Source: https://www.federalregister.gov/articles/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the
Timestamp: 2014-03-07 05:25:41
Document Index: 555920007

Matched Legal Cases: ['art 160', 'art 160', 'art 160', 'art 164', 'arts\n2', 'art 164', '§ 160', '§ 160', '§ 164', '§ 160', '§ 160', '§ 164', '§ 160', '§ 160', '§ 164', 'art 160', 'art 160', '§ 160', '§ 160', '§ 160', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 1179', '§ 1179', '§ 1179', '§ 1179', '§ 162', '§ 160', 'art 162', '§ 164', '§ 160', '§ 164', '§ 164', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', 'art 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', 'art 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 164', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160', '§ 160']

-5702 (138 pages)
Shorter URL: https://federalregister.gov/a/2013-01073 Related Topics
The Department of Health and Human Services (HHS or “the Department”) is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (“the HITECH Act” or “the Act”) to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities.
i. HIPAA and the Privacy, Security, and Enforcement Rules
ii. The Health Information Technology for Economic and Clinical Health Act
iii. The Genetic Information Nondiscrimination Act
IV. Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the HITECH Act; Other Modifications to the HIPAA Rules
A. Subparts A and B of Part 160: Statutory Basis and Purpose, Applicability, Definitions, and Preemption of State Law
1. Subpart A—General Provisions, Section 160.101—Statutory Basis and Purpose
2. Subpart A—General Provisions, Section 160.102—Applicability
i. Inclusion of Patient Safety Organizations
iii. Inclusion of Subcontractors
iv. Exceptions to Business Associate
v. Technical Changes to the Definition
vi. Response to Other Public Comments
b. Definition of “Electronic Media”
c. Definition of “Protected Health Information”
d. Definition of “State”
e. Other Changes to the Definitions in Section 160.103
4. Subpart B—Preemption of State Law
a. Section 160.201—Statutory Basis
b. Section 160.202—Definitions
i. Definition of “Contrary”
ii. Definition of “More Stringent”
B. Subparts C and D of Part 160: Amendments to the Enforcement Rule
1. Subpart C of Part 160—Compliance and Investigations
a. Sections 160.304, 160.306, 160.308, and 160.312—Noncompliance Due to Willful Neglect
b. Section 160.310—Protected Health Information Obtained by the Secretary
2. Subpart D—Imposition of Civil Money Penalties
a. Section 160.401—Definitions
Modifications to the Definition of “Reasonable Cause”
b. Section 160.402—Basis for a Civil Money Penalty
c. Section 160.404—Amount of a Civil Monetary Penalty
d. Section 160.408—Factors Considered in Determining the Amount of a Civil Money Penalty
e. Section 160.410—Affirmative Defenses
Interim Final Rule and Proposed Rule
f. Section 160.412—Waiver
g. Section 160.418—Penalty Not Exclusive
h. Section 160.420—Notice of Proposed Determination
i. Calculation of the 30-Day Cure Period for Willful Neglect Violations
C. Subparts A and C of Part 164: General Provisions and Modifications to the Security Rule
1. Technical Changes to Subpart A—General Provisions
a. Section 164.102—Statutory Basis
b. Section 164.104—Applicability
c. Section 164.105—Organizational Requirements
i. Section 164.105(a)(2)(ii)(C)-(E)
ii. Section 164.105(a)(2)(iii)(C)
iii. Section 164.105(b)(1)
iv. Section 164.105(b)(2)(ii)
d. Section 164.106—Relationship to Other Parts
2. Modifications to the HIPAA Security Rule in Subpart C
b. Section 164.306—Security Standards: General Rules
c. Section 164.308—Administrative Safeguards
d. Section 164.314—Organizational Requirements
D. Subpart E of Part 164: Modifications to the Privacy Rule
1. Section 164.500—Applicability
2. Section 164.501—Definitions
a. Definition of “Health Care Operations”
b. Definition of “Marketing”
a. Section 164.502(a) and (b)—Permitted and Required Uses and Disclosures and Minimum Necessary
i. Permitted and Required Uses and Disclosures
b. Sections 164.502(e) and 164.504(e)—Business Associate Agreements
c. Section 164.532—Transition Provisions
4. Section 164.508—Uses and Disclosures for Which an Authorization Is Required
a. Sale of Protected Health Information
i. Compound Authorizations
ii. Authorizing Future Research Use or Disclosure
5. Protected Health Information About Decedents
a. Section 164.502(f)—Period of Protection for Decedent Information
b. Section 164.510(b)—Disclosures About a Decedent to Family Members and Others Involved in Care
6. Section 164.512(b)—Disclosure of Student Immunizations to Schools
7. Section 164.514(f)—Fundraising
8. Section 164.520—Notice of Privacy Practices for Protected Health Information
9. Section 164.522(a)—Right To Request a Restriction of Uses and Disclosures
10. Section 164.524—Access of Individuals to Protected Health Information
a. Form and Format
11. Other Technical Changes and Conforming Changes
V. Modifications to the Breach Notification Rule Under the HITECH Act
C. Section-by-Section Description of Final Rule and Response to Comments
1. Section 164.402—Definitions
a. Definition of “Breach”
b. Definition of “Unsecured Protected Health Information”
2. Section 164.404—Notification to Individuals
3. Section 164.406—Notification to the Media
4. Section 164.408—Notification to the Secretary
5. Section 164.410—Notification by a Business Associate
6. Law Enforcement Delay
7. Section 164.414—Administrative Requirements and Burden of Proof
10. Responses to Other Public Comments
VI. Modifications to the HIPAA Privacy Rule Under GINA
C. Section-by-Section Description of Final Rule and Response to Public Comments
1. Scope: Extension of Required Protections to All Health Plans Subject to the HIPAA Privacy Rule
2. Section 160.101—Statutory Basis and Purpose
3. Section 160.103—Definitions
a. Definition of “Health information”
b. Definition of “Genetic Information”
c. Definition of “Genetic Test”
d. Definition of “Genetic Services”
e. Definition of “Family Member”
f. Definition of “Manifestation or Manifested”
g. Definition of “Health Plan”
4. Section 164.501—Definitions
a. Definition of “Underwriting Purposes”
b. Definition of “Health Care Operations”
5. Section 164.502(a)—Uses and Disclosures of Protected Health Information: General Rules
6. Section 164.504(f)(1)(ii)—Requirements for Group Health Plans
7. Section 164.506—Uses and Disclosures To Carry Out Treatment, Payment, or Health Care Operations
8. Section 164.514(g)—Uses and Disclosures for Activities Relating to the Creation, Renewal, or Replacement of a Contract of Health Insurance or Health Benefits
9. Section 164.520—Notice of Privacy Practices for Protected Health Information
1. Breach Notification Costs
How many breaches will require notification?
Cost of Notifying Affected Individuals by First Class Mail or Email
Cost of Substitute Notice
Cost of Breaches Involving More Than 500 Individuals
Cost of Investigating a Breach
Cost of Submitting the Annual Breach Summary to HHS
2. Notifying Individuals of Their New Privacy Rights
3. Business Associates and Covered Entities and Their Contractual Relationships
4. Qualitative Analysis of Unquantified Costs
a. Authorization for Uses and Disclosures of Protected Health Information for Marketing and Sale of Protected Health Information
b. Individual Right To Opt Out of Fundraising Communications
c. Individuals' Access to Protected Health Information
d. Right To Restrict Certain Disclosures to a Health Plan
e. Impact of the Genetic Information Underwriting Prohibition on Health Plans
1. Greater Privacy Protections for Individuals
3. Compound Authorizations for Research Uses and Disclosures
4. Authorizations for Future Research Uses or Disclosures
5. Period of Protection for Decedent Information
6. Disclosures About a Decedent
7. Public Health Disclosures
C. Third-Party Disclosures
Table 1—Estimated Costs of the Final Rule
Table 3—Technical and Conforming Changes
TABLE 1—Number of Covered Entities by NAICS CODE24
Table 2—Summary of Annual Compliance Cost for Breach Notification in 2011 Dollars
Table 3—Cost of E-Mail and First Class Mail to Affected Individuals in 2011 Dollars
Table 4—Annual Cost for Setting Up a Toll-Free Line for Three Months in 2011 Dollars
TABLE 5—Summary of Compliance Cost for Notices of Privacy Practices
TABLE 6—Business Associate Cost Estimates in 2011 Dollars
Estimated Costs of the Final Rule
Effective date: This final rule is effective on March 26, 2013.
This final rule is needed to strengthen the privacy and security protections established under the Health Insurance Portability and Accountability of 1996 Act (HIPAA) for individual's health information maintained in electronic health records and other formats. This final rule also makes changes to the HIPAA rules that are designed to increase flexibility for and decrease burden on the regulated entities, as well as to harmonize certain requirements with those under the Department's Human Subjects Protections regulations. These changes are consistent with, and arise in part from, the Department's obligations under Executive Order 13563 to conduct a retrospective review of our existing regulations for the purpose of identifying ways to reduce costs and increase flexibilities under the HIPAA Rules. We discuss our specific burden reduction efforts more fully in the Regulatory Impact Analysis.
The final rule implements changes to the HIPAA Rules under a number of authorities. First, the final rule modifies the Privacy, Security, and Enforcement Rules to strengthen privacy and security protections for health information and to improve enforcement as provided for by the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA). The rule also includes final modifications to the Breach Notification Rule, which will replace an interim final rule originally published in 2009 as required by the HITECH Act. Second, the final rule revises the HIPAA Privacy Rule to increase privacy protections for genetic information as required by the Genetic Information Nondiscrimination Act of 2008 (GINA). Finally, the Department uses its general authority under HIPAA to make a number of changes to the Rules that are intended to increase workability and flexibility, decrease burden, and better harmonize the requirements with those under other Departmental regulations.
3. Final rule on Breach Notification for Unsecured Protected Health Information under the HITECH Act, which replaces the breach notification rule's “harm” threshold with a more objective standard and supplants an interim final rule published on August 24, 2009.
4. Final rule modifying the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act (GINA) to prohibit most health plans from using or disclosing genetic information for underwriting purposes, which was published as a proposed rule on October 7, 2009. iii. Costs and Benefits
This final rule is anticipated to have an annual effect on the economy of $100 million or more, making it an economically significant rule under Executive Order 12866. Accordingly, we have prepared a Regulatory Impact Analysis that presents the estimated costs and benefits of the proposed rule. The total cost of compliance with the rule's provisions is estimated to be between $114 million and $225.4 million in the first year of implementation and approximately $14.5 million annually thereafter. Costs associated with the rule include: (i) Costs to HIPAA covered entities of revising and distributing new notices of privacy practices to inform individuals of their rights and how their information is protected; (ii) costs to covered entities related to compliance with breach notification requirements; (iii) costs to a portion of business associates to bring their subcontracts into compliance with business associate agreement requirements; and (iv) costs to a portion of business associates to achieve full compliance with the Security Rule. We summarize these costs in Table 1 below and explain the components and distribution of costs in detail in the Regulatory Impact Analysis.
We are not able to quantify the benefits of the rule due to lack of data and the impossibility of monetizing the value of individuals' privacy and dignity, which we believe will be enhanced by the strengthened privacy and security protections, expanded individual rights, and improved enforcement enabled by the rule. We also believe that some entities affected by the rule will realize cost savings as a result of provisions that simplify and streamline certain requirements, and increase flexibility, under the HIPAA Rules. However, we are unable to quantify such cost savings due to a lack of data. We describe such benefits in the Regulatory Impact Analysis.
Table 1—Estimated Costs of the Final Rule Back to Top
Approximate number of affected entities
700,000 covered entities
19,000 covered entities
14.5 million.1
250,000-500,000 business associates of covered entities
21 million-42 million.
Security Rule Compliance by Business Associates
200,000-400,000 business associates of covered entities
22.6 million-113 million.
114 million-225.4 million.
TheHIPAA Privacy, Security, and Enforcement Rules implement certain of the Administrative Simplification provisions of title II, subtitle F, of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), which added a new part C to title XI of the Social Security Act (sections 1171-1179 of the Social Security Act, 42 U.S.C. 1320d-1320d-8). The HIPAA Administrative Simplification provisions provided for the establishment of national standards for the electronic transmission of certain health information, such as standards for certain health care transactions conducted electronically and code sets and unique identifiers for health care providers and employers. The HIPAA Administrative Simplification provisions also required the establishment of national standards to protect the privacy and security of personal health information and established civil money penalties for violations of the Administrative Simplification provisions. The Administrative Simplification provisions of HIPAA apply to three types of entities, which are known as “covered entities”: health care providers who conduct covered health care transactions electronically, health plans, and health care clearinghouses.
Since the promulgation of the HIPAA Rules, legislation has been enacted requiring modifications to the Rules. In particular, the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted on February 17, 2009, as title XIII of division A and title IV of division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Public Law 111-5, modifies certain provisions of the Social Security Act pertaining to the HIPAA Rules, as well as requires certain modifications to the Rules themselves, to strengthen HIPAA privacy, security, and enforcement. The Act also provides new requirements for notification of breaches of unsecured protected health information by covered entities and business associates. In addition, the Genetic Information Nondiscrimination Act of 2008 (GINA) calls for changes to the HIPAA Privacy Rule to strengthen privacy protections for genetic information. This final rule implements the modifications required by GINA, as well as most of the privacy, security, and enforcement provisions of the HITECH Act. This final rule also includes certain other modifications to the HIPAA Rules to improve their workability and effectiveness.
The HITECH Act is designed to promote the widespread adoption and interoperability of health information technology. Subtitle D of title XIII, entitled “Privacy,” supports this goal by adopting amendments designed to strengthen the privacy and security protections for health information established by HIPAA. These provisions include extending the applicability of certain of the Privacy and Security Rules' requirements to the business associates of covered entities; requiring that Health Information Exchange Organizations and similar organizations, as well as personal health record vendors that provide services to covered entities, shall be treated as business associates; requiring HIPAA covered entities and business associates to provide for notification of breaches of “unsecured protected health information”; establishing new limitations on the use and disclosure of protected health information for marketing and fundraising purposes; prohibiting the sale of protected health information; and expanding individuals' rights to access their protected health information, and to obtain restrictions on certain disclosures of protected health information to health plans. In addition, subtitle D adopts provisions designed to strengthen and expand HIPAA's enforcement provisions.
We discuss these statutory provisions in more detail below where we describe section-by-section how this final rule implements the provisions. We do not address in this rulemaking the accounting for disclosures requirement in section 13405 of the Act, which is the subject of a separate proposed rule published on May 31, 2011, at 76 FR 31426, or the penalty distribution methodology requirement in section 13410(c) of the Act, which will be the subject of a future rulemaking.
Since enactment of the HITECH Act a number of steps have been taken to implement the strengthened privacy, security, and enforcement provisions through rulemakings and related actions. On August 24, 2009, the Department published interim final regulations to implement the breach notification provisions at section 13402 of the HITECH Act (74 FR 42740), which were effective September 23, 2009. Similarly, the Federal Trade Commission (FTC) published final regulations implementing the breach notification provisions at section 13407 for personal health record vendors and their third party service providers on August 25, 2009 (74 FR 42962), effective September 24, 2009. For purposes of determining to what information the HHS and FTC breach notification regulations apply, the Department also issued, first on April 17, 2009 (published on April 27, 2009, 74 FR 19006), and then later with its interim final rule, the guidance required by the HITECH Act under 13402(h) specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Additionally, to conform the provisions of the Enforcement Rule to the HITECH Act's tiered and increased civil money penalty structure, which became effective on February 18, 2009, the Department published an interim final rule on October 30, 2009 (74 FR 56123), effective November 30, 2009.
The NPRM proposed to extend the applicability of certain of the Privacy and Security Rules' requirements to the business associates of covered entities, making business associates directly liable for violations of these requirements. Additionally, the NPRM proposed to define a subcontractor as a business associate to ensure any protected health information the subcontractor creates or receives on behalf of the business associate is appropriately safeguarded. The NPRM proposed to establish new limitations on the use and disclosure of protected health information for marketing and fundraising purposes and to prohibit the sale of protected health information without an authorization. The NPRM also proposed to expand an individual's right to obtain an electronic copy of an individual's protected health information, and the right to restrict certain disclosures of protected health information to a health plan for payment or health care operations purposes. In addition, the NPRM proposed to further modify the Enforcement Rule to implement more of the HITECH Act's changes to HIPAA enforcement.
In addition to the proposed modifications to implement the HITECH Act, the NPRM also proposed certain other modifications to the HIPAA Rules. The NPRM proposed to permit the use of compound authorizations for conditioned and unconditioned research activities and requested comment regarding permitting authorizations for future research. Additionally, the NPRM proposed to modify the Privacy Rule's application to the individually identifiable health information of decedents and to permit covered entities that obtain the agreement of a parent to provide proof of immunization without written authorization to schools that are required to have such information.
The Genetic Information Nondiscrimination Act of 2008 (“GINA”), Pub. L. 110-233, 122 Stat. 881, prohibits discrimination based on an individual's genetic information in both the health coverage (Title I) and employment (Title II) contexts. In addition to the nondiscrimination provisions, section 105 of Title I of GINA contains new privacy protections for genetic information, which require the Secretary of HHS to revise the Privacy Rule to clarify that genetic information is health information and to prohibit group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes.
On October 7, 2009, the Department published a proposed rule to strengthen the privacy protections for genetic information under the HIPAA Privacy Rule by implementing the protections for genetic information required by GINA and making related changes to the Rule. The 60-day public comment period for the proposed rule closed on December 7, 2009. The Department received about 25 comments on the proposed rule.
In this final rule the Department finalizes the modifications to the HIPAA Privacy, Security, and Enforcement Rules to implement many of the privacy, security, and enforcement provisions of the HITECH Act and make other changes to the Rules; modifies the Breach Notification Rule; finalizes the modifications to the HIPAA Privacy Rule to strengthen privacy protections for genetic information; and responds to the public comments received on the proposed and interim final rules. Section III below describes the effective and compliance dates of the final rule. Section IV describes the changes to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act and other modifications that were proposed in July 2010, as well as the modifications to the Enforcement Rule under the HITECH Act that were addressed in the interim final rule published in October 2009. Section V describes the changes to the Breach Notification Rule. Section VI discusses the changes to the HIPAA Privacy Rule to strengthen privacy protections for genetic information.
III. Effective and Compliance Dates Back to Top
With respect to the HITECH Act requirements, section 13423 of the Act provides that the provisions in subtitle D took effect one year after enactment, i.e., on February 18, 2010, except as specified otherwise. However, there are a number of exceptions to this general rule. For example, the tiered and increased civil money penalty provisions of section 13410(d) were effective for violations occurring after the date of enactment, and sections 13402 and 13407 of the Act regarding breach notification required interim final rules within 180 days of enactment, with effective dates 30 days after the publication of such rules. Other provisions of the Act have later effective dates. For example, the provision at section 13410(a)(1) of the Act providing that the Secretary's authority to impose a civil money penalty will only be barred to the extent a criminal penalty has been imposed, rather than in cases in which the offense in question merely constitutes an offense that is criminally punishable, became effective for violations occurring on or after February 18, 2011. The discussion below generally pertains to the statutory provisions that became effective on February 18, 2010, or, in a few cases, on a later date.
We proposed that covered entities and business associates would have 180 days beyond the effective date of the final rule to come into compliance with most of the rule's provisions. We believed that a 180-day compliance period would suffice for future modifications to the HIPAA Rules, and we proposed to add a provision at § 160.105 to address the compliance date generally for implementation of new or modified standards in the HIPAA Rules. We proposed that § 160.105 would provide that with respect to new standards or implementation specifications or modifications to standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates would be required to comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. For future modifications to the HIPAA Rules necessitating a longer compliance period, we would specify a longer period in the regulatory text. Finally, we proposed to retain the compliance date provisions at §§ 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively, for historical purposes only.
Most of the comments addressing the proposed compliance periods as outlined above fell into three categories. First, several commenters supported the proposed compliance timelines and agreed that 180 days is sufficient time for covered entities, business associates, and subcontractors of all sizes to come into compliance with the final rule. Second, a few commenters supported the proposed 180-day compliance period, but expressed concern that the Department may wish to extend the 180-day compliance period in the future, if it issues modifications or new provisions that require a longer compliance period. Third, several commenters requested that the Department extend the 180-day compliance period both with regard to the modifications contained in this final rule and with regard to the more general proposed compliance deadline, as they believe 180 days is an insufficient amount of time for covered entities, business associates, and subcontractors to come into compliance with the modified rules, particularly with regard to changes in technology.
The final rule is effective on March 26, 2013. Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to come into compliance with most of the final rule's provisions, including the modifications to the Breach Notification Rule and the changes to the HIPAA Privacy Rule under GINA. We understand that some covered entities, business associates, and subcontractors remain concerned that a 180-day period does not provide sufficient time to come into compliance with the modifications. However, we believe not only that providing a 180-day compliance period best comports with section 1175(b)(2) of the Social Security Act, 42 U.S.C. 1320d-4, and our implementing provision at § 160.104(c)(1), which require the Secretary to provide at least a 180-day period for covered entities to comply with modifications to standards and implementation specifications in the HIPAA Rules, but also that providing a 180-day compliance period best protects the privacy and security of patient information, in accordance with the goals of the HITECH Act.
In addition, to make clear to the industry our expectation that going forward we will provide a 180-day compliance date for future modifications to the HIPAA Rules, we adopt the provision we proposed at § 160.105, which provides that with respect to new or modified standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates must comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. In cases where a future modification necessitates a longer compliance period, the Department will expressly provide for one, as it has done in this rulemaking with respect to the time permitted for business associate agreements to be modified.
For the reasons proposed, the final rule also retains the compliance date provisions at §§ 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively. We note that § 160.105 regarding the compliance date of new or modified standards or implementation specifications does not apply to modifications to the provisions of the HIPAA Enforcement Rule, because such provisions are not standards or implementation specifications (as the terms are defined at § 160.103). Such provisions are in effect and apply at the time the final rule becomes effective or as otherwise specifically provided. In addition, as explained above, our general rule for a 180-day compliance period for new or modified standards would not apply where we expressly provide a different compliance period in the regulation for one or more provisions. For purposes of this rule, the 180-day compliance period would not govern the time period required to modify those business associate agreements that qualify for the longer transition period in § 164.532, as we discuss further below.
Finally, the provisions of section 13402(j) of the HITECH Act apply to breaches of unsecured protected health information discovered on or after September 23, 2009, the date of the publication of the interim final rule. Thus, during the 180 day period before compliance with this final rule is required, covered entities and business associates are still required to comply with the breach notification requirements under the HITECH Act and must continue to comply with the requirements of the interim final rule. We believe that this transition period provides covered entities and business associates with adequate time to come into compliance with the revisions in this final rule and at the same time to continue to fulfill their breach notification obligations under the HITECH Act.
IV. Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the HITECH Act; Other Modifications to the HIPAA Rules Back to Top
The discussion below provides a section-by-section description of the final rule, as well as responds to public comments where substantive comments were received regarding particular provisions.
Subpart A of Part 160 of the HIPAA Rules contains general provisions that apply to all of the HIPAA Rules. Subpart B of Part 160 contains the regulatory provisions implementing HIPAA's preemption provisions. We proposed to amend a number of these provisions. Some of the proposed, and now final, changes are necessitated by the statutory changes made by the HITECH Act and GINA, while others are of a technical or conforming nature.
This section sets out the statutory basis and purpose of the HIPAA Rules. We proposed and include in this final rule a technical change to include references to the provisions of GINA and the HITECH Act upon which most of the regulatory changes below are based.
This section sets out to whom the HIPAA Rules apply. We proposed to add and include in this final rule a new paragraph (b) to make clear, consistent with the HITECH Act, that certain of the standards, requirements, and implementation specifications of the subchapter apply to business associates.
Section 160.103 contains definitions of terms that appear throughout the HIPAA Rules. The final rule modifies a number of these definitions to implement the HITECH Act and make other needed changes.
The HIPAA Privacy and Security Rules permit a covered entity to disclose protected health information to a business associate, and allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, provided the covered entity obtains satisfactory assurances in the form of a contract or other arrangement that the business associate will appropriately safeguard the information. The HIPAA Rules define “business associate” generally to mean a person who performs functions or activities on behalf of, or certain services for, a covered entity that involve the use or disclosure of protected health information. We proposed a number of modifications to the definition of “business associate” to implement the HITECH Act, to conform the term to the statutory provisions of the Patient Safety and Quality Improvement Act of 2005 (PSQIA), 42 U.S.C. 299b-21, et seq., and to make other changes to the definition.
We proposed to add patient safety activities to the list of functions and activities a person may undertake on behalf of a covered entity that give rise to a business associate relationship. PSQIA, at 42 U.S.C. 299b-22(i)(1), provides that Patient Safety Organizations (PSOs) must be treated as business associates when applying the Privacy Rule. PSQIA provides for the establishment of PSOs to receive reports of patient safety events or concerns from providers and provide analyses of events to reporting providers. A reporting provider may be a HIPAA covered entity and, thus, information reported to a PSO may include protected health information that the PSO may analyze on behalf of the covered provider. The analysis of such information is a patient safety activity for purposes of PSQIA and the Patient Safety Rule, 42 CFR 3.10, et seq. While the HIPAA Rules as written would treat a PSO as a business associate when the PSO was performing quality analyses and other activities on behalf of a covered health care provider, we proposed this change to the definition of “business associate” to more clearly align the HIPAA and Patient Safety Rules.
Commenters on this topic supported the express inclusion of patient safety activities within the definition of “business associate.”
The final rule adopts the proposed modification.
Section 13408 of the HITECH Act provides that an organization, such as a Health Information Exchange Organization, E-prescribing Gateway, or Regional Health Information Organization, that provides data transmission of protected health information to a covered entity (or its business associate) and that requires access on a routine basis to such protected health information must be treated as a business associate for purposes of the Act and the HIPAA Privacy and Security Rules. Section 13408 also provides that a vendor that contracts with a covered entity to allow the covered entity to offer a personal health record to patients as part of the covered entity's electronic health record shall be treated as a business associate. Section 13408 requires that such organizations and vendors enter into a written business associate contract or other arrangement with the covered entity in accordance with the HIPAA Rules.
In accordance with the Act, we proposed to modify the definition of “business associate” to explicitly designate these persons as business associates. Specifically, we proposed to include in the definition: (1) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires routine access to such protected health information; and (2) a person who offers a personal health record to one or more individuals on behalf of a covered entity.
We proposed to refer to “Health Information Organization” in the NPRM rather than “Health Information Exchange Organization” as used in the Act because it is our understanding that “Health Information Organization” is the more widely recognized and accepted term to describe an organization that oversees and governs the exchange of health-related information among organizations.
The Act also specifically refers to Regional Health Information Organizations; however, we did not believe the inclusion of the term in the definition of “business associate” was necessary as a Regional Health Information Organization is simply a Health Information Organization that governs health information exchange among organizations within a defined geographic area.
Further, the specific terms of “Health Information Organization” and “E-prescribing Gateway” were included as merely illustrative of the types of organizations that would fall within this paragraph of the definition of “business associate.” We requested comment on the use of these terms within the definition and whether additional clarifications or additions were necessary.
Section 13408 also provides that the data transmission organizations that the Act requires to be treated as business associates are those that require access to protected health information on a routine basis. Conversely, data transmission organizations that do not require access to protected health information on a routine basis would not be treated as business associates. This is consistent with our prior interpretation of the definition of “business associate,” through which we have stated that entities that act as mere conduits for the transport of protected health information but do not access the information other than on a random or infrequent basis are not business associates. See http://www.hhs.gov/ocr/privacy/hipaa/faq/providers/business/245.html. In contrast, entities that manage the exchange of protected health information through a network, including providing record locator services and performing various oversight and governance functions for electronic health information exchange, have more than “random” access to protected health information and thus, would fall within the definition of “business associate.”
Commenters generally supported the inclusion of Health Information Organizations, personal health record vendors, and similar entities in the definition of “business associate.” However, commenters sought various clarifications as discussed below.
Commenters generally supported use of the term Health Information Organization in lieu of more restrictive terms, such as Regional Health Information Organization. Some commenters suggested that the term Health Information Organization be defined, so as to avoid confusion as the industry develops, and suggested various alternatives for doing so. Several commenters recommended that the Office for Civil Rights (OCR) maintain a Web site link that lists current terms for entities that OCR considers to be Health Information Organizations.
Other commenters requested clarification on what it means to have “access on a routine basis” to protected health information for purposes of the definition and determining whether certain entities are excluded as mere conduits. For example, commenters asked whether the definition of business associate would include broadband suppliers or internet service providers, vendors that only have the potential to come into contact with protected health information, or entities contracted on a contingency basis that may at some point in the future have access to protected health information. Several document storage companies argued that entities like theirs should be characterized as conduits, as they do not view the protected health information they store.
Several commenters sought clarification regarding when personal health record vendors would be considered business associates. For example, commenters asked whether personal health record vendors would be business associates when the vendor provided the personal health record in collaboration with the covered entity, when the personal health record is linked to a covered entity's electronic health record, or when the personal health record is offered independently to the individual, among other scenarios. One commenter suggested that a vendor offering a personal health record to a patient on behalf of a covered entity only acts as a conduit because there is no access by the vendor to protected health information; another commenter suggested that personal health record vendors be business associates only when they have routine access to protected health information.
Several commenters sought clarification on when a personal health record vendor would be providing a personal health record “on behalf of” a covered entity and thus, would be a business associate for purposes of the HIPAA Rules. As with data transmission services, determining whether a personal health record vendor is a business associate is a fact specific determination. A personal health record vendor is not a business associate of a covered entity solely by virtue of entering into an interoperability relationship with a covered entity. For example, when a personal health record vendor and a covered entity establish the electronic means for a covered entity's electronic health record to send protected health information to the personal health record vendor pursuant to the individual's written authorization, it does not mean that the personal health record vendor is offering the personal health record on behalf of the covered entity, even if there is an agreement between the personal health record vendor and the covered entity governing the exchange of data (such as an agreement specifying the technical specifications for exchanging of data or specifying that such data shall be kept confidential). In contrast, when a covered entity hires a vendor to provide and manage a personal health record service the covered entity wishes to offer its patients or enrollees, and provides the vendor with access to protected health information in order to do so, the personal health record vendor is a business associate.
We also clarify that, contrary to one commenter's suggestion, a personal health record vendor that offers a personal health record to a patient on behalf of a covered entity does not act merely as a conduit. Rather, the personal health record vendor is maintaining protected health information on behalf of the covered entity (for the benefit of the individual). Further, a personal health record vendor that operates a personal health record on behalf of a covered entity is a business associate if it has access to protected health information, regardless of whether the personal health record vendor actually exercises this access. We believe the revisions to the definition of “business associate” discussed above clarify these points. As with other aspects of the definition of “business associate,” we intend to provide future guidance on when a personal health record vendor is a business associate for purposes of the HIPAA Rules.
Comment: One commenter recommended that the term “person” used in describing who provides transmission services to a covered entity be clarified to apply also to entities and organizations.
Response: The term “person” as defined at § 160.103 includes entities as well as natural persons.
Comment: One commenter asked whether subcontractors that support business associates with personal health record related functions are subject to the breach notification requirements under the HIPAA Breach Notification Rule or that of the FTC.
Response: As discussed below, a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of a business associate, including with respect to personal health record functions, is a HIPAA business associate and thus, is subject to the HIPAA Breach Notification Rule and not that of the FTC. The analysis of whether a subcontractor is acting on behalf of a business associate is the same analysis as discussed above with respect to whether a business associate is acting on behalf of a covered entity.
We proposed in the definition of “business associate” to provide that subcontractors of a covered entity, i.e., those persons that perform functions for or provide services to a business associate other than in the capacity as a member of the business associate's workforce, are also business associates to the extent that they require access to protected health information. We also proposed to define “subcontractor” in § 160.103 as a person who acts on behalf of a business associate, other than in the capacity of a member of the workforce of such business associate. Even though we used the term “subcontractor,” which implies there is a contract in place between the parties, the definition would apply to an agent or other person who acts on behalf of the business associate, even if the business associate has failed to enter into a business associate contract with the person. We requested comment on the use of the term “subcontractor” and its proposed definition.
The intent of the proposed extension of the Rules to subcontractors was to avoid having privacy and security protections for protected health information lapse merely because a function is performed by an entity that is a subcontractor rather than an entity with a direct relationship with a covered entity. Allowing such a lapse in privacy and security protections could allow business associates to avoid liability imposed upon them by sections 13401 and 13404 of the Act. Further, applying HIPAA privacy and security requirements directly to subcontractors also ensures that the privacy and security protections of the HIPAA Rules extend beyond covered entities to those entities that create or receive protected health information in order for the covered entity to perform its health care functions. Therefore, we proposed that downstream entities that work at the direction of or on behalf of a business associate and handle protected health information would also be required to comply with the applicable Privacy and Security Rule provisions in the same manner as the primary business associate, and likewise would incur liability for acts of noncompliance. This proposed modification would not require the covered entity to have a contract with the subcontractor; rather, the obligation would remain on each business associate to obtain satisfactory assurances in the form of a written contract or other arrangement that a subcontractor will appropriately safeguard protected health information. For example, if a business associate, such as a third party administrator, hires a company to handle document and media shredding to securely dispose of paper and electronic protected health information, then the shredding company would be directly required to comply with the applicable requirements of the HIPAA Security Rule (e.g., with respect to proper disposal of electronic media) and the Privacy Rule (e.g., with respect to limiting its uses and disclosures of the protected health information in accordance with its contract with the business associate).
While some commenters generally supported extending the business associate provisions of the Rules to subcontractors, many opposed such an extension arguing, among other things, that doing so was not the intent of Congress and beyond the statutory authority of the Department, that confusion may ensue with covered entities seeking to establish direct business associate contracts with subcontractors or prohibiting business associates from establishing subcontractor relationships altogether, and/or that creating direct liability for subcontractors will discourage such entities from operating and participating in the health care industry. Some commenters asked how far down the “chain” of subcontractors do the HIPAA Rules apply—i.e., do the Rules apply only to the first tier subcontractor or to all subcontractors down the chain.
In response to our request for comment on this issue, several commenters were concerned that use of the term subcontractor was confusing and instead suggested a different term be used, such as business associate contractor or downstream business associate, to avoid confusion between primary business associates of a covered entity and subcontractors. Other commenters suggested changes to the definition of subcontractor itself to better clarify the scope of the definition.
Several commenters requested specific guidance on who is and is not a subcontractor under the definitions of “business associate” and “subcontractor.” For example, one commenter asked whether an entity that shreds documents for a business associate for the business associate's activities and not for the covered entity, would qualify as a subcontractor. Another commenter asked whether disclosures by a business associate of protected health information for its own management and administration or legal needs creates a subcontractor relationship. Other commenters recommended that subcontractors without routine access to protected health information, or who do not access protected health information at all for their duties, not be considered business associates.
The final rule adopts the proposal to apply the business associate provisions of the HIPAA Rules to subcontractors and thus, provides in the definition of “business associate” that a business associate includes a “subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.” In response to comments, we clarify the definition of “subcontractor” in § 160.103 to provide that subcontractor means: “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.” Thus, a subcontractor is a person to whom a business associate has delegated a function, activity, or service the business associate has agreed to perform for a covered entity or business associate. A subcontractor is then a business associate where that function, activity, or service involves the creation, receipt, maintenance, or transmission of protected health information. We also decline to replace the term “subcontractor” with another, as we were not persuaded by any of the alternatives suggested by commenters (e.g., “business associate contractor,” “downstream business associate,” or “downstream entity”).
We disagree with the commenters that suggested that applying the business associate provisions of the HIPAA Rules to subcontractors is beyond the Department's statutory authority. In the HITECH Act, Congress created direct liability under the HIPAA Privacy and Security Rules for persons that are not covered entities but that create or receive protected health information in order for a covered entity to perform its health care functions, to ensure individuals' personal health information remains sufficiently protected in the hands of these entities. As stated in the NPRM, applying the business associate provisions only to those entities that have a direct relationship with a covered entity does not achieve that intended purpose. Rather, it allows privacy and security protections for protected health information to lapse once a subcontractor is enlisted to assist in performing a function, activity, or service for the covered entity, while at the same time potentially allowing certain primary business associates to avoid liability altogether for the protection of the information the covered entity has entrusted to the business associate. Further, section 13422 of the HITECH Act provides that each reference in the Privacy subtitle of the Act to a provision of the HIPAA Rules refers to such provision as in effect on the date of enactment of the Act or to the most recent update of such provision (emphasis added). Thus, the Act does not bar the Department from modifying definitions of terms in the HIPAA Rules to which the Act refers. Rather, the statute expressly contemplates that modifications to the terms may be necessary to carry out the provisions of the Act or for other purposes.
Further, we do not agree that covered entities will be confused and seek to establish direct business associate contracts with subcontractors or will prohibit business associates from engaging subcontractors to perform functions or services that require access to protected health information. The final rule makes clear that a covered entity is not required to enter into a contract or other arrangement with a business associate that is a subcontractor. See §§ 164.308(b)(1) and 164.502(e)(1)(i). In addition, as commenters did not present direct evidence to the contrary, we do not believe that covered entities will begin prohibiting business associates from engaging subcontractors as a result of the final rule, in cases where they were not doing so before. Rather, we believe that making subcontractors directly liable for violations of the applicable provisions of the HIPAA Rules will help to alleviate concern on the part of covered entities that protected health information is not adequately protected when provided to subcontractors.
The Department also believes that the privacy and security protections for an individual's personal health information and associated liability for noncompliance with the Rules should not lapse beyond any particular business associate that is a subcontractor. Thus, under the final rule, covered entities must ensure that they obtain satisfactory assurances required by the Rules from their business associates, and business associates must do the same with regard to subcontractors, and so on, no matter how far “down the chain” the information flows. This ensures that individuals' health information remains protected by all parties that create, receive, maintain, or transmit the information in order for a covered entity to perform its health care functions. For example, a covered entity may contract with a business associate (contractor), the contractor may delegate to a subcontractor (subcontractor 1) one or more functions, services, or activities the business associate has agreed to perform for the covered entity that require access to protected health information, and the subcontractor may in turn delegate to another subcontractor (subcontractor 2) one or more functions, services, or activities it has agreed to perform for the contractor that require access to protected health information, and so on. Both the contractor and all of the subcontractors are business associates under the final rule to the extent they create, receive, maintain, or transmit protected health information.
With respect to requests for specific guidance on who is and is not a subcontractor, we believe the above changes to the definition provide further clarity. We also provide the following in response to specific comments. Disclosures by a business associate pursuant to § 164.504(e)(4) and its business associate contract for its own management and administration or legal responsibilities do not create a business associate relationship with the recipient of the protected health information because such disclosures are made outside of the entity's role as a business associate. However, for such disclosures that are not required by law, the Rule requires that the business associate obtain reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person notifies the business associate of any instances of which it is aware that the confidentiality of the information has been breached. See § 164.504(e)(4)(ii)(B).
In contrast, disclosures of protected health information by the business associate to a person who will assist the business associate in performing a function, activity, or service for a covered entity or another business associate may create a business associate relationship depending on the circumstances. For example, an entity hired by a business associate to appropriately dispose of documents that contain protected health information is also a business associate and subject to the applicable provisions of the HIPAA Rules. If the documents to be shredded do not contain protected health information, then the entity is not a business associate. We also clarify that the same interpretations that apply to determining whether a first tier contractor is a business associate also apply to determining whether a subcontractor is a business associate. Thus, our interpretation of who is and is not excluded from the definition of business associate as a conduit also applies in the context of subcontractors as well. We refer readers to the above discussion regarding transmission services and conduits.
Sections 164.308(b)(2) and 164.502(e)(1)(ii) of the HIPAA Rules currently describe certain circumstances, such as when a covered entity discloses protected health information to a health care provider concerning the treatment of an individual, in which a covered entity is not required to enter into a business associate contract or other arrangement with the recipient of the protected health information. We proposed to move these provisions to the definition of “business associate” itself as exceptions to make clear that the Department does not consider the recipients of the protected health information in these circumstances to be business associates. The movement of these exceptions also was intended to help clarify that a person or an entity is a business associate if the person or entity meets the definition of “business associate,” even if a covered entity, or business associate with respect to a subcontractor, fails to enter into the required business associate contract with the person or entity.
The Department did not receive substantive public comment on this proposal. The final rule includes the exceptions within the definition of “business associate.”
For clarity and consistency, we also proposed to change the term “individually identifiable health information” in the current definition of “business associate” to “protected health information,” since a business associate has no obligation under the HIPAA Rules with respect to individually identifiable health information that is not protected health information.
The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modification to the definition. Additionally, as indicated above, we have revised the definition of business associate to clarify that a business associate includes an entity that “creates, receives, maintains, or transmits” protected health information on behalf of a covered entity. This change is intended to make the definition more consistent with language at § 164.308(b) of the Security Rule and § 164.502(e) of the Privacy Rule, as well as to clarify that entities that maintain or store protected health information on behalf of a covered entity are business associates, even if they do not actually view the protected health information.
Comment: One commenter suggested that some covered entities do not treat third party persons that handle protected health information onsite as a business associate.
Response: A covered entity may treat a contractor who has his or her duty station onsite at a covered entity and who has more than incidental access to protected health information as either a member of the covered entity's workforce or as a business associate for purposes of the HIPAA Rules.
Comment: A few commenters asked for confirmation that researchers are not considered business associates. In addition, the Secretary's Advisory Committee on Human Research Protections, in its November 23, 2010, letter to the Secretary providing comments on the NPRM, asked the Department to confirm that outsourced research review, approval, and continuing oversight functions (such as through using an external or independent Institutional Review Board) similarly do not give rise to a business associate relationship.
Response: A person or entity is a business associate only in cases where the person or entity is conducting a function or activity regulated by the HIPAA Rules on behalf of a covered entity, such as payment or health care operations, or providing one of the services listed in the definition of “business associate,” and in the performance of such duties the person or entity has access to protected health information. Thus, an external researcher is not a business associate of a covered entity by virtue of its research activities, even if the covered entity has hired the researcher to perform the research. See http://www.hhs.gov/ocr/privacy/hipaa/faq/business_associates/239.html. Similarly, an external or independent Institutional Review Board is not a business associate of a covered entity by virtue of its performing research review, approval, and continuing oversight functions.
However, a researcher may be a business associate if the researcher performs a function, activity, or service for a covered entity that does fall within the definition of business associate, such as the health care operations function of creating a de-identified or limited data set for the covered entity. See paragraph (6)(v) of the definition of “health care operations.” Where the researcher is also the intended recipient of the de-identified data or limited data set, the researcher must return or destroy the identifiers at the time the business associate relationship to create the data set terminates and the researcher now wishes to use the de-identified data or limited data set (subject to a data use agreement) for a research purpose.
Comment: A few commenters asked for clarification as to whether the business associate provisions applied to banking and financial institutions. Commenters sought clarification as to whether the exemption at § 1179 of the HIPAA statute for financial institutions was applicable to subcontractors.
Response: This final rule is not intended to affect the status of financial institutions with respect to whether they are business associates. The HIPAA Rules, including the business associate provisions, do not apply to banking and financial institutions with respect to the payment processing activities identified in § 1179 of the HIPAA statute, for example, the activity of cashing a check or conducting a funds transfer. Section 1179 of HIPAA exempts certain activities of financial institutions from the HIPAA Rules, to the extent that these activities constitute authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments for health care or health plan premiums. However, a banking or financial institution may be a business associate where the institution performs functions above and beyond the payment processing activities identified above on behalf of a covered entity, such as performing accounts receivable functions on behalf of a health care provider.
We clarify that our inclusion of subcontractors in the definition of business associate does not impact the exclusion of financial institutions from the definition of “business associates” when they are only conducting payment processing activities that fall under § 1179 of the HIPAA statute. Accordingly, a business associate need not enter into a business associate agreement with a financial institution that is solely conducting payment activities that are excluded under § 1179.
Comment: One commenter sought clarification of the status of a risk management group or malpractice insurance company that receives protected health information when contracted with a covered entity to mitigate the covered entity's risk and then contracts with legal groups to represent the covered entity during malpractice claims.
Response: A business associate agreement is not required where a covered entity purchases a health plan product or other insurance, such as medical liability insurance, from an insurer. However, a business associate relationship could arise if the insurer is performing a function on behalf of, or providing services to, the covered entity that does not directly relate to the provision of insurance benefits, such as performing risk management or assessment activities or legal services for the covered entity, that involve access to protected health information.
The term “electronic media” was originally defined in the Transactions and Code Sets Rule issued on August 17, 2000 (65 FR 50312) and was included in the definitions at § 162.103. That definition was subsequently revised and moved to § 160.103. The purpose of that revision was to clarify that the physical movement of electronic media from place to place is not limited to magnetic tape, disk, or compact disk, so as to allow for future technological innovation. We further clarified that transmission of information not in electronic form before the transmission (e.g., paper or voice) is not covered by this definition. See 68 FR 8339, Feb. 20, 2003.
In the NPRM, we proposed to revise the definition of “electronic media” in the following ways. First, we proposed to revise paragraph (1) of the definition to replace the term “electronic storage media” with “electronic storage material” to conform the definition of “electronic media” to its current usage, as set forth in the National Institute for Standards and Technology (NIST) “Guidelines for Media Sanitization” (Definition of Medium, NIST SP 800-88, Glossary B, p. 27 (2006)). The NIST definition, which was updated subsequent to the issuance of the Privacy and Security Rules, was developed in recognition of the likelihood that the evolution of the development of new technology would make use of the term “electronic storage media” obsolete in that there may be “storage material” other than “media” that house electronic data. Second, we proposed to add to paragraph (2) of the definition of “electronic media” a reference to intranets, to clarify that intranets come within the definition. Third, we proposed to change the word “because” to “if” in the final sentence of paragraph (2) of the definition of “electronic media.” The definition assumed that no transmissions made by voice via telephone existed in electronic form before transmission; the evolution of technology has made this assumption obsolete since some voice technology is digitally produced from an information system and transmitted by phone.
The Department received comments in support of the revised definition and the flexibility created to account for later technological developments. Certain other commenters raised concerns that changes to the definition could have unintended impacts when applied to the administrative transaction and code set requirements. One commenter specifically supported the change in language from “because” to “if,” noting the distinction was important to provide protection for digital audio recordings containing protected health information. One commenter suggested including the word “immediately” in the final sentence of paragraph (2) to indicate that fax transmissions are excluded from the definition of electronic media if the information being exchanged did not exist in electronic form immediately before the transmission. Several commenters sought clarification as to whether data that is retained in office machines, such as facsimiles and photocopiers, is subject to the Privacy and Security Rules.
The final rule adopts the definition as proposed with two additional modifications. First, in paragraph (2) we remove the parenthetical language referring to “wide open” with respect to the Internet and “using Internet technology to link a business with information accessible only to collaborating parties” with respect to extranets and intranets. The parenthetical language initially helped clarify what was intended by key words within the definition. As these key words have become more generally understood and guidance has become available through the NIST regarding specific key terms, such as intranet, extranet, and internet, (see, for example, NIST IR 7298 Revision 1, Glossary of Key Information Security Terms, February 2011, available at http://csrc.nist.gov/publications/nistir/ir7298-rev1/nistir-7298-revision1.pdf), we believe the parenthetical language is no longer helpful. Second, we do accept the recommendation that we alter the language in paragraph (2) to include the word “immediately,” to exclude transmissions when the information exchanged did not exist in electronic form immediately before transmission. This modification clarifies that a facsimile machine accepting a hardcopy document for transmission is not a covered transmission even though the document may have originated from printing from an electronic file.
We do not believe these changes will have unforeseen impacts on the application of the term in the transactions and code sets requirements at Part 162.
In response to commenters' concerns that photocopiers, facsimiles, and other office machines may retain electronic data, potentially storing protected health information when used by covered entities or business associates, we clarify that protected health information stored, whether intentionally or not, in photocopier, facsimile, and other devices is subject to the Privacy and Security Rules. Although such devices are not generally relied upon for storage and access to stored information, covered entities and business associates should be aware of the capabilities of these devices to store protected health information and must ensure any protected health information stored on such devices is appropriately protected and secured from inappropriate access, such as by monitoring or restricting physical access to a photocopier or a fax machine that is used for copying or sending protected health information. Further, before removal of the device from the covered entity or business associate, such as at the end of the lease term for a photocopier machine, proper safeguards should be followed to remove the electronic protected health information from the media.
For consistency with the proposed modifications to the period of protection for decedent information at § 164.502(f) (discussed below), the Department proposed to modify the definition of “protected health information” at § 160.103 to provide that the Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years.
The public comments received on this proposal are discussed and responded to below in the section describing the modifications to § 164.502(f).
For the reasons stated in the section regarding § 164.502(f), the final rule adopts the proposed modification to the definition of “protected health information.”
The HITECH Act at section 13400 includes a definition of “State” to mean “each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.” This definition varies from paragraph (2) of the HIPAA definition of “State” at § 160.103, which does not include reference to American Samoa and the Northern Mariana Islands. Thus, for consistency with the definition applied to the HIPAA Rules by the HITECH Act, we proposed to add reference to American Samoa and the Commonwealth of the Northern Mariana Islands in paragraph (2) of the definition of “State” at § 160.103.
The Department did not receive substantive public comment on this proposal and the final rule adopts the proposed modifications to the definition of “State.”
In addition to the changes discussed above, the final rule makes the following changes as proposed in the NPRM to various definitions in § 160.103:
(1) Relocates the definitions of “administrative simplification provision,” “ALJ,” “civil money penalty,” “respondent,” and “violation or violate” from § 160.302 to § 160.103 for ease of reference;
(2) Adds a reference to sections 13400-13424 of the HITECH Act to the definition of “administrative simplification provision”;
(3) Removes a comma from the definition of “disclosure” inadvertently inserted into the definition in a prior rulemaking;
(4) Replaces the term “individually identifiable health information” with “protected health information” in the definition of “standard” to better reflect the scope of the Privacy and Security Rules;
(5) Adds a reference to “business associate” following the reference to “covered entity” in the definitions of “respondent” and “compliance date,” in recognition of the potential liability imposed on business associates for violations of certain provisions of the Privacy and Security Rules by sections 13401 and 13404 of the Act; and
(6) Revises the definition of “workforce member” in § 160.103 to make clear that the term includes the employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a business associate, is under the direct control of the business associate, because some provisions of the Act and the Privacy and Security Rules place obligations on the business associate with respect to workforce members.
We proposed to modify § 160.201 regarding the statutory basis for the preemption of State law provisions to add a reference to section 264(c) of HIPAA, which contains the statutory basis for the exception to preemption at § 160.203(b) for State laws that are more stringent than the HIPAA Privacy Rule. We also proposed to add a reference to section 13421(a) of the HITECH Act, which applies HIPAA's preemption rules to the HITECH Act's privacy and security provisions. Finally, we proposed to re-title the provision to read “Statutory basis” instead of “Applicability.”
Several commenters expressed concerns about the lack of uniform Federal and State privacy laws and the resultant confusion and expense associated with determining which laws apply to a given circumstance, particularly as more and more health care entities operate across multiple state lines. Commenters recommended that the Department make efforts to engage States and other partners to examine divergent Federal and State requirements and to attempt to coordinate various disclosure rules to drive Federal-State consensus.
The final rule adopts the proposed modifications. In response to the comments concerned with the lack of uniform Federal and State privacy laws, we note that the preemption provisions of the HIPAA Rules are based on section 1178 of the Social Security Act and section 264(c)(2) of HIPAA. Through these statutory provisions, Congress made clear that the HIPAA privacy requirements are to supersede only contrary provisions of State law, and not even in all such cases, such as where the provision of State law provides more stringent privacy protections than the HIPAA Privacy Rule. Accordingly, the HIPAA Privacy Rule provides a Federal floor of privacy protections, with States free to impose more stringent privacy protections should they deem appropriate.
The term “contrary” is defined in § 160.202 to make clear when the preemption provisions of HIPAA apply to State law. For the reasons set forth on page 40875 of the July 2010 NPRM, we proposed to amend the definition of “contrary” by inserting references to business associates in paragraph (1) of the definition. We also expanded the reference to the HITECH statutory provisions in paragraph (2) of the definition to encompass all of the sections of subtitle D of the HITECH Act, rather than merely to section 13402, which was added by the breach notifications interim final rule. These changes would give effect to section 13421(a).
The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modifications.
The term “more stringent” is part of the statutory preemption language under HIPAA. HIPAA preempts State law that is contrary to a HIPAA privacy standard unless, among other exceptions, the State law is more stringent than the contrary HIPAA privacy standard. We proposed to amend the definition to add a reference to business associates.
The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modification.
Section 13410 of the HITECH Act made several amendments to the Social Security Act to strengthen the HIPAA Enforcement Rule, which applies to the Secretary's enforcement of all of the HIPAA Administrative Simplification Rules, as well as the Breach Notification Rule.
On October 30, 2009, the Department issued an interim final rule (IFR) revising the Enforcement Rule to incorporate the provisions of section 13410(d) of the HITECH Act that took effect immediately to apply to violations of the HIPAA Rules occurring after the enactment date of February 18, 2009. See 74 FR 56123. In general, section 13410(d) of the HITECH Act revised section 1176(a) of the Social Security Act to establish four categories of violations that reflect increasing levels of culpability and four corresponding tiers of penalty amounts that significantly increased the minimum penalty amount for each violation, with a maximum penalty amount of $1.5 million annually for all violations of an identical provision. Section 13410(d) also amended section 1176(b) of the Social Security Act by removing the previous affirmative defense to the imposition of penalties if the covered entity did not know and with the exercise of reasonable diligence would not have known of the violation (these violations are now punishable under the lowest tier of penalties), and by providing a prohibition on the imposition of penalties for any violation that is timely corrected, as long as the violation was not due to willful neglect. The IFR updated the HIPAA Enforcement Rule to reflect these statutory amendments. The IFR did not make amendments with respect to those enforcement provisions of section 13410 of the HITECH Act that were not effective immediately upon enactment.
In its July 2010 NPRM, the Department proposed a number of additional modifications to the Enforcement Rule to reflect other provisions of section 13410 of the HITECH Act, some of which became effective on February 18, 2010, or were to become effective at a later date: (1) Requiring that the Secretary formally investigate complaints indicating violations due to willful neglect, and impose civil money penalties upon finding violations due to willful neglect; (2) making business associates of covered entities directly liable for civil money penalties for violations of certain provisions of the HIPAA Rules; (3) requiring the Secretary to determine civil money penalty amounts based upon the nature and extent of the harm resulting from a violation; and (4) providing that the Secretary's authority to impose a civil money penalty will be barred only to the extent a criminal penalty has been imposed with respect to an act under Section 1177, rather than in cases in which the act constitutes an offense that is criminally punishable under Section 1177.
The following discussion describes the enforcement provisions of the IFR and the NPRM, responds to public comment received by the Department on both rules, and describes the final modifications to the Enforcement Rule adopted by this final rule. In addition to the modifications discussed below, this final rule also adopts the NPRM proposal to add the term “business associate” to the following provisions of the Enforcement Rule: §§ 160.300; 160.304; 160.306(a) and (c); 160.308; 160.310; 160.312; 160.316; 160.401; 160.402; 160.404(b); 160.406; 160.408(c) and (d); and 160.410(a) and (c). This is done to implement sections 13401 and 13404 of the Act, which impose direct civil money penalty liability on business associates for their violations of certain provisions of the HIPAA Rules. 1. Subpart C of Part 160—Compliance and Investigations
Section 13410(a) of the HITECH Act adds a new subsection (c) to section 1176 of the Social Security Act, which requires the Department to formally investigate a complaint if a preliminary investigation of the facts of the complaint indicates a possible violation due to willful neglect (section 1176(c)(2)) and to impose a civil money penalty for a violation due to willful neglect (section 1176(c)(1)). The Department proposed a number of modifications to Subpart C of the Enforcement Rule to implement these provisions.
First, § 160.306(c) of the Enforcement Rule currently provides the Secretary with discretion to investigate HIPAA complaints through the use of the word “may.” As a practical matter, however, the Department currently conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. Nonetheless, to implement section 1176(c)(2), the Department proposed to add a new paragraph (1) to § 160.306(c) (and to make conforming changes to the remainder of § 160.306(c)) to make clear that the Secretary will investigate any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect. Under proposed § 160.306(c)(2), the Secretary would have continued discretion with respect to investigating any other complaints.
Second, the Department proposed to modify § 160.308 by adding a new paragraph (a) to provide that the Secretary will conduct a compliance review to determine whether a covered entity or business associate is complying with the applicable administrative simplification provision when a preliminary review of the facts indicates a possible violation due to willful neglect. Like § 160.306(c) with respect to complaints, the current § 160.308(c) provides the Secretary with discretion to conduct compliance reviews. While section 13410(a) of the HITECH Act specifically mentions complaints and not compliance reviews with respect to willful neglect, the Department proposed to treat compliance reviews in the same manner because it believed doing so would strengthen enforcement with respect to potential violations of willful neglect and would ensure that investigations, whether or not initiated by a complaint, would be handled in a consistent manner. Under proposed § 160.308(b), the Secretary would continue to have discretion to conduct compliance reviews in circumstances not indicating willful neglect.
Third, given the HITECH Act's requirement that the Secretary impose a penalty for any violation due to willful neglect, the Department proposed changes to § 160.312, which currently requires the Secretary to attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. The NPRM proposed to provide instead in § 160.312(a) that the Secretary “may” rather than “will” attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. This change would permit the Department to proceed with a willful neglect violation determination as appropriate, while also permitting the Department to seek resolution of complaints and compliance reviews that did not indicate willful neglect violations by informal means (e.g., where the covered entity or business associate did not know and by exercising reasonable diligence would not have known of a violation, or where the violation is due to reasonable cause).
Finally, the Department proposed a conforming change to § 160.304(a), which currently requires the Secretary to seek, to the extent practicable, the cooperation of covered entities in obtaining compliance with the HIPAA Rules. The NPRM proposed to clarify that the Secretary would continue to do so “consistent with the provisions of this subpart” in recognition of the new HITECH Act requirement to impose a civil money penalty for a violation due to willful neglect. While the Secretary often will still seek to correct indications of noncompliance through voluntary corrective action, there may be circumstances (such as circumstances indicating willful neglect), where the Secretary may proceed directly to formal enforcement.
One commenter supported maintaining the current language at §§ 160.306 and 160.308 of the Enforcement Rule, providing the Secretary with discretion to conduct complaint investigations and compliance reviews, regardless of indications of willful neglect. One commenter suggested that OCR look to whether facts indicate a “probable,” rather than “possible,” violation due to willful neglect to limit the likelihood of unnecessary formal investigations or compliance reviews. While one commenter supported the proposal to require a compliance review in circumstances indicating a possible violation due to willful neglect, others argued that requiring compliance reviews in such circumstances is not required by the statute, will detract from resources to investigate complaints, and will be duplicative if a formal complaint investigation is also underway.
Several commenters expressed concern over the proposal at § 160.312(a) to give the Secretary discretion, rather than to require the Secretary, to attempt to resolve investigations or compliance reviews indicating noncompliance by informal means, even in cases of noncompliance that did not involve willful neglect (e.g., cases involving reasonable cause or lack of knowledge of a violation). Commenters indicated support for the Department's seeking compliance through voluntary corrective action as opposed to formal enforcement proceedings and argued that the Department should retain the requirement for the Secretary to attempt informal resolution in all circumstances except those involving willful neglect. One commenter recommended that the Secretary be able to assess penalties regardless of whether corrective action was obtained.
The final rule adopts the modifications to §§ 160.304, 160.306, 160.308, and 160.312, as proposed in the NPRM. The Department believes these changes to the enforcement provisions to be appropriate given the HITECH Act's requirements at section 13410(a) with respect to circumstances indicating or involving noncompliance due to willful neglect. We do not provide in the Rule that the Secretary will investigate when a preliminary review of the facts indicates a “probable” rather than “possible” violation due to willful neglect as the statute requires an investigation even in cases indicating a “possible” violation due to willful neglect. In response to commenters concerned about requiring the Secretary to conduct compliance reviews in circumstances in which facts indicate a possible violation due to willful neglect, we continue to believe that, while not expressly required by the statute, doing so appropriately strengthens enforcement with respect to violations due to willful neglect and ensures consistency in the handling of complaints and compliance reviews in which violations due to willful neglect are indicated. We emphasize that the Department retains discretion to decide whether to conduct a compliance review (or complaint investigation) where a preliminary review of the facts indicates a degree of culpability less than willful neglect. Further, with respect to commenter concerns about duplication between complaint investigations and compliance reviews, we clarify that the Department generally conducts compliance reviews to investigate allegations of violations of the HIPAA Rules brought to the Department's attention through a mechanism other than a complaint. For example, the Department may use a compliance review to investigate allegations of violations of the Rules brought to our attention through a media report, or from a State or another Federal agency. If the Department initiates an investigation of a complaint because its preliminary review of the facts indicates a possible violation due to willful neglect, the Department is not also required to initiate a compliance review under § 160.308 because doing so would initiate a duplicative investigation.
With respect to § 160.312, where the Rule previously mandated that the Secretary attempt to resolve indicated violations of the HIPAA Rules by informal means, the final rule now provides the Secretary with the discretion to do so, to reflect Section 13410 of the HITECH Act with regard to violations due to willful neglect. Nothing in Section 13410 of the HITECH Act limits the Secretary's ability to resolve such cases by informal means. However, through its introduction of higher penalties and its mandate for formal investigations with regard to possible violations due to willful neglect, Section 13410 strengthens enforcement and accordingly we have revised § 160.312 so that the Secretary may move directly to a civil money penalty without exhausting informal resolution efforts at her discretion, particularly in cases involving willful neglect violations.
Comment: A number of commenters requested further clarification on the scope and depth of what constitutes a “preliminary review of the facts” for purposes of determining whether facts indicate a possible violation due to willful neglect and thus, warrant a formal complaint investigation or compliance review. Certain commenters suggested that a preliminary review of the facts should go beyond merely a review of the allegations asserted in a complaint.
Response: As noted above, currently the Department conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. The Department anticipates that some complaints, on their face, or reports or referrals that form the basis of a potential compliance review, will contain sufficient information to indicate a possible violation due to willful neglect, and some may not. In any event, the Department may on a case-by-case basis expand the preliminary review and conduct additional inquiries for purposes of identifying a possible violation due to willful neglect. Notwithstanding the scope of a preliminary review, OCR will determine if an indicated violation was due to willful neglect based on the evidence from its investigation of the allegations, even if a violation due to willful neglect was not indicated at the preliminary review stage.
Section 160.310 requires that covered entities make information available to and cooperate with the Secretary during complaint investigations and compliance reviews. Section 160.310(c)(3) provides that any protected health information obtained by the Secretary in connection with an investigation or compliance review will not be disclosed by the Secretary, except as necessary for determining and enforcing compliance with the HIPAA Rules or as otherwise required by law. In the proposed rule, we proposed to modify this paragraph to also allow the Secretary to disclose protected health information if permitted under the Privacy Act at 5 U.S.C. 552a(b)(7). Section 5 U.S.C. 552a(b)(7) permits the disclosure of a record on an individual contained within a government system of records protected under the Privacy Act to another agency or instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law and if the agency has made a written request to the agency that maintains the record. The proposed change would permit the Secretary to coordinate with other law enforcement agencies, such as the State Attorneys General pursuing civil actions to enforce the HIPAA Rules on behalf of State residents pursuant to section 13410(e) of the Act, or the FTC pursuing remedies under other consumer protection authorities.
One commenter requested clarification and transparency on how or if Federal regulators such as OCR and the FTC will collaborate, when such information sharing will be initiated or occur as a routine process, or whether Federal and State agencies will work together to enforce suspected violations.
To facilitate cooperation between the Department and other law enforcement agencies, the final rule adopts the modifications to § 160.310(c)(3) as proposed in the NPRM. In response to the comment regarding transparency in how the Department is or will cooperate with other agencies in enforcement, we note that the Department's web site at http://www.hhs.gov/ocr/enforcement/ contains information about how the Department coordinates with the Department of Justice to refer cases involving possible criminal HIPAA violations and how the Department has worked with the FTC to coordinate enforcement actions for violations that implicate both HIPAA and the FTC Act. Further, the Department will be working closely with State Attorneys General to coordinate enforcement in appropriate cases, as provided under section 13410(e) of the HITECH Act. The Department will continue to update its web site as necessary and appropriate to maintain transparency with the public and the regulated community about these coordinated activities and its other enforcement actions and activities.
Section 160.401 defines “reasonable cause,” “reasonable diligence,” and “willful neglect.” Given that section 13410(d) of the HITECH Act uses these terms to describe the increasing levels of culpability for which increasing minimum levels of penalties may be imposed, the Department moved these definitions in the IFR from their prior placement at § 160.410, which pertains only to affirmative defenses, to § 160.401, so that they would apply to the entirety of Subpart D of Part 160 and the provisions regarding the imposition of civil money penalties. The IFR did not modify the definitions themselves as the HITECH Act did not amend the definitions.
Even though the HITECH Act did not amend the definitions of these terms, the Department in its NPRM proposed certain modifications to the definition of “reasonable cause” to clarify the mens rea (state of mind) required for this category of violations, and to avoid the situation where certain violations would not fall within one of the established penalty tiers. This modification is discussed below. The Department did not propose modifications to the definitions of “reasonable diligence” and “willful neglect.”
In the NPRM, the Department also included examples and guidance as to how the Department planned to apply the definitions of “reasonable cause,” “reasonable diligence,” and “willful neglect” to distinguish among the tiers of culpability. 75 FR 40877-40879. As commenters generally found this guidance helpful, the Department intends to publish the guidance on its web site.
Reasonable cause is currently defined at § 160.401 to mean: “circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated.” This definition is consistent with the Supreme Court's ruling in United States v. Boyle, 469 U.S. 241, 245 (1985), which focused on whether circumstances were beyond the regulated person's control, thereby making compliance unreasonable. See 70 FR 20224, 20238. Prior to the HITECH Act, section 1176 of the Social Security Act provided an affirmative defense to the imposition of a civil money penalty if the covered entity established that its violation was due to reasonable cause and not willful neglect and was corrected within a 30-day period (or such additional period determined by the Secretary to be appropriate).
As described above, section 13410(d) of the HITECH Act revised section 1176 of the Social Security Act to establish four tiers of increasing penalty amounts to correspond to the levels of culpability associated with the violation. The first category of violation (and lowest penalty tier) covers situations where the covered entity or business associate did not know, and by exercising reasonable diligence would not have known, of a violation. The second category of violation (and next highest penalty tier) applies to violations due to reasonable cause and not to willful neglect. The third and fourth categories apply to circumstances where the violation was due to willful neglect that is corrected within a certain time period (second highest penalty tier) and willful neglect that is not corrected (highest penalty tier). The mens rea, or state of mind, associated with the tiers is clear with respect to the first, third, and fourth categories, in that there is no mens rea with respect to the lowest category of violation, while the existence of mens rea is presumed with respect to the third and fourth categories of violation.
However, the current definition of “reasonable cause” does not address mens rea with respect to the second category of violations. Therefore, the Department proposed to amend the definition of “reasonable cause” at § 160.401 to clarify the mens rea associated with the reasonable cause category of violations and to clarify the full scope of violations that will come within the category. Specifically, the Department proposed to modify the definition of “reasonable cause” to mean “an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.” Thus, the proposed definition would now include violations due both to circumstances that would make it unreasonable for the covered entity or business associate, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated, as well as to other circumstances in which a covered entity or business associate has knowledge of a violation but lacks the conscious intent or reckless indifference associated with the willful neglect category of violations.
Commenters addressing the definition of “reasonable cause” expressed general support for the proposed clarifications to the scope of this category of violations.
The final rule adopts the proposed modifications to the definition.
Section 160.402(a) states generally that the Secretary will impose a civil money penalty upon a covered entity if the Secretary determines that the covered entity violated an administrative simplification provision. Section 164.402, in paragraphs (b) and (c), provides the basis for a civil money penalty against a covered entity where more than one covered entity is responsible for a violation, where an affiliated covered entity is responsible for a violation, and where an agent of a covered entity is responsible for a violation.
The proposed rule proposed to remove the exception at § 160.402(c) for covered entity liability for the acts of its agent in cases where the agent is a business associate, the relevant contract requirements have been met, the covered entity did not know of a pattern or practice of the business associate in violation of the contract, and the covered entity did not fail to act as required by the Privacy or Security Rule with respect to such violations. The proposed rule also proposed to add a parallel provision in a new paragraph (2) at § 160.402(c) that would provide for civil money penalty liability against a business associate for the acts of its agent. The existing language of § 160.402(c) regarding the liability of covered entities for the acts of their agents would be re-designated as paragraph (1).
These proposed changes would make covered entities and business associates liable under § 160.402(c) for the acts of their business associate agents, in accordance with the Federal common law of agency, regardless of whether the covered entity has a compliant business associate agreement in place. Section 160.402(c) closely tracks the language in section 1128A(l) of the Social Security Act, which is made applicable to HIPAA by section 1176(a)(2) of such Act, which states that “a principal is liable for penalties * * * under this section for the actions of the principal's agents acting within the scope of the agency.” One reason for removing the exception to the general provision at § 160.402(c), as we explained in the NPRM, is to ensure, where a covered entity or business associate has delegated out an obligation under the HIPAA Rules, that a covered entity or business associate would remain liable for penalties for the failure of its business associate agent to perform the obligation on the covered entity or business associate's behalf.
Several commenters requested that the Department clarify and provide additional guidance regarding how the Federal common law of agency applies to business associate relationships. These commenters expressed an overall concern that applying the Federal common law of agency to business associate relationships would add unnecessary confusion to and place an undue burden on business associate relationships. Several commenters argued that the proposed change would require covered entities and business associates to determine whether their business associates or business associate subcontractors are agents, resulting in costly and burdensome challenges when drafting business associate contracts and monitoring ongoing relationships. One commenter argued that the Federal common law of agency should not be applied to covered entity and business associate relationships because it does not generally control when the parties have entered into a contractual agreement that specifies their respective rights and obligations. Instead, the commenter argued, the contractual provisions control, and are interpreted and enforced in accordance with State law specified by the contract.
This final rule adopts the proposed modifications to § 160.402(c). We do not believe that this change will place an undue burden on covered entities and business associates. As we explained in the NPRM, a covered entity's liability for acts of its agents is customary under common law. See 75 FR 40880. Further, section 1128A(l) of the Social Security Act, applicable to HIPAA covered entities and now business associates by section 1176(a)(2) of the Act, states that a principal is liable for civil money penalties for the actions of the principal's agent acting within the scope of agency. Before the changes to § 160.402(c) were finalized in this rule, if a covered entity failed to comply with the business associate provisions in the HIPAA Rules, a covered entity potentially would have been liable for the actions of its business associate agent. Thus, we believe that the notion that a principal is liable for the acts of its agent should not be an unfamiliar concept to covered entities and business associates. However, we appreciate and understand the commenters' concerns and take this opportunity to provide additional guidance.
While section 1128A(l) is silent as to how to define “principal,” “agent,” and “scope of agency,” § 160.402(c) references the Federal common law of agency. As we explained in the Enforcement Rule preamble, 71 FR 8390, 8403-04, adopting the Federal common law to determine the definitions and application of these terms achieves nationwide uniformity in the implementation of the HIPAA Rules. We believe that relying on the Federal common law is particularly important because of HIPAA's express objective of furthering the efficiency and effectiveness of the health care system as a whole. Further, adopting the Federal common law here is consistent with the precept that Federal statutes are meant to have uniform nationwide application. Therefore, we disagree with the comment that argued that Federal common law should not be applied with respect to relationships between covered entities and business associates.
An analysis of whether a business associate is an agent will be fact specific, taking into account the terms of a business associate agreement as well as the totality of the circumstances involved in the ongoing relationship between the parties. The essential factor in determining whether an agency relationship exists between a covered entity and its business associate (or business associate and its subcontractor) is the right or authority of a covered entity to control the business associate's conduct in the course of performing a service on behalf of the covered entity. The right or authority to control the business associate's conduct also is the essential factor in determining whether an agency relationship exists between a business associate and its business associate subcontractor. Accordingly, this guidance applies in the same manner to both covered entities (with regard to their business associates) and business associates (with regard to their subcontractors).
The authority of a covered entity to give interim instructions or directions is the type of control that distinguishes covered entities in agency relationships from those in non-agency relationships. A business associate generally would not be an agent if it enters into a business associate agreement with a covered entity that sets terms and conditions that create contractual obligations between the two parties. Specifically, if the only avenue of control is for a covered entity to amend the terms of the agreement or sue for breach of contract, this generally indicates that a business associate is not acting as an agent. In contrast, a business associate generally would be an agent if it enters into a business associate agreement with a covered entity that granted the covered entity the authority to direct the performance of the service provided by its business associate after the relationship was established. For example, if the terms of a business associate agreement between a covered entity and its business associate stated that “a business associate must make available protected health information in accordance with § 164.524 based on the instructions to be provided by or under the direction of a covered entity,” then this would create an agency relationship between the covered entity and business associate for this activity because the covered entity has a right to give interim instructions and direction during the course of the relationship. An agency relationship also could exist between a covered entity and its business associate if a covered entity contracts out or delegates a particular obligation under the HIPAA Rules to its business associate. As discussed above, whether or not an agency relationship exists in this circumstance again would depend on the right or authority to control the business associate's conduct in the performance of the delegated service based on the right of a covered entity to give interim instructions.
While these principles are well established under the Federal common law of agency, we again note that any analysis regarding scope of agency depends on the facts of each circumstance. Several factors are important to consider in any analysis to determine the scope of agency: (1) The time, place, and purpose of a business associate agent's conduct; (2) whether a business associate agent engaged in a course of conduct subject to a covered entity's control; (3) whether a business associate agent's conduct is commonly done by a business associate to accomplish the service performed on behalf of a covered entity; and (4) whether or not the covered entity reasonably expected that a business associate agent would engage in the conduct in question.
The terms, statements, or labels given to parties (e.g., independent contractor) do not control whether an agency relationship exists. Rather, the manner and method in which a covered entity actually controls the service provided decides the analysis. As mentioned above, an analysis of whether a business associate is an agent will be fact specific and consider the totality of the circumstances involved in the ongoing relationship between the parties. We note here several circumstances that are important. The type of service and skill level required to perform the service are relevant factors in determining whether a business associate is an agent. For example, a business associate that is hired to perform de-identification of protected health information for a small provider would likely not be an agent because the small provider likely would not have the expertise to provide interim instructions regarding this activity to the business associate. Also, an agency relationship would not likely exist when a covered entity is legally or otherwise prevented from performing the service or activity performed by its business associate. For example, the accreditation functions performed by a business associate cannot be performed by a covered entity seeking accreditation because a covered entity cannot perform an accreditation survey or award accreditation. We also note that a business associate can be an agent of a covered entity: (1) Despite the fact that a covered entity does not retain the right or authority to control every aspect of its business associate's activities; (2) even if a covered entity does not exercise the right of control but evidence exists that it holds the authority to exercise that right; and (3) even if a covered entity and its business associate are separated by physical distance (e.g., if a covered entity and business associate are located in different countries).
Comment: One commenter asked whether the Department intends to eliminate the exceptions afforded by the Federal common law of agency. This commenter also argued that if a business associate were an agent of a covered entity, and a HIPAA compliant business associate agreement was in place, any deviation from the terms in the agreement would be by definition outside the scope of agency.
Response: As we discussed above, § 160.402(c) provides that covered entities and business associates are liable for the acts of their business associate agents, in accordance with the Federal common law of agency. Section 160.402(c) is derived from section 1128A(l) of the Social Security Act which states that “a principal is liable for penalties * * * under this section for the actions of the principal's agents acting within the scope of the agency.” Accordingly, § 160.402(c) incorporates the Federal common law of agency, which includes the understanding that for a principal to be liable for the actions of an agent, the agent must be acting within the scope of agency. Thus, the exceptions to the Federal common law of agency (as the commenter identified them) are incorporated in the final rule at § 160.402(c).
We do not agree with the commenter that any deviation from the terms in a business associate contract would be by definition outside the scope of agency. A business associate agent's conduct generally is within the scope of agency when its conduct occurs during the performance of the assigned work or incident to such work, regardless of whether the work was done carelessly, a mistake was made in the performance, or the business associate disregarded a covered entity's specific instruction. For example, a business associate agent would likely be acting within the scope of agency if it impermissibly disclosed more than the minimum necessary information to a health plan for purposes of payment, even if the disclosure is contrary to clear instructions of the covered entity. In contrast, a business associate agent's conduct generally is outside the scope of agency when its conduct is solely for its own benefit (or that of a third party), or pursues a course of conduct not intended to serve any purpose of the covered entity.
Comment: One commenter stated that the proposed change would impose strict liability on covered entities for the actions of third parties not under their control. Another commenter stated that an agent would always fall within the scope of a workforce member, which by definition is not a business associate.
Response: We disagree with both comments and believe that the comments may reflect a misunderstanding of the proposed change. First, as explained above, § 160.402(c) closely tracks the language in section 1128A(l) of the Social Security Act, which is made applicable to HIPAA by section 1176(a)(2) of such Act. It does not make a covered entity or business associate liable for the acts of third parties that are not under its control because such third parties are not its agents. With regard to the second comment, an agent could always fall within the definition of a workforce member because of the direct control requirement in that definition, but the definition of business associate excludes a workforce member. This definitional exclusion allows the covered entity to determine whether, for example, to provide training to the agent under the Privacy Rule. A covered entity would be required to provide training to a workforce member but not to a business associate agent. However, the covered entity is required to enter into a business associate agreement with a business associate agent that it does not treat as a workforce member. The proposed change to § 160.402(c) simply makes the covered entity or business associate liable for the acts of its agents acting within the scope of agency, whether the agents are workforce members or business associates. See the definitions of “business associate” and “workforce member” at § 160.103.
The IFR amended § 160.404 to revise the range of potential civil money penalty amounts a covered entity (or business associate) will be subject to for violations occurring on or after February 18, 2009, as a result of section 13410(d) of the HITECH Act.
Prior to the HITECH Act, section 1176(a) of the Social Security Act authorized the Secretary to impose a civil money penalty of not more than $100 for each violation, with the total amount imposed on a covered entity for all violations of an identical requirement or prohibition during a calendar year not to exceed $25,000. As described above, section 13410(d) of the HITECH Act modified section 1176(a) to establish tiers of increasing penalty amounts for violations based on increasing levels of culpability associated with each tier.
Accordingly, the IFR adopted at § 160.404(b) the new penalty scheme provided for at section 13410(d) of the HITECH Act for violations occurring on or after February 18, 2009. The IFR retained the pre-HITECH maximum penalty amounts of not more than $100 per violation and $25,000 for identical violations during a calendar year, for violations occurring before February 18, 2009.
In adopting the HITECH Act's penalty scheme, the Department recognized that section 13410(d) contained apparently inconsistent language (i.e., its reference to two penalty tiers “for each violation,” each of which provided a penalty amount “for all such violations” of an identical requirement or prohibition in a calendar year). To resolve this inconsistency, with the exception of violations due to willful neglect that are not timely corrected, the IFR adopted a range of penalty amounts between the minimum given in one tier and the maximum given in the second tier for each violation and adopted the amount of $1.5 million as the limit for all violations of an identical provision of the HIPAA rules in a calendar year. For violations due to willful neglect that are not timely corrected, the IFR adopted the penalty amount of $50,000 as the minimum for each violation and $1.5 million for all such violations of an identical requirement or prohibition in a calendar year.
Specifically, the IFR revised § 160.404 to provide, for violations occurring on or after February 18, 2009, the new HITECH penalty scheme, as follows: (1) For violations in which it is established that the covered entity did not know and, by exercising reasonable diligence, would not have known that the covered entity violated a provision, an amount not less than $100 or more than $50,000 for each violation; (2) for a violation in which it is established that the violation was due to reasonable cause and not to willful neglect, an amount not less than $1000 or more than $50,000 for each violation; (3) for a violation in which it is established that the violation was due to willful neglect and was timely corrected, an amount not less than $10,000 or more than $50,000 for each violation; and (4) for a violation in which it is established that the violation was due to willful neglect and was not timely corrected, an amount not less than $50,000 for each violation; except that a penalty for violations of the same requirement or prohibition under any of these categories may not exceed $1,500,000 in a calendar year. See Table 2 below.
Table 2—Categories of Violations and Respective Penalty Amounts Available Back to Top
In applying these amounts, the Department will not impose the maximum penalty amount in all cases but rather will determine the penalty amounts as required by the statute at section 1176(a)(1) and the regulations at § 160.408 (i.e., based on the nature and extent of the violation, the nature and extent of the resulting harm, and the other factors set forth at § 160.408).
Further, for counting violations, the Department continues to utilize the methodology discussed in prior preambles of the Enforcement Rule. See 70 FR 20224, 20233-55 (April 18, 2005) and 71 FR 8390, 8404-07 (February 16, 2006). For violations that began prior to February 18, 2009, and continue after that date, the Department will treat violations occurring before February 18, 2009, as subject to the penalties in effect prior to February 18, 2009, and violations occurring on or after February 18, 2009, as subject to the penalties in effect on or after February 18, 2009.
Most comments on the civil money penalty amounts expressed concern with the new penalty structure set forth in the IFR. A few of these commenters expressed a generalized concern about the potential impact the available penalty amounts might have on covered entities, particularly smaller entities. On