NRPM: Standards for Privacy of Individually Identifiable Health Information. 4. References to other laws.


The provisions we propose in this rule would interact with numerous other laws. For example, proposed § 164.510 provides standards for certain uses or disclosures that are permitted in this rule, and in some cases references activities that are authorized by other applicable law, such as federal, State, tribal or territorial laws. In cases where this rule references "law" or "applicable law" we intend to encompass all applicable laws, decisions, rules, regulations, administrative procedures or other actions having the effect of law. We do not intend to exclude any applicable legal requirements imposed by a governmental body authorized to regulate in a given area. Where particular types of law are at issue, such as in the proposed provisions for preemption of State laws in subpart B of part 160, or permitted disclosures related to the Armed Forces in § 164.510(m), we so indicate by referring to the particular type of law in question (e.g., "State law" or "federal law").

When we describe an action as "authorized by law," we mean that a legal basis exists for the activity. The phrase "authorized by law" is a term of art that includes both actions that are permitted and actions that are required by law. When we specifically discuss an action that is "required" or "mandated," we mean that a law compels (or conversely, prohibits) the performance of the activity in question. For example, in the health oversight context, disclosure of health information pursuant to a valid Inspector General subpoena, grand jury subpoena, civil investigative demand, or a statute or regulation requiring production of information justifying a claim would constitute a disclosure required by law.