[Federal Register Volume 66, Number 38 (Monday, February 26, 2001)]
[Rules and Regulations]
[Page 12434]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-4810]



[[Page 12433]]

-----------------------------------------------------------------------

Part IV





Department of Health and Human Services





-----------------------------------------------------------------------



Office of the Secretary



-----------------------------------------------------------------------



45 CFR Parts 160 and 164



Standards for Privacy of Individually Identifiable Health Information; 
Final Rule

Federal Register / Vol. 66, No. 38 / Monday, February 26, 2001 / 
Rules and Regulations

[[Page 12434]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0991-AB08


Standards for Privacy of Individually Identifiable Health 
Information

AGENCY: Office for Civil Rights, HHS.

ACTION: Final rule; correction of effective and compliance dates.

-----------------------------------------------------------------------

SUMMARY: This action corrects the effective date of the final rules 
adopting standards for privacy of individually identifiable health 
information published on December 28, 2000, in the Federal Register (65 
FR 82462), resulting in a new effective date of April 14, 2001. The 
change in the effective date delays, by operation of law, the 
compliance dates published in the final rules. The compliance dates in 
the final rules are revised accordingly.

DATES: 1. The effective date of the Standards for Privacy of 
Individually Identifiable Health Information published in the Federal 
Register on December 28, 2000, at 65 FR 82462 as amended by this final 
rule is April 14, 2001.
    2. The revision to 45 CFR 164.534 is effective April 14, 2001.

FOR FURTHER INFORMATION CONTACT: Kimberly Coleman, 1-866-OCR-PRIV (1-
866-627-7748) or TTY 1-866-788-4989.

SUPPLEMENTARY INFORMATION: On December 28, 2000, we published in the 
Federal Register final rules adopting standards for the privacy of 
individually identifiable health information (Privacy Rule). The 
Privacy Rule is the second in a series of rules mandated by sections 
261-264 of the Health Insurance Portability and Accountability Act of 
1996 (HIPAA), Public Law 104-191. In general, the Privacy Rule 
establishes in 45 CFR Part 160 a set of definitions applicable to the 
entire set of HIPAA rules, requirements for requesting that a state law 
be excepted from preemption by the statute, and compliance and 
enforcement requirements. The Privacy Rule also establishes a new 
Subpart E of Part 164. Subpart E establishes standards which entities 
covered by the statute--health plans, health care clearinghouses, and 
certain health care providers--are required to comply with to protect 
the privacy of certain individually identifiable health information 
(``protected health information''). The standards establish 
requirements relating to the uses and disclosures of protected health 
information, the rights of individuals with respect to their protected 
health information, and the procedures for exercising those rights.
    We have determined that the report to the Congress required by 5 
U.S.C. 801(a)(1) was not received, as previously thought, concurrent 
with the transmission of the Rule to the Federal Register. The required 
report was received by the Congress on February 13, 2001. Under 5 
U.S.C. 801(a)(3)(A), the effective date of a major rule is, as 
pertinent here, ``the later of the date occurring 60 days after the 
date on which * * * the Congress receives the [required] report * * *, 
or * * * the rule is published in the Federal Register * * *''. Thus, 
the published effective date, which was 60 days following the date of 
publication of the Rule in the Federal Register, is erroneous; rather, 
under 5 U.S.C. 801(a)(3)(A), the actual effective date of the Privacy 
Rule is 60 days after the receipt by the Congress of the final rule, or 
April 14. This final rule corrects the previously published effective 
date of the Privacy Rule accordingly.
    Because the correction of the effective date is required by law, we 
find good cause under 5 U.S.C. 553(b)(3)(B) and 553(d)(3) to waive 
public comment thereon and to make the correction effective immediately 
upon publication today in the Federal Register.
    Under section 1175 of the Social Security Act, 42 U.S.C. 1320d-4, 
enacted by section 262 of HIPAA, most covered entities have two years 
following initial adoption of a HIPAA standard to come into compliance 
with the standard; small health plans have three years. Since a HIPAA 
standard is adopted when the rule adopting it becomes effective, the 
change in effective date, by operation of law, has the effect of moving 
the statutory compliance dates forward by a commensurate period. As the 
compliance dates are part of the text of the Privacy Rule (45 CFR 
164.534), they are being amended to reflect the change in the effective 
date.
    This amendment is technical in nature and is required by statute, 
in light of the change of the effective date of the Privacy Rule. 
Consequently, we find that good causer under 5 U.S.C. 553(b)(3)(B) 
exists for waiving prior public comment on the revision to 
Sec. 164.534.

List of Subjects

45 CFR Part 160

    Electronic transactions, Employer benefit plan, Health, Health 
care, Health facilities, Health insurance, Health records, Medicaid, 
Medical research, Medicare, Privacy, Reporting and record keeping 
requirements.

45 CFR Part 164

    Electronic transactions, Employer benefit plan, Health, Health 
care, Health facilities, Health insurance, Health records, Medicaid, 
Medical research, Medicare, Privacy, Reporting and record keeping 
requirements.

    Dated: February 22, 2001.
Tommy G. Thompson,
Secretary.

    For the reasons set forth in the preamble, Sec. 164.534 of title 
45, Code of Federal Regulations, is amended as follows:
    1. The authority citation for Subpart E of 45 Code of Federal 
Regulations Part 164 is revised to read as follows:

    Authority: 42 U.S.C. 1320d-2 and 1320d-4, sec. 264 of Pub. L. 
104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)).


    2. Section 164.534 of Subpart E of 45 Code of Federal Regulations 
Part 164 is revised to read as follows:


Sec. 164.534  Compliance dates for initial implementation of the 
privacy standards.

    (a) Health care providers. A covered health care provider must 
comply with the applicable requirements of this subpart no later than 
April 14, 2003.
    (b) Health plans. A health plan must comply with the applicable 
requirements of this subpart no later than the following as applicable:
    (1) Health plans other han small health plans. April 14, 2003.
    (2) Small health plans. April 14, 2004.
    (c) Health clearinghouses. A health care clearinghouse must comply 
with the applicable requirements of this subpart no later than April 
14, 2003.

[FR Doc. 01-4810 Filed 2-23-01; 1:00 pm]
BILLING CODE 4150-04-M