In recent years, our society has come to rely increasingly on medical information to perform basic functions and to make decisions about individuals. However, a number of fundamental developments have threatened the confidentiality of health-care information, and are the cause of a great deal of concern. The emergence of third-party payment plans; the use of health-care information for non-health care purposes; the growing involvement of government agencies in virtually all aspects of health care; and the exponential increase in the use of computers and automated information systems for health record information have combined to put substantial pressure on traditional confidentiality protections. In addition, an increasing number of parties involved in health care treatment, payment, and oversight have routine access to personally identifiable health records. Greater utilization of health-care information coupled with inadequate confidentiality protections has increased the potential for unauthorized uses and disclosures of medical information. The disclosure of personally identifiable health-care information can profoundly affect people's lives. "It affects decisions on whether they are hired or fired; whether they can secure business licenses, and life insurance; whether they are permitted to drive cars; whether they are placed under police surveillance or labeled a security risk; or even whether they can get nominated for and elected to political office." Other secondary uses of health-care information, such as the use of genetic test results for employment and insurance purposes, have the potential to result in harm to the health-care subject if the information is disclosed for unauthorized purposes. These factors accentuate the need for strong legal safeguards. The confidentiality of health-care information is governed by various federal, state, and local statutes, ordinances, regulations, and case law. Also applicable are private accreditation standards, such as those of the Joint Commission on Accreditation of Healthcare Organizations, internal policies of particular institutions, and ethical guidelines of professional organizations. Prior to the issuance of the HIPAA privacy rule, federal laws did not address the confidentiality of health-care information collected and maintained by the private sector ( i.e. , doctors, hospitals, health plans, health insurers, and other health-care related entities). A major impetus for the enactment of HIPAA's privacy requirement was the absence of a comprehensive federal law that protected the confidentiality of patient records in all settings. Another impetus for the enactment of HIPAA was the lack of uniformity among the states in their treatment of the confidentiality of health-care information. There was substantial variation between the states on many aspects of medical records law. These differences are becoming much more critical in the collection, maintenance, and disclosure of health-care information as it is transmitted through interstate commerce amongst patients, physicians, health-care facilities, employers, government agencies, and insurers located in different states and subject to different laws. To address this disparity, HIPAA provides that state law, except for certain specified laws (concerning public health surveillance) and state laws that are more stringent, is preempted by the federal privacy rule. A compendium of state laws issued July 20, 1999 and November 2002 by Georgetown University's Health Privacy Project, "The State of Health Privacy: An Uneven Terrain", identifies medical records privacy provisions from state legislative codes. The report covers only state statutes and divides them by patient access, restrictions on disclosure, privilege, and condition specific requirements. Several comprehensive medical records confidentiality bills were introduced during the past decade, with the end result being passage of the medical privacy requirements as part of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). The Health Insurance Portability and Accountability Act of 1996 (HIPAA), P.L. 104-191 , 42 U.S.C. §§ 1320d et seq. , was created to improve the portability and continuity of health insurance coverage, to combat waste, fraud and abuse in health care, to promote the use of medical savings accounts, to improve access to long term care, and to simplify the administration of health insurance. Sections 261 through 264 of HIPAA are known as the administrative simplification provisions. The general administrative simplification rule requires health care payers and providers who transmit transactions electronically to use standardized data elements to conduct financial and administrative transactions. Section 262 directs HHS to issue standards to facilitate the electronic exchange of information, and to develop standards to protect the security of such information. Section 264 of HIPAA requires HHS to submit to the Congress detailed recommendations on standards with respect to privacy rights for individually identifiable health information. The Secretary made preliminary privacy recommendations to Congress in September 1997, based on the core fair information principles of notice, consent, access, security, and enforcement/redress, to: limit the use of an individual's health care information to health purposes only; require organizations to provide adequate security measures to protect information from misuse or disclosure; provide patients with new rights to control how their health information is used, such as the ability to get copies of records and propose corrections; hold those who misuse personal health information accountable, and provide redress for persons harmed by its misuse through criminal and civil penalties; and balance privacy protections with public responsibility to support national priorities, including public health, research, quality care, and reduction of fraud and abuse, including allowing law enforcement access to personal health information. In the 106 th Congress several proposals to protect health information were considered, but Congress did not pass legislation. None of the bills were reported out of committee, with disagreements over the patient's right to sue, parental notification of minor's access to health care, and preemption precluding agreement. In the absence of the enactment of federal legislation, HIPAA required HHS to issue privacy regulations. The final privacy regulation was published in the Federal Register on December 28, 2000 at 65 Fed. Reg. 82462, shortly before the Clinton Administration left office, and after HHS received over 52,000 comments on its initial proposal. Its original effective date of February 26, 2001 was subsequently changed to April 14, 2001. Enforcement of the rule begins in April 2003, except for small health plans (annual receipts of $5 million or less) who have until 2004 to comply. The medical privacy rule prohibits covered entities from disclosing protected health information to any third parties, unless the rules otherwise permit the disclosure. Applicability. The rule covers health plans, health care providers, and health care clearinghouses (entities that process or facilitate the processing of nonstandard data elements of health information into standard data elements). It only covers information that is electronically transmitted or maintained. It covers protected health information in any form, whether oral, written or electronic. Individual Rights. Individuals are given a right of access to their health information, a right to receive notice of the covered entity's privacy policies, a right to request amendments of their information, a right to an accounting of the disclosures made, and a right to file complaints regarding use or disclosure of their information. Individuals may request that restrictions be placed on the disclosure of their health information. Permitted Uses and Disclosures With Consent or Authorization. The use of protected health information for treatment, payment, or health care operations (a provider's or health plan's management and other activities necessary for support of treatment or payment) requires the prior written consent of a patient. Disclosures for purposes other than treatment, payment, and health care operations require a prior written authorization. Permitted Uses and Disclosures Without Consent or Authorization. Certain public priority uses and disclosures of information do not require prior written consent or authorization (such as health system oversight, public health activities, certain research activities, law enforcement, judicial and administrative proceedings, emergency treatment, and imminent threats to the health or safety of any person). Covered entities are permitted to disclose information to law enforcement for purposes of health care oversight (i.e., investigations of health care fraud, government program fraud, and civil rights investigations), for general law enforcement investigations (i.e., in response to grand jury subpoenas and court orders), to avert a serious threat to health and safety, to coroners and medical examiners, for investigations involving abuse, neglect, or domestic violence. Information Practices. Disclosures of protected health information other than for treatment purposes must use only the "minimum necessary" information. Covered entities must enter into contracts with "business associates" requiring them to protect individual health information, and must take action if they know of practices by their business associates that violate the contractual agreement. Covered entities must adhere to specific procedures in using information for fundraising or marketing. There are special requirements that apply to both federal and privately funded research. Psychotherapy notes may not be used or disclosed to others without explicit authorization. Preemption. State law, except for certain specified laws (concerning public health surveillance) and state laws that are more stringent, is preempted by the federal rule. Enforcement. The Secretary, covered entities, and others are required to ascertain compliance with, and enforcement of the privacy regulation. Any person may file a complaint with the HHS Office for Civil Rights. In cases of noncompliance, the Secretary is directed to resolve the matter by informal means. If the matter cannot be resolved informally, the Secretary may issue written findings of non-compliance that may be used as a basis for initiating action (civil monetary penalties) or a criminal referral. Penalties. Violators will be subject to civil monetary penalties ($100 per violation up to $25,000 per year), and criminal penalties (up to $250,000 and imprisonment up to 10 years) against covered entities that knowingly and improperly disclose identifiable health information. The regulation does not authorize patients to sue. Instead, the law provides that individuals must direct their complaints to HHS' Office for Civil Rights (OCR). OCR maintains a Web site with information on the new regulation, including guidance at http://www.hhs.gov/ocr/hipaa/ . HHS also recently issued a 20 page "Summary of the HIPAA Privacy Rule."