NRPM: Standards for Privacy of Individually Identifiable Health Information. i. Determinations under section 1178(a)(2)(A).


The rules proposed below should not usually implicate section 1178(a)(2)(A), which provides that a State law will not be preempted where the Secretary determines it is necessary for one or more of five specific purposes: (1) to prevent fraud and abuse; (2) to ensure appropriate State regulation of insurance and health plans; (3) for State reporting on health care delivery or costs; (4) for other purposes; or (5) which address controlled substances. The process for implementing this statutory provision is proposed here, because the issue of how such preemption issues will be handled has been raised in prior HIPAA rulemakings and needs to be addressed, and, as explained above, the statutory provision itself is fairly intertwined (in terms of the specific terms used), with the preemption provisions of the statute that relate to privacy.

The process proposed below for determinations by the Secretary would permit States to request an exception to the general rule of preemption. The decision to limit, at least as an initial matter, the right to request such determinations to States was made for several reasons. First, States are obviously most directly concerned by preemption, in that it is State legislative, judicial, or executive action that the federal requirements supersede. Principles of comity dictate that States be given the opportunity to make the case that their laws should not be superseded. Second, States are in the best position to address the issue of how their laws operate and what their intent is, both of which are relevant to the determination to be made. Third, we need to control the process as an initial matter, so that the Secretary is not overwhelmed by requests. Fourth, where particular federal requirements will have a major impact on providers, plans, or clearinghouses within a particular State, we assume that they will be able to work with their State governments to raise the issue with the Secretary; the discussion process that such negotiations should entail should help crystallize the legal and other issues for the Secretary and, hence, result in better determinations. We emphasize that HHS may well revisit this issue, once it has gained some experience with the proposed process.

Proposed § 160.204(a)(1) sets out a number of requirements for requests for determinations. In general, the purpose of these requirements is to provide as complete a statement as possible of the relevant information as an initial matter, to minimize the time needed for the Secretarial determination.

The remaining requirements of proposed § 160.204(a) generally are designed to set out an orderly process and effect of the determinations. Of particular note is proposed § 160.204(a)(5), which provides that such determinations apply only to transactions that are wholly intrastate. We recognize that in today’s economy, many, perhaps most, transactions will be interstate, so that the effect of a positive determination could be minimal under this provision. Nonetheless, we think that there is no practical alternative to the proposed policy. We do not see how it would be practical to split up transactions that involved more than one State, when one State’s law was preempted and the other’s was not. We do not see why the non-preempted law should govern the transaction, to the extent it involved an entity in a State whose law was preempted. Quite aside from the sovereignty issues such a result would raise, such a result would be very confusing for the health care industry and others working with it and thus inconsistent with the underlying goal of administrative simplification. Rather, such a situation would seem to be a classic case for application of federal standards, and proposed § 160.204(a)(5) would accordingly provide for this.