[Federal Register: December 28, 2000 (Volume 65, Number 250)]
[Rules and Regulations]
[Page 82661-82710]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr28de00-33]

[[pp. 82661-82710]] Standards for Privacy of Individually Identifiable Health
Information

[[Continued from page 82660]]

[[Page 82661]]

marketing purposes, absent any other authority to act for her husband.
See Sec. 164.502(g) for more information regarding personal
representatives.
    Comment: One commenter suggested that authorizations should be
dated on the day they are signed.
    Response: We agree and have retained this requirement in the final
rule.

Additional Elements and Requirements for Authorizations Requested by
the Covered Entity for Its Own Uses and Disclosures

    Comment: Some commenters suggested that we should not require
different elements in authorizations initiated by the covered entity
versus authorizations initiated by the individual. The commenters
argued the standards were unnecessary, confusing, and burdensome.
    Response: The proposed authorization requirements are intended to
ensure that an individual's authorization is truly voluntary. The
additional elements required for authorizations initiated by the
covered entity for its own uses and disclosures or for receipt of
protected health information from other covered entities to carry out
treatment, payment, or health care operations address concerns that are
unique to these forms of authorization. (See above regarding
requirements for research authorizations under Sec. 164.508(f).)
    First, when applicable, these authorizations must state that the
covered entity will not condition treatment, payment, eligibility, or
enrollment on the individual's providing authorization for the
requested use or disclosure. This statement is not appropriate for
authorizations initiated by the individual or another person who does
not have the ability to withhold services if the individual does not
authorize the use or disclosure.
    Second, the authorization must state that the individual may refuse
to sign the authorization. This statement is intended to signal to the
individual that the authorization is voluntary and may not be accurate
if the authorization is obtained by a person other than a covered
entity.
    Third, these authorizations must describe the purpose of the use or
disclosure. We do not include this element in the core requirements
because we understand there may be times when the individual does not
want the covered entity maintaining the protected health information to
know the purpose for the use or disclosure. For example, an individual
contemplating litigation may not want the covered entity to know that
litigation is the purpose of the disclosure. If the covered entity is
initiating the authorization for its own use or disclosure, however,
the individual and the covered entity maintaining the protected health
information should have a mutual understanding of the purpose of the
use or disclosure. Similarly, when a covered entity is requesting
authorization for a disclosure by another covered entity that may have
already obtained the individual's consent for the disclosure, the
individual and covered entity that maintains the protected health
information should be aware of this potential conflict.
    There are two additional requirements for authorizations requested
by a covered entity for its own use or disclosure of protected health
information it maintains. First, we require the covered entity to
describe the individual's right to inspect or copy the protected health
information to be used or disclosed. Individuals may want to review the
information to be used or disclosed before signing the authorization
and should be reminded of their ability to do so. This requirement is
not appropriate for authorizations for a covered entity to receive
protected health information from another covered entity, however,
because the covered entity requesting the authorization is not the
covered entity that maintains the protected health information and
cannot, therefore, grant or describe the individual's right to access
the information.
    If applicable, we also require a covered entity that requests an
authorization for its own use or disclosure to state that the use or
disclosure of the protected health information will result in direct or
indirect remuneration to the entity. Individuals should be aware of any
conflicts of interest or financial incentives on the part of the
covered entity requesting the use or disclosure. These statements are
not appropriate, however, in relation to uses and disclosures to carry
out treatment, payment, and health care operations. Uses and
disclosures for these purposes will often involve remuneration by the
nature of the use or disclosure, not due to any conflict of interest on
the part of either covered entity.
    We note that authorizations requested by a covered entity include
authorizations requested by the covered entity's business associate on
the covered entity's behalf. Authorizations requested by a business
associate on the covered entity's behalf and that authorize the use or
disclosure of protected health information by the covered entity or the
business associate must meet the requirements in Sec. 164.508(d).
Similarly, authorizations requested by a business associate on behalf
of a covered entity to accomplish the disclosure of protected health
information to that business associate or covered entity as described
in Sec. 164.508(e) must meet the requirements of that provision.
    We disagree that these elements are unnecessary, confusing, or
burdensome. We require them to ensure that the individual has a
complete understanding of what he or she is agreeing to permit.
    Comment: Many commenters suggested we include in the regulation
text a provision stated in the preamble that entities and their
business partners must limit their uses and disclosures to the
purpose(s) specified by the individual in the authorization.
    Response: We agree. In accordance with Sec. 164.508(a)(1), covered
entities may only use or disclose protected health information
consistent with the authorization. In accordance with
Sec. 164.504(e)(2), a business associate may not make any uses or
disclosures that the covered entity couldn't make.
    Comment: Some comments suggested that authorizations should
identify the source and amount of financial gain, if any, resulting
from the proposed disclosure. Others suggested that the proposed
financial gain requirements were too burdensome and would decrease
trust between patients and providers. Commenters recommended that the
requirement either should be eliminated or should only require covered
entities, when applicable, to state that direct and foreseeable
financial gain to the covered entity will result. Others requested
clarification of how the requirement for covered entities to disclose
financial gain relates to the criminal penalties that accrue for
offenses committed with intent to sell, transfer, or use individually
identifiable health information for commercial advantage, personal
gain, or malicious harm. Some commenters advocated use of the term
``financial compensation'' rather than ``financial gain'' to avoid
confusion with in-kind compensation rules. Some comments additionally
suggested excluding marketing uses and disclosures from the
requirements regarding financial gain.
    Response: We agree that clarification is warranted. In
Sec. 164.508(d)(1)(iv) of the final rule, we require a covered entity
that asks an individual to sign an authorization for the covered
entity's use or disclosure of protected health information and that
will receive direct

[[Page 82662]]

or indirect remuneration from a third party for the use or disclosure,
to state that fact in the authorization. Remuneration from a third
party includes payments such as a fixed price per disclosure,
compensation for the costs of compiling and sending the information to
be disclosed, and, with respect to marketing communications, a
percentage of any sales generated by the marketing communication. For
example, a device manufacturer may offer to pay a fixed price per name
and address of individuals with a particular diagnosis, so that the
device manufacturer can market its new device to people with the
diagnosis. The device manufacturer may also offer the covered entity a
percentage of the profits from any sales generated by the marketing
materials sent. If a covered entity seeks an authorization to make such
a disclosure, the authorization must state that the remuneration will
occur. We believe individuals should have the opportunity to weigh the
covered entity's potential conflict of interest when deciding to
authorize the covered entity's use or disclosure of protected health
information. We believe that the term ``remuneration from a third
party'' clarifies our intent to describe a direct, tangible exchange,
rather than the mere fact that parties intend to profit from their
enterprises.
    Comment: One commenter suggested we require covered entities to
request authorizations in a manner that does not in itself disclose
sensitive information.
    Response: We agree that covered entities should make reasonable
efforts to avoid unintentional disclosures. In Sec. 164.530(c)(2), we
require covered entities to have in place appropriate administrative,
technical, and physical safeguards to protect the privacy of protected
health information.
    Comment: Some commenters requested clarification that covered
entities are permitted to seek authorization at the time of enrollment
or when individuals otherwise first interact with covered entities.
Similarly, commenters requested clarification that covered entities may
disclose protected health information created after the date the
authorization was signed but prior to the expiration date of the
authorization. These commenters were concerned that otherwise multiple
authorizations would be required to accomplish a single purpose. Other
comments suggested that we prohibit prospective authorizations (i.e.,
authorizations requested prior to the creation of the protected health
information to be disclosed under the authorization) because it is not
possible for individuals to make informed decisions about these
authorizations.
    Response: We confirm that covered entities may act on
authorizations signed in advance of the creation of the protected
health information to be released. We note, however, that all of the
required elements must be completed, including a description of the
protected health information to be used or disclosed pursuant to the
authorization. This description must identify the information in a
specific and meaningful fashion so that the individual can make an
informed decision as to whether to sign the authorization.
    Comment: Some commenters suggested that the final rule prohibit
financial incentives, such as premium discounts, designed to encourage
individuals to sign authorizations.
    Response: We do not prohibit or require financial incentives for
authorizations. We have attempted to ensure that authorizations are
entered into voluntary. If a covered entity chooses to offer a
financial incentive for the individual to sign the authorization, and
the individual chooses to accept it, they are free to do so.

Section 164.510--Uses and Disclosures Requiring an Opportunity for
the Individual to Agree or to Object

Section 164.510(a)--Use and Disclosure for Facility Directories

    Comment: Many hospital organizations opposed the NPRM's proposed
opt-in approach to disclosure of directory information. These groups
noted the preamble's statement that most patients welcomed the
convenience of having their name, location, and general condition
included in the patient directory. They said that requiring hospitals
to obtain authorization before including patient information in the
directory would cause harm to many patients' needs in an effort to
serve the needs of the small number of patients who may not want their
information to be included. Specifically, they argued that the proposed
approach ultimately could have the effect of making it difficult or
impossible for clergy, family members, and florists to locate patients
for legitimate purposes. In making this argument, commenters pointed to
problems that occurred after enactment of privacy legislation in the
State of Maine in 1999. The legislation, which never was officially
implemented, was interpreted by hospitals to prohibit disclosure of
patient information to directories without written consent. As a
result, when hospitals began complying with the law based on their
interpretation, family members and clergy had difficulty locating
patients in the hospital.
    Response: We share commenters' concern about the need to ensure
that family members and clergy who have a legitimate need to locate
patients are not prevented from doing so by excessively stringent
restrictions on disclosure of protected health information to health
care facilities' directories. Accordingly, the final rule takes an opt-
out approach, stating that health care institutions may include the
name, general condition, religious affiliation, and location of a
patient within the facility in the facility's directory unless the
patient explicitly objects to the use or disclosure of protected health
information for directory purposes. To ensure that this opt-out can be
exercised, the final rule requires facilities to notify individuals of
their right not to be included in the directory and to give them the
opportunity to opt out. The final rule indicates that the notice and
opt-out may be oral. The final rule that allows health care facilities
to disclose to clergy the four types of protected health information
specified above without requiring the clergy to ask for the individual
by name will allow the clergy to identify the members of his or her
faith who are in the facility, thus ensuring that this rule will not
significantly interfere with the exercise of religion, including the
clergy's traditional religious mission to provide services to
individuals.
    Comment: A small number of commenters recommended requiring written
authorization for all disclosures of protected health information for
directory purposes. These commenters believed that the NPRM's proposed
provision allowing oral agreement would not provide sufficient privacy
protection; that it did not sufficiently hold providers accountable for
complying with patient wishes; and that it could create liability
issues for providers.
    Response: The final rule does not require written authorization for
disclosure of protected health information for directory purposes. We
believe that requiring written authorization in these cases would
increase substantially the administrative burdens and costs for covered
health care providers and could lead to significant inconvenience for
families and others attempting to locate individuals in health care
institutions. Experience from the State of Maine suggests that
requiring written authorization before patient information may be
included in facility directories

[[Page 82663]]

can be disruptive for providers, families, clergy, and others.
    Comment: Domestic violence organizations raised concerns that
including information about domestic violence victims in health care
facilities' directories could result in further harm to victims. The
NPRM addressed the issue of potential danger to patients by stating
that when patients were incapacitated, covered health care providers
could exercise discretion--consistent with good medical practice and
prior expression of patient preference--regarding whether to disclose
protected health information for directory purposes. Several commenters
recommended prohibiting providers from including information in a
health care facility's directory about incapacitated individuals when
the provider reasonably believed that the injuries to the individual
could have been caused by domestic violence. These groups believed that
such a prohibition was necessary to prevent abusers from locating and
causing further harm to domestic violence patients.
    Response: We share commenters' concerns about protecting victims of
domestic violence from further abuse. We are also concerned, however,
that imposing an affirmative duty on institutions not to disclose
information any time injuries to the individual could have been the
result of domestic violence would place too high a burden on health
care facilities, essentially requiring them to rule out domestic
violence as a potential cause of the injuries before disclosing to
family members that an incapacitated person is in the institution.
    We do believe, however, that it is appropriate to require covered
health care providers to consider whether including the individual's
name and location in the directory could lead to serious harm. As in
the preamble to the NPRM, in the preamble to the final rule, we
encourage covered health care providers to consider several factors
when deciding whether to include an incapacitated patient's information
in a health care facility's directory. One of these factors is whether
disclosing an individual's presence in the facility could reasonably
cause harm or danger to the individual (for example, if it appeared
that an unconscious patient had been abused and disclosing that the
individual is in the facility could give the attacker sufficient
information to seek out the person and repeat the abuse). Under the
final rule, when the opportunity to object to uses and disclosures for
a facility's directory cannot practicably be provided due to an
individual's incapacity or an emergency treatment circumstance, covered
health care providers may use or disclose some or all of the protected
health information that the rule allows to be included in the
directory, if the disclosure is: (1) consistent with the individual's
prior expressed preference, if known to the covered health care
provider; and (2) in the individual's best interest, as determined by
the covered health care provider in the exercise of professional
judgement. The rule allows covered health care providers making
decisions about incapacitated patients to include some portions of the
patient's information (such as name) but not other information (such as
location in the facility) to protect patient interests.

Section 164.510(b)--Uses and Disclosures for Involvement in the
Individual's Care and Notification Purposes

    Comment: A number of comments supported the NPRM's proposed
approach, which would have allowed covered entities to disclose
protected health information to the individual's next of kin, family
members, or other close personal friends when the individual verbally
agreed to the disclosure. These commenters agreed that the presumption
should favor disclosures to the next of kin, and they believed that
health care providers should encourage individuals to share genetic
information and information about transmittable diseases with family
members at risk. Others agreed with the general approach but suggested
the individual's agreement be noted in the medical record. These
commenters also supported the NPRM's proposed reliance on good
professional practices and ethics to determine when disclosures should
be made to the next of kin when the individual's agreement could not
practicably be obtained.
    A few commenters recommended that the individual's agreement be in
writing for the protection of the covered entity and to facilitate the
monitoring of compliance with the individual's wishes. These commenters
were concerned that, absent the individual's written agreement, the
covered entity would become embroiled in intra-family disputes
concerning the disclosures. Others argued that the individual's
authorization should be obtained for all disclosures, even to the next
of kin.
    One commenter favored disclosures to family members and others
unless the individual actively objected, as long as the disclosure was
consistent with sound professional practice. Others believed that no
agreement by the individual was necessary unless sensitive medical
information would be disclosed or unless the health care provider was
aware of the individual's prior objection. These commenters recommended
that good professional practice and ethics determine when disclosures
were appropriate and that disclosure should relate only to the
individual's current treatment. A health care provider organization
said that the ethical and legal obligations of the medical professional
alone should control in this area, although it believed the proposed
rule was generally consistent with these obligations.
    Response: The diversity of comments regarding the proposal on
disclosures to family members, next of kin, and other persons, reflects
a wide range of current practice and individual expectations. We
believe that the NPRM struck the proper balance between the competing
interests of individual privacy and the need that covered health care
providers may have, in some cases, to have routine, informal
conversations with an individual's family and friends regarding the
individual's treatment.
    We do not agree with the comments stating that all such disclosures
should be made only with consent or with the individual's written
authorization. The rule does not prohibit obtaining the agreement of
the individual in writing; however, we believe that imposing a
requirement for consent or written authorization in all cases for
disclosures to individuals involved in a person's care would be unduly
burdensome for all parties. In the final rule, we clarify the
circumstances in which such disclosures are permissible. The rule
allows covered entities to disclose to family members, other relatives,
close personal friends of the individual, or any other person
identified by the individual, the protected health information directly
relevant to such person's involvement with the individual's care or
payment related to the individual's health care. In addition, the final
rule allows covered entities to use or disclose protected health
information to notify, or assist in the notification of (including
identifying or locating) a family member, a personal representative of
the individual, or another person responsible for the care of the
individual, of the individual's location, general condition, or death.
The final rule includes separate provisions for situations in which the
individual is present and for when the individual is not present at the
time of disclosure. When the individual is present and can make his or
her own decisions, a covered entity may disclose protected health
information only if the covered entity: (1) Obtains the

[[Page 82664]]

individual's agreement to disclose to the third parties involved in the
individual's care; (2) provides the individual with the opportunity to
object to the disclosure, and the individual does not express an
objection; or (3) reasonably infers from the circumstances, based on
the exercise of professional judgement, that the individual does not
object to the disclosure. The final rule continues to permit
disclosures in circumstances when the individual is not present or when
the opportunity to agree or object to the use or disclosure cannot
practicably be provided due to the individual's incapacity or an
emergency circumstance. In such instances, covered entities may, in the
exercise of professional judgement, determine whether the disclosure is
in the individual's best interests and if so, disclose only the
protected health information that is directly relevant to the person's
involvement with the individual's health care.
    As discussed in the preamble for this section, we do not intend to
disrupt most covered entities' current practices with respect to
informing family members and others with whom a patient has a close
personal relationship about a patient's specific health condition when
a patient is incapacitated due to a medical emergency and the family
member or close personal friend comes to the covered entity to ask
about the patient's condition. To the extent that disclosures to family
members and others in these situations currently are allowed under
state law and covered entities' own rules, Sec. 164.510(b) allows
covered entities to continue making them in these situations,
consistent with the exercise of professional judgement as to the
patient's best interest. As indicated in the preamble above, this
section is not intended to provide a loophole for avoiding the rule's
other requirements, and it is not intended to allow disclosures to a
broad range of individuals, such as journalists who may be curious
about a celebrity's health status.
    Comments: A few comments supported the NPRM approach because it
permitted the current practice of allowing someone other than the
patient to pick up prescriptions at pharmacies. One commenter noted
that this practice occurs with respect to 25-40% of the prescriptions
dispensed by community retail pharmacies. These commenters strongly
supported the proposal's reliance on the professional judgement of
pharmacists in allowing others to pick up prescriptions for bedridden
or otherwise incapacitated patients, noting that in most cases it would
be impracticable to verify that the person was acting with the
individual's permission. Two commenters requested that the rule
specifically allow this practice. One comment opposed the practice of
giving prescriptions to another person without the individual's
authorization, because a prescription implicitly could disclose medical
information about the individual.
    Response: As stated in the NPRM, we intended for this provision to
authorize pharmacies to dispense prescriptions to family or friends who
are sent by the individual to the pharmacy to pick up the prescription.
We believe that stringent consent or verification requirements would
place an unreasonable burden on numerous transactions. In addition,
such requirements would be contrary to the expectations and preferences
of all parties to these transactions. Although prescriptions are
protected health information under the rule, we believe that the risk
to individual privacy in allowing this practice to continue is minimal.
We agree with the suggestion that the final rule should state
explicitly that pharmacies have the authority to operate in this
manner. Therefore, we have added a sentence to Sec. 164.510(b)(3)
allowing covered entities to use professional judgement and experience
with common practice to make reasonable inferences of an individual's
best interest in allowing a person to act on the individual's behalf to
pick up filled prescriptions, medical supplies, X-rays, or other
similar forms of protected health information. In such situations, as
when making disclosures of protected health information about an
individual who is not present or is unable to agree to such
disclosures, covered entities should disclose only information which
directly relates to the person's involvement in the individual's
current health care. Thus, when dispensing a prescription to a friend
who is picking it up on the patient's behalf, the pharmacist should not
disclose unrelated health information about medications that the
patient has taken in the past which could prove embarrassing to the
patient.
    Comment: We received a few comments that misunderstood the
provision as addressing disclosures related to deceased individuals.
    Response: We understand that use of the term next of kin in this
section may cause confusion. To promote clarity in the final rule, we
eliminate the term ``next of kin,'' as well as the term's proposed
definition. In the final rule, we address comments on next of kin and
the deceased in the section on disclosure of protected health
information about deceased individuals in Sec. 164.512(g).
    Comments: A number of commenters expressed concern for the
interaction of the proposed section with state laws. Some of these
comments interpreted the NPRM's use of the term next of kin as
referring to individuals with health care power of attorney and thus
they believed that the proposed rule's approach to next of kin was
inappropriately informal and in conflict with state law. Others noted
that some state laws did not allow health care information to be
disclosed to family or friends without consent or other authorization.
One commenter said that case law may be evolving toward imposing a more
affirmative duty on health care practitioners to inform next of kin in
a variety of circumstances. One commenter noted that state laws may not
define clearly who is considered to be the next of kin.
    Response: The intent of this provision was not to interfere with or
change current practice regarding health care powers of attorney or the
designation of other personal representatives. Such designations are
formal, legal actions which give others the ability to exercise the
rights of or make treatment decisions related to individuals. While
persons with health care powers of attorney could have access to
protected health information under the personal representatives
provision (Sec. 164.502(g)), and covered entities may disclose to such
persons under this provision, such disclosures do not give these
individuals substantive authority to act for or on behalf of the
individual with respect to health care decisions. State law
requirements regarding health care powers of attorney continue to
apply.
    The comments suggesting that state laws may not allow the
disclosures otherwise permitted by this provision or, conversely, that
they may impose a more affirmative duty, did not provide any specifics
with which to judge the affect of such laws. In general, however, state
laws that are more protective of an individual's privacy interests than
the rule by prohibiting a disclosure of protected health information
continue to apply. The rule's provisions regarding disclosure of
protected health information to family or friends of the individual are
permissive only, enabling covered entities to abide by more stringent
state laws without violating our rules. Furthermore, if the state law
creates an affirmative and binding legal obligation on the covered
entity to make disclosures to family or other persons under specific
circumstances, the final rule allows covered entities to comply

[[Page 82665]]

with these legal obligations. See Sec. 164.512(a).
    Comments: A number of commenters supported the proposal to limit
disclosures to family or friends to the protected health information
that is directly relevant to that person's involvement in the
individual's health care. Some comments suggested that this standard
apply to all disclosures to family or friends, even when the individual
has agreed to or not objected to the disclosure. One commenter objected
to the proposal, stating that it would be too difficult to administer.
According to this comment, it is accepted practice for health care
providers to communicate with family and friends about an individual's
condition, regardless of whether the person is responsible for or
otherwise involved in the individual's care.
    Other comments expressed concern for disclosures related to
particular types of information. For example, two commenters
recommended that psychotherapy notes not be disclosed without patient
authorization. One commenter suggested that certain sensitive medical
information associated with social stigma not be disclosed to family
members or others without patient consent.
    Response: We agree with commenters who advocated limiting
permissible disclosures to relatives and close personal friends to
information consistent with a person's involvement in the individual's
care. Under the final rule, we clarify the NPRM provision to state that
covered entities may disclose protected health information to family
members, relatives, or close personal friends of an individual or any
other person identified by the individual, to the extent that the
information directly relates to the person's involvement in the
individual's current health care. It is not intended to allow
disclosure of past medical history that is not relevant to the
individual's current condition. In addition, as discussed above, we do
not intend to disrupt covered entities' current practices with respect
to disclosing specific information about a patient's condition to
family members or others when the individual is incapacitated due to a
medical emergency and the family member or other individual comes to
the covered entity seeking specific information about the patient's
condition. For example, this section allows a hospital to disclose to a
family member the fact that a patient had a heart attack, and to
provide updated information to the family member about the patient's
progress and prognosis during his or her period of incapacity.
    We agree with the recommendation to require written authorization
for a disclosure of psychotherapy notes to family, close personal
friends, or others involved in the individual's care. As discussed
below, the final rule allows disclosure of psychotherapy notes without
authorization in a few limited circumstances; disclosure to individuals
involved in a person's care is not among those circumstances. See
Sec. 164.508 for a further discussion of the final rule's provisions
regarding disclosure of psychotherapy notes.
    We do not agree, however, with the suggestion to treat some medical
information as more sensitive than others. In most cases, individuals
will have the opportunity to prohibit or limit such disclosures. For
situations in which an individual is unable to do so, covered entities
may, in the exercise of professional judgement, determine whether the
disclosure is in the individual's best interests and, if so, disclose
only the protected health information that is directly relevant to the
person's involvement with the individual's health care.
    Comment: One commenter suggested that this provision should allow
disclosure of protected health information to the clergy and to the Red
Cross. The commenter noted that clergy have ethical obligations to
ensure confidentiality and that the Red Cross often notifies the next
of kin regarding an individual's condition in certain circumstances.
Another commenter recommended allowing disclosures to law enforcement
for the purpose of contacting the next of kin of individuals who have
been injured or killed. One commenter sought clarification that ``close
personal friend'' was intended to include domestic partners and same-
sex couples in committed relationships.
    Response: As discussed above, Sec. 164.510(a) allows covered health
care providers to disclose to clergy protected health information from
a health care facility's directory. Under Sec. 164.510(b), an
individual may identify any person, including clergy, as involved in
his or her care. This approach provides more flexibility than the
proposed rule would have provided.
    As discussed in the preamble of the final rule, this provision
allows disclosures to domestic partners and others in same-sex
relationships when such individuals are involved in an individual's
care or are the point of contact for notification in a disaster. We do
not intend to change current practices with respect to involvement of
others in an individual's treatment decisions; informal information-
sharing among persons involved; or the sharing of protected health
information during a disaster. As noted above, a power of attorney or
other legal relationship to an individual is not necessary for these
informal discussions about the individual for the purpose of assisting
in or providing a service related to the individual's care.
    We agree with the comments noting that the Red Cross and other
organizations may play an important role in locating and communicating
with the family about individuals injured or killed in an accident or
disaster situation. Therefore, the final rule includes new language, in
Sec. 164.510(b)(4), which allows covered entities to use or disclose
protected health information to a public or private entity authorized
by law or its charter to assist in disaster relief efforts, for the
purpose of coordinating with such entities to notify, or assist in the
notification of (including identifying or locating) a family member, an
individual's personal representative, or another person responsible for
the individual's care regarding the individual's location, general
condition, or death. The Red Cross is an example of a private entity
that may obtain protected health information pursuant to these
provisions. We recognize the role of the Red Cross and similar
organizations in disaster relief efforts, and we encourage cooperation
with these entities in notification efforts and other means of
assistance.
    Comment: One commenter recommended stating that individuals who are
mentally retarded and unable to agree to disclosures under this
provision do not, thereby, lose their access to further medical
treatment. This commenter also proposed stating that mentally retarded
individuals who are able to provide agreement have the right to control
the disclosure of their protected health information. The commenter
expressed concern that the parent, relative, or other person acting in
loco parentis may not have the individual's best interest in mind in
seeking or authorizing for the individual the disclosure of protected
health information.
    Response: The final rule regulates only uses and disclosures of
protected health information, not the delivery of health care. Under
the final rule's section on personal representatives (Sec. 164.502(g)),
a person with authority to make decisions about the health care of an
individual, under applicable law, may make decisions about the
protected health information of that individual, to the extent that the
protected health information is relevant to such person's
representation.

[[Page 82666]]

    In the final rule, Sec. 164.510(b) may apply to permit disclosures
to a person other than a personal representative. Under
Sec. 164.510(b), when an individual is present and has the capacity to
make his or her own decisions, a covered entity may disclose protected
health information only if the covered entity: (1) Obtains the
individual's agreement to disclose protected health information to the
third parties involved in the individual's care; (2) provides the
individual with an opportunity to object to such disclosure, and the
individual does not express an objection; or (3) reasonably infers from
the circumstances, based on the exercise of professional judgment, that
the individual does not object to the disclosure. These conditions
apply to disclosure of protected health information about individuals
with mental retardation as well as to disclosures about all other
individuals. Thus we do not believe it is necessary to include in this
section of the final rule any language specifically on persons with
mental retardation.
    Comments: A few commenters recommended that disclosures made in
good faith to the family or friends of the individual not be subject to
sanctions by the Secretary, even if the covered entity had not fully
complied with the requirements of this provision. One commenter
believed that a fear of sanction would make covered entities overly
cautious, such that they would not disclose protected health
information to domestic partners or others not recognized by law as
next of kin. Another commenter recommended that sanctions not be
imposed if the covered entity has proper policies in place and has
trained its staff appropriately. According to this commenter, the lack
of documentation of disclosures in a particular case or medical record
should not subject the entity to sanctions if the information was
disclosed in good faith.
    Response: We generally agree with commenters regarding disclosure
in good faith pursuant to this provision. As discussed above, the final
rule expands the scope of individuals to whom covered entities may
disclose protected health information pursuant to this section. In
addition, we delete the term next of kin, to avoid the appearance of
requiring any legal determination of a person's relationship in
situations involving informal disclosures. Similarly, consistent with
the informal nature of disclosures pursuant to this section, we do not
require covered entities to document such disclosures. If a covered
entity imposes its own documentation requirements and a particular
covered health care provider does not follow the entity's documentation
requirements, the disclosure is not a violation of this rule.
    Comments: The majority of comments on this provision were from
individuals and organizations concerned about domestic violence. Most
of these commenters wanted assurance that domestic violence would be a
consideration in any disclosure to the spouse or relatives of an
individual whom the covered entity suspected to be a victim of domestic
violence or abuse. In particular, these commenters recommended that
disclosures not be made to family members suspected of being the abuser
if to do so would further endanger the individual. Commenters believed
that this limitation was particularly important when the individual was
unconscious or otherwise unable to object to the disclosures.
    Response: We agree with the comments that victims of domestic
violence and other forms of abuse need special consideration in order
to avoid further harm, and we provide for discretion of a covered
entity to determine that protected health information not be disclosed
pursuant to Sec. 164.510(b). Section 164.510(b) of the final rule,
disclosures to family or friends involved in the individual's care,
states that when an individual is unable to agree or object to the
disclosure due to incapacity or another emergency situation, a covered
entity must determine based on the exercise of professional judgment
whether it is in the individual's best interest to disclose the
information. As stated in the preamble, we intend for this exercise of
professional judgment in the individual's best interest to account for
the potential for harm to the individual in cases involving domestic
violence. These circumstances are unique and are best decided by a
covered entity, in the exercise of professional judgment, in each
situation rather than by a blanket rule.

Section 164.512--Uses and Disclosures for Which Consent,
Authorization, or Opportunity to Agree or Object Is Not Required

Section 164.512(a)--Uses and Disclosures Required by Law

    Comment: Numerous commenters addressed directly or by implication
the question of whether the provision permitting uses and disclosures
of protected health information if required by other law was necessary.
Other commenters generally endorsed the need for such a provision. One
such commenter approved of the provision as a needed fail-safe
mechanism should the enumeration of permissible uses and disclosures of
protected health information in the NPRM prove to be incomplete. Other
commenters cited specific statutes which required access to protected
health information, arguing that such a provision was necessary to
ensure that these legally mandated disclosures would continue to be
permitted. For example, some commenters argued for continued access to
protected health information to investigate and remedy abuse and
neglect as currently required by the Developmental Disabilities
Assistance and Bill of Rights, 42 U.S.C. 6042, and the Protection and
Advocacy for Mentally Ill Individuals Act, 42 U.S.C. 10801.
    Some comments urged deletion of the provision for uses and
disclosures required by other law. This concern appeared to be based on
a generalized concern that the provision fostered government intrusion
into individual medical information.
    Finally, a number of commenters also urged that the required by law
provision be deleted. These commenters argued that the proposed
provision would have undermined the intent of the statute to preempt
state laws which were less protective of individual privacy. As stated
in these comments, the provision for uses and disclosures required by
other law was ``broadly written and could apply to a variety of state
laws that are contrary to the proposed rule and less protective of
privacy. (Indeed, a law requiring disclosure is the least protective of
privacy since it allows for no discretion.) The breadth of this
provision greatly exceeds the exceptions to preemption contained in
HIPAA.''
    Response: We agree with the comments that proposed Sec. 164.510(n)
was necessary to harmonize the rule with existing state and federal
laws mandating uses and disclosures of protected health information.
Therefore, in the final rule, the provision permitting uses and
disclosures as required by other law is retained. To accommodate other
reorganization of the final rule, this provision has been designated as
Sec. 164.512(a).
    We do not agree with the comments expressing concern for increased
governmental intrusion into individual privacy under this provision.
The final rule does not create any new duty or obligation to disclose
protected health information. Rather, it permits covered entities to
use or disclose protected health information when they are required by
law to do so.

[[Page 82667]]

    We likewise disagree with the characterization of the proposed
provision as inconsistent with or contrary to the preemption standards
in the statute or Part 160 of the rule. As described in the NPRM, we
intend this provision to preserve access to information considered
important enough by state or federal authorities to require its
disclosure by law.
    The importance of these required uses or disclosures is evidenced
by the legislative or other public process necessary for the government
to create a legally binding obligation on a covered entity.
Furthermore, such required uses and disclosures arise in a myriad of
other areas of law, ranging from topics addressing national security
(uses and disclosures to obtain security clearances), to public health
(reporting of communicable diseases), to law enforcement (disclosures
of gun shot wounds). Required uses and disclosures also may address
broad national concerns or particular regional or state concerns. It is
not possible, or appropriate, for HHS to reassess the legitimacy of or
the need for each of these mandates in each of their specialized
contexts. In some cases where particular concerns have been raised by
legal mandates in other laws, we allow disclosure as required by law,
and we establish additional requirements to protect privacy (for
example, informing the individual as required in Sec. 164.512(c)) when
covered entities make a legally mandated disclosure.
    We also disagree with commenters who suggest that the approach in
the final rule is contrary to the preemption provisions in HIPAA. HIPAA
provides HHS with broad discretion in fashioning privacy protections.
Recognizing the legitimacy of existing legal requirements is certainly
within the Secretary's discretion. Additionally, given the variety of
these laws, the varied contexts in which they arise, and their
significance in ensuring that important public policies are achieved,
we do not believe that Congress intended to preempt each such law
unless HHS specifically recognized the law or purpose in the
regulation.
    Comment: A number of commenters urged that the provision permitting
uses and disclosures required by other law be amended by deleting the
last sentence which stated: ``This paragraph does not apply to uses or
disclosures that are covered by paragraphs (b) through (m) of this
section.'' Some commenters sought deletion of this sentence to avoid
any inadvertent preemption of mandatory reporting laws, and requested
clarification of the effect on specific statutes.
    The majority of the commenters focused their concerns on the
potential conflict between mandatory reporting laws to law enforcement
and the limitations imposed by proposed Sec. 164.510(f), on uses and
disclosures to law enforcement. For example, the comments raised
concerns that mandatory reporting to law enforcement of injuries
resulting from violent acts and abuse require the health care provider
to initiate such reports to local law enforcement or other state
agencies, while the NPRM would have allowed such reporting on victims
of crimes only in response to specific law enforcement requests for
information. Similarly, mandatory reports of violence-related injuries
may implicate suspected perpetrators, as well as victims, and
compliance with such laws could be blocked by the proposed requirement
that disclosures about suspects was similarly limited to a response to
law enforcement inquiries for the specific purpose of identifying the
suspect. The NPRM also would have limited the type of protected health
information that could have been disclosed about a suspect or fugitive.
    In general, commenters sought to resolve this overlap by removing
the condition that the required-by-other-law provision applied only
when no other national priority purpose addressed the particular use or
disclosure. The suggested change would permit the covered entity to
comply with legally mandated uses and disclosures as long as the
relevant requirements of that law were met. Alternatively, other
commenters suggested that the restrictions on disclosures to law
enforcement be lifted to permit full compliance with laws requiring
reporting for these purposes.
    Finally, some comments sought clarification of when a use or
disclosure was ``covered by paragraphs (b) through (m).'' These
commenters were confused as to whether a particular use or disclosure
had to be specifically addressed by another provision of the rule or
simply within the scope of the one of the national priority purposes
specified by proposed paragraphs (b) through (m).
    Response: We agree with the commenters that the provision as
proposed would have inadvertently interfered with many state and
federal laws mandating the reporting to law enforcement or others of
protected health information.
    In response to these comments, we have modified the final rule to
clarify how this section interacts with the other provisions in the
rule.
    Comment: A number of commenters sought expanded authority to use
and disclosure protected health information when permitted by other
law, not just when required by law. These comments specified a number
of significant duties or potential societal benefits from disclosures
currently permitted or authorized by law, and they expressed concern
should these beneficial uses and disclosures no longer be allowed if
not specifically recognized by the rule. For example, one commenter
listed 25 disclosures of health records that are currently permitted,
but not required, by state law. This commenter was concerned that many
of these authorized uses and disclosures would not be covered by any of
the national priority purposes specified in the NPRM, and, therefore,
would not be a permissible use or disclosure under the rule. To
preserve these important uses and disclosures, the comments recommended
that provision be made for any use or disclosure which is authorized or
permitted by other law.
    Response: We do not agree with the comments that seek general
authority to use and disclose protected health information as
permitted, but not required, by other law. The uses and disclosures
permitted in the final rule reflect those purposes and circumstances
which we believe are of sufficient national importance or relevance to
the needs of the health care system to warrant the use or disclosure of
protected health information in the absence of either the individual's
express authorization or a legal duty to make such use or disclosure.
In permitting specific uses and disclosures that are not required by
law, we have considered the individual privacy interests at stake in
each area and crafted conditions or limitations in each identified area
as appropriate to balance the competing public purposes and individual
privacy needs. A general rule authorizing any use or disclosure that is
permitted, but not required, by other law would undermine the careful
balancing in the final rule.
    In making this judgment, we have distinguished between laws that
mandate uses or disclosures and laws that merely permit them. In the
former case, jurisdictions have determined that public policy purposes
cannot be achieved absent the use of certain protected health
information, and we have chosen in general not to disturb their
judgments. On the other hand, where jurisdictions have determined that
certain protected health information is not necessary to achieve

[[Page 82668]]

a public policy purpose, and only have permitted its use or disclosure,
we do not believe that those judgments reflect an interest in use or
disclosure strong enough to override the Congressional goal of
protecting privacy rights.
    Moreover, the comments failed to present any compelling
circumstance to warrant such a general provision. Despite commenters'
concerns to the contrary, most of the beneficial uses and disclosures
that the commenters referenced to support a general provision were, in
fact, uses or disclosures already permissible under the rule. For
example, the general statutory authorities relied on by one state
health agency to investigate disease outbreaks or to comply with health
data-gathering guidelines for reporting to certain federal agencies are
permissible disclosures to public health agencies.
    Finally, in the final rule, we add new provisions to Sec. 164.512
to address three examples raised by commenters of uses and disclosures
that are authorized or permitted by law, but may not be required by
law. First, commenters expressed concern for the states that provide
for voluntary reporting to law enforcement or state protective services
of domestic violence or of abuse, neglect or exploitation of the
elderly or other vulnerable adults. As discussed below, a new section,
Sec. 164.512(c), has been added to the final rule to specifically
address uses and disclosures of protected health information in cases
of abuse, neglect, or domestic violence. Second, commenters were
concerned about state or federal laws that permitted coordination and
cooperation with organizations or entities involved in cadaveric organ,
eye, or tissue donation and transplantation. In the final rule, we add
a new section, Sec. 164.512(h), to permit disclosures to facilitate
such donation and transplantation functions. Third, a number of
commenters expressed concern for uses and disclosure permitted by law
in certain custodial settings, such as those involving correctional or
detention facilities. In the final rule, we add a new subsection to the
section on uses and disclosures for specialized government functions,
Sec. 164.512(k), to identify custodial settings in which special rules
are necessary and to specify the additional uses and disclosures of the
protected health information of inmates or detainees which are
necessary in such facilities.
    Comment: A number of commenters asked for clarification of the term
``law'' and the phrase ``required by law'' for purposes of the
provision permitting uses or disclosures that are required by law. Some
of the commenters noted that ``state law'' was a defined term in Part
160 of the NPRM and that the terms should be used consistently. Other
commenters were concerned about differentiating between laws that
required a use or disclosure and those that merely authorize or permit
a use or disclosure. A number of commenters recommended that the final
rule include a definitive list of the laws that mandate a use or
disclosure of protected health information.
    Response: In the final rule, we clarify that, consistent with the
``state law'' definition in Sec. 160.202, ``law'' is intended to be
read broadly to include the full array of binding legal authority, such
as constitutions, statutes, rules, regulations, common law, or other
governmental actions having the effect of law. However, for the
purposes of Sec. 164.512(a), law is not limited to state action;
rather, it encompasses federal, state or local actions with legally
binding effect, as well as those by territorial and tribal governments.
    For more detail on the meaning of ``required by law,'' see
Sec. 164.501. Only where the law imposes a duty on the health care
professional to report would the disclosure be considered to be
required by law.
    The final rule does not include a definitive list of the laws that
contain legal mandates for disclosures of protected health information.
In light of the breadth of the term ``law'' and number of federal,
state, local, and territorial or tribal authorities that may engage in
the promulgation of binding legal authority, it would be impossible to
compile and maintain such a list. Covered entities have an independent
duty to be aware of their legal obligations to federal, state, local
and territorial or tribal authorities. The rule's approach is simply
intended to avoid any obstruction to the health plan or covered health
care provider's ability to comply with its existing legal obligations.
    Comment: A number of commenters recommended that the rule compel
covered entities to use or disclose protected health information as
required by law. They expressed concern that covered entities could
refuse or delay compliance with legally mandated disclosures by
misplaced reliance on a rule that permits, but does not require, a use
or disclosure required by other law.
    Response: We do not agree that the final rule should require
covered entities to comply with uses or disclosures of protected health
information mandated by law. The purpose of this rule is to protect
privacy, and to allow those disclosures consistent with sound public
policy. Consistent with this purpose, we mandate disclosure only to the
individual who is the subject of the information, and for purposes of
enforcing the rule. Where a law imposes a legal duty on the covered
entity to use or disclose protected health information, it is
sufficient that the privacy rule permit the covered entity to comply
with such law. The enforcement of that legal duty, however, is a matter
for that other law.

Section 164.512(b)--Uses and Disclosures for Public Health Activities

    Comment: Several non-profit entities commented that medical records
research by nonprofit entities to ensure public health goals, such as
disease-specific registries, would not have been covered by this
provision. These organizations collect information without relying on a
government agency or law. Commenters asserted that such activities are
essential and must continue. They generally supported the provisions
allowing the collection of individually identifiable health information
without authorization for registries. One stated that both governmental
and non-governmental cancer registries should be exempt from the
regulation. They stated that ``such entities, by their very nature,
collect health information for legitimate public health and research
purposes.'' Another, however, addressed its comments only to
``disclosure to non-government entities operating such system as
required or authorized by law.''
    Response: We acknowledge that such entities may be engaged in
disease-specific or other data collection activities that provide a
benefit to their members and others affected by a particular malady and
that they contribute to the public health and scientific database on
low incidence or little known conditions. However, in the absence of
some nexus to a government public health authority or other underlying
legal authority, it is unclear upon what basis covered entities can
determine which registries or collections are ``legitimate'' and how
the confidentiality of the registry information will be protected.
Commenters did not suggest methods for ``validating'' these private
registry programs, and no such methods currently exist at the federal
level. It is unknown whether any states have such a program. Broadening
the exemption could provide a loophole for private data collections for
inappropriate

[[Page 82669]]

purposes or uses under a ``public health'' mask.
    In this rule, we do not seek to make judgments as to the legitimacy
of private entities' disease-specific registries or of private data
collection endeavors. Rather, we establish the general terms and
conditions for disclosure and use of protected health information.
Under the final rule, covered entities may obtain authorization to
disclose protected health information to private entities seeking to
establish registries or other databases; they may disclose protected
health information as required by law; or they may disclose protected
health information to such entities if they meet the conditions of one
of the provisions of Secs. 164.510 or 164.512. We believe that the
circumstances under which covered entities may disclose protected
health information to private entities should be limited to specified
national priority purposes, as reflected through the FDA requirements
or directives listed in Sec. 164.512(b)(iii), and to enable recalls,
repairs, or replacements of products regulated by the FDA. Disclosures
by covered health care providers who are workforce members of an
employer or are conducting evaluations relating to work-related
injuries or illnesses or workplace surveillance also may disclose
protected health information to employers of findings of such
evaluations that are necessary for the employer to comply with
requirements under OSHA and related laws.
    Comment: Several commenters said that the NPRM did not indicate how
to distinguish between public health data collections and government
health data systems. They suggested eliminating proposed
Sec. 164.510(g) on disclosures and uses for government health data
systems, because they believed that such disclosures and uses were
adequately covered by proposed Sec. 164.510(b) on public health.
    Response: As discussed below, we agree with the commenters who
suggested that the proposed provision that would have permitted
disclosures to government health data bases was overly broad, and we
remove it from the final rule. We reviewed the important purposes for
which some commenters said government agencies needed protected health
information, and we believe that most of those needs can be met through
the other categories of permitted uses and disclosures without
authorization allowed under the final rule, including provisions
permitting covered entities to disclose information (subject to certain
limitations) to government agencies for public health, health
oversight, law enforcement, and otherwise as required by law. For
example, the final rule continues to allow collection of protected
health information without authorization to monitor trends in the
spread of infectious disease, morbidity and mortality.
    Comment: Several commenters recommended expanding the scope of
disclosures permissible under proposed Sec. 164.510(b)(1)(iii), which
would have allowed covered entities to disclose protected health
information to private entities that could demonstrate that they were
acting to comply with requirements, or at the direction, of a public
health authority. These commenters said that they needed to collect
individually identifiable health information in the process of drug and
device development, approval, and post-market surveillance--activities
that are related to, and necessary for, the FDA regulatory process.
However, they noted that the specific data collections involved were
not required by FDA regulations. Some commenters said that they often
devised their own data collection methods, and that health care
providers disclosed information to companies voluntarily for activities
such as post-marketing surveillance and efficacy surveys. Commenters
said they used this information to comply with FDA requirements such as
reporting adverse events, filing other reports, or recordkeeping.
Commenters indicated that the FDA encouraged but did not require them
to establish other data collection mechanisms, such as pregnancy
registries that track maternal exposure to drugs and the outcomes.
    Accordingly, several commenters recommended modifying proposed
Sec. 164.510(b) to allow covered entities to disclose protected health
information without authorization to manufacturers registered with the
FDA to manufacture, distribute, or sell a prescription drug, device, or
biological product, in connection with post-marketing safety and
efficacy surveillance or for the entity to obtain information about the
drug, device, or product or its use. One commenter suggested including
in the regulation an illustrative list of examples of FDA-related
requirements, and stating in the preamble that all activities taken in
furtherance of compliance with FDA regulations are ``public health
activities.''
    Response: We recognize that the FDA conducts or oversees many
activities that are critical to help ensure the safety or effectiveness
of the many products it regulates. These activities include, for
example, reporting of adverse events, product defects and problems;
product tracking; and post-marketing surveillance. In addition, we
believe that removing defective or harmful products from the market is
a critical national priority and is an important tool in FDA efforts to
promote the safety and efficacy of the products it regulates. We
understand that in most cases, the FDA lacks statutory authority to
require product recalls. We also recognize that the FDA typically does
not conduct recalls, repairs, or product replacement surveillance
directly, but rather, that it relies on the private entities it
regulates to collect data, notify patients when applicable, repair and
replace products, and undertake other activities to promote the safety
and effectiveness of FDA-regulated products.
    We believe, however, that modifying the NPRM to allow disclosure of
protected health information to private entities as part of any data-
gathering activity related to a drug, device, or biological product or
its use, or for any activity that is consistent with, or that appears
to promote objectives specified, in FDA regulation would represent an
inappropriately broad exception to the general requirement to obtain
authorization prior to disclosure. Such a change could allow, for
example, drug companies to collect protected health information without
authorization to use for the purpose of marketing pharmaceuticals. We
do not agree that all activities taken to promote compliance with FDA
regulations represent public health activities as that term is defined
in this rule. In addition, we believe it would not be appropriate to
include in the regulation text an ``illustrative list'' of requirements
``related to'' the FDA. The regulation text and preamble list the FDA-
related activities for which we believe disclosure of protected health
information to private entities without authorization is warranted.
    We believe it is appropriate to allow disclosure of protected
health information without authorization to private entities only: For
purposes that the FDA has, in effect, identified as national priorities
by issuing regulations or express directions requiring such disclosure;
or if such disclosure is necessary for a product recall. For example,
we believe it is appropriate to allow covered health care providers to
disclose to a medical device manufacturer recalling defective heart
valves the names and last known addresses of patients in whom the
provider implanted the valves. Thus, in the final rule, we allow
covered entities to disclose protected health information to entities
subject to FDA jurisdiction for the following activities: To report
adverse events (or similar reports with

[[Page 82670]]

respect to food or dietary supplements), product defects or problems
(including problems with the use or labeling of a product), or
biological product deviations, if the disclosure is made to the person
required or directed to report such information to the FDA; to track
products if the disclosure is made to a person required or directed by
the FDA to track the product; to enable product recalls, repairs, or
replacement (including locating and notifying individuals who have
received products of product recalls, withdrawals, or other problems);
or to conduct post-marketing surveillance to comply with requirements
or at the direction of the FDA. The preamble above provides further
detail on the meaning of some of the terms in this list. Covered
entities may disclose protected health information to entities for
activities other than those described above only as required by law;
with authorization; or if permissible under another section of this
rule.
    We understand that many private registries, such as pregnancy
registries, currently obtain patient authorization for data collection.
We believe the approach of Sec. 164.512(b) strikes an appropriate
balance between the objective of promoting patient privacy and control
over their health information and the objective of allowing private
entities to collect data that ultimately may have important public
health benefits.
    Comment: One commenter remarked that our proposal may impede fetal/
infant mortality and child fatality reviews.
    Response: The final rule permits a covered entity to disclose
protected health information to a public health authority authorized by
law to conduct public health activities, including the collection of
data relevant to death or disease, in accordance with Sec. 164.512(b).
Such activities may also meet the definition of ``health care
operations.'' We therefore do not believe this rule impedes these
activities.
    Comment: Several comments requested that the final regulation
clarify that employers be permitted to use and/or disclose protected
health information pursuant to the requirements of the Occupational
Safety and Health Act and its accompanying regulations (``OSHA''). A
few comments asserted that the regulation should not only permit
employers to use and disclose protected health information without
first obtaining an authorization consistent with OSHA requirements, but
also permit them to use and disclose protected health information if
the use or disclosure is consistent with the spirit of OSHA. One
commenter supported the permissibility of these types of uses and
disclosures, but warned that the regulation should not grant employers
unfettered access to the entire medical record of employees for the
purpose of meeting OSHA requirements. Other commenters noted that OSHA
not only requires disclosures to the Occupational Safety and Health
Administration, but also to third parties, such as employers and
employee representatives. Thus, this comment asked HHS to clarify that
disclosures to third parties required by OSHA are also permissible
under the regulation.
    Response: Employers as such are not covered entities under HIPAA
and we generally do not have authority over their actions. When an
employer has a health care component, such as an on-site medical
clinic, and the components meets the requirements of a covered health
care provider, health plan or health care clearinghouse, the uses and
disclosures of protected health information by the health care
component, including disclosures to the larger employer entity, are
covered by this rule and must comply with its provisions.
    A covered entity, including a covered health care provider, may
disclose protected health information to OSHA under Sec. 164.512(a), if
the disclosure is required by law, or if the disclosure is a
discretionary one for public health activities, under Sec. 164.512(b).
Employers may also request employees to provide authorization for the
employer to obtain protected health information from covered entities
to conduct analyses of work-related health issues. See Sec. 164.508.
    We also permit covered health care providers who provide health
care as a workforce member of an employer or at the request of an
employer to disclose protected health information to the employer
concerning work-related injuries or illnesses or workplace medical
surveillance in situations where the employer has a duty to keep
records on or act on such information under the OSHA or similar laws.
We added this provision to ensure that employers are able to obtain the
information that they need to meet federal and state laws designed to
promote safer and healthier workplaces. These laws are vital to
protecting the health and safety of workers and we permit specified
covered health care providers to disclose protected health information
as necessary to carry out these purposes.
    Comment: A few comments suggested that the final regulation clarify
how it would interact with existing and pending OSHA requirements. One
of these comments requested that the Secretary delay the effective date
of the regulation until reviews of existing requirements are complete.
    Response: As noted in the ``Relationship to Other Federal Laws''
section of the preamble, we are not undertaking a complete review of
all existing laws with which covered entities might have to comply.
Instead we have described a general framework under which such laws may
be evaluated. We believe that adopting national standards to protect
the privacy of individually identifiable health information is an
urgent national priority. We do not believe that it is appropriate to
delay the effective date of this regulation.
    Comment: One commenter asserted that the proposed regulation
conflicted with the OSHA regulation requirement that when a designated
representative (to whom the employee has already provided a written
authorization to obtain access) requests a release form for access to
employee medical records, the form must include the purpose for which
the disclosure is sought, which the proposed privacy regulation does
not require.
    Response: We do not agree that this difference creates a conflict
for covered entities. If an employer seeks to obtain a valid
authorization under Sec. 164.508, it may add a purpose statement to the
authorization so that it complies with OSHA's requirements and is a
valid authorization under Sec. 164.508 upon which a covered entity may
rely to make a disclosure of protected health information to the
employer.
    Comment: One commenter stated that access to workplace medical
records by the occupational medical physicians is fundamental to
workplace and community health and safety. Access is necessary whether
it is a single location or multiple sites of the same company, such as
production facilities of a national company located throughout the
country.
    Response: We permit covered health care providers who provide
health care as a workforce member of an employer or at the request of
an employer to disclose protected health information to the employer
concerning work-related injuries or illnesses or workplace medical
surveillance, as described in this paragraph. Information obtained by
an employer under this paragraph would be available for it to use,
consistent with other laws and regulations, as it chooses and
throughout the national company. We do not regulate uses or disclosures
of individually identifiable health

[[Page 82671]]

information by employers acting as employers.

Section 164.512(c)--Disclosures About Victims of Abuse, Neglect, or
Domestic Violence

    The NPRM did not include a paragraph specifically addressing
covered entities' disclosures of protected health information regarding
victims of abuse, neglect, or domestic violence. Rather, the NPRM
addressed disclosures about child abuse pursuant to proposed
Sec. 164.510(b), which would have allowed covered entities to report
child abuse to a public health authority or to another appropriate
authority authorized by law to receive reports of child abuse or
neglect. We respond to comments regarding victims of domestic violence
or abuse throughout the final rule where relevant. (See responses to
comments on Secs. 164.502(g), 164.510(b), 164.512(f)(3), 164.522, and
164.524.)
    Comment: Several commenters urged us to require that victims of
domestic violence be notified about requests for or disclosures of
protected health information about them, so that victims could take
safety precautions.
    Response: We agree that, in balancing the burdens on covered
entities from such a notification requirement against the benefits to
be gained, victims of domestic abuse merit heightened concern. For this
reason, we generally require covered entities to inform the individual
when they disclose protected health information to authorized
government authorities. As the Family Violence Prevention Fund has
noted in its Health Privacy Principles for Protecting Victims of
Domestic Violence (October 2000), victims of domestic violence and
abuse sometimes are subject to retaliatory violence. By informing a
victim of abuse or domestic violence of a disclosure to law enforcement
or other authorities, covered entities give victims the opportunity to
take appropriate safety precautions. See the above preamble discussion
of Sec. 164.512(c) for more detail about the requirements for
disclosing protected health information about victims of domestic
violence.
    Comment: Some commenters argued that a consent requirement should
apply at a minimum to disclosures involving victims of crime or victims
of domestic violence.
    Response: We agree, and we modify the proposed rule to require
covered entities to obtain an individual's agreement prior to
disclosing protected health information in most instances involving
victims of a crime or of abuse, neglect, or domestic violence. See the
above preamble discussions of Sec. 164.512(c), on disclosures about
victims of abuse, neglect, or domestic violence, and
Sec. 164.512(f)(3), on disclosures to law enforcement about crime
victims.

Section 164.512(d)--Uses and Disclosures for Health Oversight
Activities

    Comment: A couple of commenters supported the NPRM's approach to
health oversight. Several other commenters generally supported the
NPRM's approach to disclosure of protected health information for
national priority purposes, and they recommended some clarification
regarding disclosure for health oversight. Two commenters recommended
clarifying in the final rule that disclosure is allowed to all federal,
state, and local agencies that use protected health information to
carry out legally mandated responsibilities.
    Response: The final rule permits disclosures to public agencies
that meet the definition of a health oversight agency and for oversight
of the particular areas described in the statute. Section 164.512(a) of
the final rule permits disclosures that are required by law. As
discussed in the responses to comments of Sec. 164.512(a), we do not in
the final rule permit disclosures merely authorized by other laws that
do not fit within the other public policy purposes recognized by the
rule.
    Comment: One commenter recommended clarifying in the final rule
that covered entities are not required to establish business partner
contracts with health oversight agencies or public health authorities
to release individually identifiable information to them for purposes
exempt from HIPAA and sanctioned by state law.
    Response: The final rule does not require covered entities to
establish business associate contracts with health oversight agencies
when they disclose protected health information to these agencies for
oversight purposes.
    Comment: Two commenters recommended clarifying in the regulation
text that the health oversight section does not create a new right of
access to protected health information.
    Response: We agree and include such a statement in the preamble of
Sec. 164.512(d) of the final rule.
    Comment: Several commenters were concerned that the proposed
oversight section allowed but did not require disclosure of protected
health information to health oversight agencies for oversight
activities.
    Response: This rule's purpose is to protect the privacy of
individually identifiable health information. Except to enforce the
rule and to establish individuals' right to access their own protected
health information (see Sec. 164.502(a)(2)), we do not require
disclosure of protected health information to any person or entity. We
allow such disclosure for situations in which other laws require
disclosure.
    Comment: Some commenters were concerned that the NPRM would have
allowed health oversight agencies to re-use and redisclose protected
health information to other entities, and they were particularly
concerned about re-disclosure to and re-use by law enforcement
agencies. One commenter believed that government agencies would use the
label of health oversight to gain access to protected health
information from covered entities--thereby avoiding the procedural
requirements of the law enforcement section (proposed Sec. 164.510(f))
and subsequently would turn over information to law enforcement
officials. Thus, these groups were concerned that the potential for
oversight access to protected health information under the rule to
become the ``back door'' to law enforcement access to such information.
    Based on their concerns, these commenters recommended establishing
a general prohibition on the re-use and re-disclosure of protected
health information obtained by health oversight agencies in actions
against individuals. One health plan expressed general concern about
re-disclosure among all of the public agencies covered in the proposed
Sec. 164.510. It recommended building safeguards into the rule to
prevent information gathered for one purpose (for example, public
health) from being used for another purpose (such as health oversight).
    Many of the commenters concerned about re-disclosure of protected
health information obtained for oversight purposes said that if the
Secretary lacked statutory authority to regulate oversight agencies'
re-disclosure of protected health information and the re-use of this
information by other agencies covered in proposed Sec. 164.510, the
President should issue an Executive Order barring such re-disclosure
and re-use. One of these groups specified that the Executive Order
should bar re-use and re-disclosure of protected health information in
actions against individuals.
    In contrast, some commenters advocated information-sharing between
law enforcement and oversight agencies. Most of these commenters
recognized that the NPRM would have allowed re-use and re-disclosure of
protected health information from oversight to law

[[Page 82672]]

enforcement agencies, and they supported this approach.
    Response: We believe that the language we have added to the rule,
at Sec. 164.512(d)(2) and the corresponding explanation in the
preamble, to clarify the boundary between disclosures for health
oversight and for law enforcement purposes should partially address the
concern expressed by some that oversight agencies will be the back door
for access by law enforcement. In situations when the individual is the
subject of an investigation or activity and the investigation or
activity is not related to health care fraud, the requirements for
disclosure to law enforcement must be met, and an oversight agency
cannot request the information under its more general oversight
authority.
    We acknowledge, however, that there will be instances under the
rule when a health oversight agency (or a law enforcement agency in its
oversight capacity) that has obtained protected health information
appropriately will be able to redisclose the information to a law
enforcement agency for law enforcement purposes. Under HIPAA, we have
the authority to restrict re-disclosure of protected health information
only by covered entities. Re-disclosures by public agencies such as
oversight agencies are not within the purview of this rule. We support
the enactment of comprehensive privacy legislation that would govern
such public agencies' re-use and re-disclosure of this information.
Furthermore, in an effort to prevent health oversight provisions from
becoming the back door to law enforcement access to protected health
information, the President is issuing an Executive Order that places
strict limitations on the use of protected health information gathered
in the course of an oversight investigation for law enforcement
activities. For example, such use will be subject to review by the
Deputy Attorney General.
    Comment: Several commenters recommended modifying the proposed
oversight section to require health oversight officials to justify and
document their need for identifiable information.
    Response: We encourage covered entities to work with health
oversight agencies to determine the scope of information needed for
health oversight inquiries. However, we believe that requiring covered
entities to obtain extensive documentation of health oversight
information needs could compromise health oversight agencies' ability
to complete investigations, particularly when an oversight agency is
investigating the covered entity from which it is seeking information.
    Comment: Several commenters believed that health oversight
activities could be conducted without access to individually
identifiable health information. Some of these groups recommended
requiring information provided to health oversight agencies to be de-
identified to the extent possible.
    Response: We encourage health oversight agencies to use de-
identified information whenever possible to complete their
investigations. We recognize, however, that in some cases, health
oversight agencies need identifiable information to complete their
investigations. For example, as noted in the preamble to the NPRM, to
determine whether a hospital has engaged in fraudulent billing
practices, it may be necessary to examine billing records for a set of
individual cases. Similarly, to determine whether a health plan is
complying with federal or state health care quality standards, it may
be necessary to examine individually identifiable health information in
comparison with such standards. Thus, to allow health oversight
agencies to conduct the activities that are central to their mission,
the final rule does not require covered entities to de-identify
protected health information before disclosing it to health oversight
organizations.
    Comment: One commenter recommended requiring whistleblowers,
pursuant to proposed Sec. 164.518(a)(4) of the NPRM, to raise the issue
of a possible violation of law with the affected covered entity before
disclosing such information to an oversight agency, attorney, or law
enforcement official.
    Response: We believe that such a requirement would be
inappropriate, because it would create the potential for covered
entities that are the subject of whistleblowing to take action to evade
law enforcement and oversight action.
    Comment: One commenter recommended providing an exemption from the
proposed rule's requirements for accounting for disclosures when such
disclosures were for health oversight purposes.
    Response: We recognize that in some cases, informing individuals
that their protected health information has been disclosed to a law
enforcement official or to a health oversight agency could compromise
the ability of law enforcement and oversight officials to perform their
duties appropriately. Therefore, in the final rule, we retain the
approach of proposed Sec. 164.515 of the NPRM. Section 164.528(a)(2) of
the final rule states that an individual's right to receive an
accounting of disclosures to a health oversight agency, law enforcement
official, or for national security or intelligence purposes may be
temporarily suspended for the time specified by the agency or official.
As described in Sec. 164.528(a)(2), for such a suspension to occur, the
agency or official must provide the affected covered entity with a
written request stating that an accounting to the individual would be
reasonably likely to impede the agency's activity. The request must
specify the time for which the suspension is required. We believe that
providing a permanent exemption to the right to accounting for
disclosures for health oversight purposes would fail to ensure that
individuals are sufficiently informed about the extent of disclosures
of their protected health information.
    Comment: One commenter recommended making disclosures to health
oversight agencies subject to a modified version of the NPRM's proposed
three-part test governing disclosure of protected health information to
law enforcement pursuant to an administrative request (as described in
proposed Sec. 164.510(f)(1)).
    Response: We disagree that it would be appropriate to apply the
procedural requirements for law enforcement to health oversight. We
apply more extensive procedural requirements to law enforcement
disclosures than to disclosures for health oversight because we believe
that law enforcement investigations more often involve situations in
which the individual is the subject of the investigation (and thus
could suffer adverse consequences), and we believe that it is
appropriate to provide greater protection to individuals in such cases.
Health oversight involves investigations of institutions that use
health information as part of business functions, or of individuals
whose health information has been used to obtain a public benefit.
These circumstances justify broader access to information.

Overlap Between Law Enforcement and Oversight

    Comment: Some commenters expressed concern that the NPRM's
provisions permitting disclosures for health oversight and disclosures
for law enforcement overlapped, and that the overlap could create
confusion among covered entities, members of the public, and government
agencies. The commenters identified particular factors that could lead
to confusion, including that (1) the phrase ``criminal, civil, or
administrative proceeding'' appeared in the definitions of both law
enforcement

[[Page 82673]]

and oversight; (2) the examples of oversight agencies listed in the
preamble included a number of organizations that also conduct law
enforcement activities; (3) the NPRM addressed the issue of disclosures
to investigate health care fraud in the law enforcement section
(Sec. 164.510(f)(5)), yet health care fraud investigations are central
to the mission of some health care oversight agencies; (4) the NPRM
established more stringent rules for disclosure of protected health
information pursuant to an administrative subpoena issued for law
enforcement than for disclosure pursuant to an oversight agency's
administrative subpoena; and (5) the preamble, but not the NPRM
regulation text, indicated that agencies conducting both oversight and
law enforcement activities would be subject to the oversight
requirements when conducting oversight activities.
    Some commenters said that covered entities would be confused by the
overlap between law enforcement and oversight and that this concern
would lead to litigation over which rules should apply when an entity
engaged in more than one of the activities listed under the exceptions
in proposed Sec. 164.510. Other commenters believed that covered
entities could manipulate the NPRM's ambiguities in their favor, claim
that the more stringent law enforcement disclosure rules always should
apply, and thereby delay investigations. A few comments suggested that
the confusion could be clarified by making the regulation text
consistent with the preamble, by stating that when agencies conducting
both law enforcement and oversight seek protected health information as
part of their oversight activities, the oversight rules would apply.
    Response: We agree that the boundary between disclosures for health
oversight and disclosures for law enforcement proposed in the NPRM
could have been more clear. Because many investigations, particularly
investigations involving public benefit programs, have both health
oversight and law enforcement aspects to them, and because the same
agencies often perform both functions, drawing any distinction between
the two functions is necessarily difficult. For example, traditional
law enforcement agencies, such as the Federal Bureau of Investigation,
have a significant role in health oversight. At the same time,
traditional health oversight agencies, such as federal Offices of
Inspectors General, often participate in criminal investigations.
    To clarify the boundary between law enforcement and oversight for
purposes of complying with this rule, we add new language in the final
rule, at Sec. 164.512(d)(2). This section indicates that health
oversight activities do not include an investigation or activity in
which the individual is the subject of the investigation or activity
and the investigation or activity does not arise out of and is not
directly related to health care fraud. In this rule, we describe
investigations involving suspected health care fraud as investigations
related to: (1) The receipt of health care; (2) a claim for public
benefits related to health; or (3) qualification for, or receipt of
public benefits or services where a patient's health is integral to the
claim for public benefits or services. In such cases, where the
individual is the subject of the investigation and the investigation
does not relate to health care fraud, identified as investigations
regarding issues (a) through (c), the rules regarding disclosure for
law enforcement purposes (see Sec. 164.512(f)) apply.
    Where the individual is not the subject of the activity or
investigation, or where the investigation or activity relates to health
care fraud, a covered entity may make a disclosure pursuant to
Sec. 164.512(d)(1), allowing uses and disclosures for health oversight
activities. For example, when the U.S. Department of Labor's Pension
and Welfare Benefits Administration (PWBA) needs to analyze protected
health information about health plan enrollees in order to conduct an
audit or investigation of the health plan (i.e., the enrollees are not
subjects of the investigation) to investigate potential fraud by the
health plan, the health plan may disclose protected health information
to the PWBA under the health oversight rules.
    To clarify further that health oversight disclosure rules apply
generally in health care fraud investigations (subject to the exception
described above), in the final rule, we eliminate proposed
Sec. 164.510(f)(5)(i), which would have established requirements for
disclosure related to health fraud for law enforcement purposes. All
disclosures of protected health information that would have been
permitted under proposed Sec. 164.510(f)(5)(i) are permitted under
Sec. 164.512(d).
    We also recognize that sections 201 and 202 of HIPAA, which
established a federal Fraud and Abuse Control Program and the Medicare
Integrity Program, identified health care fraud-fighting as a critical
national priority. Accordingly, under the final rule, in joint law
enforcement/oversight investigations involving suspected health care
fraud, the health oversight disclosures apply, even if the individual
also is the subject of the investigation.
    We also recognize that in some cases, health oversight agencies may
conduct joint investigations with other oversight agencies involved in
investigating claims for benefits unrelated to health. For example, in
some cases, a state Medicaid agency may be working with officials of
the Food Stamps program to investigate suspected fraud involving
Medicaid and Food Stamps. While this issue was not raised specifically
in the comments, we add new language (Sec. 164.512(d)(3)) to provide
guidance to covered entities in such situations. Specifically, we
clarify that if a health oversight investigation is conducted in
conjunction with an oversight activity related to a claim for benefits
unrelated to health, the joint activity or investigation is considered
health oversight for purposes of the rule, and the covered entities may
disclose protected health information pursuant to the health oversight
provisions.
    Comment: An individual commenter recommended requiring
authorization for disclosure of patient records in fraud
investigations, unless the individual was the subject or target of the
investigation. This commenter recommended requiring a search warrant
for cases in which the individual was the subject and stating that
fraud investigators should have access to the minimum necessary patient
information.
    Response: As described above, we recognize that in some cases,
activities include elements of both law enforcement and health
oversight. Because we consider both of these activities to be critical
national priorities, we do not require covered entities to obtain
authorization for disclosure of protected health information to law
enforcement or health oversight agencies--including those oversight
activities related to health care fraud. We believe that investigations
involving health care fraud represent health oversight rather than law
enforcement. Accordingly, as indicated above, we remove proposed
Sec. 164.510(f)(5)(i) from the law enforcement section of the proposed
rule and clarify that all disclosures of protected health information
for health oversight are permissible without authorization. As
discussed in greater detail in Sec. 164.514, the final rule's minimum
necessary standard applies to disclosures under Sec. 164.512 unless the
disclosure is required by law under Sec. 164.512(a).

[[Page 82674]]

    Comment: A large number of commenters expressed concern about the
potential for health oversight agencies to become, in effect, the
``back door'' for law enforcement access to such information. The
commenters suggested that health oversight agencies could use their
relatively unencumbered access to protected health information to
circumvent the more stringent process requirements that otherwise would
apply to disclosures for law enforcement purposes. These commenters
urged us to prohibit health oversight agencies from re-disclosing
protected health information to law enforcement.
    Response: As indicated above, we do not intend for the rule's
permissive approach to health oversight or the absence of specific
documentation to permit the government to gather large amounts of
protected health information for purposes unrelated to health oversight
as defined in the rule, and we do not intend for these oversight
provisions to serve as a ``back door'' for law enforcement access to
protected health information. While we do not have the statutory
authority to regulate law enforcement and oversight agencies' re-use
and re-disclosure of protected health information, we strongly support
enactment of comprehensive privacy legislation that would govern public
agencies' re-use and re-disclosure of this information. Furthermore, in
an effort to prevent health oversight provisions from becoming the back
door to law enforcement access to protected health information, the
President is issuing an Executive Order that places strict limitations
on the use of protected health information gathered in the course of an
oversight investigation for law enforcement activities.
    Comment: One commenter asked us to allow the requesting agency to
decide whether a particular request for protected health information
was for law enforcement or oversight purposes.
    Response: As described above, we clarify the overlap between law
enforcement disclosures and health oversight disclosures based on the
privacy and liberty interests of the individual (whether the individual
also is the subject of the official inquiry) and the nature of the
public interest (whether the inquiry relates to health care fraud or to
another potential violation of law). We believe it is more appropriate
to establish these criteria than to leave the decision to the
discretion of an agency that has a stake in the outcome of the
investigation.

Section 164.512(e)--Disclosures for Judicial and Administrative
Proceedings

    Comment: A few commenters suggested that the final rule not permit
disclosures without an authorization for judicial and administrative
proceedings.
    Response: We disagree. Protected health information is necessary
for a variety of reasons in judicial and administrative proceedings.
Often it may be critical evidence that may or may not be about a party.
Requiring an authorization for all such disclosures would severely
impede the review of legal and administrative claims. Thus, we have
tried to balance the need for the information with the individual's
privacy. We believe the approach described above provides individuals
with the opportunity to object to disclosures and provides a mechanism
through which their privacy interests are taken into account.
    Comment: A few commenters sought clarification about the
interaction between permissible disclosures for judicial and
administrative proceedings, law enforcement, and health oversight.
    Response: In the final rule, we state that the provision permitting
disclosures without an authorization for judicial and administrative
proceedings does not supersede other provisions in Sec. 164.512 that
would otherwise permit or restrict the use or disclosure of protected
health information. Additionally, in the descriptive preamble of
Sec. 164.512, we provide further explanation of how these provisions
relate to one another.
    Comments: Many commenters urged the Secretary to revise the rule to
state that it does not preempt or supersede existing rules and statutes
governing judicial proceedings, including rules of evidence, procedure,
and discovery. One commenter asserted that dishonest health care
providers and others should not be able to withhold their records by
arguing that state subpoena and criminal discovery statutes compelling
disclosure are preempted by the privacy regulation. Other commenters
maintained that there is no need to replace providers' current
practice, which typically requires either a signed authorization from
the patient or a subpoena to release medical information.
    Response: These comments are similar to many of the more general
preemption comments we received. For a full discussion of the
Secretary's response on preemption issues, see part 160--subpart B.
    Comment: One commenter stated that the proposed rule creates a
conflict with existing rules and statutes governing judicial
proceedings, including rules of evidence and discovery. This commenter
stated that the rule runs afoul of state judicial procedures for
enforcement of subpoenas that require judicial involvement only when a
party seeks to enforce a subpoena.
    Response: We disagree with this comment. The final rule permits
covered entities to disclose protected health information for any
judicial or administrative procedure in response to a subpoena,
discovery request, or other lawful process if the covered entity has
received satisfactory assurances that the party seeking the disclosure
has made reasonable efforts to ensure that the individual has been
given notice of the request or has made reasonable efforts to secure a
qualified protective order from a court or administrative tribunal. A
covered entity may disclose protected health information in response to
a subpoena, discovery request, or other lawful process without a
satisfactory assurance if it has made reasonable efforts to provide the
individual with such notice or to seek a qualified protected order
itself. These rules do not require covered entities or parties seeking
the disclosure of protected health information to involve the
judiciary; they may choose the notification option rather than seeking
a qualified protective order.
    Many states have already enacted laws that incorporate these
concepts. In California, for instance, an individual must be given ten
days notice that his or her medical records are being subpoenaed from a
health care provider and state law requires that the party seeking the
records furnishes the health care provider with proof that the notice
was given to the individual. In Montana, a party seeking discovery or
compulsory process of medical records must give notice to the
individual at least ten days in advance of serving the request on a
health care provider, Service of the request must be accompanied by
written certification that the procedure has been followed. In Rhode
Island, an individual must be given notice that his or her medical
records are being subpoenaed and notice of his or her right to object.
The party serving the subpoena on the health care provider must provide
written certification to the provider that: (1) This procedure has been
followed, (2) twenty days have passed from the date of service, and (3)
no challenge has been made to the disclosure or the court has ordered
disclosure after resolution of a legal court challenge. In Washington,
an individual must be given at least fourteen days from the date of
service of notice that his or her health information is the subject of
a

[[Page 82675]]

discovery request or compulsory process to obtain a protective order.
The notice must identify the health care provider from whom the
information is sought, specify the health care information that is
sought, and the date by which a protective order must be obtained in
order to prevent the provider from disclosing the information.
    Comment: A few commenters expressed concern that the rule would
place unnecessary additional burdens on health care providers because
when they receive a request for disclosure in connection with an
administrative or judicial procedure, they would have to determine
whether the litigant's health was at issue before they made the
disclosure. A number of commenters complained that this requirement
would make it too easy for litigants to obtain protected health
information. One commenter argued that litigants should not be able to
circumvent state evidentiary rules that would otherwise govern
disclosure of protected health information simply upon counsel's
statement that the other party's medical condition or history is at
issue.
    Other commenters, however, urged that disclosure without
authorization should be permitted whenever a patient places his or her
medical condition or history at issue and recommended requiring the
request for information to include a certification to this effect. Only
if another party to litigation has raised a medical question, do these
commenters believe a court order should be required. Similarly, one
commenter supported a general requirement that disclosure without
authorization be permitted only with a court order unless the patient
has placed his or her physical or mental condition at issue.
    Response: We agree with the concerns expressed by several
commenters about this provision and have eliminated this requirement
from the final rule.
    Comment: A number of commenters stated that the proposed rule
should be modified to permit disclosure without authorization pursuant
to a lawful subpoena. One commenter argued that the provision would
limit the scope of the Inspector General's subpoena power for judicial
and administrative proceedings to information concerning a litigant
whose health condition or history is at issue, and would impose a
requirement that the Inspector General provide a written certification
to that effect. Other commenters stated that the proposed rule would
seriously impair the ability of state agencies to conduct
administrative hearings on physician licensing and disciplinary
matters. These commenters stated that current practice is to obtain
information using subpoenas.
    Other commenters argued that disclosure of protected health
information for judicial and administrative proceedings should require
a court order and/or judicial review unless the subject of the
information consents to disclosure. These commenters believed that an
attorney's certification should not be considered sufficient authority
to override an individual's privacy, and that the proposed rule made it
too easy for a party to litigation to obtain information about the
other party.
    Response: As a general matter, we agree with these comments. As
noted, the final rule deletes the provision that would permit a covered
entity to disclose protected health information pursuant to an
attorney's certification that the individual is a party to the
litigation and has put his or her medical condition at issue. Under the
final rule, covered entities may disclose protected health information
in response to a court or administrative order, provided that only the
protected health information expressly authorized by the order is
disclosed. Covered entities may also disclose protected health
information in response to a subpoena, discovery request, or other
lawful process without a court order, but only if the covered entity
receives satisfactory assurances that the party seeking disclosure has
made reasonable efforts to ensure that the individual has been notified
of the request or that reasonable efforts have been made by the party
seeking the information to secure a qualified protective order.
Additionally, a covered entity may disclose protected health
information in response to a subpoena, discovery request, or other
lawful process without a satisfactory assurance if it makes reasonable
efforts to provide the individual with such notice or to seek a
qualified protected order itself.
    We also note that the final rule specifically provides that nothing
in Subchapter C should be construed to diminish the authority of any
Inspector General, including authority provided in the Inspector
General Act of 1978.
    Comment: A number of commenters expressed concern that the proposed
rule would not permit covered entities to introduce material evidence
in proceedings in which, for example, the provisions of an insurance
contract are at issue, or when a billing or payment issue is presented.
They noted that although the litigant may be the owner of an insurance
policy, he or she may not be the insured individual to whom the health
information pertains. In addition, they stated that the medical
condition or history of a deceased person may be at issue when the
deceased person is not a party.
    Response: We disagree. Under the final rule, a covered entity may
disclose protected health information without an authorization pursuant
to a court or administrative order. It may also disclose protected
health information with an authorization for judicial or administrative
proceedings in response to a subpoena, discovery request, or other
lawful process without a court order, if the party seeking the
disclosure provides the covered entity with satisfactory assurances
that it has made reasonable efforts to ensure that the individual has
been notified of the request or to seek a qualified protective order.
Additionally, a covered entity may disclose protected health
information in response to a subpoena, discovery request, or other
lawful process without a satisfactory assurance if it makes reasonable
efforts to provide the individual with such notice or to seek a
qualified protected order itself. Therefore, a party may obtain the
information even if the subject of the information is not a party to
the litigation or deceased.
    Comment: A few commenters argued that disclosure of protected
health information should be limited only to those cases in which the
individual has consented or a court order has been issued compelling
disclosure.
    Response: The Secretary believes that such an approach would impose
an unreasonable burden on covered entities and the judicial system and
that greater flexibility is necessary to assure that the judicial and
administrative systems function smoothly. We understand that even those
states that have enacted specific statutes to protect the privacy of
health information have not imposed requirements as strict as these
commenters would suggest.
    Comment: Many commenters asked that the final rule require the
notification of the disclosure be provided to the individual whose
health information is subject to disclosure prior to the disclosure as
part of a judicial or administrative proceeding. Most of these
commenters also asked that the rule require that the individual who is
the subject of a disclosure be given an opportunity to object to the
disclosure. A few commenters suggested that patients be given ten days
to object before requested information may be disclosed and recommend
that the rule require the requester to provide a certification that
notice has been provided and that ten days have passed

[[Page 82676]]

with no objection from the subject of the information. Some commenters
suggested that if a subpoena for disclosure is not accompanied by a
court order, the covered entities be prohibited from disclosing
protected health information unless the individual has been given
notice and an opportunity to object. Another commenter recommended
requiring, in most circumstances, notice and an opportunity to object
before a court order is issued and requiring the requestor of
information to provide a signed document attesting the date of
notification and forbid disclosure until ten days after notice is
given.
    Response: We agree that in some cases the provision of notice with
an opportunity to object to the disclosure is appropriate. Thus, in the
final rule we provide that a covered entity may disclose protected
health information in response to a subpoena, discovery request or
other lawful process that is not accompanied by a court order if it
receives satisfactory assurance from the party seeking the request that
the requesting party has made a good faith attempt to provide written
notice to the individual that includes sufficient information about the
litigation or proceeding to permit the individual to raise an objection
to the court or administrative tribunal and that the time for the
individual to raise objections has elapsed (and that none were filed or
all have been resolved). Covered entities may make reasonable efforts
to provide such notice as well.
    In certain instances, however, the final rule permits covered
entities to disclose protected health information for judicial and
administrative proceedings without notice to the individual if the
party seeking the request has made reasonable efforts to seek a
qualified protective order, as described in the rule. A covered entity
may also make reasonable efforts to seek a qualified protective order
in order to make the disclosure. Additionally, a covered entity may
disclose protected health information for judicial and administrative
proceedings in response to an order of a court or administrative
tribunal provided that the disclosure is limited to only that
information that is expressly authorized by the order. The Secretary
believes notice is not necessary in these instances because a court or
administrative tribunal is in the best position to evaluate the merits
of the arguments of the party seeking disclosure and the party who
seeks to block it before it issues the order and that imposing further
procedural obstacles before a covered entity may honor that disclosure
request is unnecessary.
    Comment: Many commenters urged the Secretary to require specific
criteria for court and administrative orders. Many of these commenters
proposed that a provision be added to the rule that would require court
and administrative orders to safeguard the disclosure and use of
protected health information. These commenters urged that the
information sought must be relevant and material, as specific and
narrowly drawn as reasonably practicable, and only disclosed if de-
identified information could not reasonably be used.
    Response: The Secretary's authority is limited to covered entities.
Therefore, we do not impose requirements on courts and administrative
tribunals. However, we note that the final rule limits the permitted
disclosures by covered entities in court or administrative proceedings
to only that information which is specified in the order from a court
or an administrative body should provide a degree of protection for
individuals from unnecessary disclosure.
    Comment: Several commenters asked that the ``minimum necessary''
standard not apply to disclosures made pursuant to a court order
because individuals could then use the rule to contest the scope of
discovery requests. However, many other commenters recommended that the
rule permit disclosure only of information ``reasonably necessary'' to
respond to a subpoena. These commenters raised concerns with applying
the ``minimum necessary'' standard in judicial and administrative
proceedings, but did not believe the holder of protected health
information should have blanket authority to disclose all protected
health information. Some of the commenters urged that disclosure of any
information about third parties that may be included in the medical
records of another person-- for example, the HIV status of a partner--
be prohibited. Finally, some commenters disagreed with the proposed
rule because it did not require covered entities to evaluate the
validity of subpoenas and discovery requests to determine whether these
requests ask for the ``minimum necessary'' or ``reasonably necessary''
amount of information.
    Response: Under the final rule, if the disclosure is pursuant to an
order of a court or administrative tribunal, covered entities may
disclose only the protected health information expressly authorized by
the order. In these instances, a covered entity is not required to make
a determination whether or not the order might otherwise meet the
minimum necessary requirement.
    If the disclosure is pursuant to a satisfactory assurance from the
party seeking the disclosure, at least a good faith attempt has been
made to notify the individual in writing of the disclosure before it is
made or the parties have sought a qualified protective order that
prohibits them from using or disclosing the protected health
information for any purpose other than the litigation or proceeding for
which the information was requested and that the information will be
returned to the covered entity or destroyed at the end of the
litigation or the proceeding. Alternatively, the covered entity may
seek such notice or qualified protective order itself. This approach
provides the individual with protections and places the burden on the
parties to resolve their differences about the appropriateness and
scope of disclosure as part of the judicial or administrative procedure
itself before the order is issued, rather than requiring the covered
entity to get involved in evaluating the merits of the dispute in order
to determine whether or not the particular request is appropriate or
too broad. In these cases, the covered entity must disclose only the
protected health information that is the minimum amount necessary to
achieve the purpose for which the information is sought.
    We share the concern of the commenters that covered entities should
redact any information about third parties before disclosing an
individual's protected health information. During the fact-finding
stage of our consideration of revisions to the proposed rule, we
discussed this issue with representatives of covered entities.
Currently, information about third parties is sometimes redacted by
medical records personnel responding to requests for information. In
particular, information regarding HIV status is treated with special
sensitivity by these professionals. Although we considered including a
special provision in the final rule prohibiting such disclosure, we
decided that the revisions made to the proposed rule would provide
sufficient protection. By restricting disclosure of protected health
information to only that information specified in a court or
administrative order or released pursuant to other types of lawful
process only if the individual had notice and an opportunity to object
or if the information was subject to a protective order, individuals
who are concerned about disclosure of information concerning third
parties will have the opportunity to raise that

[[Page 82677]]

issue prior to the request for disclosure being presented to the
covered entity. We are reluctant to put the covered entity in the
position of having to resolve disputes concerning the type of
information that may be disclosed when that dispute should more
appropriately be settled through the judicial or administrative
procedure itself.
    Comment: One commenter asked that the final regulation clarify that
a court order is not required when disclosure would otherwise be
permitted under the rule. This commenter noted that the preamble states
that the requirement for a court order would not apply if the
disclosure would otherwise be permitted under the rule. For example,
disclosures of protected health information pursuant to administrative,
civil, and criminal proceedings relating to ``health oversight'' are
permitted, even if no court or administrative orders have been issued.
However, the commenter was concerned that this principle only appeared
in the preamble and not in the rule itself.
    Response: Section 164.512(e)(4) of the final regulation contains
this clarification.
    Comment: One commenter was concerned that the rule is unclear as to
whether governmental entities are given a special right to ``use''
protected health information that private parties do not have under the
proposed regulation or whether governmental entities that seek or use
protected health information are treated the same as private parties in
their use of such information. This commenter urged that we clarify our
intent regarding the use of protected health information by
governmental entities.
    Response: Generally governmental entities are treated the same as
private entities under the rule. In a few clearly defined cases, a
special rule applies. For instance, under Sec. 164.504(e)(3), when a
covered entity and its business associate are both governmental
entities, they may enter into a memorandum of understanding or adopt a
regulation with the force and effect of law that incorporates the
requirements of a business associate contract, rather than having to
negotiate a business associate contract itself.
    Comment: One commenter recommended that final rule state that
information developed as part of a quality improvement or medical error
reduction program may not be disclosed under this provision. The
commenter explained that peer review information developed to identify
and correct systemic problems in delivery of care must be protected
from disclosure to allow a full discussion of the root causes of such
events so they may be identified and addressed. According to the
commenter, this is consistent with peer review protections afforded
this information by the states.
    Response: The question of whether or not such information should be
protected is currently the subject of debate in Congress and in the
states. It would be premature for us to adopt a position on this issue
until a clear consensus emerges. Under the final rule, no special
protection against disclosure is provided for peer review information
of the type the commenter describes. However, unless the request for
disclosure fits within one of the categories of permitted or required
disclosures under the regulation, it may not be disclosed. For
instance, if disclosure of peer review information is required by
another law (such as Medicare or a state law), covered entities subject
to that law may disclose protected health information consistent with
the law.
    Comment: One commenter stated that the requirements of this section
are in conflict with Medicare contractor current practices, as defined
by the HCFA Office of General Counsel and suggested that the final rule
include more specific guidelines.
    Response: Because the commenter failed to indicate the nature of
these conflicts, we are unable to respond.
    Comment: One commenter stated that the rule should require rather
than permit disclosure pursuant to court orders.
    Response: Under the statutory framework adopted by Congress in
HIPAA, a presumption is established that the data contained in an
individual's medical record belongs to the individual and must be
protected from disclosure to third parties. The only instance in which
covered entities holding that information must disclose it is if the
individual requests access to the information himself or herself. In
the final rule (as in the proposed rule), covered entities may use or
disclose protected health information under certain enumerated
circumstances, but are not required to do so. We do not believe that
this basic principle should be compromised merely because a court order
has been issued. Consistent with this principle, we provide covered
entities with the flexibility to deal with circumstances in which the
covered entity may have valid reasons for declining to release the
protected health information without violating this regulation.
    Comment: One commenter noted that in some states, public health
records are not subject to discovery, and that the proposed rule would
not permit disclosure of protected health information pursuant to court
order or subpoena if the disclosure is not allowed by state law. The
commenter requested clarification as to whether a subpoena in a federal
civil action would require disclosure if a state law prohibiting the
release of public health records existed.
    Response: As explained above, the final rule permits, but does not
require, disclosure of protected health information pursuant to a court
order. Under the applicable preemption provisions of HIPAA, state laws
relating to the privacy of medical information that are more stringent
than the federal rules are not preempted. To the extent that an
applicable state law precludes disclosure of protected health
information that would otherwise be permitted under the final rule,
state law governs.
    Comment: A number of commenters expressed concern that the proposed
rule would negatively impact state and federal benefits programs,
particularly social security and workers' compensation. One commenter
requested that the final rule remove any possible ambiguity about
application of the rule to the Social Security Administration's (SSA)
evidence requests by permitting disclosure to all administrative level
of benefit programs. In addition, several commenters stated that
requiring SSA or states to provide the covered entity holding the
protected health information with an individual's consent before it
could disclose the information would create a huge administrative and
paperwork burden with no added value to the individual. In addition,
several other commenters indicated that states that make disability
determinations for SSA also support special accommodation for SSA's
determination process. They expressed concern that providers will
narrowly interpret the HIPAA requirements, resulting in significant
increases in processing time and program costs for obtaining medical
evidence (especially purchased consultative examinations when evidence
of record cannot be obtained). A few commenters were especially
concerned about the impact on states and SSA if the final rule were to
eliminate the NPRM's provision for a broad consent for ``all evidence
from all sources.''
    Some commenters also note that it would be inappropriate for a
provider to make a minimum necessary determination in response to a
request from SSA because the provider usually will not know the legal
parameters of SSA's programs, or have access to the

[[Page 82678]]

individual's other sources of evidence. In addition, one commenter
urged the Secretary to be sensitive to these concerns about delay and
other negative impacts on the timely determination of disa