NRPM: Standards for Privacy of Individually Identifiable Health Information. iii. Overseas foreign national beneficiaries.


The Department of Defense, as well as other federal agencies and U.S.-based non- governmental organizations, provide health care to foreign nationals overseas incident to U.S. sponsored missions or operations. Such care is provided pursuant to federal statute, international agreement, international organization sponsorship, or incident to military operations (including humanitarian and peacekeeping operations). Examples include:

  • The DOD provides general health care to an indigenous population incident to military deployment;
  • The DOD provides health care to captured and detained personnel as a consequence of overseas combat operations. Such care is mandated by international agreement, i.e., the Geneva Conventions. The most recent example involves the surrender or capture of Iraqi soldiers during the conduct of Operation Desert Storm;
  • A number of federal agencies and non-governmental organizations provide health care services as part of organized disaster relief or other humanitarian programs and activities around the world.

We believe that the statute did not contemplate these unique beneficiary populations. Under circumstances where healthcare is being furnished to foreign nationals incident to sanctioned U.S. activities overseas, application of these proposed rules could have the unintended effect of impeding or frustrating the conduct of such activities, and producing incongruous results. Examples include:

  • Requiring preparation of a notice advising the local population of the information practices of the DOD incident to receiving free medical care as part of disaster relief.
  • Medical information involving a prisoner of war could not be disclosed, without the prisoner’s consent, to U.S. military authorities who have responsibility for operating the POW camps.

Therefore, we propose to exclude overseas foreign national beneficiaries of health care provided by the DOD or other federal agency, or by non-governmental organizations acting on behalf of a federal agency, from the definition of an individual. This exclusion would mean that any health information created when providing health care to this population would not be protected health information and therefore not covered by these rules.