Document Headings

                    Document headings vary by document type but may contain                    the following:                  
                -                       the agency or agencies that issued and signed a document                    
                -                       the number of the CFR title and the number of each part                      the document amends, proposes to amend, or is directly                      related to                    
                -                       the agency docket number / agency internal file number                    
                -                       the RIN which identifies each regulatory action listed in                      the Unified Agenda of Federal Regulatory and Deregulatory                      Actions                    

                    See the                                          Document Drafting Handbook                                        for more details.                  

###### Department of Health and Human Services

###### Office of the Secretary

Notice is hereby given, that I have delegated to the Director of the Office for Civil Rights (OCR), with authority to redelegate, the following authority vested in the Secretary of Health and Human Services:

1. The authority under section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, as amended, to the extent that these actions pertain to the “Security Standards for the Protection of Electronic Protected Health Information,” at 45 CFR part 160 and part 164, subparts A and C, to

A. Impose civil money penalties under section 1176 of the Social Security Act for a covered entity's failure to comply with certain requirements and standards;

B. Issue subpoenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation or compliance review for failure to comply with certain requirements and standards; and

C. Make exception determinations, under section 1178(a)(2)(A) of the Social Security Act, concerning when provisions of State laws that are contrary to the Federal standards are not preempted by the Federal provisions.

2. The authority under section 262 of HIPAA, as amended, to administer the regulation “Security Standards for the Protection of Electronic Protected Health Information,” at 45 CFR part 160 and part 164, subparts A and C, and General Administrative Requirements, 45 CFR Part 160, as these requirements pertain to part 164, subparts A and C, and to make decisions regarding the interpretation and enforcement of these Standards and General Administrative Requirements.

This delegation shall be exercised under the Department's existing delegation of authority and policy relating to regulations.

This delegation supersedes the memorandum from the Secretary to the Administrator, Centers for Medicare & Medicaid Services, dated October 7, 2003, titled “Delegation of Authority for Certain Provisions Under Part C of Title XI of the Social Security Act.”

I hereby affirm and ratify any actions taken by the Director of OCR or his/her subordinates which involved the exercise of the authority delegated herein prior to the effective date of this delegation.

This delegation is effective immediately.

Dated: July 27, 2009.

Kathleen Sebelius, 

Secretary.

[FR Doc. E9-18557 Filed 8-3-09; 8:45 am]

BILLING CODE 4153-01-P