate. As such, we believe that relying on
our experience receiving notifications
addresses the concerns of thecommenters who thought we were
underestimating the number of breaches
that would occur each year. Based uponthis information, we have revised the
projected annual cost to implement
these breach notification provisions.

We acknowledge that there may still
be some underreporting of breaches as
the obligations of the regulation may not
yet have penetrated down to all covered
entities and business associates. At thesame time, we expect that some types ofincidents being reported today may notin the future as covered entities andbusiness associates become morefamiliar with the definition of breachand more adept at performing risk
assessments and determining whether abreach has occurred. We have received
breach notifications from covered
entities in several situations in which
notification was not necessary, such aswhere there was no underlying
impermissible use or disclosure under
the Privacy Rule or where one of the
exceptions to breach clearly applied tothe situation. This is the type of overreporting that we expect to diminish in
the future. Additionally, covered
entities and business associates are

5671

beginning to recognize areas of potential
weakness and to take systemic actions
to prevent breaches from occurring in
the future, such as encrypting portabledevices to avoid having to provide
breach notifications in the event thedevice is lost or stolen.
Table 2 shows the costs of theprovisions of the final rule based on thebreach notifications we have received
from covered entities during calendar
years 2010 and 2011. We also present
the costs required for investigating
breaches and the amount of time weanticipate individuals will spend calling
the toll-free number for substitutenotice. We estimate the total cost for thebreach notification rule to beapproximately $14.5 million.
Discounting at 3 percent and 7 percent
and annualizing over 10 years results incosts of $17 million and $20.6 million,
respectively.

TABLE 2—SUMMARY OF ANNUAL COMPLIANCE COST FOR BREACH NOTIFICATION IN 2011 DOLLARS
Number ofaffected
individuals

Number of
breaches

Cost elements

Cost/breach

Cost/affectedindividuals

Cost

E-mail and 1st Class Mail ....................................................
Substitute Notices: Media Notice .........................................
Substitute Notices: Toll-Free Number .................................
Imputed cost to affected individuals who call the toll-freeline ....................................................................................
Notice to Media of Breach: Over 500 ..................................
Report to the Secretary: 500 or More .................................
Investigation Costs: Under 500 ...........................................
Investigation Costs: 500 or More .........................................
Annual Report to the Secretary: Under 500 ........................

19,0001,190
1,190

6,710,000
6,605,500
30 660,550

$182
480
1,526

$0.5170.086
2.750$3,467,122
571,200
1,816,379

1,190
250
250
18,750250
18,750660,550
6,600,000
6,600,000
324,050
6,600,000
110,000

1,725
62
62
281
3,350
23

3.108
0.002
0.002
16.29
0.127
3.84

2,052,665
15,42015,4205,277,456
837,500
422,438

Total Cost .....................................................................

........................

........................

........................

........................

14,475,600

30 As we explain below in the section on substitute notice, we project that 6,605,500 individuals will be affected by breaches that may require
substitute notice, but we expect that at most 10% of affected individuals will call the toll-free line for information.

sroberts on DSK5SPTVN1PROD withIn this revised analysis, we rely
entirely on our experience with breach
notifications received by the Secretaryduring calendar years 2010 and 2011,
for projecting the ongoing, annual costsof the breach notification rule. Based on
our experience in those years, we
project the likely number of breaches,
number of affected individuals, andcosts associated with this regulation. We
have not attempted to predict future
costs because, as discussed above, while
we anticipate the overall number ofbreaches and the overall costs ofimplementing the breach notification
provisions to fall over time, we do notcurrently have enough data to establish
such a trend.
Affected Entities
The entities affected by the breach
notification regulation are outlined in
the impact statement of the interim final

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

rule. HIPAA covered entities and theirbusiness associates must comply withthese regulations. We estimate thatapproximately 700,000 HIPAA covered
entities will be subject to the final rule,
although many fewer will experience a
breach requiring them to fulfill thebreach notification requirements.
How many breaches will require
notification?
Although this final rule modifies thedefinition of breach at § 164.402 toremove the harm standard, we do notbelieve that this will have a significant
effect on the number of breaches
reported to HHS or on the number ofindividuals affected. As discussed in
Section V above, this final rule removes
the harm standard and implements a
more objective risk assessment forevaluating whether an impermissible
use or disclosure is a breach. As a result,

PO 00000

Frm 00107

Fmt 4701

Sfmt 4700

covered entities must still perform a risk
assessment following an impermissible
use or disclosure of protected healthinformation to determine the probability
that the protected health information
has been compromised. Events such as
hacking into an unencrypted database
and theft of unsecured protected healthinformation would in almost all cases
constitute a breach in this final rule, justas they would under the interim final
rule’s definition of breach. However,given the further clarity in this rule as
to the standard and factors to beconsidered, other incidents that may nothave been considered a breach under
the interim final rule may be considereda breach under this final rule (or insome cases, vice versa).
Instead of relying on data fromhttp://www.datalossdb.org to estimate
the number of breaches and the numberof individuals affected by such breaches

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5672

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

each year, this final rule uses breach
notification reports submitted to theSecretary by covered entities to revise
our previous estimates. We believe thesereports provide us with much more
complete information from which toproject the overall cost of implementing
this regulation.
Beginning September 23, 2009,
covered entities were obligated to notify
the Secretary of all breaches of protected
health information occurring on or afterthat date. As of September 23, 2009,
covered entities must report breaches
affecting 500 or more individuals to theSecretary without unreasonable delay
and in no case later than 60 days fromdiscovery of the breach, while breaches
affecting fewer individuals must bereported to the Secretary within 60 daysof the end of the calendar year in which
the breach occurred.
Based on our experience receiving
breach notifications during calendar
years 2010 and 2011, we project that
HHS will receive approximately 19,000
breach notifications from covered
entities annually or, on average,
approximately 1,583 breach
notifications each month.
Approximately 250 such notifications
will report breaches affecting 500 or
more individuals and the remaining
18,750 reported breaches will affectfewer than 500 individuals.
We project that approximately 6.71
million individuals will be affected by
the 19,000 breaches reported to HHS
each year, which is, on average, roughly
353 affected individuals per breach.
As in the interim final rule, we haveassumed that no State has a notification
requirement, despite the fact that thiswill overestimate the burden imposedon covered entities because covered
entities have trained their staffs andhave prepared procedures to follow
when a breach occurs to comply withexisting breach notification
requirements of most of the States. To
ameliorate the overstatement of our costestimate somewhat, we have assumed
the costs for training personnel and fordeveloping procedures for the most part
have already been expended and are
therefore in the baseline. We did notinclude these costs in our analysis of theannual costs.
We have followed the same approachto estimating the costs as outlined in theinterim final rule. We examined the costof notifying affected individuals by firstclass mail, issuing substitute notice inmajor media or on a Web site along witha toll-free phone number, notifying
prominent media in the event of abreach involving more than 500
individuals, and notifying the Secretaryof a breach, as well as the costs ofinvestigating and documenting
breaches. Some commenters requested
that we include the cost of modifying
contracts with business associates topotentially define the breach
notification obligations between theparties. We note that costs to modify
business associate agreements generally
to comply with the new HITECH
provisions are discussed elsewhere inthis impact analysis.

31 Department of Labor, Occupational
Employment Statistics; Healthcare Practitioner andTechnical Occupations. Available at http://
www.bls.gov/oes/current/oes_nat.htm.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Cost of Notifying Affected Individuals
by First Class Mail or Email
Section 164.404 requires all covered
entities to notify affected individuals ofa breach either by first class mail, or if
the individual has agreed, by email. In
the interim final rule, we assumed thatapproximately one half of notices sent
to affected individuals would be sent
via first-class mail, while the rest would
be sent via email. By comparison, in theFederal Trade Commission’s (FTC) final
breach notification rule, the FTC
assumed that 90 percent of the notices
sent to individuals affected by a breachrequiring notification under the FTC
rule would be emailed and only 10
percent would be sent by regular firstclass mail. Since the firms that the FTC
regulates are primarily web-based,assuming that the vast majority ofcommunications would be conducted
through email is a reasonableassumption. For HIPAA covered
entities, however, 90 percent of which
are small businesses or nonprofit
organizations that engage the entire U.S.
population in providing health careservices, we believed that notification
through email would be much more
limited than in the case of the entities
the FTC regulates. Some physician
offices have been slow to adopt emailcommunication with their patients forvarious reasons. We, therefore, assumed
that only 50 percent of individuals
affected as a result of a breach of
unsecured protected health information
would receive email notices. As we did
not receive any comments on thisassumption, we retain it here.
As discussed in our analysis in theinterim final rule, there will be certain
costs that both email and first-class mailnotification will share. The cost ofdrafting and preparing the notice will
apply to both forms. The median hourly
wage for the labor category of ahealthcare practitioner and technicalworker in 2011 was approximately$42.96, including 50 percent for fringe

PO 00000

Frm 00108

Fmt 4701

Sfmt 4700

benefits.31 If we assume 30 minutes per
breach for composing the letter, the costequals $21.48. We assume that it will
also take 30 minutes per breach for an
administrative assistant to prepare theletter in either email or printed formats
and to document the letter to comply
with §§ 164.414(a) and 164.530(j). The
median hourly wage for office andadministrative support staff is $22.53,
including 50 percent for benefits. For
the 30 minutes, we estimate $11.27 per
breach. The combined labor cost forcomposing and preparing the document
is approximately $32.75 per breach. Halfof this cost will be allocated to the firstclass letter and the other half to theemails.
Although computer costs for sending
email will be insignificant, it will takestaff time to select the email addressfrom the entity’s mailing list. We
assume that an office worker could
process and send 200 emails per hour ata cost of $22.53 per hour. For each
mailed notice, we assume $0.06 forpaper and envelope and $0.45 for a firstclass stamp, totaling $0.51 per letter. We
estimate another $22.53 per hour toprepare the mailing by hand at a rate of
100 letters per hour.
Based on our revised estimate of thenumber of breaches that will occur in a
year, we can multiply the number ofbreaches by the cost of composing andpreparing a notice (19,000 × $32.75)
equals $622,250. Allocating half thecosts to emailing and the same amountto regular mail yields $311,125 to eachcategory.
Splitting our estimate of the number
of affected individuals evenly between
email and regular mail gives us
3,355,000 affected individuals for eachnotice category. As we did in theinterim final rule, for emails we divide
affected individuals by the number of
emails processed in an hour (200) andmultiply the result (16,775 hours) by thehourly cost of $22.53, giving us$377,940. To this number we add the$311,125 giving us an estimated cost foremail notices of $689,066.
We follow the same method for
estimating the cost of mailing notices
using postal mail plus the cost of
postage and supplies. Dividing 100
letters per hour into 3,355,000 yields
33,550 hours, which is then multipliedby $22.53 to reach $755,882 in laborcosts to prepare the mailing. Adding tothat the costs of postage and supplies($1,711,050) and the costs of composing
and drafting ($311,125) equals$2,778,057. Summing the cost of email
and postal mail notices equals

E:\FR\FM\25JAR2.SGM

25JAR2

5673

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations$3,467,122. Table 3 presents the resultsof our analysis in the order they are
discussed above.

sroberts on DSK5SPTVN1PROD withTABLE 3—COST OF E-MAIL AND FIRST CLASS MAIL TO AFFECTED INDIVIDUALS IN 2011 DOLLARS(Annual)

Mail

Email

Total

Number of breaches ........................................................................................
Number of affected individuals or records .......................................................
Hours to compose and document notice ........................................................
Cost to compose and document notice ...........................................................
Hours to prepare mailing .................................................................................
Cost to prepare mailing ...................................................................................
Postage and supplies ......................................................................................

9,500 .........................
3,355,000 ..................
9,500 (1 hr per
breach).
$311,125 ...................
33,550 .......................
$755,882 ...................
$1,711,050 ................

9,500 .........................
3,355,000 ..................
9,500 (1 hr per
breach).
$311,125 ...................
16,775 .......................
$377,940 ...................
N/A ............................

$622,250
50,325$1,133,822$1,711,050

Total ..........................................................................................................

$2,778,057 ................

$689,066 ...................

$3,467,122

19,0006,710,000
19,000

Cost of Substitute Notice
In the event that a HIPAA covered
entity is not able to contact an affectedindividual through email or postal mail,it must attempt to contact the person
through some other means. If thenumber of individuals who cannot bereached through the mailings is lessthan ten, the entity may attempt to reachthem by some other written means, orby telephone.
In the event that the covered entity is
unable to contact 10 or more affectedindividuals through email or postal
mail, the rule requires the entity to (1)publish a notice in the media(newspaper, television, or radio) or post
a notice on its Web site, containing thesame information contained in themailed notice, and (2) set up a toll-freenumber. The toll-free number is to be
included in the media notice or noticeon the Web site.
Based on the breach notification
reports received by the Secretary during
calendar years 2010 and 2011, we
project that approximately 1,190
breaches affecting 10 or moreindividuals will require substitutenotice (including 5% of breaches
involving fewer than 500 individuals,
and all 250 breaches involving 500 or
more individuals). While several
breaches affecting only 1 individual
have also required substitute notice, as
stated in the interim final rule, we
believe the costs for notifying fewer
than 10 individuals through alternative
written means or by telephone would bevery small and as a result we have notattempted to estimate those costs.
The interim final rule estimated that
it would cost approximately $240 topublish a public notice in a newspaper.
Assuming the covered entity will
publish two notices, the cost is $480.

Multiplying this amount by the 1,190
estimated breaches yields $571,200.
Also, as noted in the interim final rule,
if a HIPAA covered entity has a Web
site, we assume there will be no cost to
post the notice to the Web site. We
believe this overestimates the overall
cost of publishing a notice, as many
covered entities will elect to post the
public notice only on their Web site,
and not in a newspaper.
As outlined in the interim final rule,the cost of setting up a toll-free phone
number is a straight forward process ofcontacting any one of a number ofservice providers who offer toll-freeservice. The interim final rule foundthat the prices for toll-free service range
from $0.027 per minute for a basic mailbox arrangement to $0.07 per minute. A
major, national phone service company
offers toll-free service for $15 per month
per toll-free number and per minutecharge of $0.07. There is a one-timecharge of $15. As in the interim final
rule, we use the costs of $15 per monthplus $15 activation fee and $0.07 per
minute.
Since the regulation requires
providers to maintain a toll-free number
for three months, the monthly chargeplus initial fee per breach will be $60.
To estimate the number of calls to thetoll-free number, the interim final ruleassumed that more individuals thanthose affected by the breach requiring
substitute notice would call out ofconcern that their protected healthinformation might have been
compromised. The interim final ruleestimated that a number equal to allaffected individuals of all breaches
would call the toll-free number. Basedon our experience to date, and giventhat many individuals involved inbreaches requiring substitute notice will

receive regular notice, we now assume
that less than 10 percent of individuals
affected by breaches requiring substitutenotice will call the toll-free line.
Therefore, as we anticipate 6,605,500
total individuals will be affected bybreaches requiring substitute notice,32
we assume that no more than 10
percent, or 660,550, will call the tollfree number to determine if they areaffected by the breach. We note thatwhile this revision significantly reduces
the overall cost to covered entities forproviding substitute notice in situations
in which there is insufficient or out-ofdate contact information for 10 or moreindividuals, we believe this estimate ismuch more appropriate based on theinformation we have received fromcovered entities thus far.
Using this number and assuming thata call averages five minutes at $0.07 per
minute, we estimate the total directcalling costs to equal $231,193. Added
to this is $345,000 that represents themonthly fee per breach (1,190 breaches)for three months plus the one-time fee(totaling $60 per breach). This brings thetotal cost of setting up and maintaining
toll-free lines to $576,193.
To this cost, we must also include theoffice staff time to answer the incoming
calls at $22.53 per hour. Based on anaverage of five minutes per call, a staff
person could handle 12 calls per hour.
Dividing 12 into 660,550 equals
approximately 55,046 hours and thenmultiplied by $22.53 equals $1,240,186.
Summing all cost elements yields a total
cost of $1,816,379.
To the degree that entities alreadymaintain toll-free phone lines, ourestimate overstates the costs of setting
up a toll-free line as required under therule. Table 4 presents our cost analysis
for the toll-free line.

32 This number includes all individuals affectedby breaches involving 500 or more individuals(6,600,000) and 5 percent of individuals affected bybreaches involving less than 500 individuals(5,500).

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

PO 00000

Frm 00109

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

5674

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
TABLE 4—ANNUAL COST FOR SETTING UP A TOLL-FREE LINE FOR THREE MONTHS IN 2011 DOLLARS

Costs

Numberof breaches
affectingfewer than
500 (5,500)

Number of
breaches 500+ (250)Monthly Charges for 3 months + 1-time Charge ($60/breach) .......................
Direct Calling Charges @ $.07/min × 5 minutes .............................................
Labor cost @ $22.53/hr × 5 min per call ........................................................
Cost to individuals @ $24.86/hr × 7.5 min per call .........................................

$330,000........................
........................
........................

$15,000........................
........................
........................

N/A
660,550
660,550
660,550$345,000$231,193$1,240,186$2,052,665

Total ..........................................................................................................

........................

........................

........................

$3,869,044

As in the interim final rule, we havealso imputed a cost to the time
individuals will spend calling the tollfree number. In estimating the time
involved, we assumed that a person will
spend five minutes per call. However,the person may not get through the firsttime and thus may have to call back asecond time which could add another 5
minutes. Taking the average between 5
and 10 minutes, we used an averagetime of 7.5 minutes per caller.
For purposes of imputing cost to anindividual’s time, we took the mediancompensation amount from the Bureauof Labor Statistics of $24.86 33 for all
occupations. Dividing 60 by 7.5 minutes
yields 8 calls per hour. Dividing thenumber of calls per hour into 660,550
calls and then multiplying by $24.86,
gives us a cost of $2,052,665.

sroberts on DSK5SPTVN1PROD with

Cost of Breaches Involving More Than
500 Individuals
If a covered entity experiences abreach of protected health information
affecting more than 500 individuals of aState or jurisdiction, § 164.406 of therule requires the entity to notify the
media in the jurisdiction or State inwhich the individuals reside. In
addition, § 164.408 of the rule requires
the entity to notify the Secretary
contemporaneously with notice toaffected individuals in cases where 500
or more individuals are affected by abreach.
As stated in the interim final rule, we
anticipate that a covered entity will
issue a press release when it must notify
the media under § 164.406. The tasks
involved in issuing the press release
will be the drafting of the statement andclearing it through the entity. As
discussed in the interim final rule, we
assume that drafting a one-pagestatement will contain essentially thesame information provided in the notice
to affected individuals and will take 1
hour of an equivalent to a GS–12
33 Department of Labor, Occupational
Employment Statistics. http://www.bls.gov/oes/current/oes_nat.htm.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Number of
calls

Total

Federal employee, earning $29 per hour.
Adding 50 percent to account for
benefits equals $43.50. Approval of therelease involves reading the document.
We expect this activity to take 15
minutes. The median hourly rate for a
public relations manager isapproximately $44.86 in 2011.34 Adding
50 percent for benefits equals $67.29, so
one quarter of an hour equals $16.82 forapproving the release. The total cost of
the release equals $61.68, andmultiplying this amount by the numberof breaches affecting more than 500
individuals (250) equals $15,420. This
amount is lower than our previous
estimate because we have adopted themore customary and realistic approachof adding 50 percent to wages forbenefits, rather than doubling standard
wage rates to account for benefits. It
should be noted that even this amount
may overstate the actual costs of issuinga notice to the media.
The report to the Secretary that must
be sent contemporaneously with thesending of the notices to the affectedindividuals will contain essentially thesame information as the notice sent tothe affected individuals. As stated in theinterim final rule, we anticipate the timeand cost to prepare the report will be
the same as that required for issuing a
notice to the media. The cost forreporting to the Secretary the 250
breaches affecting 500 or moreindividuals is $15,420.

At an office manager’s 35 time at $67 perhour ($44.65 median wage plus 50
percent for benefits) multiplied by 4 and8 hours, results in per breach costs ofapproximately $268 and $536,
respectively. Multiplying $268 by the
number of breaches affecting fewer than
10 individuals (17,800 breaches) results
in investigation costs of $4,773,616. We
then multiply $536 by the number ofbreaches affecting 10 to 499 individuals(940 breaches), which produces
investigation costs of $503,840. Adding
the totals for the two groups results ininvestigation costs of $5,277,456 peryear for breaches affecting less than 500
individuals. This estimate includes thetime required to produce thedocumentation required by § 164.414(a).
We note that this estimate issignificantly higher than that in theinterim final rule; however, this is due
entirely to the revised estimate that
there will be approximately 18,750
breaches affecting fewer than 500
individuals per year.
As stated in the interim final rule, forbreaches involving 500 or moreindividuals, the breach investigation
may take up to 100 hours to complete;
however, we assume that the average
investigation will take only 50 hours. At
an office manager’s time of $67 per hour
multiplied by 50 hours, this cost equals$3,350 per breach. Multiplying this by
the number of breaches (250) yields$837,500.

Cost of Investigating a Breach

Cost of Submitting the Annual Breach
Summary to HHS
Under § 164.408, covered entities
must notify the Secretary of all
breaches; however, covered entities
reporting breaches affecting fewer than
500 individuals may report thesebreaches to the Secretary annually.
Since the material for the submission
has already been gathered and organized
for the issuance of the notices to theaffected individuals, we expect that
notifying the Department will require at

As a prerequisite to issuing a notice
to individuals, to the media, and to theSecretary, the covered entity will needto conduct an investigation to determine
the nature and cause of the breach. We
estimate that the 95 percent of breaches
in the under 500 category that affectfewer than 10 individuals will require 4
hours of investigation. The other 5
percent of under 500 breaches, which
affect between 10 and 499 individuals,
may require up to 8 hours to investigate.
34 http://www.bls.gov/oes/current/oes_nat.htm.

PO 00000

Frm 00110

Fmt 4701

Sfmt 4700

35 See www.bls.gov/oes/current/oes_nat.htm for
All Management Occupations.

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
most an hour of office staff time once
per year. At $22.53 per hour multipliedby the total number of breaches (18,750)
affecting fewer than 500 individuals,
this cost equals $422,438.
2. Notifying Individuals of Their New
Privacy Rights

sroberts on DSK5SPTVN1PROD with

Covered entities must provide
individuals with NPPs that detail how
the covered entity may use and disclose
protected health information andexplain individuals’ rights with respect
to their own health information.
Because of changes to the HIPAA Rules
as a result of the HITECH Act and GINA,
the final rule requires covered entities tomodify their NPPs and distribute themto individuals to advise them of thefollowing: (1) For health plans that
underwrite, the prohibition against
health plans using or disclosing PHI thatis genetic information about anindividual for underwriting purposes;(2) the prohibition on the sale ofprotected health information without
the express written authorization of theindividual, as well as the other uses anddisclosures for which the rule expressly
requires the individual’s authorization(i.e., marketing and disclosure of
psychotherapy notes, as appropriate);(3) the duty of a covered entity to notify
affected individuals of a breach of
unsecured protected health information;(4) for entities that have stated theirintent to fundraise in their notice ofprivacy practices, the individual’s rightto opt out of receiving fundraisingcommunications from the covered
entity; and (5) the right of the individual
to restrict disclosures of protected
health information to a health plan withrespect to health care for which theindividual has paid out of pocket in full.
For providers, the costs related to the
NPP consist of developing and drafting
the revised NPP, and, as discussed
below, the potential to incur out-ofcycle printing costs for the revised
notice. There are no new costs
attributable to the distribution of therevised notice as providers have an
ongoing obligation to hand out the NPPs
when first-time patients come for their
appointments. We estimate that drafting
the updated NPPs will requireapproximately one-third of an hour of
professional, legal time at a cost of about$28.36 The total cost for attorneys for the
36 See http://www.bls.gov/oes/current/
naics3_541000.htm#23–0000 for lawyers. Note that
we generally calculate labor costs based on the
median hourly rate, which for lawyers is $56.21 perhour. We add 50 percent to account for fringe
benefits, resulting in an estimated hourly cost of$84.32.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

approximately 697,000 37 health careproviders in the U.S. is, therefore,
expected to be approximately $20
million. Printing the NPPs involves
production and supplies at a cost of$0.10 per notice. Based on our priorestimates, health care providers are
currently required to print and provide
the NPP to approximately 613 million
new patients annually. We assume thatmost health care providers will spreadthe printing of their notices throughout
the year, producing copies on aquarterly, monthly, or even more
frequent schedule. Further, providers
will have 8 months from the publicationof the final rule before they will need to
produce the revised NPPs, and,
therefore, can use that time to adjust
their inventory and printing schedule totransition to the revised notice without
any additional expense. Thus, assuming
a worst case scenario in which allproviders would need to replace at most
4 months of old inventory with therevised notice, the need for off-schedule
printing of the revised notice for this 4month period would be attributed tothis provision. We estimate, therefore,that providers will print not more than
204 million revised NPPs over andabove their existing printing obligations(4/12 × 613 million = 204 million).
Printing costs for 204 million NPPs willbe $20.4 million (204 million × $0.10 =$20.4 million). Therefore, the total costfor providers is approximately $40.4
million ($20 million + $20.4 million =$40.4 million).
For health plans, the costs related to
the NPP consist of developing anddrafting the revised NPP, and, forcertain health plans, the costs ofprinting and mailing the notice out-ofcycle because the revision is a materialchange. See § 164.520(c)(1)(v)(A). With
the exception of a few large healthplans, most health plans do not selfadminister their plans. Most plans areeither health insurance issuers(approximately 730) or utilize third
party administrators that act on theirbehalf in the capacity of businessassociates. We identified approximately
750 third party administrators acting as
business associates for ERISA plans. We
37 We identified 698,238 entities that must
prepare and deliver NPPs that are shown in Table
1 above. This includes 696,758 HIPAA covered
entities that are health care providers, including
hospitals, nursing facilities, doctor offices,
outpatient care centers, medical diagnostic, imaging
service, home health service and other ambulatory
care service covered entities, medical equipment
suppliers, and pharmacies. For the purposes of ourcalculation, we have rounded this number to697,000. Table 1 also includes 730 health insurance
carriers and 750 third party administrators working
on behalf of covered health plans. The costestimates for these entities are addressed later.

PO 00000

Frm 00111

Fmt 4701

Sfmt 4700

5675

have revised our earlier estimate of
3,500 third party administrators after
learning that the majority of these
entities act as welfare administratorsand do not administer health plans. In
addition, some public non-Federal
health plans may use third party
administrators. Almost all of the publicand ERISA plans, we believe, employ
third party administrators to administer
their health plans. While the third party
administrators will bear the direct costsof issuing the revised NPPs, the costs
will generally be passed on to the plansthat contract with them. Those plansthat self-administer their own plans will
also incur the costs of issuing therevised NPPs. We do not know how
many plans administer as well as
sponsor health plans and invitedcomments on the number of selfadministered plans. As we did notreceive comments on this issue, we
assume that there are not enough selfadministered plans to have an effect onthese estimates.
Each of the approximately 1,500
health insurance issuers and health plan
administrators will experience the samekinds of costs as we estimated forproviders for drafting ($28 per entity)and printing ($0.10 per notice) the
NPPs. However, health insurers andplan administrators will have to mailthe NPPs to policy holders. We
recognize that, under the existing
requirement to send new NPPs in a
separate mailing to all policy holders,the costs of distributing new NPPs,
including clerical time and in somecases, postage, constituted the majorityof the overall costs of the rule to covered
entities. However, in the proposed rule,
we requested comments on alternative
ways to inform individuals of materialchanges to their rights and protections
that would be less burdensome andcostly. Based on the comments andconsistent with E.O. 13563, in this final
rule, we have adopted an alternative tothe requirement to send the new NPP toall policy holders within 60 days. Afterconsideration, we decided to permit
health plans and third party
administrators working for health plans
to include the revised NPP in their next
annual mailing, rather than within 60
days of the material change, if they havea Web site with an NPP. See§ 164.520(c)(1)(v)(A). We anticipate that
most, if not all, affected entities willtake advantage of this option and will
not send the NPP in a separate mailing.
As such, we expect that the vast
majority of health insurers will notincur any out-of-cycle NPP
dissemination costs.
Nonetheless, to account for any costs
that might be incurred by a small

E:\FR\FM\25JAR2.SGM

25JAR2

5676

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

minority of health insurers to distributethe revised NPPs in a separate mailing,
we have calculated the costs to these
entities of doing so. We describe ourmethodology in the following
paragraphs, beginning with an estimatedtotal number of NPP recipients. We thencalculate the costs of printing andsending the revised NPP by separate
mailings to all recipients and estimatethat no more than 10 percent of thesecosts will actually be incurred.
Because the Privacy Rule requires that
only the named insured or policy holder
is notified of changes to the healthplans’ privacy practices even if thatpolicy also covers dependents, we
expect that only policy holders will
receive the revised NPPs mandated bythis rule. This assumption is consistent
with the practices of public programs,
such as Medicare, which has a policy ofmailing one notice or a set of program
materials to a household of four or fewer
beneficiaries at the same address. As aresult, although there are 50.7 million
individual Medicare beneficiaries, theprogram only sends out approximately
36 million pieces of mail per mailing.
Actuarial Research Corporation(ARC), our consultant, estimated thenumber of policy holders for all classes
of insurance products to beapproximately 183.6 million, including
all public programs. The data comesfrom the Medical Expenditure Panel
Survey from 2004–2006 projected to2010. ARC estimated 112.6 million
private sector policy holders and 71.0
million public ‘‘policy holders.’’ The
total, including more recent Medicare
data, is 188.3 million persons (which
results in roughly a split of 60 percent
private policy holders and 40 percent
public ‘‘policy holders’’), whom we
expect to receive NPPs from their plans.
The estimates do not capture policy
holders who are in hospitals or nursing
homes at the time of the survey, or
individuals who may have been insured
under more than one plan in a year, forexample, because their job statuschanged, they have supplemental
policies, or they have more than one
employer, creating duplicate coverage.
Therefore, ARC recommended we use
200 million for the number of NPPs thatwill actually be sent.
We estimate the costs of drafting,printing, and distributing the NPP to all
potential recipients to be the following.
First, drafting the NPP is estimated torequire one-third hour of legal services
at a cost of $28 × 1,500 insurance plans
and insurance administrative entities,
which equals $42,000. Second, we needto calculate printing and distribution
costs for all potential recipientsassuming the revised notice would besent in a separate mailing. As with
providers, we estimate the cost of
printing the NPP, which includes thecost of paper and actual printing, to be$0.10 per notice. Therefore, we estimate
the cost of printing 200 million notices
for mail distribution at $20 million.
Further, we estimate the cost of
distributing the NPPs, including clericaltime and postage in the same manner asthese costs were estimated for the
Breach Notification for Unsecured
Protected Health Information
Regulations. Thus, we assume that an
office worker could process and send
100 mailings per hour at a cost of $22.53
per hour, plus a postage cost of $0.45
per mailing. If notices were required tobe mailed to the 200 million
beneficiaries in the sixty-day timeframe,
the distribution costs would be $135
million (200 million/100 per hour ×$22.53 = $45 million + $90 million (200
million × $0.45)). Total printing anddistribution cost would have been $155
million, if all policy holders received
separate NPP mailings. Third, as
discussed above, we expect that nearly
all plans and third party administrators
will be able to avoid having to do aseparate mailing of the revised noticeunder the new distribution provisions
in this final rule, and that only 10

percent of these plans will incur the
printing and distribution costs. Using
the above estimates, we assume for thispurpose that 20 million notices (200
million total notices × 10%) will beneed to be printed and sent through aseparate mailing, at a total cost of $15.5
million ($2 million printing + $13.5
million mailing). Therefore, the total
cost to all plans for drafting, printing,and distributing the NPP isapproximately $15.5 million. We notethat even this total may be an
overestimation of the costs because
many insurers may use bulk mailingrates to distribute their NPPs which
would reduce their mailing costs.
The total estimated cost for bothproviders and health plans to notify
individuals and policy holders ofchanges in their privacy rights isapproximately $55.9 million in the firstyear following implementation of therule.
A number of commenters expressed
general concern regarding the costs ofprinting and distributing new NPPs but
did not provide estimates of the costs
they anticipated or question our
calculations. Two health plancommenters estimated that the costs ofprinting and mailing NPPs to theirmembers could reach up to $100,000.
However, they did not provide
information about the facts andassumptions underlying their analyses,
including the number of beneficiaries ormailings they anticipated, so we wereunable to evaluate their estimates. We
have addressed some of this concern bypermitting health plans that maintain a
notice on their web sites to include their
NPPs in their annual mailings, rather
than separately mailing the NPPs within
60 days of the material changes.
Table 5 below presents our analysis ofcosts to the providers, insurers, andthird party administrators that are
required to issue NPPs under the rule.38

sroberts on DSK5SPTVN1PROD withTABLE 5—SUMMARY OF COMPLIANCE COST FOR NOTICES OF PRIVACY PRACTICES
Cost elements

Providers

Health insurers &third party administrators

Total(approx.)

Drafting NPPs .....................................................................................................
Printing NPPs .....................................................................................................
Mailing NPPs ......................................................................................................

$20 million ..............
$20.4 million ...........
N/A .........................

$42,000 ..................
$2 million ...............
$13.5 million ...........

$20 million.
$22.4 million.
$13.5 million.

Total (approx.) .............................................................................................

$40.4 million ..........

$15.5 million ...........

$55.9 million.

38 Health care clearinghouses function almost
exclusively as business associates with respect to

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

the protected health information they maintain andprocess, and therefore have no NPP requirements.

PO 00000

Frm 00112

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
3. Business Associates and Covered
Entities and Their Contractual
Relationships
The rule extends liability for failure tocomply with certain provisions of thePrivacy and Security Rules directly tobusiness associates and businessassociate subcontractors. Prior to thisrule and HITECH, these obligations
applied to business associates and theirsubcontractors indirectly through§§ 164.504(e) and 164.314(a), which
require that covered entities by contract
require business associates to limit usesand disclosures and implement Security
Rule-like safeguards.
This final rule implements Section
13401 of HITECH Act, which makes
business associates directly liable forcompliance with many of the same
standards and implementation
specifications, and applies the same
penalties to business associates that
apply to covered entities, under the
Security Rule. Additionally, in accord
with Section 13404 of the HITECH Act,the rule requires business associates tocomply with many of the samerequirements, and applies the same
penalties to business associates that
apply to covered entities, under thePrivacy Rule. Business associates mustalso obtain satisfactory assurances in theform of a business associate agreementfrom subcontractors that thesubcontractors will safeguard any
protected health information in theirpossession. Finally, business associates
must furnish any information the
Secretary requires to investigate
whether the business associate is incompliance with the regulations.
In the proposed rule, we assumed thatbusiness associates’ compliance with
their contracts range from the minimal
compliance to avoid contract
termination to being fully compliant.
Further, we assumed that businessassociates in compliance with theircontracts would have alreadydesignated personnel to be responsible
for formulating the organization’s
privacy and security policies, performed
a risk analysis, and invested in
hardware and software to prevent andmonitor for internal and external
breaches of protected healthinformation.
We also stated in the proposed rulethat while business associates werepreviously required to comply with the
HIPAA Rules according to the terms of
their contracts with covered entities,
and we expected that most businessassociates did so already, the risk ofcriminal and/or civil monetary penalties
may spur some business associates toincrease their efforts to comply with the

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Rules. We explained that we have no
information on the degree of contract
enforcement and compliance among
business associates, and lackinformation regarding the size or type ofbusiness associates that contract withcovered entities. We have only roughestimates as to the overall number ofbusiness associates, which range fromapproximately one million to twomillion depending on the number ofbusiness associates that serve multiple
covered entities.
While we did not have specificinformation in this regard, we assumed
that some business associates andsubcontractors already comply withexisting privacy and security standardsin accordance with their indirect andcontractual obligations. For them, theproposed rule would impose only alimited burden. For other businessassociates, depending on the current
level of compliance, the proposed rule
could impose significant burdens. We
requested comments regarding theamount of burden and the number ofaffected business associates.
Several commenters stated that
requiring business associates toundertake compliance with the rule inthe same way as covered entities isexcessive and burdensome, especiallybecause in some cases businessassociates do not have the same type of
relationship with individuals. Several
commenters pointed to the burden on
covered entities and business associates
to renegotiate business associateagreements and train staff, and many
specifically mentioned that compliancewith the Security Rule is particularly
costly. One commenter stated that it wasa business associate party to ‘‘tens of
thousands’’ of business associate
contracts, with a significant cost to bringall into compliance.
We continue to expect that mostbusiness associates and subcontractors
have made and continue to make a
good-faith effort to follow the terms of
their contracts. The burden of the ruleon business associates andsubcontractors depends on the terms ofthe contracts between covered entities
and business associates and between thebusiness associates and subcontractors,
and the degree to which businessassociates and subcontractors
established privacy policies andadopted security measures that comportwith the HIPAA Rules. For businessassociates and subcontractors that havealready taken HIPAA-compliant
measures to protect the privacy andsecurity of the protected healthinformation in their possession, as
required by their existing contracts, therule imposes limited burden. We

PO 00000

Frm 00113

Fmt 4701

Sfmt 4700

5677

estimate the costs to other businessassociates later in this section.
A few commenters cited concerns
about unfair competition for smaller
business associate entities that they
believe will not be able to compete withlarger business associate entities,
especially with regard to contract
negotiations including indemnificationand other risk allocation issues.
We understand that many small
business associates are concerned about
the allocation of risk andindemnification in conjunction with
their business associate contracts.
However, as we discuss in section IV D
above, as with any contracting
relationship, business associates andcovered entities may include otherprovisions that dictate and describe
their business relationship. While these
may or may not include indemnification
clauses or other risk-shifting provisions,these contractual provisions andrelationships are outside the governanceof the HIPAA Rules.
Because we understand that covered
entities and business associates remain
concerned with the cost to bring theirbusiness associate agreements into
compliance with the final rule, we allow
contracts to be phased in over one year
from the compliance date or 20 months
from the publication date of the final
rule, and we expect and encouragecovered entities and business associates
to incorporate the costs of modifying
contracts into the normal renegotiationof contracts as the contracts expire. As
we did not receive comments to thecontrary, we believe that most contracts
will be renegotiated over the phase-in
period. In addition, the Department has
issued on its web site revised sample
business associate provisions, whichshould lessen the costs associated with
contract modifications.
As we believe covered entities
generally are operating under HIPAA
compliant contracts with their businessassociates, the transition period andavailability of sample contract
provisions should make it possible forthese entities to incorporate any minor
contract modifications into normal
contract renegotiations without any
appreciable added costs. We continue tobelieve that all covered entities haveestablished business associateagreements with their businessassociates that are consistent with therequirements of the HIPAA Rules, ascovered entities have been subject todirect liability under the Rules since
their inception and have had more thanhalf a dozen years to make theircontracts compliant. However, to theextent that some contracts between
covered entities and business associates

E:\FR\FM\25JAR2.SGM

25JAR2

5678

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withare not currently in full compliancewith the business associate agreement
provisions, these entities may
experience limited costs to revise theircontracts.
Although we are less certain about thecurrent state of business associatesubcontractor relationships, we believethat most business associates have madea good faith attempt to include theappropriate contractual requirements.
Still, we anticipate that some small
business associates, now that they are
subject to direct liability under therules, might establish or significantly
modify their subcontracts to come into
compliance for the first time. Suchbusiness associates would not be
eligible for the extended transition
period and, as a result, would incur thecosts of creating new contracts or
renegotiating contracts out of cycle. In
the Final Privacy Rule published in
2002, we estimated that entities would
need between one and two hours todevelop and tailor a business associateagreement to their particular needs. See
67 FR 53182, 53257. Taking the averageof the lower and upper estimatesprovided in the earlier rulemaking, weestimate that developing and tailoring
contract language normally would takeapproximately 90 minutes ofprofessional legal services at $84.32 perhour.39 However, as in the 2002 Final
Privacy Rule (67 FR 53257), we estimatethat providing model language will
reduce the time required to develop
contract language by at least one third.
Thus, we estimate that each new orsignificantly modified contract between
a business associate and its
subcontractors will require, at most, onehour of a lawyer’s time at a cost of$84.32.
We believe that no more than 25
percent of 1–2 million businessassociates, or 250,000–500,000 entities,
would not have already made good faithefforts to achieve compliance and willneed to create or significantly modify
subcontracts, resulting in total costs of
between $21 million and $42 million.
We expect that each businessassociate’s lawyer will draw up one
standard contract to use for all of its
subcontracts. We do not attributecontract revision costs to subcontractors
because the required contract provisions
are not negotiable and subcontractors
will need to only sign the agreement.
We note that our estimated cost likely
39 See http://www.bls.gov/oes/current/
naics3_541000.htm#23–0000 for lawyers. Note that
we generally calculate labor costs based on the
median hourly rate, which for lawyers is $56.21 perhour. We add 50 percent to account for fringe
benefits, resulting in an estimated hourly cost of$84.32.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

is an overestimate because the group ofsmall business associates that may beless likely than others to have compliant
contracts in place with subcontractors
are, because of their size, also less likely
to have any subcontractors at all.
Finally, in response to thecommenters concerned with the costand burden on business associates tocome into full compliance with the
Security Rule, we have taken anotherlook at the underlying assumptions in
the proposal. We continue to believethat business associates have engaged in
privacy practices in compliance with
their contractual obligations to use anddisclose protected health information as
limited by the Privacy Rule and their
particular contracts with covered
entities. Therefore, as we have statedabove, we do not believe that theextension of liability for compliancewith Privacy Rule requirements as
identified in this rulemaking will
impose any new costs or burdens.
With regard to the Security Rule,
which was of particular concern tocommenters as to the compliance costs
on business associates, we also continue
to believe that business associates, inproviding their adequate assurances tosafeguard electronic protected healthinformation through their businessassociate contracts, have implemented
security protections that meet thestandards and required implementation
specifications in the Security Rule.
Further, we continue to believe thatbusiness associates have made thenecessary investment in hardware andsoftware to secure the electronic
protected health information as part ofthe investment in the hardware andsoftware needed for their management
and processing of this information to
perform their business associate
functions and comply with the contract
requirements at § 164.314(a). However,based on the comments, we now believethat some business associates,
particularly smaller business associatesthat may have access to electronic
protected health information for limited
purposes, may not have engaged incertain of the formal administrative
safeguards. For example, these entities
may not have performed a risk analysis,
established a risk management program,or designated a security official, andmay not have written policies andprocedures, conducted employee
training, or documented compliance as
required under §§ 164.308 and 164.316
of the Security Rule.
We do not have information on whatpercentage of business associates may
have to engage in efforts to comply withsome of the administrative safeguard
standards, including documenting their

PO 00000

Frm 00114

Fmt 4701

Sfmt 4700

policies and procedures and training
their employees on the policies andprocedures, nor did the comments on
the impact statement offer any specificinformation to provide an estimate. We
assume that up to 80 percent of the 1–
2 million business associates, or
between 800,000 and 1.6 million
business associates, may handle
electronic protected health informationand thus may have to document their
existing security protocols. Further, of
these business associates, we assume
that no more than 25 percent are likely
to incur some cost to document theiradministrative safeguards and theirpolicies and procedures as now requiredby statute and these regulations. We
believe that our original assumption ofcompliance with all Security Rulerequirements remains sound for the restof the business associates, and we
received no substantive comments tothe contrary.
The costs of coming into fullcompliance with the administrative
safeguard procedures, such as
performance of a risk analysis anddevelopment of a risk management plan,
will vary depending on the size andcomplexity of the business associate, thescope of their duties for the covered
entity and the protected healthinformation they must secure, and thedegree to which their priordocumentation of their security
protocols falls short of compliance withthe standards in the Security Rule. In
the original Security Rule, we estimatedthat covered entities would needapproximately 16 hours to document
their policies and procedures. See 68 FR
8334, 8368. As these policies andprocedures are the reflection of the risk
management plan, which in turn isbased on the risk analysis, we believethat this estimate would be inclusive ofthat time. We believe it will takebusiness associates on average muchless time to document their security
related policies and procedures, because
they have likely already engaged inmost of the analysis associated with the
adoption of security protocols, even if
they may not have formally reduced allsuch protocols to writing, and because
the scope of their responsibilities will
generally be much more constrained
than that of the covered entity withwhom they have contracted. In addition,
while covered entities must performthese tasks with respect to their entire
business, generally only a small part ofany business associate is involved withelectronic protected health information.
Extrapolating from our estimate in theoriginal Security Rule that entities
would require approximately 16 hours
to implement and document Security

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
Rule compliance measures for the firsttime, and applying the assumption thatmost of these measures already are inplace, we estimate that these businessassociates will need only between 2 and5 hours to formalize or update theirapplicable administrative safeguards.
We would cost the time needed to comeinto compliance at $56.61/hour.40
According to these assumptions, therange of costs that any one businessassociate would incur to comply with
the new statutory and regulatory

requirements would be between $113
and $283, as first year, one-time costs.
Assuming that businesses associateswith access to electronic protected
health information represent 80 percentof 1 to 2 million total businessassociates (or 800,000 to 1.6 million
total), the aggregated costs for all
business associates are estimated to be
between approximately $22.6 million
and $113 million. (25 percent of 800,000
business associates = 200,000; 200,000 ×$113 (2 hr @ $56.61/hr) = $22.6 million.

5679

25 percent of 1.6 million businessassociates = 400,000; 400,000 × $283 (5hr @ $56.61/hr) = $113 million.) These
costs represent one time first year costs
for full compliance by businessassociates with the Security Rulerequirements.
Table 6 below presents the range of
our estimates of the costs to businessassociates of achieving compliance withthe rules.

TABLE 6—BUSINESS ASSOCIATE COST ESTIMATES IN 2011 DOLLARS
Data element

Security rule compliancedocumentation

Estimated number of affected entities ...........................................................................
Hours needed to complete compliance activities ..........................................................
Cost per hour .................................................................................................................
Total cost .......................................................................................................................

200,000–400,000 BAs ........
2–5 hours per BA ...............
$56.61 ................................
$22.6 million–$113 million ..

sroberts on DSK5SPTVN1PROD with

Response to Other Public Comments
Comment: One commenter suggested
that business associates will be reluctant
to contract with covered entities due toperceived increased risks associatedwith such contracts, and covered
entities will be forced to hire more staff
at additional costs.
Response: While the HIPAA Rules
now impose direct liability with regard
to compliance, business associates werepreviously contractually liable forcompliance with these provisions.
Further, whether a covered entity uses
workforce members or businessassociates to perform its operations
remains a decision for the covered
entity. As this commenter did notprovide specific information about his
concerns, we cannot quantify the costs
associated with this comment, nor do
we have a basis for concluding thatbusiness associates will refuse tocontract with covered entities as a resultof this rule.
Comment: One commenter suggested
that requiring business associateagreements will increase the costs oflitigation.
Response: As business associateagreements were required under the
HIPAA Rules previously, and as thecommenter did not include specificinformation about what costs hebelieves will increase, we do not believe
such a requirement will increase
litigation generally.
40 We have used the median wage rate describedby the U.S. Bureau of Labor Statistics in its 2011
National Compensation Survey for the category of

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

BAA between business associates and subcontractors
250,000–500,000 BAs.
1 hour per BA.
$84.32.
$21 million–$42 million.

a. Authorization for Uses andDisclosures of Protected Health
Information for Marketing and Sale ofProtected Health Information
The final rule modifies the definitionof ‘‘marketing’’ to encompass treatment
and health care operations
communications to individuals about
health-related products or services if thecovered entity receives financial
remuneration in exchange for making
the communication from or on behalf ofthe third party whose product or service
is being described. A covered entity
must obtain an individual’s written
authorization prior to sending marketing
communications to the individual.
In the proposed rule, we requested
comment on the extent to which
covered entities currently receive
financial remuneration from third
parties in exchange for sending
information to individuals about thethird parties’ health-related products orservices. In general, commenters did notindicate that complying with the final
rule would be administratively
burdensome, but some commenters
expressed a general concern over the
potential loss of revenue given the new
restrictions on receiving financial
remuneration from a third party to send
health-related communications to anindividual. These comments appear toindicate that most covered entities
would not attempt to obtain
authorizations for the now prohibited
communications but rather would forgo

making them altogether. We
acknowledge the potential for some lost
revenue due to these modifications incases where covered entities are
currently receiving financial
remuneration from third parties to send
health-related communications to
individuals. However, as we do notknow to what extent covered entities
today currently operate in this manner,and commenters did not include
specific information in this regard, we
do not have data that could inform
quantifying such loss.
The final rule also requires anindividual’s authorization before acovered entity may disclose protected
health information in exchange forremuneration (i.e., ‘‘sell’’ protected
health information), even if thedisclosure is for an otherwise permitted
disclosure under the Privacy Rule. The
final rule includes several exceptions tothis authorization requirement. In the
proposed rule, we stated that on its face,
this new prohibition would appear toincrease the burden to covered entities
by requiring them to obtain
authorizations in situations in which noauthorization is currently required.
However, we believed such a scenario tobe unlikely. We believed mostindividuals would not authorize
disclosures of their protected healthinformation when they were informed
the covered entity would be
remunerated for the disclosure. Thus,
we believed covered entities would
simply discontinue making suchdisclosures as it would not beManagement Analysts (including responsibilities
for designing systems and procedures), which isapproximately $37.74/hr. See http://www.bls.gov/

oes/current/oes_nat.htm . To this wage rate we haveadded 50 percent for benefits, which results in a
total cost of $56.61/hr.

4. Qualitative Analysis of Unquantified
Costs

PO 00000

Frm 00115

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5680

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

worthwhile for covered entities tocontinue to attempt to obtain such
authorizations. We requested commenton these assumptions.
As noted above, the requirement toobtain authorization to receive
remuneration to make a disclosure ofprotected health information contains
several exceptions. In the proposed rule,
we expressed our belief that covered
entities would not incur additional costs
to continue making most of the excepteddisclosures as such exceptions were notconstrained or limited in any way andthus, would not change the status quo.
However, we recognized that the
exception for research disclosures may
impose additional burden on
researchers as it was, consistent withthe statute, a conditional exception.
Covered entities would be able todisclose protected health information
under the research exception only to theextent any remuneration received in
exchange for the information did notexceed the cost to produce and transmit
the information. Thus, we recognizedthat researchers who purchase data fromcovered entities may now incur
additional costs as a result of the final
rule, in order to obtain newly required
authorizations, if they are currently
paying a covered entity more than thecost to produce and transmit theprotected health information (e.g., an
incentive payment to produce the data)
and the covered entity is not willing toaccept only the costs to prepare andtransmit the data. It was also recognizedthat some research may be jeopardized
to the extent that authorizations for theentity to receive these incentive
payments could not be obtained fromsubjects. On the other hand, to theextent covered entities agreed to receive
only the costs to prepare and transmit
the data, these entities would
experience a loss of revenue while
researchers would experience a
corresponding decrease in costs, andcurrent disclosures for research
purposes could continue withoutauthorization. While we acknowledged
the potential costs under this provision,
we stated that we have no informationon the amounts currently paid tocovered entities by researchers forprotected health information, and thus,
had no way to estimate the impact of theprovision. We solicited comment in thisarea.
Overall, commenters did not indicatethat obtaining authorization prior todisclosing protected health informationin exchange for remuneration would
result in an increased burden or cost forthe covered entity. However, onecommenter did estimate that obtaining
additional authorizations may cost

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

approximately $22 to $28, per patient.
Some commenters indicated it may beburdensome to determine if
remuneration was in fact received by
the entity.
The comments on this provision did
not alter our belief that, in general,
covered entities would discontinue
making disclosures in exchange forremuneration that require theindividual’s authorization, given theunlikelihood most individuals would
agree to authorize such disclosures.
Further, there are a number of
exceptions to the general prohibition
that allow a covered entity to continue
to operate ‘‘status quo’’ with respect toa number of types of disclosures, even
if the covered entity receives
remuneration. In response to thecomments, we acknowledge that it may
be difficult to determine whether
remuneration has been received by acovered entity, particularly since theprohibition encompasses both direct
and indirect (i.e., non-financial)
remuneration. We expect to issue future
guidance on this topic to assist entities
in complying.
With respect to the amounts currently
paid to covered entities by researchers,some commenters indicated as a general
concern that limiting remuneration
received by covered entities fromresearchers may provide a disincentive
for covered entities to continue assisting
researchers in their efforts. However,commenters did not quantify what they
are paying covered entities above thecosts to prepare and transmit the data,
nor did they provide information thatwould give the Department an idea ofthe extent to which covered entities
receive such payments. Therefore, while
we acknowledge the potential for somelost revenue to covered entities due tothese modifications or some additionalcosts to researchers to obtain
authorizations, we do not have data that
could inform quantifying such costs. At
the same time, we note that we havemade some clarifications in the above
preamble discussion regarding theseprovisions that we believe would lessen
any such impact. Specifically, thepreamble explains that we do notconsider a sale of protected healthinformation to encompass payments acovered entity may receive in the formof grants, or contracts or otherarrangements to perform programs or
activities, such as a research study,
where any provision of protected healthinformation to the payer is a byproductof the service being provided. Thus, thepayment by a research sponsor to acovered entity to conduct a researchstudy is not considered a sale ofprotected health information even if the

PO 00000

Frm 00116

Fmt 4701

Sfmt 4700

study involves disclosing research
results that include protected healthinformation to the sponsor. In contrast,
a sale of protected health information
includes disclosures of protected healthinformation where a covered entity isreceiving remuneration from or on
behalf of the recipient of the data for the
information itself. Thus, a disclosure ofprotected health information by acovered entity to a third party
researcher that is conducting the
research in exchange for remuneration
would fall within these provisions,
unless the only remuneration received
is a reasonable, cost-based fee to cover
the cost to prepare and transmit the data
for such purposes.
b. Individual Right To Opt Out ofFundraising Communications
The current Privacy Rule requires
covered entities give individuals theopportunity to opt out of receiving
future fundraising communications
from the entity. The HITECH Act andfinal rule strengthens the opt out by
requiring that it be clear andconspicuous and that an individual’s
choice to opt out should be treated asa revocation of authorization. While therule specified that a clear andconspicuous opt out method must notcause an individual to incur an undue
burden or more than a nominal cost,
proposed rule did not specify themethod to be employed but rather left
it up to the discretion of the covered
entity. We requested comment on theextent to which the requirement that theopportunity to elect not to receive
further fundraising communications beclear and conspicuous would have an
impact on covered entities and theircurrent fundraising materials.
Overall, commenters did not indicatethat requiring the opt out for further
fundraising to be clear and conspicuous
would greatly impact covered entities
and their current fundraising efforts orprovide specific anticipated costs in thisregard. Rather, some commenters
indicated that they already provide prepaid, pre-printed postcards for thispurpose with fundraising mailings anddoing so is neither costly nor imposesa significant burden on the individual
who wishes to opt out of further
communications. Based on thisfeedback and the continued flexibility
in the final rule to choose the opt out
method (e.g., toll-free number, postcard), we do not believe that therequirement that fundraising opt-outs beclear and conspicuous will result insignificant new costs to covered entities.
Further, while some commenters did
indicate that a pre-solicitation opt out
would be costly for covered entities in

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

sroberts on DSK5SPTVN1PROD withresponse to our request for comment on
this issue, as a result of this general
opposition, the final rule does notchange the current requirement thatcovered entities only need to include an
opt-out with any solicitation sent to anindividual rather than to the first
fundraising communication.
c. Individuals’ Access to Protected
Health Information
In this final rule, we strengthen an
individual’s right to receive anelectronic copy of his or her protected
health information. Specifically, as was
proposed, the final rule requires that if
an individual requests an electronic
copy of protected health informationthat is maintained electronically in one
or more designated record sets, thecovered entity must provide theindividual with access to the electronic
information in the electronic form andformat requested by the individual, if it
is readily producible, or, if not, in areadable electronic form and format asagreed to by the covered entity and theindividual. Also, as in the proposed
rule, the final rule provides that acovered entity may charge a fee for costs
associated with labor and supplies forcreating an electronic copy, including
electronic portable media if agreed to by
the individual, and clarifies that acovered entity may charge for postage if
an individual requests that the covered
entity transmit portable media
containing an electronic copy throughmail or courier. However, covered
entities may not include fees associatedwith maintaining systems, retrieval
costs, or infrastructure costs in the fee
they charge to provide an electroniccopy.
We continue to believe that thisrequirement will not result insignificant new burdens on covered
entities. Individuals already had a rightto access protected health information
maintained in electronic designatedrecord sets under the prior Rule, andalready had a right to receive anelectronic copy of such information to
the extent the electronic copy wasreadily producible by the covered
entity. The Rule provides significant
flexibility to covered entities inhonoring individuals’ request forelectronic access. While a covered entity
must provide some type of electronic
copy to an individual who requests one,a covered entity is not required toprovide the exact form of the copy oraccess requested by the individual if it
is not readily producible in such form.
Thus, covered entities may provide
readily producible electronic copies ofprotected health information that are
currently available on their various

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

systems. A covered entity is not
required to purchase new software orsystems in order to accommodate anelectronic copy request for a specificform that is not readily producible by
the covered entity at the time of therequest, provided that the covered entity
is able to provide some form ofelectronic copy. Further, in cases where
an individual chooses not to accept theelectronic copy that is readily
producible by the covered entity, a hard
copy may be offered.
We did hear from several commentersthat some legacy or other systems, whilecapable of producing a hard copy as
previously required under the existing
access requirement, may not be capableof producing any electronic copy atpresent. In these cases, covered entities
may incur some cost burden in order topurchase software or hardware to
produce some kind of electronic copy
for electronic information held indesignated record sets on such legacy
systems. However, covered entities are
not required to purchase additional
software or hardware to meet
individuals’ specific requests, as long as
at least one type of electronic copy isavailable. We anticipate some cost will
be incurred by covered entities withsuch systems; however we did notreceive comments on the extent of thesecosts, or the number of covered entities
with legacy systems that will need toincur such costs.
d. Right To Restrict Certain Disclosures
to a Health Plan
The final rule requires that a covered
health care provider agree in most cases
to an individual’s request to restrict
disclosure to a health plan of theindividual’s protected healthinformation that pertains to a healthcare service for which the individual
has paid the health care provider in fullout of pocket. This is a change from theprior rule, which provided individuals
with the right to request a restriction on
certain disclosures; however, a covered
entity was not required to agree to therestriction, whatever the circumstances.
We do not believe that covered healthcare providers will incur substantial
costs to implement this expanded rightfor a number of reasons. First, in order
to comply with the rule prior to thischange, a covered entity is alreadyrequired to have processes andprocedures in place for accepting andconsidering individuals’ requests for
restrictions, even if, as a general matter,the covered entity declines to agree tosuch requests. This final rule does not
require new or different processes forreceiving and reviewing requests for
restrictions, just that the covered entity

PO 00000

Frm 00117

Fmt 4701

Sfmt 4700

5681

honor, in most cases, a self-pay patient’s
request for a restriction to a health plan.
Second, for those covered health careproviders that do not currently, but will
now be required to, accommodate
requests by self-pay patients to restrict
disclosures to a health plan, the final
rule provides significant flexibility in
how providers are to honor anindividual’s request and the preamble
makes various clarifications in response
to comments as to how to operationalize
this new requirement. For example, thefinal rule makes clear that a health careprovider is not required to separate or
segregate records in order to ensure an
individual’s restriction request ishonored. Rather, the final rule leaves itto the discretion of the provider as to
how to flag information that is the
subject of a restriction. Further, the final
rule provides flexibility as to how
restriction requests for certain services,such as bundled services, are to behandled, as well as what reasonable
efforts should be made to obtain
payment from an individual whose
original form of payment has beendishonored, prior to resorting to billingthe health plan for the service. Finally,in response to comments regarding thepotential burden and cost of doing so,
the final rule does not require healthcare providers to inform downstream
providers who may receive theindividual’s protected healthinformation, such as a pharmacy or
specialist, of a restriction, given the lackof automated technologies to support
such a requirement.
Notwithstanding the above, we
acknowledge that there will be some
additional burden on certain health careproviders to ensure an individual’srequest to restrict a disclosure to ahealth plan is honored where such arequest would not have been honored in
the past. However, we do not have data
to inform quantifying an estimated costin this area. For example, we do nothave data on the number of providers
that currently accommodate requests
from self-pay patients to restrict
disclosures versus those that do not, thenumber of requests that covered healthcare providers receive today that would
now require a restriction, nor even thenumber of requests for restrictions
generally that covered health careproviders currently receive.
e. Impact of the Genetic Information
Underwriting Prohibition on Health
Plans
The final rule prohibits health plansthat are HIPAA covered entities, except
issuers of long term care policies, fromusing or disclosing an individual’s
protected health information that is

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5682

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

genetic information for underwriting
purposes. As we explained in the
proposed rule, the rule does not affecthealth plans that do not currently use or
disclose protected health information
for underwriting purposes. Further,even with respect to health plans that
perform underwriting, plans and issuersin the group market previously
commented to the Department that they
do not, even prior to the passage of
GINA, use genetic information forunderwriting purposes because preGINA laws and regulations prohibit
them from discriminating against
individuals based on any health status
related factors, including genetic
information. With respect to issuers in
the individual health insurance market,
the Department acknowledged in the
proposed rule that there may be moresignificant policy changes associatedwith the prohibition on using or
disclosing protected health informationthat is genetic information forunderwriting purposes. However, theDepartment explained in the proposed
rule that it did not have sufficient
information to determine the extent ofsuch changes, that is, to what extent
issuers in the individual healthinsurance market use genetic
information for underwriting purposes.
Regardless, as we explained in the
proposed rule, in the case of either theindividual or group market, theDepartment assumed, because aprohibited use or disclosure of genetic
information for underwriting purposes
would also be a discriminatory use ofsuch information under thenondiscrimination provisions of GINA
Title I and its implementing regulations,that there would be no costs associatedwith conforming a plan’s practices tocomply with the underwritingprohibition that are above and beyond
the costs associated with complying
with the regulations implementing
sections 101–103 of GINA. With respect
to the health plans not covered by GINA
but subject to the proposed prohibitionin the Privacy Rule, the Department also
assumed that the costs to comply would
be minimal because such plans either:(1) do not perform underwriting, as is
the case generally with public benefit
plans; or (2) perform underwriting but
do not in most cases use genetic
information (including family medical
history) for such purposes.
In general, most comments in
response to the proposed rule did notprovide information that contradicted
the above assumptions. However,concern was expressed regarding theadverse impact of such an underwritingprohibition on the long-term care

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

market. Given the concern regarding theimpact of the underwriting prohibitionon the long-term care market, the final
rule exempts such plans from theprohibition. Thus, there are no costs to
be attributed to long term care plans
with this rule. Further, given we did notreceive other comments that would lead
us to question the underlying
assumptions in the proposed rule, we
do not expect this provision of the final
rule to result in substantial new costs on
health plans, particularly those thathave been required to comply with theregulations implementing GINA’s
nondiscrimination provisions forseveral years now.
f. Enforcement Provisions
The amendments contained within
this final rule to the HIPAA
Enforcement Rule conform theregulatory language of the Rule to theenhanced enforcement provisions of the
HITECH Act. Consistent with its
reasoning in prior HIPAA Enforcement
rulemakings,41 the Department expects
the costs covered entities, and now
business associates, may incur withrespect to their compliance with the
Enforcement Rule, itself, should be low
in most cases. That is, covered entities
and business associates that comply
with the HIPAA rules voluntarily, as is
expected, should not incur any
additional, significant costs as a resultof the Enforcement Rule. Further, we
believe the increased penalties andother enhancements provided by the
HITECH Act and which are reflected inthis final rule provide even more
incentive to covered entities andbusiness associates to take steps
necessary to comply and thus not beliable for violations.
D. Qualitative Analysis of Unquantified
Benefits
While we are certain that theregulatory changes in this final rule
represent significant benefits, we cannot
monetize their value. Many commenters
agreed with our assumptions regarding
the benefits to individuals, but we did
not receive any comments that included
specific information about quantifying
those benefits. The following sections
describe in greater detail the qualitative
benefits of the final rule. In addition to
greater privacy protections forindividuals, these benefits include theresults of our efforts to reduce burdens.
Consistent with E.O. 13563, we
conducted a retrospective review of ourregulations and identified areas, such as
41 See the preambles to the proposed and final
Enforcement Rules at 70 FR 20224, 20248–49 (April
18, 2005) and 71 FR 8390, 8424 (February 16, 2006).

PO 00000

Frm 00118

Fmt 4701

Sfmt 4700

certain research authorization
requirements and disclosures to schools
regarding childhood immunizations, inwhich we could decrease costs andincrease flexibilities under the HIPAA
Rules. The resulting changes are
discussed below.
1. Greater Privacy Protections for
Individuals
The benefits for individuals include
added information on their rights
through an expanded NPP, and greaterrights with regard to the uses anddisclosures of their personal healthinformation through expanded
requirements to: (1) Obtain
authorization before a covered entity or
business associate may disclose theirprotected health information in
exchange for remuneration, (2) restrictcertain disclosures to a health plan at
the request of the individual, (3)strengthen the ability of individuals to
opt out of further fundraisingcommunications, and (4) limit uses anddisclosures of protected healthinformation for marketing. Individuals
also will benefit from increased
protection against discrimination basedon their genetic information, achieved
through the prohibition against healthplans using or disclosing protected
health information that is genetic
information for underwriting purposes.
Individuals also will have increased
access to their protected healthinformation in an electronic format.
Finally, under the rule, individuals’
health information will be afforded
greater protection by business associatesof covered entities who share liability
and responsibility with the covered
entity for safeguarding against
impermissible uses and disclosures ofprotected health information.
2. Breach Notification
The analysis of benefits of the breach
notification regulation is as stated in theinterim final rule. In summary, we
stated that notifying individuals affectedby a breach would alert them to andenable them to mitigate potential harms,
such as identity theft resulting from theexposure of certain identifiers, andreputational harm that may result fromthe exposure of sensitive medical
information. Further, the breach
notification requirements provide
incentive to covered entities andbusiness associates to better safeguard
protected health information, such as byencrypting the information, where
possible.
We also believe that the modifications
to the definition of breach to remove theharm standard and revise the risk
assessment will ensure that covered

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
entities and business associates apply
the rule in a more objective and uniform
manner. We believe that thesemodifications will make the rule easierfor covered entities and businessassociates to implement and will result
in consistency of notification acrossentities which will benefit consumers.

sroberts on DSK5SPTVN1PROD with

3. Compound Authorizations for
Research Uses and Disclosures
We proposed to permit compound
authorizations for the use or disclosureof protected health information for
conditioned and unconditioned
research activities provided that theauthorization clearly differentiates
between the conditioned andunconditioned research components
and clearly allows the individual theoption to opt in to the unconditioned
research activities. We believed that the
proposed provision would reduceburden and costs on the researchcommunity by eliminating the need for
multiple forms for research studies
involving both a clinical trial and a
related biospecimen banking activity or
study and by harmonizing the Privacy
Rule’s authorization requirements with
the informed consent requirements
under the Common Rule. This change to
the Rule had long been sought by the
research community. While we
expected burden reduction and costsavings due to these modifications, we
had no data which to quantify an
estimate of such savings. We requested
comment on the anticipated savings that
this change would bring to the researchcommunity.
As explained above, the final rule
adopts the proposal to permit
compound research authorizations.
While almost all commenters on this
topic were supportive and agreed thatthe change would result in reduced
burdens and costs due to a reduction informs and harmonization with theCommon Rule, we did not receive
significant comment that could informour quantifying the anticipated costsavings associated with thismodification.
4. Authorizations for Future Research
Uses or Disclosures
We requested comment on the
Department’s previous interpretationthat an authorization for research usesand disclosures must include a
description of each purpose of therequested use or disclosure that is study
specific, and the possibility ofmodifying this interpretation to allow
for the authorization of future researchuses and disclosures. We believed that
this change in interpretation would
reduce burden on covered entities and

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

researchers by reducing the need forresearchers to obtain multiple
authorizations from the same individualfor research and further harmonizing thePrivacy Rule authorization requirementswith the informed consent requirements
under the Common Rule.
The final rule adopts the newinterpretation to allow covered entities
to obtain authorizations for future
research uses and disclosures to theextent such purposes are adequately
described in the authorization such that
it would be reasonable for theindividual to expect that his or her
protected health information could be
used or disclosed for such future
research. While we did receive
comments supporting our assertions
that permitting authorizations for future
research uses and disclosures would
reduce burden to covered entities andresearchers by obviating the need forresearchers to seek out past research
participants to obtain authorization for
future studies which they may be able
to authorize at the initial time ofenrollment into a study, andadditionally by reducing the waivers ofauthorization that researchers would
need to obtain from Institutional Review
Boards, we did not receive specificcomment on cost savings that could
inform our quantifying the savings inthis final rule.
5. Period of Protection for Decedent
Information
We proposed to modify the current
rule to limit the period for which acovered entity must protect anindividual’s health information to 50
years after the individual’s death. We
believed this would reduce the burden
on both covered entities and thoseseeking the protected health informationof persons who have been deceased formany years by eliminating the need tosearch for and find a personal
representative of the decedent, who inmany cases may not be known or evenexist after so many years, to authorize
the disclosure. We believed this change
would also benefit family members andhistorians who may seek access to the
medical information of these decedents
for personal and public interest reasons.
However, we lacked any data to be able
to estimate the benefits (or any
unanticipated costs) of this provisionand requested comment on theseassertions.
The final rule adopts the modification
to limit the period of protection fordecedent health information to 50 years
after the date of death. While mostcomments responding to this proposal
were very supportive of the change,
agreeing with the anticipated benefits

PO 00000

Frm 00119

Fmt 4701

Sfmt 4700

5683

the Department had articulated (i.e.,easier access to old or ancient patient
health information by family, historians,
archivists), the comments did notprovide specific information that could
inform our quantifying a cost-savings orreduction in burden associated with thischange in policy.
The Department did receive onecomment asserting that covered entities
may keep decedent information,
particularly the information of famous
individuals, for longer than 50 years
past the date of death in order tomonetize those records. The commentercited an example of an x-ray of a
deceased celebrity being sold at an
auction for $45,000. However, we do not
anticipate that this is or will be a typicalscenario.
6. Disclosures About a Decedent
We proposed to permit covered
entities to disclose a decedent’s
protected health information to family
members and others who were involvedin the care or payment for care prior to
the decedent’s death, unless doing so isinconsistent with any prior expressed
preference of the individual that is
known to the covered entity. In thepreamble to the proposed rule, we
stated our belief that the proposedchange would reduce burden bypermitting covered entities to disclose
protected health information about adecedent to family members and otherpersons who were involved in an
individual’s care while the individual
was alive, without having to obtainwritten permission in the form of an
authorization from the decedent’s
personal representative, who may not beknown or even exist, and may be moredifficult to locate as time passes.
However, we had no data to permit us
to estimate the reduction in burden andrequested public comment on this issue.
The final rule adopts the modification
as proposed. However, as with theproposed rule, we are unable to quantify
any cost-savings with respect thischange. While commenters confirmedthat permitting such disclosures would
help facilitate communications withfamily members and other persons who
were involved in an individual’s care or
payment for care prior to death, we did
not receive any information that could
inform estimating a savings.
7. Public Health Disclosures
We proposed to create a new publichealth provision to permit disclosure of
proof of a child’s immunization by acovered entity to a school in States thathave school entry or similar laws. This
proposed change would have allowed acovered health care provider to release

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5684

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

proof of immunization to a school
without having to obtain a written
authorization, provided the provider
obtained the agreement, which may be
oral, to the disclosure from a parent,
guardian or other person acting in loco
parentis for the individual, or from theindividual, if the individual was anadult or emancipated minor. We
anticipated that the proposed change tothe regulations would reduce theburden on parents, schools, and covered
entities in obtaining and providing
written authorizations, and would
minimize the amount of school missedby students. However, because welacked data on the burden reduction, wewere unable to provide an estimate of
the possible savings and requested
comment on this point.
The final rule adopts the proposal topermit covered entities to disclose, withthe oral or written agreement of a parent
or guardian, a child’s proof of
immunization to schools in States thathave school entry or similar laws. Thisobviates the need for a covered entity toreceive formal, executed HIPAA
authorizations for such disclosures.
While the final rule requires thatcovered entities document theagreement, the final rule is flexible anddoes not prescribe the nature of the
documentation and does not requiresignature by the parent, allowing
covered entities the flexibility todetermine what is appropriate for their
purposes. For example, as the preamble
indicates above, if a parent or guardiansubmits a written or email request to acovered entity to disclose their child’s
immunization records to the child’s
school, a copy of the request would
suffice as documentation of theagreement. Likewise, if a parent or
guardian calls the covered entity andrequests over the phone that theirchild’s immunization records bedisclosed to the child’s school, anotation in the child’s medical record or
elsewhere of the phone call would
suffice as documentation of theagreement.
Given that the rule no longer requires
a formal, executed HIPAA authorization
for such disclosures and provides
significant flexibility in the form of the
documentation required of a parent’s orguardian’s agreement to the disclosure,
this modification is expected to result in
reduced burden and cost to covered
health care providers in making these
disclosures, as well as to the parents
and schools involved in the process. We
acknowledge that covered health careproviders who wish to use these lessformal processes in lieu of theauthorization will need to explain their
new procedure to office staff. However,

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

given the provision’s flexibility andnarrow scope, we do not expect that theproviders will need to do more thanensure office staff have a copy of the
new procedure. Further, any one-timecosts to develop and deploy the newprocedure will be offset by the savings
that are expected to accrue from thechange over time as the disclosures arecarried out. While we acknowledge theoverall savings associated with thischange, as with other provisions in thisrule providing increased flexibility forcompliance, we are unable to quantify
them. For example, we do not have dataon how many family doctors and otherproviders generally make these types of
disclosures and how many requests
such providers generally receive for
proof of immunization, and we did notreceive data from commenters that
could inform our estimating savings inthis area.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The Regulatory Flexibility Act
requires agencies to analyze andconsider options for reducing regulatoryburden if the regulation will impose asignificant burden on a substantial
number of small entities. The Act
requires the head of the agency to either
certify that the rule would not impose
such a burden or perform a regulatory
flexibility analysis and consider
alternatives to lessen the burden.
For the reasons stated below, it is notexpected that the cost of compliancewill be significant for small entities. Nor
is it expected that the cost ofcompliance will fall disproportionately
on small entities. Although many of thecovered entities and business associates
affected by the rule are small entities,
they do not bear a disproportionate costburden compared to the other entities
subject to the rule. Further, with respect
to small business associates, only thefraction of these entities that has notmade a good faith effort to comply withexisting requirements will experience
additional costs under the rule. The
Department did not receive any
comments on its certification in the
proposed rules. Therefore, the Secretarycertifies that this rule will not have asignificant economic impact on asubstantial number of small entities.
The RFA generally defines a ‘‘small
entity’’ as (1) a proprietary firm meetingthe size standards of the Small Business
Administration (SBA), (2) a nonprofit
organization that is not dominant in its
field, or (3) a small government
jurisdiction with a population of lessthan 50,000. The SBA size standard for
health care providers ranges between

PO 00000

Frm 00120

Fmt 4701

Sfmt 4700$7.0 million and $34.5 million in
annual receipts. Because 90 percent ormore of all health care providers meet
the SBA size standard for a small
business or are nonprofit organizations,
we generally treat all health careproviders as small entities for purposesof performing a regulatory flexibility
analysis.
With respect to health insurers andthird party administrators, the SBA size
standard is $7.0 million in annual
receipts. While some insurers areclassified as nonprofit, it is possible
they are dominant in their market. For
example, a number of Blue Cross/Blue
Shield insurers are organized as
nonprofit entities; yet they dominate thehealth insurance market in the States
where they are licensed and therefore
would not be considered small
businesses. Using the SBA’s definitionof a small insurer as a business with lessthan $7 million in revenues, premiums
earned as a measure of revenue,42 anddata obtained from the National
Association of InsuranceCommissioners,43 the Department
estimates that approximately 276 out of
730 insurers had revenues of less than
$7 million.44
From the approximately $225.4
million (upper estimate) in costs we areable to identify, the cost per covered
entity may be as low as $80 (for the vast
majority of covered entities) and as highas $843 (for those entities thatexperience a breach), and we estimatethat the cost per affected businessassociate will be between $84.32 and$282. These costs are discussed in detailin the regulatory impact analysis andbelow. We do not view this as asignificant burden because, for example,
even the highest average compliancecost per covered entity we haveidentified ($843) represents just
0.0001% of annual revenues for a small
entity with only $7 million in receipts(see the low end of SBA’s size standard
for health care providers). We include
750 third party administrators in thecalculation of covered entities, torepresent approximately 2.5 million
ERISA plans,45 most of which are small
entities, on whose behalf they carry our
42 U.S. Small Business Administration, ‘‘Table of
Small Business Standards Matched to North
American Industry Classification System Codes,’’available at http://www.sba.gov/content/smallbusiness-size-standards.
43 HHS ASPE analysis of 2010 NAIC
Supplemental Health Care Exhibit Data.
44 These counts could be an overestimate. Only
health insurance premiums from both the groupand individual market were counted. If insurers
also offered other types of insurance, their revenues
could be higher.
45 Source: 2010 Medical Expenditure Survey—
Insurance Component.

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
compliance activities. We have no
information on how many of these plansself-administer, and we did not receive
any information from commenters inthis area and so do not include a
separate estimate for plans that selfadminister.
We estimate that the breach
notification requirements will result in$14.5 million in annual costs to covered
entities. Dividing that amount by theapproximately 19,000 entities that will
actually experience a breach ofprotected health information each year,
we estimate that the costs of complying
with the breach notification
requirements will amount to, on
average, $763 per covered entity thatmust respond to a breach. Smaller
covered entities likely will face much
lower costs, as these entities generally
have protected health information forfar fewer individuals than do larger
covered entities and breach notification
costs are closely linked to the numberof individuals affected by a given breach
incident.
The other source of costs for covered
entities arises from the requirement toprovide revised NPPs to the individuals
they serve. We estimate that theapproximately 700,000 covered entities
will experience total costs ofapproximately $55.9 million forcompliance with the NPP requirements,
or about $80 per covered entity.
We estimate the costs for 200,000–
400,000 business associates to come intofull compliance with the Security Rule
to be approximately $22.6–$113 million.
The average cost per affected businessassociate would be approximately $198.
Finally, we estimate that 250,000 to
500,000 business associates will incur
costs totaling between $21 million and$42 million, respectively, to establish or
significantly modify contracts with
subcontractors to be in compliance withthe rule’s requirements for businessassociate agreements. The average cost
per business associate would beapproximately $84.
Based on the relatively small cost per
covered entity and per businessassociate, the Secretary certifies that theRule will not have a significant impact
on a substantial number of small
entities. Still, we considered andadopted several solutions for reducing
the burden on small entities.
First, we combined several required
rules into one rulemaking, which willallow affected entities to revise anddistribute their notices of privacy
practices at one time rather thanmultiple times, as each separate rule
was published. Second, in the final rule
we increase flexibility for health plansby allowing them to send the revised

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

notices with their annual mailings
rather than requiring plans to send themto individuals in a separate mailing.
Third, we allow covered entities andbusiness associates with existing HIPAA
compliant contracts twelve months fromthe date of the rule to renegotiate theircontracts unless the contract isotherwise renewed or modified before
such date. This amount of time plus theeight months from the publication dateof the rule to the compliance dategenerally gives the parties 20 months torenegotiate their agreements. We believethat the added time will reduce the costto revise agreements because thechanges the rule requires will beincorporated into the routine updatingof covered entities’ and businessassociates’ contracts.
Finally, the Department has also
published on its web site sample
language for revising the contracts
between covered entities and businessassociates. While the language is genericand may not suit all entities andagreements, particularly larger entities
and those with more complex business
relationships, we believe that it will
particularly help small entities with
their contract revisions and save themtime and money in redrafting theircontracts to conform to the rule.
2. Unfunded Mandates Reform Act
Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipatedcosts and benefits before issuing any
rule whose mandates would require
spending in any one year $100 million
in 1995 dollars, updated annually for
inflation. In 2011, that threshold isapproximately $136 million. UMRA
does not address the total cost of a rule.
Rather, it focuses on certain categories
of cost, mainly those ‘‘Federal mandate’’costs resulting from: (1) Imposing
enforceable duties on State, local, orTribal governments, or on the private
sector; or (2) increasing the stringency ofconditions in, or decreasing the fundingof, State, local, or Tribal governments
under entitlement programs.
We are able to identify between $114
and $225.4 million in costs on both theprivate sector and State and Federal
entities for compliance with the final
modifications to the HIPAA Privacy andSecurity Rules, and for compliance withthe final Breach Notification Rule. As
stated above, there may be other costs
we are not able to monetize because welack data, and the rule may produce
savings that may offset some or all of theadded costs. We must also separately
identify costs to be incurred by theprivate sector and those incurred by
State and Federal entities.

PO 00000

Frm 00121

Fmt 4701

Sfmt 4700

5685

Some of the costs of the regulation
will fall on covered entities, which areprimarily health care providers andhealth plans.46 For the purpose of thesecalculations, we included all provider
costs as private sector costs. While we
recognize that some providers are Stateor Federal entities, we do not haveadequate information to estimate thenumber of public providers, but webelieve the number to be significantly
less than 10 percent of all providers
shown in Table 1. Therefore, as we didfor the RFA analysis and for ease of
calculation, we assumed that all
provider costs are private sector costs.
We did not receive any comments on
this assumption.
With respect to health plans, based on
the data discussed in section C, we
estimate that 60 percent of policy
holders are served by private sector
health plans and 40 percent of policy
holders are served by public sectorplans. Therefore, we attribute 60 percentof health plan costs to the private sector
and 40 percent of plan costs to the
public sector.
The remaining costs of complying
with the regulation will be borne bybusiness associates of covered entities.
We do not have data with which toestimate the numbers of private versus
public entity business associates.
However, we believe that the vast
majority of, if not all, businessassociates, are private entities.
Therefore, we assumed all businessassociate costs are private sector costs.
Of the specific costs we can identify,
we estimate that approximately 91
percent of all costs, or between $103.7
and $205 million, will fall on private
sector health care providers, healthplans, and business associates. The
remaining costs, approximately $10.3–
20.4 million, will fall on public sector
health plans. The following paragraphs
outline the distribution of costs arisingfrom the four cost-bearing elements ofthe final rule: (1) Covered entities must
revise and distribute notices of privacy
practices, (2) Covered entities thatexperience a breach of protected healthinformation must comply with thebreach notification requirements, (3)certain business associates must revise
contracts with subcontractors to meetbusiness associate agreement
requirements, and (4) Certain businessassociates must make efforts to achieve
full compliance with the administrativerequirements of the Security Rule.
46 Another type of covered entity, health careclearinghouses, generally will not bear these costs,
as clearinghouses are not required to provide a
notice of private practices to individuals and are
involved in a miniscule fraction of breach
incidents, if any.

E:\FR\FM\25JAR2.SGM

25JAR2

5686

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

We estimate the costs for to comply
with the NPP provisions will reachabout $55.9 million, which will beshared by providers and health plans.
Providers will bear approximately $40.4
million of these costs, all of which we
attribute to the private sector. Healthplans will bear approximately $15.5
million and, as explained above, wehave allocated 60 percent of health plan
costs for NPPs, or $9.3 million, as
private sector costs. Public plans willbear the remaining $6.2 million.
We estimate that private entities willbear 93 percent of the costs ofcompliance with the breach notification
requirements, or about $13.5 million.
This is because the majority of breach
reports are filed by health careproviders, all of whose costs weattribute to the private sector. Consistent
with our estimate that 60 percent ofhealth plan members are enrolled in
private sector plans, we also include asprivate costs 60 percent of the breach
notification costs borne by health plans(based on the number of health plansthat have filed breach reports).
Finally, we estimate that all of thecosts for business associates to create orrevise business associate agreementswith subcontractors ($42 million outer
estimate), and to come into fullcompliance with the Security Rule($113 million outer estimate), will beprivate sector costs.
As the estimated costs to private
entities alone may exceed the $136
million threshold, UMRA requires us toprepare an analysis of the costs andbenefits of the rule. We have alreadydone so, in accordance with Executive
Orders 12866 and 13563, and present
this analysis in sections C and D.

3. Federalism
Executive Order 13132 establishes
certain requirements that an agency
must meet when it promulgates a rulethat imposes substantial direct
requirement costs on State and local
governments, preempts State law, orotherwise has Federalism implications.
The Federalism implications of thePrivacy and Security Rules wereassessed as required by Executive Order13132 and published as part of thepreambles to the final rules on
December 28, 2000 (65 FR 82462,
82797) and February 20, 2003 (68 FR
8334, 8373), respectively. Regarding
preemption, the preamble to the final
Privacy Rule explains that the HIPAA
statute dictates the relationship between
State law and Privacy Rulerequirements. Therefore, the Privacy
Rule’s preemption provisions do notraise Federalism issues. The HITECH
Act, at section 13421(a), provides thatthe HIPAA preemption provisions shallapply to the HITECH provisions andrequirements. While we have mademinor technical changes to thepreemption provisions in Subpart B ofPart 160 to conform to and incorporate
the HITECH Act preemption provisions,these changes do not raise newFederalism issues. The changes include:(1) Amending the definitions of‘‘contrary’’ and ‘‘more stringent’’ toreference business associates; and (2)further amending the definition ofcontrary to provide that State law would
be contrary to the HIPAA
Administrative Simplification
provisions if it stands as an obstacle tothe accomplishment and execution of
the full purposes and objectives of not
only HIPAA, but also the HITECH Act.

We do not believe that the rule will
impose substantial direct compliancecosts on State and local governmentsthat are not required by statute. It is ourunderstanding that State and local
government covered entities do not
engage in marketing, the sale ofprotected health information, or
fundraising. Therefore, themodifications in these areas would notcause additional costs to State and local
governments. We anticipate that themost significant direct costs on Stateand local governments will be the costfor State and local government-owned
covered entities of drafting, printing,and distributing revised notices ofprivacy practices, which would include
the cost of mailing these notices forState health plans, such as Medicaid.
However, the costs involved can be
attributed to the statutory requirements,
which provide individuals withstrengthened rights about which theyneed to be notified.
In considering the principles in andrequirements of Executive Order 13132,
the Department has determined thatthese modifications to the Privacy andSecurity Rules will not significantly
affect the rights, roles, andresponsibilities of the States.
F. Accounting Statement
Whenever a rule is considered asignificant rule under Executive Order
12866, we are required to develop an
accounting statement indicating thecosts associated with promulgating therule. Below, we present overallmonetary annualized costs discounted
at 3 percent and 7 percent as describedin the Regulatory Impact Analysis.

ESTIMATED COSTS OF THE FINAL RULE
[In 2011 millions]Primary
estimate($M)

Costs (annualized)

sroberts on DSK5SPTVN1PROD with

Discounted @7% .............................................................................................................
@3% ................................................................................................................................

In the RIA, we acknowledged several
potential sources of costs that we wereunable to quantify. Because we have noway to determine the extent to which
entities currently engage in certain
activities for which they now needauthorization, or who will need to takeon a new burden because of the rule, wecannot predict the magnitude of thesecosts with any certainty. These potential
sources of cost include:
1. Potential lost revenue to covered
entities who forgo making certain

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

subsidized health-related
communications to individuals rather
than obtain those individuals’
authorization for such communications;
2. Costs to researchers to obtain
authorization to make incentive
payments (above the costs to prepare thedata) to covered entities to produce dataor, alternatively, a loss in revenue forcovered entities who agree to accept
only the costs to prepare and transmit
the data;

PO 00000

Frm 00122

Fmt 4701

Sfmt 4700

Minimum
estimate
($M)
42.8
35.2

34.8
28.7

Maximum
estimate
($M)
50.6
41.7

3. Potential costs to certain covered
entities who purchase software or
hardware to allow them to produce anelectronic copy of individuals’ protected
health information; and4. The burden to some health careproviders of ensuring that anindividual’s request to restrict a
disclosure to a health plan is honored
where it might not have been before thefinal rule.
While we are certain the changes inthis final rule also represent distinct

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
benefits to individuals with regard to
the privacy and security of their healthinformation, and with regard to theirrights to that information, we are unable
to quantify the benefits. Other expected
qualitative benefits, which are describedin detail above, include savings due toprovisions simplifying and streamlining
requirements and increasing flexibility.
Such savings arise from:
1. Eliminating the need for multiple
forms for certain research studies bypermitting compound authorizations;
2. Obviating the need to find past
research participants and obtain new
authorizations for new research byallowing individuals to authorize future
research uses and disclosures at thetime of initial enrollment;
3. Limiting the period of protection
for decedent information to permit
family members and historians to obtain
information about a decedent without
needing to find a personal
representative of the deceased
individual to authorize the disclosure;
4. Permitting disclosures to a
decedent’s family members or others
involved in the care or payment for careprior to the decedent’s death; and5. Permitting covered entities todocument a parent’s informal agreement
to disclose immunization information toa child’s school rather than requiring asigned authorization form.
VIII. Collection of Information
Requirements
This final rule contains the following
information collections (i.e., reporting,recordkeeping, and third-party
disclosures) under the Paperwork
Reduction Act. Some of those
provisions involve changes from theinformation collections set out in the
proposed and interim final rules. Thesechanges are noted below.

sroberts on DSK5SPTVN1PROD with

A. Reporting• Notification to the Secretary of
breaches of unsecured protected healthinformation (§ 164.408). In the final
rule, we revise our estimated number of
respondents and responses to reflect ourexperience administering the interim
final rule.
B. Recordkeeping• Documentation of safeguards andpolicies and procedures under the
Security Rule (§ 164.316). In the
proposed rule, we assumed that all
business associates were in compliancewith the Security Rule’s documentation
standard because of their contractual
obligations to covered entities under the
HIPAA Rules. In the final rule, we
recognize that a minority of businessassociates, who have not previously

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

5687

maintained documentation of theirpolicies and procedures andadministrative safeguards under the
Security Rule, may experience a burden
coming into compliance with the
documentation standard for the firsttime because they are now subject todirect liability under the Security Rule.
• Business Associate Agreements(§ 164.504(e)). We assumed in the
proposed rule that business associates
and their subcontractors werecomplying with their existing
contractual obligations but
acknowledged that some contracts
would have to be modified to reflectchanges in the law. We requested
comments on how many entities would
be unable able to revise contracts, in thenormal course of business, within thephase-in period. We did not receive
comments that would allow us to makea specific estimate; nonetheless, in the
final rule we assume that a significant
minority of business associates willneed to revise their business associateagreements with subcontractors (orestablish such agreements for the firsttime if they were not previously incompliance).

List of Subjects

C. Third-Party Disclosures■ 1. The authority citation for part 160• Breach notification to affectedindividuals and the media (§§ 164.404 &164.406). We revise our estimates of thenumbers of breaches, covered entities,
and individuals affected to reflect ourexperience in administering the breach
notification requirements under theinterim final rule.
• Revision and dissemination ofnotices of privacy practices forprotected health information(§ 164.520). Our burden estimates forthis provision in the proposed rule werebased on the requirement for covered
entities to send a separate mailingcontaining the new notice to each policy
holder. As part of an effort to reduceoverall burden, the final rule instead
permits health plans to send the revised
notice of privacy practices in their next
annual mailing to policy holders,allowing them to avoid additional
distribution burdens. We also revise theestimated number of affected covered
entities based on updated informationfrom the Department of Labor and the
Small Business Administration.
In addition to the changes
summarized above, the informationcollections described in this final rule
have been submitted to the Office ofManagement and Budget for review andapproval.

is revised to read as follows:

PO 00000

Frm 00123

Fmt 4701

Sfmt 4700

45 CFR Part 160
Administrative practice andprocedure, Computer technology,
Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Healthfacilities, Health insurance, Healthrecords, Hospitals, Investigations,
Medicaid, Medical research, Medicare,
Penalties, Privacy, Reporting and record
keeping requirements, Security.
45 CFR Part 164
Administrative practice andprocedure, Computer technology,
Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Healthfacilities, Health insurance, Healthrecords, Hospitals, Medicaid, Medical
research, Medicare, Privacy, Reporting
and record keeping requirements,
Security.
For the reasons set forth in thepreamble, the Department amends 45
CFR Subtitle A, Subchapter C, parts 160
and 164, as set forth below:
PART 160—GENERALADMINISTRATIVE REQUIREMENTS

Authority: 42 U.S.C. 1302(a); 42 U.S.C.
1320d–1320d–9; sec. 264, Pub. L. 104–191,
110 Stat. 2033–2034 (42 U.S.C. 1320d–2(note)); 5 U.S.C. 552; secs. 13400–13424, Pub.
L. 111–5, 123 Stat. 258–279; and sec. 1104 of
Pub. L. 111–148, 124 Stat. 146–154.
■ 2. Revise § 160.101 to read as follows:§ 160.101

Statutory basis and purpose.

The requirements of this subchapter
implement sections 1171–1180 of theSocial Security Act (the Act), sections
262 and 264 of Public Law 104–191,
section 105 of Public Law 110–233,
sections 13400–13424 of Public Law
111–5, and section 1104 of Public Law
111–148.
■ 3. Amend § 160.102 as follows:■ a. Redesignate paragraph (b) as
paragraph (c); and■ b. Add new paragraph (b) to read as
follows:§ 160.102

Applicability.

*

*
*
*
*
(b) Where provided, the standards,
requirements, and implementation
specifications adopted under thissubchapter apply to a businessassociate.
*
*
*
*
*
■ 4. Amend § 160.103 as follows:■ a. Revise the definitions of ‘‘Businessassociate’’, ‘‘Compliance date’’,

E:\FR\FM\25JAR2.SGM

25JAR2

5688

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations‘‘Disclosure’’, ‘‘Electronic media’’, theintroductory text of the definition of‘‘Health information’’, paragraphs (1)(vi)
through (xi), and (xv) of the definitionof ‘‘Health plan’’, paragraph (2) of thedefinition of ‘‘Protected healthinformation,’’ and the definitions of‘‘Standard’’, ‘‘State’’, and ‘‘Workforce’’;and■ b. Add, in alphabetical order, newdefinitions of ‘‘Administrative
simplification provision’’, ‘‘ALJ’’, ‘‘Civil
money penalty or penalty’’, ‘‘Family
member’’, ‘‘Genetic information’’,‘‘Genetic services’’, ‘‘Genetic test’’,‘‘Manifestation or manifested’’,‘‘Respondent’’, ‘‘Subcontractor’’, and‘‘Violation or violate’’.
The revisions and additions read as
follows:§ 160.103

Definitions.

sroberts on DSK5SPTVN1PROD with

*

*
*
*
*
Administrative simplification
provision means any requirement or
prohibition established by:(1) 42 U.S.C. 1320d–1320d–4, 1320d–
7, 1320d–8, and 1320d–9;(2) Section 264 of Pub. L. 104–191;(3) Sections 13400–13424 of Public
Law 111–5; or(4) This subchapter.
ALJ means Administrative Law Judge.
*
*
*
*
*
Business associate: (1) Except asprovided in paragraph (4) of thisdefinition, business associate means,with respect to a covered entity, aperson who:(i) On behalf of such covered entity orof an organized health care arrangement(as defined in this section) in which thecovered entity participates, but otherthan in the capacity of a member of theworkforce of such covered entity or
arrangement, creates, receives,maintains, or transmits protected healthinformation for a function or activity
regulated by this subchapter, including
claims processing or administration,
data analysis, processing or
administration, utilization review,
quality assurance, patient safety
activities listed at 42 CFR 3.20, billing,
benefit management, practicemanagement, and repricing; or(ii) Provides, other than in thecapacity of a member of the workforceof such covered entity, legal, actuarial,
accounting, consulting, data aggregation(as defined in § 164.501 of thissubchapter), management,
administrative, accreditation, or
financial services to or for such covered
entity, or to or for an organized healthcare arrangement in which the covered
entity participates, where the provisionof the service involves the disclosure ofprotected health information from such

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

covered entity or arrangement, or fromanother business associate of suchcovered entity or arrangement, to theperson.
(2) A covered entity may be a businessassociate of another covered entity.
(3) Business associate includes:(i) A Health Information Organization,
E-prescribing Gateway, or other personthat provides data transmission services
with respect to protected healthinformation to a covered entity and that
requires access on a routine basis tosuch protected health information.
(ii) A person that offers a personal
health record to one or more individuals
on behalf of a covered entity.
(iii) A subcontractor that creates,
receives, maintains, or transmits
protected health information on behalfof the business associate.
(4) Business associate does notinclude:(i) A health care provider, withrespect to disclosures by a covered
entity to the health care provider
concerning the treatment of theindividual.
(ii) A plan sponsor, with respect todisclosures by a group health plan (orby a health insurance issuer or HMO
with respect to a group health plan) tothe plan sponsor, to the extent that therequirements of § 164.504(f) of thissubchapter apply and are met.
(iii) A government agency, withrespect to determining eligibility for, or
enrollment in, a government health planthat provides public benefits and isadministered by another government
agency, or collecting protected healthinformation for such purposes, to theextent such activities are authorized bylaw.
(iv) A covered entity participating inan organized health care arrangementthat performs a function or activity as
described by paragraph (1)(i) of thisdefinition for or on behalf of suchorganized health care arrangement, orthat provides a service as described inparagraph (1)(ii) of this definition to or
for such organized health carearrangement by virtue of such activities
or services.
Civil money penalty or penalty means
the amount determined under § 160.404
of this part and includes the plural ofthese terms.
*
*
*
*
*
Compliance date means the date bywhich a covered entity or businessassociate must comply with a standard,
implementation specification,requirement, or modification adopted
under this subchapter.
*
*
*
*
*
Disclosure means the release, transfer,provision of access to, or divulging in

PO 00000

Frm 00124

Fmt 4701

Sfmt 4700

any manner of information outside theentity holding the information.
*
*
*
*
*
Electronic media means:(1) Electronic storage material on
which data is or may be recorded
electronically, including, for example,
devices in computers (hard drives) andany removable/transportable digitalmemory medium, such as magnetic tapeor disk, optical disk, or digital memorycard;(2) Transmission media used to
exchange information already inelectronic storage media. Transmission
media include, for example, theInternet, extranet or intranet, leasedlines, dial-up lines, private networks,
and the physical movement ofremovable/transportable electronicstorage media. Certain transmissions,
including of paper, via facsimile, and ofvoice, via telephone, are not considered
to be transmissions via electronic media
if the information being exchanged did
not exist in electronic form immediately
before the transmission.
*
*
*
*
*
Family member means, with respect
to an individual:(1) A dependent (as such term isdefined in 45 CFR 144.103), of theindividual; or(2) Any other person who is a firstdegree, second-degree, third-degree, or
fourth-degree relative of the individual
or of a dependent of the individual.
Relatives by affinity (such as bymarriage or adoption) are treated thesame as relatives by consanguinity (thatis, relatives who share a common
biological ancestor). In determining thedegree of the relationship, relatives byless than full consanguinity (such as
half-siblings, who share only one
parent) are treated the same as relatives
by full consanguinity (such as siblings
who share both parents).
(i) First-degree relatives include
parents, spouses, siblings, and children.
(ii) Second-degree relatives include
grandparents, grandchildren, aunts,
uncles, nephews, and nieces.
(iii) Third-degree relatives include
great-grandparents, great-grandchildren,
great aunts, great uncles, and firstcousins.
(iv) Fourth-degree relatives include
great-great grandparents, great-great
grandchildren, and children of firstcousins.
Genetic information means:(1) Subject to paragraphs (2) and (3)of this definition, with respect to anindividual, information about:(i) The individual’s genetic tests;(ii) The genetic tests of family
members of the individual;

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations(iii) The manifestation of a disease ordisorder in family members of suchindividual; or(iv) Any request for, or receipt of,genetic services, or participation inclinical research which includes genetic
services, by the individual or any family
member of the individual.
(2) Any reference in this subchapter togenetic information concerning an
individual or family member of anindividual shall include the genetic
information of:(i) A fetus carried by the individual orfamily member who is a pregnant
woman; and(ii) Any embryo legally held by anindividual or family member utilizing
an assisted reproductive technology.
(3) Genetic information excludes
information about the sex or age of any
individual.
Genetic services means:(1) A genetic test;(2) Genetic counseling (including
obtaining, interpreting, or assessing
genetic information); or(3) Genetic education.
Genetic test means an analysis ofhuman DNA, RNA, chromosomes,
proteins, or metabolites, if the analysis
detects genotypes, mutations, or
chromosomal changes. Genetic test does
not include an analysis of proteins or
metabolites that is directly related to amanifested disease, disorder, or
pathological condition.
*
*
*
*
*
Health information means any
information, including genetic
information, whether oral or recorded inany form or medium, that: * * *
*
*
*
*
*
Health plan means * * *(1) * * *(vi) The Voluntary Prescription Drug
Benefit Program under Part D of title
XVIII of the Act, 42 U.S.C. 1395w–101
through 1395w–152.
(vii) An issuer of a Medicare
supplemental policy (as defined in
section 1882(g)(1) of the Act, 42 U.S.C.
1395ss(g)(1)).
(viii) An issuer of a long-term carepolicy, excluding a nursing home fixedindemnity policy.
(ix) An employee welfare benefit planor any other arrangement that isestablished or maintained for the
purpose of offering or providing healthbenefits to the employees of two or more
employers.
(x) The health care program foruniformed services under title 10 of theUnited States Code.
(xi) The veterans health care program
under 38 U.S.C. chapter 17.
*
*
*
*
*

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(xv) The Medicare Advantage program
under Part C of title XVIII of the Act, 42
U.S.C. 1395w–21 through 1395w–28.
*
*
*
*
*
Manifestation or manifested means,with respect to a disease, disorder, or
pathological condition, that anindividual has been or could reasonably
be diagnosed with the disease, disorder,or pathological condition by a healthcare professional with appropriate
training and expertise in the field of
medicine involved. For purposes of thissubchapter, a disease, disorder, or
pathological condition is not manifested
if the diagnosis is based principally on
genetic information.
*
*
*
*
*
Protected health information * * *(2) Protected health information
excludes individually identifiable
health information:(i) In education records covered by
the Family Educational Rights andPrivacy Act, as amended, 20 U.S.C.
1232g;(ii) In records described at 20 U.S.C.
1232g(a)(4)(B)(iv);(iii) In employment records held by acovered entity in its role as employer;
and(iv) Regarding a person who has been
deceased for more than 50 years.
*
*
*
*
*
Respondent means a covered entity or
business associate upon which theSecretary has imposed, or proposes toimpose, a civil money penalty.
*
*
*
*
*
Standard means a rule, condition, or
requirement:(1) Describing the following
information for products, systems,
services, or practices:(i) Classification of components;(ii) Specification of materials,
performance, or operations; or(iii) Delineation of procedures; or(2) With respect to the privacy ofprotected health information.
*
*
*
*
*
State refers to one of the following:(1) For a health plan established or
regulated by Federal law, State has themeaning set forth in the applicablesection of the United States Code forsuch health plan.
(2) For all other purposes, State
means any of the several States, theDistrict of Columbia, theCommonwealth of Puerto Rico, theVirgin Islands, Guam, American Samoa,
and the Commonwealth of the Northern
Mariana Islands.
Subcontractor means a person towhom a business associate delegates afunction, activity, or service, other thanPO 00000

Frm 00125

Fmt 4701

Sfmt 4700

5689

in the capacity of a member of theworkforce of such business associate.
*
*
*
*
*
Violation or violate means, as thecontext may require, failure to comply
with an administrative simplification
provision.
Workforce means employees,
volunteers, trainees, and other persons
whose conduct, in the performance ofwork for a covered entity or businessassociate, is under the direct control ofsuch covered entity or businessassociate, whether or not they are paidby the covered entity or businessassociate.
■ 5. Add § 160.105 to subpart A to readas follows:§ 160.105 Compliance dates for
implementation of new or modified
standards and implementation
specifications.

Except as otherwise provided, withrespect to rules that adopt new
standards and implementation
specifications or modifications tostandards and implementation
specifications in this subchapter inaccordance with § 160.104 that become
effective after January 25, 2013, covered
entities and business associates mustcomply with the applicable newstandards and implementation
specifications, or modifications tostandards and implementation
specifications, no later than 180 days
from the effective date of any suchstandards or implementation
specifications.
■ 6. Revise § 160.201 to read as follows:§ 160.201

Statutory basis.

The provisions of this subpart
implement section 1178 of the Act,section 262 of Public Law 104–191,
section 264(c) of Public Law 104–191,
and section 13421(a) of Public Law 111–
5.
■ 7. In § 160.202, revise the definition of‘‘Contrary’’ and paragraph (1)(i) of thedefinition of ‘‘More stringent’’ to read as
follows:§ 160.202

Definitions.

*

*
*
*
*
Contrary, when used to compare aprovision of State law to a standard,requirement, or implementation
specification adopted under thissubchapter, means:(1) A covered entity or businessassociate would find it impossible tocomply with both the State and Federal
requirements; or(2) The provision of State law stands
as an obstacle to the accomplishment
and execution of the full purposes andobjectives of part C of title XI of the Act,

E:\FR\FM\25JAR2.SGM

25JAR2

5690

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

section 264 of Public Law 104–191, orsections 13400–13424 of Public Law
111–5, as applicable.
More stringent * * *(1) * * *(i) Required by the Secretary inconnection with determining whether acovered entity or business associate is incompliance with this subchapter; or
*
*
*
*
*
■ 8. Revise § 160.300 to read as follows:§ 160.300

Applicability.

This subpart applies to actions by the
Secretary, covered entities, businessassociates, and others with respect toascertaining the compliance by covered
entities and business associates with,and the enforcement of, the applicableprovisions of this part 160 and parts 162
and 164 of this subchapter.
§ 160.302[Removed and Reserved]■ 9. Remove and reserve § 160.302.
■ 10. Revise § 160.304 to read as§ 160.308

Compliance reviews.

(a) The Secretary will conduct acompliance review to determine
whether a covered entity or businessassociate is complying with theapplicable administrative simplification
provisions when a preliminary reviewof the facts indicates a possible violation
due to willful neglect.
(b) The Secretary may conduct acompliance review to determine
whether a covered entity or businessassociate is complying with theapplicable administrative simplification
provisions in any other circumstance.
■ 13. Revise § 160.310 to read as
follows:

follows:§ 160.310 Responsibilities of covered
entities and business associates.

§ 160.304 Principles for achieving
compliance.

(a) Provide records and compliancereports. A covered entity or businessassociate must keep such records andsubmit such compliance reports, in suchtime and manner and containing suchinformation, as the Secretary may
determine to be necessary to enable theSecretary to ascertain whether thecovered entity or business associate hascomplied or is complying with theapplicable administrative simplification
provisions.
(b) Cooperate with complaintinvestigations and compliance reviews.
A covered entity or business associatemust cooperate with the Secretary, if theSecretary undertakes an investigation orcompliance review of the policies,
procedures, or practices of the covered
entity or business associate to determine
whether it is complying with theapplicable administrative simplification
provisions.
(c) Permit access to information. (1) A
covered entity or business associatemust permit access by the Secretaryduring normal business hours to its
facilities, books, records, accounts, andother sources of information, including
protected health information, that are
pertinent to ascertaining compliancewith the applicable administrative
simplification provisions. If theSecretary determines that exigent
circumstances exist, such as when
documents may be hidden or destroyed,a covered entity or business associatemust permit access by the Secretary at
any time and without notice.
(2) If any information required of acovered entity or business associateunder this section is in the exclusive(a) Cooperation. The Secretary will, tothe extent practicable and consistent
with the provisions of this subpart, seek
the cooperation of covered entities andbusiness associates in obtaining
compliance with the applicableadministrative simplification
provisions.
(b) Assistance. The Secretary may
provide technical assistance to covered
entities and business associates to help
them comply voluntarily with theapplicable administrative simplification
provisions.
■ 11. In § 160.306, revise paragraphs (a)and (c) to read as follows:§ 160.306

sroberts on DSK5SPTVN1PROD withor business associate about thecomplaint, the Secretary will describe
the acts and/or omissions that are thebasis of the complaint.
■ 12. Revise § 160.308 to read as
follows:

Complaints to the Secretary.

(a) Right to file a complaint. A person
who believes a covered entity or
business associate is not complying
with the administrative simplification
provisions may file a complaint with theSecretary.
*
*
*
*
*
(c) Investigation. (1) The Secretary
will investigate any complaint filed
under this section when a preliminary
review of the facts indicates a possible
violation due to willful neglect.
(2) The Secretary may investigate anyother complaint filed under this section.
(3) An investigation under this section
may include a review of the pertinent
policies, procedures, or practices of thecovered entity or business associate andof the circumstances regarding any
alleged violation.
(4) At the time of the initial written
communication with the covered entity

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

PO 00000

Frm 00126

Fmt 4701

Sfmt 4700

possession of any other agency,
institution, or person and the otheragency, institution, or person fails or
refuses to furnish the information, thecovered entity or business associatemust so certify and set forth what efforts
it has made to obtain the information.
(3) Protected health information
obtained by the Secretary in connection
with an investigation or compliancereview under this subpart will not be
disclosed by the Secretary, except ifnecessary for ascertaining or enforcing
compliance with the applicableadministrative simplification
provisions, if otherwise required by law,or if permitted under 5 U.S.C.
552a(b)(7).
■ 14. Revise § 160.312 to read as
follows:§ 160.312 Secretarial action regarding
complaints and compliance reviews.

(a) Resolution when noncompliance isindicated. (1) If an investigation of acomplaint pursuant to § 160.306 or acompliance review pursuant to§ 160.308 indicates noncompliance, theSecretary may attempt to reach aresolution of the matter satisfactory to
the Secretary by informal means.
Informal means may include
demonstrated compliance or acompleted corrective action plan orother agreement.
(2) If the matter is resolved byinformal means, the Secretary will so
inform the covered entity or businessassociate and, if the matter arose froma complaint, the complainant, inwriting.
(3) If the matter is not resolved byinformal means, the Secretary will—(i) So inform the covered entity or
business associate and provide thecovered entity or business associate an
opportunity to submit written evidenceof any mitigating factors or affirmative
defenses for consideration under§§ 160.408 and 160.410 of this part. The
covered entity or business associatemust submit any such evidence to theSecretary within 30 days (computed in
the same manner as prescribed under§ 160.526 of this part) of receipt of such
notification; and(ii) If, following action pursuant toparagraph (a)(3)(i) of this section, theSecretary finds that a civil money
penalty should be imposed, inform thecovered entity or business associate ofsuch finding in a notice of proposed
determination in accordance with§ 160.420 of this part.
(b) Resolution when no violation isfound. If, after an investigation pursuant
to § 160.306 or a compliance review
pursuant to § 160.308, the Secretary
determines that further action is not

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
warranted, the Secretary will so informthe covered entity or business associateand, if the matter arose from acomplaint, the complainant, in writing.
■ 15. In § 160.316, revise theintroductory text to read as follows:§ 160.316 Refraining from intimidation orretaliation.

A covered entity or business associate
may not threaten, intimidate, coerce,harass, discriminate against, or take anyother retaliatory action against any
individual or other person for—
*
*
*
*
*
■ 16. In § 160.401, revise the definitionof ‘‘Reasonable cause’’ to read as
follows:§ 160.401****
Reasonable cause means an act oromission in which a covered entity or
business associate knew, or by
exercising reasonable diligence would
have known, that the act or omission
violated an administrative
simplification provision, but in which
the covered entity or business associate
did not act with willful neglect.
*
*
*
*
*
■ 17. Revise § 160.402 to read as
follows:

sroberts on DSK5SPTVN1PROD with

Basis for a civil money penalty.

(a) General rule. Subject to § 160.410,
the Secretary will impose a civil money
penalty upon a covered entity or
business associate if the Secretary
determines that the covered entity or
business associate has violated anadministrative simplification provision.
(b) Violation by more than one
covered entity or business associate. (1)Except as provided in paragraph (b)(2)of this section, if the Secretary
determines that more than one covered
entity or business associate was
responsible for a violation, the Secretary
will impose a civil money penalty
against each such covered entity or
business associate.
(2) A covered entity that is a memberof an affiliated covered entity, in
accordance with § 164.105(b) of thissubchapter, is jointly and severally
liable for a civil money penalty for aviolation of part 164 of this subchapter
based on an act or omission of theaffiliated covered entity, unless it isestablished that another member of theaffiliated covered entity was responsible
for the violation.
(c) Violation attributed to a covered
entity or business associate. (1) A
covered entity is liable, in accordancewith the Federal common law of agency,
for a civil money penalty for a violation

VerDate Mar<15>2010

18:57 Jan 24, 2013

§ 160.404

Amount of a civil money penalty.

*

Definitions.

*§ 160.402

based on the act or omission of any
agent of the covered entity, including aworkforce member or businessassociate, acting within the scope of theagency.
(2) A business associate is liable, in
accordance with the Federal common
law of agency, for a civil money penalty
for a violation based on the act oromission of any agent of the businessassociate, including a workforce
member or subcontractor, acting within
the scope of the agency.
■ 18. In § 160.404, revise theintroductory text of paragraphs (b)(2)(i),(b)(2)(iii), and (b)(2)(iv) to read as
follows:

Jkt 229001****(b) * * *(2) * * *(i) For a violation in which it isestablished that the covered entity or
business associate did not know and, by
exercising reasonable diligence, would
not have known that the covered entity
or business associate violated suchprovision,
*
*
*
*
*
(iii) For a violation in which it isestablished that the violation was due towillful neglect and was corrected during
the 30-day period beginning on the firstdate the covered entity or businessassociate liable for the penalty knew, or,by exercising reasonable diligence,
would have known that the violation
occurred,*****(iv) For a violation in which it isestablished that the violation was due towillful neglect and was not correctedduring the 30-day period beginning on
the first date the covered entity or
business associate liable for the penalty
knew, or, by exercising reasonablediligence, would have known that theviolation occurred,
*
*
*
*
*
■ 19. Revise § 160.406 to read as
follows:§ 160.406 Violations of an identicalrequirement or prohibition.

The Secretary will determine thenumber of violations of an
administrative simplification provision
based on the nature of the covered
entity’s or business associate’s
obligation to act or not act under theprovision that is violated, such as its
obligation to act in a certain manner, or
within a certain time, or to act or not act
with respect to certain persons. In thecase of continuing violation of aprovision, a separate violation occurs
each day the covered entity or businessassociate is in violation of the provision.

PO 00000

Frm 00127

Fmt 4701

Sfmt 4700

5691■ 20. Revise § 160.408 to read as

follows:§ 160.408 Factors considered indetermining the amount of a civil money
penalty.

In determining the amount of any
civil money penalty, the Secretary willconsider the following factors, which
may be mitigating or aggravating as
appropriate:(a) The nature and extent of theviolation, consideration of which may
include but is not limited to:(1) The number of individuals
affected; and(2) The time period during which theviolation occurred;(b) The nature and extent of the harm
resulting from the violation,
consideration of which may include but
is not limited to:(1) Whether the violation caused
physical harm;(2) Whether the violation resulted infinancial harm;(3) Whether the violation resulted inharm to an individual’s reputation; and(4) Whether the violation hindered an
individual’s ability to obtain healthcare;(c) The history of prior compliancewith the administrative simplification
provisions, including violations, by thecovered entity or business associate,
consideration of which may include but
is not limited to:(1) Whether the current violation is
the same or similar to previous
indications of noncompliance;(2) Whether and to what extent thecovered entity or business associate has
attempted to correct previous
indications of noncompliance;(3) How the covered entity or businessassociate has responded to technicalassistance from the Secretary provided
in the context of a compliance effort;and(4) How the covered entity or businessassociate has responded to priorcomplaints;(d) The financial condition of thecovered entity or business associate,
consideration of which may include but
is not limited to:(1) Whether the covered entity or
business associate had financial
difficulties that affected its ability tocomply;(2) Whether the imposition of a civil
money penalty would jeopardize theability of the covered entity or businessassociate to continue to provide, or to
pay for, health care; and(3) The size of the covered entity or
business associate; and(e) Such other matters as justice may
require.

E:\FR\FM\25JAR2.SGM

25JAR2

5692

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations■ 21. Revise § 160.410 to read as

follows:

sroberts on DSK5SPTVN1PROD with§ 160.410

Affirmative defenses.

(a) The Secretary may not:(1) Prior to February 18, 2011, impose
a civil money penalty on a covered
entity or business associate for an act
that violates an administrative
simplification provision if the covered
entity or business associate establishes
that the violation is punishable under
42 U.S.C. 1320d–6.
(2) On or after February 18, 2011,
impose a civil money penalty on acovered entity or business associate foran act that violates an administrative
simplification provision if the covered
entity or business associate establishes
that a penalty has been imposed under
42 U.S.C. 1320d–6 with respect to suchact.
(b) For violations occurring prior to
February 18, 2009, the Secretary may
not impose a civil money penalty on acovered entity for a violation if thecovered entity establishes that anaffirmative defense exists with respect
to the violation, including the following:(1) The covered entity establishes, tothe satisfaction of the Secretary, that it
did not have knowledge of the violation,
determined in accordance with theFederal common law of agency, and by
exercising reasonable diligence, would
not have known that the violation
occurred; or(2) The violation is—(i) Due to circumstances that would
make it unreasonable for the covered
entity, despite the exercise of ordinary
business care and prudence, to comply
with the administrative simplification
provision violated and is not due towillful neglect; and(ii) Corrected during either:(A) The 30-day period beginning on
the first date the covered entity liable
for the penalty knew, or by exercisingreasonable diligence would have
known, that the violation occurred; or(B) Such additional period as the
Secretary determines to be appropriate
based on the nature and extent of the
failure to comply.
(c) For violations occurring on or after
February 18, 2009, the Secretary may
not impose a civil money penalty on acovered entity or business associate fora violation if the covered entity or
business associate establishes to thesatisfaction of the Secretary that theviolation is—(1) Not due to willful neglect; and(2) Corrected during either:(i) The 30-day period beginning on
the first date the covered entity or
business associate liable for the penalty
knew, or, by exercising reasonable

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

diligence, would have known that theviolation occurred; or(ii) Such additional period as the
Secretary determines to be appropriate
based on the nature and extent of the
failure to comply.
■ 22. Revise § 160.412 to read as
follows:

requirements, and implementation
specifications under part C of title XI of
the Act, section 264 of Public Law 104–
191, and sections 13400–13424 of
Public Law 111–5.
■ 27. In § 164.104, revise paragraph (b)to read as follows:§ 160.412*

Waiver.

For violations described in§ 160.410(b)(2) or (c) that are notcorrected within the period specified
under such paragraphs, the Secretary
may waive the civil money penalty, inwhole or in part, to the extent that thepayment of the penalty would be
excessive relative to the violation.
■ 23. Revise § 160.418 to read as
follows:§ 160.418

Penalty not exclusive.

Except as otherwise provided by 42
U.S.C. 1320d–5(b)(1) and 42 U.S.C.
299b–22(f)(3), a penalty imposed under
this part is in addition to any otherpenalty prescribed by law.
■ 24. Amend § 160.534 as follows:■ a. Revise paragraph (b)(1)(iii);■ b. Add paragraph (b)(1)(iv); and■ c. Revise paragraph (b)(2).
The revisions read as follows:§ 160.534

The hearing.

*

*
*
*
*
(b)(1) * * *(iii) Claim that a proposed penalty
should be reduced or waived pursuant
to § 160.412 of this part; and(iv) Compliance with subpart D ofpart 164, as provided under§ 164.414(b).
(2) The Secretary has the burden ofgoing forward and the burden of
persuasion with respect to all otherissues, including issues of liability otherthan with respect to subpart D of part
164, and the existence of any factors
considered aggravating factors indetermining the amount of the proposed
penalty.
*****
PART 164—SECURITY AND PRIVACY■ 25. The authority citation for part 164

is revised to read as follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C.
1320d–1320d–9; sec. 264, Pub. L. 104–191,
110 Stat. 2033–2034 (42 U.S.C. 1320d–2(note)); and secs. 13400–13424, Pub. L. 111–
5, 123 Stat. 258–279.
■ 26. Revise § 164.102 to read as

follows:§ 164.102

Statutory basis.

The provisions of this part are
adopted pursuant to the Secretary’s
authority to prescribe standards,

PO 00000

Frm 00128

Fmt 4701

Sfmt 4700§ 164.104

Applicability.

****(b) Where provided, the standards,
requirements, and implementation
specifications adopted under this part
apply to a business associate.
■ 28. Amend § 164.105 as follows:■ a. Revise the introductory text ofparagraph (a)(1), the introductory text ofparagraph (a)(2)(i), paragraph (a)(2)(ii),the introductory text of paragraph(a)(2)(iii), and paragraphs (a)(2)(iii)(A)and (B);■ b. Redesignate paragraph (a)(2)(iii)(C)
as paragraph (a)(2)(iii)(D) and add newparagraph (a)(2)(iii)(C);■ c. Revise newly redesignatedparagraph (a)(2)(iii)(D); and■ d. Revise paragraph (b).
The revisions read as follows:§ 164.105

Organizational requirements.

(a)(1) Standard: Health carecomponent. If a covered entity is ahybrid entity, the requirements of thispart, other than the requirements of thissection, § 164.314, and § 164.504, apply
only to the health care component(s) of
the entity, as specified in this section.
(2) * * *(i) Application of other provisions. In
applying a provision of this part, otherthan the requirements of this section,§ 164.314, and § 164.504, to a hybrid
entity:*****(ii) Safeguard requirements. The
covered entity that is a hybrid entity
must ensure that a health carecomponent of the entity complies withthe applicable requirements of this part.
In particular, and without limiting thisrequirement, such covered entity mustensure that:(A) Its health care component does
not disclose protected healthinformation to another component of
the covered entity in circumstances inwhich subpart E of this part would
prohibit such disclosure if the healthcare component and the othercomponent were separate and distinct
legal entities;(B) Its health care component protects
electronic protected health information
with respect to another component of
the covered entity to the same extent
that it would be required under subpart
C of this part to protect suchinformation if the health care

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
component and the other component
were separate and distinct legal entities;(C) If a person performs duties forboth the health care component in thecapacity of a member of the workforceof such component and for anothercomponent of the entity in the same
capacity with respect to thatcomponent, such workforce member
must not use or disclose protected
health information created or received
in the course of or incident to themember’s work for the health carecomponent in a way prohibited bysubpart E of this part.
(iii) Responsibilities of the covered
entity. A covered entity that is a hybrid
entity has the following responsibilities:(A) For purposes of subpart C of part
160 of this subchapter, pertaining tocompliance and enforcement, thecovered entity has the responsibility ofcomplying with this part.
(B) The covered entity is responsible
for complying with § 164.316(a) and§ 164.530(i), pertaining to theimplementation of policies andprocedures to ensure compliance withapplicable requirements of this part,
including the safeguard requirements inparagraph (a)(2)(ii) of this section.
(C) The covered entity is responsible
for complying with § 164.314 and§ 164.504 regarding business associatearrangements and other organizational
requirements.
(D) The covered entity is responsiblefor designating the components that arepart of one or more health carecomponents of the covered entity anddocumenting the designation inaccordance with paragraph (c) of thissection, provided that, if the covered
entity designates one or more healthcare components, it must include any
component that would meet thedefinition of a covered entity or
business associate if it were a separate
legal entity. Health care component(s)also may include a component only tothe extent that it performs covered
functions.
(b)(1) Standard: Affiliated covered
entities. Legally separate covered
entities that are affiliated may designatethemselves as a single covered entity for
purposes of this part.
(2) Implementation specifications.
(i) Requirements for designation of anaffiliated covered entity.
(A) Legally separate covered entities
may designate themselves (including
any health care component of suchcovered entity) as a single affiliatedcovered entity, for purposes of this part,
if all of the covered entities designatedare under common ownership orcontrol.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(B) The designation of an affiliatedcovered entity must be documented andthe documentation maintained as
required by paragraph (c) of this section.
(ii) Safeguard requirements. An
affiliated covered entity must ensurethat it complies with the applicablerequirements of this part, including, if
the affiliated covered entity combines
the functions of a health plan, healthcare provider, or health careclearinghouse, § 164.308(a)(4)(ii)(A) and§ 164.504(g), as applicable.
*
*
*
*
*
■ 29. Revise § 164.106 to read as
follows:§ 164.106

Relationship to other parts.

In complying with the requirementsof this part, covered entities and, where
provided, business associates, arerequired to comply with the applicableprovisions of parts 160 and 162 of thissubchapter.
■ 30. The authority citation for subpart
C of part 164 is revised to read as
follows:
Authority: 42 U.S.C. 1320d–2 and 1320d–
4; sec. 13401, Pub. L. 111–5, 123 Stat. 260.
■ 31. Revise § 164.302 to read as

follows:§ 164.302

Applicability.

A covered entity or business associatemust comply with the applicablestandards, implementation
specifications, and requirements of thissubpart with respect to electronic
protected health information of acovered entity.
■ 32. In § 164.304, revise the definitionsof ‘‘Administrative safeguards’’ and‘‘Physical safeguards’’ to read as
follows:§ 164.304

Definitions.

*

*
*
*
*
Administrative safeguards areadministrative actions, and policies andprocedures, to manage the selection,
development, implementation, andmaintenance of security measures toprotect electronic protected healthinformation and to manage the conductof the covered entity’s or businessassociate’s workforce in relation to theprotection of that information.
*
*
*
*
*
Physical safeguards are physicalmeasures, policies, and procedures toprotect a covered entity’s or businessassociate’s electronic information
systems and related buildings andequipment, from natural andenvironmental hazards, andunauthorized intrusion.
*
*
*
*
*

PO 00000

Frm 00129

Fmt 4701

Sfmt 4700

5693■ 33. Amend § 164.306 as follows:■ a. Revise the introductory text ofparagraph (a) and paragraph (a)(1);■ b. Revise paragraph (b)(1), theintroductory text of paragraph (b)(2),and paragraphs (b)(2)(i) and (b)(2)(ii);■ c. Revise paragraph (c);■ d. Revise paragraph (d)(2), theintroductory text of paragraph (d)(3),paragraph (d)(3)(i), and the introductory
text of paragraph (d)(3)(ii); and■ e. Revise paragraph (e).
The revisions read as follows:§ 164.306
rules.

Security standards: General(a) General requirements. Covered
entities and business associates must do
the following:(1) Ensure the confidentiality,
integrity, and availability of allelectronic protected health information
the covered entity or business associatecreates, receives, maintains, ortransmits.
*
*
*
*
*
(b) * * *(1) Covered entities and businessassociates may use any security
measures that allow the covered entity
or business associate to reasonably andappropriately implement the standards
and implementation specifications as
specified in this subpart.
(2) In deciding which security
measures to use, a covered entity or
business associate must take into
account the following factors:(i) The size, complexity, andcapabilities of the covered entity or
business associate.
(ii) The covered entity’s or thebusiness associate’s technicalinfrastructure, hardware, and software
security capabilities.
*
*
*
*
*
(c) Standards. A covered entity or
business associate must comply withthe applicable standards as provided inthis section and in § 164.308, § 164.310,§ 164.312, § 164.314 and § 164.316 withrespect to all electronic protected healthinformation.
(d) * * *(2) When a standard adopted in§ 164.308, § 164.310, § 164.312,§ 164.314, or § 164.316 includes
required implementation specifications,a covered entity or business associatemust implement the implementation
specifications.
(3) When a standard adopted in§ 164.308, § 164.310, § 164.312,§ 164.314, or § 164.316 includes
addressable implementation
specifications, a covered entity or
business associate must—(i) Assess whether each
implementation specification is a

E:\FR\FM\25JAR2.SGM

25JAR2

5694

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

reasonable and appropriate safeguard inits environment, when analyzed withreference to the likely contribution toprotecting electronic protected healthinformation; and(ii) As applicable to the covered entity
or business associate—
*
*
*
*
*
(e) Maintenance. A covered entity or
business associate must review andmodify the security measures
implemented under this subpart asneeded to continue provision ofreasonable and appropriate protection ofelectronic protected health information,and update documentation of suchsecurity measures in accordance with§ 164.316(b)(2)(iii).
■ 34. Amend § 164.308 as follows:■ a. Revise the introductory text ofparagraph (a), paragraph (a)(1)(ii)(A),paragraph (a)(1)(ii)(C), paragraph (a)(2),paragraph (a)(3)(ii)(C), paragraph(a)(4)(ii)(C), paragraph (a)(6)(ii), andparagraph (a)(8); and■ b. Revise paragraph (b).
The revisions read as follows:

sroberts on DSK5SPTVN1PROD with§ 164.308

Administrative safeguards.

(a) A covered entity or businessassociate must, in accordance with§ 164.306:(1) * * *(ii) * * *(A) Risk analysis (Required). Conduct
an accurate and thorough assessment of
the potential risks and vulnerabilities tothe confidentiality, integrity, andavailability of electronic protected
health information held by the covered
entity or business associate.
*
*
*
*
*
(C) Sanction policy (Required). Apply
appropriate sanctions against workforce
members who fail to comply with thesecurity policies and procedures of thecovered entity or business associate.
*
*
*
*
*
(2) Standard: Assigned security
responsibility. Identify the security
official who is responsible for thedevelopment and implementation of thepolicies and procedures required by thissubpart for the covered entity or
business associate.
(3) * * *(ii) * * *(C) Termination procedures(Addressable). Implement proceduresfor terminating access to electronic
protected health information when theemployment of, or other arrangement
with, a workforce member ends or as
required by determinations made as
specified in paragraph (a)(3)(ii)(B) of
this section.
(4) * * *(ii) * * *VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(C) Access establishment andmodification (Addressable). Implement
policies and procedures that, based
upon the covered entity’s or thebusiness associate’s access authorization
policies, establish, document, review,
and modify a user’s right of access to aworkstation, transaction, program, orprocess.
*****(6) * * *(ii) Implementation specification:
Response and reporting (Required).
Identify and respond to suspected or
known security incidents; mitigate, tothe extent practicable, harmful effects of
security incidents that are known to thecovered entity or business associate; anddocument security incidents and theiroutcomes.
*****(8) Standard: Evaluation. Perform a
periodic technical and nontechnicalevaluation, based initially upon thestandards implemented under this ruleand, subsequently, in response toenvironmental or operational changes
affecting the security of electronic
protected health information, that
establishes the extent to which acovered entity’s or business associate’ssecurity policies and procedures meetthe requirements of this subpart.
(b)(1) Business associate contracts
and other arrangements. A covered
entity may permit a business associate
to create, receive, maintain, or transmit
electronic protected health informationon the covered entity’s behalf only if thecovered entity obtains satisfactory
assurances, in accordance with§ 164.314(a), that the business associate
will appropriately safeguard theinformation. A covered entity is not
required to obtain such satisfactory
assurances from a business associatethat is a subcontractor.
(2) A business associate may permit abusiness associate that is asubcontractor to create, receive,
maintain, or transmit electronic
protected health information on its
behalf only if the business associate
obtains satisfactory assurances, inaccordance with § 164.314(a), that thesubcontractor will appropriately
safeguard the information.
(3) Implementation specifications:
Written contract or other arrangement(Required). Document the satisfactory
assurances required by paragraph (b)(1)or (b)(2) of this section through a written
contract or other arrangement with thebusiness associate that meets theapplicable requirements of § 164.314(a).
■ 35. Revise the introductory text of§ 164.310 to read as follows:

PO 00000

Frm 00130

Fmt 4701

Sfmt 4700§ 164.310

Physical safeguards.

A covered entity or business associatemust, in accordance with § 164.306:
*
*
*
*
*
■ 36. Revise the introductory text of§ 164.312 to read as follows:§ 164.312

Technical safeguards.

A covered entity or business associatemust, in accordance with § 164.306:
*
*
*
*
*
■ 37. Amend § 164.314 by revisingparagraphs (a) and (b)(2)(iii) to read as
follows:§ 164.314

Organizational requirements.

(a)(1) Standard: Business associate
contracts or other arrangements. The
contract or other arrangement requiredby § 164.308(b)(4) must meet therequirements of paragraph (a)(2)(i),(a)(2)(ii), or (a)(2)(iii) of this section, as
applicable.
(2) Implementation specifications(Required).
(i) Business associate contracts. The
contract must provide that the businessassociate will—(A) Comply with the applicablerequirements of this subpart;(B) In accordance with§ 164.308(b)(2), ensure that any
subcontractors that create, receive,
maintain, or transmit electronic
protected health information on behalfof the business associate agree tocomply with the applicablerequirements of this subpart by entering
into a contract or other arrangement thatcomplies with this section; and(C) Report to the covered entity any
security incident of which it becomesaware, including breaches of unsecured
protected health information as requiredby § 164.410.
(ii) Other arrangements. The covered
entity is in compliance with paragraph(a)(1) of this section if it has anotherarrangement in place that meets therequirements of § 164.504(e)(3).
(iii) Business associate contracts with
subcontractors. The requirements ofparagraphs (a)(2)(i) and (a)(2)(ii) of thissection apply to the contract or otherarrangement between a businessassociate and a subcontractor requiredby § 164.308(b)(4) in the same manneras such requirements apply to contracts
or other arrangements between acovered entity and business associate.
(b) * * *(2) * * *(iii) Ensure that any agent to whom it
provides this information agrees toimplement reasonable and appropriate
security measures to protect the
information; and
*
*
*
*
*

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations■ 38. Revise the introductory text of§ 164.316 and the third sentence ofparagraph (a) to read as follows:§ 164.316 Policies and procedures anddocumentation requirements.

A covered entity or business associatemust, in accordance with § 164.306:(a) * * * A covered entity or businessassociate may change its policies andprocedures at any time, provided thatthe changes are documented and are
implemented in accordance with thissubpart.
*****■ 39. Revise § 164.402 to read as
follows:

sroberts on DSK5SPTVN1PROD with§ 164.402

Definitions.

As used in this subpart, the following
terms have the following meanings:
Breach means the acquisition, access,use, or disclosure of protected healthinformation in a manner not permitted
under subpart E of this part which
compromises the security or privacy ofthe protected health information.
(1) Breach excludes:(i) Any unintentional acquisition,access, or use of protected healthinformation by a workforce member or
person acting under the authority of acovered entity or a business associate, if
such acquisition, access, or use wasmade in good faith and within the scopeof authority and does not result infurther use or disclosure in a manner
not permitted under subpart E of thispart.
(ii) Any inadvertent disclosure by aperson who is authorized to accessprotected health information at acovered entity or business associate toanother person authorized to accessprotected health information at the same
covered entity or business associate, ororganized health care arrangement inwhich the covered entity participates,
and the information received as a resultof such disclosure is not further used ordisclosed in a manner not permitted
under subpart E of this part.
(iii) A disclosure of protected healthinformation where a covered entity or
business associate has a good faith belief
that an unauthorized person to whom
the disclosure was made would notreasonably have been able to retain suchinformation.
(2) Except as provided in paragraph(1) of this definition, an acquisition,access, use, or disclosure of protected
health information in a manner not
permitted under subpart E is presumed
to be a breach unless the covered entity
or business associate, as applicable,
demonstrates that there is a low
probability that the protected healthinformation has been compromised

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

based on a risk assessment of at least thefollowing factors:(i) The nature and extent of theprotected health information involved,
including the types of identifiers andthe likelihood of re-identification;(ii) The unauthorized person who
used the protected health information or
to whom the disclosure was made;(iii) Whether the protected healthinformation was actually acquired or
viewed; and(iv) The extent to which the risk to theprotected health information has been
mitigated.
Unsecured protected healthinformation means protected healthinformation that is not renderedunusable, unreadable, or indecipherable
to unauthorized persons through the useof a technology or methodology
specified by the Secretary in theguidance issued under section
13402(h)(2) of Public Law 111–5.
■ 40. In § 164.406, revise paragraph (a)to read as follows:§ 164.406

Notification to the media.

(a) Standard. For a breach of
unsecured protected health information
involving more than 500 residents of aState or jurisdiction, a covered entity
shall, following the discovery of thebreach as provided in § 164.404(a)(2),
notify prominent media outlets serving
the State or jurisdiction.
*
*
*
*
*
■ 41. In § 164.408, revise paragraph (c)to read as follows:§ 164.408

Notification to the Secretary.

*

*
*
*
*
(c) Implementation specifications:
Breaches involving less than 500
individuals. For breaches of unsecured
protected health information involving
less than 500 individuals, a covered
entity shall maintain a log or otherdocumentation of such breaches and,not later than 60 days after the end ofeach calendar year, provide thenotification required by paragraph (a) of
this section for breaches discovered
during the preceding calendar year, inthe manner specified on the HHS website.
■ 42. In § 164.410, revise paragraph (a)to read as follows:§ 164.410 Notification by a businessassociate.

(a) Standard—(1) General rule. A
business associate shall, following thediscovery of a breach of unsecured
protected health information, notify thecovered entity of such breach.
(2) Breaches treated as discovered.
For purposes of paragraph (a)(1) of thissection, a breach shall be treated as

PO 00000

Frm 00131

Fmt 4701

Sfmt 4700

5695

discovered by a business associate as of
the first day on which such breach is
known to the business associate or, by
exercising reasonable diligence, would
have been known to the businessassociate. A business associate shall bedeemed to have knowledge of a breachif the breach is known, or by exercisingreasonable diligence would have been
known, to any person, other than the
person committing the breach, who isan employee, officer, or other agent of
the business associate (determined inaccordance with the Federal common
law of agency).
*
*
*
*
*
■ 43. The authority citation for subpart
E of part 164 is revised to read as
follows:
Authority: 42 U.S.C. 1320d–2, 1320d–4,
and 1320d–9; sec. 264 of Pub. L. 104–191,
110 Stat. 2033–2034 (42 U.S.C. 1320d–2(note)); and secs. 13400–13424, Pub. L. 111–
5, 123 Stat. 258–279.
■ 44. In § 164.500, redesignate

paragraph (c) as paragraph (d) and add
new paragraph (c) to read as follows:§ 164.500

Applicability.

*

*
*
*
*
(c) Where provided, the standards,
requirements, and implementation
specifications adopted under thissubpart apply to a business associatewith respect to the protected healthinformation of a covered entity.
*
*
*
*
*
■ 45. Amend § 164.501 as follows:■ a. Revise paragraphs (1) and (3) of thedefinition of ‘‘Health care operations’’;■ b. Revise the definition of‘‘Marketing’’; and■ c. Revise paragraph (1)(i) of thedefinition of ‘‘Payment’’.
The revisions read as follows:§ 164.501

Definitions.

*

*
*
*
*
Health care operations means * * *(1) Conducting quality assessment
and improvement activities, including
outcomes evaluation and developmentof clinical guidelines, provided that theobtaining of generalizable knowledge is
not the primary purpose of any studies
resulting from such activities; patient
safety activities (as defined in 42 CFR
3.20); population-based activities
relating to improving health or reducing
health care costs, protocol development,case management and care coordination,
contacting of health care providers andpatients with information about
treatment alternatives; and related
functions that do not include treatment;
*
*
*
*
*
(3) Except as prohibited under§ 164.502(a)(5)(i), underwriting,

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5696

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

enrollment, premium rating, and otheractivities related to the creation,
renewal, or replacement of a contract ofhealth insurance or health benefits, andceding, securing, or placing a contract
for reinsurance of risk relating to claims
for health care (including stop-loss
insurance and excess of loss insurance),
provided that the requirements of§ 164.514(g) are met, if applicable;
*
*
*
*
*
Marketing: (1) Except as provided inparagraph (2) of this definition,marketing means to make acommunication about a product orservice that encourages recipients of thecommunication to purchase or use theproduct or service.
(2) Marketing does not include a
communication made:(i) To provide refill reminders orotherwise communicate about a drug or
biologic that is currently beingprescribed for the individual, only if
any financial remuneration received by
the covered entity in exchange formaking the communication isreasonably related to the covered
entity’s cost of making thecommunication.
(ii) For the following treatment andhealth care operations purposes, except
where the covered entity receives
financial remuneration in exchange formaking the communication:(A) For treatment of an individual bya health care provider, including casemanagement or care coordination for theindividual, or to direct or recommend
alternative treatments, therapies, healthcare providers, or settings of care to theindividual;(B) To describe a health-related
product or service (or payment for suchproduct or service) that is provided by,
or included in a plan of benefits of, thecovered entity making thecommunication, including
communications about: the entities
participating in a health care provider
network or health plan network;
replacement of, or enhancements to, ahealth plan; and health-related products
or services available only to a healthplan enrollee that add value to, but are
not part of, a plan of benefits; or(C) For case management or carecoordination, contacting of individuals
with information about treatment
alternatives, and related functions to theextent these activities do not fall within
the definition of treatment.
(3) Financial remuneration means
direct or indirect payment from or on
behalf of a third party whose product orservice is being described. Direct orindirect payment does not include any
payment for treatment of an individual.

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

Payment means:(1) * * *(i) Except as prohibited under§ 164.502(a)(5)(i), a health plan to obtainpremiums or to determine or fulfill its
responsibility for coverage andprovision of benefits under the healthplan; or*****■ 46. In § 164.502, revise paragraphs (a),(b)(1), (e), and (f) to read as follows:§ 164.502 Uses and disclosures ofprotected health information: General rules.

(a) Standard. A covered entity or
business associate may not use or
disclose protected health information,
except as permitted or required by thissubpart or by subpart C of part 160 of
this subchapter.
(1) Covered entities: Permitted usesand disclosures. A covered entity ispermitted to use or disclose protected
health information as follows:(i) To the individual;(ii) For treatment, payment, or healthcare operations, as permitted by and incompliance with § 164.506;(iii) Incident to a use or disclosure
otherwise permitted or required by thissubpart, provided that the covered
entity has complied with the applicablerequirements of §§ 164.502(b),164.514(d), and 164.530(c) with respect
to such otherwise permitted or required
use or disclosure;(iv) Except for uses and disclosuresprohibited under § 164.502(a)(5)(i),pursuant to and in compliance with avalid authorization under § 164.508;(v) Pursuant to an agreement under, oras otherwise permitted by, § 164.510;
and(vi) As permitted by and incompliance with this section, § 164.512,§ 164.514(e), (f), or (g).
(2) Covered entities: Required
disclosures. A covered entity is required
to disclose protected health information:(i) To an individual, when requested
under, and required by § 164.524 or§ 164.528; and(ii) When required by the Secretary
under subpart C of part 160 of thissubchapter to investigate or determine
the covered entity’s compliance withthis subchapter.
(3) Business associates: Permitted
uses and disclosures. A businessassociate may use or disclose protected
health information only as permitted or
required by its business associate
contract or other arrangement pursuant
to § 164.504(e) or as required by law.
The business associate may not use or
disclose protected health information ina manner that would violate therequirements of this subpart, if done by
the covered entity, except for the

PO 00000

Frm 00132

Fmt 4701

Sfmt 4700

purposes specified under§ 164.504(e)(2)(i)(A) or (B) if such uses
or disclosures are permitted by its
contract or other arrangement.
(4) Business associates: Required usesand disclosures. A business associate isrequired to disclose protected healthinformation:(i) When required by the Secretary
under subpart C of part 160 of thissubchapter to investigate or determine
the business associate’s compliancewith this subchapter.
(ii) To the covered entity, individual,
or individual’s designee, as necessary tosatisfy a covered entity’s obligations
under § 164.524(c)(2)(ii) and (3)(ii) withrespect to an individual’s request for anelectronic copy of protected healthinformation.
(5) Prohibited uses and disclosures.
(i) Use and disclosure of genetic
information for underwriting purposes:
Notwithstanding any other provision ofthis subpart, a health plan, excluding an
issuer of a long-term care policy fallingwithin paragraph (1)(viii) of thedefinition of health plan, shall not use
or disclose protected health informationthat is genetic information forunderwriting purposes. For purposes ofparagraph (a)(5)(i) of this section,
underwriting purposes means, withrespect to a health plan:(A) Except as provided in paragraph(a)(5)(i)(B) of this section:(1) Rules for, or determination of,eligibility (including enrollment andcontinued eligibility) for, or
determination of, benefits under theplan, coverage, or policy (includingchanges in deductibles or other costsharing mechanisms in return for
activities such as completing a healthrisk assessment or participating in awellness program);(2) The computation of premium orcontribution amounts under the plan,
coverage, or policy (including
discounts, rebates, payments in kind, orother premium differential mechanisms
in return for activities such ascompleting a health risk assessment or
participating in a wellness program);(3) The application of any pre-existing
condition exclusion under the plan,
coverage, or policy; and(4) Other activities related to thecreation, renewal, or replacement of acontract of health insurance or healthbenefits.
(B) Underwriting purposes does notinclude determinations of medical
appropriateness where an individual
seeks a benefit under the plan, coverage,or policy.
(ii) Sale of protected healthinformation:

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations(A) Except pursuant to and incompliance with § 164.508(a)(4), a
covered entity or business associate may
not sell protected health information.
(B) For purposes of this paragraph,sale of protected health informationmeans:(1) Except as provided in paragraph(a)(5)(ii)(B)(2) of this section, a
disclosure of protected healthinformation by a covered entity or
business associate, if applicable, where
the covered entity or business associate
directly or indirectly receives
remuneration from or on behalf of therecipient of the protected healthinformation in exchange for theprotected health information.
(2) Sale of protected healthinformation does not include a
disclosure of protected healthinformation:(i) For public health purposes
pursuant to § 164.512(b) or § 164.514(e);(ii) For research purposes pursuant to§ 164.512(i) or § 164.514(e), where theonly remuneration received by thecovered entity or business associate is areasonable cost-based fee to cover thecost to prepare and transmit theprotected health information for such
purposes;(iii) For treatment and payment
purposes pursuant to § 164.506(a);(iv) For the sale, transfer, merger, or
consolidation of all or part of thecovered entity and for related due
diligence as described in paragraph(6)(iv) of the definition of health care
operations and pursuant to § 164.506(a);(v) To or by a business associate foractivities that the business associateundertakes on behalf of a covered entity,
or on behalf of a business associate in
the case of a subcontractor, pursuant to§§ 164.502(e) and 164.504(e), and theonly remuneration provided is by thecovered entity to the business associate,or by the business associate to thesubcontractor, if applicable, for the
performance of such activities;(vi) To an individual, when requested
under § 164.524 or § 164.528;(vii) Required by law as permitted
under § 164.512(a); and(viii) For any other purpose permitted
by and in accordance with theapplicable requirements of this subpart,
where the only remuneration received
by the covered entity or businessassociate is a reasonable, cost-based fee
to cover the cost to prepare and transmit
the protected health information forsuch purpose or a fee otherwise
expressly permitted by other law.
(b) * * *(1) Minimum necessary applies. Whenusing or disclosing protected healthinformation or when requesting

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

protected health information fromanother covered entity or businessassociate, a covered entity or businessassociate must make reasonable efforts
to limit protected health information to
the minimum necessary to accomplish
the intended purpose of the use,
disclosure, or request.
*
*
*
*
*
(e)(1) Standard: Disclosures tobusiness associates. (i) A covered entity
may disclose protected healthinformation to a business associate andmay allow a business associate to create,
receive, maintain, or transmit protected
health information on its behalf, if thecovered entity obtains satisfactory
assurance that the business associate
will appropriately safeguard theinformation. A covered entity is not
required to obtain such satisfactory
assurances from a business associatethat is a subcontractor.
(ii) A business associate may disclose
protected health information to abusiness associate that is asubcontractor and may allow thesubcontractor to create, receive,
maintain, or transmit protected healthinformation on its behalf, if the businessassociate obtains satisfactory
assurances, in accordance with§ 164.504(e)(1)(i), that the subcontractor
will appropriately safeguard theinformation.
(2) Implementation specification:
Documentation. The satisfactory
assurances required by paragraph (e)(1)of this section must be documented
through a written contract or otherwritten agreement or arrangement withthe business associate that meets theapplicable requirements of § 164.504(e).
(f) Standard: Deceased individuals. A
covered entity must comply with therequirements of this subpart withrespect to the protected healthinformation of a deceased individual fora period of 50 years following the deathof the individual.
*
*
*
*
*
■ 47. In § 164.504, revise paragraphs (e),(f)(1)(ii) introductory text, and(f)(2)(ii)(B) to read as follows:§ 164.504 Uses and disclosures:
Organizational requirements.

*

*
*
*
*
(e)(1) Standard: Business associate
contracts. (i) The contract or otherarrangement required by § 164.502(e)(2)must meet the requirements ofparagraph (e)(2), (e)(3), or (e)(5) of thissection, as applicable.
(ii) A covered entity is not incompliance with the standards in§ 164.502(e) and this paragraph, if thecovered entity knew of a pattern of

PO 00000

Frm 00133

Fmt 4701

Sfmt 4700

5697

activity or practice of the businessassociate that constituted a material
breach or violation of the businessassociate’s obligation under the contract
or other arrangement, unless thecovered entity took reasonable steps tocure the breach or end the violation, as
applicable, and, if such steps were
unsuccessful, terminated the contract orarrangement, if feasible.
(iii) A business associate is not incompliance with the standards in§ 164.502(e) and this paragraph, if thebusiness associate knew of a pattern ofactivity or practice of a subcontractor
that constituted a material breach or
violation of the subcontractor’s
obligation under the contract or otherarrangement, unless the businessassociate took reasonable steps to curethe breach or end the violation, as
applicable, and, if such steps were
unsuccessful, terminated the contract orarrangement, if feasible.
(2) Implementation specifications:
Business associate contracts. A contract
between the covered entity and abusiness associate must:(i) Establish the permitted andrequired uses and disclosures ofprotected health information by thebusiness associate. The contract may not
authorize the business associate to use
or further disclose the information in amanner that would violate therequirements of this subpart, if done by
the covered entity, except that:(A) The contract may permit thebusiness associate to use and disclose
protected health information for theproper management and administrationof the business associate, as provided inparagraph (e)(4) of this section; and(B) The contract may permit thebusiness associate to provide data
aggregation services relating to thehealth care operations of the covered
entity.
(ii) Provide that the business associate
will:(A) Not use or further disclose theinformation other than as permitted or
required by the contract or as requiredby law;(B) Use appropriate safeguards andcomply, where applicable, with subpart
C of this part with respect to electronic
protected health information, to prevent
use or disclosure of the information
other than as provided for by its
contract;(C) Report to the covered entity any
use or disclosure of the information notprovided for by its contract of which it
becomes aware, including breaches of
unsecured protected health information
as required by § 164.410;(D) In accordance with§ 164.502(e)(1)(ii), ensure that any

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5698

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

subcontractors that create, receive,
maintain, or transmit protected healthinformation on behalf of the businessassociate agree to the same restrictions
and conditions that apply to thebusiness associate with respect to suchinformation;(E) Make available protected healthinformation in accordance with§ 164.524;(F) Make available protected healthinformation for amendment andincorporate any amendments toprotected health information inaccordance with § 164.526;(G) Make available the information
required to provide an accounting of
disclosures in accordance with§ 164.528;(H) To the extent the businessassociate is to carry out a covered
entity’s obligation under this subpart,comply with the requirements of thissubpart that apply to the covered entity
in the performance of such obligation.
(I) Make its internal practices, books,
and records relating to the use anddisclosure of protected healthinformation received from, or created or
received by the business associate on
behalf of, the covered entity available to
the Secretary for purposes ofdetermining the covered entity’scompliance with this subpart; and(J) At termination of the contract, if
feasible, return or destroy all protected
health information received from, or
created or received by the businessassociate on behalf of, the covered entitythat the business associate still
maintains in any form and retain no
copies of such information or, if such
return or destruction is not feasible,
extend the protections of the contract tothe information and limit further usesand disclosures to those purposes thatmake the return or destruction of theinformation infeasible.
(iii) Authorize termination of thecontract by the covered entity, if thecovered entity determines that thebusiness associate has violated amaterial term of the contract.
(3) Implementation specifications:
Other arrangements. (i) If a covered
entity and its business associate are bothgovernmental entities:(A) The covered entity may comply
with this paragraph and § 164.314(a)(1),
if applicable, by entering into amemorandum of understanding with thebusiness associate that contains terms
that accomplish the objectives ofparagraph (e)(2) of this section and§ 164.314(a)(2), if applicable.
(B) The covered entity may comply
with this paragraph and § 164.314(a)(1),
if applicable, if other law (including
regulations adopted by the covered

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

entity or its business associate) contains
requirements applicable to the businessassociate that accomplish the objectivesof paragraph (e)(2) of this section and§ 164.314(a)(2), if applicable.
(ii) If a business associate is requiredby law to perform a function or activity
on behalf of a covered entity or toprovide a service described in thedefinition of business associate in§ 160.103 of this subchapter to a covered
entity, such covered entity may disclose
protected health information to thebusiness associate to the extent
necessary to comply with the legal
mandate without meeting therequirements of this paragraph and§ 164.314(a)(1), if applicable, provided
that the covered entity attempts in goodfaith to obtain satisfactory assurances as
required by paragraph (e)(2) of thissection and § 164.314(a)(1), if
applicable, and, if such attempt fails,
documents the attempt and the reasonsthat such assurances cannot be
obtained.
(iii) The covered entity may omit fromits other arrangements the termination
authorization required by paragraph(e)(2)(iii) of this section, if such
authorization is inconsistent with thestatutory obligations of the covered
entity or its business associate.
(iv) A covered entity may comply
with this paragraph and § 164.314(a)(1)
if the covered entity discloses only alimited data set to a business associate
for the business associate to carry out ahealth care operations function and thecovered entity has a data use agreementwith the business associate thatcomplies with § 164.514(e)(4) and§ 164.314(a)(1), if applicable.
(4) Implementation specifications:
Other requirements for contracts andother arrangements. (i) The contract orother arrangement between the covered
entity and the business associate may
permit the business associate to use theprotected health information received
by the business associate in its capacity
as a business associate to the covered
entity, if necessary:(A) For the proper management andadministration of the business associate;or(B) To carry out the legal
responsibilities of the businessassociate.
(ii) The contract or other arrangement
between the covered entity and thebusiness associate may permit thebusiness associate to disclose theprotected health information received
by the business associate in its capacity
as a business associate for the purposes
described in paragraph (e)(4)(i) of thissection, if:

PO 00000

Frm 00134

Fmt 4701

Sfmt 4700(A) The disclosure is required by law;or(B)(1) The business associate obtains
reasonable assurances from the person
to whom the information is disclosedthat it will be held confidentially andused or further disclosed only as
required by law or for the purposes forwhich it was disclosed to the person;
and(2) The person notifies the businessassociate of any instances of which it isaware in which the confidentiality of
the information has been breached.
(5) Implementation specifications:
Business associate contracts with
subcontractors. The requirements of§ 164.504(e)(2) through (e)(4) apply tothe contract or other arrangement
required by § 164.502(e)(1)(ii) between abusiness associate and a businessassociate that is a subcontractor in thesame manner as such requirements
apply to contracts or other arrangements
between a covered entity and businessassociate.
(f)(1)* * *(ii) Except as prohibited by§ 164.502(a)(5)(i), the group health plan,or a health insurance issuer or HMO
with respect to the group health plan,
may disclose summary healthinformation to the plan sponsor, if theplan sponsor requests the summary
health information for purposes of:
*
*
*
*
*
(2) * * *(ii) * * *(B) Ensure that any agents to whom it
provides protected health information
received from the group health plan
agree to the same restrictions andconditions that apply to the plan
sponsor with respect to suchinformation;
*
*
*
*
*
■ 48. In § 164.506, revise paragraphs (a)and (c)(5) to read as follows:§ 164.506 Uses and disclosures to carryout treatment, payment, or health care
operations.

(a) Standard: Permitted uses anddisclosures. Except with respect to uses
or disclosures that require an
authorization under § 164.508(a)(2)through (4) or that are prohibited under§ 164.502(a)(5)(i), a covered entity may
use or disclose protected healthinformation for treatment, payment, or
health care operations as set forth inparagraph (c) of this section, provided
that such use or disclosure is consistent
with other applicable requirements ofthis subpart.
*
*
*
*
*
(c) * * *(5) A covered entity that participatesin an organized health care arrangement

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
may disclose protected healthinformation about an individual to otherparticipants in the organized health carearrangement for any health care
operations activities of the organized
health care arrangement.
■ 49. Amend § 164.508 as follows:■ a. Revise the headings of paragraphs(a), (a)(1), and (a)(2);■ b. Revise paragraph (a)(3)(ii);■ c. Add new paragraph (a)(4); and■ d. Revise paragraphs (b)(1)(i), and(b)(3).
The revisions and additions read as
follows:

sroberts on DSK5SPTVN1PROD with§ 164.508 Uses and disclosures for which
an authorization is required.

(a) Standard: Authorizations for usesand disclosures—(1) Authorization
required: General rule. * * *(2) Authorization required:
Psychotherapy notes. * * *(3) * * *(ii) If the marketing involves financial
remuneration, as defined in paragraph(3) of the definition of marketing at§ 164.501, to the covered entity from athird party, the authorization must statethat such remuneration is involved.
(4) Authorization required: Sale ofprotected health information.
(i) Notwithstanding any provision ofthis subpart, other than the transition
provisions in § 164.532, a covered entity
must obtain an authorization for any
disclosure of protected healthinformation which is a sale of protected
health information, as defined in§ 164.501 of this subpart. (ii) Suchauthorization must state that thedisclosure will result in remuneration to
the covered entity.
(b) * * *(1) * * *(i) A valid authorization is adocument that meets the requirementsin paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1),and (c)(2) of this section, as applicable.
*
*
*
*
*
(3) Compound authorizations. An
authorization for use or disclosure ofprotected health information may not be
combined with any other document tocreate a compound authorization,
except as follows:(i) An authorization for the use or
disclosure of protected healthinformation for a research study may be
combined with any other type of written
permission for the same or anotherresearch study. This exception includes
combining an authorization for the useor disclosure of protected healthinformation for a research study withanother authorization for the same
research study, with an authorization
for the creation or maintenance of a
research database or repository, or with

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

a consent to participate in research.
Where a covered health care provider
has conditioned the provision ofresearch-related treatment on theprovision of one of the authorizations,as permitted under paragraph (b)(4)(i) of
this section, any compound
authorization created under thisparagraph must clearly differentiate
between the conditioned andunconditioned components and provide
the individual with an opportunity to
opt in to the research activities
described in the unconditioned
authorization.
(ii) An authorization for a use or
disclosure of psychotherapy notes may
only be combined with anotherauthorization for a use or disclosure of
psychotherapy notes.
(iii) An authorization under thissection, other than an authorization fora use or disclosure of psychotherapy
notes, may be combined with any othersuch authorization under this section,
except when a covered entity has
conditioned the provision of treatment,
payment, enrollment in the health plan,or eligibility for benefits underparagraph (b)(4) of this section on theprovision of one of the authorizations.
The prohibition in this paragraph on
combining authorizations where one
authorization conditions the provisionof treatment, payment, enrollment in ahealth plan, or eligibility for benefits
under paragraph (b)(4) of this section
does not apply to a compound
authorization created in accordancewith paragraph (b)(3)(i) of this section.
*
*
*
*
*
■ 50. Amend § 164.510 as follows:■ a. Revise paragraph (a)(1)(ii)
introductory text;■ b. Revise paragraph (b)(1)(i), thesecond sentence of paragraph (b)(1)(ii),paragraph (b)(2)(iii), the first sentence ofparagraph (b)(3), and paragraph (b)(4);and■ c. Add new paragraph (b)(5).
The revisions and additions read as
follows:§ 164.510 Uses and disclosures requiring
an opportunity for the individual to agree orto object.

*

*
*
*
*
(a) * * *(1) * * *(ii) Use or disclose for directory
purposes such information:
*
*
*
*
*
(b) * * *(1) * * *(i) A covered entity may, in
accordance with paragraphs (b)(2),(b)(3), or (b)(5) of this section, disclose
to a family member, other relative, or a

PO 00000

Frm 00135

Fmt 4701

Sfmt 4700

5699

close personal friend of the individual,
or any other person identified by theindividual, the protected healthinformation directly relevant to such
person’s involvement with theindividual’s health care or payment
related to the individual’s health care.
(ii) * * * Any such use or disclosureof protected health information for such
notification purposes must be inaccordance with paragraphs (b)(2),(b)(3), (b)(4), or (b)(5) of this section, as
applicable.
*
*
*
*
*
(2) * * *(iii) Reasonably infers from thecircumstances, based on the exercise of
professional judgment, that theindividual does not object to thedisclosure.
(3) * * * If the individual is notpresent, or the opportunity to agree orobject to the use or disclosure cannot
practicably be provided because of theindividual’s incapacity or an emergency
circumstance, the covered entity may, inthe exercise of professional judgment,
determine whether the disclosure is in
the best interests of the individual and,if so, disclose only the protected healthinformation that is directly relevant to
the person’s involvement with theindividual’s care or payment related tothe individual’s health care or needed
for notification purposes. * * *(4) Uses and disclosures for disaster
relief purposes. A covered entity may
use or disclose protected healthinformation to a public or private entity
authorized by law or by its charter toassist in disaster relief efforts, for the
purpose of coordinating with such
entities the uses or disclosurespermitted by paragraph (b)(1)(ii) of thissection. The requirements in paragraphs(b)(2), (b)(3), or (b)(5) of this section
apply to such uses and disclosures tothe extent that the covered entity, in theexercise of professional judgment,
determines that the requirements do notinterfere with the ability to respond to
the emergency circumstances.
(5) Uses and disclosures when theindividual is deceased. If the individual
is deceased, a covered entity may
disclose to a family member, or otherpersons identified in paragraph (b)(1) of
this section who were involved in theindividual’s care or payment for healthcare prior to the individual’s death,
protected health information of theindividual that is relevant to such
person’s involvement, unless doing so isinconsistent with any prior expressed
preference of the individual that is
known to the covered entity.
■ 51. Amend § 164.512 as follows:■ a. Revise the paragraph heading forparagraph (b), the introductory text of

E:\FR\FM\25JAR2.SGM

25JAR2

5700

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

paragraph (b)(1) and the introductory
text of paragraph (b)(1)(v)(A);■ b. Add new paragraph (b)(1)(vi);■ c. Revise the introductory text ofparagraph (e)(1)(iii) and paragraph(e)(1)(vi);■ d. Revise paragraph (i)(2)(iii); and■ e. Revise paragraphs (k)(1)(ii), (k)(3),and (k)(5)(i)(E).
The revisions and additions read as
follows:§ 164.512 Uses and disclosures for which
an authorization or opportunity to agree orobject is not required.

sroberts on DSK5SPTVN1PROD with

*

*
*
*
*
(b) Standard: Uses and disclosures for
public health activities. (1) Permitted
uses and disclosures. A covered entity
may use or disclose protected healthinformation for the public healthactivities and purposes described in thisparagraph to:
*
*
*
*
*
(v) * * *(A) The covered entity is a covered
health care provider who provides
health care to the individual at therequest of the employer:
*
*
*
*
*
(vi) A school, about an individual
who is a student or prospective studentof the school, if:(A) The protected health informationthat is disclosed is limited to proof of
immunization;(B) The school is required by State orother law to have such proof of
immunization prior to admitting theindividual; and(C) The covered entity obtains anddocuments the agreement to thedisclosure from either:(1) A parent, guardian, or other person
acting in loco parentis of the individual,
if the individual is an unemancipatedminor; or(2) The individual, if the individual isan adult or emancipated minor.
*
*
*
*
*
(e) * * *(1) * * *(iii) For the purposes of paragraph(e)(1)(ii)(A) of this section, a covered
entity receives satisfactory assurancesfrom a party seeking protected healthinformation if the covered entity
receives from such party a written
statement and accompanying
documentation demonstrating that:
*
*
*
*
*
(vi) Notwithstanding paragraph(e)(1)(ii) of this section, a covered entity
may disclose protected healthinformation in response to lawfulprocess described in paragraph (e)(1)(ii)of this section without receiving
satisfactory assurance under paragraph

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(e)(1)(ii)(A) or (B) of this section, if thecovered entity makes reasonable efforts
to provide notice to the individual
sufficient to meet the requirements ofparagraph (e)(1)(iii) of this section or toseek a qualified protective ordersufficient to meet the requirements ofparagraph (e)(1)(v) of this section.
*
*
*
*
*
(i) * * *(2) * * *(iii) Protected health informationneeded. A brief description of theprotected health information for which
use or access has been determined to benecessary by the institutional review
board or privacy board, pursuant toparagraph (i)(2)(ii)(C) of this section;
*
*
*
*
*
(k) * * *(1) * * *(ii) Separation or discharge frommilitary service. A covered entity that is
a component of the Departments of
Defense or Homeland Security may
disclose to the Department of Veterans
Affairs (DVA) the protected healthinformation of an individual who is amember of the Armed Forces upon theseparation or discharge of the individualfrom military service for the purpose ofa determination by DVA of theindividual’s eligibility for or entitlement
to benefits under laws administered by
the Secretary of Veterans Affairs.
*
*
*
*
*
(3) Protective services for the
President and others. A covered entity
may disclose protected healthinformation to authorized Federal
officials for the provision of protective
services to the President or otherpersons authorized by 18 U.S.C. 3056 or
to foreign heads of state or other persons
authorized by 22 U.S.C. 2709(a)(3), orfor the conduct of investigations
authorized by 18 U.S.C. 871 and 879.
*
*
*
*
*
(5) * * *(i) * * *(E) Law enforcement on the premisesof the correctional institution; or
*
*
*
*
*
■ 52. In § 164.514, revise paragraphs(e)(4)(ii)(C)(4), (f), and (g) to read as
follows:§ 164.514 Other requirements relating touses and disclosures of protected healthinformation.

*

*
*
*
*
(e) * * *(4) * * *(ii) * * *(C) * * *(4) Ensure that any agents to whom it
provides the limited data set agree to thesame restrictions and conditions that

PO 00000

Frm 00136

Fmt 4701

Sfmt 4700

apply to the limited data set recipientwith respect to such information; and
*
*
*
*
*
(f) Fundraising communications.
(1) Standard: Uses and disclosures for
fundraising. Subject to the conditions ofparagraph (f)(2) of this section, acovered entity may use, or disclose to abusiness associate or to an
institutionally related foundation, thefollowing protected health information
for the purpose of raising funds for its
own benefit, without an authorization
meeting the requirements of § 164.508:(i) Demographic information relating
to an individual, including name,address, other contact information, age,gender, and date of birth;(ii) Dates of health care provided to anindividual;(iii) Department of service
information;(iv) Treating physician;(v) Outcome information; and(vi) Health insurance status.
(2) Implementation specifications:
Fundraising requirements. (i) A covered
entity may not use or disclose protected
health information for fundraising
purposes as otherwise permitted byparagraph (f)(1) of this section unless astatement required by§ 164.520(b)(1)(iii)(A) is included in the
covered entity’s notice of privacy
practices.
(ii) With each fundraisingcommunication made to an individual
under this paragraph, a covered entity
must provide the individual with a clear
and conspicuous opportunity to electnot to receive any further fundraisingcommunications. The method for anindividual to elect not to receive further
fundraising communications may notcause the individual to incur an undue
burden or more than a nominal cost.
(iii) A covered entity may notcondition treatment or payment on theindividual’s choice with respect to thereceipt of fundraising communications.
(iv) A covered entity may not makefundraising communications to anindividual under this paragraph where
the individual has elected not to receive
such communications under paragraph(f)(1)(ii)(B) of this section.
(v) A covered entity may provide an
individual who has elected not toreceive further fundraisingcommunications with a method to opt
back in to receive such
communications.
(g) Standard: uses and disclosures forunderwriting and related purposes. If ahealth plan receives protected healthinformation for the purpose ofunderwriting, premium rating, or otheractivities relating to the creation,

E:\FR\FM\25JAR2.SGM

25JAR2Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations
renewal, or replacement of a contract ofhealth insurance or health benefits, andif such health insurance or healthbenefits are not placed with the healthplan, such health plan may only use or
disclose such protected healthinformation for such purpose or as may
be required by law, subject to theprohibition at § 164.502(a)(5)(i) withrespect to genetic information includedin the protected health information.
*
*
*
*
*
■ 53. Amend § 164.520:■ a. Revise paragraphs (b)(1)(ii)(E),(b)(1)(iii), (b)(1)(iv)(A), (b)(1)(v)(A),(c)(1)(i) introductory text, and(c)(1)(i)(B);■ b. Remove paragraph (c)(1)(i)(C); and■ c. Add paragraph (c)(1)(v).
The revisions and addition read as
follows:§ 164.520 Notice of privacy practices forprotected health information.

sroberts on DSK5SPTVN1PROD with

*

*
*
*
*
(b) * * *(1) * * *(ii) * * *(E) A description of the types of usesand disclosures that require an
authorization under § 164.508(a)(2)–(a)(4), a statement that other uses anddisclosures not described in the notice
will be made only with the individual’s
written authorization, and a statementthat the individual may revoke anauthorization as provided by§ 164.508(b)(5).
(iii) Separate statements for certain
uses or disclosures. If the covered entity
intends to engage in any of thefollowing activities, the description
required by paragraph (b)(1)(ii)(A) of
this section must include a separate
statement informing the individual ofsuch activities, as applicable:(A) In accordance with § 164.514(f)(1),
the covered entity may contact theindividual to raise funds for the covered
entity and the individual has a right to
opt out of receiving such
communications; (B) In accordance with§ 164.504(f), the group health plan, or ahealth insurance issuer or HMO withrespect to a group health plan, may
disclose protected health information to
the sponsor of the plan; or(C) If a covered entity that is a healthplan, excluding an issuer of a long-termcare policy falling within paragraph(1)(viii) of the definition of health plan,
intends to use or disclose protected
health information for underwriting
purposes, a statement that the covered
entity is prohibited from using or
disclosing protected health informationthat is genetic information of anindividual for such purposes.
(iv) * * *VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(A) The right to request restrictions oncertain uses and disclosures of protected
health information as provided by§ 164.522(a), including a statement thatthe covered entity is not required toagree to a requested restriction, except
in case of a disclosure restricted under§ 164.522(a)(1)(vi);
*
*
*
*
*
(v) * * *(A) A statement that the covered
entity is required by law to maintain theprivacy of protected health information,
to provide individuals with notice of its
legal duties and privacy practices withrespect to protected health information,and to notify affected individuals
following a breach of unsecured
protected health information;
*
*
*
*
*
(c) * * *(1) * * *(i) A health plan must provide thenotice:*****(B) Thereafter, at the time ofenrollment, to individuals who are newenrollees.
*
*
*
*
*
(v) If there is a material change to thenotice:(A) A health plan that posts its noticeon its web site in accordance withparagraph (c)(3)(i) of this section must
prominently post the change or its
revised notice on its web site by theeffective date of the material change tothe notice, and provide the revised
notice, or information about the materialchange and how to obtain the revised
notice, in its next annual mailing toindividuals then covered by the plan.
(B) A health plan that does not post
its notice on a web site pursuant toparagraph (c)(3)(i) of this section must
provide the revised notice, orinformation about the material change
and how to obtain the revised notice, toindividuals then covered by the plan
within 60 days of the material revision
to the notice.
*
*
*
*
*
■ 54. Amend § 164.522 as follows:■ a. Revise paragraph (a)(1)(ii);■ b. Add new paragraph (a)(1)(vi); and■ c. Revise the introductory text ofparagraph (a)(2), and paragraphs(a)(2)(iii), and paragraph (a)(3).
The revisions and additions read as
follows:§ 164.522 Rights to request privacy
protection for protected health information.

(a)(1) * * *(ii) Except as provided in paragraph(a)(1)(vi) of this section, a covered entity
is not required to agree to a restriction.
*
*
*
*
*

PO 00000

Frm 00137

Fmt 4701

Sfmt 4700

5701(vi) A covered entity must agree to therequest of an individual to restrict
disclosure of protected healthinformation about the individual to ahealth plan if:(A) The disclosure is for the purposeof carrying out payment or health care
operations and is not otherwise requiredby law; and(B) The protected health information
pertains solely to a health care item orservice for which the individual, or
person other than the health plan onbehalf of the individual, has paid thecovered entity in full.
(2) Implementation specifications:
Terminating a restriction. A covered
entity may terminate a restriction, if:
*
*
*
*
*
(iii) The covered entity informs theindividual that it is terminating its
agreement to a restriction, except thatsuch termination is:(A) Not effective for protected healthinformation restricted under paragraph(a)(1)(vi) of this section; and(B) Only effective with respect toprotected health information created or
received after it has so informed theindividual.
(3) Implementation specification:
Documentation. A covered entity must
document a restriction in accordancewith § 160.530(j) of this subchapter.
*
*
*
*
*
■ 55. Amend § 164.524 as follows:■ a. Remove paragraph (b)(2)(ii) andredesignate paragraph (b)(2)(iii) as
paragraph (b)(2)(ii);■ b. Revise newly designated paragraph(b)(2)(ii);■ c. Revise paragraph (c)(2)(i);■ d. Redesignate paragraph (c)(2)(ii) as
paragraph (c)(2)(iii);■ e. Add new paragraph (c)(2)(ii);■ f. Revise paragraphs (c)(3) and(c)(4)(i);■ g. Redesignate paragraphs (c)(4)(ii)and (c)(4)(iii) as paragraphs (c)(4)(iii)and (c)(4)(iv), respectively; and■ h. Add new paragraph (c)(4)(ii).
The revisions and additions read as
follows:§ 164.524 Access of individuals toprotected health information.

*

*
*
*
*
(b) * * *(2) * * *(ii) If the covered entity is unable totake an action required by paragraph(b)(2)(i)(A) or (B) of this section within
the time required by paragraph (b)(2)(i)of this section, as applicable, thecovered entity may extend the time forsuch actions by no more than 30 days,
provided that:(A) The covered entity, within thetime limit set by paragraph (b)(2)(i) of

E:\FR\FM\25JAR2.SGM

25JAR2

sroberts on DSK5SPTVN1PROD with

5702

Federal Register / Vol. 78, No. 17 / Friday, January 25, 2013 / Rules and Regulations

this section, as applicable, provides theindividual with a written statement of
the reasons for the delay and the date bywhich the covered entity will complete
its action on the request; and(B) The covered entity may have only
one such extension of time for action ona request for access.
(c) * * *(2) Form of access requested. (i) The
covered entity must provide theindividual with access to the protected
health information in the form andformat requested by the individual, if it
is readily producible in such form andformat; or, if not, in a readable hard
copy form or such other form andformat as agreed to by the covered entity
and the individual.
(ii) Notwithstanding paragraph(c)(2)(i) of this section, if the protected
health information that is the subject ofa request for access is maintained in one
or more designated record sets
electronically and if the individual
requests an electronic copy of suchinformation, the covered entity must
provide the individual with access tothe protected health information in theelectronic form and format requested by
the individual, if it is readily produciblein such form and format; or, if not, ina readable electronic form and format asagreed to by the covered entity and theindividual.
*
*
*
*
*
(3) Time and manner of access. (i)The covered entity must provide theaccess as requested by the individual ina timely manner as required byparagraph (b)(2) of this section,
including arranging with the individual
for a convenient time and place toinspect or obtain a copy of the protected
health information, or mailing the copyof the protected health information at
the individual’s request. The covered
entity may discuss the scope, format,
and other aspects of the request foraccess with the individual as necessary
to facilitate the timely provision ofaccess.
(ii) If an individual’s request foraccess directs the covered entity totransmit the copy of protected healthinformation directly to another person
designated by the individual, thecovered entity must provide the copy tothe person designated by the individual.
The individual’s request must be inwriting, signed by the individual, andclearly identify the designated person
and where to send the copy of protected
health information.
(4) * * *VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001(i) Labor for copying the protected
health information requested by theindividual, whether in paper orelectronic form;(ii) Supplies for creating the paper
copy or electronic media if theindividual requests that the electronic
copy be provided on portable media;
*
*
*
*
*
■ 56. In § 164.532, revise paragraphs (a),(c)(2), (c)(3), (d), (e)(1), and (e)(2), andadd paragraphs (c)(4) and (f) to read as
follows:§ 164.532

Transition provisions.

(a) Standard: Effect of priorauthorizations. Notwithstanding§§ 164.508 and 164.512(i), a covered
entity may use or disclose protected
health information, consistent withparagraphs (b) and (c) of this section,
pursuant to an authorization or otherexpress legal permission obtained froman individual permitting the use or
disclosure of protected healthinformation, informed consent of theindividual to participate in research, awaiver of informed consent by an IRB,
or a waiver of authorization inaccordance with § 164.512(i)(1)(i).
*
*
*
*
*
(c) * * *(2) The informed consent of theindividual to participate in the research;(3) A waiver, by an IRB, of informed
consent for the research, in accordancewith 7 CFR 1c.116(d), 10 CFR
745.116(d), 14 CFR 1230.116(d), 15 CFR
27.116(d), 16 CFR 1028.116(d), 21 CFR
50.24, 22 CFR 225.116(d), 24 CFR
60.116(d), 28 CFR 46.116(d), 32 CFR
219.116(d), 34 CFR 97.116(d), 38 CFR
16.116(d), 40 CFR 26.116(d), 45 CFR
46.116(d), 45 CFR 690.116(d), or 49 CFR
11.116(d), provided that a covered
entity must obtain authorization inaccordance with § 164.508 if, after thecompliance date, informed consent issought from an individual participatingin the research; or(4) A waiver of authorization inaccordance with § 164.512(i)(1)(i).
(d) Standard: Effect of prior contracts
or other arrangements with businessassociates. Notwithstanding any otherprovisions of this part, a covered entity,
or business associate with respect to a
subcontractor, may disclose protected
health information to a businessassociate and may allow a businessassociate to create, receive, maintain, ortransmit protected health information
on its behalf pursuant to a written
contract or other written arrangementwith such business associate that does

PO 00000

Frm 00138

Fmt 4701

Sfmt 9990

not comply with §§ 164.308(b),164.314(a), 164.502(e), and 164.504(e),only in accordance with paragraph (e) of
this section.
(e) Implementation specification:
Deemed compliance. (1) Qualification.
Notwithstanding other sections of thispart, a covered entity, or businessassociate with respect to a
subcontractor, is deemed to be incompliance with the documentation andcontract requirements of §§ 164.308(b),164.314(a), 164.502(e), and 164.504(e),with respect to a particular businessassociate relationship, for the time
period set forth in paragraph (e)(2) ofthis section, if:(i) Prior to January 25, 2013, suchcovered entity, or business associatewith respect to a subcontractor, hasentered into and is operating pursuant
to a written contract or other written
arrangement with the business associatethat complies with the applicableprovisions of §§ 164.314(a) or 164.504(e)that were in effect on such date; and(ii) The contract or other arrangement
is not renewed or modified from March
26, 2013, until September 23, 2013.
(2) Limited deemed complianceperiod. A prior contract or otherarrangement that meets the qualification
requirements in paragraph (e) of thissection shall be deemed compliant until
the earlier of:(i) The date such contract or otherarrangement is renewed or modified on
or after September 23, 2013; or(ii) September 22, 2014.
*
*
*
*
*
(f) Effect of prior data use agreements.
If, prior to [January 25, 2013, a covered
entity has entered into and is operating
pursuant to a data use agreement witha recipient of a limited data set thatcomplies with § 164.514(e),notwithstanding § 164.502(a)(5)(ii), thecovered entity may continue to disclose
a limited data set pursuant to suchagreement in exchange for remunerationfrom or on behalf of the recipient of theprotected health information until theearlier of:(1) The date such agreement isrenewed or modified on or after
September 23, 2013; or(2) September 22, 2014.
*
*
*
*
*
Dated: January 15, 2013.
Kathleen Sebelius,
Secretary.
[FR Doc. 2013–01073 Filed 1–17–13; 4:15 pm]
BILLING CODE 4153–01–P

E:\FR\FM\25JAR2.SGM

25JAR2