23214

Federal Register / Vol. 75, No. 84 / Monday, May 3, 2010 / Proposed Rules

power and responsibilities between theFederal Government and Indian tribes.
Energy Effects
We have analyzed this proposed rule
under Executive Order 13211, Actions
Concerning Regulations That
Significantly Affect Energy Supply,Distribution, or Use. We havedetermined that it is not a ‘‘significant
energy action’’ under that order because
it is not a ‘‘significant regulatory action’’under Executive Order 12866 and is not
likely to have a significant adverse effecton the supply, distribution, or use ofenergy. The Administrator of the Officeof Information and Regulatory Affairs
has not designated it as a significant
energy action. Therefore, it does not
require a Statement of Energy Effects
under Executive Order 13211.
Technical Standards
The National Technology Transferand Advancement Act (NTTAA) (15U.S.C. 272 note) directs agencies to use
voluntary consensus standards in theirregulatory activities unless the agency
provides Congress, through the Office ofManagement and Budget, with an
explanation of why using thesestandards would be inconsistent withapplicable law or otherwise impractical.
Voluntary consensus standards aretechnical standards (e.g., specificationsof materials, performance, design, oroperation; test methods; sampling
procedures; and related management
systems practices) that are developed oradopted by voluntary consensus
standards bodies.
This proposed rule does not use
technical standards. Therefore, we did
not consider the use of voluntary
consensus standards.

emcdonald on DSK2BSOYB1PROD with PROPOSALSHarbors, Marine safety, Navigation(water), Reporting and record keeping
requirements, Security measures,Waterways.
For the reasons discussed in thepreamble, the Coast Guard proposes toamend 33 CFR Part 165 as follows:
PART 165—REGULATED NAVIGATION
AREAS AND LIMITED ACCESS AREAS
1. The authority citation for part 165
continues to read as follows:
Authority: 33 U.S.C. 1226, 1231; 46 U.S.C.
Chapter 701, 3306, 3703; 50 U.S.C. 191, 195;
33 CFR 1.05–1, 6.04–1, 6.04–6, 160.5; Pub. L.
107–295, 116 Stat. 2064; Department ofHomeland Security Delegation No. 0170.1

2. Add § 165.1334 to read as follows:§ 165.1334 Security Zone; U.S. Coast
Guard BSU Seattle, Pier 36, Elliot Bay,Seattle, WA.

(a) Location: The following area is asecurity zone: All waters in Elliot Bay
east of a line from 47° 35.450′ N 122°
20.585′ W to 47° 35.409′ N 122°20.585′
W at Pier 36, Elliot Bay, Seattle, WA.
(b) Regulations: Under 33 CFR part
165, subpart D, no person or vessel may
enter or remain in the security zone
established by this section without thepermission of the Captain of the Port
Puget Sound or DesignatedRepresentative.
(c) Authorization: To request
authorization to operate within thissecurity zone, contact United States
Coast Guard Sector Seattle Joint HarborOperations Center at 206–217–6001.
Dated: April 6, 2010.
S.E. Englebert,
Captain, U.S. Coast Guard, Captain of thePort, Puget Sound.
[FR Doc. 2010–10209 Filed 4–30–10; 8:45 am]

Environment
We have analyzed this proposed rule
under Department of Homeland
Security Management Directive 023–01
and Commandant Instruction
M16475.lD, which guide the Coast
Guard in complying with the National
Environmental Policy Act of 1969
(NEPA) (42 U.S.C. 4321–4370f), andhave made a preliminary determinationthat this action is one of a category ofactions that do not individually orcumulatively have a significant effect on
the human environment. A preliminary
environmental analysis checklist
supporting this determination isavailable in the docket where indicatedunder ADDRESSES. We seek any
comments or information that may leadto the discovery of a significant
environmental impact from this
proposed rule.

VerDate Mar<15>2010

List of Subjects in 33 CFR Part 165

16:30 Apr 30, 2010

Jkt 220001

BILLING CODE 9110–04–P

DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
45 CFR Parts 160 and 164
RIN 0991–AB62

HIPAA Privacy Rule Accounting ofDisclosures Under the Health
Information Technology for Economicand Clinical Health Act; Request for
Information
AGENCY: Office for Civil Rights,
Department of Health and HumanServices.
ACTION: Request for information.

PO 00000

Frm 00024

Fmt 4702

Sfmt 4702

SUMMARY: Section 13405(c) of the Health
Information Technology for Economicand Clinical Health (HITECH) Act
expands an individual’s right under theHealth Insurance Portability andAccountability Act of 1996 (HIPAA)
Privacy Rule to receive an accounting ofdisclosures of protected healthinformation made by HIPAA coveredentities and their business associates. In
particular, section 13405(c) of theHITECH Act requires the Department of
Health and Human Services(‘‘Department’’ or ‘‘HHS’’) to revise theHIPAA Privacy Rule to require coveredentities to account for disclosures ofprotected health information to carryout treatment, payment, and health care
operations if such disclosures arethrough an electronic health record.
This document is a request for
information (RFI) to help us better
understand the interests of individuals
with respect to learning of suchdisclosures, the administrative burden
on covered entities and businessassociates of accounting for suchdisclosures, and other information thatmay inform the Department’s
rulemaking in this area.
DATES: Submit comments on or before
May 18, 2010.
ADDRESSES: Written comments may besubmitted through any of the methods
specified below. Please do not submit
duplicate comments.
• Federal eRulemaking Portal: You
may submit electronic comments at
http://www.regulations.gov. Follow theinstructions for submitting electroniccomments. Attachments should be in
Microsoft Word, WordPerfect, or Excel;
however, we prefer Microsoft Word.
• Regular, Express, or Overnight Mail:
You may mail written comments (oneoriginal and two copies) to the followingaddress only: U.S. Department of Healthand Human Services, Office for CivilRights, Attention: HITECH Accountingof Disclosures, Hubert H. Humphrey
Building, Room 509F, 200
Independence Avenue, SW.,
Washington, DC 20201.
• Hand Delivery or Courier: If youprefer, you may deliver (by hand orcourier) your written comments (oneoriginal and two copies) to the following
address only: Office for Civil Rights,
Attention: HITECH Accounting ofDisclosures, Hubert H. Humphrey
Building, Room 509F, 200
Independence Avenue, SW.,
Washington, DC 20201. (Because accessto the interior of the Hubert H.
Humphrey Building is not readily
available to persons without Federal
government identification, commenters
are encouraged to leave their comments

E:\FR\FM\03MYP1.SGM

03MYP1Federal Register / Vol. 75, No. 84 / Monday, May 3, 2010 / Proposed Rulesin the mail drop slots located in themain lobby of the building.)
Inspection of Public Comments: Allcomments received before the close of
the comment period will be available forpublic inspection, including any
personally identifiable or confidential
business information that is included ina comment. We will post all comments
received before the close of thecomment period at http://
www.regulations.gov. Because
comments will be made public, theyshould not include any sensitive
personal information, such as a person’ssocial security number; date of birth;
driver’s license number, state
identification number or foreign countryequivalent; passport number; financial
account number; or credit or debit card
number. Comments also should notinclude any sensitive healthinformation, such as medical records orother individually identifiable healthinformation, or any non-public
corporate or trade association
information, such as trade secrets orother proprietary information.
FOR FURTHER INFORMATION CONTACT:

Andra Wicks, 202–205–2292.
SUPPLEMENTARY INFORMATION:

emcdonald on DSK2BSOYB1PROD with PROPOSALS

I. BackgroundCovered entities under the Health
Insurance Portability andAccountability Act of 1996 (HIPAA),
Title II, Subtitle F—Administrative
Simplification, Public Law 104–191,
110 Stat. 2021, are currently required by
the HIPAA Privacy Rule at 45 CFR
164.528 to make available to anindividual upon request an accountingof certain disclosures of the individual’s
protected health information over thepast six years. For each disclosure, theaccounting must include: (1) The date ofthe disclosure; (2) the name (andaddress, if known) of the entity or
person who received the protected
health information; (3) a brief
description of the information
disclosed; and (4) a brief statement of
the purpose of the disclosure (or a copyof the written request for thedisclosure). For multiple disclosures tothe same person for the same purpose,
the accounting is only required toinclude: (1) For the first disclosure, afull accounting, with the elements
described above; (2) the frequency,periodicity, or number of disclosures
made during the accounting period; and(3) the date of the last such disclosure
made during the accounting period.
Section 164.528(a)(1)(i) of the Privacy
Rule currently exempts disclosures tocarry out treatment, payment, andVerDate Mar<15>2010

16:30 Apr 30, 2010

Jkt 220001

health care operations from theseaccounting requirements.1
Section 13405(c) of the Health
Information Technology for Economic
and Clinical Health (HITECH) Act,
Public Law 111–5, 123 Stat. 265–66,
provides that the exemption at§ 164.528(a)(1)(i) of the Privacy Rule fordisclosures to carry out treatment,payment, and health care operations nolonger applies to disclosures ‘‘throughan electronic health record.’’ Undersection 13405(c), an individual has aright to receive an accounting of suchdisclosures that covers disclosures madeduring the three years prior to therequest. Section 13400 of the statutedefines ‘‘electronic health record’’ as ‘‘anelectronic record of health-related
information on an individual that iscreated, gathered, managed, andconsulted by authorized health careclinicians and staff.’’ We take theopportunity in this RFI to request publiccomment to inform our regulations
under the HITECH Act, which requiresthat we take into account both theinterests of individuals in learning thecircumstances under which theirprotected health information is being
disclosed and the administrative burdenof accounting for disclosures fortreatment, payment, and health care
operations through an electronic healthrecord.
We request comments specifically on
the questions below. The Department
welcomes comments from all
stakeholders on these issues, but in
addition to hearing from covered
entities, is particularly interested inhearing from individuals, consumer
advocates and groups, and, regarding
technical capabilities, from vendors ofelectronic health record systems.
II. Questions
1. What are the benefits to theindividual of an accounting ofdisclosures, particularly of disclosures
made for treatment, payment, andhealth care operations purposes?
2. Are individuals aware of theircurrent right to receive an accounting ofdisclosures? On what do you base thisassessment?
3. If you are a covered entity, how doyou make clear to individuals their rightto receive an accounting of disclosures?
How many requests for an accountinghave you received from individuals?
4. For individuals that have received
an accounting of disclosures, did theaccounting provide the individual with
the information he or she was seeking?
1 The core health care activities of ‘‘Treatment,’’‘‘Payment,’’ and ‘‘Health Care Operations’’ aredefined in the Privacy Rule at 45 CFR 164.501.

PO 00000

Frm 00025

Fmt 4702

Sfmt 4702

23215

Are you aware of how individuals use
this information once obtained?
5. With respect to treatment, payment,
and health care operations disclosures,
45 CFR 170.210(e) currently provides
the standard that an electronic healthrecord system record the date, time,patient identification, user
identification, and a description of thedisclosure. In response to its interim
final rule, the Office of the National
Coordinator for Health Information
Technology received comments on thisstandard and the corresponding
certification criterion suggesting that thestandard also include to whom adisclosure was made (i.e., recipient) andthe reason or purpose for the disclosure.
Should an accounting for treatment,
payment, and health care operations
disclosures include these or otherelements and, if so, why? How
important is it to individuals to know
the specific purpose of a disclosure—i.e., would it be sufficient to describe
the purpose generally (e.g., for ‘‘fortreatment,’’ ‘‘for payment,’’ or ‘‘for healthcare operations purposes’’), or is moredetail necessary for the accounting to beof value? To what extent are individuals
familiar with the different activities thatmay constitute ‘‘health care operations?’’
On what do you base this assessment?
6. For existing electronic healthrecord systems:(a) Is the system able to distinguishbetween ‘‘uses’’ and ‘‘disclosures’’ as
those terms are defined under theHIPAA Privacy Rule? Note that the term‘‘disclosure’’ includes the sharing ofinformation between a hospital andphysicians who are on the hospital’s
medical staff but who are not membersof its workforce.
(b) If the system is limited to only
recording access to information without
regard to whether it is a use or
disclosure, such as certain audit logs,
what information is recorded? How longis such information retained? Whatwould be the burden to retain theinformation for three years?
(c) If the system is able to distinguishbetween uses and disclosures ofinformation, what data elements areautomatically collected by the systemfor disclosures (i.e., collected without
requiring any additional manual input
by the person making the disclosure)?
What information, if any, is manuallyentered by the person making thedisclosure?
(d) If the system is able to distinguishbetween uses and disclosures ofinformation, does it record a descriptionof disclosures in a standardized manner(for example, does the system offer or
require a user to select from a limited
list of types of disclosures)? If yes, isE:\FR\FM\03MYP1.SGM

03MYP1

23216

Federal Register / Vol. 75, No. 84 / Monday, May 3, 2010 / Proposed Rules

emcdonald on DSK2BSOYB1PROD with PROPOSALS

such a feature being utilized and what
are its benefits and drawbacks?
(e) Is there a single, centralized
electronic health record system? Or is ita decentralized system (e.g., different
departments maintain different
electronic health record systems and an
accounting of disclosures for treatment,
payment, and health care operations
would need to be tracked for eachsystem)?
(f) Does the system automaticallygenerate an accounting for disclosures
under the current HIPAA Privacy Rule(i.e., does the system account fordisclosures other than to carry out
treatment, payment, and health careoperations)?
i. If yes, what would be the additionalburden to also account for disclosures tocarry out treatment, payment, andhealth care operations? Would there beadditional hardware requirements (e.g.,to store such accounting information)?
Would such an accounting feature
impact system performance?

VerDate Mar<15>2010

16:30 Apr 30, 2010

Jkt 220001

ii. If not, is there a different
automated system for accounting fordisclosures, and does it interface withthe electronic health record system?
7. The HITECH Act provides that acovered entity that has acquired anelectronic health record after January 1,
2009 must comply with the new
accounting requirement beginning
January 1, 2011 (or anytime after thatdate when it acquires an electronic
health record), unless we extend thiscompliance deadline to no later than2013. Will covered entities be able tobegin accounting for disclosuresthrough an electronic health record tocarry out treatment, payment, andhealth care operations by January 1,
2011? If not, how much time would ittake vendors of electronic health record
systems to design and implement sucha feature? Once such a feature isavailable, how much time would it takefor a covered entity to install an updated
electronic health record system withthis feature?

PO 00000

Frm 00026

Fmt 4702

Sfmt 9990

8. What is the feasibility of anelectronic health record module that is
exclusively dedicated to accounting fordisclosures (both disclosures that mustbe tracked for the purpose of accounting
under the current HIPAA Privacy Ruleand disclosures to carry out treatment,payment, and health care operations)?
Would such a module work withcovered entities that maintaindecentralized electronic health recordsystems?
9. Is there any other information thatwould be helpful to the Department
regarding accounting for disclosuresthrough an electronic health record tocarry out treatment, payment, andhealth care operations?
Dated: April 26, 2010.
Georgina Verdugo,Director, Office for Civil Rights.
[FR Doc. 2010–10054 Filed 4–30–10; 8:45 am]
BILLING CODE 4153–01–P

E:\FR\FM\03MYP1.SGM

03MYP1