01-4811. Standards for Privacy of Individually Identifiable Health Information

AGENCY:

Office for Civil Rights, HHS.

ACTION:

Final rule; request for comments.

SUMMARY:

This action provides for the submission of comments on a technical amendment to the final rule adopting standards for privacy of individually identifiable health information published on December 28, 2000, in the Federal Register (65 FR 82462), to convert it to a final rule with request for comments. The purpose of this action is to permit public comment on the final rule for a limited period before the rule becomes effective.

DATES:

1. Comments will be considered if received as provided below, no later than 5 p.m. on March 30, 2001.

2. The effective date of the final rule with request for comments published December 28, 2000 (65 FR 82462) was corrected to be April 14, 2001. See 66 FR 12434 (February 26, 2001).

ADDRESSES:

Comments will be considered only if provided through any of the following means:

1. Mail written comments (1 original and, if possible, a floppy disk) to the following address: U.S. Department of Health and Human Services, Attention: Privacy I, Room 801, Hubert H. Humphrey Building, 200 Independence Avenue, SW., Washington, DC 20201.

2. Deliver written comments (1 original and, if possible, a floppy disk) to Room 801, 200 Independence Avenue, SW., Washington, DC 20201.

3. Submit electronic comments at the following website: http://aspe.hhs.gov/​admnsimp/​.

FOR FURTHER INFORMATION CONTACT:

Kimberly Coleman, 1-866-OCR-PRIV (1-866-627-7748) or TTY 1-866-788-4989.

SUPPLEMENTARY INFORMATION:

Comment Procedures, Availability of Copies, and Electronic Access

Comment procedures: All comments should include the full name, address, and telephone number of the sender or a knowledgeable point of contact. Each specific comment should specify the section of the final rule to which the specific comment pertains. If possible, please send an electronic version of the comments on a 31/2 inch DOS format floppy disk in Adobe Acrobat Portable Document Format (PDF), HTML, ASCII text, or popular word processor format (Microsoft Word, Corel WordPerfect). All comments and content must be limited to the 8.5 wide by 11.0 high vertical (also referred to as “portrait”) page orientation. If identical/duplicate comment submissions are submitted both electronically and in paper form, each submission should clearly indicate that it is a duplicate submission.

Because of staffing and resource limitations, we will not accept comments by electronic mail or facsimile (FAX) transmission. Any comments received through such media will be deleted or destroyed, as appropriate. They will not be considered as public comments.

Comments that are timely received in proper form and at one of the addresses specified above will be available for public inspection by appointment as they are received, generally beginning approximately three weeks after this publication in Room 801 of the Department's offices at 200 Independence Avenue, SW, Washington, DC on Monday through Friday of each week from 8:30 a.m. to 5 p.m. Appointments may be made by telephoning 202-260-3392.

After the close of the comment period, comments that we are technically able to convert will be posted on the Administrative Simplification website specified above.

Copies: To order copies of the Federal Register containing this document, send your request to New Orders, Superintendent of Documents, PO Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at 202-512-1800 or by fax to 202-512-2250. The cost for each copy is $9. Alternatively, the Federal Register may be viewed and photocopied at most libraries designated as Federal Depository Libraries and at many other public and academic libraries throughout the country that receive the Federal Register.

Electronic Access: This document is available electronically at the above website as well as at the web site of the Government Printing Office at http://www.access.gpo.gov/​su_​docs/​aces/​140.html.

Discussion

On December 28, 2000, we published in the Federal Register a final rule adopting standards for the privacy of individually identifiable health information (Privacy Rule). The Privacy Rule is the second in a series of rules mandated by sections 261-264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. In general, the Privacy Rule establishes in 45 CFR part 160 a set of definitions applicable to the entire set of HIPAA rules, requirements for requesting that a state law be excepted from preemption by the statute, and compliance and enforcement requirements. The Privacy Rule also establishes a new subpart E of part 164. Subpart E establishes standards which entities covered by the statute—health plans, health care clearinghouses, and certain health care providers—are required to comply with to protect the privacy of certain individually identifiable health information (“protected health information”). The standards are requirements relating to the uses and disclosures of protected health information, the rights of individuals with respect to their protected health information, and the procedures for exercising those rights.

The Privacy Rule affects over 600,000 entities and virtually every American. It is estimated to cost in excess of $17.6 billion over ten years. The Department received over 52,000 public comments in the public comment period on the proposed rule; in the period following publication of the final rule, HHS has received approximately a thousand inquiries about the impact and operation of the Privacy Rule on numerous sectors of the economy. Many comments exhibit substantial confusion over how the Rule will operate; others express great concern over the complexity and workability of the Rule. The significance of the Privacy Rule for the health care industry and for society as a whole, and the substantial nature of some concerns that have been raised have led us to conclude that an additional comment period on the Privacy Rule is warranted. Accordingly, we hereby solicit public comment for 30 days on the Privacy Rule, as published in the Federal Register on December 28, 2000 at 65 FR 82462.

Based on telephone calls, e-mails, letters, and other contacts with HHS, we are aware that the Privacy Rule has been the subject of widespread debate in the health care industry and the public at large in the almost two months since its publication. Thus, we believe that many of the public's concerns about the Privacy Rule have already crystallized. We accordingly are of the view that 30 days should be sufficient for the public to state its views fully to HHS.

We determined that the report to Congress required by 5 U.S.C. 801(a)(1) was not received by the Congress concurrent with the transmission of the Privacy Rule to the Federal Register, as previously thought. We have published elsewhere in this section of the Federal Register a final rule correcting the effective date of the Privacy Rule to April 14, 2001 to comply with 5 U.S.C. 801(a)(3)(A). This action does not alter the corrected effective date. The public comment period provided for above accordingly will close before the Privacy Rule becomes effective.

Dated: February 22, 2001.

Tommy G. Thompson,

Secretary.