[Federal Register: March 27, 2002 (Volume 67, Number 59)]

[Proposed Rules]

[Page 14775-14815]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr27mr02-22]

[[Page 14775]]

-----------------------------------------------------------------------

Part II

Department of Health and Human Services

-----------------------------------------------------------------------

45 CFR Parts 160 and 164

Office of the Secretary; Standards for Privacy of Individually

Identifiable Health Information; Proposed Rule

[[Page 14776]]

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0991-AB14

Standards for Privacy of Individually Identifiable Health

Information

AGENCY: Office for Civil Rights, HHS.

ACTION: Proposed rule; modification.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS) proposes to

modify certain standards in the Rule entitled ``Standards for Privacy

of Individually Identifiable Health Information'' (the ``Privacy

Rule''). The Privacy Rule implements the privacy requirements of the

Administrative Simplification subtitle of the Health Insurance

Portability and Accountability Act of 1996.

The purpose of this action is to propose changes that maintain

strong protections for the privacy of individually identifiable health

information while clarifying misinterpretations, addressing the

unintended negative effects of the Privacy Rule on health care quality

or access to health care, and relieving unintended administrative

burden created by the Privacy Rule.

DATES: To assure consideration, written comments mailed to the

Department as provided below must be postmarked no later than April 26,

2002, and written comments hand delivered to the Department and

comments submitted electronically must be received as provided below,

no later than 5 p.m. on April 26, 2002.

ADDRESSES: Comments will be considered only if provided through any of

the following means:

1. Mail written comments (1 original and, if possible, 3 copies and

a floppy disk) to the following address: U.S. Department of Health and

Human Services, Office for Civil Rights, Attention: Privacy 2, Hubert

H. Humphrey Building, Room 425A, 200 Independence Avenue, SW.,

Washington, DC 20201.

2. Deliver written comments (1 original and, if possible, 3 copies

and a floppy disk) to the following address: Attention: Privacy 2,

Hubert H. Humphrey Building, Room 425A, 200 Independence Avenue, SW.,

Washington, DC 20201.

3. Submit electronic comments at the following Web site: http://

www.hhs.gov/ocr/hipaa/.

See the SUPPLEMENTARY INFORMATION section for further information

on comment procedures, availability of copies, and electronic access.

FOR FURTHER INFORMATION CONTACT: Felicia Farmer 1-866-OCR-PRIV (1-
866-

627-7748) or TTY 1-866-788-4989.

SUPPLEMENTARY INFORMATION: Comment procedures, availability of copies,

and electronic access.

Comment Procedures: All comments should include the full name,

address, and telephone number of the sender or a knowledgeable point of

contact. Comments should address only those sections of the Privacy

Rule for which modifications are being proposed or for which comments

are requested. Comments on other sections of the Privacy Rule will not

be considered, except insofar as they pertain to the standards for

which modifications are proposed or for which comments are requested.

Each specific comment should specify the section of the Privacy Rule to

which it pertains.

Written comments should include 1 original and, if possible, 3

copies and an electronic version of the comments on a 3\1/2\ inch DOS

format floppy disk in HTML, ASCII text, or popular word processor

format (Microsoft Word, Corel WordPerfect). All comments and content

must be limited to the 8.5 inches wide by 11.0 inches high vertical

(also referred to as ``portrait'') page orientation. Additionally, if

identical/duplicate comment submissions are submitted both

electronically at the specified Web site and in paper form, the

Department requests that each submission clearly indicate that it is a

duplicate submission.

Because of staffing and resource limitations, the Department will

not accept comments by telephone or facsimile (FAX) transmission. Any

comments received through such media will be deleted or destroyed, as

appropriate, and not be considered as public comments. The Department

will accept electronic comments only as submitted through the Web site

identified in the ADDRESSES section above. No other form of electronic

mail will be accepted or considered as public comment. In addition,

when mailing written comments, the public is encouraged to submit

comments as early as possible due to potential delays in mail service.

Inspection of Public Comments: Comments that are timely received in

proper form and at one of the addresses specified above will be

available for public inspection by appointment as they are received,

generally beginning approximately three weeks after publication of this

document, at 200 Independence Avenue, SW., Washington, DC on Monday

through Friday of each week from 9 a.m. to 4 p.m. Appointments may be

made by telephoning 1-866-OCR-PRIV (1-866-627-7748) or TTY 1-866-788-

4989.

Copies: To order copies of the Federal Register containing this

document, send your request to: New Orders, Superintendent of

Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date

of the issue requested and enclose a check or money order payable to

the Superintendent of Documents, or enclose your Visa or Master Card

number and expiration date. Credit card orders can also be placed by

calling the order desk at (202) 512-1800 (or toll-free at 1-866-512-

1800) or by fax to (202) 512-2250. The cost for each copy is $10.00.

Alternatively, you may view and photocopy the Federal Register document

at most libraries designated as Federal Depository Libraries and at

many other public and academic libraries throughout the country that

receive the Federal Register.

Electronic Access: This document is available electronically at the

OCR Privacy Web site at

http://www.hhs.gov/ocr/hipaa/, as well as at the Web site of the

Government Printing Office at http://www.access.gpo.gov/su_docs/aces/

aces140.html.

I. Background

A. Statutory Background

Congress recognized the importance of protecting the privacy of

health information given the rapid evolution of health information

systems in the Health Insurance Portability and Accountability Act of

1996 (HIPAA), Public Law 104-191, which became law on August 21, 1996.

HIPAA's Administrative Simplification provisions, sections 261 through

264 of the statute, were designed to improve the efficiency and

effectiveness of the health care system by facilitating the electronic

exchange of information with respect to financial and administrative

transactions carried out by health plans, health care clearinghouses,

and health care providers who transmit information electronically in

connection with such transactions. To implement these provisions, the

statute directed HHS to adopt a suite of uniform, national standards

for transactions, unique health identifiers, code sets for the data

elements of the transactions, security of health information, and

electronic signature.

At the same time, Congress recognized the challenges to the

[[Page 14777]]

confidentiality of health information presented by the increasing

complexity of the health care industry, and by advances in the health

information systems technology and communications. Thus, the

Administrative Simplification provisions of HIPAA authorized the

Secretary to promulgate regulations on standards for the privacy of

individually identifiable health information if Congress did not enact

health care privacy legislation by August 21, 1999. HIPAA also required

the Secretary of HHS to provide Congress with recommendations for

protecting the confidentiality of health care information. The

Secretary submitted such recommendations to Congress on September 11,

1997, but Congress was unable to act within its self-imposed deadline.

With respect to these regulations, HIPAA provided that the

standards, implementation specifications, and requirements established

by the Secretary not supersede any contrary State law that imposes more

stringent privacy protections. Additionally, Congress required that HHS

consult with the National Committee on Vital and Health Statistics, a

Federal Advisory committee established pursuant to section 306(k) of

the Public Health Service Act (42 U.S.C. 242k(k)), and the Attorney

General in the development of HIPAA privacy standards.

After a set of standards is adopted by the Department, HIPAA

provides HHS with authority to modify the standards as deemed

appropriate, but not more frequently than once every 12 months.

However, modifications are permitted during the first year after

adoption of the standard if the changes are necessary to permit

compliance with the standard. HIPAA also provides that compliance with

modifications to standards or implementation specifications must be

accomplished by a date designated by the Secretary, which may not be

earlier than 180 days from the adoption of the modification.

B. Regulatory and Other Actions to Date

As Congress did not enact legislation regarding the privacy of

individually identifiable health information prior to August 21, 1999,

HHS published a proposed Rule setting forth such standards on November

3, 1999 (64 FR 59918). The Department received more than 52,000 public

comments in response to the proposal. After reviewing and considering

the public comments, HHS issued a final Rule (65 FR 82462) on December

28, 2000, establishing ``Standards for Privacy of Individually

Identifiable Health Information'' (``Privacy Rule'').

In an era where consumers are increasingly concerned about the

privacy of their personal information, the Privacy Rule creates for the

first time national protections for the privacy of their most sensitive

information--health information. Congress has passed other laws to

protect consumer's personal information contained in bank, credit card,

other financial records, and even video rentals. These health privacy

protections are intended to provide consumers with similar assurances

that their health information, including genetic information, will be

properly protected. Under the Privacy Rule, health plans, health care

clearinghouses, and certain health care providers must guard against

misuse of individuals' identifiable health information and limit the

sharing of such information, and consumers are afforded significant new

rights to understand and control how their health information is used

and disclosed.

After publication of the Privacy Rule, HHS received many inquiries

and unsolicited comments through telephone calls, e-mails, letters, and

other contacts about the impact and operation of the Privacy Rule on

numerous sectors of the health care industry. Many of these commenters

exhibited substantial confusion over how the Privacy Rule will operate;

others expressed great concern over the complexity of the Privacy Rule.

In response to these communications and to ensure that the provisions

of the Privacy Rule would protect patients' privacy without creating

unanticipated consequences that might harm patients' access to health

care or quality of health care, the Secretary of HHS requested comment

on the Privacy Rule in March 2001 (66 FR 12738). After an expedited

review of the comments by the Department, the Secretary decided that it

was appropriate for the Privacy Rule to become effective on April 14,

2001, as scheduled (65 FR 12433). At the same time, the Secretary

directed the Department immediately to begin the process of developing

guidelines on how the Privacy Rule should be implemented and to clarify

the impact of the Privacy Rule on health care activities. In addition,

the Secretary charged the Department with proposing appropriate changes

to the Privacy Rule during the next year to clarify the requirements

and correct potential problems that could threaten access to, or

quality of, health care. The comments received during the comment

period, as well as other communications from the public and all sectors

of the health care industry, including letters, testimony at public

hearings, and meetings requested by these parties, have helped to

inform the Department's efforts to develop proposed modifications and

guidance on the Privacy Rule.

On July 6, 2001, the Department issued its first guidance to answer

common questions and clarify certain of the Privacy Rule's provisions.

In the guidance, the Department also committed to proposing

modifications to the Privacy Rule to address problems arising from

unintended effects of the Privacy Rule on health care delivery and

access. The guidance is available on the HHS Office for Civil Rights

(OCR) Privacy Web site at http://www.hhs.gov/ocr/hipaa/.

II. Overview of the Proposed Rule

As described above, through public comments, testimony at public

hearings, meetings at the request of industry and other stakeholders,

as well as other communications, the Department learned of a number of

concerns about the potential unintended effect certain provisions would

have on health care delivery and access. In response to these concerns,

and pursuant to HIPAA's provisions for modifications to the standards,

the Department is proposing modifications to the Privacy Rule.

In addition, the National Committee for Vital and Health Statistics

(NCVHS), Subcommittee on Privacy and Confidentiality, held public

hearings on the implementation of the Privacy Rule on August 21-23,

2001, and January 24-25, 2002, and provided recommendations to the

Department based on these hearings. The NCVHS serves as the statutory

advisory body to the Secretary of HHS with respect to the development

and implementation of the Rules required by the Administrative

Simplification provisions of HIPAA, including the privacy standards.

Through the hearings, the NCVHS specifically solicited public input on

issues related to certain key standards in the Privacy Rule: consent,

minimum necessary, marketing, fundraising, and research. The resultant

public testimony and subsequent recommendations submitted to the

Department by the NCVHS also served to inform the development of these

proposed modifications.

Based on the information received through the various sources

described above, the Department proposes to modify the following areas

or provisions of the Privacy Rule: consent, including other provisions

for uses and disclosures of protected health information for treatment,

payment, and health care operations; notice of privacy

[[Page 14778]]

practices for protected health information; minimum necessary uses and

disclosures, and oral communications; business associates; uses and

disclosures for marketing; parents as the personal representatives of

unemancipated minors; uses and disclosures for research purposes; uses

and disclosures of protected health information for which

authorizations are required; and de-identification of protected health

information. In addition to these key areas, the proposal includes

changes to certain other provisions where necessary to clarify the

Privacy Rule. The Department also includes in the proposed Rule a list

of technical corrections intended as editorial or typographical

corrections to the Privacy Rule.

The proposed modifications collectively are designed to ensure that

protections for patient privacy are implemented in a manner that

maximizes the effectiveness of such protections while not compromising

either the availability or the quality of medical care. They reflect a

continuing commitment on the part of the Department to strong privacy

protections for medical records and the belief that privacy is most

effectively protected by requirements that are not exceptionally

difficult to implement. If there are any ways in which privacy

protections are unduly compromised by these modifications, the

Department welcomes comments and suggestions for alternative ways

effectively to protect patient privacy without adversely affecting

access to, or the quality of, health care.

Given that the compliance date of the Privacy Rule for most covered

entities is April 14, 2003, and statutory requirements to ensure that

affected parties have sufficient time to come into compliance require

any revisions to become effective by October 13, 2002, the Department

is soliciting public comment on these proposed modifications for only

30 days. As stated above, the modifications address public concerns

already communicated to the Department through a wide variety of

sources since publication of the Privacy Rule in December 2000. For

these reasons, the Department believes that 30 days should be

sufficient for the public to state its views fully to the Department on

the proposed modifications to the Privacy Rule.

III. Description of Proposed Modifications

A. Uses and Disclosures for Treatment, Payment, and Health Care

Operations

1. Consent

Treatment and payment for health care are core functions of the

health care industry, and uses and disclosures of individually

identifiable health information for such purposes are critical to the

effective operation of the health care system. Health care providers

and health plans must also use individually identifiable health

information for certain health care operations, such as administrative,

financial, and legal activities, to run their businesses, and to

support the essential health care functions of treatment and payment.

Equally important are health care operations designed to maintain and

improve the quality of health care. In developing the Privacy Rule, the

Department considered the privacy implications of uses and disclosures

for treatment, payment, and health care operations in connection with

the need for these activities to continue. In balancing the need for

these activities and the privacy interests involved in using and

disclosing protected health information for these purposes, the

Department considered the fact that many individuals expect that their

health information will be used and disclosed as necessary to treat

them, bill for treatment, and, to some extent, operate the covered

entity's health care business. Due to individual expectations with

respect to the use or disclosure of information for such activities and

so as not to interfere with an individual's access to quality health

care or efficient payment for such health care, the Department's goal

is to permit these activities to occur with little or no restriction.

Consistent with this view, the Privacy Rule generally provides

covered entities with permission to use and disclose protected health

information as necessary for treatment, payment, and health care

operations. For certain health care providers that have a direct

treatment relationship with individuals, such as many physicians,

hospitals, and pharmacies, the Privacy Rule requires such providers to

obtain an individual's written consent prior to using or disclosing

protected health information for these purposes.

To implement the consent standard, the Privacy Rule requires a

covered health care provider with a direct treatment relationship with

the individual to obtain a single, one-time, general permission from

the individual prior to using or disclosing protected health

information about him or her for treatment, payment, and health care

operations. An individual may revoke his or her consent at any time,

except to the extent that the covered entity has taken action in

reliance on the consent. The Privacy Rule contains exceptions to the

consent requirements, under which a provider may use or disclose

protected health information without prior consent when there is an

emergency treatment situation, when a provider is required by law to

treat the individual, or when there are substantial communication

barriers. Additionally, because the Department realizes that a health

care provider cannot treat a patient without being able to use and

disclose his or her protected health information for treatment

purposes, the Privacy Rule permits a covered health care provider to

refuse to treat a patient who refuses to provide consent. Finally, the

Privacy Rule permits other covered entities to voluntarily obtain

consent, in accordance with these consent provisions.

The consent requirement for health care providers with direct

treatment relationships was a significant change from the Department's

initial proposal published in November 1999. At that time, the

Department proposed to permit all covered entities to use and disclose

protected health information to carry out treatment, payment, and

health care operations without any requirement that the covered

entities obtain an individual's consent for such uses and disclosures,

subject to a few limited exceptions. Further, the Department had

proposed to prohibit covered entities from obtaining an individual's

consent for uses and disclosures of protected health information for

these purposes, unless required by other applicable law. Instead, the

Department relied on the principle of fair notice, coupled with

regulatory limits on the use and disclosure of health information, to

balance the individual's privacy interests against the need not to

impede the delivery of quality health care. Providing individuals with

fair notice about the information practices and responsibilities of

their plans and providers, and their rights with respect to information

about them, is a privacy principle as important as the principle of

consent. Indeed, consents often provide individuals with little actual

control over information. When an individual is required to sign a

blanket consent at the point of treatment as a condition of treatment

or payment, that

[[Page 14779]]

consent is often not voluntary. Instead, therefore, the Department

proposed to require most covered entities to create and provide to

individuals a notice describing all of the entity's information

practices, including their practices with respect to uses and

disclosures of protected health information to carry out treatment,

payment, and health care operations.

The Department received a strong public response opposing this

proposal. Health care providers and patients argued that consent

provides individuals with a sense of control over how their information

will be used and disclosed, is a current practice of many health care

providers, and is expected by patients. Providers explained that they

would face an ethical conflict from a prohibition on obtaining consent.

The consent requirement for direct treatment providers was a direct

response to these comments.

Public Comments

The Department received many comments in March 2001, as well as

recommendations from the NCVHS based on public testimony, about the

consent provisions in the Privacy Rule. There were some proponents of

consent that urged the Department to retain, expand, or strengthen the

consent provisions. There were also many opponents of consent that

raised a number of issues and serious concerns that the consent

requirements will impede access to, and the delivery of, quality health

care. Most significantly, many covered entities described an array of

circumstances when they need to use or disclose protected health

information for treatment, payment, or health care operations purposes

prior to the initial face-to-face contact with the patient, and

therefore, prior to obtaining consent.

Consistent with the comments that the Department received after the

initial notice of proposed rulemaking (NPRM), proponents of the consent

requirement argued that consent is integral to providing individuals

the opportunity to be active participants in their own health care and

can bolster patient trust in providers. One of the most significant

values that proponents placed on consent was that it defines an

``initial moment'' when patients can focus on information practices and

raise questions about privacy concerns. Some proponents recommended

that the consent requirement be extended to health plans because these

entities may not have the same duty and legal obligation as health care

providers to maintain confidentiality.

Others urged the Department to strengthen consent by eliminating

the ability of providers to condition treatment on the receipt of

consent. There were also some commenters that thought that consent

should be required more frequently. They claimed that the consent

provisions will be ineffective to provide individuals with control over

how their information will be used or disclosed because it is general

and only must be obtained one time. They argued that an individual may

have differing degrees of concern about the privacy of health

information, depending on the nature of the information raised in the

particular encounter with the provider, and that an initial, one-time

consent cannot account for such variation.

At the same time, most covered entities were concerned about

significant practical problems that resulted from the consent

requirements in the Privacy Rule. Commenters raised numerous examples

of obstacles that the prior consent provisions will pose to timely

access to health care. Health care providers commented that they often

use health information about an individual for necessary treatment,

payment, and health care operations activities prior to the first face-

to-face contact with the individual. Under the Privacy Rule, these

routine and often essential activities are not permitted unless the

provider first obtains consent from the individual. Although the

consent only needs to be obtained one time, there may be problems for

new patients who have not yet provided consent, for existing patients

who have not yet provided consent after the compliance date of the

Privacy Rule, for patients who have revoked consent, and for patients

who may have provided consent, but the provider cannot find such

documentation.

These concerns were primarily raised by pharmacists and pharmacies,

but the same issue exists in any referral or new patient situation.

Pharmacists informed us that they typically use individually

identifiable health information, received from a physician, to fill a

prescription, search for potential drug interactions, and determine

eligibility and obtain authorization for payment, before the individual

arrives at the pharmacy to pick up the prescription. The consent

requirement would delay such activity for any first-time customers and

for many more customers immediately following the compliance date of

the Privacy Rule. Tracking consents in large, multi-state pharmacy

chains can result in delays as well. At best, an individual will

experience significant delays in obtaining his or her prescription if a

pharmacist cannot fill the prescription until the individual is present

to sign a consent. Even greater delays may be experienced by

individuals too ill to pick up their own prescriptions. Although the

Privacy Rule permits a friend or neighbor to pick up the prescription,

that person may not have the legal authority to sign a consent on the

individual's behalf. Thus, a number of trips back and forth to the

pharmacy may be needed to obtain the prior consent. This problem is

greatly magnified in rural areas, where persons may travel much longer

distances to see health care providers, including pharmacists.

Similarly, a hospital receives information about a patient from a

referring physician and routinely uses this information to schedule and

prepare for procedures before the individual presents at the hospital

for such procedure. The Privacy Rule's requirement that a covered

entity obtain an individual's consent prior to using or disclosing

their information is an impediment to these activities and could

require an individual to make an additional trip to the hospital simply

to provide consent. The Department did not intend that the Privacy Rule

interfere with such activities.

Commenters also raised concerns that providers who do not provide

treatment in person may be unable to provide care because they are

unable to obtain prior written consent to use protected health

information at the first service delivery. This was a special concern

with respect to providers who care for individuals over the telephone.

For example, providers who cover for other providers during non-

business hours or providers who had not yet had the opportunity to

obtain a patient's consent were concerned that they would not be able

to respond to telephone calls from individuals in need of treatment

because they were not able to obtain consent over the telephone. Nurses

who staff telephone centers that provide health care assessment and

advice, but who never see patients, had similar concerns.

Other concerns related to treatment were expressed about the

limitations of the exceptions to the consent requirement in the Privacy

Rule. For example, emergency medical providers were unclear as to

whether all activities in which they engage qualify for the emergency

treatment exception to the consent requirement. As a result of this

confusion, they were concerned that, if a situation was urgent, they

would have to try to obtain consent to comply with the Privacy Rule

even if that would be inconsistent with current practice of emergency

medicine. These providers

[[Page 14780]]

also were concerned about the requirement that a provider must attempt

to obtain consent as soon as reasonably practicable after an emergency.

Emergency medical providers explained that they typically do not have

ongoing relationships with individuals and that the requirement to

attempt to obtain consent after the emergency would require significant

efforts and administrative burden on their part, and would be viewed as

harassment by individuals.

Providers who do not provide emergency care and who are not likely

meet one of the consent exceptions were concerned that they may be put

in the untenable position of having to decide whether to withhold

treatment when an individual does not provide consent or proceed to use

information to treat the individual in violation of the consent

requirements.

Covered entities were also concerned that the difficultly in

tracking consents may hamper treatment. The Privacy Rule permits an

individual to revoke his or her consent. Large institutional providers

claimed that, since tracking of patient consents and revocations would

be very difficult and expensive, in practice, they would need to obtain

consent for each patient encounter, rather than just one-time as

allowed by the Privacy Rule. Covered entities were concerned that, if

an individual revokes consent, they would have to eliminate all

protected health information about that individual from their systems

in order to ensure that it was not used inadvertently for routine

health care operations purposes, which would hinder their quality

improvement activities and other health care operations. Additionally,

testimony before the NCVHS revealed a concern that the ability of a

patient to revoke consent might prevent health care providers from

accessing protected health information that is critical for the

treatment of an individual in an emergency treatment situation where a

new consent is not obtained.

The Department also heard many concerns about the transition

provisions related to the use and disclosure of protected health

information for treatment, payment, or health care operations. The

Privacy Rule permits covered health care providers that are required to

obtain consent for treatment, payment, or health care operations to

continue, after the compliance date of the Privacy Rule, to use and

disclose protected health information they created or received prior to

the compliance date of the Privacy Rule for these purposes if they have

obtained consent, authorization, or other express legal permission to

use or disclose such information for any of these purposes, even if

such permission does not meet the consent requirements under the

Privacy Rule. Many providers informed the Department that they

currently were not required to obtain consent for these purposes, that

these transition provisions would result in significant operational

problems, and the inability to access health records would have an

adverse effect on quality activities.

Concerns also were raised regarding the exception to the consent

requirement for cases where a provider is required by law to treat an

individual. For example, providers that are required by law to treat

were concerned about the mixed messages to patients and interference

with the physician-patient relationship that would result when they are

required to ask for consent to use or disclose protected health

information for treatment, payment, or health care operations, but if

the patient says ``no,'' they are permitted to use or disclose the

information for such purposes anyway.

There also was confusion about the interaction of the consent

provisions and the provisions regarding parents and minors. Testimony

received by the NCVHS indicated uncertainty as to the validity of a

consent signed by a parent for his or her minor child once the child

reaches the age of majority. The NCVHS requested clarification

regarding whether a child must sign a new consent upon reaching the age

of majority.

The NCVHS hearings and recommendations focused on practical

implementation issues, including the unintended consequences of the

consent provisions, but did not address whether the Privacy Rule should

or should not require consent. The NCVHS generally recommended that the

Department consider circumstances in which protected health information

could be used and disclosed without an individual's prior written

consent and modify the Privacy Rule accordingly. The Committee

specifically recommended that the Privacy Rule should be amended to

include provisions for allowing covered entities to use and disclose

protected health information prior to the initial face-to-face contact

with an individual.

Proposed Modifications

The Department is concerned by the multitude of comments and

examples demonstrating that the consent requirements result in

unintended consequences that impede the provision of health care in

many critical circumstances and that other such unintended consequences

may exist which have yet to be brought to its attention. However, the

Department understands that the opportunity to discuss privacy

practices and concerns is an important component of privacy, and that

the confidential relationship between a patient and a health care

provider includes the patient's ability to be involved in discussions

and decisions related to the use and disclosure of any protected health

information about him or her.

Accordingly, the Department proposes an approach that protects

privacy interests by affording patients the opportunity to engage in

important discussions regarding the use and disclosure of their health

information, while allowing activities that are essential to provide

access to quality health care to occur unimpeded. Specifically, the

Department proposes to make optional the obtaining of consent to use

and disclose protected health information for treatment, payment, or

health care operations on the part of all covered entities, including

providers with direct treatment relationships. Under this proposal,

health care providers with direct treatment relationships with

individuals would no longer be required to obtain an individual's

consent prior to using and disclosing information about him or her for

treatment, payment, and health care operations. They, like other

covered entities, would have regulatory permission for such uses and

disclosures.

In order to preserve flexibility and the valuable aspects of the

consent requirement, the Department proposes changes that would: (1)

Permit all covered entities to obtain consent if they choose, (2)

strengthen the notice requirements to preserve the opportunity for

individuals to discuss privacy practices and concerns with providers,

and (3) enhance the flexibility of the consent process for those

covered entities that choose to obtain consent. See section III.B. of

the preamble below for the related discussion of proposed modifications

to the Privacy Rule's notice requirements.

Other individual rights would not be affected by this proposal.

Although covered entities would not be required to obtain an

individual's consent, any uses or disclosures of protected health

information for treatment, payment, or health care operations would

still need to be consistent with the covered entity's notice of privacy

practices. Also, the removal of the consent requirement only applies to

consent for treatment, payment, and health care operations; it does not

alter the

[[Page 14781]]

requirement to obtain an authorization under Sec. 164.508 for uses and

disclosures of protected health information not otherwise permitted by

the Privacy Rule. The functions of treatment, payment, and health care

operations were all given carefully limited definitions in the Privacy

Rule, and the Department intends to enforce strictly the requirement

for obtaining an individual's authorization, in accordance with

Sec. 164.508, for uses and disclosure of protected health information

for other purposes not otherwise permitted or required by the Privacy

Rule. Furthermore, individuals would retain the right to request

restrictions, in accordance with Sec. 164.522(a).

Although consent for use and disclosure of protected health

information for treatment, payment, and health care operations would no

longer be mandated, the Department is proposing to allow covered

entities to have a consent process if they wish to do so. The

Department heard from some commenters that obtaining consent was an

integral part of the ethical and other practice standards for many

health care professionals. The Department, therefore, would not

prohibit covered entities from obtaining consent.

Under this proposal, a consent could apply only to uses and

disclosures that are otherwise permitted by the Privacy Rule. A consent

obtained through this voluntary process would not be sufficient to

permit a use or disclosure which, under the Privacy Rule, requires an

authorization or is otherwise expressly conditioned. For example, a

consent could not be obtained in lieu of an authorization or a waiver

of authorization by an IRB or Privacy Board to disclose protected

health information for research purposes.

The Department proposes to allow covered entities that choose to

have a consent process complete discretion in designing this process.

The comments have informed the Department that one consent process and

one set of principles will likely be unworkable. As a result, these

proposed standards would leave complete flexibility to each covered

entity. Covered entities that chose to obtain consent could rely on

industry practices to design a voluntary consent process that works

best for their practice area and consumers.

To effectuate these changes to the consent standard, the Department

proposes to replace the consent provisions in Sec. 164.506 with a new

provision at Sec. 164.506(a) that would provide regulatory permission

for covered entities to use or disclose protected health information

for treatment, payment, and health care operations, and a new provision

at Sec. 164.506(b) that would allow covered entities to obtain consent

if they choose to, and make clear that such consent may not permit a

use or disclosure of protected health information not otherwise

permitted or required by the Privacy Rule. Additionally, the Department

proposes a number of conforming modifications throughout the Privacy

Rule to accommodate the proposed approach. The most substantive

corresponding changes are proposed at Secs. 164.502 and 164.532.

Section 164.502(a)(1) provides a list of the permissible uses and

disclosures of protected health information, and refers to the

corresponding section of the Privacy Rule for the detailed

requirements. The Department collapses the provisions at

Secs. 164.502(a)(1)(ii) and (iii) that address uses and disclosures of

protected health information for treatment, payment, and health care

operations and modifies the language to eliminate the consent

requirement for these purposes.

Section 164.532 consists of the transition provisions. In

Sec. 164.532, the Department deletes references to Sec. 164.506 and to

consent, authorization, or other express legal permission obtained for

uses and disclosures of protected health information for treatment,

payment, and health care operations prior to the compliance date of the

Privacy Rule. The proposal to permit a covered entity to use or

disclose protected health information for these purposes without

consent or authorization would apply to any protected health

information held by a covered entity whether created or received before

or after the compliance date. Therefore, transition provisions would

not be necessary.

The Department also proposes conforming changes to the definition

of ``more stringent'' in Sec. 160.202, Sec. 164.500(b)(1)(v),

Secs. 164.508(a)(2)(i) and (b)(3)(i), the introductory text of

Secs. 164.510 and 164.512, the title of Sec. 164.512, and

Sec. 164.520(b)(1)(ii)(B) to reflect that consent is no longer

required.

2. Disclosures for Treatment, Payment, or Health Care Operations of

Another Entity

The Privacy Rule permits a covered entity to use and disclose

protected health information for treatment, payment, or health care

operations (subject to a consent in some cases). Uses and disclosures

for treatment are broad because the definition of treatment

incorporates the interaction among more than one entity; specifically,

coordination and management of health care among health care providers

or by a health care provider with a third party, consultations between

health care providers, and referrals of a patient for health care from

one health care provider to another. As a result, covered entities are

permitted to disclose protected health information for treatment

regardless of to whom the disclosure is made, as well as to disclose

protected health information for the treatment activities of another

health care provider.

However, for payment and health care operations, the Privacy Rule

generally limits a covered entity's uses and disclosures of protected

health information to those that are necessary for its own payment and

health care operations activities. This limitation is explicitly stated

in the preamble discussions in the Privacy Rule of the definitions of

``payment'' and ``health care operations.'' The Privacy Rule also

provides that a covered entity must obtain authorization to disclose

protected health information for the payment or health care operations

of another entity. The Department intended these requirements to be

consistent with individuals' privacy expectations. See

Secs. 164.506(a)(5) and 164.508(e).

Public Comments

A number of commenters raised specific concerns with the

restriction that a covered entity is permitted to use and disclose

protected health information only for its own payment and health care

operations activities. These commenters presented a number of examples

where such a restriction would impede the ability of certain covered

entities to obtain reimbursement for health care, to conduct certain

quality assurance or improvement activities, such as accreditation, or

to monitor fraud and abuse.

With regard to payment, the Department received specific concerns

about the difficultly that the Privacy Rule will place on certain

providers trying to obtain information needed for reimbursement for

health care. Specifically, ambulance service providers explained that

they normally receive the information they need to seek payment for

treatment from the hospital emergency departments to which they

transport their patients, since it is usually not possible at the time

the service is rendered for the ambulance service provider to obtain

such information directly from the individual. Nor is it practicable or

[[Page 14782]]

feasible in all cases for the hospital to obtain the individual's

authorization to provide payment information to the ambulance service

provider after the fact. This disclosure of protected health

information from the hospital to the ambulance service provider is not

permitted under the Privacy Rule without an authorization from the

patient because it is a disclosure by the hospital for the payment

activities of the ambulance service provider.

In addition, commenters stated that physicians and other covered

entities outsource their billing, claims, and reimbursement functions

to accounts receivable management companies. These collectors often

attempt to recover payments from a patient for care rendered by

multiple health care providers. Commenters were concerned that the

Privacy Rule will prevent these collectors, as business associates of

multiple providers, from using a patient's demographic information

received from one provider in order to facilitate collection for

another provider's payment purposes.

With regard to health care operations, the Department also received

comments about the difficultly that the Privacy Rule will place on

health plans trying to obtain information needed for quality assessment

activities. Health plans informed the Department that they need to

obtain individually identifiable health information from health care

providers for the plans' own quality-related activities, accreditation,

and performance measures, e.g., Health Plan Employer Data and

Information Set (HEDIS). Commenters explained that the information

provided to plans for payment purposes (e.g., claims or encounter

information) may not be sufficient for quality assessment or

accreditation purposes. Plans may receive even less information from

their capitated providers.

The NCVHS also received specific public testimony with regard to

this issue as part of public hearings held in August 2001. The NCVHS

subsequently recommended to the Department that the Privacy Rule be

amended to allow for uses and disclosures for quality-related

activities among covered entities without individual written

authorization.

Proposed Modifications

Based on concerns raised by comments, the Department proposes to

modify Sec. 164.506 to permit a covered entity to disclose protected

health information for the payment activities of another covered entity

or health care provider, and for certain health care operations of

other covered entities. This proposal would broaden the uses and

disclosures that are permitted as part of treatment, payment, and

health care operations so as not to interfere inappropriately with

access to quality and effective health care, while limiting this

expansion in order to continue to protect the privacy expectations of

individuals. It would be a limited expansion of the information that is

allowed to flow between entities, without an authorization, as part of

treatment, payment, and certain health care operations.

The Department proposes the following. First, the Department

explicitly includes in Sec. 164.506(c)(1) language stating that a

covered entity may use or disclose protected health information for its

own treatment, payment, or health care operations without prior consent

or authorization.

Second, in Sec. 164.506(c)(2), the Department includes language to

clarify its intent that a covered entity may share protected health

information for the treatment activities of another health care

provider. For example, a primary care provider, who is a covered entity

under the Privacy Rule, may send a copy of an individual's medical

record to a specialist who needs the information to treat the same

individual. No authorization would be required.

Third, with respect to payment, the Department proposes, in

Sec. 164.506(c)(3), to explicitly permit a covered entity to disclose

protected health information to another covered entity or health care

provider for the payment activities of that entity. The Department

recognizes that not all health care providers who need protected health

information to obtain payment are covered entities, and therefore,

proposes to allow disclosures of protected health information to both

covered and non-covered health care providers. The Department is

unaware of any similar barrier with respect to plans that are not

covered under the Privacy Rule to obtain the protected health

information they need for payment purposes, but solicits comment on

whether such barriers exist. Therefore, the Department proposes to

limit disclosures under this provision to those health plans that are

covered by the Privacy Rule.

Fourth, in Sec. 164.506(c)(4), the Department proposes to permit a

covered entity to disclose protected health information about an

individual to another covered entity for certain health care operations

purposes of the covered entity that receives the information. The

proposal would permit such disclosures only for the activities

described in paragraphs (1) and (2) of the definition of ``health care

operations,'' as well as for health care fraud and abuse detection and

compliance programs (as provided for in paragraph (4) of the definition

of ``health care operations''). The activities that fall into

paragraphs (1) and (2) of the definition of ``health care operations''

include quality assessment and improvement activities, population-based

activities relating to improving health or reducing health care costs,

case management, conducting training programs, and accreditation,

certification, licensing, or credentialing activities. This provision

is intended to allow information to flow from one covered entity to

another for activities important to providing quality and effective

health care.

The proposed expansion for permissible disclosures for health care

operations without authorization is more limited than the permissible

disclosures for treatment and payment in two ways. First, in contrast

to treatment and payment, the proposal limits the types of health care

operations that are covered by this expansion. The Department proposes

this limitation because it recognizes that ``health care operations''

is a broad term and that individuals are less aware of the business-

related activities that involve the use and disclosure of protected

health information. In addition, many commenters and the NCVHS focused

their comments on covered entities' needs to share protected health

information for quality-related health care operations activities.

Second, in contrast to the treatment and payment provisions in this

section, the proposal for disclosures of protected health information

for health care operations of another entity limits disclosures to

other covered entities. By limiting disclosure for such purposes to

entities that are required to comply with the Privacy Rule, the

protected health information would continue to be protected. The

Department believes that this would create the appropriate balance

between meeting an individual's privacy expectations and meeting a

covered entity's need for information for quality-related health care

operations.

These proposed modifications to allow disclosures for health care

operations of another entity are permitted only to the extent that each

entity has, or has had, a relationship with the individual who is the

subject of the information being requested. Where the relationship

between the individual and the covered entity has ended, a disclosure

of protected health information about the individual only would be

allowed if related to the past

[[Page 14783]]

relationship. The Department believes that this limitation is necessary

in order to protect the privacy expectations of the individual. An

individual should expect that two providers that are providing

treatment to the individual, and the health plan that pays for the

individual's health care, would have protected health information about

the individual for health care operations purposes. However, an

individual would not expect a health plan with which the individual has

no relationship to be able to obtain identifiable information from his

or her health care provider. Therefore, this proposed limitation would

minimize the effect on privacy interests, while not interfering with

covered entities' ability to continue to provide access to quality and

effective health care.

These provisions do not eliminate a covered entity's responsibility

to apply the Privacy Rule's minimum necessary provisions to both the

disclosure of and request for information for payment and health care

operations purposes. In addition, the Department continues to strongly

encourage the use of de-identified information wherever feasible.

The Department, however, is aware that the above proposal could

pose barriers to disclosures for quality-related health care operations

to plans and health care providers that are not covered entities, or to

entities that do not have a relationship with the individual. For

example, the proposal could be a problem for hospitals that share

aggregated but identifiable information with other hospitals for health

care operations purposes, when the recipient hospital does not have a

relationship with the individual who is the subject of the information

being disclosed. While the Department believes the proposed

modification strikes the right balance between privacy expectations and

covered entities' need for information for such purposes, the

Department is considering permitting the disclosure of information that

is not facially identifiable for quality-related purposes, subject to a

data use or similar agreement. This would permit uses and disclosures

for such purposes of a limited data set that does not include facially

identifiable information, but in which certain identifiers remain. The

Department is requesting comment on whether this approach would strike

a proper balance. See section III.I of the preamble regarding de-

identification of protected health information for a detailed

discussion of this proposed approach.

Related to the above modifications, and in response to comments

evidencing confusion on this matter, the Department proposes in

Sec. 164.506(c)(5) to make it clear that covered entities participating

in an organized health care arrangement (OHCA) may share protected

health information for the health care operations of the OHCA. The

Privacy Rule allows legally separate covered entities that are

integrated clinically or operationally to be considered an OHCA for

purposes of the Privacy Rule if protected health information must be

shared among the covered entities for the joint management and

operations of the arrangement. See the definition of ``organized health

care arrangement'' in Sec. 164.501. Additionally, the Privacy Rule, in

the definition of ``health care operations,'' permits the sharing of

protected health information in an OHCA for such activities. The

Department proposes to remove the language regarding OHCAs from the

definition of ``health care operations'' as unnecessary because such

language now would appear in Sec. 164.506(c)(5).

In addition, the Department proposes a conforming change to delete

the word ``covered'' in paragraph (1)(i) of the definition of

``payment.'' This change would be necessary because the proposal would

permit disclosures to non-covered providers for their payment

activities.

B. Notice of Privacy Practices for Protected Health Information

The Privacy Rule requires most covered entities to provide

individuals with adequate notice of the uses and disclosures of

protected health information that may be made by the covered entity,

and of the individual's rights, and the covered entity's

responsibilities, with respect to protected health information. See

Sec. 164.520. Content requirements for the notice are specified in the

Privacy Rule. There are also specific requirements, which vary based on

the type of covered entity, for providing such notice to individuals.

For example, a covered health care provider that has a direct

treatment relationship with an individual must provide the notice by

the date of the first service delivery and, if such provider maintains

a physical service delivery site, must post the notice in a clear and

prominent location. In addition, whenever the notice is revised, the

provider must make the notice available upon request. If the covered

provider maintains a website, the notice must also be available

electronically on the web site. If the first service delivery to an

individual is electronic, the covered provider must furnish electronic

notice automatically and contemporaneously in response to the

individual's first request for service.

Proposed Modifications

In order to preserve some of the most important benefits of the

consent requirement, the Department proposes to modify the notice

requirements at Sec. 164.520(c)(2) to require that a covered health

care provider with a direct treatment relationship make a good faith

effort to obtain an individual's written acknowledgment of receipt of

the provider's notice of privacy practices. Other covered entities,

such as health plans, would not be required to obtain this

acknowledgment from individuals, but could do so if they chose.

The Department believes that promoting individuals' understanding

of privacy practices is an essential component of providing notice to

individuals. In addition, the Department believes it is just good

business practice to provide individuals with fair notice about how

their information will be used, disclosed, and protected. This proposal

would strengthen the notice process by incorporating into the notice

process the ``initial moment'' between a covered health care provider

and an individual, where individuals may focus on information practices

and privacy rights and discuss any concerns related to the privacy of

their protected health information. This express acknowledgment would

also provide the opportunity for an individual to make a request for

additional restrictions on the use or disclosure of his or her

protected health information or for additional confidential treatment

of communications, as permitted under Sec. 164.522.

The Department intends the proposed notice acknowledgment

requirement to be simple and not impose a significant burden on either

the covered health care provider or the individual. First, the

requirement for good faith efforts to obtain a written acknowledgment

only applies to covered providers with direct treatment relationships.

This is the same group of covered entities that would have been

required to obtain consent under the Privacy Rule. The Department

believes that these are the covered entities that have the most direct

relationships with individuals, and therefore, the entities for which

the requirement will provide the greatest privacy benefit to

individuals with the least burden to covered entities.

Second, the Department designed the timing of the proposed good

faith acknowledgment requirement to limit the burden on covered

entities by generally making it consistent with the

[[Page 14784]]

timing for notice distribution. Therefore, with one exception, a

covered health care provider would be required to make good faith

efforts to obtain a written acknowledgment of the notice at the time of

first service delivery--the same time that the notice must be provided.

The Department understands, however, that providing notice and

obtaining an acknowledgment is not practicable during emergency

treatment situations. In these situations, the Department proposes in

Sec. 164.520(c)(2) to delay the requirement for provision of notice

until reasonably practicable after the emergency treatment situation,

and exempt health care providers from having to make a good faith

effort to obtain the acknowledgment in emergency treatment situations.

Third, the proposal does not prescribe in detail the form the

acknowledgment must take. Rather, the Department proposes to require

only that the acknowledgment be in writing, and intends to allow each

covered health care provider to choose the form and other details of

the acknowledgment that are best suited to the entity's practices and

that will not pose an impediment to the delivery of timely, quality

health care. While the Department believes that requiring the

individual's signature is preferable because an individual is likely to

pay more attention or more carefully read a document that he or she

signs, the proposal does not require an individual's signature on the

notice. An acknowledgment under this proposed modification also may be

obtained, for example, by having the individual sign a separate list or

simply initial a cover sheet of the notice to be retained by the

covered entity. The proposal would not limit the manner in which a

covered entity obtains the individual's acknowledgment of receipt of

the notice.

Most importantly, the proposed modification would require only the

good faith effort of the provider to obtain the individual's

acknowledgment. The Department understands that an individual may

refuse to sign or otherwise fail to provide his or her acknowledgment.

Unlike the Privacy Rule's consent requirement, an individual's failure

or refusal to acknowledge the notice, despite a covered entity's good

faith efforts to obtain such signature, would not interfere with the

provider's ability to deliver timely and effective treatment. Failure

by a covered entity to obtain an individual's acknowledgment, assuming

it otherwise documented its good faith effort, would not be considered

a violation of the Privacy Rule. Compliance with this requirement would

be achieved in a particular case if the provider with a direct

treatment relationship either: (1) Obtained a written acknowledgment,

or (2) made a good faith effort to obtain such acknowledgment and

documented such efforts and the reason for failure. Such reason for

failure simply may be, for example, that the individual refused to sign

after being requested to do so. In addition to the individual's failure

or refusal to acknowledge receipt of the notice, this proposed

provision is intended to allow covered health care providers

flexibility to deal with a variety of circumstances in which obtaining

an acknowledgment is problematic.

The requirement for a good faith effort to obtain the individual's

acknowledgment would apply, except in emergency treatment situations,

to the provision of notice on the first delivery of service, regardless

of whether such service is provided in person or electronically. When

electronic notice is provided as part of the first service delivery,

the system should be capable of capturing the individual's

acknowledgment of receipt electronically. The Department does not

anticipate that a notification of receipt would be difficult or costly

to design.

Documentation requirements under this proposal would be required to

comply with the documentation requirements in Sec. 164.530(j). In

addition, nothing in the proposed requirements described above would

relieve any covered entity from its duty to provide the notice in plain

language so that the average reader can understand the notice. As

stated in the preamble to the Privacy Rule, the Department encourages

covered entities to consider alternative means of communicating with

certain populations, such as with individuals who cannot read or who

have limited English proficiency.

C. Minimum Necessary and Oral Communications

The Privacy Rule at Sec. 164.502(b) generally requires covered

entities to make reasonable efforts to limit the use or disclosure of,

and requests for, protected health information to the minimum necessary

to accomplish the intended purpose. Protected health information

includes individually identifiable health information in any form,

including information transmitted orally, or in written or electronic

form. See the definition of ``protected health information'' at

Sec. 164.501. The minimum necessary standard is intended to make

covered entities evaluate their practices and enhance protections as

needed to limit unnecessary or inappropriate access to, and disclosures

of, protected health information.

The Privacy Rule sets forth requirements at Sec. 164.514(d) for

implementing the minimum necessary standard with regard to a covered

entity's uses, disclosures, and requests. Essentially, a covered entity

is required to develop and implement policies and procedures

appropriate to the entity's business practices and workforce that

reasonably minimize the amount of protected health information used,

disclosed, and requested; and, for uses of protected health

information, that also limit who has access to such information.

Specifically, for uses of protected health information, the policies

and procedures must identify the persons or classes of persons within

the covered entity who need access to the information to carry out

their job duties, the categories or types of protected health

information needed, and conditions appropriate to such access. For

routine or recurring requests and disclosures, the policies and

procedures may be standard protocols. Non-routine requests for and

disclosures of protected health information must be reviewed

individually.

With regard to disclosures, the Privacy Rule permits a covered

entity to rely on the judgment of certain parties requesting the

disclosure as to the minimum amount of information that is needed. For

example, a covered entity is permitted to reasonably rely on

representation from a public health official that the protected health

information requested is the minimum necessary for a public health

purpose. Similarly, a covered entity is permitted to reasonably rely on

the judgment of another covered entity requesting a disclosure that the

information requested is the minimum amount of information reasonably

necessary to fulfill the purpose for which the request has been made.

See Sec. 164.514(d)(3)(iii).

The Privacy Rule contains some exceptions to the minimum necessary

standard. The minimum necessary requirements do not apply to uses or

disclosures that are required by law, disclosures made to the

individual or pursuant to an authorization initiated by the individual,

disclosures to or requests by a health care provider for treatment

purposes, uses or disclosures that are required for compliance with the

regulations implementing the other administrative simplification

provisions of HIPAA, or disclosures to the Secretary of HHS for

enforcement purposes. See Sec. 164.502(b)(2).

[[Page 14785]]

The Department received much, varied commentary both on the minimum

necessary provisions, as well as on the Privacy Rule's protections of

oral communications. The following discussion addresses the concerns

identified by commenters that were common to both the Privacy Rule's

standards for minimum necessary as well as protecting oral

communications, and describes the Department's proposal for modifying

the Privacy Rule in response to these concerns. In addition, the

Department proposes to modify certain other paragraphs within

Sec. 164.514(d) to clarify the Department's intent with respect to

these provisions. The Department also discusses some of the other

concerns that have been received, which the Department attempted to

address in its July 6 guidance on the Privacy Rule. Lastly, the

Department describes the recommendations provided to the Department by

the NCVHS as a result of public testimony received on implementation of

the minimum necessary standard, as well as the Department's response to

these recommendations.

Public Comments--Incidental Uses and Disclosures

During the March 2001, comment period on the Privacy Rule, the

Department received a number of comments raising concerns and questions

as to whether the Privacy Rule's restrictions on uses and disclosures

will prohibit covered entities from engaging in certain common and

essential health care communications and practices in use today.

Commenters were concerned that the Department is imposing through the

Privacy Rule absolute, strict standards that would not allow for the

incidental or unintentional disclosure that could occur as a by-product

of engaging in these health care communications and practices. It was

argued that the Privacy Rule will, in effect, prohibit such practices

and, therefore, impede many activities and communications essential to

effective and timely treatment of patients.

These concerns were raised both in the context of applying the

Privacy Rule's protections to oral communications, as well as in

implementing the minimum necessary standard. For example, with regard

to oral communications, commenters expressed concern over whether

health care providers may continue to engage in confidential

conversations with other providers or with patients, if there were a

possibility that they could be overheard. As examples, commenters

specifically questioned whether health care staff can continue to:

coordinate services at hospital nursing stations orally; discuss a

patient's condition over the phone with the patient or another

provider, if other people are nearby; discuss lab test results with a

patient or other provider in a joint treatment area; call out a

patient's name in a waiting room; or discuss a patient's condition

during training rounds in an academic or training institution.

Many covered entities also expressed confusion and concern that the

Privacy Rule will stifle or unnecessarily burden many of their current

health care practices. For example, commenters questioned whether they

will be prohibited from using sign-in sheets in waiting rooms or

maintaining patient charts at bedside, or whether they will need to

isolate X-ray lightboards or destroy empty prescription vials. These

concerns seemed to stem from a perception that covered entities will be

required to prevent any incidental disclosure such as those that may

occur when a visiting family member or other person not authorized to

access protected health information happens to walk by medical

equipment or other material containing individually identifiable health

information, or when individuals in a waiting room sign their name on a

log sheet and glimpse the names of other patients.

Proposed Modifications--Incidental Uses and Disclosures

The Department, in its July 6 guidance, clarified that the Privacy

Rule is not intended to impede customary and necessary health care

communications or practices, nor to require that all risk of incidental

use or disclosure be eliminated to satisfy its standards. So long as

reasonable safeguards are employed, the burden of impeding such

communications are not outweighed by any benefits that may accrue to

individuals' privacy interests. The guidance assured that the Privacy

Rule would be modified to clarify that such communications and

practices may continue, if reasonable safeguards are taken to minimize

the chance of incidental disclosure to others.

Accordingly, the Department proposes to modify the Privacy Rule to

add a new provision at Sec. 164.502(a)(1)(iii) which explicitly permits

certain incidental uses and disclosures that occur as a result of an

otherwise permitted use or disclosure under the Privacy Rule. An

incidental use or disclosure would be a secondary use or disclosure

that cannot reasonably be prevented, is limited in nature, and that

occurs as a by-product of an otherwise permitted use or disclosure

under the Privacy Rule. The Department proposes that an incidental use

or disclosure be permissible only to the extent that the covered entity

has applied reasonable safeguards as required by Sec. 164.530(c), and

implemented the minimum necessary standard, where applicable, as

required by Secs. 164.502(b) and 164.514(d).

Under this proposal, an incidental use or disclosure that occurs as

a result of a failure to apply reasonable safeguards or the minimum

necessary standard, as appropriate, is not a permissible use or

disclosure and is, therefore, a violation of the Privacy Rule. For

example, a covered entity that asks for a patient's health history on

the waiting room sign-in sheet is not abiding by the minimum necessary

requirements and, therefore, any incidental disclosure of such

information that results from this practice would be an unlawful

disclosure under the Privacy Rule.

Further, this proposed modification is not intended to excuse

erroneous uses or disclosures or those that result from mistake or

neglect. The Department would not consider such uses and disclosures to

be incidental as they do not occur as a by-product of an otherwise

permissible use or disclosure. For example, an impermissible disclosure

would occur when a covered entity mistakenly sends protected health

information via electronic mail to the wrong recipient or when

protected health information is erroneously made accessible to others

through the entity's web site.

Proposed Modifications to the Minimum Necessary Standard

Section 164.502(b)(2) sets forth the exceptions to the minimum

necessary standard in the Privacy Rule. The Department proposes to

separate Sec. 164.502(b)(2)(ii) into two subparagraphs

(Sec. 164.502(b)(2)(ii) and (iii)) to eliminate confusion regarding the

exception to the minimum necessary standard for uses or disclosures

made pursuant to an authorization under Sec. 164.508 and those for

disclosures made to the individual. Additionally, to conform to the

proposal to eliminate the special authorizations required by the

Privacy Rule at Sec. 164.508(d), (e), and (f) (see section III.H for

the relevant preamble discussion regarding authorization), the

Department proposes to expand the exception for authorizations to apply

generally to any authorization executed pursuant to Sec. 164.508.

Therefore, the proposal would exempt from the minimum necessary

standard any uses or disclosures for which the covered entity

[[Page 14786]]

has received an authorization that meets the requirements of

Sec. 164.508.

The Privacy Rule at Sec. 164.514(d) lists the standard and the

specific requirements for implementing the minimum necessary standard.

The Department proposes to modify Sec. 164.514(d)(1) to delete the term

``reasonably ensure'' in response to concerns that the term connotes an

absolute, strict standard and, therefore, is inconsistent with how the

Department has described the minimum necessary requirements as being

reasonable and flexible to the unique circumstances of the covered

entity. In addition, the Department generally revises the language to

be more consistent with the description of standards elsewhere in the

Privacy Rule.

The Privacy Rule at Sec. 164.514(d)(4) consists of the

implementation specifications for applying the minimum necessary

standard to a request for protected health information. The Department

intended these provisions to be consistent with the requirements set

forth in Sec. 164.514(d)(3) for applying the minimum necessary standard

to disclosures of protected health information, so that covered

entities would be able to address requests and disclosures in a similar

manner. However, with respect to requests not made on a routine and

recurring basis, the Department omitted from Sec. 164.514(d)(4) the

requirement that a covered entity may implement this standard by

developing criteria designed to limit its request for protected health

information to the minimum necessary to accomplish the intended

purpose. The Department proposes to add such a provision to make the

implementation specifications for applying the minimum necessary

standard to requests for protected health information by a covered

entity more consistent with the implementation specifications for

disclosures.

Other Comments on the Minimum Necessary Standard

In addition to the comments described above regarding incidental

uses or disclosures, the Department received many other varied comments

expressing both support of, and concerns about, the minimum necessary

standard. The Department, in its July 6, 2001, guidance, attempted to

address many of the commenters' concerns by clarifying the Department's

intent with respect to the minimum necessary provisions. For example,

many commenters expressed concerns about the costs and burden to

covered entities in implementing the standard. A number of these

commenters questioned whether they will be required to redesign office

space or implement expensive upgrades to computer systems.

The Department's guidance emphasized that the minimum necessary

standard is a reasonableness standard, intended to be flexible to

account for the characteristics of the entity's business and workforce.

The standard is not intended to override the professional judgment of

the covered entity. The Department clarified that facility redesigns

and expensive computer upgrades are not specifically required by the

minimum necessary standard. Covered entities may, however, need to make

certain adjustments to their facilities, as reasonable, to minimize

access or provide additional security. For example, covered entities

may decide to isolate and/or lock file cabinets or records rooms, or

provide additional security, such as passwords, on computers that

maintain protected health information.

A number of commenters, especially health care providers, also

expressed concern that the minimum necessary restrictions on uses

within the entity will jeopardize patient care and exacerbate medical

errors by impeding access to information necessary for treatment

purposes. These commenters urged the Department to expand the treatment

exception to cover uses of protected health information within the

entity. Other commenters urged the Department to exempt all uses and

disclosures for treatment, payment, and health care operations purposes

from the minimum necessary standard.

The Privacy Rule is not intended to impede access by health care

professionals to information necessary for treatment purposes. As the

Department explained in its guidance, a covered entity is permitted to

develop policies and procedures that allow for the appropriate

individuals within the entity to have access to protected health

information, including entire medical records, as appropriate, so that

those workforce members are able to provide timely and effective

treatment.

With regard to payment and health care operations, the Department

remains concerned, as stated in the preamble to the Privacy Rule, that,

without the minimum necessary standard, covered entities may be tempted

to disclose an entire medical record when only a few items of

information are necessary, to avoid the administrative step of

extracting or redacting information. The Department also believes that

this standard will cause covered entities to assess their privacy

practices, give the privacy interests of their patients and enrollees

greater attention, and make improvements that might otherwise not be

made. For these reasons, the Department continues to believe that the

privacy benefits of retaining the minimum necessary standard for these

purposes outweigh the burdens involved.

In addition, the NCVHS Subcommittee on Privacy and Confidentiality

solicited public testimony on implementation of the minimum necessary

standard of the Privacy Rule at its August 2001 public hearings. The

testimony reflected a wide range of views, from those who commented

that the Privacy Rule provides sufficient protections on individually

identifiable health information without the minimum necessary standard,

to those who expressed strong support for the standard as an integral

part of the Privacy Rule. A number of panelists welcomed the

flexibility of the standard, while others expressed concern that the

vagueness of the standard might restrict the necessary flow of

information, impede care, and lead to an increase in defensive

information practices that would lead to the withholding of important

information for fear of liability. Testimony also reflected differing

views on the cost and administrative burden of implementing the

standard. Some expressed much concern regarding the increased cost and

burden, while others argued that the cost will be barely discernable.

The NCVHS developed recommendations on the minimum necessary

standard based on the testimony and written comments provided at the

hearings. In its recommendations, the NCVHS strongly reaffirmed the

importance of the minimum necessary principle, but also generally

recommended that HHS provide additional clarification and guidance to

industry regarding the minimum necessary requirements to assist with

effective implementation of these provisions, while allowing for the

necessary flow of information and minimizing defensive information

practices. While the NCVHS pointed out that many panelists at the

hearing found the Department's July 6 guidance helpful in addressing

questions about the minimum necessary standard, the Committee heard

that many questions still remain within the industry. Therefore, the

NCVHS specifically requested further guidance by the Department on the

reasonable reliance provisions, and the requirement that covered

entities develop policies and procedures for addressing routine uses

[[Page 14787]]

of information. In addition, the NCVHS recommended that the Department

provide education to address the increasing concerns about liability

and defensive information practices that may lessen the flow of

information and impede care. The NCVHS generally recommended that the

Department issue advisory opinions, publish best practices, and make

available model policies, procedures, and forms to assist in

alleviating the cost and administrative burden that will be incurred

when developing policies and procedures as required by the minimum

necessary provisions.

The Department agrees with the NCVHS about the need for further

guidance on the minimum necessary standard and intends to issue further

guidance to clarify issues causing confusion and concern in the

industry, as well as provide additional technical assistance materials

to help covered entities implement the provisions.

D. Business Associates

The Privacy Rule at Sec. 164.502(e) permits a covered entity to

disclose protected health information to a business associate who

performs a function or activity on behalf of, or provides a service to

the covered entity that involves the creation, use, or disclosure of,

protected health information, provided that the covered entity obtains

satisfactory assurances that the business associate will appropriately

safeguard the information. The Department recognizes that most covered

entities do not perform or carry out all of their health care

activities and functions by themselves, but rather acquire the services

or assistance of a variety of other persons or entities. Given this

framework, the Department intended these provisions to allow such

business relationships to continue while ensuring that identifiable

health information created or shared in the course of the relationships

was protected.

The Privacy Rule requires that the satisfactory assurances obtained

from the business associate be in the form of a written contract (or

other written arrangement as between governmental entities) between the

covered entity and the business associate that contains the elements

specified at Sec. 164.504(e). For example, the agreement must identify

the uses and disclosures of protected health information the business

associate is permitted or required to make, as well as require the

business associate to put in place appropriate safeguards to protect

against a use or disclosure not permitted by the contract or agreement.

The Privacy Rule also provides that, where a covered entity knows

of a material breach or violation by the business associate of the

contract or agreement, the covered entity is required to take

reasonable steps to cure the breach or end the violation, and if such

steps are unsuccessful, to terminate the contract or arrangement. If

termination of the contract or arrangement is not feasible, a covered

entity then is required to report the problem to the Secretary of HHS.

A covered entity that violates the satisfactory assurances it provided

as a business associate of another covered entity will be in

noncompliance with the Privacy Rule's business associate provisions.

The Privacy Rule's definition of ``business associate'' at

Sec. 160.103 includes some of the functions or activities, and all of

the types of services, that make a person or entity who engages in them

a business associate, if such activity or service involves protected

health information. For example, a third party administrator (TPA) is a

business associate of a health plan to the extent the TPA assists the

health plan with claims processing or another covered function.

Similarly, accounting services performed by an outside consultant give

rise to a business associate relationship when provision of the service

entails access to the protected health information held by a covered

entity.

The Privacy Rule excepts from the business associate standard

certain uses or disclosures of protected health information. That is,

in certain situations, a covered entity is not required to have a

contract or other written agreement in place before disclosing

protected health information to a business associate or allowing

protected health information to be created by the business associate on

its behalf. Specifically, the standard does not apply to: disclosures

by a covered entity to a health care provider for treatment purposes;

disclosures to the plan sponsor by a group health plan, or a health

insurance issuer or HMO with respect to a group health plan, to the

extent that the requirements of Sec. 164.504(f) apply and are met; or

to the collection and sharing of protected health information by a

health plan that is a public benefits program and an agency other than

the agency administering the health plan, where the other agency

collects protected health information for, or determines, eligibility

or enrollment with respect to the government program, and where such

activity is authorized by law. See Sec. 164.502(e)(1)(ii).

Public Comments

The Department has received many comments on the business associate

provisions of the Privacy Rule. The majority of commenters expressed

some concern over the anticipated administrative burden and cost to

implement the business associate provisions. Some commenters stated

that covered entities might have existing contracts that are not set to

terminate or expire until after the compliance date of the Privacy

Rule. Many of these commenters expressed specific concern that the two-

year compliance period does not provide enough time to reopen and

renegotiate what could be hundreds or more contracts for large covered

entities. A number of these commenters urged the Department to

grandfather in existing contracts until such contracts come up for

renewal instead of requiring that all contracts be in compliance with

the business associate provisions by the compliance date of the Privacy

Rule. In response to these comments, the Department intends to relieve

some of the burden on covered entities in complying with the business

associate provisions, both by proposing to grandfather certain existing

contracts for a specified period of time, as well as publishing model

contract language. These proposed changes are discussed below in this

section under ``Proposed Modifications.''

In addition, commenters continued to express concern over a

perceived liability imposed by the Privacy Rule that would essentially

require that the covered entity monitor, and be responsible for, the

actions of its business associates with respect to the privacy and

safeguarding of protected health information. However, the Privacy Rule

only requires that, where a covered entity knows of a pattern of

activity or practice that constitutes a material breach or violation of

the business associate's obligation under the contract, the covered

entity take steps to cure the breach or end the violation. Accordingly,

the Department, in its July 6 guidance, clarified that active

monitoring of the actions of business associates is not required of

covered entities, and more importantly, that covered entities are not

responsible or liable for the actions of their business associates.

A number of commenters urged the Department to exempt covered

entities from having to enter into contracts with business associates

who are also covered entities under the Privacy Rule. The Department

continues to believe, as stated in the preamble to the Privacy Rule,

that a covered entity that is a

[[Page 14788]]

business associate should be restricted from using or disclosing the

protected health information it creates or receives through its

business associate function for any purposes other than those

explicitly provided for in its contract. In addition, the contract

serves to clarify the uses and disclosures made as, and the protected

health information held by, the covered entity, versus those uses and

disclosures made as, and the protected health information held by, the

same entity as the business associate.

Many commenters continued to express concerns that requiring

business associate contracts between health care providers in treatment

situations would burden and impede quality care. The Department

clarifies that the Privacy Rule does not require a contract for a

covered entity to disclose protected health information to a health

care provider for treatment purposes. In fact, such disclosures are

explicitly excepted from the business associate requirements. See

Sec. 164.502(e)(1). For example, a hospital is not required to have

business associate contracts with health care providers who have staff

privileges at the institution in order for these entities to share

protected health information for treatment purposes. Nor is a physician

required to have a business associate contract with a laboratory as a

condition of disclosing protected health information for the treatment

of an individual.

Some commenters requested clarification as to whether business

associate contracts were required between a health plan and the health

care providers participating in the plan's network. Participation in a

plan network in and of itself does not give rise to a business

associate relationship to the extent that neither entity is performing

functions or activities, or providing services to, the other entity.

For example, each covered entity is acting on its own behalf when a

provider submits a claim to a health plan, and when the health plan

assesses and pays the claim. Discount payment arrangements do not

require business associate relationships. However, this does not

preclude a covered entity from establishing a business associate

relationship with the health plan or another entity in the network for

some other purpose. If the health plan and one or more of the providers

participating in its network do perform covered functions on behalf of

each other, a business associate agreement is required. For example, if

one health care provider handles the billing activities of another

health care provider in the same network, a business associate contract

would be required before protected health information could be

disclosed for this activity.

Proposed Modifications

The Department proposes new transition provisions at

Sec. 164.532(d) and (e) to allow covered entities, other than small

health plans, to continue to operate under certain existing contracts

with business associates for up to one year beyond the April 14, 2003,

compliance date of the Privacy Rule. This modification is proposed in

response to commenter concerns regarding the insufficient time provided

by the two-year period between the effective date and compliance date

of the Privacy Rule for covered entities, especially large entities, to

reopen and renegotiate all existing vendor and service contracts in

order to bring such contracts into compliance with the Privacy Rule's

requirements.

The additional transition period would be available to a covered

entity, other than a small health plan, if, prior to the effective date

of this transition provision, the covered entity has an existing

contract or other written arrangement with a business associate, and

such contract or arrangement is not renewed or modified between the

effective date of this provision and the Privacy Rule's compliance date

of April 14, 2003. The provisions are intended to allow those covered

entities who qualify as described above to continue to disclose

protected health information to the business associate, or allow the

business associate to create or receive protected health information on

its behalf, for up to one year beyond the Privacy Rule's compliance

date, regardless of whether the contract meets the applicable contract

requirements in the Privacy Rule. The Department proposes to deem such

contracts to be compliant with the Privacy Rule until either the

covered entity has renewed or modified the contract following the

compliance date of the Privacy Rule (April 14, 2003), or April 14,

2004, whichever is sooner. In cases where a contract simply renews

automatically without any change in terms or other action by the

parties (also known as ``evergreen contracts''), the Department intends

that such evergreen contracts would be eligible for the extension and

that deemed compliance would not terminate when these contracts

automatically roll over.

Covered entities that were concerned about timely compliance wanted

to be able to incorporate the business associate contract requirements

at the time they would otherwise be modifying or renewing the contract.

Therefore, the extension would only apply until such time as the

contract is modified or renewed following the effective date of this

modification. Furthermore, the Department proposes to limit the deemed

compliance period to one year, as the appropriate balance between

maintaining individuals' privacy interests and alleviating the burden

on the covered entity.

These transition provisions would apply to covered entities only

with respect to written contracts or other written arrangements as

specified above, and not to oral contracts or other arrangements. In

addition, a covered entity that enters into a contract after the

effective date of this modification must have a business associate

contract that meets the applicable requirements of Secs. 164.502(e) and

164.504(e) by April 14, 2003.

The proposed transition provisions would not apply to small health

plans, as defined in the Privacy Rule. Small health plans would still

be required to have business associate contracts that are in compliance

with the Privacy Rule's applicable provisions, by the Privacy Rule's

compliance deadline for such covered entities of April 14, 2004. The

Department proposes to exclude this subset of covered entities from

these provisions because the statute already provides an additional

year for these smaller entities to come into compliance, which should

be sufficient for compliance with the Privacy Rule's business associate

provisions. In addition, the Department believes that the proposed

model contract provisions (see the Appendix to the preamble) will

assist small health plans and other covered entities in their

implementation of the Privacy Rule's business associate provisions by

April 14, 2004.

Proposed Sec. 164.532(e)(2) provides that, after the Privacy Rule's

compliance date, these new provisions would not relieve a covered

entity of its responsibilities with respect to making protected health

information available to the Secretary, including information held by a

business associate, as necessary for the Secretary to determine

compliance. Similarly, under proposed Sec. 164.532(e)(2), these

provisions would not relieve a covered entity of its responsibilities

with respect to an individual's rights to access or amend his or her

protected health information held by business associates, or receive an

accounting of uses and disclosures by business associates, as provided

for by the Privacy Rule's requirements at Secs. 164.524, 164.526, and

164.528. Covered entities would still be required to fulfill

individuals' rights with respect to their protected health information,

[[Page 14789]]

including information held by a business associate of the covered

entity. Covered entities must ensure, in whatever manner effective, the

appropriate cooperation by their business associates in meeting these

requirements.

The Department retains without modification the standards and

implementation specifications that apply to business associate

relationships as set forth at Secs. 164.502(e) and 164.504(e),

respectively, of the Privacy Rule.

E. Uses and Disclosures of Protected Health Information for Marketing

The Privacy Rule defines ``marketing'' at Sec. 164.501 as a

communication about a product or service, a purpose of which is to

encourage recipients of the communication to purchase or use the

product or service, subject to certain limited exceptions. The

definition does not limit the type or means of communication that is

considered marketing. In general, a covered entity is not permitted to

use or disclose protected health information for the purposes of

marketing products or services that are not health-related without the

express authorization of the individual. Moreover, the Privacy Rule

prohibits a covered entity from selling lists of patients or enrollees

to third parties, or from disclosing protected health information to a

third party for the independent marketing activities of the third

party, without the express authorization of the individual.

The Department understands that covered entities need to be able to

discuss their own health-related products and services, or those of

third parties, as part of their everyday business and as part of

promoting the health of their patients and enrollees. For example, a

health care provider may recommend to a patient a particular brand name

drug for the treatment of that patient. Even though these

communications also meet the above definition of ``marketing,'' the

Privacy Rule does not require an authorization for such communications.

Instead, the Privacy Rule addresses these types of health-related

communications in two ways.

First, the Department did not want to interfere with or

unnecessarily burden communications about treatment or about the

benefits and services of plans and providers. Therefore, the Privacy

Rule explicitly excludes from the definition of ``marketing'' certain

health-related communications that may be part of a covered entity's

treatment of the individual or its health care operations, but that may

also promote the use or sale of a service or product. For example,

communications made by a covered entity for the purpose of describing

the participating providers and health plans in a network, or

describing the services offered by a provider or the benefits covered

by a health plan, are excluded from the definition of ``marketing.'' In

addition, communications made by a health care provider as part of the

treatment of a patient and for the purpose of furthering that

treatment, or made by a covered entity in the course of managing an

individual's treatment or recommending an alternative treatment, are

not considered marketing under the Privacy Rule. These exceptions do

not apply, however, to written communications for which a covered

entity is compensated by a third party. The Department intended that

covered entities be able to discuss freely their products and services

and the products and services of others in the course of managing an

individual's health care or providing or discussing treatment

alternatives with an individual. Under the Privacy Rule, therefore,

covered entities are permitted to use and disclose protected health

information for these excepted activities without authorization under

Sec. 164.508.

Second, the Privacy Rule permits, at Sec. 164.514(e), covered

entities to use and disclose protected health information without

individual authorization for other health-related communications that

meet the definition of ``marketing,'' subject to certain conditions on

the manner in which the communications are made. The Privacy Rule does

not condition the substance of health-related marketing communications.

Rather, it attempts to assure that individuals are aware of the source

of the communication and the reason they received such communications,

as well as to provide individuals with some control over whether or not

they receive these communications in the future.

Specifically, the Privacy Rule permits a covered entity to use or

disclose protected health information to communicate to individuals

about the health-related products or services of the covered entity or

of a third party if the communication: (1) Identifies the covered

entity as the party making the communication; (2) identifies, if

applicable, that the covered entity received direct or indirect

remuneration from a third party for making the communication; (3)

generally contains instructions describing how the individual may opt

out of receiving future communications about health-related products

and services; and (4) where protected health information is used to

target the communication about a product or service to individuals

based on their health status or health condition, explains why the

individual has been targeted and how the product or service relates to

the health of the individual. The Privacy Rule also requires a covered

entity to make a determination, prior to using or disclosing protected

health information to target a communication to individuals based on

their health status or condition, that the product or service may be

beneficial to the health of the type or class of individual targeted to

receive the communication.

For certain permissible marketing communications, however, the

Department did not believe these conditions to be practicable.

Therefore, Sec. 164.514(e) also permits, without the above conditions,

a covered entity to make a marketing communication that occurs in a

face-to-face encounter with the individual, or that involves products

or services of only nominal value. These provisions permit a covered

entity to discuss services and products, as well as provide sample

products without restriction, during a face-to-face communication, or

distribute calendars, pens, and other merchandise that generally

promote a product or service if they are of only nominal value.

Public Comments

The Department received many comments on the Privacy Rule's

marketing requirements, as well as recommendations from the NCVHS,

based on public testimony from trade associations, medical

associations, insurance commissioners, academic medical centers, non-

profit hospitals, and consumers. Both industry and consumer groups

argued that the marketing provisions were complicated and confusing.

Covered entities expressed confusion over the Privacy Rule's

distinction between health care communications that are excepted from

the definition of ``marketing'' versus those that are marketing but

permitted subject to the special conditions in Sec. 164.514(e). For

example, commenters questioned if, and if so, when, disease management

communications or refill reminders are ``marketing'' communications

subject to the special disclosure and opt-out conditions in

Sec. 164.514(e). Commenters also stated that it was unclear how to

characterize various health care operations activities, such as general

health-related educational and wellness promotional activities, and

therefore unclear how to treat such activities under the marketing

provisions of the Privacy Rule.

The Department also learned of a general dissatisfaction by

consumers

[[Page 14790]]

with the conditions required by Sec. 164.514(e). Many commenters

questioned the general effectiveness of the conditions and whether the

conditions would properly protect consumers from unwanted disclosure of

protected health information to commercial entities, the re-disclosure

of the information by these commercial entities, and the intrusion of

unwanted solicitations. They did not feel that they were protected by

the fact that commercial entities handling the protected health

information would be subject to business associate agreements with

covered entities. In addition, commenters expressed specific

dissatisfaction with the provision at Sec. 164.514(e)(3)(iii) for

individuals to opt out of future marketing communications. Many argued

for the opportunity to opt out of marketing communications before any

marketing occurred. Others requested that the Department limit

marketing communications to only those consumers that affirmatively

chose to be the target of such communications.

Proposed Modifications

In response to these concerns, the Department proposes to modify

the Privacy Rule to make the marketing provisions clearer and simpler.

First, and most significantly, the Department proposes to simplify the

Privacy Rule by eliminating the special provisions for marketing

health-related products and services at Sec. 164.514(e). Instead, any

communication defined as ``marketing'' in Sec. 164.501 would require

authorization by the individual. In contrast to the Privacy Rule, under

these proposed modifications, covered entities would no longer be able

to make any type of marketing communications without authorization

simply by meeting the disclosure and opt-out provisions in the Privacy

Rule. The Department believes that requiring authorization for all

marketing communications would effectuate greater consumer privacy

protection not currently afforded by the disclosure and opt-out

conditions of Sec. 164.514(e) of the Privacy Rule.

Second, the Department proposes to maintain the substance of the

Privacy Rule's definition of ``marketing'' at Sec. 164.501, with minor

clarifications. Specifically, the Department proposes to define

``marketing'' as ``to make a communication about a product or service

to encourage recipients of the communication to purchase or use the

product or service.'' The proposed modification retains the substance

of the ``marketing'' definition, but changes the language slightly to

avoid the implication that marketing is tied to the intent of the

communication. Removing language referencing the purpose of the

communication would shift the assessment of whether a communication is

marketing from the intent of the speaker to the effect of the

communication. If the effect of the communication is to encourage

recipients of the communication to purchase or use the product or

service, the communication would be marketing.

Third, with respect to the exclusions from the definition of

``marketing'' in Sec. 164.501, the Department has tried to simplify the

language to avoid confusion and better conform to other sections of the

regulation, particularly in the area of treatment communications, and

is proposing one substantive change. The modified language reads as

follows: ``(1) To describe the entities participating in a health care

provider network or health plan network, or to describe if, and the

extent to which, a product or service (or payment for such product or

service) is provided by a covered entity or included in a plan of

benefits; (2) For treatment of that individual; or (3) For case

management or care coordination for that individual, or to direct or

recommend alternative treatments, therapies, health care providers, or

settings of care to that individual.''

With respect to the third exclusion, the Department is proposing to

replace a communication made ``in the course of managing the treatment

of that individual,'' with a communication for ``case management'' or

``care coordination'' for that individual. The Department is proposing

these changes for clarity because ``case management'' and ``care

coordination'' are the terms that are used in the definition of

``health care operations,'' while ``managing the treatment of that

individual'' is not. These changes are not intended to increase the

scope of the marketing exclusions.

The Department is proposing to eliminate the distinction in the

definition of ``marketing'' at Sec. 164.501 pertaining to written

communications for which a covered entity is compensated by a third

party. Under the Privacy Rule, exceptions from the definition of

``marketing'' are only applicable if the communication is made either

orally or in writing when no remuneration from a third party has been

paid to a covered entity for making the communication. The Department

found that these rules led to confusion and many questions about

treatment-related communications, such as prescription refill

reminders. Many commenters felt that these restriction rules could

burden the ability of providers and patients to communicate freely

about treatment. Most commenters did not want any treatment

communications to be considered marketing. The Department understands

these concerns and wants to avoid situations where a health care

provider would be required to obtain an authorization to send out a

prescription refill reminder, even if the provider is compensated by a

third party for the activity. Therefore, the Department proposes to

eliminate this provision in order to facilitate necessary and important

treatment communications.

None of these proposed modifications change the basic prohibition

in the Privacy Rule against covered entities selling lists of patients

or enrollees to third parties, or from disclosing protected health

information to a third party for the independent marketing activities

of a third party, without the express authorization of the individual.

The Department received numerous comments suggesting that the

Privacy Rule's marketing exceptions in the definition and under

Sec. 164.514(e) may not allow for certain common health care

communications, such as disease management, wellness programs,

prescription refill reminders, and appointment notifications that

individuals expect to receive as part of their health care to continue

unimpeded. The Department believes that these types of communications

are allowed under the exceptions to the definition of ``marketing'' in

the Privacy Rule, and therefore would continue to be allowed under the

proposed modification. The Department is interested in comments

identifying specific types of communication that should or should not

be considered marketing.

To reinforce the policy requiring an authorization for most

marketing communications, the Department proposes to add a specific

marketing provision at Sec. 164.508(a)(3) explicitly requiring an

authorization for a use or disclosure of protected health information

for marketing purposes. Additionally, if the marketing is expected to

result in direct or indirect remuneration to the covered entity from a

third party, the Department proposes that the authorization state this

fact. As in the Privacy Rule at Sec. 164.514(e)(2), proposed

Sec. 164.508(a)(3) would exclude from the marketing authorization

requirements face-to-face communications made by a covered entity to an

individual. The Department proposes to retain this exception in the

Privacy Rule so that the marketing provisions would not interfere with

the

[[Page 14791]]

relationship and dialogue between health care providers and

individuals. Similarly, the Department proposes to retain the Privacy

Rule's exception to the authorization requirement for a marketing

communication that concerns products or services of nominal value, but

proposes to replace the language with the common business term

``promotional gift of nominal value.''

Given the above proposal, the Department also proposes to remove

Sec. 164.514(e) as unnecessary. Accordingly, conforming changes to

remove references to Sec. 164.514(e) are proposed at

Sec. 164.502(a)(1)(vi) and in paragraph (6)(v) of the definition of

``health care operations'' in Sec. 164.501.

With the elimination of the special rules in Sec. 164.514(e), the

Department thereby proposes to eliminate the requirement that

disclosures for health-related marketing are limited to disclosures to

business associates hired to assist the covered entity with the

communication. Under the proposed rule, this distinction would serve no

purpose, because an authorization would be required for such

disclosures and thus the individual would know from the face of the

authorization who will receive the information. Similarly, this

simplification also would eliminate the requirement that a marketing

communication identify the covered entity responsible for the

communication. Under the proposal, the individual would have authorized

the disclosure and thus would know which plans and providers are

disclosing health information for marketing purposes. There would be

added burden but no benefit in retaining an additional notification

requirement.

F. Parents as Personal Representatives of Unemancipated Minors \1\

---------------------------------------------------------------------------

\1\ Throughout this section of the preamble, ``minor'' refers to

an unemancipated minor and ``parent'' refers to a parent, guardian,

or other person acting in loco parentis.

---------------------------------------------------------------------------

The Privacy Rule is intended to assure that parents have

appropriate access to health information about their children. By

generally creating new protections and individual rights with respect

to individually identifiable health information, the Privacy Rule

establishes new rights for parents with respect to the health

information about their minor children in the vast majority of cases.

In addition, the Department intended that State or other applicable law

regarding disclosure of health information about a minor child to a

parent should govern where such law exists.

Under the Privacy Rule, parents are granted new rights with respect

to health information about their minor children as the personal

representatives of their minor children. See Sec. 164.502(g).

Generally, parents will be able to access and control the health

information about their minor children. See Sec. 164.502(g)(3).

The Privacy Rule recognizes a limited number of exceptions to this

general rule. These exceptions generally track the ability of certain

minors to obtain specified health care without parental consent under

State or other applicable laws. For example, every State has a law that

permits adolescents to be tested for HIV without the consent of a

parent. These laws are created to assure that adolescents will seek

health care that is essential to their own health, as well as public

health. In these exceptional cases, where a minor can obtain a

particular health care service without the consent of a parent under

State or other applicable law, it is the minor and not the parent who

may exercise the privacy rights afforded to individuals under the

Privacy Rule. See Sec. 164.502(g)(3)(i)-(ii).

The Privacy Rule also allows the minor to exercise control of the

protected health information when the parent has agreed to the minor

obtaining confidential treatment (see Sec. 164.502(g)(3)(iii)), and

allows a covered health care provider to choose not to treat a parent

as a personal representative of the minor when the provider is

concerned about abuse or harm to the child. See Sec. 164.502(g)(5).

Of course, a covered provider always may disclose health

information about a minor to a parent in the most important cases, even

if one of the limited exceptions discussed above apply. Disclosure of

such information is always permitted as necessary to avert a serious

and imminent threat to the health or safety of the minor. See

Sec. 164.512(j). The Privacy Rule also states that disclosure of health

information about a minor to a parent is permitted if State law

authorizes or requires disclosure to a parent, thereby allowing such

disclosure where State law determines it is appropriate. See

Sec. 160.202, definition of ``more stringent.'' Finally, health

information about the minor may be disclosed to the parent if the minor

involves the parent in his or her health care and does not object to

such disclosure. See Secs. 164.502(g)(3)(i) and 164.510(b). The parent

will retain all rights concerning any other health information about

his or her minor child that does not meet one of the exceptions.

Rationale for Privacy Rule's Provisions Regarding Parents and Minors

The Department continues to balance multiple goals in developing

standards in the Privacy Rule with respect to parents and minors.

First, the standards need to operate in a way that facilitates access

to quality health care. This is an overarching goal throughout the

Privacy Rule and is equally important here. Thus, the Department wants

to ensure that parents have appropriate access to the health

information about their minor children to make important health care

decisions about them. The Department also wants to make sure that the

Privacy Rule does not interfere with a minor's ability to consent to

and obtain health care under current State or other applicable law.

Second, the Department does not want to interfere with State or other

applicable laws related to competency or parental rights, in general,

or the role of parents in making health care decisions about their

minor children, in particular. Third, the Department does not want to

interfere with the professional requirements of State medical boards or

other ethical codes of health care providers with respect to

confidentiality of health information or health care practices of such

providers with respect to adolescent health care.

As a result of these competing goals, the Department's approach

continues to be that the standards, implementation specifications, and

requirements with respect to parents and minors defer to, and are

consistent with, State or other applicable law and professional

practice. Where State and other applicable law is silent, the

Department has attempted to create standards that are consistent with

such laws and that permit States the discretion to continue to decide

the rights of parents and minors with respect to health information

without interference from the federal Privacy Rule.

Public Comments

Since December 2000, the Department has heard concerns about the

impact of the Privacy Rule on both parental and minor rights.

Physicians and other health care professionals who treat adolescents

support the existing provisions in the Privacy Rule. These commenters

assert that these provisions allow health care providers to deliver

care in a manner consistent with their ethical and legal obligations,

and that they strike the appropriate balance by permitting providers to

render confidential care to minors in limited circumstances, while

providing States

[[Page 14792]]

the ultimate discretion to determine the extent of parents' access to

information.

Other commenters oppose the Privacy Rule on the grounds that the

Privacy Rule unduly interferes with parental rights to control health

care for their minor children and to access health information about

their minor children. They assert that failure to provide parents with

access to all health information about their minor children could

result in negative health outcomes because parents could be making

health care decisions for their children based on incomplete

information.

Finally, some commenters believe, incorrectly, that the Privacy

Rule creates new rights for minors to consent to treatment. The

Department issued guidance to clarify that the Privacy Rule does not

address access to treatment or the ability to consent to treatment. It

is State or other applicable law, and not the Privacy Rule, that

governs who can consent to treatment. The Privacy Rule does not in any

way alter the ability of a parent to consent to health care for a minor

child or the ability of a minor child to consent to his or her own

health care.

Proposed Modifications

The Department has reassessed the parents and minors provisions in

the Privacy Rule, and does not propose to change its approach. The

Department will continue to defer to State or other applicable law and

to remain neutral and preserve the status quo to the extent possible.

However, the Department is proposing changes to these standards where

they do not operate as intended and are inconsistent with the

Department's underlying goals.

The Privacy Rule accomplishes the goals of deferring to State law

and preserving the status quo when State law is definitive, that is,

when State law requires or prohibits disclosure or access. However,

when State law provides discretion or is silent, the Privacy Rule may

not always accomplish these goals. In particular, the Department has

identified two areas in which the standard does not work as intended.

First, the language regarding deference to State law that authorizes or

prohibits disclosure of health information about a minor to a parent

fails to assure that State law governs when the law grants a provider

discretion to disclose protected health information to a parent in

certain circumstances. Second, the Privacy Rule may prohibit parental

access in cases where State law is silent, but where a parent could get

access today, consistent with State law.

First, in order to assure that State and other applicable laws that

address disclosure of health information about a minor to his or her

parent govern in all cases, the Department proposes to move the

relevant language about the disclosure of health information from the

definition of ``more stringent'' (see Sec. 160.202) to the standards

regarding parents and minors (see Sec. 164.502(g)(3)). This change

would make it clear that State and other applicable law governs not

only when a State explicitly addresses disclosure of protected health

information to a parent but also when such law provides discretion to a

provider.

The language itself is also changed in the proposal to adapt it to

the new section. The proposed language in Sec. 164.502(g)(3)(ii) states

that a covered entity may disclose protected health information about a

minor to a parent if an applicable provision of State or other law,

including applicable case law, permits or requires such disclosure, and

that a covered entity may not disclose protected health information

about a minor to a parent if an applicable provision of State or other

law, including applicable case law, prohibits such disclosure. This new

language would help clarify when disclosure of health information about

a minor to his or her parent is permitted or prohibited based on State

or other law. The revision would also clarify that the deference to

State or other applicable law includes deference to established case

law as well as an explicit provision in a statute or regulation.

Second, the Department proposes to add a new paragraph (iii) to

Sec. 164.502(g)(3) to establish a neutral policy regarding the right of

access of a parent to health information about a minor under

Sec. 164.524, in the rare circumstance in which the parent is

technically not the personal representative of the minor under the

Privacy Rule. This policy would apply particularly where State or other

law is silent or unclear. The new paragraph would not change the right

of access, but would simply provide that the person who can exercise

the right of access to health information under the Privacy Rule must

be consistent with State or other applicable law. It would assure that

the Privacy Rule would not prevent a covered entity from providing such

access, in accordance with the Privacy Rule, to a parent, as if a

personal representative of the minor child, if access would be

consistent with State or other applicable law.

This modification also would not affect a parent's right of access

under the Privacy Rule in the vast majority of cases where the parent

is the personal representative of the minor. In those cases, the parent

could exercise the right of access in accordance with the Privacy Rule.

This provision would be relevant only in the rare exceptions in which

the parent is not the personal representative of the minor.

The Department proposes to use the phrase ``consistent with State

or other applicable law'' with regard to access in the personal

representatives section of the Privacy Rule. This is different than the

proposed language in the section about personal representatives that

relates to disclosures, in which a disclosure to a parent is permitted

if such disclosure is permitted or required by an ``applicable

provision of State or other law, including applicable case law.'' The

language in the disclosure paragraphs requires an explicit law for such

disclosure to be permitted by the Privacy Rule. The language in the

access paragraphs permits parental access in accordance with the

Privacy Rule if such access is consistent with State or other law,

regardless of whether such law is explicit. Therefore, if a State

permits a minor to obtain care without the consent of a parent, but is

silent as to whether the parent can access the related medical records

of the minor, as is typically the case, then the provider may provide

access to the parent if such access is consistent with State law and

could deny access to the parent if such denial of access is consistent

with State law. This may be based on interpretation of State consent

law or may be based on other law. The provider could not, however,

abuse this provision to deny access to both the parent and the minor.

This provision would not significantly change the operation of the

Privacy Rule with respect to parental access. In cases where the parent

is not the personal representative of the minor under the Privacy Rule,

the proposed language would not require a provider to grant access to a

parent. In these cases, a provider would have discretion to provide

access to a parent when permitted to do so under State or other

applicable law despite the ability of the minor to obtain health care

confidentially or without parental consent under applicable law or

professional practice. The Department further assumes that current

professional health care provider practices with respect to access by

parents and confidentiality of minor's records are consistent with

State and other applicable law. In any event, parental access under

this section would continue to be subject to any relevant limitations

on access in

[[Page 14793]]

Sec. 164.524. This proposed change provides States with the option of

clarifying the interaction between their consent laws and the ability

for parents to have access to the health information about the care

that their minor children received in accordance with such laws. As

such, this change should more accurately reflect current State law.

G. Uses and Disclosures for Research Purposes

1. Institutional Review Board (IRB) or Privacy Board Approval of a

Waiver of Authorization

Much of the biomedical and behavioral research conducted in the

U.S. is governed either by the rule entitled ``Federal Policy for the

Protection of Human Subjects'' (the ``Common Rule'') and/or the Food

and Drug Administration's (FDA) human subject protection regulations.

Although these regulatory requirements, which apply to federally-funded

and to some privately-funded research, include protections to help

ensure the privacy of subjects and the confidentiality of information,

the intent of the Privacy Rule, among other things, is to supplement

these protections by requiring covered entities to implement specific

measures to safeguard the privacy of individually identifiable health

information.

The Common Rule applies to all human research that is supported,

conducted, or regulated by any of the seventeen federal agencies that

have adopted the Common Rule, including research that uses individually

identifiable health information. FDA's human subject protection

regulations generally apply to clinical investigations under FDA's

jurisdiction, whether or not such research is federally funded. Both

sets of regulations have requirements relating to review by an

institutional review board (IRB) to ensure that the risks to research

participants, including privacy risks, are minimized. As part of this

review, generally, IRBs must consider the informed consent document

that will be used to inform prospective research participants about the

study. Both the Common Rule and FDA regulations have provisions

relating to the waiver of informed consent. The Common Rule waiver

provisions allow research covered by the Common Rule to be conducted if

an IRB determines that certain criteria specified in the Common Rule

have been met. FDA's regulations do not contain equivalent waiver

provisions since the criteria for a waiver of informed consent are

generally not appropriate for clinical research. However, FDA's human

subject protection regulations contain exceptions to informed consent

for emergency research and for the emergency use of an investigational

product.

The Common Rule and FDA's regulations explicitly address privacy

and confidentiality in the following places: (1) The informed consent

document is required to include ``a statement describing the extent, if

any, to which confidentiality of records identifying the subject will

be maintained'' (Common Rule Sec. ____.116(a)(5), 21 CFR 50.25(a)(5));

and (2) to approve a study an IRB must determine that ``when

appropriate, there are adequate provisions to protect the privacy of

subjects and to maintain the confidentiality of data'' (Common Rule

Sec. ____.111(a)(7), 21 CFR 56.111(a)(7)).

Privacy Rule

The Privacy Rule builds upon these existing federal regulations.

The requirements are intended to strike a balance by minimizing the

privacy risks of research participants, while not impeding the conduct

of vital national and international research. For research

participants, this means that they will have more information about how

their protected health information may be used for research purposes.

The Privacy Rule requires researchers who are subject to the Common

Rule or FDA's human subject protection regulations to make some changes

to the way they use and disclose protected health information.

Researchers who are not currently subject to these requirements may,

however, need to make more significant changes to current practice.

The Privacy Rule at Secs. 164.508 and 164.512(i) establishes the

conditions under which covered entities may disclose protected health

information for research purposes. In general, covered entities are

permitted to use or disclose protected health information for research

either with individual authorization, or without individual

authorization in limited circumstances and under certain conditions.

A covered entity is permitted to use and disclose protected health

information for research purposes with an authorization from the

research participant that meets the requirements of Sec. 164.508 of the

Privacy Rule. Additional requirements apply to research that is not

solely record-based but, rather, involves the treatment of individuals.

Specifically, in order for a covered entity to use or disclose

protected health information that it creates from a research study that

includes treatment of individuals (e.g., a clinical trial), the Privacy

Rule at Sec. 164.508(f) requires that additional research-specific

elements be included in the authorization form, which describes how

protected health information created for the research study will be

used or disclosed. The Privacy Rule provides that such an authorization

pursuant to Sec. 164.508(f) may be combined with the traditional

informed consent document used in research, as well as the consent

required under Sec. 164.506 and the notice of privacy practices

required under Sec. 164.520. In addition, a covered entity is permitted

to condition the provision of the research-related treatment on the

individual's authorization for the covered entity to use and disclose

protected health information created from the study. The Privacy Rule,

however, does not permit an individual authorization form for a

research use or disclosure of existing protected health information to

be combined with a research informed consent document or an

authorization form for research that involves treatment.

Alternatively, a covered entity is permitted to use or disclose

protected health information for research purposes without

authorization by the research participant if the covered entity first

obtains either of the following:

Documentation of approval of a waiver of authorization

from an IRB or a Privacy Board. The Privacy Rule delineates specific

requirements for the elements that must be documented, including the

Board's determinations with respect to eight defined waiver criteria.

Where a review is conducted preparatory to research or

where research is conducted on decedent's information, certain

representations from the researcher, including that the use or

disclosure is sought solely for such a purpose and that the protected

health information is necessary for the purpose.

Public Comment

A number of commenters argued that the waiver criteria in the

Privacy Rule were confusing, redundant, and internally inconsistent.

These commenters urged the Department to simplify the provisions,

especially for entities subject to both the Privacy Rule and the Common

Rule. Consequently, these commenters recommended that the Privacy Rule

be modified to allow protected health information to be used or

disclosed for research without individual authorization if informed

consent is obtained as stipulated by the Common Rule or FDA's human

subject protection regulations, or waived as

[[Page 14794]]

stipulated by the Common Rule. Commenters who favored these changes

asserted that the existing federal human subject protection regulations

adequately protect all of the rights and welfare of human subjects, and

therefore, the Privacy Rule's provisions are unnecessary and

duplicative for research currently governed by federal regulations.

These commenters also argued that the Privacy Rule's waiver criteria

and requirements for individual authorization, in effect,

inappropriately modify the Common Rule, since the Privacy Rule

prohibits covered entities from honoring an IRB's decisions unless the

Privacy Rule's requirements are met. Some of these commenters further

suggested that the confidentiality provisions of the Common Rule and

FDA's human subject protection regulations be reviewed to determine if

they adequately protect the privacy of research participants, and if

found to be inadequate, these regulations should be modified.

The Department understands commenters' recommendations to simplify

the Privacy Rule as it applies to research. However, as stated in the

preamble to the Privacy Rule and the Department's July 6 guidance, the

Department disagrees that the Privacy Rule will modify the Common Rule.

The Privacy Rule regulates only the content and conditions of the

documentation that covered entities must obtain before using or

disclosing protected health information for research purposes.

The NCVHS also heard a number of concerns and confusion in

testimony at the August 2001 hearing regarding the research provisions

in the Privacy Rule. As a result, the NCVHS generally recommended that

the Department provide additional guidance in this area. Consistent

with this recommendation, the HHS Office for Civil Rights and the HHS

Office for Human Research Protections intend to work together to

provide interpretations, guidance, and technical assistance to help the

research community in understanding the relationship between the

Privacy Rule and the Common Rule.

The NCVHS also received testimony requesting that uses and

disclosures of protected health information for research be

characterized as an element of treatment, payment, and health care

operations under the Privacy Rule, and thus be permitted without

individual authorization. The NCVHS, in their recommendations to the

Department, disagreed with this viewpoint, and expressed support for

the policy embodied in the Privacy Rule, permitting uses and

disclosures for research pursuant to an authorization or an IRB or

Privacy Board waiver of authorization.

In addition, the NCVHS received testimony regarding the issue of

recruiting research subjects. Commenters expressed concern and

confusion as to how researchers would be able to recruit research

subjects when the Privacy Rule does not permit protected health

information to be removed from the covered entity's premises during

reviews preparatory to research. The NCVHS recommended that the

Department provide guidance on this issue. The Department clarifies

that the Privacy Rule's provisions for IRB or Privacy Board waiver of

authorization are intended to encompass a partial waiver of

authorization for the purposes of allowing a researcher to obtain

protected health information necessary to recruit potential research

participants. For example, even if an IRB does not waive informed

consent and individual authorization for the study itself, it may waive

such authorization to permit the disclosure of protected health

information to a researcher as necessary for the researcher to be able

to contact and recruit individuals as potential research subjects.

Many researchers also expressed concerns that the Privacy Rule's

de-identification safe harbor was so strict that it would result in

more research being subject to IRB review than is currently the case.

These commenters requested that the standards for de-identification be

changed in order to make de-identification a more plausible option for

the sharing of data with researchers.

The Privacy Rule's de-identification safe harbor was not designed

to be used for research purposes. Rather, the Privacy Rule permits uses

and disclosures of protected health information for research purposes

with individual authorization, or pursuant to an IRB or Privacy Board

waiver of authorization as permitted by Sec. 164.512(i). The Department

is aware, however, that some research is conducted today without IRB

oversight because the information is not facially identifiable. While

the Department is not convinced of the need to modify the safe harbor

standard for de-identified information, the Department is requesting

comment on an alternative approach that would permit uses and

disclosures of a limited data set for research purposes which does not

include facially identifiable information but in which certain

identifiers remain. See section III.I of the preamble regarding de-

identification of protected health information for a detailed

discussion of this proposed approach.

A number of commenters were concerned about the Privacy Rule's

requirement for ``a statement of the individual's right to revoke the

authorization in writing and the exceptions to the right to revoke * *

*'', because this provision would prohibit researchers from analyzing

the data collected prior to the individual's decision to revoke his or

her authorization. The Department is not proposing to modify this

provision. The Privacy Rule limits an individual's right to revoke his

or her authorization by the extent to which the covered entity has

taken action in reliance on the authorization. Therefore, even though a

revocation will prohibit a covered entity from further disclosing

protected health information for research purposes, the exception to

this requirement is intended to allow for certain continued uses of the

information as appropriate to preserve the integrity of the research

study, e.g., as necessary to account for the individual's withdrawal

from the study.

The Department believes that researchers have established practices

for accommodating an individual's decision to withdraw from a research

study. Indeed, the Common Rule at Sec. ____46.116 and FDA's human

subject protection regulations at 21 CFR 50.25(a)(8) contain similar

provisions that require the informed consent document include a

statement that ``* * * the subject may discontinue participation at any

time without penalty or loss of benefits to which the subject is

otherwise entitled.'' However, the Department understands that these

practices may not be uniform and may vary depending on the nature of

the research being conducted, with respect to the continued use or

disclosure of data collected prior to the participant's withdrawal. If

covered entities were permitted to continue using or disclosing

protected health information for the research project even after an

individual had revoked his or her authorization, this would undermine

the primary objective of the authorization requirements to be a

voluntary, informed choice of the individual. The Department believes

that limiting uses and disclosures following revocation of an

authorization to those necessary to preserve the integrity of the

research appropriately balances the individual's right of choice and

the researcher's reliance on the authorization. However, the Department

solicits comment on other means of achieving this balance.

[[Page 14795]]

Specific comments, including testimony to the NCVHS, are addressed

below where relevant to the corresponding proposed modifications to the

Privacy Rule.

Proposed Modifications to Waiver Criteria

The Department understands commenters' concerns that several of the

Privacy Rule's criteria for the waiver of a research participant's

authorization are confusing and redundant, or inconsistent and

conflicting with the Common Rule's requirements for the waiver of an

individual's informed consent. However, since the Common Rule's

criteria for the waiver of informed consent do not explicitly require

IRBs to consider issues related to the privacy of prospective research

participants, the Department disagrees with the recommendation to

exempt from the Privacy Rule research uses and disclosures that are

made with a waiver of informed consent pursuant to the Common Rule.

In response to commenter concerns, the Department proposes the

following modifications to the waiver criteria to maintain uniform

standards in the Privacy Rule for all research, whether or not the

research is subject to the Common Rule, as well as to ensure that the

Privacy Rule's waiver process works more seamlessly with the Common

Rule's waiver process. The Department, in reassessing the waiver

criteria defined by the Common Rule, believes that only two of the

Common Rule waiver criteria are practicable when focused solely on

patient privacy. Accordingly, the Department proposes to retain the

following two criteria in the Privacy Rule that are comparable to two

of the Common Rule criteria: (1) The use or disclosure of protected

health information involves no more than a minimal risk to the privacy

of individuals; and (2) the research could not practicably be conducted

without the waiver or alteration. The criterion in the Common Rule to

determine that the rights and welfare of subjects will not adversely be

affected, when limited to privacy, seems to conflict with the criterion

regarding assessing minimal privacy risk; it is not clear how both

criteria can be met when the focus is solely on privacy. The Department

therefore proposes to delete the criterion in the Privacy Rule that the

alteration or waiver will not adversely affect the privacy rights and

the welfare of the individuals.

Moreover, the Department understands commenters' concerns that

substantial overlap and potential inconsistency may exist among three

of the Privacy Rule's criteria and the criterion that the use or

disclosure involves no more than a minimal risk to the individuals. The

Department believes that the three criteria in the Privacy Rule that

focus on (1) plans to protect identifiers from improper use and

disclosure, (2) plans to destroy the identifiers at the earliest

opportunity, and (3) adequate written assurances against redisclosure,

essentially help to define when the research use or disclosure poses

only a minimal risk to the individual's privacy interests, rather than

operate as stand-alone criteria. As such, the Department proposes to

require the assessment of these three factors as part of the waiver

criterion for assessment of minimal privacy risk. This provision does

not preclude the IRB or Privacy Board from assessing other criteria as

necessary to determine minimal privacy risk, e.g., whether the

safeguards included in the protocol are appropriate to the sensitivity

of the data.

In addition, the Department agrees with commenters that the

following waiver criterion is unnecessarily duplicative of other

provisions to protect patients' confidentiality interests, and

therefore, proposes to eliminate it: the privacy risks to individuals

whose protected health information is to be used or disclosed are

reasonable in relation to the anticipated benefits, if any, to the

individual, and the importance of the knowledge that may reasonably be

expected to result from the research.

Lastly, the Department proposes to retain the criterion that the

research could not practicably be conducted without access to and use

of the protected health information. The Privacy Rule permits a covered

entity to reasonably rely on a researcher's documentation of approval

of these waiver criteria, and a description of the data needed for the

research as approved by an IRB or Privacy Board, to satisfy it's

obligation with respect to limiting the disclosure to the minimum

necessary.

In sum, the Department proposes that the following wavier criteria

replace the waiver criteria listed in the Privacy Rule at

Sec. 164.512(i)(2)(ii):

(1) The use or disclosure of protected health information involves

no more than a minimal risk to the privacy of individuals, based on, at

least, the presence of the following elements:

(a) an adequate plan to protect the identifiers from improper use

and disclosure;

(b) an adequate plan to destroy the identifiers at the earliest

opportunity consistent with conduct of the research, unless there is a

health or research justification for retaining the identifiers or such

retention is otherwise required by law; and

(c) adequate written assurances that the protected health

information will not be reused or disclosed to any other person or

entity, except as required by law, for authorized oversight of the

research project, or for other research for which the use or disclosure

of protected health information would be permitted by this subpart;

(2) The research could not practicably be conducted without the

waiver or alteration; and

(3) The research could not practicably be conducted without access

to and use of the protected health information.

The Department believes that the proposed modifications to the

waiver criteria in the Privacy Rule would eliminate both the

redundancies in the waiver criteria and the conflicts these provisions

pose to research conducted pursuant to the Common Rule.

2. Research Authorizations

Several commenters argued that certain authorization requirements

in the Privacy Rule at Sec. 164.508 are problematic as applied to

research uses and disclosures. Generally, commenters raised concerns

that the requirements for individual authorization for uses and

disclosures for research purposes are unduly complex and burdensome. In

response to these concerns, the Department proposes to make a number of

modifications to simplify the authorization requirements, both

generally and in certain circumstances as they specifically apply to

uses and disclosures of protected health information for research. The

discussion below focuses on the proposed modifications specific to uses

and disclosures for research. See section III.H of the preamble for a

discussion of the Department's general proposal to modify the Privacy

Rule's authorization requirements.

In particular, the Department proposes a single set of requirements

that generally apply to all types of authorizations, including those

for research purposes. This modification would eliminate the specific

provisions at Sec. 164.508(f) for authorizations for uses and

disclosures of protected health information created for research that

includes treatment of the individual. As a result, an authorization for

such purposes would not require any additional elements above and

beyond those required for authorizations in general at Sec. 164.508(c).

To conform to this proposed change, the Department also proposes to

modify the requirements for prohibiting

[[Page 14796]]

conditioning of authorizations at Sec. 164.508(b)(4)(i) to remove the

reference to Sec. 164.508(f). A covered health care provider, thus,

would be able to condition the provision of research-related treatment

on provision of an authorization for the use and disclosure of

protected health information for the particular research study.

Additionally, the Department proposes to modify

Sec. 164.508(b)(3)(i) to reflect its intent to eliminate the special

authorization requirements for research studies that involve treatment

in Sec. 164.508(f), as well as to clarify that the Privacy Rule would

allow an authorization for the use or disclosure of protected health

information for research to be combined with any other legal permission

related to the research study, including another authorization or

consent to participate in the research. The Department heard from

several provider groups who thought the authorization provisions as

they relate to research to be too complex. These commenters argued in

favor of permitting covered entities to combine all of the research

authorizations required by the Privacy Rule with the informed consent

to participate in research. To simplify the requirements in response to

these concerns, the Department proposes to modify the Privacy Rule to

allow for the combining of such permissions.

Finally, the Department proposes to include provisions specific to

authorizations for research within the core element proposed at

Sec. 164.508(c)(1)(v) for an expiration date or an expiration event

that relates to the individual or the purpose of the use or disclosure.

First, the Department proposes to explicitly provide that the statement

``end of the research study'' or similar language is sufficient to meet

this requirement for an expiration date or event where the

authorization is for a use or disclosure of protected health

information for research. This modification is proposed in response to

commenter concerns that the particular end date of a research study may

not be known and questions regarding whether the end of a research

study is an ``event''. In addition, such a statement would also be

sufficient to encompass additional time, even after the conclusion of

the research, to allow for the use of protected health information as

necessary to meet record retention requirements to which the researcher

is subject. The Department, therefore, proposes to clarify that

including such a statement on the research authorization would fulfill

the requirement to include an expiration event.

Similarly, the Department proposes to explicitly provide that the

statement ``none'' or similar language is sufficient to meet this

provision if the authorization is for a covered entity to use or

disclose protected health information for the creation or maintenance

of a research database or repository. The Department proposes this

modification in response to commenter concerns that the Privacy Rule's

requirement for an ``expiration date or an expiration event that

relates to the individual or the purpose of the use or disclosure''

will create a significant obstacle for the development of research

databases or repositories. Commenters stated that research databases

and repositories are often retained indefinitely, and the requirement

that an authorization include an expiration date or event was found to

be counter to the purpose of developing such research resources. The

Department understands these concerns and, therefore, proposes to

permit an individual's authorization to use or disclose protected

health information for the creation and maintenance of a research

database or repository to be valid without an expiration date or event.

The Department emphasizes that this provision is intended to apply only

in the limited circumstances where a use or disclosure is sought solely

for the creation or maintenance of a database or repository, and does

not extend to authorizations for further research or any other purpose.

Therefore, subsequent research using the information maintained in the

database or repository pursuant to an authorization would require that

the authorization include the term ``end of the research study'' or

other explicit expiration date or event.

3. Research Transition Provisions

The Privacy Rule includes at Sec. 164.532 different transition

requirements for research that includes treatment (i.e., clinical

trials) and for research that does not include treatment (i.e., records

research). For research that includes treatment, the Privacy Rule

states that as long as legal permission was obtained to use or disclose

protected health information for a specific research project, that

legal permission will continue to be valid until the completion of the

research project; a new permission will not be required to use or

disclose protected health information that was created or received

either before or after the compliance date. However, for research that

does not include treatment, a legal permission obtained before the

compliance date will only be valid for the use and disclosure of

protected health information obtained before the compliance date. The

Privacy Rule does not prescribe the form of the express legal

permission in either case. Express legal permission could be a signed

agreement by the individual to participate in a privately-funded

research study.

The Privacy Rule does not explicitly address transition provisions

for research studies ongoing after the compliance date where the legal

permission of the individual had not been sought. This point was noted

by several of those who commented on the Privacy Rule's transition

provisions as they apply to research. Some of these commenters

recommended that the Privacy Rule be revised to grandfather in the

research use and disclosure of all protected health information that

existed prior to the compliance date. These commenters expressed

concern that much data would be lost to the research community since it

would often be infeasible or impossible to obtain individuals'

permission to use this archival information.

Given the confusion about the transition provisions and to assure

that ongoing, vital research will not be impeded, the Department

reassessed the relevant provisions and proposes that there be no

distinction between research that includes treatment and research that

does not, and no distinction between requirements for research

conducted with patients' informed consent versus research conducted

with an IRB-approved waiver of patients' informed consent. Therefore,

the Department proposes to permit a covered entity to use or disclose

for a specific research study protected health information that is

created or received either before or after the compliance date (if

there is no agreed-to restriction in accordance with Sec. 164.522(a)),

if the covered entity has obtained, prior to the compliance date an

authorization or other express legal permission from an individual to

use or disclose protected health information for the research study. In

addition, the Department proposes to grandfather in research in which

the individual has signed an informed consent to participate in the

research study, or an IRB has waived informed consent for the research

study, in accordance with the Common Rule or FDA's human subject

protection regulations.

These proposed provisions are intended to apply once any of the

permissions described above has been granted, regardless of whether the

[[Page 14797]]

research study actually has begun by the compliance date or not,

provided that the permission was obtained prior to the compliance date.

In addition, with respect to the informed consent of the individual,

the Department proposes not to limit the transition provisions to an

informed consent pursuant to the Common Rule, but rather intends to

allow for the transition of an informed consent for privately-funded

research. Research studies that do not obtain such express legal

permission, informed consent, or IRB waiver prior to the compliance

date must obtain either authorization, as required by Sec. 164.508, or

a waiver of authorization from an IRB or Privacy Board, as required by

Sec. 164.512(i).

H. Uses and Disclosures for Which Authorization Is Required

The Privacy Rule permits covered entities to use and disclose

protected health information for treatment, payment, and health care

operations (subject to the individual's consent, if applicable) and as

necessary for public policy purposes, such as public health and safety,

health oversight activities, and enforcement. Covered entities must

obtain an individual's voluntary and informed authorization before

using or disclosing protected health information for any purpose that

is not otherwise permitted or required under the Privacy Rule.

The Privacy Rule provides for the individual's voluntary

authorization for uses and disclosure of his or her protected health

information by prohibiting, with very limited exceptions, covered

entities from conditioning treatment, payment, or eligibility for

benefits or enrollment in a health plan, on obtaining an authorization.

Furthermore, in Sec. 164.508(b)(5), the Privacy Rule permits

individuals, with limited exceptions, to revoke an authorization at any

time. These provisions are intended to prevent covered entities from

coercing individuals into signing an authorization that is not

necessary for their health care.

To help ensure that individuals give their authorization for the

use or disclosure of their protected health information on an informed

basis, the Privacy Rule, under Sec. 164.508(c), sets out core elements

that must be included in any authorization. These core elements are

intended to provide individuals with information needed to make an

informed decision about giving their authorization. This information

includes specific details about the use or disclosure, as well as

providing the individual fair notice about his or her rights with

respect to the authorization and the potential for the information to

be redisclosed. The Privacy Rule requires authorizations to provide

individuals with additional information for specific circumstances

under the following three sets of implementation specifications: in

Sec. 164.508(d), for authorizations requested by a covered entity for

its own uses and disclosures; in Sec. 164.508(e), for authorizations

requested by a covered entity for disclosures by others; and in

Sec. 164.508(f), for authorizations for research that includes

treatment of the individual. Additionally, the authorization must be

written in plain language so individuals can understand the information

presented in the authorization.

Public Comments

The Department received a number of comments raising various issues

regarding implementation of the authorization requirements. A majority

of commenters said the authorization provisions of the Privacy Rule are

too complex and confusing. Some commented that the sets of

implementation specifications are not discrete, creating the potential

for the implementation specifications for specific circumstances to

conflict with the required core elements. Others expressed confusion

generally about which authorization requirements they would be required

to implement.

Commenters also have raised concerns about the revocation

provisions in Sec. 164.508(b)(5). The Privacy Rule provides an

exception to the individual's right to revoke an authorization where

the authorization is obtained as a condition of obtaining insurance

coverage, or where other law provides the insurer the right to contest

a claim under the policy. The Department intended this provision to

permit insurers to obtain necessary protected health information during

contestability periods under State law. For example, an individual may

not revoke an authorization for the disclosure of protected health

information to a life insurer for the purpose of investigating material

misrepresentation if the individual's policy is still subject to the

contestability period. However, commenters were concerned because other

law also provides the insurer with the right to contest the policy

itself, not just a claim under the policy, and the Privacy Rule does

not provide an explicit exception to allow for this right.

Proposed Modifications

In response to these concerns, the Department is proposing

modifications to the Privacy Rule to simplify the authorization

provisions, while preserving the provisions for ensuring that

authorizing the use or disclosure of protected health information is a

voluntary and informed decision. The Department proposes to consolidate

the implementation specifications into a single set of criteria to

simplify these provisions, prevent confusion, and eliminate the

potential for conflicts between the authorization requirements.

Thus, under the proposed modifications, the specifications for the

elements and requirements of an authorization would be consolidated

under Sec. 164.508(c). Paragraphs (d), (e), and (f) in this section

would be eliminated. Paragraph (c)(1) would require all authorizations

to contain the following core elements: (1) A description of the

information to be used or disclosed, (2) the identification of the

persons or class of persons authorized to make the use or disclosure of

the protected health information, (3) the identification of the persons

or class of persons to whom the covered entity is authorized to make

the use or disclosure, (4) a description of each purpose of the use or

disclosure, (5) an expiration date or event, (6) the individual's

signature and date, and (7) if signed by a personal representative, a

description of his or her authority to act for the individual. The

Department also proposes to add new language to clarify that when the

individual initiates the authorization for his or her own purposes, the

purpose may be described as ``at the request of the individual.'' Thus,

individuals would not have to reveal the purpose of the requested

disclosure if they chose not to do so.

Paragraph (c)(2) would require authorizations to contain the

following notifications: (1) A statement that the individual may revoke

the authorization in writing, and either a statement regarding the

right to revoke, and instructions on how to exercise such right, or to

the extent this information is included in the covered entity's notice,

a reference to the notice, (2) a statement that treatment, payment,

enrollment, or eligibility for benefits may not be conditioned on

obtaining the authorization if such conditioning is prohibited by the

Privacy Rule, or, if conditioning is permitted by the Privacy Rule, a

statement about the consequences of refusing to sign the authorization,

and (3) a statement about the potential for the protected health

information to be subject to redisclosure

[[Page 14798]]

by the recipient. The Department also proposes to limit the requirement

that a covered entity disclose any remuneration that will result from

obtaining an authorization, to authorizations for marketing purposes.

Therefore, the remuneration disclosure requirement appears only in the

new Sec. 164.508(a)(3) on marketing authorizations. These modifications

would permit covered entities to use a single authorization form, and

make it easier to use for the individual and the covered entity, as

well as third parties.

The Department also proposes to add language to the revocation

exceptions in Sec. 164.508(b)(5)(ii) to include an exception with

respect to the insurer's right to contest the policy under other law.

This proposed modification would recognize, without expanding upon, an

insurer's right to contest the policy under existing law.

Other proposed modifications concerning authorizations for research

are discussed in section III.G of the preamble.

Finally, the Department proposes a number of technical conforming

modifications throughout this section of the Privacy Rule to

accommodate the modifications to this section, as well as the proposed

modifications to the consent provision. Specifically, the Department

proposes to modify the exception to the minimum necessary standard in

the Privacy Rule at Sec. 164.502(b)(2), which exempts from the standard

uses or disclosures made pursuant to an authorization under

Sec. 164.508, except for authorizations requested by the covered entity

under Sec. 164.508(d), (e), or (f). By simplifying the authorization

requirements, the proposed modifications described above would

eliminate the special authorizations required by Sec. 164.508(d), (e),

or (f) in the Privacy Rule. To be consistent with the proposed

approach, the Department proposes to eliminate the reference to such

authorizations in the exception at Sec. 164.502(b)(2), thereby

expanding the exception to exempt from the minimum necessary standard

uses and disclosures made pursuant to an authorization for any purpose.

The Department also proposes modifications at

Secs. 164.508(a)(2)(i)(A), (B), and (C) to place limits on the use and

disclosure of psychotherapy notes without authorization to carry out

treatment, payment or health care operations. The modifications clarify

that this information is not permitted to be used or disclosed without

individual authorization for purposes of another entity.

The Department proposes to delete Sec. 164.508(b)(4)(iii), relating

to a health plan conditioning payment of a claim on the provision of an

authorization, since this provision will be rendered moot under the

proposed modifications to the consent provision. Additionally, the

Department proposes to delete Sec. 164.508(b)(2)(iv) of the Privacy

Rule, because it is redundant with Sec. 164.508(b)(1)(i), and to modify

Sec. 164.508(b)(1)(i) to clarify that an authorization is valid only if

it meets the requirements of paragraphs (c)(1) and (c)(2).

Modifications are also proposed at Sec. 164.508(b)(1)(v) of the Privacy

Rule (newly designated as Sec. 164.508(b)(2)(iv) in the proposed Rule)

to clarify that an authorization that violates paragraph (b)(4)

(prohibiting the conditioning of authorizations) is not a valid

authorization.

These proposed modifications also expressly provide that an

authorization is needed for purposes of marketing. See section III.G of

the preamble for a detailed discussion of the proposed modifications

regarding marketing.

I. De-Identification of Protected Health Information

At Sec. 164.514(a)-(c), the Privacy Rule permits a covered entity

to de-identify protected health information so that such information

may be used and disclosed freely, without being subject to the Privacy

Rule's protections. Health information is de-identified, or not

individually identifiable, under the Privacy Rule, if it does not

identify an individual and if the covered entity has no reasonable

basis to believe that the information can be used to identify an

individual. In order to meet this standard, the Privacy Rule provides

two alternative methods for covered entities to de-identify protected

health information.

First, a covered entity may demonstrate that it has met the

standard if a person with appropriate knowledge and experience applying

generally acceptable statistical and scientific principles and methods

for rendering information not individually identifiable makes and

documents a determination that there is a very small risk that the

information could be used by others to identify a subject of the

information. The preamble to the Privacy Rule refers to two government

reports that provide guidance for applying these principles and

methods, including describing types of techniques intended to reduce

the risk of disclosure that should be considered by a professional when

de-identifying health information. These techniques include removing

all direct identifiers, reducing the number of variables on which a

match might be made, and limiting the distribution of records through a

``data use agreement'' or ``restricted access agreement'' in which the

recipient agrees to limits on who can use or receive the data.

Alternatively, covered entities may choose to use the Privacy

Rule's safe harbor method for de-identification. Under the safe harbor

method, covered entities must remove all of a list of 18 enumerated

identifiers and have no actual knowledge that the information remaining

could be used alone or in combination to identify a subject of the

information. The identifiers that must be removed include direct

identifiers, such as name, street address, social security number, as

well as other identifiers, such as birth date, admission and discharge

dates, and five-digit zip code. The safe harbor does allow for the

disclosure of all geographic subdivisions no smaller than a State, as

well as the initial three digits of a zip code if the geographic unit

formed by combining all zip codes with the same initial three digits

contains more than 20,000 people. In addition, age, if less than 90,

gender, ethnicity, and other demographic information not listed may

remain in the information. The safe harbor is intended to provide

covered entities with a simple, definitive method that does not require

much judgment by the covered entity to determine if the information is

adequately de-identified.

The Privacy Rule also allows for the covered entity to assign a

code or other means of record identification to allow de-identified

information to be re-identified by the covered entity, if the code is

not derived from or related to information about the subject of the

information, e.g., derivation of the individual's social security

number, and is not otherwise capable of being translated so as to

identify the individual. The covered entity also may not use or

disclose the code for any other purpose, and may not disclose the

mechanism, e.g., algorithm or other tool, for re-identification.

The Department is cognizant of the increasing capabilities and

sophistication of electronic data matching used to link data elements

from various sources, and from which, therefore, individuals may be

identified. Given this increasing risk to individuals' privacy, the

Department included in the Privacy Rule the above stringent standards

for determining when information may flow unprotected. The Department

also wanted the standards to be flexible enough so the Privacy Rule

would not be a disincentive for covered entities to use or disclose de-

identified

[[Page 14799]]

information wherever possible. The Privacy Rule, therefore, strives to

balance an individuals' privacy interests with providing a sufficient

level of information to make de-identified databases useful.

Public Comments

The Department heard a number of concerns from commenters regarding

the de-identification standard in the Privacy Rule. These comments

generally were raised in the context of using and disclosing

information for research, public health purposes, or for certain health

care operations. Commenters were concerned that the safe harbor method

for de-identifying protected health information was so stringent that

it required removal of many of the data elements that were essential to

their analyses for these purposes. The comments, however, demonstrated

little consensus as to which data elements were needed for such

analyses, with many commenters requesting elements, such as birth date,

neighborhood, account numbers, medical record numbers, and device

identifiers. In addition, commenters largely were silent with regard to

the feasibility of using the Privacy Rule's alternative statistical

method to de-identify information. The Department is aware, however, of

a general view of covered entities that the statistical method is

beyond their capabilities.

With regard to health care operations, a number of state hospital

associations were concerned that the Privacy Rule will prevent them

from collecting patient information from area hospitals in order to

conduct and disseminate analyses that are useful for hospitals in

making decisions about quality and efficiency improvements. These

commenters explained that the Privacy Rule's stringent provisions for

de-identification would not allow for the necessary data elements to be

collected for such analyses. Specifically, commenters identified the

following critical elements that would be restricted from disclosure by

the Privacy Rule's de-identification standard: Five-digit zip code,

city, county or neighborhood; the dates on which the injury or illness

was treated and the patient released from the hospital; and the month

of birth (noted by commenters as especially important for very young

children). In addition, commenters argued that the Privacy Rule's

provisions for data aggregation by a business associate, while allowing

for the collection and aggregation of identifiable data from multiple

hospitals for quality and efficiency purposes, would not allow state

hospital associations to disclose all the desired analyses back to the

contributing hospitals because some identifiers would remain in the

data. These commenters emphasized the importance to hospitals to have

access to information about community health care needs and the ability

to compare their community to others in the state so that they may

adequately respond to and fulfill such needs.

In addition, commenters identified a problem with hospitals

themselves sharing aggregated information with other hospitals for

health care operations purposes. The Privacy Rule prohibits covered

entities from disclosing protected health information for the health

care operations purposes of other covered entities. As described in

section III.A.2 of the preamble regarding Uses and Disclosures for

Treatment, Payment, and Health Care Operations, the Department is

proposing to modify this restriction and allow covered entities to

disclose protected health information for another covered entity's

health care operations under some circumstances. However, two

conditions on the sharing of individually identifiable information for

health care operations may continue to pose a problem. The proposed

modifications would condition the sharing on both entities being

covered entities and both entities having a relationship with the

individual. Hospitals wishing to exchange patient information with each

other or with other community health care providers would not satisfy

these conditions in all cases.

Many researchers expressed similar concerns, explaining that the

Privacy Rule's de-identification safe harbor was so strict that it

would result in more research being done on identifiable health

information and, thereby, being subject to IRB review than is currently

the case. Under the Common Rule, research that uses ``identifiable

private information'' must undergo IRB review. However, there is no

agreed-upon definition of ``identifiable private information'' and IRBs

determine on a case-by-case basis what constitutes ``identifiable

private information.'' Consistent with this variability, the comments

did not demonstrate consensus on what identifiers should be permitted

to be retained for research purposes.

In addition, commenters also expressed concerns with respect to

public health reporting. For example, some product manufacturers

subject to the jurisdiction of FDA were concerned that they would not

be able to operate post-marketing surveillance registries, to which

health care providers report problems. Commenters stated that even

though they do not need information with direct identifiers, the

Privacy Rule's strict de-identification standard would not allow the

reporting of useful information into the registry. Additionally, a

number of commenters described the de-identification standard as

hampering many research and health care operations activities that also

serve a public health purpose, e.g., the tracking of the emergence of

disease that could be the result of bioterrorism.

The Department also heard from some consumer advocates who

supported the elimination of barriers they believe are imposed by the

de-identification standard to important medical research. In order to

ensure privacy is protected, but at the same time not render impossible

research using de-identified information, these commenters recommended

that the Department permit the use of information for research that is

facially de-identified, i.e., stripped of direct identifiers, so long

as the research entity provides assurances that it will not use or

disclose the information for purposes other than research and will not

identify or contact the individuals who are the subjects of the

information.

Solicitation of Comment

The Department is aware of the importance of the activities

described by the commenters but is not currently convinced of the need

to modify the safe harbor standard for de-identified information.

Instead, the Department requests comment on an alternative approach

that would permit uses and disclosures of a limited data set which does

not include facially identifiable information but in which certain

identifiers would remain. The Department is not considering permitting

the disclosure of any such limited data set for general purposes, but

rather is considering permitting disclosure of such information for

research, public health, and health care operations purposes.

The limited data set would not include the following information,

which the Department considers direct identifiers: name, street

address, telephone and fax numbers, e-mail address, social security

number, certificate/license number, vehicle identifiers and serial

numbers, URLs and IP addresses, and full face photos and any other

comparable images. The limited data set would include the following

identifiable information: admission, discharge, and service dates; date

of death; age (including age 90 or over); and five-digit zip code. The

[[Page 14800]]

Department solicits comment on whether another one or more geographic

units smaller than State, such as city, county, precinct, neighborhood

or other unit, would be needed in addition to, or be preferable to,

five-digit zip code.

In addition, to address concerns raised by commenters regarding

access to birth date for research or other studies relating to young

children or infants, the Department clarifies that the Privacy Rule

does not prohibit age of an individual from being expressed as an age

in months, days, or hours. Given that the limited data set would

include all ages, including age in months, days, or hours, if

preferable, the Department requests comment on whether date of birth is

needed and, if so, whether the entire date is needed, or just the month

and year.

In addition, to further protect privacy, the Department would

propose to condition the disclosure of the limited data set on covered

entities obtaining from the recipients a data use or similar agreement,

in which the recipient would agree to limit the use of the limited data

set to the specified purposes in the Privacy Rule, and limit who can

use or receive the data, as well as agree not to re-identify the data

or contact the individuals. Commenters seemed to indicate that

recipients would be amenable to such conditions.

The Department solicits public comment on the feasibility and

acceptability of the above approach for the described purposes, and

whether or not the limitations and conditions would be sufficiently

protective of patient privacy.

Proposed Modifications

In addition to the solicitation of comment above, the Department

proposes a technical modification to the safe harbor provisions. A

number of commenters expressed confusion regarding what was believed to

be conflicting provisions within the de-identification standard.

Commenters argued that, on the one hand, the Privacy Rule treats

information as de-identified if all listed identifiers on the

information are stripped, including any unique, identifying number,

characteristic, or code. Yet, the Privacy Rule permits a covered entity

to assign a code or other record identification to the information so

that it may be re-identified by the covered entity at some later date.

The Department did not intend the re-identification code to be

considered one of the enumerated identifiers. Therefore, the Department

proposes to clarify its intent by explicitly excepting the re-

identification code or other means of record identification permitted

by Sec. 164.514(c) from the listed identifiers at

Sec. 164.514(b)(2)(i)(R).

J. Technical Corrections and Other Clarifications

In addition to the modifications described above, the Department

proposes to make the following clarifications:

1. Changes of Legal Ownership. The Privacy Rule's definition of

health care operations, at Sec. 164.501, includes business management

and general administrative activities of the entity, including, due

diligence in connection with the sale or transfer of assets to a

potential successor in interest, if the potential successor in interest

is a covered entity or, following completion of the sale or transfer,

will become a covered entity.

In the preamble to the Privacy Rule, the Department explained that

this language was included to remedy an omission in the 1999 proposed

Rule by

add[ing] to the definition of health care operations disclosures of

protected health information for due diligence to a covered entity

that is a potential successor in interest. This provision includes

disclosures pursuant to the sale of a covered entity's business as a

going concern, mergers, acquisitions, consolidations, and other

similar types of corporate restructuring between covered entities,

including a division of a covered entity, and to an entity that is

not a covered entity but will become a covered entity if the

reorganization or sale is completed.

65 FR at 82609 (December 28, 2000) (response to comment); see also 65

FR at 82491 (similar language); 65 FR at 82652 (``We clarify in the

definition of health care operations that a covered entity may sell or

transfer its assets, including protected health information, to a

successor in interest that is or will become a covered entity.'')

Despite language in the preamble to the contrary, the definition of

health care operations in the Privacy Rule does not expressly provide

for the transfer of protected health information upon sale or transfer

to a successor in interest. Instead, the definition of ``health care

operations'' only mentions disclosures of protected health information

for ``due diligence'' purposes when a sale or transfer to a successor

in interest is contemplated. ``Due diligence'' is generally understood

to mean the ``[a] prospective buyer's or broker's investigation and

analysis of a target company, a piece of property, or a newly issued

security.'' Black's Law Dictionary (7th ed. 1999) available in Westlaw,

DIBLACK database.

The Department proposes to add language to paragraph (6) of the

definition of ``health care operations'' to clarify the intent to

permit the transfer of records to a covered entity upon a sale,

transfer, merger, or consolidation. This proposed change would prevent

the Privacy Rule from interfering with necessary treatment or payment

activities upon the sale of a covered entity or its assets.

The Department also proposes to use the terms ``sale, transfer,

consolidation or merger'' to eliminate the term ``successor in

interest'' from this paragraph. The Department intended this provision

to apply to any sale, transfer, merger or consolidation and believes

the current language may not sufficiently accomplish this goal. The

proposed language's use of the terms ``sale, transfer, merger and

consolidation'' is based on language used in model State laws

addressing the disclosure of personal or privileged information

collected or received in connection with an insurance transaction.

The Department retains the limitation that such disclosures are

health care operations only to the extent the entity receiving the

protected health information is a covered entity or will become a

covered entity as a result of the sale, transfer, merger, or

consolidation. In addition, the proposed modification does not affect

any responsibility of covered entities either under other law or

ethical obligation to notify individuals appropriately of a sale,

transfer, merger, or consolidation.

2. Group Health Plan Disclosures of Enrollment and Disenrollment

Information to Plan Sponsors. The Department proposes to modify the

Privacy Rule to make express the Department's policy, which was

explained in the preamble to the Privacy Rule, that group health plans

are permitted to share enrollment and disenrollment information with

plan sponsors without amending plan documents. Under the Privacy Rule,

a group health plan, as well as a health insurance issuer or HMO

providing health insurance or health coverage to the group health plan,

are covered entities. Neither employers nor other plan sponsors are

defined as covered entities. The Department recognizes the legitimate

need of the plan sponsor to have access to health information of these

covered entities in certain situations. Therefore, the Privacy Rule at

Sec. 164.504(f) permits a group health plan, and health insurance

issuers or HMOs with respect to the group health plan, to disclose

protected health information to the plan sponsor provided that, among

other requirements, the plan documents are

[[Page 14801]]

amended to appropriately reflect and restrict the plan sponsor's uses

and disclosures of such information.

There are two exceptions where the Privacy Rule permits group

health plans (or health insurance issuers or HMOs, as appropriate) to

disclose information to a plan sponsor without requiring amendment of

plan documents. First, Sec. 164.504(f) permits such disclosures when

the information needed by the plan sponsor is summary health

information. Second, as explained in the preamble to the Privacy Rule,

a plan sponsor is permitted to perform enrollment functions on behalf

of its employees without meeting the requirements of Sec. 164.504(f),

as such functions are considered outside of the plan administration

functions. Therefore, a group health plan is also permitted to disclose

enrollment or disenrollment information to the plan sponsor without

amending the plan documents as required by Sec. 164.504(f).

However, this policy regarding disclosures of enrollment or

disenrollment information was addressed only in the preamble to the

Privacy Rule and not explicitly in the regulation itself. As a result,

the policy seems to have been overlooked and the absence of a specific

provision in the regulation itself has caused misinterpretation within

industry. To remedy this misunderstanding and make its policy clear,

the Department proposes to add an explicit exception at

Sec. 164.504(f)(1)(iii) to clarify that group health plans (or health

insurance issuers or HMOs, as appropriate) are permitted to disclose

enrollment or disenrollment information to a plan sponsor without

meeting the plan document amendment and other related requirements.

3. Definition of ``Individually Identifiable Health Information.''

The Department proposes to move the definition of ``individually

identifiable health information'' from Sec. 164.501 to Sec. 160.103 to

clarify that the definition is relevant to all of the provisions in

Parts 160 through 164.

4. Accounting of Disclosures of Protected Health Information. Under

the Privacy Rule at Sec. 164.528, individuals have the right to receive

an accounting of disclosures of protected health information made by

the covered entity, with certain exceptions. These exceptions, or

instances where a covered entity is not required to account for

disclosures, include disclosures made by the covered entity to carry

out treatment, payment, or health care operations, as well as

disclosures to individuals of protected health information about them.

The accounting is required to include the following: (1)

disclosures of protected health information that occurred during the

six years prior to the date of the request for an accounting, including

disclosures to or by a business associate of the covered entity; (2)

for each disclosure: the date of the disclosure; the name of the entity

or person who received the protected health information; if known, the

address of such entity or person; a brief description of the protected

health information disclosed; and a brief statement of the purpose of

the disclosure that reasonably informs the individual of the basis for

the disclosure, or in lieu of such a statement, a copy of the

individual's written authorization pursuant to Sec. 164.508 or a copy

of a written request for a disclosure under Secs. 164.502(a)(2)(ii) or

164.512. For multiple disclosures of protected health information to

the same person, the Privacy Rule allows covered entities to provide

individuals with an accounting that contains only the following

information: (1) For the first disclosure, a full accounting, with the

elements described in (2) above; (2) the frequency, periodicity, or

number of disclosures made during the accounting period; and (3) the

date of the last such disclosure made during the accounting period.

A number of commenters raised concerns that the high costs and

administrative burdens associated with the accounting requirements

would deter covered entities from disclosing protected health

information. In response to these concerns, the Department proposes to

expand the exceptions to the standard at Sec. 164.528(a)(1) to include

disclosures made pursuant to an authorization as provided in

Sec. 164.508. Covered entities would no longer be required to account

for any disclosures authorized by the individual in accordance with

Sec. 164.508. The Department is proposing to alleviate burden in this

way because it is believed that an accounting of disclosures made

pursuant to such permissions is unnecessary because such disclosures

are already known by the individual, in as much as the individual was

required to sign the forms authorizing the disclosures.

Accordingly, the Department proposes to make two conforming

amendments at Secs. 164.528(b)(2)(iv) and (b)(3) to delete references

in the accounting content requirements to disclosures made pursuant to

an authorization.

5. Uses and Disclosures Regarding FDA-regulated Products and

Activities. The Department recognizes the importance of public health

activities and, in the Privacy Rule, allows information to be used and

disclosed for these purposes without requiring individual consent or

authorization. The recent anthrax attacks and the threat of other forms

of bio-terrorism have served to underscore the vital necessity of a

strong and effective public health system. The Rule allows covered

entities to disclose protected health information to public health

authorities for a broad array of public health purposes, including

reporting of diseases, injuries, vital statistics, and for the conduct

of public health surveillance and interventions. The Rule permits

public health reporting to private persons who are contractors for or

agents of the public health authority. The Rule also recognizes the

essential role of manufacturers and other private persons in carrying

out the Food and Drug Administration's (FDA) public health mission.

The Privacy Rule, at Sec. 164.512(b)(1)(iii), specifically permits

covered entities to disclose protected health information, without

individual authorization, to a person who is subject to the

jurisdiction of the FDA for the following specified purposes: (1) To

report adverse events, defects or problems, or biological product

deviations with respect to products regulated by the FDA (if the

disclosure is made to the person required or directed to report such

information to the FDA), (2) to track products (if the disclosure is

made to the person required or directed to report such information to

the FDA), (3) for product recalls, repairs, or replacement, and (4) for

conducting post-marketing surveillance to comply with FDA requirements

or at the direction of the FDA.

The Department received a number of comments on the provisions for

public health activities related to FDA-regulated products. The

majority of these commenters were concerned that the Privacy Rule

constrains important public health surveillance and reporting

activities by impeding the flow of needed information to those subject

to the FDA's jurisdiction. In particular, commenters noted that

limiting disclosures to those that are ``required or directed'' by FDA

does not reflect the breadth of public health activities that are

currently being conducted by the private sector on a voluntary basis or

under the general auspices of--but not at the direction of--FDA. In

general, commenters were concerned that such limitations would stifle

current reporting practices. For example, the

[[Page 14802]]

FDA currently obtains the vast majority of its information about drugs

and devices indirectly from health care providers who voluntarily

report known adverse events or problems to the manufacturer of the

product. The manufacturer may or may not be required to report such

adverse events to FDA. Commenters assert that the present language of

the Privacy Rule will have a ``chilling effect'' on these important

communications due to uncertainty over the manufacturer's obligation to

report to the FDA.

Some concern was expressed about the potential liability of a

covered entity for a disclosure to an employee of the manufacturer who

is not ``a person subject to the jurisdiction of the FDA'' or to the

wrong manufacturer. The Department seeks to assure covered entities

that use of the term ``a person'' was not intended to limit reporting

to a single individual within an entity, but to allow reporting to flow

as it does today between health care providers and representatives of

manufacturers or other companies. Moreover, the Department seeks to

clarify that covered entities may continue to disclose protected health

information to the companies identified on the product labels as the

manufacturer registered with the FDA to distribute the product.

To eliminate the ``chilling effect'' of the Rule, some commenters

requested that the Department include in the Rule a ``good-faith'' safe

harbor to protect covered entities from enforcement actions arising

from unintentional violations of the Privacy Rule. For example, a

health care provider would not have violated the Rule if the disclosure

was made in the good faith belief that the entity to whom the adverse

event was reported was responsible for the FDA-regulated product, even

if it turned out to be the wrong manufacturer.

Finally, a number of commenters, including some that are subject to

the FDA's jurisdiction, suggested that: identifiable health information

is not necessary for some or all of these public health reporting

purposes; that identifiable health information is not reported to FDA;

and that for purposes of post-marketing surveillance, information

without direct identifiers (such as name, mailing address, phone

number, social security number, and email address) should suffice. The

Department recognizes that there must be a balance between the need for

public health activities that benefit every individual by safeguarding

the effectiveness, safety, and quality of the products regulated by the

FDA, and the privacy interests of specific individuals. However, the

comments did not offer a consensus as to which activities could be

performed without identifiable information or which identifiers, if

any, were needed. In Section III.I of this preamble regarding De-

identification issues, the Department is soliciting comments on a

limited data set for use for specific purposes, including public

health. The Department also requests comments as to whether this

limited data set should be required or permitted for some or all public

health purposes or if a special rule should be developed for public

health reporting.

The Department did not intend the Privacy Rule to discourage or

prevent the reporting of adverse events or otherwise disrupt the flow

of essential information that FDA and persons subject to the

jurisdiction of FDA need in order to carry out their important public

health activities. Therefore, the Department proposes a number of

changes to eliminate uncertainties identified by the commenters, and,

thereby, encourage covered entities to continue to report and cooperate

in these essential public health activities. The proposed modifications

attempt to recognize and preserve current public health activities of

persons subject to the jurisdiction of the FDA while not diminishing

the health information privacy protections for individuals.

Specifically, the Department proposes to remove from

Sec. 164.512(b)(1)(iii)(A) and (B) the phrase ``if the disclosure is

made to a person required or directed to report such information to the

Food and Drug Administration'' and to remove from subparagraph (D) the

phrase ``to comply with requirements or at the direction of the Food

and Drug Administration.'' In lieu of this language, HHS proposes to

describe at the outset the public health purposes for which disclosures

may be made. The proposed language reads: ``A person subject to the

jurisdiction of the Food and Drug Administration (FDA) with respect to

an FDA-regulated product or activity for which that person has

responsibility, for the purpose of activities related to the quality,

safety or effectiveness of such FDA-regulated product or activity.''

The Department proposes to retain the listing of specific

activities identified in paragraphs (A), (B), (C), and (D), to give

covered entities additional assurance that public health disclosures

for these activities are permissible under the Privacy Rule. The

listing, however, is no longer an exclusive list of FDA-related public

health activities, but rather is a list of examples of the most common

activities. Additionally, language has been added to paragraph (C) to

include ``lookback'' activities which are necessary for tracking blood

and plasma products, as well as quarantining tainted blood or plasma

and notifying recipients of such tainted products.

The privacy of individuals' health information would continue to be

protected through the limitations placed on the permissible disclosures

for FDA purposes. Specifically, such disclosures must relate to FDA-

regulated products or activities for which the person using or

receiving the information has responsibility, and for activities

related to the safety, effectiveness, or quality of such FDA-regulated

product or activity.

The Department is not proposing a good-faith safe harbor at this

time because it believes that these proposed modifications will

adequately address the concerns and uncertainties facing covered

entities. However, the Department is interested in hearing from

affected parties as to whether the proposed modifications are adequate

or if additional measures are necessary for health care providers or

others to continue to report this vital information about FDA-regulated

products or activities.

6. Hybrid Entities. The Privacy Rule defines covered entities that

primarily engage in activities that are not covered functions--i.e.,

functions that relate to the entity's operation as a health plan,

health care provider, or health care clearinghouse--as hybrid entities.

See Sec. 164.504(a). In order to limit the burden on such entities,

most of the requirements of the Privacy Rule only apply to the health

care component(s) of the hybrid entity and not to the parts of the

entity that do not engage in covered functions. The health care

component(s) include those components of the entity that perform

covered functions and other components of the entity that support those

covered functions, in the same way such support may be provided by a

business associate. A covered entity that is a hybrid entity is

required to define and designate those parts of the entity that engage

in the covered functions and ``business associate'' functions and that

are, therefore, part of the health care component(s). The health care

component is designed to include components that engage in ``business

associate'' functions because it is impossible for the entity to

contract with itself and the authorization requirement would limit the

ability to engage in necessary health care operations functions.

The hybrid entity is also required to create adequate separation

(i.e., fire walls) between the health care component(s) and other

components of

[[Page 14803]]

the entity. Transfer of protected health information held by the health

care component to other components of the hybrid entity is a disclosure

under the Privacy Rule and is only allowed to the same extent as such

disclosure would be permitted to a separate entity.

Examples of hybrid entities are: (1) corporations that are not in

the health care industry, but that operate on-site health clinics, and

(2) insurance carriers that have multiple lines of business which

include both health insurance and other insurance lines such as general

liability or property and casualty insurance.

A ``hybrid entity'' is defined in the Privacy Rule as an entity

``whose covered functions are not its primary functions.'' (emphasis

added). In the preamble to the Privacy Rule, the Department explained

that the use of the term ``primary'' in the definition of a ``hybrid

entity'' was not intended to operate with mathematical precision. The

Department intended a common sense evaluation of whether the covered

entity mostly operates as a health plan, health care provider, or

health care clearinghouse. If an entity's primary activity was engaging

in covered functions, then the whole entity would be a covered entity

and the hybrid entity provisions would not apply. However, if the

covered entity primarily conducted non-health activities, it would

qualify as a hybrid entity and would be required to comply with the

Privacy Rule with respect to its health care component(s). Commenters

expressed concern that the policy guidance in the preamble was

insufficient as long as the Privacy Rule itself limited the hybrid

entity provisions to entities that primarily conducted non-health

related activities. There were particular concerns in cases in which

the health plan line of business was the primary business, and the line

of business that is one of the excepted benefits, e.g., workers'

compensation insurance, was only a small portion of the business. There

were also concerns about what ``primary'' meant if not a mathematical

calculation and how the entity would know whether or not it was a

hybrid entity based on the guidance in the preamble.

As a result of these comments, the Department proposes to delete

the term ``primary'' from the definition of ``hybrid entity'' in

Sec. 164.504(a). In order to avoid the problem of line drawing, the

Department proposes to permit any covered entity to be a hybrid entity

if it is a single legal entity that performs both covered and non-

covered functions, regardless of whether the non-covered functions

represent that entity's primary function, a substantial function, or

even a small portion of the entity's activities.

The Department proposes to permit covered entities that could

qualify as hybrid entities to choose whether or not they want to be

hybrid entities. Elimination of the requirement in the definition of

``hybrid entity'' that covered functions not be the ``primary''

functions of the covered entity would greatly increase the proportion

of covered entities that are hybrid entities. In order to avoid the

burden of requiring many more covered entities to designate the health

care components and create fire walls within their entity when it is

administratively simpler to treat the entire entity as a covered

entity, the proposal would allow the covered entity to choose whether

it will be a hybrid entity or not. To accomplish this objective, the

proposed definition of ``hybrid entity'' would require that in order to

be a hybrid entity, a covered entity that otherwise qualifies must

designate health care components. If a covered entity does not

designate health care components, the entire entity would be a covered

entity.

There are advantages and disadvantages to being a hybrid entity.

Whether or not the advantages outweigh the disadvantages will be a

decision of each covered entity that may qualify as a hybrid entity and

will be influenced by factors such as how the entity is organized and

the proportion of the entity that must be included in the health care

component. Where the non-covered functions of the entity are only a

small portion of the entity, it will likely be more efficient to simply

consider the entire entity as a covered entity. Nonetheless, the

Department is proposing to permit flexibility for covered entities to

choose whether or not to be treated as a covered entity entirely or as

a hybrid entity.

The Department also proposes to simplify the definition of ``health

care component'' in Sec. 164.504(a) to make clear that a health care

component is whatever the covered entity designates as the health care

component, consistent with the provisions regarding designation in

Sec. 164.504(c)(3)(iii). The specific language regarding which

components make up a health care component would be in the

implementation specification that addresses designation of health care

components. The Department proposes to move this specific language

because it provides requirements and directions that are more

appropriately placed in an implementation specification. The Department

proposes that health care components may include: (1) Components of the

covered entity that engage in covered functions, and (2) any component

that engages in activities that would make such component a business

associate of a component that performs covered functions if the two

components were separate legal entities.

With respect to the components that perform covered functions, the

Department also clarifies that a hybrid entity must include in its

health care component(s) any component that would meet the definition

of ``covered entity'' if it were a separate legal entity. ``Covered

functions'' are those functions of a covered entity that make the

entity a health plan, health care provider, or health care

clearinghouse. However, there was some ambiguity as to whether a

component of a covered entity that is a health care provider, but that

does not conduct standard electronic transactions, must be included in

the health care component. The proposed language would clarify that any

component that would be a covered entity if it were a separate legal

entity must be included in the health care component.

Under these proposed changes, a component that is a health care

provider and that engages in standard electronic transactions must be

included in the health care component, but a component that is a health

care provider but that does not engage in standard electronic

transactions may, but would not be required to, be included in the

health care component of the hybrid entity. The decision would be left

to the covered entity in the second case. For example, in a university

setting, the single legal entity may operate hospital facilities that

bill electronically and research laboratories that do not engage in any

electronic billing. The modification would clarify that the university

as a hybrid entity need only include the hospital facilities that bill

electronically in the health care component. The modification also

would make clear that the university has the option to include the

components, such as the research laboratory, that function as a health

care provider, but not as a covered health care provider. A covered

entity that chooses to include a non-covered health care provider in

their health care component would be required to ensure that the non-

covered health care provider, as well as the rest of the health care

component, is in compliance with the Privacy Rule.

There is also a conforming change in the proposed language in

Sec. 164.504(c)(1)(ii) to make it clear that a reference to a ``covered

health care provider'' in the Privacy Rule could

[[Page 14804]]

include the functions of a health care provider who does not engage in

electronic transactions, if the covered entity chooses to include such

functions in the health care component.

With respect to the language regarding components that engage in

``business associate'' functions, the Department does not make any

substantive change. The components of a hybrid that may provide

services to the component that performs covered functions, such as a

portion of the legal or accounting departments of the entity, may be

included in the health care component so protected health information

can be shared with such components of the entity without requiring

business associate agreements or individual authorizations. The related

language in paragraph (2)(ii) of the definition of ``health care

component'' in the Privacy Rule that requires the ``business

associate'' functions include the use of protected health information

is not included in this proposed Rule because it is redundant.

It is important to note that a covered entity may include

components that engage in ``business associate'' functions in its

health care component or not. It is not a violation of the Privacy Rule

to fail to include such a component in the health care component

designation. However, a disclosure of protected health information from

the health care component to such other component if it is not part of

the health care component is the same as a disclosure outside the

covered entity and is a violation unless it is permitted by the Privacy

Rule. Because an entity cannot have a business associate contract with

itself, such a disclosure likely would require individual

authorization.

Finally, to avoid needless application of the hybrid entity

provisions to a covered entity's activities as an employer, rather than

as a health plan, health care provider, or health care clearinghouse,

the Department proposes to modify the definition of ``protected health

information'' in Sec. 164.501. The preamble to the Privacy Rule makes

clear that the Privacy Rule does not treat employment records as

protected health information. To avoid any confusion or

misinterpretation on this point, the Department proposes to expressly

exclude employment records held by a covered entity in its role as

employer from the definition of ``protected health information.'' In

that way, employment records will be treated in the same manner as

student medical records covered by FERPA, which the Privacy Rule

excludes from the definition of ``protected health information.'' This

change will limit the need for a covered entity, whose primary

activities are covered functions, to designate itself as a hybrid

entity simply to carve out employment records.

It is important to note that the exception from the definition of

``protected health information'' for employment records only applies to

individually identifiable health information in those records that are

held by a covered entity in its role as employer. The exception does

not apply to individually identifiable health information held by a

covered entity when carrying out its health plan or health care

provider functions. Such information would be protected health

information. The Department specifically is soliciting comments on

whether the term ``employment records'' is clear or whether it needs to

be more fully explained. It would be particularly helpful if commenters

could identify certain types of records that should be included or

excluded from ``employment records.''

7. Technical Corrections. The Privacy Rule contained some technical

and typographical errors. Therefore, the Department proposes to make

the following corrections:

a. In Sec. 160.102(b), beginning in the second line, ``section

201(a)(5) of the Health Insurance Portability Act of 1996, (Pub. L.

104-191),'' is replaced with ``42 U.S.C. 1320a-7c(a)(5)''.

b. In Sec. 160.203(b), in the second line, ``health information''

is replaced with ``individually identifiable health information''.

c. In Sec. 164.102, ``implementation standards'' is corrected to

read ``implementation specifications.''

d. In Sec. 164.501, in the definition of ``protected health

information'', ``Family Educational Right and Privacy Act'' is

corrected to read ``Family Educational Rights and Privacy Act.''

e. In Sec. 164.508(b)(1)(ii), in the fifth line, the word ``be'' is

deleted.

f. In Sec. 164.508(b)(3)(iii), a comma is added after the words

``psychotherapy notes''.

g. In Sec. 164.510(b)(3), in the third line, the word ``for'' is

deleted.

h. In Sec. 164.512(b)(1)(v)(A), in the fourth line, the word ``a''

is deleted.

i. In Sec. 164.512(b)(1)(v)(C), in the eighth line, the word

``and'' is added after the semicolon.

j. In Sec. 164.512(f)(3), paragraphs (ii) and (iii) are

redesignated as (i) and (ii), respectively.

k. In Sec. 164.512(g)(2), in the seventh line, the word ``to'' is

added after the word ``directors.''

l. In Sec. 164.512(i)(1)(iii)(A), in the second line, the word

``is'' after the word ``sought'' is deleted.

m. In Sec. 164.522(a)(1)(v), in the sixth line,

``Secs. 164.502(a)(2)(i)'' is corrected to read

``Secs. 164.502(a)(2)(ii)''.

n. In Sec. 164.530(i)(4)(ii)(A), in the second line, ``the

requirements'' is replaced with the word ``specifications''.

IV. Preliminary Regulatory Impact Analysis

Federal law (5 U.S.C. 804(2), as added by section 251 of Pub. L.

104-21), specifies that a ``major rule'' is any rule that the Office of

Management and Budget finds is likely to result in:

An annual effect on the economy of $100 million or more;

A major increase in costs or prices for consumers,

individual industries, federal, State, or local government agencies, or

geographic regions; or

Significant adverse effects in competition, employment,

investment productivity, innovation, or on the ability of United States

based enterprises to compete with foreign-based enterprises in domestic

and export markets.

The impact of the modifications proposed in this rulemaking would

be a net reduction of costs associated with the Privacy Rule of

approximately $100 million. Therefore, this Rule is a major rule as

defined in 5 U.S.C. 804(2).

Executive Order 12866 directs agencies to assess all costs and

benefits of available regulatory alternatives and, when regulation is

necessary, to select regulatory approaches that maximize net benefits

(including potential economic, environmental, public health and safety

effects; distributive impacts; and equity). According to Executive

Order 12866, a regulatory action is ``significant'' if it meets any one

of a number of specified conditions, including having an annual effect

on the economy of $100 million or more, adversely affecting in a

material way a sector of the economy, competition, or jobs, or if it

raises novel legal or policy issues. The purpose of the regulatory

impact analysis is to assist decision-makers in understanding the

potential ramifications of a regulation as it is being developed. The

analysis is also intended to assist the public in understanding the

general economic ramifications of the regulatory changes.

The Privacy Rule included a regulatory impact analysis (RIA), which

estimated the cost of the Privacy Rule at $17.6 billion over ten years.

65 FR 82462, 82758. The changes to the Privacy Rule proposed by this

notice of proposed rulemaking are a result of comment by the industry

and the public at large identifying a number of unintended consequences

of the Privacy

[[Page 14805]]

Rule that could adversely affect access to, or the quality of health

care delivery. These proposed changes should facilitate implementation

and compliance with the Privacy Rule, and lower the costs and burdens

associated with the Privacy Rule while maintaining the confidentiality

of protected health information.

The proposed changes would affect five areas of the Privacy Rule

that will have an economic impact: (1) Consent; (2) notice; (3)

marketing; (4) research; and (5) business associates. In addition, the

proposal contains a number of changes that, though important, can be

categorized as clarifications of intended policy. For example, the

modifications would permit certain uses and disclosures of protected

health information that are incidental to an otherwise permitted use or

disclosure. This change would recognize such practices as the need for

physicians to talk to patients in semi-private hospital rooms or nurses

to communicate with others in public areas, and avoids the costs

covered entities might have incurred to reconfigure facilities as

necessary to ensure absolute privacy for these common treatment-related

communications. This and other modifications in this proposal (other

than those described below) clarify the intent of the standards in the

Privacy Rule and, as such, do not change or alter the associated costs

that were estimated for the Privacy Rule. There are no new costs or

savings by these changes, and therefore, there is no cost estimate made

here for them.

A. Summary of Costs and Benefits in Final Regulatory Impact Statement

The Privacy Rule was estimated to produce net costs of $17.6

billion, with net present value costs of $11.8 billion (2003 dollars)

over ten years (2003-2012). The Department estimates the modifications

in this proposal would lower the net cost of the Privacy Rule by

approximately $100 million over ten years.

Measuring both the economic costs and benefits of health

information privacy was recognized as a difficult task. The paucity of

data and incomplete information on current industry privacy and

information system practices made cost estimation a challenge. Benefits

were difficult to measure because they are, for the most part,

inherently intangible. Therefore, the regulatory impact analysis in the

Privacy Rule focused on the key policy areas addressed by the privacy

standards, some of which would be affected by the proposed

modifications in this rulemaking.

B. Proposed Modifications To Prevent Barriers to Access to or Quality

of Health Care

The changes proposed in this rulemaking are intended to address the

possible adverse effects of the final privacy standards on an

individual's access to, or the quality of, health care. The

modifications touch on five of the key policy areas addressed by the

final regulatory impact analysis, including consent, research,

marketing, notice, and business associates.

Consent

Under the Privacy Rule, a covered health care provider with a

direct treatment relationship with an individual must obtain the

individual's prior written consent for use or disclosure of protected

health information for treatment, payment, or health care operations,

subject to a limited number of exceptions. Other covered health care

providers and health plans may obtain such a consent if they so choose.

The initial cost of the consent requirement was estimated to be $42

million. Based on assumptions for growth in the number of patients, the

total costs for ten years was estimated to be $103 million. See 65 FR

82771 (December 28, 2000).\2\

---------------------------------------------------------------------------

\2\ The total cost for consent in the regulatory impact analysis

showed an initial cost of $166 million and $227 million over ten

years. Included in these total numbers is the cost of tracking

patient requests to restrict the disclosure of their health

information. This right is not changed in these modifications. The

numbers here represent the costs associated with the consent

functions that are proposed to be repealed.

---------------------------------------------------------------------------

The proposed modifications would eliminate the consent requirement.

The consent requirement posed many difficulties for an individual's

access to health care, and was problematic for operations essential for

the quality of the health care delivery system. However, any health

care provider or health plan may choose to obtain an individual's

consent for treatment, payment, and health care operations. The

elimination of the consent requirement reduces the initial cost of the

privacy standards by $42 million in the first year and by $103 million

over ten years.

As explained in detail in section III.A.1. above, many comments

that the Department received in March 2001 and testimony before the

NCVHS revealed that the consent requirements in the Privacy Rule create

unintended barriers to timely provision of care, particularly with

respect to use and disclosure of health information prior to a health

care provider's first face-to-face contact with the individual. These

and other barriers discussed above would have entailed costs not

anticipated in the economic analyses in the Privacy Rule. These

comments also revealed that the consent requirements create

administrative burdens, for example, with respect to tracking the

status and revocation of consents, that were not foreseen and thus not

included in that economic analysis. Therefore, while the estimated

costs of the consent provisions were $103 million, comments have

suggested that the costs were likely to be much higher. If these

comments are accurate, the cost savings associated with retracting the

consent provisions would, therefore, also be significantly higher than

$103 million.

Notice

In eliminating the consent requirement, the Department proposes to

preserve the opportunity for a covered health care provider with a

direct treatment relationship with an individual to engage in a

meaningful communication about the provider's privacy practices and the

individual's rights by strengthening the notice requirements. Under the

Privacy Rule, these health care providers are required to distribute to

individuals their notice of privacy practices no later than the date of

the first service delivery after the compliance date. The modifications

would not change this distribution requirement, but would add a new

documentation requirement. A covered health care provider with a direct

treatment relationship would be required to make a good faith effort to

obtain the individual's acknowledgment of receipt of the notice

provided at the first service delivery. The form of the acknowledgment

is not prescribed and can be as unintrusive as retaining a copy of the

notice initialed by the individual. If the provider's good faith effort

fails, documentation of the attempt is all that would be required.

Since the modification would not require any change in the form of the

notice or its distribution, the ten-year cost estimate of $391 million

for these areas in the Privacy Rule's impact analysis remains the same.

See 65 FR 82770 (December 28, 2000).

However, the additional effort by direct treatment providers in

obtaining and documenting the individual's acknowledgment of receipt of

the notice would add costs. This new requirement would attach only to

the initial provision of notice by a direct treatment provider to an

individual after the compliance date. Under the proposed modification,

providers would have considerable flexibility on how to achieve this.

Some providers could

[[Page 14806]]

choose to obtain the required written acknowledgment on a separate

piece of paper, while others could take different approaches, such as

an initialed check-off sheet or a signature line on the notice itself

with the provider keeping a copy.

In the original analysis, the Department estimated that the consent

cost would be $0.05 per page based on the fact that the consent had to

be a stand alone document requiring a signature. This proposed

modification to the notice requirement would provide greater

flexibility and, therefore, greater opportunity to reduce costs

compared to the consent requirement. The Department estimates that the

additional cost of the signature requirement, on average, would be

$0.03 per notice. Based on data obtained from the Medical Expenditure

Panel Survey (MEPS), which estimate the number of patient visits in a

year, the Department estimates that in the first year there would be

816 million notices distributed, including the new additional

information needed to acknowledge receipt of the notice. Over the next

nine years, the Department estimates, again based on MEPS data, that

there would be 5.3 billion visits to health care providers by new

patients (established patients will not need to receive another copy of

the notice). At $0.03 per document, the first year cost would be $24

million and the total cost over ten years would be $184 million.

Business Associates

The Privacy Rule requires a covered entity to have a written

contract, or other arrangement that documents satisfactory assurances

that a business associate will appropriately safeguard protected health

information in order to disclose protected health information to the

business associate. The regulatory impact analysis for the Privacy Rule

provided cost estimates for two aspects of this requirement. In the

Privacy Rule, $103 million in first-year costs was estimated for

development of a standard business associate contract language. (There

were additional costs associated with these requirements related to the

technical implementation of new data transfer protocols, but these are

not affected by the changes being proposed here.) In addition, $197

million in first-year costs and $697 million in total costs over ten

years were estimated in the Privacy Rule for the review and oversight

of existing business associate contracts.

The modifications do not change the standards for business

associate contracts or the implementation specifications with respect

to the covered entity's responsibilities for managing the contracts.

However, as part of this proposal, the Department is including model

business associate contract language. This model is only suggested

language and is not a complete contract. The model language is designed

to be adapted to the business arrangement between the covered entity

and the business associate and to be incorporated into a contract

drafted by the parties. The final regulatory impact analysis assumed

the development of such standard language by trade and professional

associations. While this has, in fact, been occurring, the Department

continues to receive requests for model contract language, particularly

from small health care providers. The Department expects that trade and

professional associations will continue to provide assistance to their

members. However, the model contract language in this proposal will

simplify their efforts by providing a base from which they can develop

language. The Department had estimated $103 million in initial year

costs for this activity based on the assumption it would require one

hour per non-hospital provider and two hours for hospitals and health

plans to develop contract language and to tailor the language to the

particular needs of the covered entity. The additional time for

hospitals and health plans reflected the likelihood that these covered

entities would have a more extensive number of business associate

relationships. Because there will be less effort expended than

originally estimated in the Privacy Rule, the Department estimates a

reduction in contract development time by one-third because of the

availability of the model language. Thus, the Department now estimates

that this activity will take 40 minutes for non-hospital providers and

80 minutes for hospitals and health plans. The Department estimates

that the savings from the proposed business associate contract language

would be approximately $35 million in the first year.

The Department is also proposing in this rulemaking to give covered

entities additional time to review their existing business associate

contracts and to conform written contracts to the privacy standards.

Under the proposal, a covered entity's written business associate

contracts, existing at the time the modifications become effective,

would be deemed to comply with the privacy standards until such time as

the contracts are renewed or modified or until April 14, 2004,

whichever is earlier. The effect of this proposal would be to spread

first year costs over an additional year, with a corresponding

postponement of the costs estimated for the out years. However, the

Department has no reliable information as to the number of contracts

potentially affected by the modification or how long a delay may occur.

Therefore, the Department does not compute any cost savings to this

modification.

Marketing

Under Sec. 164.514(e) of the Privacy Rule, certain health-related

communications are subject to special conditions on marketing

communications, if they also serve to promote the use or sale of a

product or service. These marketing conditions require that particular

disclosures be made as part of the marketing materials sent to

individuals. Absent these disclosures, protected health information can

only be used or disclosed in connection with such marketing

communications with the individual's authorization. The Department is

aware that the Privacy Rule's Sec. 164.514(e) conditions for health-

related communications create a potential burden on covered entities to

make difficult assessments regarding many of their communications. The

proposed modifications to the marketing provisions would relieve the

burden on covered entities by making most marketing subject to an

authorization requirement and eliminating the Sec. 164.514(e)

conditions on marketing communications.

In developing the final impact analysis for the Privacy Rule, the

Department was unable to estimate the cost of the marketing provisions.

There was too little data and too much variation in current practice to

estimate how the Privacy Rule might affect marketing. The same remains

true today. However, the proposed modifications would relieve burden on

the covered entities in making communications for treatment and certain

health care operations relative to the requirements in the Privacy

Rule. Although the Department cannot provide a quantifiable estimate,

the effect of these proposed changes will be to lower costs relative to

the Privacy Rule.

Research

In the final impact analysis for the Privacy Rule, the Department

estimated the total cost of the provisions requiring documentation of

an Institutional Review Board (IRB) or Privacy Board waiver of

individual authorization for the use or disclosure of protected health

information for a research purpose as $40 million for the first year

and $585

[[Page 14807]]

million for the ten-year period. The costs were estimated based on the

time that an IRB or privacy board would need to consider a request for

a waiver under the criteria provided in the Privacy Rule. See 65 FR

82770-82771 (December 28, 2000).

The proposed modification would simplify and reduce the number of

criteria required for an IRB or Privacy Board to approve a waiver of

authorization in three ways. First, the proposal would simplify the

criteria for waivers to better conform to the Common Rule's waiver

criteria for informed consent to participate in the research study.

Second, the proposal would simplify the accounting procedures for

research by eliminating the need to account for disclosures based on

individual authorization. Third, the proposal would simplify the

authorization process for research to facilitate the combining of the

informed consent for participation in the research itself with all

authorizations required under the Privacy Rule. Therefore, the

Department estimates that the net effect of these modifications would

be to reduce the time necessary to assemble the necessary waivers and

for an IRB or Privacy Board to consider and act on waiver requests by

one quarter. The Department estimates these simplifications would

reduce the expected costs first year costs by $10 million and the ten

year costs by $146 million, relative to the Privacy Rule. Since this

initial estimate is based on limited information available to the

Department, the Department requests information to better assess this

cost savings.

Privacy Rule Modifications--Ten-Year Cost Estimates

----------------------------------------------------------------------------------------------------------- -----

Change due to

Policy Original Cost Modification modification

----------------------------------------------------------------------------------------------------------- -----

Consent.............................. $103 million........... Provision removed...... -$103 million.\1\

Notice............................... $391 million........... Good faith effort to +$184 million.

obtain acknowledgment

of receipt.

Marketing............................ Not scored due to lack Fewer activities Reduction in cost but

of data. constitute marketing. magnitude cannot be

estimated.

Business Associates.................. $103 million for Model language provided -$35 million.

contract modifications.

Research............................. $585 million........... Waiver requirements -$146 million.

simplified.

Net Change........................... ....................... ....................... -$100 million.

----------------------------------------------------------------------------------------------------------- -----

\1\ As noted above in the discussion on consent, while the estimated costs of the consent provisions were $103

million, comments have suggested that the costs were likely to be much higher. If these comments are accurate,

the cost savings associated with retracting the consent provisions would, therefore, also be significantly

higher than $103 million.

C. Costs to the Federal Government

The proposed changes in this Rule will result in small savings to

the federal government relative to the costs that would have occurred

under the Privacy Rule. Although there will be some increase in costs

for the new requirements for obtaining acknowledgment for receipt of

the notice, these costs are partially offset by the savings in the

elimination of the consent. As discussed above, to the extent comments

are accurate that the costs for the consent provisions are much higher

than estimated, the cost savings associated with the retraction of

these provisions would, therefore, be significantly higher. The

Department does not believe the federal government engages in

significant marketing as defined in the Privacy Rule. The federal

government will have business associates under the Privacy Rule, and

therefore, the model language proposed in this rulemaking will be of

benefit to federal departments and agencies. The Department has not

estimated the federal government's portion of the $35 million savings

it estimated for this change. Similarly, the federal government, which

conducts and sponsors a significant amount of research that is subject

to IRBs, will realize some savings as a result of the research

modifications proposed in this rulemaking. The Department does not have

sufficient information, however, to estimate the federal government's

portion of the total $146 million savings with respect to research

modifications.

D. Costs to State and Local Government

The proposed changes also may affect the costs to state and local

governments. However, these effects likely will be small. As with the

federal government, state and local governments will have any costs of

the additional notice requirement offset by the savings realized by the

elimination of the consent requirement. As discussed above, to the

extent comments are accurate that the costs for the consent provisions

are much higher than estimated, the cost savings associated with the

retraction of these provisions would, therefore, be significantly

higher. State and local governments could realize savings from the

model language for business associates and the changes in research, but

the savings are likely to be small. The Department does not have

sufficient information to estimate the state and local government's

share of the net savings from the proposed changes.

E. Benefits

The benefits of these modifications would be lower costs, and

enhanced implementation and compliance with the Privacy Rule without

compromising the protection of individually identifiable health

information or access to quality health care.

F. Alternatives

In July 2001, the Department clarified the Privacy Rule in

guidance, where feasible, to resolve some of the issues raised by

commenters. Issues that could not adequately be addressed through

guidance because of the need for a regulatory change are addressed in

this proposed Rule. The Department examined a number of alternatives to

these proposed provisions. One alternative was to not make any changes

to the Privacy Rule, but this option was rejected for the reasons

explained throughout the preamble. The Department also considered

various alternatives to specific provisions in the development of this

proposed Rule. These alternatives are generally discussed above, where

appropriate.

V. Preliminary Regulatory Flexibility Analysis

The Department also examined the impact of this proposed Rule as

required

[[Page 14808]]

by the Small Business Regulatory Enforcement and Fairness Act (SBREFA)

(5 U.S.C. 601, et seq.). SBREFA requires agencies to determine whether

a rule will have a significant economic impact on a substantial number

of small entities.

The law does not define the thresholds to use in implementing the

law and the Small Business Administration discourages establishing

quantitative criteria. However, the Department has long used two

criteria--the number of entities affected and the impact on revenue and

costs--for assessing whether a regulatory flexibility analysis is

necessary. Department guidelines state that an impact of three to five

percent should be considered a significant economic impact. Based on

these criteria, the Department has determined that a regulatory

flexibility analysis is not required.

As described in the Regulatory Flexibility Analysis for the Privacy

Rule, most covered entities are small businesses--approximately

465,000. See Table A, 65 FR 82780 (December 28, 2000). Lessening the

burden for small entities, consistent with the intent of protecting

privacy, was an important consideration in developing these

modifications. However, as discussed in the Preliminary Regulatory

Impact Analysis, above, the net affect of the proposed changes is an

overall savings of approximately $100 million over ten years. Even if

all of this savings were to accrue to small entities (an over

estimation), the impact per small entity would be de minimis.

VI. Collection of Information Requirements

Under the Paperwork Reduction Act (PRA) of 1995, the Department is

required to provide 60-day notice in the Federal Register and solicit

public comment before a collection of information requirement is

submitted to the Office of Management and Budget (OMB) for review and

approval. In order to fairly evaluate whether an information collection

should be approved by OMB, section 3506(c)(2)(A) of the PRA requires

that the Department solicit comment on the following issues:

The need for the information collection and its usefulness

in carrying out the proper functions of the agency.

The accuracy of the estimate of the information collection

burden.

The quality, utility, and clarity of the information to be

collected.

Recommendations to minimize the information collection

burden on the affected public, including automated collection

techniques.

In accordance with these requirements, the Department is soliciting

public comments on the model business associate contract language

displayed in the Appendix to this proposed Rule. The Department

provides these model business associate contract provisions in response

to numerous requests for guidance. These provisions are designed to

help covered entities more easily comply with the business associate

contract requirements of the Privacy Rule. However, use of these model

provisions is not required for compliance with the Privacy Rule. Nor is

the model language a complete contract. Rather, the model language is

designed to be adapted to the business arrangement between the covered

entity and the business associate and to be incorporated into a

contract drafted by the parties.

Section 164.506--Consent for Treatment, Payment, and Health Care

Operations

Under the Privacy Rule, a covered health care provider that has a

direct treatment relationship with individuals must, except in certain

circumstances, obtain an individual's consent to use or disclose

protected health information to carry out treatment, payment, and

health care operations. The modifications would eliminate this

requirement. While the consent requirement is subject to the PRA, the

Department believes that the burden associated with the requirement is

exempt from the PRA as stipulated under 5 CFR 1320.3(b)(2). Therefore,

the modification does not affect the paperwork burden associated with

the Privacy Rule.

Section 164.520--Notice of Privacy Practices for Protected Health

Information

The modifications would impose a good faith effort on direct

treatment providers to obtain an individual's acknowledgment of receipt

of the notice of privacy practices for protected health information and

to document such acknowledgment or, in the absence of such

acknowledgment, the entity's good faith efforts to obtain it. In

addition, a covered entity would have to retain the acknowledgment or

documentation of the good faith effort as required by Sec. 164.530(j).

The Department is continuing to work on estimating the burden imposed

by the Privacy Rule. The estimate for the acknowledgment of receipt of

the notice will be reflected in the paperwork reduction package to be

submitted to OMB as required by the PRA.

The Department has submitted a copy of this proposed Rule to OMB

for its review of the information collection requirements described

above. These requirements are not effective until they have been

approved by OMB.

If you comment on any of these information collection and record

keeping requirements, please mail copies directly to the following:

Center for Medicaid and Medicare Services, Information Technology

Investment Management Group, Division of CMS Enterprise Standards, Room

C2-26-17, 7500 Security Boulevard, Baltimore, MD 21244-1850. ATTN: John

Burke, HIPAA Privacy;

and

Office of Information and Regulatory Affairs, Office of Management and

Budget, Room 10235, New Executive Office Building, Washington, DC

20503, ATTN: Allison Herron Eydt, CMS Desk Officer.

VII. Unfunded Mandates

Section 202 of the Unfunded Mandates Reform Act of 1995 also

requires that agencies assess anticipated costs and benefits before

issuing any rule that may result in an expenditure by State, local, or

tribal governments, in the aggregate, or by the private sector, of $110

million in a single year. A final cost-benefit analysis was published

in the Privacy Rule of December 28, 2000 (65 FR 82462, 82794). In

developing the final Privacy Rule, the Department adopted the least

burdensome alternatives, consistent with achieving the Rule's goals.

The Department does not believe that the modifications in the proposed

Rule would qualify as an unfunded mandate under the statute.

VIII. Environmental Impact

The Department has determined under 21 CFR 25.30(k) that this

action is of a type that does not individually or cumulatively have a

significant effect on the human environment. Therefore, neither an

environmental assessment nor an environmental impact statement is

required.

IX. Executive Order 13132: Federalism

Executive Order 13132 establishes certain requirements that an

agency must meet when it promulgates a proposed rule (and subsequent

Privacy Rule) that imposes substantial direct requirement costs on

State and local governments, preempts State law, or otherwise has

Federalism implications. The federalism implications of the Privacy

Rule were assessed as required by Executive Order 13132 and published

in the Privacy Rule of

[[Page 14809]]

December 28, 2000 (65 FR 82462, 82797). The proposed change with the

most direct effect on federalism principles concerns the clarifications

regarding the rights of parents and minors under State law. The

modifications would make clear the intent of the Department to defer to

State law with respect to such rights. Therefore, the Department

believes that the modifications in this proposed Rule would not

significantly affect the rights, roles and responsibilities of States.

Appendix to the Preamble--Model Business Associate Contract Provisions

Introduction

The Department of Health and Human Services provides these model

business associate contract provisions in response to numerous

requests for guidance. This is only model language. These provisions

are designed to help covered entities more easily comply with the

business associate contract requirements of the Privacy Rule.

However, use of these model provisions is not required for

compliance with the Privacy Rule. The language may be amended to

more accurately reflect business arrangements between the covered

entity and the business associate.

These or similar provisions may be incorporated into an

agreement for the provision of services between the entities or they

may be incorporated into a separate business associate agreement.

These provisions only address concepts and requirements set forth in

the Privacy Rule and alone are not sufficient to result in a binding

contract under State law and do not include many formalities and

substantive provisions that are required or typically included in a

valid contract. Reliance on this model is not sufficient for

compliance with state law and does not replace consultation with a

lawyer or negotiations between the parties to the contract.

Furthermore, a covered entity may want to include other

provisions that are related to the Privacy Rule but that are not

required by the Privacy Rule. For example, a covered entity may want

to add provisions in a business associate contract in order for the

covered entity to be able to rely on the business associate to help

the covered entity meet its obligations under the Privacy Rule. In

addition, there may be permissible uses or disclosures by a business

associate that are not specifically addressed in these model

provisions. For example, the Privacy Rule does not preclude a

business associate from disclosing protected health information to

report unlawful conduct in accordance with Sec. 164.502(j). However,

there is not a specific model provision related to this permissive

disclosure. These and other types of issues will need to be worked

out between the parties.

Model Business Associate Contract Provisions \1\

---------------------------------------------------------------------------

\1\ Words or phrases contained in brackets are intended as

either optional language or as instructions to the users of these

model provisions and are not intended to be included in the

contractual provisions.

---------------------------------------------------------------------------

Definitions (alternative approaches)

Catch-all definition:

Terms used, but not otherwise defined, in this Agreement shall

have the same meaning as those terms in 45 CFR 160.103 and 164.501.

Examples of specific definitions:

(a) Business Associate. ``Business Associate'' shall mean

[Insert Name of Business Associate].

(b) Covered Entity. ``Covered Entity'' shall mean [Insert Name

of Covered Entity].

(c) Individual. ``Individual'' shall have the same meaning as

the term ``individual'' in 45 CFR 164.501 and shall include a person

who qualifies as a personal representative in accordance with 45 CFR

164.502(g).

(d) Privacy Rule. ``Privacy Rule'' shall mean the Standards for

Privacy of Individually Identifiable Health Information at 45 CFR

part 160 and part 164, subparts A and E.

(e) Protected Health Information. ``Protected Health

Information'' shall have the same meaning as the term ``protected

health information'' in 45 CFR 164.501, limited to the information

created or received by Business Associate from or on behalf of

Covered Entity.

(f) Required By Law. ``Required By Law'' shall have the same

meaning as the term ``required by law'' in 45 CFR 164.501.

(g) Secretary. ``Secretary'' shall mean the Secretary of the

Department of Health and Human Services or his designee.

Obligations and Activities of Business Associate

(a) Business Associate agrees to not use or further disclose

Protected Health Information other than as permitted or required by

the Agreement or as Required By Law.

(b) Business Associate agrees to use appropriate safeguards to

prevent use or disclosure of the Protected Health Information other

than as provided for by this Agreement.

(c) Business Associate agrees to mitigate, to the extent

practicable, any harmful effect that is known to Business Associate

of a use or disclosure of Protected Health Information by Business

Associate in violation of the requirements of this Agreement. [This

provision may be included if it is appropriate for the Covered

Entity to pass on its duty to mitigate damages by a Business

Associate.]

(d) Business Associate agrees to report to Covered Entity any

use or disclosure of the Protected Health Information not provided

for by this Agreement.

(e) Business Associate agrees to ensure that any agent,

including a subcontractor, to whom it provides Protected Health

Information received from, or created or received by Business

Associate on behalf of Covered Entity agrees to the same

restrictions and conditions that apply through this Agreement to

Business Associate with respect to such information.

(f) Business Associate agrees to provide access, at the request

of Covered Entity, and in the time and manner designated by Covered

Entity, to Protected Health Information in a Designated Record Set,

to Covered Entity or, as directed by Covered Entity, to an

Individual in order to meet the requirements under 45 CFR 164.524.

[Not necessary if business associate does not have protected health

information in a designated record set.]

(g) Business Associate agrees to make any amendment(s) to

Protected Health Information in a Designated Record Set that the

Covered Entity directs or agrees to pursuant to 45 CFR 164.526 at

the request of Covered Entity or an Individual, and in the time and

manner designated by Covered Entity. [Not necessary if business

associate does not have protected health information in a designated

record set.]

(h) Business Associate agrees to make internal practices, books,

and records relating to the use and disclosure of Protected Health

Information received from, or created or received by Business

Associate on behalf of, Covered Entity available to the Covered

Entity, or at the request of the Covered Entity to the Secretary, in

a time and manner designated by the Covered Entity or the Secretary,

for purposes of the Secretary determining Covered Entity's

compliance with the Privacy Rule.

(i) Business Associate agrees to document such disclosures of

Protected Health Information and information related to such

disclosures as would be required for Covered Entity to respond to a

request by an Individual for an accounting of disclosures of

Protected Health Information in accordance with 45 CFR 164.528.

(j) Business Associate agrees to provide to Covered Entity or an

Individual, in time and manner designated by Covered Entity,

information collected in accordance with Section [Insert Section

Number in Contract Where Provision (i) Appears] of this Agreement,

to permit Covered Entity to respond to a request by an Individual

for an accounting of disclosures of Protected Health Information in

accordance with 45 CFR 164.528.

Permitted Uses and Disclosures by Business Associate

General Use and Disclosure Provisions (alternative approaches)

Specify purposes:

Except as otherwise limited in this Agreement, Business

Associate may use or disclose Protected Health Information on behalf

of, or to provide services to, Covered Entity for the following

purposes, if such use or disclosure of Protected Health Information

would not violate the Privacy Rule if done by Covered Entity: [List

Purposes].

Refer to underlying services agreement:

Except as otherwise limited in this Agreement, Business

Associate may use or disclose Protected Health Information to

perform functions, activities, or services for, or on behalf of,

Covered Entity as specified in [Insert Name of Services Agreement],

provided that such use or disclosure would not violate the Privacy

Rule if done by Covered Entity.

[[Page 14810]]

Specific Use and Disclosure Provisions [only necessary if parties wish

to allow Business Associate to engage in such activities]

(a) Except as otherwise limited in this Agreement, Business

Associate may use Protected Health Information for the proper

management and administration of the Business Associate or to carry

out the legal responsibilities of the Business Associate.

(b) Except as otherwise limited in this Agreement, Business

Associate may disclose Protected Health Information for the proper

management and administration of the Business Associate, provided

that disclosures are required by law, or Business Associate obtains

reasonable assurances from the person to whom the information is

disclosed that it will remain confidential and used or further

disclosed only as required by law or for the purpose for which it

was disclosed to the person, and the person notifies the Business

Associate of any instances of which it is aware in which the

confidentiality of the information has been breached.

(c) Except as otherwise limited in this Agreement, Business

Associate may use Protected Health Information to provide Data

Aggregation services to Covered Entity as permitted by 42 CFR

164.504(e)(2)(i)(B).

Obligations of Covered Entity

Provisions for Covered Entity to Inform Business Associate of Privacy

Practices and Restrictions [provisions dependent on business

arrangement]

(a) Covered Entity shall provide Business Associate with the

notice of privacy practices that Covered Entity produces in

accordance with 45 CFR 164.520, as well as any changes to such

notice.

(b) Covered Entity shall provide Business Associate with any

changes in, or revocation of, permission by Individual to use or

disclose Protected Health Information, if such changes affect

Business Associate's permitted or required uses and disclosures.

(c) Covered Entity shall notify Business Associate of any

restriction to the use or disclosure of Protected Health Information

that Covered Entity has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by Covered Entity

Covered Entity shall not request Business Associate to use or

disclose Protected Health Information in any manner that would not

be permissible under the Privacy Rule if done by Covered Entity.

[Include an exception if the Business Associate will use or disclose

protected health information for, and the contract includes

provisions for, data aggregation or management and administrative

activities of Business Associate].

Term and Termination

(a) Term. The Term of this Agreement shall be effective as of

[Insert Effective Date], and shall terminate when all of the

Protected Health Information provided by Covered Entity to Business

Associate, or created or received by Business Associate on behalf of

Covered Entity, is destroyed or returned to Covered Entity, or, if

it is infeasible to return or destroy Protected Health Information,

protections are extended to such information, in accordance with the

termination provisions in this Section.

(b) Termination for Cause. Upon Covered Entity's knowledge of a

material breach by Business Associate, Covered Entity shall provide

an opportunity for Business Associate to cure the breach or end the

violation and terminate this Agreement [and the ____ Agreement/

sections ____ of the ____ Agreement] if Business Associate does not

cure the breach or end the violation within the time specified by

Covered Entity, or immediately terminate this Agreement [and the

____ Agreement/sections ____ of the ____ Agreement] if Business

Associate has breached a material term of this Agreement and cure is

not possible. [Bracketed language in this provision may be necessary

if there is an underlying services agreement. Also, opportunity to

cure is permitted, but not required by the Privacy Rule.]

(c) Effect of Termination.

(1) Except as provided in paragraph (2) of this section, upon

termination of this Agreement, for any reason, Business Associate

shall return or destroy all Protected Health Information received

from Covered Entity, or created or received by Business Associate on

behalf of Covered Entity. This provision shall apply to Protected

Health Information that is in the possession of subcontractors or

agents of Business Associate. Business Associate shall retain no

copies of the Protected Health Information.

(2) In the event that Business Associate determines that

returning or destroying the Protected Health Information is

infeasible, Business Associate shall provide to Covered Entity

notification of the conditions that make return or destruction

infeasible. Upon mutual agreement of the Parties that return or

destruction of Protected Health Information is infeasible, Business

Associate shall extend the protections of this Agreement to such

Protected Health Information and limit further uses and disclosures

of such Protected Health Information to those purposes that make the

return or destruction infeasible, for so long as Business Associate

maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a

section in the Privacy Rule means the section as in effect or as

amended, and for which compliance is required.

(b) Amendment. The Parties agree to take such action as is

necessary to amend this Agreement from time to time as is necessary

for Covered Entity to comply with the requirements of the Privacy

Rule and the Health Insurance Portability and Accountability Act,

Public Law 104-191.

(c) Survival. The respective rights and obligations of Business

Associate under Section [Insert Section Number Related to ``Effect

of Termination''] of this Agreement shall survive the termination of

this Agreement.

(d) Interpretation. Any ambiguity in this Agreement shall be

resolved in favor of a meaning that permits Covered Entity to comply

with the Privacy Rule.

List of Subjects

45 CFR Part 160

Electronic transactions, Employer benefit plan, Health, Health

care, Health facilities, Health insurance, Health records, Medicaid,

Medical research, Medicare, Privacy, Reporting and record keeping

requirements.

45 CFR Part 164

Electronic transactions, Employer benefit plan, Health, Health

care, Health facilities, Health insurance, Health records, Medicaid,

Medical research, Medicare, Privacy, Reporting and record keeping

requirements.

Dated: March 12, 2002.

Tommy G. Thompson,

Secretary.

For the reasons set forth in the preamble, the Department proposes

to amend 45 CFR Subtitle A, Subchapter C, as follows:

PART 160--GENERAL ADMINISTRATIVE REQUIREMENTS

1. The authority citation for part 160 continues to read as

follows:

Authority: Sec. 1171 through 1179 of the Social Security Act,

(42 U.S.C. 1320d-1329d-8) as added by sec. 262 of Pub. L. 104-191,

110 Stat. 2021-2031 and sec. 264 of Pub. L. 104-191 (42 U.S.C.

1320d-2(note)).

Sec. 160.102 [Amended]

2. Amend Sec. 160.102(b), by removing the phrase ``section

201(a)(5) of the Health Insurance Portability Act of 1996, (Pub. L.

104-191)'' and adding in its place the phrase ``the Social Security

Act, 42 U.S.C. 1320a-7c(a)(5)''.

3. In Sec. 160.103 add the definition of ``individually

identifiable health information'' in alphabetical order to read as

follows:

Sec. 160.103 Definitions.

* * * * *

Individually identifiable health information is information that is

a subset of health information, including demographic information

collected from an individual, and:

(1) Is created or received by a health care provider, health plan,

employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental

health or condition of an individual; the provision of health care to

an individual; or the past, present, or future payment for the

provision of health care to an individual; and

(i) That identifies the individual; or

(ii) With respect to which there is a reasonable basis to believe

the

[[Page 14811]]

information can be used to identify the individual.

* * * * *

4. In Sec. 160.202 revise paragraphs (2) and (4) of the definition

of ``more stringent'' to read as follows:

Sec. 160.202 Definitions.

* * * * *

More stringent means * * *

(2) With respect to the rights of an individual, who is the subject

of the individually identifiable health information, regarding access

to or amendment of individually identifiable health information,

permits greater rights of access or amendment, as applicable.

* * * * *

(4) With respect to the form, substance, or the need for express

legal permission from an individual, who is the subject of the

individually identifiable health information, for use or disclosure of

individually identifiable health information, provides requirements

that narrow the scope or duration, increase the privacy protections

afforded (such as by expanding the criteria for), or reduce the

coercive effect of the circumstances surrounding the express legal

permission, as applicable.

* * * * *

Sec. 160.203 [Amended]

5. Amend Sec. 160.203(b) by adding the words ``individually

identifiable'' before the word ``health''.

PART 164--SECURITY AND PRIVACY

Subpart E--Privacy of Individually Identifiable Health Information

1. The authority citation for part 164 continues to read as

follows:

Authority: 42 U.S.C. 1320d-2 and 1320d-4, sec. 264 of Pub. L.

104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)).

Sec. 164.102 [Amended]

2. Amend Sec. 164.102 by removing the words ``implementation

standards'' and adding in its place the words ``implementation

specifications.''

Sec. 164.500 [Amended]

3. In Sec. 164.500, remove ``consent,'' from paragraph (b)(1)(v).

Sec. 164.501 [Amended]

4. Amend Sec. 164.501 as follows:

a. In the definition of ``health care operations'' remove from the

introductory text of the definition ``, and any of the following

activities of an organized health care arrangement in which the covered

entity participates'' and revise paragraphs (6)(iv) and (v).

b. Remove the definition of ``individually identifiable health

information''.

c. Revise the definition of ``marketing''.

d. In paragraph (1)(ii) of the definition of ``payment,'' remove

the word ``covered''.

e. Revise paragraph (2) of the definition of ``protected health

information''.

The revisions read as follows:

Sec. 164.501 Definitions.

* * * * *

Health care operations means * * *

(6) * * *

(iv) The sale, transfer, merger, or consolidation of all or part of

a covered entity with another covered entity, or an entity that

following such activity will become a covered entity and due diligence

related to such activity; and

(v) Consistent with the applicable requirements of Sec. 164.514,

creating de-identified health information and fundraising for the

benefit of the covered entity.

* * * * *

Marketing means to make a communication about a product or service

to encourage recipients of the communication to purchase or use the

product or service. Marketing excludes a communication made to an

individual:

(1) To describe the entities participating in a health care

provider network or health plan network, or to describe if, and the

extent to which, a product or services (or payment for such product or

service) is provided by a covered entity or included in a plan of

benefits;

(2) For treatment of that individual; or

(3) For case management or care coordination for that individual,

or to direct or recommend alternative treatments, therapies, health

care providers, or settings of care to that individual.

* * * * *

Protected health information means * * *

(2) Protected health information excludes individually identifiable

health information in:

(i) Education records covered by the Family Educational Rights and

Privacy Act, as amended, 20 U.S.C. 1232g;

(ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and

(iii) Employment records held by a covered entity in its role as

employer.

* * * * *

5. Amend Sec. 164.502 as follows:

a. Revise paragraphs (a)(1)(ii), (iii), and (vi).

b. Revise paragraph (b)(2)(ii).

c. Redesignate paragraphs (b)(2)(iii) through (v) as paragraphs

(b)(2)(iv) through (vi).

d. Add a new paragraph (b)(2)(iii).

e. Redesignate paragraphs (g)(3)(i) through (iii) as (g)(3)(i)(A)

through (C) and redesignate paragraph (g)(3) as (g)(3)(i).

f. Add new paragraphs (g)(3)(ii) and (iii).

The revisions and additions read as follows:

Sec. 164.502 Uses and disclosures of protected health information:

general rules.

(a) Standard. * * *

(1) Permitted uses and disclosures. * * *

(ii) For treatment, payment, or health care operations, as

permitted by and in compliance with Sec. 164.506;

(iii) As incident to a use or disclosure otherwise permitted or

required by this subpart, provided that the covered entity has complied

with the applicable requirements of Sec. 164.502(b), Sec. 164.514(d),

and Sec. 164.530(c) with respect to such otherwise permitted or

required uses or disclosures;

* * * * *

(vi) As permitted by and in compliance with this section,

Sec. 164.512, or Sec. 164.514(f) and (g).

* * * * *

(b) Standard: Minimum necessary. * * *

(2) Minimum necessary does not apply. * * *

(ii) Uses or disclosures made to the individual, as permitted under

paragraph (a)(1)(i) of this section or as required by paragraph

(a)(2)(i) of this section;

(iii) Uses or disclosures made pursuant to an authorization under

Sec. 164.508;

* * * * *

(g)(1) Standard: Personal representatives. * * *

(3) Implementation specification: unemancipated minors.

(i) * * *

(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this

section:

(A) A covered entity may disclose protected health information

about an unemancipated minor to a parent, guardian, or other person

acting in loco parentis if an applicable provision of State or other

law, including applicable case law, permits or requires such

disclosure; and

(B) A covered entity may not disclose protected health information

about an unemancipated minor to a parent, guardian, or other person

acting in loco parentis if an applicable provision of State or other

law, including applicable case law, prohibits such disclosure.

[[Page 14812]]

(iii) Notwithstanding the provisions of paragraph (g)(3)(i) of this

section, a covered entity must, consistent with State or other

applicable law, provide a right of access, as set forth in Sec. 164.524

to either:

(A) A parent, guardian, or other person acting in loco parentis, as

the personal representative of the unemancipated minor;

(B) The unemancipated minor; or

(C) Both.

* * * * *

6. Amend Sec. 164.504 as follows:

a. In paragraph (a), revise the definitions of ``health care

component'' and ``hybrid entity''.

b. Revise paragraph (c)(1)(ii).

c. Revise paragraph (c)(3)(iii).

d. Revise paragraph (f)(1)(i).

e. Add paragraph (f)(1)(iii).

The revisions and addition read as follows:

Sec. 164.504 Uses and disclosures: Organizational requirements.

(a) Definitions. * * *

Health care component means a component or combination of

components of a hybrid entity designated by the hybrid entity in

accordance with paragraph (c)(3)(iii) of this section.

Hybrid entity means a single legal entity:

(1) That is a covered entity;

(2) Whose business activities include both covered and non-covered

functions; and

(3) That designates health care components in accordance with

paragraph (c)(3)(iii) of this section.

* * * * *

(c)(1) Implementation specification: Application of other

provisions. * * *

(ii) A reference in such provision to a ``health plan,'' ``covered

health care provider,'' or ``health care clearinghouse'' refers to a

health care component of the covered entity if such health care

component performs the functions of a health plan, health care

provider, or health care clearinghouse, as applicable; and

* * * * *

(3) Implementation specifications: Responsibilities of the covered

entity. * * *

(iii) The covered entity is responsible for designating the

components that are part of one or more health care components of the

covered entity and documenting the designation as required by

Sec. 164.530(j), provided that if the covered entity designates a

health care component or components, it must include any component that

would meet the definition of covered entity if it were a separate legal

entity. Health care component(s) may include a component that performs:

(A) covered functions; and

(B) activities that would make such component a business associate

of a component that performs covered functions if the two components

were separate legal entities.

* * * * *

(f)(1) Standard: Requirements for group health plans. (i) Except as

provided under paragraph (f)(1)(ii) or (iii) of this section or as

otherwise authorized under Sec. 164.508, a group health plan, in order

to disclose protected health information to the plan sponsor or to

provide for or permit the disclosure of protected health information to

the plan sponsor by a health insurance issuer or HMO with respect to

the group health plan, must ensure that the plan documents restrict

uses and disclosures of such information by the plan sponsor consistent

with the requirements of this subpart.

* * * * *

(iii) The group health plan, or a health insurance issuer or HMO

with respect to the group health plan, may disclose to the plan sponsor

information on whether the individual is participating in the group

health plan, or is enrolled in or has disenrolled from a health

insurance issuer or HMO offered by the plan to the plan sponsor.

* * * * *

7. Revise Sec. 164.506 to read as follows:

Sec. 164.506 Uses and disclosures to carry out treatment, payment, or

health care operations.

(a) Standard: Permitted uses and disclosures. Except with respect

to uses or disclosures that require an authorization under

Sec. 164.508(a)(2) and (3), a covered entity may use or disclose

protected health information for treatment, payment, or health care

operations as set forth in paragraph (c) of this section, provided that

such use or disclosure is consistent with other applicable requirements

of this subpart.

(b) Standard: Consent permitted. (1) A covered entity may obtain

consent of the individual to use or disclose protected health

information to carry out treatment, payment, or health care operations.

(2) Consent of an individual under this paragraph shall not be

effective to permit a use or disclosure of protected health information

that is not otherwise permitted or required by this subpart.

(c) Implementation specifications: Treatment, payment, or health

care operations.

(1) A covered entity may use or disclose protected health

information for its own treatment, payment, or health care operations.

(2) A covered entity may disclose protected health information for

treatment activities of another health care provider.

(3) A covered entity may disclose protected health information to

another covered entity or health care provider for the payment

activities of the entity that receives the information.

(4) A covered entity may disclose protected health information to

another covered entity for health care operations activities of the

entity that receives the information, if both entities have a

relationship with the individual who is the subject of the protected

health information being requested, and the disclosure is:

(i) For a purpose listed in paragraph (1) or (2) of the definition

of health care operations; or

(ii) For the purpose of health care fraud and abuse detection or

compliance.

(5) A covered entity that participates in an organized health care

arrangement may disclose protected health information about an

individual to another covered entity that participates in the organized

health care arrangement for any health care operations activities of

the organized health care arrangement.

8. Amend Sec. 164.508 as follows:

a. Remove ``consistent with consent requirements in Sec. 164.506''

in paragraph (a)(2)(i).

b. Add ``the'' before ``originator'' in paragraph (a)(2)(i)(A).

c. Remove the word ``in'' after the term ``covered entity'' and add

in its place the words ``for its own'' in paragraph (a)(2)(i)(B).

d. Add the words ``itself in'' after the word ``defend'' in

paragraph (a)(2)(i)(C).

e. Add paragraph (a)(3).

f. Revise paragraphs (b)(1)(i).

g. Remove the word ``be'' in paragraph (b)(1)(ii).

h. Remove '', (d), (e), or (f)'' from paragraph (b)(2)(ii).

i. Remove paragraph (b)(2)(iv).

j. Redesignate paragraphs (b)(2)(v) and (vi) as paragraphs

(b)(2)(iv) and (v).

k. Add ``or (4)'' after ``(b)(3)'' in redesignated paragraph

(b)(2)(iv).

l. Revise paragraphs (b)(3)(i).

m. Add a comma after the term ``psychotherapy notes'' in paragraph

(b)(3)(iii).

n. Remove ``under paragraph (f) of'' and add in its place ``for the

use or disclosure of protected health information for such research

under'' in paragraph (b)(4)(i).

[[Page 14813]]

o. Add the word ``and'' at the end of paragraph (b)(4)(ii)(B).

p. Remove paragraph (b)(4)(iii).

q. Redesignate paragraph (b)(4)(iv) as paragraph (b)(4)(iii).

r. Add ``or the policy itself'' after the word ``policy'' in

paragraph (b)(5)(ii).

s. Remove paragraphs (d), (e), and (f).

t. Revise paragraph (c).

The revisions and addition read as follows:

Sec. 164.508 Uses and disclosures for which an authorization is

required.

(a) Standard: Authorizations for uses and disclosures. * * *

(3) Authorization required: Marketing. (i) Notwithstanding any

other provision of this subpart other than Sec. 164.532, a covered

entity must obtain an authorization for any use or disclosure of

protected health information for marketing, except if the communication

is in the form of:

(A) A face-to-face communication made by a covered entity to an

individual; or

(B) A promotional gift of nominal value provided by the covered

entity.

(ii) If the marketing is expected to result in direct or indirect

remuneration to the covered entity from a third party, the

authorization must state that such remuneration is expected.

* * * * *

(b) Implementation specifications: General requirements. * * *

(1) Valid authorizations.

(i) A valid authorization is a document that meets the requirements

in paragraphs (c)(1) and (2) of this section.

* * * * *

(3) Compound authorizations. * * *

(i) An authorization for the use or disclosure of protected health

information for a specific research study may be combined with any

other type of written permission for the same research study, including

another authorization for the use or disclosure of protected health

information for such research or a consent to participate in such

research;

* * * * *

(c) Implementation specifications: Core elements and requirements.

(1) Core elements. A valid authorization under this section must

contain at least the following elements:

(i) A description of the information to be used or disclosed that

identifies the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or

class of persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s),

or class of persons, to whom the covered entity may make the requested

use or disclosure.

(iv) A description of each purpose of the requested use or

disclosure. The statement ``at the request of the individual'' is a

sufficient description of the purpose when an individual initiates the

authorization and does not, or elects not to, provide a statement of

the purpose.

(v) An expiration date or an expiration event that relates to the

individual or the purpose of the use or disclosure. The following

statements meet the requirements for an expiration date or an

expiration event if the appropriate conditions apply:

(A) The statement ``end of the research study'' or similar language

is sufficient if the authorization is for a use or disclosure of

protected health information for research.

(B) The statement ``none'' or similar language is sufficient if the

authorization is for the covered entity to use or disclose protected

health information for the creation and maintenance of a research

database or research repository.

(vi) Signature of the individual and date. If the authorization is

signed by a personal representative of the individual, a description of

such representative's authority to act for the individual must also be

provided.

(2) Required statements. In addition to the core elements, the

authorization must contain statements adequate to place the individual

on notice of all of the following:

(i) The individual's right to revoke the authorization in writing,

and either:

(A) The exceptions to the right to revoke and a description of how

the individual may revoke the authorization; or

(B) To the extent that the information in paragraph (c)(2)(i)(A) of

this section is included in the notice required by Sec. 164.520, a

reference to the covered entity's notice.

(ii) The ability or inability to condition treatment, payment,

enrollment or eligibility for benefits on the authorization, by stating

either:

(A) The covered entity may not condition treatment, payment,

enrollment or eligibility for benefits on whether the individual signs

the authorization when the prohibition on conditioning of

authorizations in paragraph (b)(4) of this section applies; or

(B) The consequences to the individual of a refusal to sign the

authorization when, in accordance with paragraph (b)(4) of this

section, the covered entity can condition treatment, enrollment in the

health plan, or eligibility for benefits on failure to obtain such

authorization.

(iii) The potential for information disclosed pursuant to the

authorization to be subject to redisclosure by the recipient and no

longer be protected by this rule.

(3) Plain language requirement. The authorization must be written

in plain language.

(4) Copy to the individual. If a covered entity seeks an

authorization from an individual for a use or disclosure of protected

health information, the covered entity must provide the individual with

a copy of the signed authorization.

9. Amend Sec. 164.510 as follows:

a. Revise the first sentence of the introductory text.

b. Remove the word ``for'' from paragraph (b)(3).

The revision reads as follows:

Sec. 164.510 Uses and disclosures requiring an opportunity for the

individual to agree or to object.

A covered entity may use or disclose protected health information,

provided that the individual is informed in advance of the use or

disclosure and has the opportunity to agree to or prohibit or restrict

the use or disclosure, in accordance with the applicable requirements

of this section. * * *

* * * * *

10. Amend Sec. 164.512 as follows:

a. Revise the section heading and the first sentence of the

introductory text.

b. Revise paragraph (b)(1)(iii).

c. In paragraph (b)(1)(v)(A) remove the word ``a'' before the word

``health.''

d. Add the word ``and'' after the semicolon at the end of paragraph

(b)(1)(v)(C).

e. Redesignate paragraphs (f)(3)(ii) and (iii) as (f)(3)(i) and

(ii).

f. In the second sentence of paragraph (g)(2) add the word ``to''

after the word ``directors.''

g. In paragraph (i)(1)(iii)(A) remove the word ``is'' after the

word ``disclosure.''

h. Revise paragraph (i)(2)(ii).

The revisions read as follows:

Sec. 164.512 Uses and disclosures for which an authorization or

opportunity to agree or object is not required.

A covered entity may use or disclose protected health information

without the written authorization of the individual, as described in

Sec. 164.508, or the opportunity for the individual to agree or object

as described in Sec. 164.510, in the situations covered by this

section,

[[Page 14814]]

subject to the applicable requirements of this section. * * *

* * * * *

(b) Standard: uses and disclosures for public health activities.

(1) Permitted disclosures. * * *

(iii) A person subject to the jurisdiction of the Food and Drug

Administration (FDA) with respect to an FDA-regulated product or

activity for which that person has responsibility, for the purpose of

activities related to the quality, safety or effectiveness of such FDA-

regulated product or activity. Such purposes include:

(A) To collect or report adverse events (or similar activities with

respect to food or dietary supplements), product defects or problems

(including problems with the use or labeling of a product), or

biological product deviations;

(B) To track FDA-regulated products;

(C) To enable product recalls, repairs, or replacement, or lookback

(including locating and notifying individuals who have received

products that have been recalled, withdrawn, or are the subject of

lookback); or

(D) To conduct post marketing surveillance;

* * * * *

(i) Standard: Uses and disclosures for research purposes. * * *

(2) Documentation of waiver approval. * * *

(ii) Waiver criteria. A statement that the IRB or privacy board has

determined that the alteration or waiver, in whole or in part, of

authorization satisfies the following criteria:

(A) The use or disclosure of protected health information involves

no more than a minimal risk to the privacy of individuals, based on, at

least, the presence of the following elements;

(1) An adequate plan to protect the identifiers from improper use

and disclosure;

(2) An adequate plan to destroy the identifiers at the earliest

opportunity consistent with conduct of the research, unless there is a

health or research justification for retaining the identifiers or such

retention is otherwise required by law; and

(3) Adequate written assurances that the protected health

information will not be reused or disclosed to any other person or

entity, except as required by law, for authorized oversight of the

research study, or for other research for which the use or disclosure

of protected health information would be permitted by this subpart;

(B) The research could not practicably be conducted without the

waiver or alteration; and

(C) The research could not practicably be conducted without access

to and use of the protected health information.

* * * * *

11. Amend Sec. 164.514 as follows:

a. Revise paragraph (b)(2)(i)(R).

b. Revise paragraph (d)(1).

c. Revise paragraph (d)(4)(iii).

d. Remove and reserve paragraph (e).

The revisions read as follows:

Sec. 164.514 Other requirements relating to uses and disclosures of

protected health information.

* * * * *

(b) Implementation specifications: Requirements for de-

identification of protected health information. * * *

(2)(i) * * *

(R) Any other unique identifying number, characteristic, or code,

except as permitted by paragraph (c) of this section; and

* * * * *

(d)(1) Standard: minimum necessary requirements. In order to comply

with Sec. 164.502(b) and this section, a covered entity must meet the

requirements of paragraphs (d)(2) through (d)(5) of this section with

respect to a request for or the use and disclosure of protected health

information.

* * * * *

(4) Implementation specifications: Minimum necessary requests for

protected health information. * * *

(iii) For all other requests, a covered entity must:

(A) Develop criteria designed to limit the request for protected

health information to the information reasonably necessary to

accomplish the purpose for which the request is made; and

(B) Review requests for disclosure on an individual basis in

accordance with such criteria.

* * * * *

(e) [Removed and Reserved]

* * * * *

12. Amend Sec. 164.520 as follows:

a. Remove the word ``consent or'' from paragraph (b)(1)(ii)(B).

b. Revise paragraph (c)(2)(i).

c. Redesignate paragraphs (c)(2)(ii) and (iii) as (c)(2)(iii) and

(iv).

d. Add new paragraph (c)(2)(ii).

e. Amend redesignated paragraph (c)(2)(iv) by removing

``(c)(2)(ii)'' and adding in its place ``(c)(2)(iii)'.

f. Revise paragraph (c)(3)(iii) by adding a sentence at the end.

g. Revise paragraph (e).

The revisions and addition read as follows:

Sec. 164.520 Notice of privacy practices for protected health

information.

* * * * *

(c) Implementation specifications: provision of notice. * * *

(2) Specific requirements for certain covered health care

providers. * * *

(i) Provide the notice:

(A) No later than the date of the first service delivery, including

service delivered electronically, to such individual after the

compliance date for the covered health care provider; or

(B) In an emergency treatment situation, as soon as reasonably

practicable after the emergency treatment situation.

(ii) Except in an emergency treatment situation, make a good faith

effort to obtain a written acknowledgment of receipt of the notice

provided in accordance with paragraph (c)(2)(i) of this section, and if

not obtained, document its good faith efforts to obtain such

acknowledgment and the reason why the acknowledgment was not obtained;

* * * * *

(3) Specific requirements for electronic notice. * * *

(iii) * * * The requirements in paragraph (c)(2)(ii) of this

section apply to electronic notice.

* * * * *

(e) Implementation specifications: Documentation. A covered entity

must document compliance with the notice requirements, as required by

Sec. 164.530(j), by retaining copies of the notices issued by the

covered entity and, if applicable, any written acknowledgments of

receipt of the notice or documentation of good faith efforts to obtain

such written acknowledgment, in accordance with paragraph (c)(2)(ii) of

this section.

Sec. 164.522 [Amended]

13. Amend Sec. 164.522 by removing the reference to

``164.502(a)(2)(i)'' in paragraph (a)(1)(v), and adding in its place

``164.502(a)(2)(ii)''.

14. Amend Sec. 164.528 as follows:

a. In paragraph (a)(1)(i), remove ``Sec. 164.502'' and add in its

place ``Sec. 164.506''.

b. Redesignate paragraphs (a)(1)(iii) through (vi) as (a)(1)(iv)

through (vii).

c. Add paragraph (a)(1)(iii).

d. Revise paragraph (b)(2)(iv) in its entirety.

e. Remove ``or pursuant to a single authorization under

Sec. 164.508,'' from paragraph (b)(3).

The addition and revision read as follows:

Sec. 164.528 Accounting of disclosures of protected health

information.

(a) Standard: Right to an accounting of disclosures of protected

health information.

[[Page 14815]]

(1) * * *

(iii) Pursuant to an authorization as provided in Sec. 164.508.

* * * * *

(b) Implementation specifications: Content of the accounting. * * *

(2) * * *

(iv) A brief statement of the purpose of the disclosure that

reasonably informs the individual of the basis for the disclosure or,

in lieu of such statement, a copy of a written request for a disclosure

under Secs. 164.502(a)(2)(ii) or 164.512, if any.

* * * * *

15. Amend Sec. 164.530 as follows:

a. Redesignate paragraph (c)(2) as (c)(2)(i).

b. Add paragraph (c)(2)(ii).

c. Remove the words ``the requirements'' from paragraph

(i)(4)(ii)(A) and add in their place the word ``specifications.''

The addition reads as follows:

Sec. 164.530 Administrative requirements.

* * * * *

(c) Standard: Safeguards. * * *

(2) Implementation specifications: Safeguards. (i) * * *

(ii) A covered entity must reasonably safeguard protected health

information to limit incidental uses or disclosures made pursuant to an

otherwise permitted or required use or disclosure.

* * * * *

16. Revise Sec. 164.532 to read as follows:

Sec. 164.532 Transition Provisions.

(a) Standard: Effect of prior authorizations. Notwithstanding

Secs. 164.508 and 164.512(i), a covered entity may use or disclose

protected health information, consistent with paragraphs (b) and (c) of

this section, pursuant to an authorization or other express legal

permission obtained from an individual permitting the use or disclosure

of protected health information, informed consent of the individual to

participate in research, or a waiver of informed consent by an IRB.

(b) Implementation specification: Effect of prior authorization for

purposes other than research. Notwithstanding any provisions in

Sec. 164.508, a covered entity may use or disclose protected health

information that it created or received prior to the applicable

compliance date of this subpart pursuant to an authorization or other

express legal permission obtained from an individual prior to the

applicable compliance date of this subpart, provided that the

authorization or other express legal permission specifically permits

such use or disclosure and there is no agreed-to restriction in

accordance with Sec. 164.522(a).

(c) Implementation specification: Effect of prior permission for

research. Notwithstanding any provisions in Secs. 164.508 and

164.512(i), a covered entity may use or disclose, for a specific

research study, protected health information that it created or

received either before or after the applicable compliance date of this

subpart, provided that there is no agreed-to restriction in accordance

with Sec. 164.522(a) and that the covered entity has obtained, prior to

the applicable compliance date, either:

(1) The authorization or other express legal permission from an

individual to use or disclose protected health information for the

research study;

(2) The informed consent of the individual to participate in the

research study; or

(3) A waiver, by an IRB, of informed consent for the research

study, in accordance with 7 CFR 1c.116(d), 10 CFR 745.116(d), 14 CFR

1230.116(d), 15 CFR 27.116(d), 16 CFR 1028.116(d), 21 CFR 50.24, 22 CFR

225.116(d), 24 CFR 60.116(d), 28 CFR 46.116(d), 32 CFR 219.116(d), 34

CFR 97.116(d), 38 CFR 16.116(d), 40 CFR 26.116(d), 45 CFR 46.116(d), 45

CFR 690.116(d), or 49 CFR 11.116(d), provided that a covered entity

must obtain authorization in accordance with Sec. 164.508 if, after the

compliance date, informed consent is sought from an individual

participating in the research study.

(d) Standard: Effect of prior contracts or other arrangements with

business associates. Notwithstanding any other provisions of this

subpart, a covered entity, other than a small health plan, may disclose

protected health information to a business associate and may allow a

business associate to create, receive, or use protected health

information on its behalf pursuant to a written contract or other

written arrangement with such business associate that does not comply

with Secs. 164.502(e) and 164.504(e) consistent with the requirements,

and only for such time, set forth in paragraph (e) of this section.

(e) Implementation specification: Deemed compliance.--(1)

Qualification. Notwithstanding other sections of this subpart, a

covered entity, other than a small health plan, is deemed to be in

compliance with the documentation and contract requirements of

Secs. 164.502(e) and 164.504(e), with respect to a particular business

associate relationship, for the time period set forth in paragraph

(e)(2) of this section, if:

(i) Prior to the effective date of this provision, such covered

entity has entered into and is operating pursuant to a written contract

or other written arrangement with a business associate for such

business associate to perform functions or activities or provide

services that make the entity a business associate; and

(ii) The contract or other arrangement is not renewed or modified

from the effective date of this provision and until the compliance date

set forth in Sec. 164.534.

(2) Limited deemed compliance period. A prior contract or other

arrangement that meets the qualification requirements in paragraph (e)

of this section, shall be deemed compliant until the earlier of:

(i) The date such contract or other arrangement is renewed or

modified on or after the compliance date set forth in Sec. 164.534; or

(ii) April 14, 2004.

(3) Covered entity responsibilities. Nothing in this section shall

alter the requirements of a covered entity to comply with part 160,

subpart C of this subchapter and Secs. 164.524, 164.526, and 164.528

with respect to protected health information held by a business

associate.

[FR Doc. 02-7144 Filed 3-21-02; 12:00 pm]

BILLING CODE 4153-01-P