NRPM: Standards for Privacy of Individually Identifiable Health Information. g. Carve-out for State laws relating to oversight of health plans.


Section 1178(c) provides that nothing in part C of title XI limits the ability of States to require health plans “to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, facility licensure or certification, or individual licensure or certification.” This section thus also carves out an area in which the States have traditionally regulated health care as an area which the statute intends to leave in place. State laws requiring the reporting of or access to information of the type covered by section 1178(c) will in certain cases involve the reporting of, or access to, individually identifiable health information. Accordingly, provision has been made for such reporting and access by making such reporting and access permitted disclosures and uses under this proposed rule. See proposed § 164.510(c).