NRPM: Standards for Privacy of Individually Identifiable Health Information. ii. Foreign diplomatic and military personnel.


The Department of Defense, as well as other federal agencies, provide medical care to foreign military and diplomatic personnel, as well as their dependents. Such care is provided pursuant to either statutory authority (e.g., 10 U.S.C. 2549) or international agreement. The care may be delivered either in the United States or overseas. Also, where health care is provided in the United States, it may be furnished by non-government providers when government delivered care is not available or the beneficiary elects to obtain private as opposed to government health care. Examples include:

  • Foreign military personnel being trained, or assigned to U.S. military organizations, in the United States who receive care from either government or private health care providers;
  • The DOD operated medical clinic which provides care to all allied military and diplomatic personnel assigned to NATO SHAPE Headquarters in Brussels, Belgium;
  • The DOS, which also is engaged in arranging health care for foreign diplomatic and military personnel and their families, could also have legitimate needs for information concerning the health services involved.

We believe that the statute was not intended to cover this unique class of beneficiaries. These persons are receiving U.S., either private or governmental, furnished health care, either in the United States or overseas, because of the beneficiary’s military or diplomatic status. For such personnel, we believe that the country-to-country agreements or federal statutes which call for, or authorize, such care in furtherance of a national defense or foreign policy purpose should apply. We propose to exclude foreign military and diplomatic personnel and their dependents who receive health care provided by or paid for by the DOD or other federal agency, or by an entity acting on its behalf pursuant to a country-to-country agreement or federal statute, from the definition of an “individual” in § 164.504. Therefore, the health information created about such persons by a DOD or other federal agency health care provider would not be protected under this rule. However, information created about such persons by covered health care providers whose services are not paid for by or provided on behalf of a federal agency would be protected health information.