NRPM: Standards for Privacy of Individually Identifiable Health Information. 2. Activities and Costs Associated with Compliance.


For a summary of the basic activities that a small entity would need to do to comply with this rule, please refer to section III of the preamble. This discussion summarizes some of the specific activities that covered entities must undertake to comply with the proposed rule’s provisions and options considered that would reduce the burden to small entities. In developing this proposed rule, we considered a variety of alternatives for minimizing the economic burden that it will create for small entities. We could not exempt small businesses from the entire proposed rule because they represent such a large and critical proportion of the health care industry (84 percent).

The guiding principle in our considerations of how to address the burden on small entities has been to make provisions scalable. To the extent possible, we have allowed for entities to determine how extensively they will address certain issues. This ability to adapt provisions to minimize burden has been addressed in earlier preamble language and will be briefly discussed again in the following section.

Before discussing specific provisions, it is important to note some of the broader questions that were addressed in formulating this proposed rule. We considered extending the compliance period for small entities but decided that because they represent such a large portion of the health care market, such an extension would be inappropriate. However, HIPAA does create an extended compliance time of 36 months for small plans. For all other time limit questions, we also considered giving small entities the same sort of extensions. For example, entities are required to either approve or deny a request to inspect and copy information within 20 days. We considered allowing small entities a longer response time. Rather than giving small entities extensions, we decided to establish time limits that we believe are reasonable for affected entities of all sizes, with the understanding that larger entities may not need as much time as they have been allocated in certain situations.

While we considered the needs of small entities during our discussions of provisions for this proposed rule, we are highlighting the most significant discussions in the following sections: