Document Headings

                    Document headings vary by document type but may contain                    the following:                  
                -                       the agency or agencies that issued and signed a document                    
                -                       the number of the CFR title and the number of each part                      the document amends, proposes to amend, or is directly                      related to                    
                -                       the agency docket number / agency internal file number                    
                -                       the RIN which identifies each regulatory action listed in                      the Unified Agenda of Federal Regulatory and Deregulatory                      Actions                    

                    See the                                          Document Drafting Handbook                                        for more details.                  

###### Department of Health and Human Services

###### Office of the Secretary

          - 45 CFR Parts 160 and 164
          - RIN 0991-AB08

# AGENCY:

Office for Civil Rights, HHS.

# ACTION:

Final rule; request for comments.

# SUMMARY:

                        This action provides for the submission of comments on a technical amendment to the final rule adopting standards for privacy of individually identifiable health information published on December 28, 2000, in the                         **Federal Register**                         (65 FR 82462), to convert it to a final rule with request for comments. The purpose of this action is to permit public comment on the final rule for a limited period before the rule becomes effective.                    

# DATES:

1. Comments will be considered if received as provided below, no later than 5 p.m. on March 30, 2001.

2. The effective date of the final rule with request for comments published December 28, 2000 (65 FR 82462) was corrected to be April 14, 2001. See 66 FR 12434 (February 26, 2001).

# ADDRESSES:

Comments will be considered only if provided through any of the following means:

1. Mail written comments (1 original and, if possible, a floppy disk) to the following address: U.S. Department of Health and Human Services, Attention: Privacy I, Room 801, Hubert H. Humphrey Building, 200 Independence Avenue, SW., Washington, DC 20201. 

2. Deliver written comments (1 original and, if possible, a floppy disk) to Room 801, 200 Independence Avenue, SW., Washington, DC 20201.

3. Submit electronic comments at the following website: http://aspe.hhs.gov/​admnsimp/​.

# FOR FURTHER INFORMATION CONTACT:

Kimberly Coleman, 1-866-OCR-PRIV (1-866-627-7748) or TTY 1-866-788-4989.

# SUPPLEMENTARY INFORMATION:

## Comment Procedures, Availability of Copies, and Electronic Access

*Comment procedures:*                     All comments should include the full name, address, and telephone number of the sender or a knowledgeable point of contact. Each specific comment should specify the section of the final rule to which the specific comment pertains. If possible, please send an electronic version of the                           ( print page 12739)                        comments on a 3                    1/2                     inch DOS format floppy disk in Adobe Acrobat Portable Document Format (PDF), HTML, ASCII text, or popular word processor format (Microsoft Word, Corel WordPerfect). All comments and content must be limited to the 8.5 wide by 11.0 high vertical (also referred to as “portrait”) page orientation. If identical/duplicate comment submissions are submitted both electronically and in paper form, each submission should clearly indicate that it is a duplicate submission.                

                    Because of staffing and resource limitations, we will                     *not*                     accept comments by electronic mail or facsimile (FAX) transmission. Any comments received through such media will be deleted or destroyed, as appropriate. They will not be considered as public comments.                

Comments that are timely received in proper form and at one of the addresses specified above will be available for public inspection by appointment as they are received, generally beginning approximately three weeks after this publication in Room 801 of the Department's offices at 200 Independence Avenue, SW, Washington, DC on Monday through Friday of each week from 8:30 a.m. to 5 p.m. Appointments may be made by telephoning 202-260-3392.

After the close of the comment period, comments that we are technically able to convert will be posted on the Administrative Simplification website specified above.

*Copies:*                     To order copies of the                     **Federal Register**                     containing this document, send your request to New Orders, Superintendent of Documents, PO Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at 202-512-1800 or by fax to 202-512-2250. The cost for each copy is $9. Alternatively, the                     **Federal Register**                     may be viewed and photocopied at most libraries designated as Federal Depository Libraries and at many other public and academic libraries throughout the country that receive the                     **Federal Register**                    .                

*Electronic Access:*                     This document is available electronically at the above website as well as at the web site of the Government Printing Office at                     *http://www.access.gpo.gov/​su_​docs/​aces/​140.html.*

## Discussion

                    On December 28, 2000, we published in the                     **Federal Register**                     a final rule adopting standards for the privacy of individually identifiable health information (Privacy Rule). The Privacy Rule is the second in a series of rules mandated by sections 261-264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. In general, the Privacy Rule establishes in 45 CFR part 160 a set of definitions applicable to the entire set of HIPAA rules, requirements for requesting that a state law be excepted from preemption by the statute, and compliance and enforcement requirements. The Privacy Rule also establishes a new subpart E of part 164. Subpart E establishes standards which entities covered by the statute—health plans, health care clearinghouses, and certain health care providers—are required to comply with to protect the privacy of certain individually identifiable health information (“protected health  information”). The standards are requirements relating to the uses and disclosures of protected health information, the rights of individuals with respect to their protected health information, and the procedures for exercising those rights.                

                    The Privacy Rule affects over 600,000 entities and virtually every American. It is estimated to cost in excess of $17.6 billion over ten years. The Department received over 52,000 public comments in the public comment period on the proposed rule; in the period following publication of the final rule, HHS has received approximately a thousand inquiries about the impact and operation of the Privacy Rule on numerous sectors of the economy. Many comments exhibit substantial confusion over how the Rule will operate; others express great concern over the complexity and workability of the Rule. The significance of the Privacy Rule for the health care industry and for society as a whole, and the substantial nature of some concerns that have been raised have led us to conclude that an additional comment period on the Privacy Rule is warranted. Accordingly, we hereby solicit public comment for 30 days on the Privacy Rule, as published in the                     **Federal Register**                     on December 28, 2000 at 65 FR 82462.                

Based on telephone calls, e-mails, letters, and other contacts with HHS, we are aware that the Privacy Rule has been the subject of widespread debate in the health care industry and the public at large in the almost two months since its publication. Thus, we believe that many of the public's concerns about the Privacy Rule have already crystallized. We accordingly are of the view that 30 days should be sufficient for the public to state its views fully to HHS.

                    We determined that the report to Congress required by 5 U.S.C. 801(a)(1) was not received by the Congress concurrent with the transmission of the Privacy Rule to the                     **Federal Register**                    , as previously thought. We have published elsewhere in this section of the                     **Federal Register**                     a final rule correcting the effective date of the Privacy Rule to April 14, 2001 to comply with 5 U.S.C. 801(a)(3)(A). This action does not alter the corrected effective date. The public comment period provided for above accordingly will close before the Privacy Rule becomes effective.                

Dated: February 22, 2001.

Tommy G. Thompson,

Secretary.

[FR Doc. 01-4811  Filed 2-26-01; 11:13 am]

BILLING CODE 4150-04-M