Source: https://aspe.hhs.gov/report/nrpm-standards-privacy-individually-identifiable-health-information/ii-provisions-proposed-rule
Timestamp: 2019-04-23 20:20:51+00:00

Document:
NRPM: Standards for Privacy of Individually Identifiable Health Information. II. Provisions of the proposed rule.
We propose to establish a new subchapter C to title 45 of the Code of Federal Regulations. Although the rules proposed below would only establish two new parts (parts 160 and 164), we anticipate the new subchapter C will eventually contain three parts, part 160, 162, and 164, with parts 161 and 163 being reserved for future expansion, if needed. Part 160 will contain general requirements and provisions applicable to all of the regulations issued under sections 262 and 264 of Public Law 104-191 (the Administrative Simplification provisions of HIPAA). We anticipate that Part 162 will contain the Administrative Simplification regulations relating to transactions, code sets and identifiers. The new part 164 will encompass the rules relating to the security standards authorized by section 1173(d), the electronic signature standard authorized by section 1173(e), and the privacy rules proposed below.
The new part 164 will be composed of two subparts: subparts A and E, with B, C, and D being reserved. Subpart A will consist of general provisions and subpart E will consist of the final privacy rules. Because the new part 160 will apply to the privacy rules, as well as the other Administrative Simplification rules, it is set out below.
The discussion below describes the entities and the information that would be subject to the proposed regulation.
Section 1171 of the Act defines several terms and our proposed rules would, for the most part, simply restate the law or adopt definitions previously defined in the other HIPAA proposed rules. In some instances, we propose definitions from the Secretary’s Recommendations. We also propose some new definitions for convenience and efficiency of exposition, and others to clarify the application and operation of this rule. We describe the proposed definitions and discuss the rationale behind them, below.
1. Act. We would define “Act” to mean the Social Security Act, as amended. This definition would be added for convenience.
2. Covered entity. This definition would be provided for convenience of reference and would mean the entities to which part C of title XI of the Act applies. These are the entities described in section 1172(a)(1): health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction referred to in section 1173(a)(1) of the Act (a “standard transaction”). In the preamble we occasionally refer to health plans and the health care providers described above as "covered plans," "covered providers," or "covered plans and providers."
We note that health care providers who do not submit HIPAA transactions in standard form become covered by this rule when other entities, such as a billing service or a hospital, transmit standard electronic transactions on their behalf. The provider could not circumvent these requirements by assigning the task to its agent, since the agent would be deemed to be acting as the provider.
3. Health care. We would define the term “health care” as it is defined in the Secretary’s Recommendations. Health care means the provision of care, services, or supplies to a patient and includes any: (1) preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, counseling, service, or procedure with respect to the physical or mental condition, or functional status, of a patient or affecting the structure or function of the body; (2) sale or dispensing of a drug, device, equipment, or other item pursuant to a prescription; or (3) procurement or banking of blood, sperm, organs, or any other tissue for administration to patients.
4. Health care clearinghouse. We would define “health care clearinghouse” as defined by section 1171(2) of the Act. The Act defines a “health care clearinghouse” as a “public or private entity that processes or facilitates the processing of nonstandard data elements of health information into standard data elements.” In practice, clearinghouses receive transactions from health care providers, health plans, other health care clearinghouses, or business partners of such entities, and other entities, translate the data from a given format into one acceptable to the entity receiving the transaction, and forward the processed transaction to that entity. There are currently a number of private clearinghouses that contract or perform this function for health care providers. For purposes of this rule, we would consider billing services, repricing companies, community health management information systems or community health information systems, “value-added” networks, switches and similar organizations to be health care clearinghouses for purposes of this part only if they actually perform the same functions as a health care clearinghouse.
We would note that we are proposing to exempt clearinghouses from a number of the provisions of this rule that would apply to other covered entities (see §§ 164.512, 164.514 and 164.516 below), because in most cases we do not believe that clearinghouses would be dealing directly with individuals. In many instances, clearinghouses would be considered business partners under this rule and would be bound by their contracts with covered plans and providers. See proposed § 164.506(e). We would adopt this position with the caveat that the exemptions would be void for any clearinghouse that had direct contact with individuals in a capacity other than that of a business partner.
5. Health care provider. Section 1171(3) of the Act defines “health care provider” as a “provider of medical services as defined in section 1861(u) of the Act, a provider of medical or other health services as defined in section 1861(s) of the Act, and any other person who furnishes health care services or supplies.” We are proposing to define “health care provider” as the Act does, and clarify that a health care provider is limited to any person or organization that furnishes, bills, or is paid for, health care services or supplies in the normal course of business. This definition would include a researcher who provides health care to the subjects of research, free clinics, and a health clinic or licensed health care professional located at a school or business.
Section 1861(u) of the Act contains the Medicare definition of a provider, which encompasses institutional providers, such as hospitals, skilled nursing facilities, home health agencies, and comprehensive outpatient rehabilitation facilities. Section 1861(s) of the Act defines other Medicare facilities and practitioners, including assorted clinics and centers, physicians, clinical laboratories, various licensed/certified health care practitioners, and suppliers of durable medical equipment. The last portion of the proposed definition encompasses appropriately licensed or certified health care practitioners or organizations, including pharmacies and nursing homes and many types of therapists, technicians, and aides. It also would include any other individual or organization that furnishes health care services or supplies in the normal course of business. An individual or organization that bills and/or is paid for health care services or supplies in the normal course of business, such as a group practice or an “on-line” pharmacy accessible on the Internet, is also a health care provider for purposes of this statute.
For a more detailed discussion of the definition of health care provider, we refer the reader to our proposed rule (Standard Health Care Provider Identifier) published on May 7, 1998, in the Federal Register (63 Fed Reg 25320).
6. Health information. We would define “health information” as it is defined in section 1171(4) of the Act. “Health information” would mean any information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
In this paragraph we attempt to clarify the relationship between the defined terms “health information,” “individually identifiable health information” and “protected health information.” The term “health information” encompasses the universe of information governed by the administrative simplification requirements of the Act. For example, under section 1173 of the Act, the Secretary is to adopt standards to enable the electronic exchange of all health information. However, protection of personal privacy is primarily a concern for the subset of health information that is “individually identifiable health information,” as defined by the Act (see below). For example, a tabulation of the number of students with asthma by school district would be health information, but since it normally could not be used to identify any individuals, it would not usually create privacy concerns. The definition of individually identifiable health information omits some of the persons or organizations that are described as creating or receiving “health information.” Some sections of the Act refer specifically to individually identifiable health information, such as section 1177 in setting criminal penalties for wrongful use or disclosure, and section 264 in requesting recommendations for privacy standards. Finally, we propose the phrase “protected health information” (§ 164.504) to refer to the subset of individually identifiable health information that is used or disclosed by the entities that are subject to this rule.
7. Health plan. We would define “health plan” essentially as section 1171(5) of the Act defines it. Section 1171 of the Act refers to several definitions in section 2791 of the Public Health Service Act, 42 U.S.C. 300gg-91, as added by Public Law 104-191. For clarity, we would incorporate the referenced definitions as currently stated into our proposed definitions.
As defined in section 1171(5), a “health plan” is an individual plan or group health plan that provides, or pays the cost of, medical care (see section 2791(a) of the Public Health Service Act (PHS Act)). This definition would include, but is not limited to, the 15 types of plans listed in the statute, as well as any combination of them. The term would include, when applied to public benefit programs, the component of the government agency that administers the program. Church plans and government plans are included to the extent that they fall into one or more of the listed categories.
a. “Group health plan” (as currently defined by Section 2791(a) of the PHS Act). A group health plan is a plan that has 50 or more participants (as the term “participant” is currently defined by section 3(7) of ERISA) or is administered by an entity other than the employer that established and maintains the plan. This definition includes both insured and self-insured plans.
Section 2791(a)(1) of the PHS Act defines “group health plan” as an employee welfare benefit plan (as defined in current section 3(1) of ERISA) to the extent that the plan provides medical care, including items and services paid for as medical care, to employees or their dependents directly or through insurance, or otherwise.
b. “Health insurance issuer” (as currently defined by section 2791(b) of the PHS Act).
Section 2971(b) of the PHS Act defines a “health insurance issuer” as an insurance company, insurance service, or insurance organization that is licensed to engage in the business of insurance in a State and is subject to State law that regulates insurance.
c. “Health maintenance organization” (as currently defined by section 2791(b) of the PHS Act). Section 2791(b) of the PHS Act currently defines a “health maintenance organization” as a federally qualified health maintenance organization, an organization recognized as such under State law, or a similar organization regulated for solvency under State law in the same manner and to the same extent as such a health maintenance organization. These organizations may include preferred provider organizations, provider sponsored organizations, independent practice associations, competitive medical plans, exclusive provider organizations, and foundations for medical care.
d. Part A or Part B of the Medicare program (title XVIII of the Act).
e. The Medicaid program (title XIX of the Act).
f. A “Medicare supplemental policy” as defined under section 1882(g)(1) of the Act. Section 1882(g)(1) of the Act defines a “Medicare supplemental policy” as a health insurance policy that a private entity offers a Medicare beneficiary to provide payment for expenses incurred for services and items that are not reimbursed by Medicare because of deductible, coinsurance, or other limitations under Medicare. The statutory definition of a Medicare supplemental policy excludes a number of plans that are similar to Medicare supplemental plans, such as health plans for employees and former employers and for members and former members of trade associations and unions. A number of these health plans may be included under the definitions of “group health plan” or “health insurance issuer,” as defined in paragraphs “a” and “b” above.
g. A “long-term care policy,” including a nursing-home fixed indemnity policy. A “long- term care policy” is considered to be a health plan regardless of how comprehensive it is.
h. An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers. This includes plans that are referred to as multiple employer welfare arrangements (“MEWAs”).
i. The health care program for active military personnel under title 10 of the United States Code. See paragraph “k”, below, for further discussion.
j. The veterans health care program under chapter 17 of title 38 of the United States Code. This health plan primarily furnishes medical care through hospitals and clinics administered by the Department of Veterans Affairs (VA) for veterans enrolled in the VA health care system.
k. The Civilian Health and Medical Program of the Uniformed Services (CHAMPUS) as defined in 10 U.S.C. 1072(4). We note that the Act’s definition of “health plan” omits several types of health care provided by the Department of Defense (DOD). Sections 1171(5)(I) and 1171(5)(K) cover only the health care program for active duty personnel (see 10 U.S.C. 1074(a)) and the CHAMPUS program (see 10 U.S.C. 1079, 1086). What is omitted is health care provided in military treatment facilities to military retirees (see 10 U.S.C. 1074(b)), to dependents of active duty personnel and to dependents of retirees (see 10 U.S.C. 1076), to Secretarial designees such as members of Congress, Justices of the Supreme Court, and to foreign military personnel under NATO status of forces agreements. Health care provided by the DOD in military facilities to the aforementioned persons is not included as a “health plan” under HIPAA. However, these facilities would still be considered to be health care providers.
l. The Indian Health Service program under the Indian Health Care Improvement Act (25 U.S.C. 1601, et. seq.). This program furnishes services, generally through its own health care providers, primarily to persons who are eligible to receive services because they are of American Indian or Alaskan Native descent.
m. The Federal Employees Health Benefits Program under 5 U.S.C. chapter 89. This program consists of health insurance plans offered to active and retired federal employees and their dependents. Although section 1171(5)(M) of the Act refers to the “Federal Employees Health Benefit Plan,” this and any other rules adopting administrative simplification standards will use the correct name, the Federal Employees Health Benefits Program. One health plan does not cover all federal employees; over 350 health plans provide health benefits coverage to federal employees, retirees, and their eligible family members. Therefore, we will use the correct name, The Federal Employees Health Benefits Program, to make clear that the administrative simplification standards apply to all health plans that participate in the Program.
n. An approved State child health plan for child health assistance that meets the requirements of section 2103 of the Act, which established the Children's Health Insurance Program (CHIP).
o. A Medicare Plus Choice organization as defined in 42 CFR 422.2, with a contract under 42 CFR part 422, subpart K.
p. Any other individual plan or group health plan, or combination thereof, that provides or pays for the cost of medical care. This category implements the language at the beginning of the statutory definition of the term "health plan": "The term 'health plan' means an individual or group plan that provides, or pays the cost of, medical care . . . Such term includes the following, and any combination thereof . . ." This statutory language is general, not specific. Moreover, the statement that the term "health plan" "includes" the specified plans implies that the term also covers other plans that meet the stated criteria. One approach to interpreting this introductory language in the statute would be to make coverage decisions about plans that may meet these criteria on a case-by-case basis. Instead we propose to clarify its coverage by adding this category to the proposed definition of "health plan"; we seek public comment on its application. The Secretary would determine which plans that meet the criteria in the preceding paragraph are health plans for purposes of title II of HIPAA.
Consistent with the other parts of HIPAA, the provisions of this rule generally would not apply to certain types of insurance entities, such as workers’ compensation and automobile insurance carriers, other property and casualty insurers, and certain forms of limited benefits coverage, even when such arrangements provide coverage for health care services. 29 U.S.C. 1186(c). We note that health care providers would be subject to the provisions of this rule with respect to the health care they provide to individuals, even if such providers seek or receive reimbursement from an insurance entity that is not a covered entity under these rules. However, nothing in this rule would be intended to prevent a health care provider from disclosing protected health information to a non-covered insurance entity for the purpose of obtaining payment for services. Further, under proposed § 164.510(n), this rule would permit disclosures by health care providers of protected health information to such insurance entities and to other persons when mandated by applicable law for the purposes of determining eligibility for coverage or benefits under such insurance arrangements. For example, a State workers’ compensation law that requires disclosure of protected health information to an insurer or employer for the purposes of determining an individual’s eligibility for medical or other benefits, or for the purpose of determining fitness for duty, would not be disturbed by this rule.
8. Secretary. This term means the Secretary of Health and Human Services and any other officer or employee of the Department of Health and Human Services to whom the authority involved has been delegated. It is provided for ease of reference.
9. Small health plan. The HIPAA does not define a “small health plan,” but instead explicitly leaves the definition to be determined by the Secretary. We propose to adopt the size classification used by the Small Business Administration. We would therefore define a “small health plan” as a health plan with annual receipts of $5 million or less. 31 CFR 121.201. This differs from the definition of “small health plan” in prior proposed Administrative Simplification rules. We will conform the definitions in the final Administrative Simplification rules.
10. Standard. The term “standard” would mean a prescribed set of rules, conditions, or requirements concerning classification of components, specification of materials, performance or operations, or delineation of procedures in describing products, systems, services, or practices. This definition is a general one, to accommodate the varying functions of the specific standards proposed in the other HIPAA regulations, as well as the rules proposed below.
11. State. This term would include the 50 States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam. This definition follows the statutory definition of “State” in section 1101(a) of the Act.
12. Transaction. We would define “transaction,” as we have done in other Administrative Simplification regulations, to mean the exchange of information between two parties to carry out financial or administrative activities related to health care. A transaction would be (1) any of the transactions listed in section 1173(a)(2) of the Act, and (2) any transaction determined appropriate by the Secretary in accordance with Section 1173(a)(1) of the Act.
a. Health claims or equivalent encounter information. This transaction could be used to submit health care claim billing information, encounter information, or both, from health care providers to payers, either directly or via intermediary billers and claims clearinghouses.
b. Health care payment and remittance advice. This transaction could be used by a health plan to make a payment to a financial institution for a health care provider (sending payment only), to send an explanation of benefits remittance advice directly to a health care provider (sending data only), or to make payment and send an explanation of benefits remittance advice to a health car provider via a financial institution (sending both payment and data).
c. Coordination of benefits. This transaction could be used to transmit health care claims and billing payment information between payers with different payment responsibilities where coordination of benefits is required or between payers and regulatory agencies to monitor the furnishing, billing, and/or payment of health care services within a specific health care/insurance industry segment.
d. Health claims status. This transaction could be used by health care providers and recipients of health care products or services (or their authorized agents) to request the status of a health care claim or encounter from a health plan.
e. Enrollment and disenrollment in a health plan. This transaction could be used to establish communication between the sponsor of a health benefit and the payer. It provides enrollment data, such as subscriber and dependents, employer information, and primary care health care provider information. A sponsor would be the backer of the coverage, benefit, or product. A sponsor could be an employer, union, government agency, association, or insurance company. The health plan would refer to an entity that pays claims, administers the insurance product or benefit, or both.
f. Eligibility for a health plan. This transaction could be used to inquire about the eligibility, coverage, or benefits associated with a benefit plan, employer, plan sponsor, subscriber, or a dependent under the subscriber’s policy. It also could be used to communicate information about or changes to eligibility, coverage, or benefits from information sources (such as insurers, sponsors, and payers) to information receivers (such as physicians, hospitals, third party administrators, and government agencies).
g. Health plan premium payments. This transaction could be used by, for example, employers, employees, unions, and associations to make and keep track of payments of health plan premiums to their health insurers. This transaction could also be used by a health care provider, acting as liaison for the beneficiary, to make payment to a health insurer for coinsurance, copayments, and deductibles.
h. Referral certification and authorization. This transaction could be used to transmit health care service referral information between health care providers, health care providers furnishing services, and payers. It could also be used to obtain authorization for certain health care services from a health plan.
i. First report of injury. This transaction could be used to report information pertaining to an injury, illness, or incident to entities interested in the information for statistical, legal, claims, and risk management processing requirements.
j. Health claims attachments. This transaction could be used to transmit health care service information, such as subscriber, patient, demographic, diagnosis, or treatment data for the purpose of a request for review, certification, notification, or reporting the outcome of a health care services review.
k. Other transactions as the Secretary may prescribe by regulation. Under section 1173(a)(1)(B) of the Act, the Secretary may adopt standards, and data elements for those standards, for other financial and administrative transactions deemed appropriate by the Secretary. These transactions would be consistent with the goals of improving the operation of the health care system and reducing administrative costs.
13. Business partner. This term would mean a person to whom a covered entity discloses protected health information so that the person can carry out, assist with the performance of, or perform on behalf of, a function or activity for the covered entity. Such term includes any agent, contractor or other person who receives protected health information from the covered entity (or from another business partner of the covered entity) for the purposes described in the previous sentence. It would not include a person who is an employee, a volunteer or other person associated with the covered entity on a paid or unpaid basis.
14. Designated record set. This term would be defined as a group of records under the control of a covered entity from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual, and which is used by the covered entity to make decisions about the individual. The concept of a “designated record set” is derived from the Privacy Act’s concept of a “system of records.” Under the Privacy Act, federal agencies must provide an individual with access to "information pertaining to him which is contained in [a system of records]." 5 U.S.C. 552a(d)(1). A “system of records” is defined as "a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. 552a(a)(5). Under this rule, we would substitute the term “covered entity” for “agency” and limit the information to that used by the covered entity to make decisions about the individual.
We would define a “record” as "any item, collection, or grouping of protected health information maintained, collected, used, or disseminated by a covered entity." Under the Privacy Act, "the term 'record' means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." 5 U.S.C. 552a(a)(4). For purposes of this rule we propose to limit the information to protected health information, as defined in this rule. “Protected health information” already incorporates the concept of identifiability, and therefore our definition of “record” is much simpler.
For health plans, designated record sets would include, at a minimum, the claims adjudication, enrollment, and patient accounting systems. For health care providers, designated record sets would include, at a minimum, the medical records and billing records. Designated record set would also include a correspondence system, a complaint system, or an event tracking system if decisions about individuals are made based, in whole or in part, on information in those systems. Files used to backup a primary data system or the sequential files created to transmit a batch of claims to a clearinghouse are clear examples of data files which would not fall under this definition.
We note that a designated record set would only exist for types of records that a covered entity actually “retrieves” by an identifier, and not records that are only “retrievable” by an identifier. In many cases, technology will permit sorting and retrieving by a variety of fields and therefore the “retrievable” standard would be relatively meaningless.
15. Disclosure. This term would be defined as the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.
16. Health care operations. We propose the term “health care operations” to clarify the activities we consider to be “compatible with and directly related to” treatment and payment and therefore would not require authorization from the individual for use or disclosure of protected health information.
Compiling and analyzing information in anticipation of, or for use in, civil or criminal legal proceedings.
Our definition proposes to limit health care operations to functions and activities performed by a health plan or provider or by a business partner on behalf of a health plan or a provider. Our definition anticipates that in order for treatment and payment to occur, protected health information would be used within entities, would be shared with business partners, and in some cases would be shared between covered entities (or their business partners). However, a health care operation should not result in protected health information being disclosed to an entity that is not the covered entity (or a business partner of such entity) on whose behalf the operation is being performed. For example, a health plan may request a health care provider to provide protected health information to the health plan, or to a business partner of the health plan, as part of an outcomes evaluation effort relating to providers affiliated with that plan. This would be a health care operation.
We are aware that the health care industry is changing and that these categories, though broad, may need to be modified to reflect different conditions in the future.
17. Health oversight agency. We would define the term “health oversight agency” as it is defined in the Secretary’s Recommendations. See section II.E. below for further discussion.
18. Individual. We would define “individual” to mean the person who is the subject of protected health information. We would define the term to include, with respect to the signing of authorizations and other rights (such as access, copying, and correction), various types of legal representatives. The term would include court-appointed guardians or persons with a power of attorney, including persons making health care decisions for incapacitated persons, persons acting on behalf of a decedent’s estate, where State or other applicable law authorizes such legal representatives to exercise the person’s rights in such contexts, and parents subject to certain restrictions explained below. We would define this term to exclude foreign military and foreign diplomatic personnel and their dependents who receive health care provided or paid for by the DOD or other federal agency or entity acting on its behalf, and overseas foreign national beneficiaries of health care provided by the DOD or other federal agency, or non-governmental organization acting on its behalf.
The purpose of our proposal is to define and limit the circumstances in which an individual’s protected heath information could be used or disclosed by covered entities. As discussed above, we are proposing to make the use and exchange of protected health information relatively easy for health care purposes and more difficult for purposes other than health care.
As a general rule, we are proposing that protected health information not be used or disclosed by covered entities except as authorized by the individual who is the subject of such information or as explicitly provided this rule. Under this proposal, most uses and disclosures of an individual’s protected health information would not require explicit authorization by the individual, but would be restricted by the provisions of the rule. Covered entities would be able to use or disclose an individual’s protected health information without authorization for treatment, payment and health care operations. See proposed § 164.506(a)(1)(i). Covered entities also would be permitted to use or disclose an individual’s protected health information for specified public and public policy-related purposes, including public health, research, health oversight, law enforcement, and use by coroners. Covered entities would be permitted by this rule to use and disclose protected health information when required to do so by other law, such as a mandatory reporting requirement under State law or pursuant to a search warrant. See proposed § 164.510. Covered entities would be required by this rule to disclose protected health information for only two purposes: to permit individuals to inspect and copy protected health information about them (see proposed § 164.514) and for enforcement of this rule (see proposed § 164.522(e)).
The proposed rule generally would not require covered entities to vary the level of protection of protected health information based on the sensitivity of such information. We believe that all protected health information should have effective protection from inappropriate use and disclosure by covered entities, and except for limited classes of information that are not needed for treatment and payment purposes, we have not provided additional protection to protected health information that might be considered particularly sensitive. We would note that the proposed rule would not preempt provisions of other applicable laws that provide additional privacy protection to certain classes of protected health information. We understand, however, that there are medical conditions and treatments that individuals may believe are particularly sensitive, or which could be the basis of stigma or discrimination. We invite comment on whether this rule should provide for additional protection for such information. We would appreciate comment that discusses how such information should be identified and the types of steps that covered entities could take to provide such additional protection. We also invite comment on how such provisions could be enforced.
Covered entities of all types and sizes would be required to comply with the proposed privacy standards outlined below. The proposed standards would not impose particular mechanisms or procedures that covered entities must adopt to implement the standards. Instead, we would require that each affected entity assess its own needs and devise, implement, and maintain appropriate privacy policies, procedures, and documentation to address its business requirements. How each privacy standard would be satisfied would be business decisions that each entity would have to make. This allows the privacy standards to establish a stable baseline, yet remain flexible enough to take advantage of developments and methods for protecting privacy that will evolve over time.
Because the privacy standards would need to be implemented by all covered entities, from the smallest provider to the largest, multi-state health plan, a single approach to implementing these standards would be neither economically feasible nor effective in safeguarding health information privacy. For example, in a small physician practice, the office manager might be designated to serve as the privacy official as one of many duties (see proposed § 164.518(a)) whereas at a large health plan, the privacy official may constitute a full time position and have the regular support and advice of a privacy staff or board.
Similarly, a large enterprise may make frequent electronic disclosures of similar data. In such a case, the enterprise would be expected to remove identifiers or to limit the data fields that are disclosed to fit the purpose of the disclosure. The process would be documented and perhaps even automated. A solo physician’s office, however, would not be expected to have the same capabilities to limit the amount of information disclosed, although, in the cases of disclosures involving a small number of records, such an office could be expected to hide identifiers or to limit disclosures to certain pages of the medical record that are relevant to the purpose of the disclosure.
In taking this approach, we intend to strike a balance between the need to maintain the confidentiality of protected health information and the economic cost of doing so. Health care entities must consider both aspects in devising their solutions. This approach is similar to the approach we proposed in the Notice of Proposed Rulemaking for the administrative simplification security and electronic signature standards.
This section addresses the requirements that we are proposing when protected health information is disclosed pursuant to the individual's explicit authorization. The regulation would require that covered entities have authorization from individuals before using or disclosing their protected health information for any purpose not otherwise recognized by this regulation. Circumstances where an individual’s protected health information may be used or disclosed without authorization are discussed in connection with proposed §§164.510 and 164.522 below.
where a covered entity asks an individual to authorize it to disclose or use information for purposes other than treatment, payment or health care operations.
In addition, this section proposes conditions where a covered entity or the individual initiates an authorization for use or disclosure of psychotherapy notes or research information unrelated to treatment. See discussion above in section II.C.1.c.
Individually identifiable health information is used for a vast array of purposes not directly related to providing or paying for an individual’s health care. Examples of such uses include targeted marketing of new products and assessing the eligibility of an individual for certain public benefits or for commercial products based on their health status. Under these rules, these types of uses and disclosures could only be made by a covered entity with the specific authorization of the subject of the information. The requirements proposed in this section are not intended to interfere with normal uses and disclosures of information in the health care delivery or payment process, but only to permit control of uses extraneous to health care. The restrictions on disclosure that the regulation would apply to covered entities may mean that some existing uses and disclosures of information could take place only if the individual explicitly authorized them under this section.
Authorization would be required for these uses and disclosures because individuals probably do not envision that the information they provide when getting health care would be disclosed for such unrelated purposes. Further, once a patient’s protected health information is disclosed outside of the treatment and payment arena, it could be very difficult for the individual to determine what additional entities have seen, used and further disclosed the information. Requiring an authorization from the patient for such uses and disclosures would enhance individuals’ control over their protected health information.
We considered requiring a uniform set of requirements for all authorizations, but concluded that it would be appropriate to treat authorizations initiated by the individual differently from authorizations sought by covered entities. There are fundamental differences in the uses of information and in the relationships and understandings among the parties in these two situations. When individuals initiate authorizations, they are more likely to understand the purpose of the release and to benefit themselves from the use or disclosure. When a covered entity asks the individual to authorize disclosure, we believe the entity should make clear what the information will be used for, what the individual's rights are, and how the covered entity would benefit from the requested disclosure.
Individuals seek disclosure of their health information to others in many circumstances, such as when applying for life or disability insurance, when government agencies conduct suitability investigations, and in seeking certain job assignments where health is relevant. Another common instance is tort litigation, where an individual's attorney needs individually identifiable health information to evaluate an injury claim and asks the individual to authorize disclosure of records relating to the injury to the attorney.
There could also be circumstances where the covered entity asks an individual to authorize use or disclosure of information, for example to disclose it to a subsidiary to market life insurance to the individual. Similarly, the covered entity might ask that the individual authorize it to send information to a person outside that covered entity – possibly another covered entity or class of covered entity – for purposes outside of treatment, payment, or health care operations. See proposed § 164.508(a)(2)(ii).
This section describes uses and disclosures of protected health information that covered entities could make for purposes other than treatment, payment, and health care operations without individual authorization, and the conditions under which such uses and disclosures could be made. We propose to allow covered entities to use or disclose protected health information without individual authorization for such purposes if the use or disclosure would comply with the applicable requirements of this section.
These categories of allowable uses and disclosures are designed to permit and promote key national health care priorities, and to ensure that the health care system operates smoothly. For each of these categories, this rule would permit – but not require – the covered entity to use or disclose protected health information without the individual’s authorization. Some covered entities could conclude that the records they hold, or portions of them, should not be used or disclosed for one or more of these permitted purposes without individuals’ authorization (absent a law mandating such disclosure), even under the conditions imposed here. The proposed regulation is intended to reflect the importance of safeguarding individuals’ confidentiality, while also enabling important national priority activities that require protected health information.
We considered permitting uses and disclosures only where law affirmatively requires the covered entity to use or disclose protected health information. However, because the activities described below are so important to the population as a whole, we decided to permit a covered entity to use or disclose information to promote those activities even when such activities are not legally mandated. In some cases, however, we would permit a use or disclosure only when such use or disclosure is authorized by other law. The requirements for verification of legal authority are discussed in each relevant section.
Where another law forbids the use or disclosure of protected health information without the individual’s authorization, nothing in this section would permit such use or disclosure.
Other law may require use or disclosure of protected health information. If such a use or disclosure is not otherwise addressed in proposed § 164.510(b) through (m), we would in proposed § 164.510(n) permit covered entities to use or disclose protected health information without individual authorization pursuant to any law that mandates such use or disclosure. To be in compliance with this rule, the covered entity must meet the requirements of such other law requiring the use or disclosure. Similarly, nothing in this rule would provide authority for a covered entity to restrict or refuse to make a use or disclosure mandated by other law.
The HIPAA legislative authority generally does not bring the entities that receive disclosures pursuant to this section, including public health authorities, oversight and law enforcement agencies, researchers, and attorneys, under the jurisdiction of this proposed rule. We therefore generally cannot propose restrictions on the further use and disclosure of protected health information obtained by the recipients of these disclosures (unless the recipient is also a covered entity). We believe, however, that in most instances it is sound policy to restrict further uses and disclosures of such protected health information. For example, the Secretary’s Recommendations proposed that protected health information obtained by researchers not be further disclosed except for emergency circumstances, for a research project that meets certain conditions, and for oversight of research. We believe that federal legislation should include appropriate restrictions on further use and disclosure of protected health information received by entities for purposes such as those described in this section. We note that, under S.578 (introduced by Senator Jeffords), protected health information disclosed for oversight could not be used against the subject of the protected health information unless the action arises out of and is directly related to a health care fraud or a fraudulent claim for benefits, unless such use is judicially authorized.. We believe such safeguards strike the right balance between encouraging national priority oversight activities and protecting individuals’ privacy.
The provisions of this section contain requirements related to use and requirements related to disclosure, as appropriate to each of the purposes discussed. For many of these purposes, only requirements relating to disclosure are proposed because there are no appropriate internal uses for such a purpose. Examples include disclosures for next-of-kin and disclosures for banking and financial purposes.
For many of these permitted disclosures, we would require the covered entity to verify the identity of the requestor and his or her legal authority to make the request. Requirements for verifying the identity and authority of requests for information are further discussed in II.G, “Administrative Requirements.” As discussed in more detail in section II.G.3. of this preamble, the verification requirement would apply where the identity of the person making the request is not already known to the covered entity (e.g., where the disclosure is not part of a routine business transaction). We would ask health plans and health care providers to take reasonable steps to verify the identity of persons requesting protected health information, such as asking to see a badge or other proof of the identity of government officials, and would allow covered entities to rely on the statement of government officials and others regarding the legal authority for the activity. We would not require covered entities to make an independent inquiry into the legal authority behind requests for protected health information.
The provisions below would permit covered entities to use or disclose protected health information without individual authorization, pursuant to certain requirements. Although health care clearinghouses would be defined as covered entities under this rule, in most instances clearinghouses will be receiving and maintaining protected health information as the business partner of a covered health plan or provider. In such cases, proposed § 164.510(a)(2) provides that the clearinghouses that hold protected health information as business partners would not be permitted to make uses or disclosures otherwise permitted by this section unless such uses or disclosures also were permitted under the terms of the contract between the clearinghouse and the business partner.
The following proposed sections are intended to facilitate individual understanding of and involvement in the handling of their protected health information. Four basic individual rights would be created under this section: the right to a notice of information practices; the right to obtain access to protected health information about them; the right to obtain access to an accounting of how their protected health information has been disclosed; and the right to request amendment and correction of protected health information.
The rights described below would apply with respect to protected health information held by health care providers and health plans. We are proposing that clearinghouses not be subject to all of these requirements. We believe that as business partners of covered plans and providers, clearinghouses would not usually initiate or maintain direct relationships with individuals. The contractual relationship between a clearinghouse (as a business partner) and a covered plan or provider would bind the clearinghouse to the notice of information practices developed by the plan or provider and it will include specific provisions regarding inspection, copying, amendment and correction. Therefore, we do not believe the clearinghouses should be required to provide a notice or provide access for inspection, copying, amendment or correction. We would require clearinghouses to provide an accounting of any disclosures for purposes other than treatment, payment and health care operations to individuals upon request. See proposed § 164.515. It is our understanding that the vast majority of the clearinghouse function falls within the scope of treatment, payment, and health care operations and therefore we do not believe providing this important right to individuals will impose a significant burden on the industry. We invite comment on whether or not we should require clearinghouses to comply with all of the provisions of the individual rights section.
In § 164.518, we are proposing general administrative requirements for covered entities. We would require all covered entities to designate a privacy official, train members of their workforce regarding privacy requirements, safeguard protected health information, and establish sanctions for members of the workforce who do not abide by the entity’s privacy policies and procedures. In addition, we are proposing that covered plans and providers be required to establish a means for individuals to complain to the covered plan or provider if they believe that their privacy rights have been violated. In the discussions of each proposed provision, we provide examples of how different kinds of covered entities could satisfy these requirements.
In proposed § 164.520, we would require covered entities to develop and document their policies and procedures for implementing the requirements of this rule. This requirement is intended as a tool to facilitate covered entities’ efforts to develop appropriate policies to implement this rule, to ensure that the members of its workforce and business partners understand and carry out expected privacy practices, and to assist covered entities in developing a notice of information practices.
The scale of the policies developed should be consistent with the size of the covered entity. For example, a smaller employer could develop policies restricting access to health plan information to one designated employee, empowering that employee to deny release of the information to corporate executives and managers unless required for health plan administration. Larger employers could have policies that include using contractors for any function that requires access to protected health information or requiring all reports they receive for plan administration to be de-identified unless individual authorization is obtained.
this practice does not use or disclose any protected health information that is not authorized or permitted under the federal privacy regulation and therefore does not request any authorized disclosures from patients. Staff R.N. reviews all individually authorized requests for disclosures to ensure they contain all required elements and reviews the copied information to ensure only authorized information is released in response. Information requests that would require extensive redaction will be denied.
Larger entities with many functions and business relationships and who are subject to multi-state reporting and record-keeping requirements would need to develop and document more extensive policies. A health plan would need to describe all activities that would be considered health care operations and identify the use and disclosure requirements of each activity. A health plan may determine that underwriting department employees must provide a written request, approved by a team leader, to access any identifiable claims information; that such requests must be retained and reviewed every quarter for appropriateness; and the underwriting department must destroy such information after use for an approved activity. We urge professional associations to develop model policies, procedures and documentation for their members of all sizes.
We are proposing general guidelines for covered entities to develop and document their own policies and procedures. We considered a more uniform, prescriptive approach but concluded that a single approach would be neither effective in safeguarding protected health information nor appropriate given the vast differences among covered entities in size, business practices and level of sophistication. It is important that each covered entity’s internal policies and procedures for implementing the requirements of this regulation are tailored to the nature and number of its business arrangements, the size of its patient population, its physical plant and computer system, the size and characteristics of its workforce, whether it has one or many locations, and similar factors. The internal policies and procedures appropriate for a clearinghouse would not be appropriate for a physician practice; the internal policies and procedures appropriate for a large, multi-state health plan would not be appropriate for a smaller, local health plan.
After evaluating the requirements of federal, State, or other applicable laws, covered entities should develop policies and procedures that are appropriate for their size, type, structure, and business arrangements. Once a covered plan or provider has developed and documented all of the policies and procedures as required in this section, it would have compiled all of the information needed to develop the notice of information practices required in § 164.512. The notice is intended to include a clear and concise summary of many of the policies and procedures discussed in this section. Further, if an individual has any questions about the entity’s privacy policies that are not addressed by the notice, a representative of the entity can easily refer to the documented policies and procedures for additional information.
Before making a material change in a policy or procedure, the covered entity would, in most instances, be required to make the appropriate changes to the documentation required by this section before implementing the change. In addition, covered plans and providers would be required to revise their the notice of information practices in advance. Where the covered entity determines that a compelling reason exists to take an action that is inconsistent with its documentation or notice before making the necessary changes, it may take such action if it documents the reasons supporting the action and makes the necessary changes within 30 days of taking such action.
In an attempt to ensure that large entities develop coordinated and comprehensive policies and procedures as required by this section, we considered proposing that entities with annual receipts greater than $5 million 1 be required to have a privacy board review and approve the documentation of policies and procedures. As originally conceived, the privacy board would only serve to review research protocols as described in § 164.510(j). We believe that such a board could also serve as “privacy experts” for the covered entity and could review the entity’s documented policies and procedures. In this capacity, the overriding objective of the board would be to foster development of up-to-date, individualized policies that enable the organization to protect health information without unnecessarily interfering with the treatment and payment functions or business needs. This type of review is particularly important for large entities who would have to coordinate policies and procedures among a large staff, but smaller organizations would be encouraged, but not required, to take a similar approach (i.e., have a widely representative group participate in the development and/or review of the organization’s internal privacy policies and the documentation thereof). We solicit comment on this proposal.
We also considered requiring the covered entity to make its documentation available to persons outside the entity upon request. We rejected this approach because covered entities should not be required to share their operating procedures with the public, or with their competitors.
We recognize that the documentation requirement in this proposed rule would impose some paperwork burden on covered plans and providers. However, we believe that it is necessary to ensure that covered plans and providers establish privacy policies procedures in advance of any requests for disclosure, authorization, or subject access. It is also necessary to ensure that covered entities and members of their workforce have a clear understanding of the permissible uses and disclosures of protected health information and their duty to protect the privacy of such information under specific circumstances.

References: § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164