HHS and Health Privacy Framework HIPPA Privacy Rule Reflection Paper Write a reflective essay. Develop a descriptive essay on the origins of and regulatory

HHS and Health Privacy Framework HIPPA Privacy Rule Reflection Paper Write a reflective essay. Develop a descriptive essay on the origins of and regulatory objectives defined in the Privacy Rule.Read the “Background” section on pp. 82462-82474 of the Final Privacy Rule.Identify and summarize the reasons why the U.S. Department of Health and Human Services (HHS) believed (at the time) that the country needed a national health privacy framework. What industry “gaps” were the regulators trying to address with the Privacy Rule?Reflect on the challenges HHS raised in the early aughts. Are these challenges still relevant today? Why or why not? Thursday,
December 28, 2000
Part II
Department of
Health and Human
Services
Office of the Secretary
45 CFR Parts 160 and 164
Standards for Privacy of Individually
Identifiable Health Information; Final
Rule
VerDate 112000
19:16 Dec 27, 2000
Jkt 194001
PO 00000
Frm 00001
Fmt 4717
Sfmt 4717
E:FRFM28DER2.SGM
pfrm08
PsN: 28DER2
82462
Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
45 CFR Parts 160 and 164
Rin: 0991–AB08
Standards for Privacy of Individually
Identifiable Health Information
AGENCY: Office of the Assistant
Secretary for Planning and Evaluation,
DHHS.
ACTION: Final rule.
SUMMARY: This rule includes standards
to protect the privacy of individually
identifiable health information. The
rules below, which apply to health
plans, health care clearinghouses, and
certain health care providers, present
standards with respect to the rights of
individuals who are the subjects of this
information, procedures for the exercise
of those rights, and the authorized and
required uses and disclosures of this
information.
The use of these standards will
improve the efficiency and effectiveness
of public and private health programs
and health care services by providing
enhanced protections for individually
identifiable health information. These
protections will begin to address
growing public concerns that advances
in electronic technology and evolution
in the health care industry are resulting,
or may result, in a substantial erosion of
the privacy surrounding individually
identifiable health information
maintained by health care providers,
health plans and their administrative
contractors. This rule implements the
privacy requirements of the
Administrative Simplification subtitle
of the Health Insurance Portability and
Accountability Act of 1996.
DATES: The final rule is effective on
February 26, 2001.
FOR FURTHER INFORMATION CONTACT:
Kimberly Coleman, 1–866–OCR–PRIV
(1–866–627–7748) or TTY 1–866–788–
4989.
SUPPLEMENTARY INFORMATION:
Availability of copies, and electronic
access.
Copies: To order copies of the Federal
Register containing this document, send
your request to: New Orders,
Superintendent of Documents, P.O. Box
371954, Pittsburgh, PA 15250–7954.
Specify the date of the issue requested
and enclose a check or money order
payable to the Superintendent of
Documents, or enclose your Visa or
Master Card number and expiration
date. Credit card orders can also be
VerDate 112000
19:16 Dec 27, 2000
placed by calling the order desk at (202)
512–1800 or by fax to (202) 512–2250.
The cost for each copy is $8.00. As an
alternative, you can view and
photocopy the Federal Register
document at most libraries designated
as Federal Depository Libraries and at
many other public and academic
libraries throughout the country that
receive the Federal Register.
Electronic Access: This document is
available electronically at http://
aspe.hhs.gov/admnsimp/ as well as at
the web site of the Government Printing
Office at http://www.access.gpo.gov/
su_docs/aces/aces140.html.
I. Background
Table of Contents
Sec.
160.101 Statutory basis and purpose.
160.102 Applicability.
160.103 Definitions.
160.104 Modifications.
160.201 Applicability
160.202 Definitions.
160.203 General rule and exceptions.
160.204 Process for requesting exception
determinations.
160.205 Duration of effectiveness of
exception determinations.
160.300 Applicability.
160.302 Definitions.
160.304 Principles for achieving
compliance.
(a) Cooperation.
(b) Assistance.
160.306 Complaints to the Secretary.
(a) Right to file a complaint.
(b) Requirements for filing complaints.
(c) Investigation.
160.308 Compliance reviews.
160.310 Responsibilities of covered entities.
(a) Provide records and compliance
reports.
(b) Cooperate with complaint
investigations and compliance reviews.
(c) Permit access to information.
160.312 Secretarial action regarding
complaints and compliance reviews.
(a) Resolution where noncompliance is
indicated.
(b) Resolution when no violation is found.
164.102 Statutory basis.
164.104 Applicability.
164.106 Relationship to other parts.
164.500 Applicability.
164.501 Definitions.
164.502 Uses and disclosures of protected
health information: general rules.
(a) Standard.
(b) Standard: minimum necessary.
(c) Standard: uses and disclosures of
protected health information subject to
an agreed upon restriction.
(d) Standard: uses and disclosures of deidentified protected health information.
(e) Standard: disclosures to business
associates.
(f) Standard: deceased individuals.
(g) Standard: personal representatives.
(h) Standard: confidential
communications.
Jkt 194001
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
(i) Standard: uses and disclosures
consistent with notice.
(j) Standard: disclosures by
whistleblowers and workforce member
crime victims.
164.504 Uses and disclosures:
organizational requirements.
(a) Definitions.
(b) Standard: health care component.
(c) Implementation specification:
application of other provisions.
(d) Standard: affiliated covered entities.
(e) Standard: business associate contracts.
(f) Standard: requirements for group
health plans.
(g) Standard: requirements for a covered
entity with multiple covered functions.
164.506 Consent for uses or disclosures to
carry out treatment, payment, or health
care operations.
(a) Standard: consent requirement.
(b) Implementation specifications: general
requirements.
(c) Implementation specifications: content
requirements.
(d) Implementation specifications:
defective consents.
(e) Standard: resolving conflicting
consents and authorizations.
(f) Standard: joint consents.
164.508 Uses and disclosures for which an
authorization is required.
(a) Standard: authorizations for uses and
disclosures.
(b) Implementation specifications: general
requirements.
(c) Implementation specifications: core
elements and requirements.
(d) Implementation specifications:
authorizations requested by a covered
entity for its own uses and disclosures.
(e) Implementation specifications:
authorizations requested by a covered
entity for disclosures by others.
(f) Implementation specifications:
authorizations for uses and disclosures
of protected health information created
for research that includes treatment of
the individual.
164.510 Uses and disclosures requiring an
opportunity for the individual to agree or
to object.
(a) Standard: use and disclosure for
facility directories.
(b) Standard: uses and disclosures for
involvement in the individual’s care and
notification purposes.
164.512 Uses and disclosures for which
consent, an authorization, or opportunity
to agree or object is not required.
(a) Standard: uses and disclosures
required by law.
(b) Standard: uses and disclosures for
public health activities.
(c) Standard: disclosures about victims of
abuse, neglect or domestic violence.
(d) Standard: uses and disclosures for
health oversight activities.
(e) Standard: disclosures for judicial and
administrative proceedings.
(f) Standard: disclosures for law
enforcement purposes.
(g) Standard: uses and disclosures about
decedents.
(h) Standard: uses and disclosures for
cadaveric organ, eye or tissue donation
purposes.
E:FRFM28DER2.SGM
pfrm08
PsN: 28DER2
Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations
(i) Standard: uses and disclosures for
research purposes.
(j) Standard: uses and disclosures to avert
a serious threat to health or safety.
(k) Standard: uses and disclosures for
specialized government functions.
(l) Standard: disclosures for workers’
compensation.
164.514 Other requirements relating to uses
and disclosures of protected health
information.
(a) Standard: de-identification of
protected health information.
(b) Implementation specifications:
requirements for de-identification of
protected health information.
(c) Implementation specifications: reidentification.
(d) Standard: minimum necessary
requirements.
(e) Standard: uses and disclosures of
protected health information for
marketing.
(f) Standard: uses and disclosures for
fundraising.
(g) Standard: uses and disclosures for
underwriting and related purposes.
(h) Standard: verification requirements
164.520 Notice of privacy practices for
protected health information.
(a) Standard: notice of privacy practices.
(b) Implementation specifications: content
of notice.
(c) Implementation specifications:
provision of notice.
(d) Implementation specifications: joint
notice by separate covered entities.
(e) Implementation specifications:
documentation.
164.522 Rights to request privacy protection
for protected health information.
(a) Standard: right of an individual to
request restriction of uses and
disclosures.
(b) Standard: confidential
communications requirements.
164.524 Access of individuals to protected
health information.
(a) Standard: access to protected health
information.
(b) Implementation specifications:
requests for access and timely action.
(c) Implementation specifications:
provision of access.
(d) Implementation specifications: denial
of access.
(e) Implementation specification:
documentation.
164.526 Amendment of protected health
information.
(a) Standard: right to amend.
(b) Implementation specifications:
requests for amendment and timely
action.
(c) Implementation specifications:
accepting the amendment.
(d) Implementation specifications:
denying the amendment.
(e) Implementation specification: actions
on notices of amendment.
(f) Implementation specification:
documentation.
164.528 Accounting of disclosures of
protected health information.
(a) Standard: right to an accounting of
disclosures of protected health
information.
VerDate 112000
19:16 Dec 27, 2000
(b) Implementation specifications: content
of the accounting.
(c) Implementation specifications:
provision of the accounting.
(d) Implementation specification:
documentation.
164.530 Administrative requirements.
(a) Standard: personnel designations.
(b) Standard: training.
(c) Standard: safeguards.
(d) Standard: complaints to the covered
entity.
(e) Standard: sanctions
(f) Standard: mitigation.
(g) Standard: refraining from intimidating
or retaliatory acts.
(h) Standard: waiver of rights.
(i) Standard: policies and procedures.
(j) Standard: documentation.
(k) Standard: group health plans.
164.532 Transition provisions.
(a) Standard: effect of prior consents and
authorizations.
(b) Implementation specification:
requirements for retaining effectiveness
of prior consents and authorizations.
164.534 Compliance dates for initial
implementation of the privacy standards.
(a) Health care providers.
(b) Health plans.
(c) Health care clearinghouses.
Purpose of the Administrative
Simplification Regulations
This regulation has three major
purposes: (1) To protect and enhance
the rights of consumers by providing
them access to their health information
and controlling the inappropriate use of
that information; (2) to improve the
quality of health care in the U.S. by
restoring trust in the health care system
among consumers, health care
professionals, and the multitude of
organizations and individuals
committed to the delivery of care; and
(3) to improve the efficiency and
effectiveness of health care delivery by
creating a national framework for health
privacy protection that builds on efforts
by states, health systems, and individual
organizations and individuals.
This regulation is the second final
regulation to be issued in the package of
rules mandated under title II subtitle F
section 261–264 of the Health Insurance
Portability and Accountability Act of
1996 (HIPAA), Public Law 104–191,
titled ‘‘Administrative Simplification.’’
Congress called for steps to improve
‘‘the efficiency and effectiveness of the
health care system by encouraging the
development of a health information
system through the establishment of
standards and requirements for the
electronic transmission of certain health
information.’’ To achieve that end,
Congress required the Department to
promulgate a set of interlocking
regulations establishing standards and
protections for health information
systems. The first regulation in this set,
Jkt 194001
PO 00000
Frm 00003
Fmt 4701
Sfmt 4700
82463
Standards for Electronic Transactions 65
FR 50312, was published on August 17,
2000 (the ‘‘Transactions Rule’’). This
regulation establishing Standards for
Privacy of Individually Identifiable
Health Information is the second final
rule in the package. A rule establishing
a unique identifier for employers to use
in electronic health care transactions, a
rule establishing a unique identifier for
providers for such transactions, and a
rule establishing standards for the
security of electronic information
systems have been proposed. See 63 FR
25272 and 25320 (May 7, 1998); 63 FR
32784 (June 16, 1998); 63 FR 43242
(August 12, 1998). Still to be proposed
are rules establishing a unique identifier
for health plans for electronic
transactions, standards for claims
attachments, and standards for
transferring among health plans
appropriate standard data elements
needed for coordination of benefits. (See
section C, below, for a more detailed
explanation of the statutory mandate for
these regulations.)
In enacting HIPAA, Congress
recognized the fact that administrative
simplification cannot succeed if we do
not also protect the privacy and
confidentiality of personal health
information. The provision of highquality health care requires the
exchange of personal, often-sensitive
information between an individual and
a skilled practitioner. Vital to that
interaction is the patient’s ability to
trust that the information shared will be
protected and kept confidential. Yet
many patients are concerned that their
information is not protected. Among the
factors adding to this concern are the
growth of the number of organizations
involved in the provision of care and
the processing of claims, the growing
use of electronic information
technology, increased efforts to market
health care and other products to
consumers, and the increasing ability to
collect highly sensitive information
about a person’s current and future
health status as a result of advances in
scientific research.
Rules requiring the protection of
health privacy in the United States have
been enacted primarily by the states.
While virtually every state has enacted
one or more laws to safeguard privacy,
these laws vary significantly from state
to state and typically apply to only part
of the health care system. Many states
have adopted laws that protect the
health information relating to certain
health conditions such as mental
illness, communicable diseases, cancer,
HIV/AIDS, and other stigmatized
conditions. An examination of state
health privacy laws and regulations,
E:FRFM28DER2.SGM
pfrm08
PsN: 28DER2
82464
Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations
however, found that ‘‘state laws, with a
few notable exceptions, do not extend
comprehensive protections to people’s
medical records.’’ Many state rules fail
to provide such basic protections as
ensuring a patient’s legal right to see a
copy of his or her medical record. See
Health Privacy Project, ‘‘The State of
Health Privacy: An Uneven Terrain,’’
Institute for Health Care Research and
Policy, Georgetown University (July
1999) (http://www.healthprivacy.org)
(the ‘‘Georgetown Study’’).
Until now, virtually no federal rules
existed to protect the privacy of health
information and guarantee patient
access to such information. This final
rule establishes, for the first time, a set
of basic national privacy standards and
fair information practices that provides
all Americans with a basic level of
protection and peace of mind that is
essential to their full participation in
their care. The rule sets a floor of
ground rules for health care providers,
health plans, and health care
clearinghouses to follow, in order to
protect patients and encourage them to
seek needed care. The rule seeks to
balance the needs of the individual with
the needs of the society. It creates a
framework of protection that can be
strengthened by both the federal
government and by states as health
information systems continue to evolve.
Need for a National Health Privacy
Framework
The Importance of Privacy
Privacy is a fundamental right. As
such, it must be viewed differently than
any ordinary economic good. The costs
and benefits of a regulation must, of
course, be considered as a means of
identifying and weighing options. At the
same time, it is important not to lose
sight of the inherent meaning of privacy:
it speaks to our individual and
collective freedom.
A right to privacy in personal
information has historically found
expression in American law. All fifty
states today recognize in tort law a
common law or statutory right to
privacy. Many states specifically
provide a remedy for public revelation
of private facts. Some states, such as
California and Tennessee, have a right
to privacy as a matter of state
constitutional law. The multiple
historical sources for legal rights to
privacy are traced in many places,
including Chapter 13 of Alan Westin’s
Privacy and Freedom and in Ellen
Alderman & Caroline Kennedy, The
Right to Privacy (1995).
Throughout our nation’s history, we
have placed the rights of the individual
VerDate 112000
19:16 Dec 27, 2000
at the forefront of our democracy. In the
Declaration of Independence, we
asserted the ‘‘unalienable right’’ to ‘‘life,
liberty and the pursuit of happiness.’’
Many of the most basic protections in
the Constitution of the United States are
imbued with an attempt to protect
individual privacy while balancing it
against the larger social purposes of the
nation.
To take but one example, the Fourth
Amendment to the United States
Constitution guarantees that ‘‘the right
of the people to be secure in their
persons, houses, papers and effects,
against unreasonable searches and
seizures, shall not be violated.’’ By
referring to the need for security of
‘‘persons’’ as well as ‘‘papers and
effects’’ the Fourth Amendment suggests
enduring values in American law that
relate to privacy. The need for security
of ‘‘persons’’ is consistent with
obtaining patient consent before
performing invasive medical
procedures. The need for security in
‘‘papers and effects’’ underscores the
importance of protecting information
about the person, contained in sources
such as personal diaries, medical
records, or elsewhere. As is generally
true for the right of privacy in
information, the right is not absolute.
The test instead is what constitutes an
‘‘unreasonable’’ search of the papers and
effects.
The United States Supreme Court has
upheld the constitutional protection of
personal health information. In Whalen
v. Roe, 429 U.S. 589 (1977), the Court
analyzed a New York statute that
created a database of persons who
obtained drugs for which there was both
a lawful and unlawful market. The
Court, in upholding the statute,
recognized at least two different kinds
of interests within the constitutionally
protected ‘‘zone of privacy.’’ ‘‘One is the
individual interest in avoiding
disclosure of personal matters,’’ such as
this regulation principally addresses.
This interest in avoiding disclosure,
discussed in Whalen in the context of
medical information, was found to be
distinct from a different line of cases
concerning ‘‘the interest in
independence in making certain kinds
of important decisions.’’
Individuals’ right to privacy in
information about themselves is not
absolute. It does not, for instance,
prevent reporting of public health
information on communicable diseases
or stop law enforcement from getting
information when due process has been
obse…
Purchase answer to see full
attachment