12434 Federal Register / Vol. 66, No. 38 / Monday, February 26, 2001 / Rules and Regulations

DEPARTMENT OF HEALTH AND

HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0991–AB08

Standards for Privacy of Individually

Identifiable Health Information

AGENCY: Office for Civil Rights, HHS.

ACTION: Final rule; correction of

effective and compliance dates.

SUMMARY: This action corrects the

effective date of the final rules adopting

standards for privacy of individually

identifiable health information

published on December 28, 2000, in the

Federal Register (65 FR 82462),

resulting in a new effective date of April

14, 2001. The change in the effective

date delays, by operation of law, the

compliance dates published in the final

rules. The compliance dates in the final

rules are revised accordingly.

DATES: 1. The effective date of the

Standards for Privacy of Individually

Identifiable Health Information

published in the Federal Register on

December 28, 2000, at 65 FR 82462 as

amended by this final rule is April 14,

2001.

2. The revision to 45 CFR 164.534 is

effective April 14, 2001.

FOR FURTHER INFORMATION CONTACT:

Kimberly Coleman, 1–866–OCR–PRIV

(1–866–627–7748) or TTY 1–866–788–

4989.

SUPPLEMENTARY INFORMATION: On

December 28, 2000, we published in the

Federal Register final rules adopting

standards for the privacy of individually

identifiable health information (Privacy

Rule). The Privacy Rule is the second in

a series of rules mandated by sections

261–264 of the Health Insurance

Portability and Accountability Act of

1996 (HIPAA), Public Law 104–191. In

general, the Privacy Rule establishes in

45 CFR Part 160 a set of definitions

applicable to the entire set of HIPAA

rules, requirements for requesting that a

state law be excepted from preemption

by the statute, and compliance and

enforcement requirements. The Privacy

Rule also establishes a new Subpart E of

Part 164. Subpart E establishes

standards which entities covered by the

statute—health plans, health care

clearinghouses, and certain health care

providers—are required to comply with

to protect the privacy of certain

individually identifiable health

information (‘‘protected health

information’’). The standards establish

requirements relating to the uses and

disclosures of protected health

information, the rights of individuals

with respect to their protected health

information, and the procedures for

exercising those rights.

We have determined that the report to

the Congress required by 5 U.S.C.

801(a)(1) was not received, as

previously thought, concurrent with the

transmission of the Rule to the Federal

Register. The required report was

received by the Congress on February

13, 2001. Under 5 U.S.C. 801(a)(3)(A),

the effective date of a major rule is, as

pertinent here, ‘‘the later of the date

occurring 60 days after the date on

which * * * the Congress receives the

[required] report * * *, or * * * the

rule is published in the Federal Register

* * *’’. Thus, the published effective

date, which was 60 days following the

date of publication of the Rule in the

Federal Register, is erroneous; rather,

under 5 U.S.C. 801(a)(3)(A), the actual

effective date of the Privacy Rule is 60

days after the receipt by the Congress of

the final rule, or April 14. This final rule

corrects the previously published

effective date of the Privacy Rule

accordingly.

Because the correction of the effective

date is required by law, we find good

cause under 5 U.S.C. 553(b)(3)(B) and

553(d)(3) to waive public comment

thereon and to make the correction

effective immediately upon publication

today in the Federal Register.

Under section 1175 of the Social

Security Act, 42 U.S.C. 1320d–4,

enacted by section 262 of HIPAA, most

covered entities have two years

following initial adoption of a HIPAA

standard to come into compliance with

the standard; small health plans have

three years. Since a HIPAA standard is

adopted when the rule adopting it

becomes effective, the change in

effective date, by operation of law, has

the effect of moving the statutory

compliance dates forward by a

commensurate period. As the

compliance dates are part of the text of

the Privacy Rule (45 CFR 164.534), they

are being amended to reflect the change

in the effective date.

This amendment is technical in

nature and is required by statute, in

light of the change of the effective date

of the Privacy Rule. Consequently, we

find that good causer under 5 U.S.C.

553(b)(3)(B) exists for waiving prior

public comment on the revision to

§ 164.534.

List of Subjects

45 CFR Part 160

Electronic transactions, Employer

benefit plan, Health, Health care, Health

facilities, Health insurance, Health

records, Medicaid, Medical research,

Medicare, Privacy, Reporting and record

keeping requirements.

45 CFR Part 164

Electronic transactions, Employer

benefit plan, Health, Health care, Health

facilities, Health insurance, Health

records, Medicaid, Medical research,

Medicare, Privacy, Reporting and record

keeping requirements.

Dated: February 22, 2001.

Tommy G. Thompson,

Secretary.

For the reasons set forth in the

preamble, § 164.534 of title 45, Code of

Federal Regulations, is amended as

follows:

1. The authority citation for Subpart

E of 45 Code of Federal Regulations Part

164 is revised to read as follows:

Authority: 42 U.S.C. 1320d–2 and 1320d–

4, sec. 264 of Pub. L. 104–191, 110 Stat.

2033–2034 (42 U.S.C. 1320d–2(note)).

2. Section 164.534 of Subpart E of 45

Code of Federal Regulations Part 164 is

revised to read as follows:

§ 164.534 Compliance dates for initial

implementation of the privacy standards.

(a) Health care providers. A covered

health care provider must comply with

the applicable requirements of this

subpart no later than April 14, 2003.

(b) Health plans. A health plan must

comply with the applicable

requirements of this subpart no later

than the following as applicable:

(1) Health plans other han small

health plans. April 14, 2003.

(2) Small health plans. April 14, 2004.

(c) Health clearinghouses. A health

care clearinghouse must comply with

the applicable requirements of this

subpart no later than April 14, 2003.

[FR Doc. 01–4810 Filed 2–23–01; 1:00 pm]

BILLING CODE 4150–04–M