streamline the flow of information integral to the operation of the health care system while protecting confidential health information from inappropriate access, disclosure, and use. HIPAA required the Secretary of HHS to submit recommendations to the Congress on privacy standards, addressing (1) the rights of the individual who is the subject of the information; (2) procedures for exercising such rights; and (3) authorized and required uses and disclosures of such information. HIPAA further directed that if legislation governing these privacy standards was not enacted within 3 years of the enactment of HIPAA—by August 21, 1999—the Secretary should issue regulations on the matter. HHS submitted recommendations to Congress on September 11, 1997, and when legislation was not enacted by the deadline, issued a draft regulation on November 3, 1999. After receiving over 52,000 comments on the proposed regulation, HHS issued a final regulation on December 28, 2000. Two key provisions in HIPAA defined the framework within which HHS developed the privacy regulation. HIPAA specifically applies the administrative simplification standards to health plans, health care clearinghouses (entities that facilitate the flow of information between providers and payers), and health care providers that maintain and transmit health information electronically. HHS lacks the authority under HIPAA to directly regulate the actions of other entities that have access to personal health information, such as pharmacy benefit management companies acting on behalf of managed care networks. HIPAA does not allow HHS to preempt state privacy laws that are more protective of health information privacy. Also, state laws concerning public health surveillance (such as monitoring the spread of infectious diseases) may not be preempted. HIPAA does not impose limits on the type of health care information to which federal privacy protection would apply. At the time the proposed regulation was issued, HHS sought to protect only health data that had been stored or transmitted electronically, but it asserted its legal authority to cover all personal health care data if it chose to do so. HHS adopted this position in the final regulation and extended privacy protection to personal health information in whatever forms it is stored or exchanged— electronic, written, or oral. The new regulation establishes a minimum level of privacy protection for individually identifiable health information that is applicable nationwide. When it takes full effect, patients will enjoy new privacy rights, and providers, plans, researchers, and others will have new responsibilities.Most groups have until February 26, 2003, to come into compliance with the new regulation, while small health plans were given an additional year. The regulation protecting personal health information provides patients with a common set of rights regarding access to and use of their medical records. For the first time, these rights will apply to all Americans, regardless of the state in which they live or work. Specifically, the regulation provides patients the following: Access to their medical records. Patients will be able to view and copy their information, request that their records be amended, and obtain a history of authorized disclosures. Restrictions on disclosure. Patients may request that restrictions be placed on the disclosure of their health information. (Providers may choose not to accept such requests.) Psychotherapy notes may not be used by, or disclosed to, others without explicit authorization. Education. Patients will receive a written notice of their providers’ and payers’ privacy procedures, including an explanation of patients’ rights and anticipated uses and disclosures of their health information. Remedies. Patients will be able to file a complaint with the HHS Office for Civil Rights (OCR) that a user of their personal health information has not complied with the privacy requirements. Violators will be subject to civil and criminal penalties established under HIPAA. Providers, health plans, and clearinghouses—referred to as covered entities—must meet new requirements and follow various procedures, as follows: Develop policies and procedures for protecting patient privacy. Among other requirements, a covered entity must designate a privacy official, train its employees on the entity’s privacy policies, and develop procedures to receive and address complaints. Obtain patients’ written consent or authorization. Providers directly treating patients must obtain written consent to use or disclose protected health information to carry out routine health care functions. Routine uses include nonemergency treatment, payment, and an entity’s own health care operations. In addition, providers, health plans, and clearinghouses must obtain separate written authorization from the patient to use or disclose information for nonroutine purposes, such as releasing information to lending institutions or life insurers. without explicit authorization from the individual. Furthermore, where staff administering the group health plan work in the same office as staff making hiring and promotion decisions, access to personal health information must be limited to those employees who perform health plan administrative functions. The regulation sets out special requirements for use of personal health information that apply to both federal and privately funded research: Researchers may use and disclose health information without authorization if it does not identify an individual. Information is presumed to be de-identified by removing or concealing all individually identifiable data, including name, addresses, phone numbers, Social Security numbers, health plan beneficiary numbers, dates indicative of age, and other unique identifiers specified in the regulation. Researchers who seek personal health information from covered entities will have two options. They can either obtain patient authorization or obtain a waiver from such authorization by having their research protocol reviewed and approved by an independent body—an institutional review board (IRB) or privacy board. In its review, the independent body must determine that the use of personal health information will not adversely affect the rights or welfare of the individuals involved, and that the benefit of the research is expected to outweigh the risks to the individuals’ privacy. HHS and others within the federal government will have a number of specific responsibilities to perform under the regulations. Although it no longer falls to the states to regulate the privacy of health information, states will still be able to enact more stringent laws. Federal and state public officials may obtain, without patient authorization, personal health information for public health surveillance; abuse, neglect, or domestic violence investigations; health care fraud investigations; and other oversight and law enforcement activities. HHS’ OCR has broad authority to administer the regulation and provide guidance on its implementation. It will decide when to investigate complaints that a covered entity is not complying and perform other enforcement functions directly related to the regulations. HIPAA gives HHS authority to impose civil monetary penalties ($100 per violation up to $25,000 per year) against covered entities for disclosures made in error. It may also make referrals for criminal penalties (for amounts of up to $250,000 and imprisonment for up to 10 years) against covered entities that knowingly and improperly disclose identifiable health information. Among the stakeholder groups we interviewed, there was consensus that HHS had effectively taken into account many of the views expressed during the comment period. Most organizations also agreed that the final regulation improved many provisions published in the proposed regulation. At the same time, many groups voiced concerns about the merit, clarity, and practicality of certain requirements. Overall, considerable uncertainty remains regarding the actions needed to comply with the new privacy requirements. Although the regulation, by definition, is prescriptive, it includes substantial flexibility. For example, in announcing the release of the regulation, HHS noted that “the regulation establishes the privacy safeguard standards that covered entities must meet, but it leaves detailed policies and procedures for meeting these standards to the discretion of each covered entity.” Among the stakeholder groups we interviewed, the topics of concern centered on conditions for consent, authorization, and disclosures; rules pertaining to the business associates of covered entities; limited preemption of state laws; the costs of implementation; and HHS’ capacity to provide technical assistance. in the first place. Another representative commented that public confidence in the protection of their medical information could be eroded as a result of the marketing provisions. One representative also concluded that allowing patients the opportunity to opt out in advance of all marketing contacts would better reflect the public’s chief concern in this area. HHS officials told us that this option exists under the provision granting patients the right to request restrictions on certain disclosures but that providers are not required to accept such patient requests. Several organizations questioned whether the scope of the consent provision was sufficient. For example, American Medical Association (AMA) representatives supported the requirement that providers obtain patient consent to disclose personal health information for all routine uses, but questioned why the requirement did not apply to health plans. Plans use identifiable patient information for quality assurance, quality improvement projects, utilization management, and a variety of other purposes. The association underscored its position that consent should be obtained before personal health information is used for any purpose and that the exclusion of health plans was a significant gap in the protection of this information. AMA suggested that health plans could obtain consent as part of their enrollment processes. The American Association of Health Plans (AAHP) also expressed concerns about the scope of consent, but from a different perspective. AAHP officials believe that the regulation may limit the ability of the plans to obtain the patient data necessary to conduct health care operations if providers’ patient consent agreements are drawn too narrowly to allow such data sharing. They suggested two ways to address this potential problem. First, if the health plans and network providers considered themselves an “organized health care arrangement,” access to the information plans needed could be covered in the consent providers obtained from their patients. Second, plans could include language in their contracts with physicians that would ensure access to patients’ medical record information. pharmacies could obtain written consent prior to treatment—that is, filling a prescription for the first time. The American Health Information Management Association (AHIMA) similarly noted the timing issue for hospitals with respect to getting background medical information from a patient prior to admission. HHS officials told us that they believe the regulation contains sufficient flexibility for providers to develop procedures necessary to address these and similar situations. Research organizations focused on the feasibility of requirements for researchers to obtain identifiable health information. The regulation requires them to obtain patient authorization unless an independent panel reviewing the research waives the authorization requirement.