HHS SUMMARY: The Department of Health and Human Services ("HHS" or "Department") modifies certain standards in the Rule entitled "Standards for Privacy of Individually Identifiable Health Information" ("Privacy Rule"). The Privacy Rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996.
The purpose of these modifications is to maintain strong protections for the privacy of individually identifiable health information while clarifying certain of the Privacy Rule's provisions, addressing the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieving unintended administrative burdens created by the Privacy Rule.
Additional Guidance issued by HHS on December 4, 2002.
PDF [487 K]
--------------------------------------------------------------------------------
PREAMBLE
Summary and Introduction
Background
Overview of the NPRM
Section-by-Section Description of Final Modifications and Response to Comments:
Marketing
Health Care Operations: Changes of Ownership
Employment Records
Section 164.502--Uses and Disclosures of Protected Health Information: General Rules
Incidental Uses and Disclosures
Minimum Necessary Standards
Parents as Personal Representatives of Unemancipated Minors
Section 164.504--Uses and Disclosures: Organizational Requirements
Hybrid Entities
Group Health Plan Disclosures of Enrollment and Disenrollment Information to Plan Sponsors
Section 164.506--Uses and Disclosures for Treatment, Payment, and Health Care Operations
Consent
Disclosures for Treatment, Payment, or Health Care Operations of Another Entity
Uses and Disclosures for Which Authorization Is Required
Section 164.512--Uses and Disclosures for Which Authorization or Opportunity To Agree or Object Is Not Required
Uses and Disclosures Regarding FDA-Regulated Products and Activities
Institutional Review Board (IRB) or Privacy Board Approval of a Waiver of Authorization
Section 164.514--Other Requirements Relating to Uses and Disclosures of Protected Health Information
De-Identification of Protected Health Information
Limited Data Sets
Section 164.520--Notice of Privacy Practices for Protected Health Information
Section 164.528--Accounting of Disclosures of Protected Health Information
Section 164.532--Transition Provisions
Technical Corrections and Other Clarifications
Final Regulatory Impact Analysis
Sample Business Associate Contract Provisions--Appendix