[Federal Register: December 28, 2000 (Volume 65, Number 250)]
[Rules and Regulations]
[Page 82561-82610]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr28de00-31]

[[pp. 82561-82610]] Standards for Privacy of Individually Identifiable Health
Information

[[Continued from page 82560]]

[[Page 82561]]

A covered entity may only extend the deadline one time per request for
accounting.
    The NPRM did not address whether a covered entity could charge a
fee for the accounting of disclosures.
    In the final rule, we provide that individuals have a right to
receive one free accounting per 12 month period. For each additional
request by an individual within the 12 month period, the covered entity
may charge a reasonable, cost-based fee. If it imposes such a fee, the
covered entity must inform the individual of the fee in advance and
provide the individual with an opportunity to withdraw or modify the
request in order to avoid or reduce the fee.

Procedures and Documentation

    As in the proposed rule, we establish documentation requirements
for covered entities subject to this provision. In accordance with
Sec. 164.530(j), for disclosures that are subject to the accounting
requirement, the covered entity must retain documentation of the
information required to be included in the accounting. The covered
entity must also retain a copy of any accounting provided and must
document the titles of the persons or offices responsible for receiving
and processing requests for an accounting.

Section 164.530--Administrative Requirements

Designation of a Privacy Official and Contact Person

    In Sec. 164.518(a) of the NPRM, we proposed that covered entities
be required to designate an individual as the covered entity's privacy
official, responsible for the implementation and development of the
entity's privacy policies and procedures. We also proposed that covered
entities be required to designate a contact person to receive
complaints about privacy and provide information about the matters
covered by the entity's notice. We indicated that the contact person
could be, but was not required to be, the person designated as the
privacy official. We proposed to leave implementation details to the
discretion of the covered entity. We expected implementation to vary
widely depending on the size and nature of the covered entity, with
small offices assigning this as an additional duty to an existing staff
person, and large organizations creating a full-time privacy official.
In proposed Sec. 164.512, we also proposed to require the covered plan
or provider's privacy notice to include the name of a contact person
for privacy matters.
    The final regulation retains the requirements for a privacy
official and contact person as specified in the NPRM. These
designations must be documented. The designation of privacy official
and contact person positions within affiliated entities will depend on
how the covered entity chooses to designate the covered entity(ies)
under Sec. 164.504(b). If a subsidiary is defined as a covered entity
under this regulation, then a separate privacy official and contact
person is required for that covered entity. If several subsidiaries are
designated as a single covered entity, pursuant to Sec. 164.504(b),
then together they need have only a single privacy officer and contact
person. If several covered entities share a notice for services
provided on the same premises, pursuant to Sec. 164.520(d), that notice
need designate only one privacy official and contact person for the
information collected under that notice.
    These requirements are consistent with the approach recommended by
the Joint Commission on Accreditation of Healthcare Organizations, and
the National Committee for Quality Assurance, in its paper ``Protecting
Personal Health Information; A framework for Meeting the Challenges in
a Managed Care Environment.'' This paper notes that ``accountability is
enhanced by having focal points who are responsible for assessing
compliance with policies and procedures * * * '' (p. 29)

Training

    In Sec. 164.518(b) of the NPRM we proposed to require that covered
entities provide training on the entities' policies and procedures to
all members of the workforce likely to have access to protected health
information. Each entity would be required to provide initial training
by the date on which this rule became applicable. After that date, each
covered entity would have to provide training to new members of the
workforce within a reasonable time after joining the entity. In
addition, we proposed that when a covered entity made material changes
in its privacy policies or procedures, it would be required to retrain
those members of the workforce whose duties were related to the change
within a reasonable time of making the change.
    The NPRM would have required that, upon completion of the training,
the trainee would be required to sign a statement certifying that he or
she received the privacy training and would honor all of the entity's
privacy policies and procedures. Entities would determine the most
effective means of achieving this training requirement for their
workforce. We also proposed that, at least every three years after the
initial training, covered entities would be required to have each
member of the workforce sign a new statement certifying that he or she
would honor all of the entity's privacy policies and procedures. The
covered entity would have been required to document its policies and
procedures for complying with the training requirements.
    The final regulation requires covered entities to train all members
of their workforce on the policies and procedures with respect to
protected health information required by this rule, as necessary and
appropriate for the members of the workforce to carry out their
functions within the covered entity. We do not change the proposed time
lines for training existing and new members of the workforce, or for
training due to material changes in the covered entity's policies and
procedures. We eliminate both the requirement for employees to sign a
certification following training and the triennial re-certification
requirement. Covered entities are responsible for implementing policies
and procedures to meet these requirements and for documenting that
training has been provided.

Safeguards

    In Sec. 164.518(c) of the NPRM, we proposed to require covered
entities to put in place administrative, technical, and physical
safeguards to protect the privacy of protected health information. We
made reference in the preamble to similar requirements proposed for
certain electronic information in the Notice of Proposed Rulemaking
entitled the Security and Electronic Signature Standards (HCFA-0049-P).
We stated that we were proposing parallel and consistent requirements
for safeguarding the privacy of protected health information. In
Sec. 164.518(c)(3) of the NPRM, we required covered entities to have
safeguards to ensure that information was not used in violation of the
requirements of this subpart or by people who did not have proper
authorization to access the information.
    We do not change the basic proposed requirements that covered
entities have administrative, technical and physical safeguards to
protect the privacy of protected health information. We combine the
proposed requirements into a single standard that requires covered
entities to safeguard protected health information from accidental or
intentional use or disclosure that is a violation of the requirements
of this rule

[[Page 82562]]

and to protect against the inadvertent disclosure of protected health
information to persons other than the intended recipient. Limitations
on access to protected health information by the covered entities
workforce will also be covered by the policies and procedures for
``minimum necessary'' use of protected health information, pursuant to
Sec. 164.514(d). We expect these provisions to work in tandem.
    We do not prescribe the particular measures that covered entities
must take to meet this standard, because the nature of the required
policies and procedures will vary with the size of the covered entity
and the type of activities that the covered entity undertakes. (That
is, as with other provisions of this rule, this requirement is
``scalable.'') Examples of appropriate safeguards include requiring
that documents containing protected health information be shredded
prior to disposal, and requiring that doors to medical records
departments (or to file cabinets housing such records) remain locked
and limiting which personnel are authorized to have the key or pass-
code. We intend this to be a common sense, scalable, standard. We do
not require covered entities to guarantee the safety of protected
health information against all assaults. Theft of protected health
information may or may not signal a violation of this rule, depending
on the circumstances and whether the covered entity had reasonable
policies to protect against theft. Organizations such as the
Association for Testing and Materials (ASTM) and the American Health
Information Management Association (AHIMA) have developed a body of
recommended practices for handling of protected health information that
covered entities may find useful.
    We note that the proposed HIPAA Security Standards would require
covered entities to safeguard the privacy and integrity of health
information. For electronic information, compliance with both
regulations will be required.
    In Sec. 164.518(c)(2) of the NPRM we proposed requirements for
verification procedures to establish identity and authority for
permitted disclosures of protected health information.
    In the final rule, this material has been moved to Sec. 164.514(h).

Use or Disclosure of Protected Health Information by Whistleblowers

    In Sec. 164.518(c)(4) of the NPRM, this provision was entitled
``Implementation Specification: Disclosures by whistleblowers.'' It is
now retitled ``Disclosures by whistleblowers,'' with certain changes,
and moved to Sec. 164.502(j)(1).

Complaints to the Covered Entity

    In Sec. 164.518(d) of the NPRM, we proposed to require covered
entities to have a mechanism for receiving complaints from individuals
regarding the health plan's or provider's compliance with the
requirements of this proposed rule. We did not require that the health
plan or provider develop a formal appeals mechanism, nor that ``due
process'' or any similar standard be applied. Additionally, there was
no requirement to respond in any particular manner or time frame.
    We proposed two basic requirements for the complaint process.
First, the covered health plan or health care provider would be
required to identify in the notice of information practices a contact
person or office for receiving complaints. Second, the health plan or
provider would be required to maintain a record of the complaints that
are filed and a brief explanation of their resolution, if any.
    In the final rule, we retain the requirement for an internal
complaint process for compliance with this rule, including the two
basic requirements of identifying a contact person and documenting
complaints received and their dispositions, if any. We expand the scope
of complaints that covered entities must have a means of receiving to
include complaints concerning violations of the covered entity's
privacy practices, not just violations of the rule. For example, a
covered entity must have a mechanism for receiving a complaint that
patient information is used at a nursing station in a way that it can
also be viewed by visitors to the hospital, regardless of whether the
practices at the nursing stations might constitute a violation of this
rule.

Sanctions

    In Sec. 164.518(e) of the NPRM, we proposed to require all covered
entities to develop, and apply when appropriate, sanctions against
members of its workforce who failed to comply with privacy policies or
procedures of the covered entity or with the requirements of the rule.
Covered entities would be required to develop and impose sanctions
appropriate to the nature of the violation. The preamble stated that
the type of sanction applied would vary depending on factors such as
the severity of the violation, whether the violation was intentional or
unintentional, and whether the violation indicated a pattern or
practice of improper use or disclosure of protected health information.
Sanctions could range from a warning to termination. The NPRM preamble
language also stated that covered entities would be required to apply
sanctions against business associates that violated the proposed rule.
    In the final rule, we retain the requirement for sanctions against
members of a covered entity's workforce. We also require a covered
entity to have written policies and procedures for the application of
appropriate sanctions for violations of this subpart and to document
those sanctions. These sanctions do not apply to whistleblower
activities that meet the provisions of Sec. 164.502(j) or complaints,
investigations, or opposition that meet the provisions of
Sec. 164.530(g)(2). We eliminate language regarding business associates
from this section. Requirements with respect to business associates are
stated in Sec. 164.504.

Duty To Mitigate

    In proposed Sec. 164.518(f), we would have required covered
entities to have policies and procedures for mitigating, to the extent
practicable, any deleterious effect of a use or disclosure of protected
health information in violation of the requirements of this subpart.
The NPRM preamble also included specific language applying this
requirement to harm caused by members of the covered entity's workforce
and business associates.
    With respect to business associates, the NPRM preamble but not the
NPRM rule text, stated that covered entities would have a duty to take
reasonable steps in response to breaches of contract terms. Covered
entities generally would not be required to monitor the activities of
their business associates, but would be required to take steps to
address problems of which they become aware, and, where the breach was
serious or repeated, would also be required to monitor the business
associate's performance to ensure that the wrongful behavior had been
remedied. Termination of the arrangement would be required only if it
became clear that a business associate could not be relied upon to
maintain the privacy of protected health information provided to it.
    In the final rule, we clarify this requirement by imposing a duty
for covered entities to mitigate any harmful effect of a use or
disclosure of protected health information that is known to the covered
entity. We apply the duty to mitigate to a violation of the covered
entity's policies and procedures, not just a violation of the
requirements of the subpart. We resolve the ambiguities in the NPRM by
imposing this duty on covered entities for harm caused by

[[Page 82563]]

either members of their workforce or by their business associates.
    We eliminate the language regarding potential breaches of business
associate contracts from this section. All other requirements with
respect to business associates are stated in Sec. 164.504.

Refraining from Intimidating or Retaliatory Acts

    In Sec. 164.522(d)(4) of the NPRM, in the Compliance and
Enforcement section, we proposed that one of the responsibilities of a
covered entity would be to refrain from intimidating or retaliatory
acts. Specifically, the rule provided that ``[a] covered entity may not
intimidate, threaten, coerce, discriminate against, or take other
retaliatory action against any individual for the filing of a complaint
under this section, for testifying, assisting, participating in any
manner in an investigation, compliance review, proceeding or hearing
under this Act, or opposing any act or practice made unlawful by this
subpart.''
    In the final rule, we continue to require that entities refrain
from intimidating or retaliatory acts; however, the provisions have
been moved to the Administrative Requirements provisions in
Sec. 164.530. This change is not just clerical; in making this change,
we apply this provision to the privacy rule alone rather than to all
the HIPAA administrative simplification rules. (The compliance and
enforcement provisions that were in Sec. 164 are now in Part 160,
Subpart C.)
    We continue to prohibit retaliation against individuals for filing
a complaint with the Secretary, but also prohibit retaliation against
any other person who files such a complaint. This is the case because
the term ``individual'' is generally limited to the person who is the
subject of the information. The final rule prohibits retaliation
against persons, not just individuals, for testifying, assisting, or
participating in an investigation, compliance review, proceeding or
hearing under Part C of Title XI. The proposed regulation referenced
the ``Act,'' which is defined in Part 160 as the Social Security Act.
Because we only intend to protect activities such as participation in
investigations and hearings under the Administrative Simplification
provisions of HIPAA, the final rule references Part C of Title XI of
the Social Security Act.
    The proposed rule would have prohibited retaliatory actions against
individuals for opposing any act or practice made unlawful by this
subpart. The final rule retains this provision, but applies it to any
person, only if the person ``has a good faith belief that the practice
opposed is unlawful, the manner of the opposition is reasonable and
does not involve a disclosure of protected health information in
violation of this subpart.'' The final rule provides additional
protections, which had been included in the preamble to the proposed
rule. Specifically, we prohibit retaliatory actions against individuals
who exercise any right, or participate in any process established by
the privacy rule (Part 164 Subpart E), and include as an example the
filing of a complaint with the covered entity.

Waiver of Rights

    In the final regulation, but not in the proposed regulation, we
provide that a covered entity may not require individuals to waive
their rights to file a complaint with the Secretary or their other
rights under this rule as a condition of the provision of treatment,
payment, enrollment in a health plan or eligibility for benefits. This
provision ensures that covered entities do not take away the rights
that individuals have been provided in Parts 160 and 164.

Requirements for Policies and Procedures, and Documentation
Requirements

    In Sec. 164.520 of the NPRM, we proposed to require covered
entities to develop and document their policies and procedures for
implementing the requirements of the rule. In the final regulation we
retain this approach, but specify which standards must be documented in
each of the relevant sections. In this section, we state the general
administrative requirements applicable to all policies and procedures
required throughout the regulation.
    In Sec. 164.530(i), (j), and (k) of the final rule, we amend the
NPRM language in several respects. In Sec. 164.530(i) we require that
the policies and procedures be reasonably designed to comply with the
standards, implementation specifications, and other requirements of the
relevant part of the regulation, taking into account the size of the
covered entity and the nature of the activities undertaken by the
covered entity that relate to protected health information. However, we
clarify that the requirements that policies and procedures be
reasonably designed may not be interpreted to permit or excuse any
action that violates the privacy regulation. Where the covered entity
has stated in its notice that it reserves the right to change
information practices, we allow the new practice to apply to
information created or collected prior to the effective date of the new
practice and establish requirements for making this change. We also
establish the conditions for making changes if the covered entity has
not reserved the right to change its practices.
    We require covered entities to modify in a prompt manner their
policies and procedures to comply with changes in relevant law and,
where the change also affects the practices stated in the notice, to
change the notice. We make clear that nothing in our requirements
regarding changes to policies and procedures or changes to the notice
may be used by a covered entity to excuse a failure to comply with
applicable law.
    In Sec. 164.530(j), we require that the policies and procedures
required throughout the regulation be maintained in writing, and that
any other communication, action, activity, or designation that must be
documented under this regulation be documented in writing. We note that
``writing'' includes electronic storage; paper records are not
required. We also note that, if a covered entity is required to
document the title of a person, we mean the job title or similar
description of the relevant position or office.
    We require covered entities to retain any documentation required
under this rule for at least six years (the statute of limitations
period for the civil penalties) from the date of the creation of the
documentation, or the date when the document was last in effect, which
ever is later. This generalizes the NPRM provision to cover all
documentation required under the rule. The language on ``last was in
effect'' is a change from the NPRM which was worded ``unless a longer
period applies under this subpart.''
    This approach is consistent with the approach recommended by the
Joint Commission on Accreditation of Healthcare Organizations, and the
National Committee for Quality Assurance, in its paper ``Protecting
Personal Health Information; A framework for Meeting the Challenges in
a Managed Care Environment.'' This paper notes that ``MCOs [Managed
Care Organizations] should have clearly defined policies and procedures
for dealing with confidentiality issues.'' (p. 29).

Standards for Certain Group Health Plans

    We add a new provision (Sec. 164.530(k)) to clarify the
administrative responsibilities of group health plans that offer
benefits through issuers and HMOs. Specifically, a group health plan
that provides benefits solely through an issuer or HMO, and that does
not create, receive or maintain protected health

[[Page 82564]]

information other than summary health information or information
regarding enrollment and disenrollment, is not subject to the
requirements of this section regarding designation of a privacy
official and contact person, workforce training, safeguards,
complaints, mitigation, or policies and procedures. Such a group health
plan is only subject to the requirements of this section regarding
documentation with respect to its plan documents. Issuers and HMOs are
covered entities under this rule, and thus have independent obligations
to comply with this section with respect to the protected health
information they maintain about the enrollees in such group health
plans. The group health plans subject to this provision will have only
limited protected health information. Therefore, imposing these
requirements on the group health plan would impose burdens not
outweighed by a corresponding enhancement in privacy protections.

Section 164.532--Transition Provisions

    In the NPRM, we did not address the effect of the regulation on
consents and authorizations covered entities obtained prior to the
compliance date of the regulation.
    In the final rule, we clarify that, in certain circumstances, a
covered entity may continue to rely upon consents, authorizations, or
other express legal permissions obtained prior to the compliance date
of this regulation to use or disclose protected health information even
if these consents, authorizations, or permissions do not meet the
requirements set forth in Secs. 164.506 or 164.508.
    We realize that a covered entity may wish to rely upon a consent,
authorization, or other express legal permission obtained from an
individual prior to the compliance date of this regulation which
permits the use or disclosure of individually identifiable health
information for activities that come within treatment, payment, or
health care operations (as defined in Sec. 164.501), but that do not
meet the requirements for consents set forth in Sec. 164.506. In the
final rule, we permit a covered entity to rely upon such consent,
authorization, or permission to use or disclose protected health
information that it created or received before the applicable
compliance date of the regulation to carry out the treatment, payment,
or health care operations as long as it meets two requirements. First,
the covered entity may not make any use or disclosure that is expressly
excluded from the consent, authorization, or permission. Second, the
covered entity must comply with all limitations expressed in the
consent, authorization, or permission. Thus, we do not require a
covered entity to obtain a consent that meets the requirements of
Sec. 164.506 to use or disclose this previously obtained protected
health information as long as the use or disclosure is consistent with
the requirements of this section. However, a covered entity will need
to obtain a consent that meets the requirements of Sec. 164.506 to the
extent that it is required to obtain a consent under Sec. 164.506 from
an individual before it may use or disclose any protected health
information it creates or receives after the date by which it must
comply with this rule.
    Similarly, we recognize that a covered entity may wish to rely upon
a consent, authorization, or other express legal permission obtained
from an individual prior to the applicable compliance date of this
regulation that specifically permits the covered entity to use or
disclose individually identifiable health information for activities
other than to carry out treatment, payment, or health care operations.
In the final rule, we permit a covered entity to rely upon such a
consent, authorization, or permission to use or disclose protected
health information that it created or received before the applicable
compliance date of the regulation for the specific activities described
in the consent, authorization, or permission as long as the covered
entity complies with two requirements. First, the covered entity may
not make any use or disclosure that is expressly excluded from the
consent, authorization, or permission. Second, the covered entity must
comply with all limitations expressed in the consent, authorization, or
permission. Thus, we do not required a covered entity to obtain an
authorization that meets the requirements of Sec. 164.508 to use or
disclose this previously obtained protected health information so long
as the use or disclosure is consistent with the requirements of this
section. However, a covered entity will need to obtain an authorization
that meets the requirements of Sec. 164.508, to the extent that it is
required to obtain an authorization under this rule, from an individual
before it may use or disclose any protected health information it
creates or receives after the date by which it must comply with this
rule.
    Additionally, the final rule acknowledges that covered entities may
wish to rely upon consents, authorizations, or other express legal
permission obtained from an individual prior to the applicable
compliance date for a specific research project that includes the
treatment of individuals, such as clinical trials. These consents,
authorizations, or permissions may specifically permit a use or
disclosure of individually identifiable health information for purposes
of the project. Alternatively, they may be general consents to
participate in the project. A covered entity may use or disclose
protected health information it created or received before or after to
the applicable compliance date of this rule for purposes of the project
provided that the covered entity complies with all limitations
expressed in the consent, authorization, or permission.
    If, pursuant to this section, a covered entity relies upon a
previously obtained consent, authorization, or other express legal
permission and agrees to a request for a restriction by an individual
under Sec. 164.522(a), any subsequent use or disclosure under that
consent, authorization, or permission must comply with the agreed upon
restriction as well.
    We believe it is necessary to grandfather in previously obtained
consents, authorizations, or other express legal permissions in these
circumstances to ensure that important functions of the health care
system are not impeded. We link the effectiveness of such consents,
authorizations, or permissions in these circumstances to the applicable
compliance date to give covered entities sufficient notice of the
requirements set forth in Secs. 164.506 and 164.508.
    The rule does not change the past effectiveness of consents,
authorizations, or other express legal permissions that do not come
within this section. This means that uses or disclosures of
individually identifiable health information made prior to the
compliance date of this regulation are not subject to sanctions, even
if they were made pursuant to documents or permissions that do not meet
the requirements of this rule or were made without permission. This
rule alters only the future effectiveness of the previously obtained
consents, authorizations, or permissions. Covered entities are not
required to rely upon these consents, authorizations, or permissions
and may obtain new consents or authorizations that meet the applicable
requirements of Secs. 164.506 and 164.508.
    When reaching this decision, we considered requiring all covered
entities to obtain new consents or authorizations consistent with the
requirements of Secs. 164.506 and 164.508 before they would be able to
use or disclose protected health information obtained

[[Page 82565]]

after the compliance date of these rules. We rejected this option
because we recognize that covered entities may not always be able to
obtain new consents or authorizations consistent with the requirements
of Secs. 164.506 and 164.508 from all individuals upon whose
information they rely. We also refrained from impeding the rights of
covered entities to exercise their interests in the records they have
created. We do not require covered entities with existing records or
databases to destroy or remove the protected health information for
which they do not have valid consents or authorizations that meet the
requirements of Secs. 164.506 and 164.508. Covered entities may rely
upon the consents, authorizations, or permissions they obtained from
individuals prior to the applicable compliance date of this regulation
consistent with the constraints of those documents and the requirements
discussed above.
    We note that if a covered entity obtains before the applicable
compliance date of this regulation a consent that meets the
requirements of Sec. 164.506, an authorization that meets the
requirements of Sec. 164.508, or an IRB or privacy board waiver of
authorization that meets the requirements of Sec. 164.512(i), the
consent, authorization, or waiver is effective for uses or disclosures
that occur after the compliance date and that are consistent with the
terms of the consent, authorization, or waiver.

Section 164.534--Compliance Dates for Initial Implementation of the
Privacy Standards

    In the NPRM, we provided that a covered entity must be in
compliance with this subpart not later than 24 months following the
effective date of this rule, except that a covered entity that is a
small health plan must be in compliance with this subpart not later
than 36 months following the effective date of the rule.
    The final rule did not make any substantive changes. The format is
changed so as to more clearly present the various compliance dates. The
final rule lists the types of covered entities and then the various
dates that would apply to each of these entities.

III. Section-by-Section Discussion of Comments

    The following describes the provisions in the final regulation, and
the changes we make to the proposed provisions section-by-section.
Following each section are our responses to the comments to that
section. This section of the preamble is organized to follow the
corresponding section of the final rule, not the NPRM.

General Comments

    We received many comments on the rule overall, not to a particular
provision. We respond to those comments here. Similar comments, but
directed to a specific provision in the proposed rule, are answered
below in the corresponding section of this preamble.

Comments on the Need for Privacy Standards, and Effects of this
Regulation on Current Protections

    Comment: Many commenters expressed the opinion that federal
legislation is necessary to protect the privacy of individuals' health
information. One comment advocated Congressional efforts to provide a
comprehensive federal health privacy law that would integrate the
substance abuse regulations with the privacy regulation.
    Response: We agree that comprehensive privacy legislation is
urgently needed. This administration has urged the Congress to pass
such legislation. While this regulation will improve the privacy of
individuals' health information, only legislation can provide the full
array of privacy protection that individuals need and deserve.
    Comment: Many commenters noted that they do not go to a physician,
or do not completely share health information with their physician,
because they are concerned about who will have access to that
information. Many physicians commented on their patients' reluctance to
share information because of fear that their information will later be
used against them.
    Response: We agree that strong federal privacy protections are
necessary to enhance patients' trust in the health care system.
    Comment: Many commenters expressed concerns that this regulation
will allow access to health information by those who today do not have
such access, or would allow their physician to disclose information
which may not lawfully be disclosed today. Many of these commenters
stated that today, they consent to every disclosure of health
information about them, and that absent their consent the privacy of
their health information is ``absolute.'' Others stated that, today,
health information is disclosed only pursuant to a judicial order.
Several commenters were concerned that this regulation would override
stronger state privacy protection.
    Response: This regulation does not, and cannot, reduce current
privacy protections. The statutory language of the HIPAA specifically
mandates that this regulation does not preempt state laws that are more
protective of privacy.
    As discussed in more detail in later this preamble, while many
people believe that they must be asked permission prior to any release
of health information about them, current laws generally do not impose
such a requirement. Similarly, as discussed in more detail later in
this preamble, judicial review is required today only for a small
proportion of releases of health information.
    Comment: Many commenters asserted that today, medical records
``belong'' to patients. Others asserted that patients own their medical
information and health care providers and insurance companies who
maintain health records should be viewed as custodians of the patients'
property.
    Response: We do not intend to change current law regarding
ownership of or responsibility for medical records. In developing this
rule we reviewed current law on this and related issues, and built on
that foundation.
    Under state laws, medical records are often the property of the
health care provider or medical facility that created them. Some state
laws also provide patients with access to medical records or an
ownership interest in the health information in medical records.
However, these laws do not divest the health care provider or the
medical facility of its ownership interest in medical records. These
statutes typically provide a patient the right to inspect or copy
health information from the medical record, but not the right to take
the provider's original copy of an item in the medical record. If a
particular state law provides greater ownership rights, this regulation
leaves such rights in place.
    Comment: Some commenters argued that the use and disclosure of
sensitive personal information must be strictly regulated, and
violation of such regulations should subject an entity to significant
penalties and sanctions.
    Response: We agree, and share the commenters' concern that the
penalties in the HIPAA statute are not sufficient to fully protect
individuals' privacy interests. The need for stronger penalties is
among the reasons we believe Congress should pass comprehensive privacy
legislation.
    Comment: Many commenters expressed the opinion that the proposed
ruled should provide stricter privacy protections.

[[Page 82566]]

    Response: We received nearly 52,000 comments on the proposed
regulation, and make substantial changes to the proposal in response to
those comments. Many of these changes will strengthen the protections
that were proposed in the NPRM.
    Comment: Many comments express concerns that their health
information will be given to their employers.
    Response: We agree that employer access to health information is a
particular concern. In this final regulation, we make significant
changes to the NPRM that clarify and provide additional safeguards
governing when and how the health plans covered by this regulation may
disclose health information to employers.
    Comment: Several commenters argued that individuals should be able
to sue for breach of privacy.
    Response: We agree, but do not have the legislative authority to
grant a private right of action to sue under this statute. Only
Congress can grant that right.

Objections to Government Access to Protected Health Information

    Comment: Many commenters urged the Department not to create a
government database of health information, or a tracking system that
would enable the government to track individuals health information.
    Response: This regulation does not create such a database or
tracking system, nor does it enable future creation of such a database.
This regulation describes the ways in which health plans, health care
clearinghouses, and certain health care providers may use and disclose
identifiable health information with and without the individual's
consent.
    Comment: Many commenters objected to government access to or
control over their health information, which they believe the proposed
regulation would provide.
    Response: This regulation does not increase current government
access to health information. This rule sets minimum privacy standards.
It does not require disclosure of health information, other than to the
subject of the records or for enforcement of this rule. Health plans
and health care providers are free to use their own professional ethics
and judgement to adopt stricter policies for disclosing health
information.
    Comment: Some commenters viewed the NPRM as creating fewer hurdles
for government access to protected health information than for access
to protected health information by private organizations. Some health
care providers commented that the NPRM would impose substantial new
restrictions on private sector use and disclosure of protected health
information, but would make government access to protected health
information easy. One consumer advocacy group made the same
observation.
    Response: We acknowledge that many of the national priority
purposes for which we allow disclosure of protected health information
without consent or authorization are for government functions, and that
many of the governmental recipients of such information are not
governed by this rule. It is the role of government to undertake
functions in the broader public interest, such as public health
activities, law enforcement, identification of deceased individuals
through coroners' offices, and military activities. It is these public
purposes which can sometimes outweigh an individual's privacy interest.
In this rule, we specify the circumstances in which that balance is
tipped toward the public interest with respect to health information.
We discuss the rationale behind each of these permitted disclosures in
the relevant preamble sections below.

Miscellaneous Comments

    Comment: Many commenters objected to the establishment of a unique
identifier for health care or other purposes.
    Response: This regulation does not create an identifier. We assume
these comments refer to the unique health identifier that Congress
directed the Secretary to promulgate under section1173(b) of the Social
Security Act, added by section 262 of the HIPAA. Because of the public
concerns about such an identifier, in the summer of 1998 Vice President
Gore announced that the Administration would not promulgate such a
regulation until comprehensive medical privacy protections were in
place. In the fall of that year, Congress prohibited the Department
from promulgating such an identifier, and that prohibition remains in
place. The Department has no plans to promulgate a unique health
identifier.
    Comment: Many commenters asked that we withdraw the proposed
regulation and not publish a final rule.
    Response: Under section 264 of the HIPAA, the Secretary is required
by Congress to promulgate a regulation establishing standards for
health information privacy. Further, for the reasons explained
throughout this preamble above, we believe that the need to protect
health information privacy is urgent and that this regulation is in the
public's interest.
    Comment: Many commenters express the opinion that their consent
should be required for all disclosure of their health information.
    Response: We agree that consent should be required prior to release
of health information for many purposes, and impose such a requirement
in this regulation. Requiring consent prior to all release of health
information, however, would unduly jeopardize public safety and make
many operations of the health care system impossible. For example,
requiring consent prior to release of health information to a public
health official who is attempting to track the source of an outbreak or
epidemic could endanger thousands of lives. Similarly, requiring
consent before an oversight official could audit a health plan would
make detection of health care fraud all but impossible; it could take
health plans months or years to locate and obtain the consent of all
current and past enrollees, and the health plan would not have a strong
incentive to do so. These uses of medical information are clearly in
the public interest.
    In this regulation, we must balance individuals' privacy interests
against the legitimate public interests in certain uses of health
information. Where there is an important public interest, this
regulation imposes procedural safeguards that must be met prior to
release of health information, in lieu of a requirement for consent. In
some instances the procedural safeguards consist of limits on the
circumstances in which information may be disclosed, in others the
safeguards consist of limits on what information may be disclosed, and
in other cases we require some form of legal process (e.g., a warrant
or subpoena) prior to release of health information. We also allow
disclosure of health information without consent where other law
mandates the disclosures. Where such other law exists, another public
entity has made the determination that the public interests outweigh
the individual's privacy interests, and we do not upset that
determination in this regulation. In short, we tailor the safeguards to
match the specific nature of the public purpose. The specific
safeguards are explained in each section of this regulation below.
    Comment: Many comments address matters not relevant to this
regulation, such as alternative fuels, hospital reimbursement, and gulf
war syndrome.
    Response: These and similar matters are not relevant to this
regulation and will not be addressed further.

[[Page 82567]]

    Comment: A few commenters questioned why this level of detail is
needed in response to the HIPAA Congressional mandate.
    Response: This level of detail is necessary to ensure that
individuals' rights with respect to their health information are clear,
while also ensuring that information necessary for important public
functions, such as protecting public health, promoting biomedical
research, fighting health care fraud, and notifying family members in
disaster situations, will not be impaired by this regulation. We
designed this rule to reflect current practices and change some of
them. The comments and our fact finding revealed the complexity of
current health information practices, and we believe that the
complexity entailed in reflecting those practices is better public
policy than a perhaps simpler rule that disturbed important information
flows.
    Comment: A few comments stated that the goal of administrative
simplification should never override the privacy of individuals.
    Response: We believe that privacy is a necessary component of
administrative simplification, not a competing interest.
    Comment: At least one commenter said that the goal of
administrative simplification is not well served by the proposed rule.
    Response: Congress recognized that privacy is a necessary component
of administrative simplification. The standardization of electronic
health information mandated by the HIPAA that make it easier to share
that information for legitimate purposes also make the inappropriate
sharing of that information easier. For this reason, Congress included
a mandate for privacy standards in this section of the HIPAA. Without
appropriate privacy protections, public fear and instances of abuse
would make it impossible for us to take full advantage of the
administrative and costs benefits inherent in the administrative
simplification standards.
    Comment: At least one commenter asked us to require
psychotherapists to assert any applicable legal privilege on patients'
behalf when protected health information is requested.
    Response: Whether and when to assert a claim of privilege on a
patient's behalf is a matter for other law and for the ethics of the
individual health care provider. This is not a decision that can or
should be made by the federal government.
    Comment: One commenter called for HHS to consider the privacy
regulation in conjunction with the other HIPAA standards. In
particular, this comment focused on the belief that the Security
Standards should be compatible with the existing and emerging health
care and information technology industry standards.
    Response: We agree that both this regulation and the final Security
Regulation should be compatible with existing and emerging technology
industry standards. This regulation is ``technology neutral.'' We do
not mandate the use of any particular technologies, but rather set
standards which can be met through a variety of means.
    Comment: Several commenters claimed that the statutory authority
given under HIPAA cannot provide meaningful privacy protections because
many entities with access to protected health information, such as
employers, worker's compensation carriers, and life insurance
companies, are not covered entities. These commenters expressed support
for comprehensive legislation to close many of the existing loopholes.
    Response: We agree with the commenters that comprehensive
legislation is necessary to provide full privacy protection and have
called for members of Congress to pass such legislation to prevent
unauthorized and potentially harmful uses and disclosures of
information.

Part 160--Subpart A--General Provisions

Section 160.103--Definitions

Business Associate

    The response to comments on the definition of ``business partner,''
renamed in this rule as ``business associate,'' is included in the
response to comments on the requirements for business associates in the
preamble discussion of Sec. 164.504.

Covered Entity

    Comment: A number of commenters urged the Department to expand or
clarify the definition of ``covered entity'' to include certain
entities other than health care clearinghouses, health plans, and
health care providers who conduct standard transactions. For example,
several commenters asked that the Department generally expand the scope
of the rule to cover all entities that receive or maintain individually
identifiable health information; others specifically urged the
Department to cover employers, marketing firms, and legal entities that
have access to individually identifiable health information. Some
commenters asked that life insurance and casualty insurance carriers be
considered covered entities for purposes of this rule. One commenter
recommended that Pharmacy Benefit Management (PBM) companies be
considered covered entities so that they may use and disclose protected
health information without authorization.
    In addition, a few commenters asked the Department to clarify that
the definition includes providers who do not directly conduct
electronic transactions if another entity, such as a billing service or
hospital, does so on their behalf.
    Response: We understand that many entities may use and disclose
individually identifiable health information. However, our jurisdiction
under the statute is limited to health plans, health care
clearinghouses, and health care providers who transmit any health
information electronically in connection with any of the standard
financial or administrative transactions in section 1173(a) of the Act.
These are the entities referred to in section 1173(a)(1) of the Act and
thus listed in Sec. 160.103 of the final rule. Consequently, once
protected health information leaves the purview of one of these covered
entities, their business associates, or other related entities (such as
plan sponsors), the information is no longer afforded protection under
this rule. We again highlight the need for comprehensive federal
legislation to eliminate such gaps in privacy protection.
    We also provide the following clarifications with regard to
specific entities.
    We clarify that employers and marketing firms are not covered
entities. However, employers may be plan sponsors of a group health
plan that is a covered entity under the rule. In such a case, specific
requirements apply to the group health plan. See the preamble on
Sec. 164.504 for a discussion of specific ``firewall'' and other
organizational requirements for group health plans and their employer
sponsors. The final rule also contains provisions addressing when an
insurance issuer providing benefits under a group health plan may
disclose summary health information to a plan sponsor.
    With regard to life and casualty insurers, we understand that such
benefit providers may use and disclose individually identifiable health
information. However, Congress did not include life insurers and
casualty insurance carriers as ``health plans'' for the purposes of
this rule and therefore they are not covered entities. See the
discussion regarding the definition of ``health plan'' and excepted
benefits.

[[Page 82568]]

    In addition, we clarify that a PBM is a covered entity only to the
extent that it meets the definition of one or more of the entities
listed in Sec. 160.102. When providing services to patients through
managed care networks, it is likely that a PBM is acting as a business
associate of a health plan, and may thus use and disclose protected
health information pursuant to the relevant provisions of this rule.
PBMs may also be business associates of health care providers. See the
preamble sections on Secs. 164.502, 164.504, and 164.506 for
discussions of the specific requirements related to business associates
and consent.
    Lastly, we clarify that health care providers who do not submit
HIPAA transactions in standard form become covered by this rule when
other entities, such as a billing service or a hospital, transmit
standard electronic transactions on their behalf. The provider could
not circumvent these requirements by assigning the task to a
contractor.
    Comment: Many commenters urged the Department to restrict or
clarify the definition of ``covered entity'' to exclude certain
entities, such as department-operated hospitals (public hospitals);
state Crime Victim Compensation Programs; employers; and certain lines
of insurers, such as workers' compensation insurers, property and
casualty insurers, reinsurers, and stop-loss insurers. One commenter
expressed concern that clergy, religious practitioners, and other
faith-based service providers would have to abide by the rule and asked
that the Department exempt prayer healing and non-medical health care.
    Response: The Secretary provides the following clarifications in
response to these comments. To the extent that a ``department-operated
hospital'' meets the definition of a ``health care provider'' and
conducts any of the standard transactions, it is a covered entity for
the purposes of this rule. We agree that a state Crime Victim
Compensation Program is not a covered entity if it is not a health care
provider that conducts standard transactions, health plan, or health
care clearinghouse. Further, as described above, employers are not
covered entities.
    In addition, we agree that workers' compensation insurers, property
and casualty insurers, reinsurers, and stop-loss insurers are not
covered entities, as they do not meet the statutory definition of
``health plan.'' See further discussion in the preamble on Sec. 160.103
regarding the definition of ``health plan.'' However, activities
related to ceding, securing, or placing a contract for reinsurance,
including stop-loss insurance, are health care operations in the final
rule. As such, reinsurers and stop-loss insurers may obtain protected
health information from covered entities.
    Also, in response to the comment regarding religious practitioners,
the Department clarifies that ``health care'' as defined under the rule
does not include methods of healing that are solely spiritual.
Therefore, clergy or other religious practitioners that provide solely
religious healing services are not health care providers within the
meaning of this rule, and consequently not covered entities for the
purposes of this rule.
    Comment: A few commenters expressed general uncertainty and
requested clarification as to whether certain entities were covered
entities for the purposes of this rule. One commenter was uncertain as
to whether the rule applies to certain social service entities, in
addition to clinical social workers that the commenter believes are
providers. Other commenters asked whether researchers or non-
governmental entities that collect and analyze patient data to monitor
and evaluate quality of care are covered entities. Another commenter
requested clarification regarding the definition's application to
public health agencies that also are health care providers as well as
how the rule affects public health agencies in their data collection
from covered entities.
    Response: Whether the professionals described in these comments are
covered by this rule depends on the activities they undertake, not on
their profession or degree. The definitions in this rule are based on
activities and functions, not titles. For example, a social service
worker whose activities meet this rule's definition of health care will
be a health care provider. If that social service worker also transmits
information in a standard HIPAA transaction, he or she will be a
covered health entity under this rule. Another social service worker
may provide services that do not meet the rule's definition of health
care, or may not transmit information in a standard transaction. Such a
social service worker is not a covered entity under this rule.
Similarly, researchers in and of themselves are not covered entities.
However, researchers may also be health care providers if they provide
health care. In such cases, the persons, or entities in their role as
health care providers may be covered entities if they conduct standard
transactions.
    With regard to public health agencies that are also health care
providers, the health care provider ``component'' of the agency is the
covered entity if that component conducts standard transactions. See
discussion of ``health care components'' below. As to the data
collection activities of a public health agency, the final rule in
Sec. 164.512(b) permits a covered entity to disclose protected health
information to public health authorities under specified circumstances,
and permits public health agencies that are also covered entities to
use protected health information for these purposes. See
Sec. 164.512(b) for further details.
    Comment: A few commenters requested that the Department clarify
that device manufacturers are not covered entities. They stated that
the proposal did not provide enough guidance in cases where the
``manufacturer supplier'' has only one part of its business that acts
as the ``supplier,'' and additional detail is needed about the
relationship of the ``supplier component'' of the company to the rest
of the business. Similarly, another commenter asserted that drug,
biologics, and device manufacturers should not be covered entities
simply by virtue of their manufacturing activities.
    Response: We clarify that if a supplier manufacturer is a Medicare
supplier, then it is a health care provider, and it is a covered entity
if it conducts standard transactions. Further, we clarify that a
manufacturer of supplies related to the health of a particular
individual, e.g., prosthetic devices, is a health care provider because
the manufacturer is providing ``health care'' as defined in the rule.
However, that manufacturer is a covered entity only if it conducts
standard transactions. We do not intend that a manufacturer of supplies
that are generic and not customized or otherwise specifically designed
for particular individuals, e.g., ace bandages for a hospital, is a
health care provider. Such a manufacturer is not providing ``health
care'' as defined in the rule and is therefore not a covered entity. We
note that, even if such a manufacturer is a covered entity, it may be
an ``indirect treatment provider'' under this rule, and thus not
subject to all of the rule's requirements.
    With regard to a ``supplier component,'' the final rule addresses
the status of the unit or unit(s) of a larger entity that constitute a
``health care component.'' See further discussion under Sec. 164.504 of
this preamble.
    Finally, we clarify that drug, biologics, and device manufacturers
are not health care providers simply by virtue of their manufacturing
activities. The manufacturer must be providing health care consistent
with the final

[[Page 82569]]

rule's definition in order to be considered a health care provider.
    Comment: A few commenters asked that the Department clarify that
pharmaceutical manufacturers are not covered entities. It was explained
that pharmaceutical manufacturers provide support and guidance to
doctors and patients with respect to the proper use of their products,
provide free products for doctors to distribute to patients, and
operate charitable programs that provide pharmaceutical drugs to
patients who cannot afford to buy the drugs they need.
    Response: A pharmaceutical manufacturer is only a covered entity if
the manufacturer provides ``health care'' according to the rule's
definition and conducts standard transactions. In the above case, a
pharmaceutical manufacturer that provides support and guidance to
doctors and patients regarding the proper use of their products is
providing ``health care'' for the purposes of this rule, and therefore,
is a health care provider to the extent that it provides such services.
The pharmaceutical manufacturer that is a health care provider is only
a covered entity, however, if it conducts standard transactions. We
note that this rule permits a covered entity to disclose protected
health information to any person for treatment purposes, without
specific authorization from the individual. Therefore, a covered health
care provider is permitted to disclose protected health information to
a pharmaceutical manufacturer for treatment purposes. Providing free
samples to a health care provider does not in itself constitute health
care. For further analysis of pharmacy assistance programs, see
response to comment on Sec. 164.501, definition of ``payment.''
    Comment: Several commenters asked about the definition of ``covered
entity'' and its application to health care entities within larger
organizations.
    Response: A detailed discussion of the final rule's organizational
requirements and firewall restrictions for ``health care components''
of larger entities, as well as for affiliated, and other entities is
found at the discussion of Sec. 164.504 of this preamble. The following
responses to comments provide additional information with respect to
particular ``component entity'' circumstances.
    Comment: Several commenters asked that we clarify the definition of
covered entity to state that with respect to persons or organizations
that provide health care or have created health plans but are primarily
engaged in other unrelated businesses, the term ``covered entity''
encompasses only the health care components of the entity. Similarly,
others recommended that only the component of a government agency that
is a provider, health plan, or clearinghouse should be considered a
covered entity.
    Other commenters requested that we revise proposed Sec. 160.102 to
apply only to the component of an entity that engages in the
transactions specified in the rule. Commenters stated that companies
should remain free to employ licensed health care providers and to
enter into corporate relationships with provider institutions without
fear of being considered to be a covered entity. Another commenter
suggested that the regulation not apply to the provider-employee or
employer when neither the provider nor the company are a covered
entity.
    Some commenters specifically argued that the definition of
``covered entity'' did not contemplate an integrated health care system
and one commenter stated that the proposal would disrupt the multi-
disciplinary, collaborative approach that many take to health care
today by treating all components as separate entities. Commenters,
therefore, recommended that the rule treat the integrated entity, not
its constituent parts, as the covered entity.
    A few commenters asked that the Department further clarify the
definition with respect to the unique organizational models and
relationships of academic medical centers and their parent universities
and the rules that govern information exchange within the institution.
One commenter asked whether faculty physicians who are paid by a
medical school or faculty practice plan and who are on the medical
staff of, but not paid directly by, a hospital are included within the
covered entity. Another commenter stated that it appears that only the
health center at an academic institution is the covered entity.
Uncertainty was also expressed as to whether other components of the
institution that might create protected health information only
incidentally through the conduct of research would also be covered.
    Response: The Department understands that in today's health care
industry, the relationships among health care entities and non-health
care organizations are highly complex and varied. Accordingly, the
final rule gives covered entities some flexibility to segregate or
aggregate its operations for purposes of the application of this rule.
The new component entity provision can be found at Secs. 164.504(b)-
(c). In response to the request for clarification on whether the rule
would apply to a research component of the covered entity, we point out
that if the research activities fall outside of the health care
component they would not be subject to the rule. One organization may
have one or several ``health care component(s)'' that each perform one
or more of the health care functions of a covered entity, i.e., health
care provider, health plan, health care clearinghouse. In addition, the
final rule permits covered entities that are affiliated, i.e., share
common ownership or control, to designate themselves, or their health
care components, together to be a single covered entity for purposes of
the rule.
    It appears from the comments that there is not a common
understanding of the meaning of ``integrated delivery system.''
Arrangements that apply this label to themselves operate and share
information many different ways, and may or may not be financially or
clinically integrated. In some cases, multiple entities hold themselves
out as one enterprise and engage together in clinical or financial
activities. In others, separate entities share information but do not
provide treatment together or share financial risk. Many health care
providers participate in more than one such arrangement.
    Therefore, we do not include a separate category of ``covered
entity'' under this rule for ``integrated delivery systems'' but
instead accommodate the operations of these varied arrangements through
the functional provisions of the rule. For example, covered entities
that operate as ``organized health care arrangements'' as defined in
this rule may share protected health information for the operation of
such arrangement without becoming business associates of one another.
Similarly, the regulation does not require a business associate
arrangement when protected health information is shared for purposes of
providing treatment. The application of this rule to any particular
``integrated system'' will depend on the nature of the common
activities the participants in the system perform. When the
participants in such an arrangement are ``affiliated'' as defined in
this rule, they may consider themselves a single covered entity (see
Sec. 164. 504).
    The arrangements between academic health centers, faculty practice
plans, universities, and hospitals are similarly diverse. We cannot
describe a blanket rule that covers all such arrangements. The
application of this rule will depend on the purposes for which the
participants in such arrangements share protected health information,
whether some or all participants are under common ownership or control,
and similar matters. We note that physicians who have staff privileges
at a covered

[[Page 82570]]

hospital do not become part of that hospital covered entity by virtue
of having such privileges.
    We reject the recommendation to apply the rule only to components
of an entity that engage in the transactions. This would omit as
covered entities, for example, the health plan components that do not
directly engage in the transactions, including components that engage
in important health plan functions such as coverage determinations and
quality review. Indeed, we do not believe that the statute permits this
result with respect to health plans or health care clearinghouses as a
matter of negative implication from section 1172(a)(3). We clarify that
only a health care provider must conduct transactions to be a covered
entity for purposes of this rule.
    We also clarify that health care providers (such as doctors or
nurses) who work for a larger organization and do not conduct
transactions on their own behalf are workforce members of the covered
entity, not covered entities themselves.
    Comment: A few commenters asked the Department to clarify the
definition to provide that a multi-line insurer that sells insurance
coverages, some of which do and others which do not meet the definition
of ``health plan,'' is not a covered entity with respect to actions
taken in connection with coverages that are not ``health plans.''
    Response: The final rule clarifies that the requirements below
apply only to the organizational unit or units of the organization that
are the ``health care component'' of a covered entity, where the
``covered functions'' are not the primary functions of the entity.
Therefore, for a multi-line insurer, the ``health care component'' is
the insurance line(s) that conduct, or support the conduct of, the
health care function of the covered entity. Also, it should be noted
that excepted benefits, such as life insurance, are not included in the
definition of ``health plan.'' (See preamble discussion of
Sec. 164.504).
    Comment: A commenter questioned whether the Health Care Financing
Administration (HCFA) is a covered entity and how HCFA will share data
with Medicare managed care organizations. The commenter also questioned
why the regulation must apply to Medicaid since the existing Medicaid
statute requires that states have privacy standards in place. It was
also requested that the Department provide a definition of ``health
plan'' to clarify that state Medicaid Programs are considered as such.
    Response: HCFA is a covered entity because it administers Medicare
and Medicaid, which are both listed in the statute as health plans.
Medicare managed care organizations are also covered entities under
this regulation. As noted elsewhere in this preamble, covered entities
that jointly administer a health plan, such as Medicare + Choice, are
both covered entities, and are not business associates of each other by
virtue of such joint administration.
    We do not exclude state Medicaid programs. Congress explicitly
included the Medicaid program as a covered health plan in the HIPAA
statute.
    Comment: A commenter asked the Department to provide detailed
guidance as to when providers, plans, and clearinghouses become covered
entities. The commenter provided the following example: if a provider
submits claims only in paper form, and a coordination of benefits (COB)
transaction is created due to other insurance coverage, will the
original provider need to be notified that the claim is now in
electronic form, and that it has become a covered entity? Another
commenter voiced concern as to whether physicians who do not conduct
electronic transactions would become covered entities if another entity
using its records downstream transmits information in connection with a
standard transaction on their behalf.
    Response: We clarify that health care providers who submit the
transactions in standard electronic form, health plans, and health care
clearinghouses are covered entities if they meet the respective
definitions. Health care providers become subject to the rule if they
conduct standard transactions. In the above example, the health care
provider would not be a covered entity if the coordination of benefits
transaction was generated by a payor.
    We also clarify that health care providers who do not submit
transactions in standard form become covered by this rule when other
entities, such as a billing service or a hospital, transmit standard
electronic transactions on the providers' behalf. However, where the
downstream transaction is not conducted on behalf of the health care
provider, the provider does not become a covered entity due to the
downstream transaction.
    Comment: Several commenters discussed the relationship between
section 1179 of the Act and the privacy regulations. One commenter
suggested that HHS retain the statement that a covered entity means
``the entities to which part C of title XI of the Act applies.'' In
particular, the commenter observed that section 1179 of the Act
provides that part C of title XI of the Act does not apply to financial
institutions or to entities acting on behalf of such institutions that
are covered by the section 1179 exemption. Thus, under the definition
of covered entity, they comment that financial institutions and other
entities that come within the scope of the section 1179 exemption are
appropriately not covered entities.
    Other commenters maintained that section 1179 of the Act means that
the Act's privacy requirements do not apply to the request for, or the
use or disclosure of, information by a covered entity with respect to
payment: (a) For transferring receivables; (b) for auditing; (c) in
connection with--(i) a customer dispute; or (ii) an inquiry from or to
a customer; (d) in a communication to a customer of the entity
regarding the customer's transactions payment card, account, check, or
electronic funds transfer; (e) for reporting to consumer reporting
agencies; or (f) for complying with: (i) a civil or criminal subpoena;
or (ii) a federal or state law regulating the entity. These companies
expressed concern that the proposed rule did not include the full text
of section 1179 when discussing the list of activities that were exempt
from the rule's requirements. Accordingly, they recommended including
in the final rule either a full listing of or a reference to section
1179's full list of exemptions. Furthermore, these firms opposed
applying the proposed rule's minimum necessary standard for disclosure
of protected health information to financial institutions because of
section 1179.
    These commenters suggest that in light of section 1179, HHS lacks
the authority to impose restrictions on financial institutions and
other entities when they engage in activities described in that
section. One commenter expressed concern that even though proposed
Sec. 164.510(i) would have permitted covered entities to disclose
certain information to financial institutions for banking and payment
processes, it did not state clearly that financial institutions and
other entities described in section 1179 are exempt from the rule's
requirements.
    Response: We interpret section 1179 of the Act to mean that
entities engaged in the activities of a financial institution, and
those acting on behalf of a financial institution, are not subject to
this regulation when they are engaged in authorizing, processing,
clearing, settling, billing, transferring, reconciling, or collecting
payments for a financial institution. The statutory reference to 12
U.S.C. 3401 indicates that Congress chose to adopt the definition of
financial institutions found

[[Page 82571]]

in the Right to Financial Privacy Act, which defines financial
institutions as any office of a bank, savings bank, card issuer,
industrial loan company, trust company, savings association, building
and loan, homestead association, cooperative bank, credit union, or
consumer finance institution located in the United States or one of its
Territories. Thus, when we use the term ``financial institution'' in
this regulation, we turn to the definition with which Congress provided
us. We interpret this provision to mean that when a financial
institution, or its agent on behalf of the financial institution,
conducts the activities described in section 1179, the privacy
regulation will not govern the activity.
    If, however, these activities are performed by a covered entity or
by another entity, including a financial institution, on behalf of a
covered entity, the activities are subject to this rule. For example,
if a bank operates the accounts payable system or other ``back office''
functions for a covered health care provider, that activity is not
described in section 1179. In such instances, because the bank would
meet the rule's definition of ``business associate,'' the provider must
enter into a business associate contract with the bank before
disclosing protected health information pursuant to this relationship.
However, if the same provider maintains an account through which he/she
cashes checks from patients, no business associate contract would be
necessary because the bank's activities are not undertaken for or on
behalf of the covered entity, and fall within the scope of section
1179. In part to give effect to section 1179, in this rule we do not
consider a financial institution to be acting on behalf of a covered
entity when it processes consumer-conducted financial transactions by
debit, credit or other payment card, clears checks, initiates or
processes electronic funds transfers, or conducts any other activity
that directly facilitates or effects the transfer of funds for
compensation for health care.
    We do not agree with the comment that section 1179 of the Act means
that the privacy regulation's requirements cannot apply to the
activities listed in that section; rather, it means that the entities
expressly mentioned, financial institutions (as defined in the Right to
Financial Privacy Act), and their agents that engage in the listed
activities for the financial institution are not within the scope of
the regulation. Nor do we interpret section 1179 to support an
exemption for disclosures to financial institutions from the minimum
necessary provisions of this regulation.
    Comment: One commenter recommended that HHS include a definition of
``entity'' in the final rule because HIPAA did not define it. The
commenter explained that in a modern health care environment, the
organization acting as the health plan or health care provider may
involve many interrelated corporate entities and that this could lead
to difficulties in determining what ``entities'' are actually subject
to the regulation.
    Response: We reject the commenter's suggestion. We believe it is
clear in the final rule that the entities subject to the regulation are
those listed at Sec. 160.102. However, we acknowledge that how the rule
applies to integrated or other complex health systems needs to be
addressed; we have done so in Sec. 164.504 and in other provisions,
such as those addressing organized health care arrangements.
    Comment: The preamble should clarify that self-insured group health
and workmen's compensation plans are not covered entities or business
partners.
    Response: In the preamble to the proposed rule we stated that
certain types of insurance entities, such as workers' compensation,
would not be covered entities under the rule. We do not change this
position in this final rule. The statutory definition of health plan
does not include workers' compensation products, and the regulatory
definition of the term specifically excludes them. However, HIPAA
specifically includes most group health plans within the definition of
``health plan.''
    Comment: A health insurance issuer asserted that health insurers
and third party administrators are usually required by employers to
submit reports describing the volume, amount, payee, basis for services
rendered, types of claims paid and services for which payment was
requested on behalf of it covered employees. They recommended that the
rule permit the disclosure of protected health information for such
purposes.
    Response: We agree that health plans should be able to disclose
protected health information to employers sponsoring health plans under
certain circumstances. Section 164.504(f) explains the conditions under
which protected health information may be disclosed to plan sponsors.
We believe that this provision gives sponsors access to the information
they need, but protects individual's information to the extent possible
under our legislative authority.

Group Health Plan

    For response to comments relating to ``group health plan,'' see the
response to comments on ``health plan'' below and the response to
comments on Sec. 164.504.

Health Care

    Comment: A number of commenters asked that we include disease
management activities and other similar health improvement programs,
such as preventive medicine, health education services and maintenance,
health and case management, and risk assessment, in the definition of
``health care.'' Commenters maintained that the rule should avoid
limiting technological advances and new health care trends intended to
improve patient ``health care.''
    Response: Review of these and other comments, and our fact-finding,
indicate that there are multiple, different, understandings of the
definition of these terms. Therefore, rather than create a blanket rule
that includes such terms in or excludes such terms from the definition
of ``health care,'' we define health care based on the underlying
activities that constitute health care. The activities described by
these commenters are considered ``health care'' under this rule to the
extent that they meet this functional definition. Listing activities by
label or title would create the risk that important activities would be
left out and, given the lack of consensus on what these terms mean,
could also create confusion.
    Comment: Several commenters urged that the Department clarify that
the activities necessary to procure and distribute eyes and eye tissue
will not be hampered by the rule. Some of these commenters explicitly
requested that we include ``eyes and eye tissue'' in the list of
procurement biologicals as well as ``eye procurement'' in the
definition of ``health care.'' In addition, it was argued that
``administration to patients'' be excluded in the absence of a clear
definition. Also, commenters recommended that the definition include
other activities associated with the transplantation of organs, such as
processing, screening, and distribution.
    Response: We delete from the definition of ``health care''
activities related to the procurement or banking of blood, sperm,
organs, or any other tissue for administration to patients. We do so
because persons who make such donations are not seeking to be treated,
diagnosed, or assessed or otherwise seeking health care for themselves,
but are seeking to contribute to the health care of others. In
addition, the nature of

[[Page 82572]]

these activities entails a unique kind of information sharing and
tracking necessary to safeguard the nation's organ and blood supply,
and those seeking to donate are aware that this information sharing
will occur. Consequently, such procurement or banking activities are
not considered health care and the organizations that perform such
activities are not considered health care providers for purposes of
this rule.
    With respect to disclosure of protected health information by
covered entities to facilitate cadaveric organ and tissue donation, the
final rule explicitly permits a covered entity to disclose protected
health information without authorization, consent, or agreement to
organ procurement organizations or other entities engaged in the
procurement, banking, or transplantation of cadaveric organs, eyes, or
tissue for the purpose of facilitating donation and transplantation.
See Sec. 164.512(h). We do not include blood or sperm banking in this
provision because, for those activities, there is direct contact with
the donor, and thus opportunity to obtain the individual's
authorization.
    Comment: A large number of commenters urged that the term
``assessment'' be included in the list of services in the definition,
as ``assessment'' is used to determine the baseline health status of an
individual. It was explained that assessments are conducted in the
initial step of diagnosis and treatment of a patient. If assessment is
not included in the list of services, they pointed out that the
services provided by occupational health nurses and employee health
information may not be covered.
    Response: We agree and have added the term ``assessment'' to the
definition to clarify that this activity is considered ``health care''
for the purposes of the rule.
    Comment: One commenter asked that we revise the definition to
explicitly exclude plasmapheresis from paragraph (3) of the definition.
It was explained that plasmapheresis centers do not have direct access
to health care recipients or their health information, and that the
limited health information collected about plasma donors is not used to
provide health care services as indicated by the definition of health
care.
    Response: We address the commenters' concerns by removing the
provision related to procurement and banking of human products from the
definition.

Health Care Clearinghouse

    Comment: The largest set of comments relating to health care
clearinghouses focused on our proposal to exempt health care
clearinghouses from the patient notice and access rights provisions of
the regulation. In our NPRM, we proposed to exempt health care
clearinghouses from certain provisions of the regulation that deal with
the covered entities' notice of information practices and consumers'
rights to inspect, copy, and amend their records. The rationale for
this exemption was based on our belief that health care clearinghouses
engage primarily in business-to-business transactions and do not
initiate or maintain direct relationships with individuals. We proposed
this position with the caveat that the exemptions would be void for any
health care clearinghouse that had direct contact with individuals in a
capacity other than that of a business partner. In addition, we
indicated that, in most instances, clearinghouses also would be
considered business partners under this rule and would be bound by
their contracts with covered plans and providers. They also would be
subject to the notice of information practices developed by the plans
and providers with whom they contract.
    Commenters stated that, although health care clearinghouses do not
have direct contact with individuals, they do have individually
identifiable health information that may be subject to misuse or
inappropriate disclosure. They expressed concern that we were proposing
to exempt health care clearinghouses from all or many aspects of the
regulation. These commenters suggested that we either delete the
exemption or make it very narrow, specific and explicit in the final
regulatory text.
    Clearinghouse commenters, on the other hand, were in agreement with
our proposal, including the exemption provision and the provision that
the exemption is voided when the entity does have direct contact with
individuals. They also stated that a health care clearinghouse that has
a direct contact with individuals is no longer a health care
clearinghouse as defined and should be subject to all requirements of
the regulation.
    Response: In the final rule, where a clearinghouse creates or
receives protected health information as a business associate of
another covered entity, we maintain the exemption for health care
clearinghouses from certain provisions of the regulation dealing with
the notice of information practices and patient's direct access rights
to inspect, copy and amend records (Secs. 164.524 and 164.526), on the
grounds that a health care clearinghouse is engaged in business-to-
business operations, and is not dealing directly with individuals.
Moreover, as business associates of plans and providers, health care
clearinghouses are bound by the notices of information practices of the
covered entities with whom they contract.
    Where a health care clearinghouse creates or receives protected
health information other than as a business associate, however, it must
comply with all the standards, requirements, and implementation
specifications of the rule. We describe and delimit the exact nature of
the exemption in the regulatory text. See Sec. 164.500(b). We will
monitor developments in this sector should the basic business-to-
business relationship change.
    Comment: A number of comments relate to the proposed definition of
health care clearinghouse. Many commenters suggested that we expand the
definition. They suggested that additional types of entities be
included in the definition of health care clearinghouse, specifically
medical transcription services, billing services, coding services, and
``intermediaries.'' One commenter suggested that the definition be
expanded to add entities that receive standard transactions, process
them and clean them up, and then send them on, without converting them
to any standard format. Another commenter suggested that the health
care clearinghouse definition be expanded to include entities that do
not perform translation but may receive protected health information in
a standard format and have access to that information. Another
commenter stated that the list of covered entities should include any
organization that receives or maintains individually identifiable
health information. One organization recommended that we expand the
health care clearinghouse definition to include the concept of a
research data clearinghouse, which would collect individually
identifiable health information from other covered entities to generate
research data files for release as de-identified data or with
appropriate confidentiality safeguards. One commenter stated that HHS
had gone beyond Congressional intent by including billing services in
the definition.
    Response: We cannot expand the definition of ``health care
clearinghouse'' to cover entities not covered by the definition of this
term in the statute. In the final regulation, we

[[Page 82573]]

make a number of changes to address public comments relating to
definition. We modify the definition of health care clearinghouse to
conform to the definition published in the Transactions Rule (with the
addition of a few words, as noted above). We clarify in the preamble
that, while the term ``health care clearinghouse'' may have other
meanings and connotations in other contexts, for purposes of this
regulation an entity is considered a health care clearinghouse only to
the extent that it actually meets the criteria in our definition.
Entities performing other functions but not meeting the criteria for a
health care clearinghouse are not clearinghouses, although they may be
business associates. Billing services are included in the regulatory
definition of ``health care clearinghouse,'' if they perform the
specified clearinghouse functions. Although we have not added or
deleted any entities from our original definition, we will monitor
industry practices and may add other entities in the future as changes
occur in the health system.
    Comment: Several commenters suggested that we clarify that an
entity acting solely as a conduit through which individually
identifiable health information is transmitted or through which
protected health information flows but is not stored is not a covered
entity, e.g., a telephone company or Internet Service Provider. Other
commenters indicated that once a transaction leaves a provider or plan
electronically, it may flow through several entities before reaching a
clearinghouse. They asked that the regulation protect the information
in that interim stage, just as the security NPRM established a chain of
trust arrangement for such a network. Others noted that these
``conduit'' entities are likely to be business partners of the
provider, clearinghouse or plan, and we should clarify that they are
subject to business partner obligations as in the proposed Security
Rule.
    Response: We clarify that entities acting as simple and routine
communications conduits and carriers of information, such as telephone
companies and Internet Service Providers, are not clearinghouses as
defined in the rule unless they carry out the functions outlined in our
definition. Similarly, we clarify that value added networks and
switches are not health care clearinghouses unless they carry out the
functions outlined in the definition, and clarify that such entities
may be business associates if they meet the definition in the
regulation.
    Comment: Several commenters, including the large clearinghouses and
their trade associations, suggested that we not treat health care
clearinghouses as playing a dual role as covered entity and business
partner in the final rule because such a dual role causes confusion as
to which rules actually apply to clearinghouses. In their view, the
definition of health care clearinghouse is sufficiently clear to stand
alone and identify a health care clearinghouse as a covered entity, and
allows health care clearinghouses to operate under one consistent set
of rules.
    Response: For reasons explained in Sec. 164.504 of this preamble,
we do not create an exception to the business associate requirements
when the business associate is also a covered entity. We retain the
concept that a health care clearinghouse may be a covered entity and a
business associate of a covered entity under the regulation. As
business associates, they would be bound by their contracts with
covered plans and providers.

Health Care Provider

    Comment: One commenter pointed out that the preamble referred to
the obligations of providers and did not use the term, ``covered
entity,'' and thus created ambiguity about the obligations of health
care providers who may be employed by persons other than covered
entities, e.g., pharmaceutical companies. It was suggested that a
better reading of the statute and rule is that where neither the
provider nor the company is a covered entity, the rule does not impose
an obligation on either the provider-employee or the employer.
    Response: We agree. We use the term ``covered entity'' whenever
possible in the final rule, except for the instances where the final
rule treats the entities differently, or where use of the term ``health
care provider'' is necessary for purposes of illustrating an example.
    Comment: Several commenters stated that the proposal's definition
was broad, unclear, and/or confusing. Further, we received many
comments requesting clarification as to whether specific entities or
persons were ``health care providers'' for the purposes of our rule.
One commenter questioned whether affiliated members of a health care
group (even though separate legal entities) would be considered as one
primary health care provider.
    Response: We permit legally distinct covered entities that share
common ownership or control to designate themselves together to be a
single covered entity. Such organizations may promulgate a single
shared notice of information practices and a consent form. For more
detailed information, see the preamble discussion of Sec. 164.504(d).
    We understand the need for additional guidance on whether specific
entities or persons are health care providers under the final rule. We
provide guidance below and will provide additional guidance as the rule
is implemented.
    Comment: One commenter observed that sections 1171(3), 1861(s) and
1861(u) of the Act do not include pharmacists in the definition of
health care provider or pharmacist services in the definition of
``medical or other health services,'' and questioned whether
pharmacists were covered by the rule.
    Response: The statutory definition of ``health care provider'' at
section 1171(3) includes ``any other person or organization who
furnishes, bills, or is paid for health care in the normal course of
business.'' Pharmacists' services are clearly within this statutory
definition of ``health care.'' There is no basis for excluding
pharmacists who meet these statutory criteria from this regulation.
    Comment: Some commenters recommended that the scope of the
definition be broadened or clarified to cover additional persons or
organizations. Several commenters argued for expanding the reach of the
health care provider definition to cover entities such as state and
local public health agencies, maternity support services (provided by
nutritionists, social workers, and public health nurses and the Special
Supplemental Nutrition Program for Women, Infants and Children), and
those companies that conduct cost-effectiveness reviews, risk
management, and benchmarking studies. One commenter queried whether
auxiliary providers such as child play therapists, and speech and
language therapists are considered to be health care providers. Other
commenters questioned whether ``alternative'' or ``complementary''
providers, such as naturopathic physicians and acupuncturists would be
considered health care providers covered by the rule.
    Response: As with other aspects of this rule, we do not define
``health care provider'' based on the title or label of the
professional. The professional activities of these kinds of providers
vary; a person is a ``health care provider'' if those activities are
consistent with the rule's definition of ``health care provider.''
Thus, health care providers include persons, such as those noted by the
commenters, to the extent that they meet the definition. We note that
health care providers are only

[[Page 82574]]

subject to this rule if they conduct certain transactions. See the
definition of ``covered entity.''
    However companies that conduct cost-effectiveness reviews, risk
management, and benchmarking studies are not health care providers for
the purposes of this rule unless they perform other functions that meet
the definition. These entities would be business associates if they
perform such activities on behalf of a covered entity.
    Comment: Another commenter recommended that the Secretary expand
the definition of health care provider to cover health care providers
who transmit or ``or receive'' any health care information in
electronic form.
    Response: We do not accept this suggestion. Section 1172(a)(3)
states that providers that ``transmit'' health information in
connection with one of the HIPAA transactions are covered, but does not
use the term ``receive'' or a similar term.
    Comment: Some comments related to online companies as health care
providers and covered entities. One commenter argued that there was no
reason ``why an Internet pharmacy should not also be covered'' by the
rule as a health care provider. Another commenter stated that online
health care service and content companies, including online medical
record companies, should be covered by the definition of health care
provider. Another commenter pointed out that the definitions of covered
entities cover ``Internet providers who `bill' or are `paid' for health
care services or supplies, but not those who finance those services in
other ways, such as through sale of identifiable health information or
advertising.'' It was pointed out that thousands of Internet sites use
information provided by individuals who access the sites for marketing
or other purposes.
    Response: We agree that online companies are covered entities under
the rule if they otherwise meet the definition of health care provider
or health plan and satisfy the other requirements of the rule, i.e.,
providers must also transmit health information in electronic form in
connection with a HIPAA transaction. We restate here the language in
the preamble to the proposed rule that ``An individual or organization
that bills and/or is paid for health care services or supplies in the
normal course of business, such as * * * an ``online'' pharmacy
accessible on the Internet, is also a health care provider for purposes
of this statute'' (64 FR 59930).
    Comment: We received many comments related to the reference to
``health clinic or licensed health care professional located at a
school or business in the preamble's discussion of ``health care
provider.'' It was stated that including ``licensed health care
professionals located at a school or business'' highlights the need for
these individuals to understand they have the authority to disclose
information to the Social Security Administration (SSA) without
authorization.
    However, several commenters urged HHS to create an exception for or
delete that reference in the preamble discussion to primary and
secondary schools because of employer or business partner
relationships. One federal agency suggested that the reference
``licensed health care professionals located at a [school]'' be deleted
from the preamble because the definition of health care provider does
not include a reference to schools. The commenter also suggested that
the Secretary consider: adding language to the preamble to clarify that
the rules do not apply to clinics or school health care providers that
only maintain records that have been excepted from the definition of
protected health information, adding an exception to the definition of
covered entities for those schools, and limiting paperwork requirements
for these schools. Another commenter argued for deleting references to
schools because the proposed rule appeared to supersede or create
ambiguity as to the Family Educational Rights and Privacy Act (FERPA),
which gives parents the right to access ``education'' and health
records of their unemancipated minor children. However, in contrast,
one commenter supported the inclusion of health care professionals who
provide services at schools or businesses.
    Response: We realize that our discussion of schools in the NPRM may
have been confusing. Therefore, we address these concerns and set forth
our policy regarding protected health information in educational
agencies and institutions in the ``Relationship to Other Federal Laws''
discussion of FERPA, above.
    Comment: Many commenters urged that direct contact with the patient
be necessary for an entity to be considered a health care provider.
Commenters suggested that persons and organizations that are remote to
the patient and have no direct contact should not be considered health
care providers. Several commenters argued that the definition of health
care provider covers a person that provides health care services or
supplies only when the provider furnishes to or bills the patient
directly. It was stated that the Secretary did not intend that
manufacturers, such as pharmaceutical, biologics, and device
manufacturers, health care suppliers, medical-surgical supply
distributors, health care vendors that offer medical record
documentation templates and that typically do not deal directly with
the patient, be considered health care providers and thus covered
entities. However, in contrast, one commenter argued that, as an in
vitro diagnostics manufacturer, it should be covered as a health care
provider.
    Response: We disagree with the comments that urged that direct
dealings with an individual be a prerequisite to meeting the definition
of health care provider. Many providers included in the statutory
definition of provider, such as clinical labs, do not have direct
contact with patients. Further, the use and disclosure of protected
health information by indirect treatment providers can have a
significant effect on individuals' privacy. We acknowledge, however,
that providers who treat patients only indirectly need not have the
full array of responsibilities as direct treatment providers, and
modify the NPRM to make this distinction with respect to several
provisions (see, for example Sec. 164.506 regarding consent). We also
clarify that manufacturers and health care suppliers who are considered
providers by Medicare are providers under this rule.
    Comment: Some commenters suggested that blood centers and plasma
donor centers that collect and distribute source plasma not be
considered covered health care providers because the centers do not
provide ``health care services'' and the blood donors are not
``patients'' seeking health care. Similarly, commenters expressed
concern that organ procurement organizations might be considered health
care providers.
    Response: We agree and have deleted from the definition of ``health
care'' the term ``procurement or banking of blood, sperm, organs, or
any other tissue for administration to patients.'' See prior discussion
under ``health care.''
    Comment: Several commenters proposed to restrict coverage to only
those providers who furnished and were paid for services and supplies.
It was argued that a salaried employee of a covered entity, such as a
hospital-based provider, should not be covered by the rule because that
provider would be subject both directly to the rule as a covered entity
and indirectly as an employee of a covered entity.
    Response: The ``dual'' direct and indirect situation described in
these comments can arise only when a health

[[Page 82575]]

care provider conducts standard HIPAA transactions both for itself and
for its employer. For example, when the services of a provider such as
a hospital-based physician are billed through a standard HIPAA
transaction conducted for the employer, in this example the hospital,
the physician does not become a covered provider. Only when the
provider uses a standard transaction on its own behalf does he or she
become a covered health care provider. Thus, the result is typically as
suggested by this commenter. When a hospital-based provider is not paid
directly, that is, when the standard HIPAA transaction is not on its
behalf, it will not become a covered provider.
    Comment: Other commenters argued that an employer who provides
health care services to its employees for whom it neither bills the
employee nor pays for the health care should not be considered health
care providers covered by the proposed rule.
    Response: We clarify that the employer may be a health care
provider under the rule, and may be covered by the rule if it conducts
standard transactions. The provisions of Sec. 164.504 may also apply.
    Comment: Some commenters were confused about the preamble
statement: ``in order to implement the principles in the Secretary's
Recommendations, we must impose any protections on the health care
providers that use and disclose the information, rather than on the
researcher seeking the information,'' with respect to the rule's policy
that a researcher who provides care to subjects in a trial will be
considered a health care provider. Some commenters were also unclear
about whether the individual researcher providing health care to
subjects in a trial would be considered a health care provider or
whether the researcher's home institution would be considered a health
care provider and thus subject to the rule.
    Response: We clarify that, in general, a researcher is also a
health care provider if the researcher provides health care to subjects
in a clinical research study and otherwise meets the definition of
``health care provider'' under the rule. However, a health care
provider is only a covered entity and subject to the rule if that
provider conducts standard transactions. With respect to the above
preamble statement, we meant that our jurisdiction under the statute is
limited to covered entities. Therefore, we cannot apply any
restrictions or requirements on a researcher in that person's role as a
researcher. However, if a researcher is also a health care provider
that conducts standard transactions, that researcher/provider is
subject to the rule with regard to its provider activities.
    As to applicability to a researcher/provider versus the
researcher's home institution, we provide the following guidance. The
rule applies to the researcher as a covered entity if the researcher is
a health care provider who conducts standard transactions for services
on his or her own behalf, regardless of whether he or she is part of a
larger organization. However, if the services and transactions are
conducted on behalf of the home institution, then the home institution
is the covered entity for purposes of the rule and the researcher/
provider is a workforce member, not a covered entity.
    Comment: One commenter expressed confusion about those instances
when a health care provider was a covered entity one day, and one who
``works under a contract'' for a manufacturer the next day.
    Response: If persons are covered under the rule in one role, they
are not necessarily covered entities when they participate in other
activities in another role. For example, that person could be a covered
health care provider in a hospital one day but the next day read
research records for a different employer. In its role as researcher,
the person is not covered, and protections do not apply to those
research records.
    Comment: One commenter suggested that the Secretary modify proposed
Sec. 160.102, to add the following clause at the end (after (c))
(regarding health care provider), ``With respect to any entity whose
primary business is not that of a health plan or health care provider
licensed under the applicable laws of any state, the standards,
requirements, and implementation specifications of this subchapter
shall apply solely to the component of the entity that engages in the
transactions specified in [Sec. ] 160.103.'' (Emphasis added.) Another
commenter also suggested that the definition of ``covered entity'' be
revised to mean entities that are ``primarily or exclusively engaged in
health care-related activities as a health plan, health care provider,
or health care clearinghouse.''
    Response: The Secretary rejects these suggestions because they will
impermissibly limit the entities covered by the rule. An entity that is
a health plan, health care provider, or health care clearinghouse meets
the statutory definition of covered entity regardless of how much time
is devoted to carrying out health care-related functions, or regardless
of what percentage of their total business applies to health care-
related functions.
    Comment: Several commenters sought to distinguish a health care
provider from a business partner as proposed in the NPRM. For example,
a number of commenters argued that disease managers that provide
services ``on behalf of'' health plans and health care providers, and
case managers (a variation of a disease management service) are
business partners and not ``health care providers.'' Another commenter
argued that a disease manager should be recognized (presumably as a
covered entity) because of its involvement from the physician-patient
level through complex interactions with health care providers.
    Response: To the extent that a disease or case manager provides
services on behalf of or to a covered entity as described in the rule's
definition of business associate, the disease or case manager is a
business associate for purposes of this rule. However, if services
provided by the disease or case manager meet the definition of
treatment and the person otherwise meets the definition of ``health
care provider,'' such a person is a health care provider for purposes
of this rule.
    Comment: One commenter argued that pharmacy employees who assist
pharmacists, such as technicians and cashiers, are not business
partners.
    Response: We agree. Employees of a pharmacy that is a covered
entity are workforce members of that covered entity for purposes of
this rule.
    Comment: A number of commenters requested that we clarify the
definition of health care provider (``* * * who furnishes, bills, or is
paid for health care services or supplies in the normal course of
business'') by defining the various terms ``furnish'', ``supply'', and
``in the normal course of business.'' For instance, it was stated that
this would help employers recognize when services such as an employee
assistance program constituted health care covered by the rule.
    Response: Although we understand the concern expressed by the
commenters, we decline to follow their suggestion to define terms at
this level of specificity. These terms are in common use today, and an
attempt at specific definition would risk the inadvertent creations of
conflict with industry practices. There is a significant variation in
the way employers structure their employee assistance programs (EAPs)
and the type of services that they provide. If the EAP provides direct
treatment to individuals, it may be a health care provider.

[[Page 82576]]

Health Information

    The response to comments on health information is included in the
response to comments on individually identifiable health information,
in the preamble discussion of Sec. 164.501.

Health Plan

    Comment: One commenter suggested that to eliminate any ambiguity,
the Secretary should clarify that the catch-all category under the
definition of health plan includes ``24-hour coverage plans'' (whether
insured or self-insured) that integrate traditional employee health
benefits coverage and workers' compensation coverage for the treatment
of on-the-job injuries and illnesses under one program. It was stated
that this clarification was essential if the Secretary persisted in
excluding workers' compensation from the final rule.
    Response: We understand concerns that such plans may use and
disclose individually identifiable health information. We therefore
clarify that to the extent that 24-hour coverage plans have a health
care component that meets the definition of ``health plan'' in the
final rule, such components must abide by the provisions of the final
rule. In the final rule, we have added a new provision to Sec. 164.512
that permits covered entities to disclose information under workers'
compensation and similar laws. A health plan that is a 24-hour plan is
permitted to make disclosures as necessary to comply with such laws.
    Comment: A number of commenters urged that certain types of
insurance entities, such as workers' compensation and automobile
insurance carriers, property and casualty insurance health plans, and
certain forms of limited benefits coverage, be included in the
definition of ``health plan.'' It was argued that consumers deserve the
same protection with respect to their health information, regardless of
the entity using it, and that it would be inequitable to subject health
insurance carriers to more stringent standards than other types of
insurers that use individually identifiable health information.
    Response: The Congress did not include these programs in the
definition of a ``health plan'' under section 1171 of the Act. Further,
HIPAA's legislative history shows that the House Report's (H. Rep. 104-
496) definition of ``health plan'' originally included certain benefit
programs, such as workers' compensation and liability insurance, but
was later amended to clarify the definition and remove these programs.
Thus, since the statutory definition of a health plan both on its face
and through legislative history evidence Congress' intention to exclude
such programs, we do not have the authority to require that these
programs comply with the standards. We have added explicit language to
the final rule which excludes the excepted benefit programs, as defined
in section 2971(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1).
    Comment: Some commenters urged HHS to include entities such as stop
loss insurers and reinsurers in the definition of ``health plan.'' It
was observed that such entities have come to play important roles in
managed care delivery systems. They asserted that increasingly,
capitated health plans and providers contract with their reinsurers and
stop loss carriers to medically manage their high cost outlier cases
such as organ and bone marrow transplants, and therefore should be
specifically cited as subject to the regulations.
    Response: Stop-loss and reinsurers do not meet the statutory
definition of health plan. They do not provide or pay for the costs of
medical care, as described in the statute, but rather insure health
plans and providers against unexpected losses. Therefore, we cannot
include them as health plans in the regulation.
    Comment: A commenter asserted that there is a significant
discrepancy between the effect of the definition of ``group health
plan'' as proposed in Sec. 160.103, and the anticipated impact in the
cost estimates of the proposed rule at 64 FR 60014. Paragraph (1) of
the proposed definition of ``health plan'' defined a ``group health
plan'' as an ERISA-defined employee welfare benefit plan that provides
medical care and that: ``(i) Has 50 or more participants, or (ii) Is
administered by an entity other than the employer that established and
maintains the plan[.]'' (emphasis added) According to this commenter,
under this definition, the only insured or self-insured ERISA plans
that would not be regulated ``health plans'' would be those that have
less than 50 participants and are self administered.
    The commenter presumed that the we had intended to exclude from the
definition of ``health plan'' (and from coverage under the proposed
rule) all ERISA plans that are small (less than 50 participants) or are
administered by a third party, whether large or small, based on the
statement at 64 FR 60014, note 18. That footnote stated that the
Department had ``not included the 3.9 million `other' employer-health
plans listed in HCFA's administrative simplification regulations
because these plans are administered by a third party. The proposed
regulation will not regulate the employer plans but will regulate the
third party administrators of the plan.'' The commenter urged us not to
repeat the statutory definition, and to adopt the policy implied in the
footnote.
    Response: We agree with the commenter's observation that footnote
18 (64 FR 60014) was inconsistent with the proposed definition. We
erred in drafting that note. The definition of ``group health plan'' is
adopted from the statutory definition at section 1171(5)(A), and
excludes from the rule as ``health plans'' only the few insured or
self-insured ERISA plans that have less than 50 participants and are
self administered. We reject the commenter's proposed change to the
definition as inconsistent with the statute.
    Comment: A number of insurance companies asked that long term care
insurance policies be excluded from the definition of ``health plan.''
It was argued that such policies do not provide sufficiently
comprehensive coverage of the cost of medical care, and are limited
benefit plans that provide or pay for the cost of custodial and other
related services in connection with a long term, chronic illness or
disability.
    These commenters asserted that HIPAA recognizes this nature of long
term care insurance, observing that, with respect to HIPAA's
portability requirements, Congress enacted a series of exclusions for
certain defined types of health plan arrangements that do not typically
provide comprehensive coverage. They maintained that Congress
recognized that long term care insurance is excluded, so long as it is
not a part of a group health plan. Where a long term care policy is
offered separately from a group health plan it is considered an
excepted benefit and is not subject to the portability and guarantee
issue requirements of HIPAA. Although this exception does not appear in
the Administrative Simplification provisions of HIPAA, it was asserted
that it is guidance with respect to the treatment of long term care
insurance as a limited benefit coverage and not as coverage that is so
``sufficiently comprehensive'' that it is to be treated in the same
manner as a typical, comprehensive major medical health plan
arrangement.
    Another commenter offered a different perspective observing that
there are some long-term care policies--that do not pay for medical
care and therefore are not ``health plans.'' It was noted that most
long-term care policies are reimbursement policies--that is,

[[Page 82577]]

they reimburse the policyholder for the actual expenses that the
insured incurs for long-term care services. To the extent that these
constitute ``medical care,'' this commenter presumed that these
policies would be considered ``health plans.'' Other long-term care
policies, they pointed out, simply pay a fixed dollar amount when the
insured becomes chronically ill, without regard to the actual cost of
any long-term care services received, and thus are similar to fixed
indemnity critical illness policies. The commenter suggested that while
there was an important distinction between indemnity based long-term
care policies and expenses based long-term care policies, it may be
wise to exclude all long-term care policies from the scope of the rule
to achieve consistency with HIPAA.
    Response: We disagree. The statutory language regarding long-term
care policies in the portability title of HIPAA is different from the
statutory language regarding long-term care policies in the
Administrative Simplification title of HIPAA. Section 1171(5)(G) of the
Act means that issuers of long-term care policies are considered health
plans for purposes of administrative simplification. We also interpret
the statute as authorizing the Secretary to exclude nursing home fixed-
indemnity policies, not all long-term care policies, from the
definition of ``health plan,'' if she determines that these policies do
not provide ``sufficiently comprehensive coverage of a benefit'' to be
treated as a health plan (see section 1171 of the Act). We interpret
the term ``comprehensive'' to refer to the breadth or scope of coverage
of a policy. ``Comprehensive'' policies are those that cover a range of
possible service options. Since nursing home fixed indemnity policies
are, by their own terms, limited to payments made solely for nursing
facility care, we have determined that they should not be included as
health plans for the purposes of the HIPAA regulations. The Secretary,
therefore, explicitly excluded nursing home fixed-indemnity policies
from the definition of ``health plan'' in the Transactions Rule, and
this exclusion is thus reflected in this final rule. Issuers of other
long-term care policies are considered to be health plans under this
rule and the Transactions Rule.
    Comment: One commenter was concerned about the potential impact of
the proposed regulations on ``unfunded health plans,'' which the
commenter described as programs used by smaller companies to provide
their associates with special employee discounts or other membership
incentives so that they can obtain health care, including prescription
drugs, at reduced prices. The commenter asserted that if these discount
and membership incentive programs were covered by the regulation, many
smaller employers might discontinue offering them to their employees,
rather than deal with the administrative burdens and costs of complying
with the rule.
    Response: Only those special employee discounts or membership
incentives that are ``employee welfare benefit plans'' as defined in
section 3(1) of the Employee Retirement Income Security Act of 1974, 29
U.S.C. 1002(1), and provide ``medical care'' (as defined in section
2791(a)(2) of the Public Health Service Act, 42 U.S.C. 300gg-91(a)(2)),
are health plans for the purposes of this rule. Discount or membership
incentive programs that are not group health plans are not covered by
the rule.
    Comment: Several commenters agreed with the proposal to exclude
``excepted benefits'' such as disability income insurance policies,
fixed indemnity critical illness policies, and per diem long-term care
policies from the definition of ``health plan,'' but were concerned
that the language of the proposed rule did not fully reflect this
intent. They asserted that clarification was necessary in order to
avoid confusion and costs to both consumers and insurers.
    One commenter stated that, while HHS did not intend for the rule to
apply to every type of insurance coverage that paid for medical care,
the language of the proposed rule did not bear this out. The problem,
it was asserted, is that under the proposed rule any insurance policy
that pays for ``medical care'' would technically be a ``health plan.''
It was argued that despite the statements in the narrative, there are
no provisions that would exempt any of the ``excepted benefits'' from
the definition of ``health care.'' It was stated that:

    Although (with the exception of long-term care insurance), the
proposed rule does not include the `excepted benefits' in its list
of sixteen examples of a health plan (proposed 45 CFR 160.104), it
does not explicitly exclude them either. Because these types of
policies in some instances pay benefits that could be construed as
payments for medical care, we are concerned by the fact that they
are not explicitly excluded from the definition of `health plan' or
the requirements of the proposed rule.''

    Several commenters proposed that HHS adopt the same list of
``excepted benefits'' contained in 29 U.S.C. 1191b, suggesting that
they could be adopted either as exceptions to the definition of
``health plan'' or as exceptions to the requirements imposed on
``health plans.'' They asserted that this would promote consistency in
the federal regulatory structure for health plans.
    It was suggested that HHS clarify whether the definition of health
plan, particularly the ``group health plan'' and ``health insurance
issuer'' components, includes a disability plan or disability insurer.
It was noted that a disability plan or disability insurer may cover
only income lost from disability and, as mentioned above, some
rehabilitation services, or a combination of lost income,
rehabilitation services and medical care. The commenter suggested that
in addressing this coverage issue, it may be useful to refer to the
definitions of group health plan, health insurance issuer and medical
care set forth in Part I of HIPAA, which the statutory provisions of
the Administrative Simplification subtitle expressly reference. See 42
U.S.C. 1320d(5)(A) and (B).
    Response: We agree that the NPRM may have been ambiguous regarding
the types of plans the rule covers. To remedy this confusion, we have
added language that specifically excludes from the definition any
policy, plan, or program providing or paying the cost of the excepted
benefits, as defined in section 2971(c)(1) of the PHS Act, 42 U.S.C.
300gg-91(c)(1). As defined in the statute, this includes but is not
limited to benefits under one or more (or any combination thereof) of
the following: coverage only for accident, or disability income
insurance, or any combination thereof; liability insurance, including
general liability insurance and automobile liability insurance; and
workers' compensation or similar insurance.
    However, the other excepted benefits as defined in section
2971(c)(2) of the PHS Act, 42 U.S.C. 300gg-91(c)(2), such as limited
scope dental or vision benefits, not explicitly excepted from the
regulation could be considered ``health plans'' under paragraph
(1)(xvii) of the definition of ``health plan'' in the final rule if and
to the extent that they meet the criteria for the definition of
``health plan.'' Such plans, unlike the programs and plans listed at
section 2971(c)(1), directly and exclusively provide health insurance,
even if limited in scope.
    Comment: One commenter recommended that the Secretary clarify that
``health plan'' does not include property and casualty benefit
providers. The commenter stated that the clarifying language is needed
given the ``catchall'' category of entities defined as ``any other
individual plan or group health plan, or combination thereof, that

[[Page 82578]]

provides or pays for the cost of medical care,'' and asserted that
absent clarification there could be serious confusion as to whether
property and casualty benefit providers are ``health plans'' under the
rule.
    Response: We agree and as described above have added language to
the final rule to clarify that the ``excepted benefits'' as defined
under 42 U.S.C. 300gg-91(c)(1), which includes liability programs such
as property and casualty benefit providers, are not health plans for
the purposes of this rule.
    Comment: Some commenters recommended that the Secretary replace the
term ``medical care'' with ``health care.'' It was observed that
``health care'' was defined in the proposal, and that this definition
was used to define what a health care provider does. However, they
observed that the definition of ``health plan'' refers to the provision
of or payment for ``medical care,'' which is not defined. Another
commenter recommended that HHS add the parenthetical phrase ``as such
term is defined in section 2791 of the Public Health Ser