In order to "improve portability and continuity of health insurance coverage in the group and individual markets," Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA) on August 21, 1996, P.L. 104-191 , 110 Stat. 1936, 42 U.S.C. §§ 1320d et seq. Subtitle F of Title II of HIPAA is entitled "Administrative Simplification," and states that the purpose of the subtitle is to improve health care by "encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." Sections 261 through 264 of HIPAA contain the administrative simplification provisions. HIPAA requires health care payers and providers who transmit transactions electronically to use standardized data elements to conduct financial and administrative transactions. Section 262 directs HHS to issue standards to facilitate the electronic exchange of information. Section 263 of HIPAA delineates the duties of the National Committee on Vital and Health Statistics. Section 264 of HIPAA requires HHS to submit to the Congress detailed recommendations on standards with respect to privacy rights for individually identifiable health information. In the absence of the enactment of federal legislation, HIPAA required HHS to issue privacy regulations. The final Privacy Rule was issued by HHS and published in the Federal Register on December 28, 2000 at 65 Fed. Reg. 82462, shortly before the Clinton Administration left office. The Privacy Rule went into effect on April 14, 2001. On August 14, 2002, HHS published in the Federal Register a modified Privacy Rule, 67 Fed. Reg. 53181. Enforcement of the Privacy Rule began on April 14, 2003, except for small health plans (those with annual receipts of $5 million or less) who have until April 2004 to comply. The HIPAA Privacy Rule covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions electronically. Covered entities are bound by the new privacy standards even if they contract with others (called "business associates") to perform essential functions. HIPAA does not give HHS authority to regulate other private businesses or public agencies. Covered entities that fail to comply with the rule are subject to civil and criminal penalties, but individuals do not have the right to sue for violations of the rule. Instead, the law provides that individuals must direct their complaints to HHS' Office for Civil Rights (OCR). OCR maintains a Web site with information on the new regulation, including guidance at http://www.hhs.gov/ocr/hipaa/ . HHS also recently issued a 20 page "Summary of the HIPAA Privacy Rule." HHS will enforce the civil money penalties, and the Department of Justice will enforce the criminal penalties. Criminal penalties may be imposed if the offense is committed under false pretenses, with intent to sell the information or reap other personal gain. HIPAA authorizes the HHS Secretary to impose civil money penalties of up to $25,000 for each year for those entities failing to comply with the privacy rule. Several statutory limitations are imposed on the Secretary's authority to impose civil money penalties (CMP). A penalty may not be imposed: with respect to an act that constitutes an offense punishable under the criminal penalty provision; "if it is established to the satisfaction of the Secretary that the person liable for the penalty did not know, and by exercising reasonable diligence would not have known, that such person violated the provisions;" if "the failure to comply was due to reasonable cause and not to willful neglect" and is corrected within a certain time period. A CMP may be reduced or waived "to the extent that the payment of such penalty would be excessive relative to the compliance failure involved." In addition, a number of procedural requirements are incorporated by reference in HIPAA that are relevant to the imposition of CMP's. The Secretary may not initiate a CMP action "later than six months after the date" of the occurrence that forms the basis for the CMP action. The Secretary may initiate a CMP by serving notice in a manner authorized by Rule 4 of the Federal Rules of Civil Procedure. The Secretary must give written notice to the person to whom he wishes to impose a CMP and an opportunity for a determination to made "on the record after a hearing at which the person is entitled to be represented by counsel, to present witnesses, and to cross-examine witnesses against the person." Judicial review of the Secretary's determination and the issuance and enforcement of subpoenas is available in the United States Court of Appeals. With respect to ascertaining compliance with and enforcement of the Privacy Rule, the Secretary of HHS is to seek the voluntary cooperation of covered entities. The Secretary is authorized to provide technical assistance to covered entities in order to facilitate their voluntary compliance. Enforcement and other activities to facilitate compliance include the provision of technical assistance; responding to questions; providing interpretations and guidance; responding to state requests for preemption determinations; investigating complaints and conducting compliance reviews; and seeking civil monetary penalties and making referrals for criminal prosecution. An individual may file a compliant with the Secretary if the individual believes that the covered entity is not complying with the rule. Complaints must be filed in writing, either on paper or electronically; name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the Privacy Rule; and be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless the time limit is waived by the Secretary for good cause shown. Complaints to the Secretary may be filed only with respect to alleged violations occurring on or after April 14, 2003. The Secretary has delegated to the Office for Civil Rights (OCR) the authority to receive and investigate complaints as they may relate to the Privacy Rule. Individuals may file written complaints with OCR by mail, fax or e-mail. For information about the Privacy Rule or the process for filing a complaint with OCR, they may contact any OCR office or go to http://www.hhs.gov/ocr/howtofileprivacy.htm . After April 14, 2003, individuals have a right to file a complaint directly with the covered entity, and are directed to refer to the covered entity's notice of privacy practices for information about how to file a complaint. The Secretary's investigation may include a review of the policies, procedures, or practices of the covered entity, and of the circumstances regarding the alleged acts or omissions. The Secretary is also authorized to conduct compliance reviews. Covered entities are required to provide records and compliance reports to the Secretary to determine compliance; and to cooperate with complaint investigations and compliance reviews. In cases where an investigation or compliance review has indicated noncompliance, the Secretary is to inform the covered entity and the complainant in writing, and attempt to resolve the matter informally. If the Secretary determines that the matter cannot be resolved informally, the Secretary may issue written findings documenting the noncompliance. In cases where no violation is found, the Secretary is to inform the covered entity and the complainant in writing. On April 17, 2003 HHS published an interim final "Enforcement Rule" that applies to standards, including the Privacy Rule, adopted under the Administrative Simplification provisions of HIPAA, 68 Fed. Reg. 18895. The interim final rule establishes procedures for investigations, imposition of penalties, and hearings for civil money penalties; and is effective May 19, 2003 thru September 16, 2003. It is to be revised when HHS issues a complete Enforcement rule that will include procedural and substantive requirements for the imposition of civil money penalties, such as HHS' policies for determining violations and calculating CMP's. Although HHS recognized that the Administrative Procedure Act (APA) requires that most of the provisions of the complete Enforcement Rule be promulgated through notice-and-comment rulemaking, it concluded that the interim final rule's procedural provisions are exempted from the requirement for notice and comment rulemaking under the "rules of agency . . . procedure, or practice" exemption of the APA, 5 U.S.C. § 553(b)(3)(A). As a result, HHS published the procedural rules in final form without notice-and-comment to inform covered entities and the public of the procedural requirements for compliance. In addition, HHS requests public comment thru June 16, 2003 on the interim final rule. The National Committee on Vital and Health Statistics (NCVHS) serves as the statutory public advisory body to the Secretary of Health and Human Services in the area of health data and statistics. As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Administrative Simplification provisions of HIPAA, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule). Last fall, the NCVHS held three hearings to learn about the implementation activities of covered entities. In its November 2002 letter to Secretary Thompson summarizing its findings the Committee stated that "there is an extremely high level of confusion, misunderstanding, frustration, anxiety, fear, and anger as the April 14, 2003 compliance date nears." Reportedly the Privacy Rule has "touched off a quiet revolution in the health care industry." According to NCVHS, the OCR is widely viewed as not providing adequate guidance and technical assistance as evidenced by the lack of model notices of privacy practices, acknowledgments, authorizations, and other forms. The general guidance was judged to be of limited value because of special industry or professional circumstances, and NCVHS reported that witnesses conveyed a great sense of frustration that they could not obtain clarification from OCR or answers to the questions they submitted.