2014-11579. Notice of National Transportation Safety Board Public Health Authority Status

AGENCY:

National Transportation Safety Board (NTSB).

ACTION:

Notice.

SUMMARY:

The NTSB is publishing this notice to inform health care providers, including hospitals, health plans, and other health organizations, of the NTSB's status as a “public health authority” under the health care privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

FOR FURTHER INFORMATION CONTACT:

David Tochen, General Counsel, [phone].

SUPPLEMENTARY INFORMATION:

I. Background

The NTSB is an independent Federal agency with statutory responsibility for investigating and determining the probable causes of all civil aviation and certain railroad, highway, marine, hazardous materials, and pipeline accidents and incidents. See 49 U.S.C. 1116, 1131. Through its comprehensive public reports on transportation accidents and incidents and safety recommendations, the NTSB protects and promotes public health and safety by helping prevent recurrences of accidents and injuries to the hundreds of millions of Americans who travel or are employed in the nation's channels of transportation each year. The NTSB has issued more than 13,000 safety recommendations since its establishment in 1967.

The NTSB possesses statutory authority to obtain information in investigations by subpoena and “may inspect any record, process, control, or facility related to an accident investigation.” Id. §§ 1113(a)(1), 1134(a)(2). The NTSB may also “order an autopsy to be performed and have other tests made when necessary to investigate an accident.” Id. § 1134(f)(1). In any accident investigation, NTSB staff obtains relevant information through a variety of means, including voluntary measures, subpoenas, and testimony at public investigative hearings.

II. HIPAA Privacy Rule

Congress enacted HIPAA (Pub. L. 104-191, 110 Stat. 1936 (1996)) to create and strengthen national standards for the privacy of Americans' health information, among several other major purposes. In response to a mandate in section 264(c)(1) of HIPAA, the U.S. Department of Health and Human Services (HHS) in 2000 finalized a set of regulatory requirements to protect health information privacy. See Standards for Privacy of Individually Identifiable Health Information, 65 FR 82462 (Dec. 28, 2000), as amended, 78 FR 5566 (Jan 25, 2013). These requirements, described collectively as the HIPAA Privacy Rule (Privacy Rule) and codified in relevant part at 45 CFR parts 160 and 164, govern uses and disclosures of individuals' health information by “covered entities”: health care providers, health plans, and health care clearinghouses. 45 CFR 160.103.

The Privacy Rule generally limits a covered entity's ability to disclose an individual's protected health information to another person. See id. § 164.502(a). An exception to this general prohibition expressly permits a covered entity to disclose protected health information without the individual's authorization or opportunity to object to a

public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions. . . .

Id. § 164.512(b)(1)(i). The Privacy Rule defines a “public health authority” as

an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

Id. § 164.501. In the preamble to the final Privacy Rule, HHS described the definition of “public health authority” as a “broad” definition, commensurate with a “broad Congressional mandate [in HIPAA] not to interfere with current public health practices” under State public health laws. 65 FR 82624.

III. NTSB Public Health Authority Status

The NTSB is a public health authority for purposes of the HIPAA Privacy Rule. HHS specifically cited the NTSB as an example of a public health authority in the preamble to a notice of proposed rulemaking (NPRM) on the Privacy Rule in 1999; the preamble included the NTSB in an illustrative list of several “government agencies and entities [that] carry out public health activities in the course of their missions.” Standards for Privacy of Individually Identifiable Health Information, 64 FR 59918, 59956 (Nov. 3, 1999). The definition of “public health authority” adopted in the final rule does not differ in any relevant respect from the definition contemplated in the NPRM.^[1] In the 14 years since publication of the final Privacy Rule, the NTSB's status as a public health authority has facilitated the Board's access to information that substantially assisted the Board in issuing safety recommendations that prevented accidents and injuries and saved lives.

Moreover, as HHS noted in the NPRM, NTSB's activities, by design, “reduce mortality and injury by making recommendations for safety improvements,” 64 FR 59956, and fall well within the ambit of public health activities conducted “for the purpose of preventing or controlling . . . injury,” 45 CFR 164.512(b)(1)(i). NTSB investigations thoroughly examine causal and contributing factors in transportation accidents and incidents, including human factors such as fatigue among crewmembers, so regulators, transportation operators, and other stakeholders may implement appropriate measures to prevent the accidents and incidents from recurring. NTSB investigations also examine the nature and extent of accident victims' injuries so that the Board may issue appropriate recommendations to improve the crashworthiness of transportation vehicles and to improve accidents' survivability. Finally, the NTSB examines emergency responses to transportation accidents to identify measures that could mitigate injuries and prevent deaths in the future.

Dated: May 14, 2014.

Christopher A. Hart,

Acting Chairman.

Footnotes

1.  In relevant part, the final rule modified the proposed definition of “public health authority” “slightly to clarify that a `public health authority' also includes a person or entity acting under a grant of authority from or contract with a public health agency.” 65 FR 82497. The final rule also added language to the provision authorizing disclosures to a public health authority to permit disclosures to a foreign government agency acting in collaboration with a public health authority. See 65 FR 82525.