Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Federal Tort Claims Act


Comment: One comment contended that the proposed regulation's requirement mandating covered entities to name the subjects of protected health information disclosed under a business partner contract as third party intended beneficiaries under the contract would have created an impermissible right of action against the government under the Federal Tort Claims Act ("FTCA").

Response: Because we have deleted the third party beneficiary provisions from the final rules, this comment is moot.

Comment: Another comment suggested the regulation would hamper the ability of federal agencies to disclose protected health information to their attorneys, the Department of Justice, during the initial stages of the claims brought under the FTCA.

Response: We disagree. The regulation applies only to federal agencies that are covered entities. To the extent an agency is not a covered entity, it is not subject to the regulation; to the extent an agency is a covered entity, it must comply with the regulation. A covered entity that is a federal agency may disclose relevant information to its attorneys, who are business associates, for purposes of health care operations, which includes uses or disclosures for legal functions. See § 164.501 (definitions of "business associate" and "health care operations"). The final rule provides specific provisions describing how federal agencies may provide adequate assurances for these types of disclosures of protected health information. See § 164.504(e)(3).