NRPM: Standards for Privacy of Individually Identifiable Health Information. ii. Advisory opinions under section 1178(a)(2)(B).


The rules proposed below lay out a similar process for advisory opinions under section 1178(a)(2)(B). That section of the statute provides that, subject to the requirements of section 264(c)(2) [the provision of HIPAA that establishes the “more stringent” preemption test], State laws that “relate to the privacy of individually identifiable health information” are excepted from the general rule that the HIPAA standards, requirements, and implementation specifications preempt contrary State law.

Unlike section 1178(a)(2)(A), section 1178(a)(2)(B) does not provide for the making of a determination by the Secretary. Nonetheless, it is clear that the Secretary may make judgments about the legal effect of particular State privacy laws in making compliance and enforcement decisions. It is also foreseeable that the Secretary will be asked to take a position on whether particular State privacy laws are preempted or not. We have concluded that the best way of addressing these concerns is to provide a mechanism by which the Secretary can issue advisory opinions, so that the public may be informed about preemption judgments the Secretary has made. See proposed § 160.204(b).

The process proposed below for requesting advisory opinions is limited to States, for the reasons described in the preceding section. The requirements for requests for advisory opinions are similar to the requirements for determinations in proposed § 160.204(a), but are tailored to the different statutory requirements of sections 1178(a)(2)(A) and 264(c)(2). As with proposed § 164.204(a), the process proposed below would provide for publication of advisory opinions issued by the Secretary on an annual basis, to ensure that the public is informed of the decisions made in this area.