[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 81)

[Assistant]
According to privacy_rule_2000:

ities must obtain the individual's authorization before using or disclosing protected health information for marketing purposes. In the final rule, we add a new definition of marketing (see §164.501).
For more detail on what activities constitute marketing, see §164.501, definition of ''marketing,'' and §164.514(e). ## Pre-Enrollment Underwriting

As in the proposed rule, covered entities must obtain the individual's authorization to use or disclose protected health information for the purpose of making eligibility or enrollment determinations relating to an individual or for underwriting or risk rating determinations, prior to the individual's enrollment in a health plan (that is, for purposes of pre-enrollment underwriting). For example, if an individual applies for new coverage with a health plan in the non-group market and the health plan wants to review protected health information from the individual's covered health care providers before extending an offer of coverage, the individual first must authorize the covered providers to share the information with the health plan. If the individual applies for renewal of existing coverage, however, the health plan would not need to obtain an authorization to review its existing claims records about that individual, because this activity would come within the definition of health care operations and be permissible. We also note that under §164.504(f), a group health plan and a health insurance issuer that provides benefits with respect to a group health plan are permitted in certain circumstances to disclose summary health information to the plan sponsor for the purpose of obtaining premium bids. Because these disclosures fall within the definition of health care operations, they do not require authorization. ## Employment Determinations

As in the proposed rule, covered entities must obtain the individual's authorization to use or disclose protected health information for employment determinations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 28)

[Assistant]
According to hitech_omnibus_2013:

ost logical reading of the HITECH Act, which provides the Secretary with discretion to impose penalties for each category of culpability up to the maximum amount described in the highest penalty tier.
With respect to those comments expressing concern about the discretion available to the Secretary under the adopted scheme we emphasize again that the Department will not impose the maximum penalty amount in all cases but will rather determine the amount of a penalty on a case-by-case basis, depending on the nature and extent of the violation and the nature and extent of the resulting harm, as required by the HITECH Act, as well as the other factors

18:57 Jan 24, 2013

PO 00000

Frm 00019

set forth at § 160.408. In response to those commenters particularly concerned about the impact of penalties on smaller entities, we note that the other factors include both the financial condition and size of the covered entity or business associate. These factors are discussed more fully below. In addition, with respect to comments expressing specific concern about fairness regarding those violations of which an entity did not know or by exercising reasonable diligence would not have known or for which there was a reasonable cause and not willful neglect, we note that in both cases an entity may establish that an affirmative defense applies under § 160.410, where the entity corrects the violation within 30 days from the date the entity had knowledge of the violation or with the exercise of reasonable diligence would have had knowledge of the violation, or during a period determined appropriate by the Secretary based upon the nature and extent of the entity's failure to comply. These affirmative defenses are described more fully below. In addition, Section 13410(d) of the HITECH Act and Section 1176(a) of the Social Security Act, give the Secretary further ability to waive a civil money penalty, in whole or in part, under certain circumstances.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 124)

[Assistant]
According to privacy_rule_2000:

care services. To carry out their insurance functions, these non-covered insurers typically seek individually identifiable health information from covered health care providers and group health plans.
In drafting the proposed rule, the Secretary was faced with the challenge of trying to carry out the statutory mandate of safeguarding the privacy of individually identifiable health information by regulating the flow of such information from covered entities while at the same time respecting the Congressional intent to shield workers' compensation carriers and other excepted benefit plans from regulation as covered entities. In the proposed rule we allowed covered entities to disclose protected health information without individual consent for purposes of treatment, payment or health care operationseven when the disclosure was to a noncovered entity such as a workers' compensation carrier. In addition, we allowed protected health information to be disclosed if required by state law for purposes of determining eligibility for coverage or fitness for duty. The proposed rule also required that whenever a covered entity disclosed protected health information to a noncovered entity, even though authorized under the rule, the individual who was the subject of the information must be informed that the protected health information was no longer subject to privacy protections. Like other disclosures under the proposed rule, the information provided to workers' compensation carriers for treatment, payment or health care operations was subject to the minimum necessary standard. However, to the extent that protected health information was disclosed to the carrier because it was required by law, it was not subject to the minimum necessary standard. In addition, individuals were entitled to an accounting when protected health information was disclosed for purposes other than treatment, payment or health care operations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 19)

[Assistant]
According to hitech_omnibus_2013:

ement provisions of the IFR and the NPRM, responds to public comment received by the Department on both rules, and describes the final modifications to the Enforcement Rule adopted by this final rule.
In addition to the modifications discussed below, this final rule also adopts the NPRM proposal to add the term ''business associate'' to the following provisions of the Enforcement Rule: §§ 160.300; 160.304; 160.306(a) and (c); 160.308; 160.310; 160.312; 160.316; 160.401; 160.402; 160.404(b); 160.406; 160.408(c) and (d); and 160.410(a) and (c). This is done to implement sections 13401 and 13404 of the Act, which impose direct civil money penalty liability on business associates for their violations of certain provisions of the HIPAA Rules. Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with

1. Subpart C of Part 160-Compliance and Investigations a. Sections 160.304, 160.306, 160.308, and 160.312-Noncompliance Due to Willful Neglect

## Proposed Rule

Section 13410(a) of the HITECH Act adds a new subsection (c) to section 1176 of the Social Security Act, which requires the Department to formally investigate a complaint if a preliminary investigation of the facts of the complaint indicates a possible violation due to willful neglect (section 1176(c)(2)) and to impose a civil money penalty for a violation due to willful neglect (section 1176(c)(1)). The Department proposed a number of modifications to Subpart C of the Enforcement Rule to implement these provisions. First, § 160.306(c) of the Enforcement Rule currently provides the Secretary with discretion to investigate HIPAA complaints through the use of the word ''may.'' As a practical matter, however, the Department currently conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 64)

[Assistant]
According to security_rule_2003:

paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.
- (ii) Implementation specifications:
- (A) Authorization and/or supervision (Addressable). Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. - (B) Workforce clearance procedure (Addressable). Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate. - (C) Termination procedures (Addressable). Implement procedures for terminating access to electronic protected health information when the employment of a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section. - (4)(i) Standard: Information access management. Implement policies and procedures for authorizing access to

PO 00000

Frm 00045

- electronic protected health information that are consistent with the applicable requirements of subpart E of this part. - (ii) Implementation specifications :
- (A) Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. - (B) Access authorization (Addressable). Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism. - (C) Access establishment and modification (Addressable).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 35)

[Assistant]
According to privacy_rule_2000:

ut which are governed by various federal laws (such as Medicare, Medicaid, and ERISA). Congress explicitly included some of these programs in HIPAA, subjecting them directly to the privacy regulation.
Section 1171 of the Act defines the term ''health plan'' to include the following federally conducted, regulated, or funded programs: Group plans under ERISA that either have 50 or more participants or are administered by an entity other than the employer who established and maintains the plan; federally qualified health maintenance organizations; Medicare; Medicaid; Medicare supplemental policies; the health care program for active military personnel; the health care program for veterans; the Civilian Health and Medical Program of the Uniformed Services (CHAMPUS); the Indian health service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, et seq. ; and the Federal Employees Health Benefits Program. There also are many other federally conducted, regulated, or funded programs in which individually identifiable health information is created or maintained, but which do not come within the statutory definition of ''health plan.'' While these latter types of federally conducted, regulated, or assisted programs are not explicitly covered by part C of title XI in the same way that the programs listed in the statutory definition of ''health plan'' are covered, the statute may nonetheless apply to transactions and other activities conducted under such programs. This is likely to be the case when the federal entity or federally regulated or funded entity provides health services; the requirements of part C may apply to such an entity as a ''health care provider.'' Thus, the issue of how different federal requirements apply is likely to arise in numerous contexts.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 46)

[Assistant]
According to nist_sp800-66r2:

ivity of the ePHI controlled by the organization as well as the organization's size, complexity, and environmental and/or operational changes (e.g., other relevant laws or accreditation requirements).
• In addition to periodic reevaluations, consider repeating evaluations when environmental and operational changes that affect the security of ePHI are made to the organization (e.g., if new technology is adopted or if there are newly recognized risks to the security of ePHI). | • Do security policies specify that evaluations will be repeated when environmental and operational changes are made that affect the security of ePHI? • Do policies on the frequency of security evaluations reflect any and all relevant federal or state laws that bear on environmental or operational changes affecting the security of ePHI? • Has the organization explored the use of automated tools to support periodic evaluations? |

81 See Sec. 5.5.2, HIPAA Standard: Documentation . ## 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1)) 82

HIPAA Standard: A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor. Covered entities need to be cognizant of differentiating between best practices versus what the Security Rule requires. Vendor management and supply chain risks are important topics due to the potential they have to introduce new threats and risks to organizations. However, to the extent that such vendors and service providers are business associates, HIPAA treats them the same as covered entities with respect to Security Rule compliance.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 148)

[Assistant]
According to hitech_omnibus_2013:

ual's genetic tests; (2) the genetic tests of family members of such individual; and (3) the manifestation of a disease or disorder in family members of such individual (i.e., family medical history).
GINA also provides that the term ''genetic information'' includes, with respect to any individual, any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by such

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with individual or family member of such individual. GINA expressly provides that the term ''genetic information'' shall not include information about the sex or age of any individual. This basic definition of ''genetic information'' in section 102(a)(4) of GINA (and that is to apply for purposes of section 105) is also expanded by section 102(a)(3), which provides that any reference to genetic information concerning an individual or family member in the PHSA shall include: with respect to an individual or family member of an individual who is a pregnant woman, the genetic information of any fetus carried by such pregnant woman; and with respect to an individual or family member utilizing an assisted reproductive technology, the genetic information of any embryo legally held by the individual or family member. The Department proposed to include this statutory definition of ''genetic information'' in § 160.103. ## Overview of Public Comments

Most commenters did not address the proposed definition of ''genetic information'' in their comments on the proposed rule. However, one commenter stated that it was unclear what information may fall within the scope of the term ''genetic information'' and whether such term may be construed to include traditional medical information or medical tests used in underwriting today. ## Final Rule

The final rule adopts without modification the definition of ''genetic information'' proposed in the NPRM.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 44)

[Assistant]
According to security_rule_2003:

han the requirements outlined in the proposed rule may be imposed. VerDate Jan<31>2003

Response: The general rule is that the security standards in this final rule supersede contrary State law.
Only where the Secretary has granted an exception under section 1178(a)(2)(A) of the Act, or in situations under section 1178(b) or (c) of the Act, will the general rule not hold true. Covered entities may be required to adhere to stricter Stateimposed security measures that are not contrary to this final rule. ## 2. Enforcement

The proposed rule did not contain specific enforcement provisions. This final rule likewise does not contain specific enforcement provisions; it is expected that enforcement provisions applicable to all Administrative Simplification rules will be proposed in a future rulemaking. a. Comment: One commenter voiced support for the proposed rule's approach. Another stated that the process is poorly defined. One commenter stated that fines should be eliminated, or the scope of activity subject to fines should be more narrowly defined. While a number of commenters were of the opinion that HHS must retain enforcement responsibility, stating that it would be unconstitutional to give it to a private entity, several others stated that it may not be practical for HHS to retain the responsibility for determining violations and imposing penalties specified by the statute. A concern was voiced over HHS's ability to fairly and consistently apply the rules due to budget constraints. Several commenters support industry solutions to enforcement with some level of government involvement. One commenter recommended a single audit process using accrediting bodies already in place. Another stated that entities providing accreditation services should not be involved in enforcement as this would result in a conflict of interest.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 42)

[Assistant]
According to privacy_rule_2000:

tical subdivision of a state or territory, or an Indian tribe, for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody.
Other persons held in lawful custody includes juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, or others awaiting charges or trial. This language was necessary to explain the privacy rights and protections of inmates in this regulation. ## Covered Functions

We add a new term, ''covered functions,'' as a shorthand way of expressing and referring to the functions that the entities covered by section 1172(a) of the Act perform. Section 1171 defines the terms ''health plan'', ''health care provider'', and ''health care clearinghouse'' in functional terms. Thus, a ''health plan'' is an individual or group plan ''that provides, or pays the cost of, medical care * * *'', a ''health care provider'' ''furnish[es] health care services or supplies,'' and a ''health care clearinghouse'' is an entity ''that processes or facilitates the processing of * * * data elements of health information * * *''. Covered functions, therefore, are the activities that any such entity engages in that are directly related to operating as a health plan, health care provider, or health care clearinghouse; that is, they are the functions that make it a health plan, health care provider, or health care clearinghouse. The term ''covered functions'' is not intended to include various support functions, such as computer support, payroll and other office support, and similar support functions, although we recognize that these support functions must occur in order for the entity to carry out its health care functions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 211)

[Assistant]
According to privacy_rule_2000:

ubstance abuse confidentiality regulations in the ''Relationship to Other Federal Laws'' preamble provides guidance that may be applied to the laws governing Veteran's Affairs (''VA'') health records.
In most cases, a conflict will not exist between these privacy rules and the VA programs. For example, some disclosures allowed without patient consent or authorization under the privacy regulation may not be within the VA statutory list of permissible disclosures without a written consent. In such circumstances, the covered entity would have to abide by the VA statute, and no conflict exists. If the disclosures permitted by the VA statute come within the permissible disclosures of our rules, no conflict exists. In some cases, our rules may demand additional requirements, such as obtaining the approval of a privacy board or Institutional Review Board if a covered entity seeks to disclose protected health information for research purposes without the individual's authorization. A covered entity subject to the VA statute will need to ensure that it meets the requirements of both that statute and the regulation below. If a conflict arises, the covered entity should evaluate the specific potential conflicting provisions under the implied repeal analysis set forth in the ''Relationship to Other Federal Laws'' discussion in the preamble. ## WIC

Comment: One comment called on other federal agencies to examine their regulations and policies regarding the use and disclosure of protected health information. The comment suggested that other agencies revise their regulations and policies to avoid duplicative, contradictory, or more stringent requirements. The comment noted that the U.S. Department of Agriculture's Special Supplemental Nutrition Program for Women, Infants, and Children (''WIC'') does not release WIC data.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 156)

[Assistant]
According to hitech_omnibus_2013:

formation for underwriting purposes. Such covered entities, in particular, should ensure that appropriate staff members are trained on the permissible and impermissible uses of genetic information. 6.
Section 164.504(f)(1)(ii)Requirements for Group Health Plans

## Proposed Rule

Section 164.504(f)(1)(ii) permits a group health plan, or health insurance issuer or HMO with respect to the group health plan, to disclose summary health

VerDate Mar<15>2010

information to the plan sponsor if the plan sponsor requests the information for the purpose of obtaining premium bids from health plans for providing health insurance coverage under the group health plan, or for modifying, amending, or terminating the group health plan. As this provision permits activities that constitute ''underwriting purposes,'' as defined by GINA and the proposed rule, the Department proposed to modify § 164.504(f)(1)(ii) to clarify that § 164.504(f)(1)(ii) would not allow a disclosure of protected health information that is otherwise prohibited by the underwriting prohibition. ## Overview of Public Comments

The Department received one comment in support of this modification. ## Final Rule

The final rule adopts the modification to § 164.504(f)(1)(ii). 7. Section 164.506-Uses and Disclosures To Carry Out Treatment, Payment, or Health Care Operations Proposed Rule

Section 164.506(a) of the Privacy Rule sets out the uses and disclosures a covered entity is permitted to make to carry out treatment, payment, or health care operations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.502(b) require?

[Assistant]
According to breach_notification_2009:

§164.502(b) and 164.514(d).

We do not intend to interfere with research or public health activities that rely on dates of birth or zip codes. Uses and disclosures of limited data sets that include this information continue to be permissible under the Privacy Rule if the applicable requirements, such as a data use agreement, are satisfied. Further, we note that a covered entity or business associate is not responsible for a breach by a third party to whom it permissibly disclosed protected health information, including limited data sets, unless the third party received the information in its r


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 74)

[Assistant]
According to privacy_mod_2002:

he earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
4.
(c) Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the
- The Department proposed to delete the criterion that ''the alteration or waiver will not adversely affect the privacy rights and the welfare of the individuals,'' because it may conflict

19:04 Aug 13, 2002

PO 00000

Frm 00049

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

(2) The research could not practicably be conducted without the waiver or alteration; and

(3) The research could not practicably be conducted without access to and use of the protected health information. Overview of Public Comments. The following discussion provides an overview of the public comment received on this proposal. Additional comments received on this issue are discussed below in the section entitled, ''Response to Other Public Comments.''

The overwhelming majority of commenters were supportive of the Department's proposed modifications to the Privacy Rule's waiver criteria. These commenters found that the proposed revisions adequately addressed earlier concerns that the waiver criteria in the December 2000 Rule were confusing, redundant, and internally inconsistent. However, a few commenters argued that some of the proposed criteria continued to be too subjective and urged that they be eliminated. Final Modifications. The Department agrees with the majority of commenters that supported the proposed waiver criteria, and adopts the modifications as proposed in the NPRM.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.304 require?

[Assistant]
According to security_rule_2003:

§164.304, as appropriate. We included only terms relevant to the particular standards and implementation specifications being adopted.

3. Comment: Several commenters requested that the mapped matrix located in Addendum 3 of the proposed rule be included in this final rule, either as part of the rule or as an addendum, while others stated that it should not be part of this final rule. Several commenters cited items to be added to the mapped matrix.

Response: The mapped matrix was merely a snapshot of current standards and guidelines that the implementation team was able to obtain for review d


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 265)

[Assistant]
According to privacy_rule_2000:

lic or re-released after the initial whistleblowing event, and that this could put covered entities in violation of the law. Many commenters wanted to see the whistleblower provision deleted entirely.
According to a number of health care associations who commented on this topic, current practices already include adequate mechanisms for informing law enforcement, oversight and legal counsel of possible violations without the need for patient identifiable information; thus, the provision allowing whistleblowers to share protected health information is unnecessary. Additionally, some commenters felt that the covered entity needs to be allowed to prohibit disclosures outside of legitimate processes. Some commenters were concerned about not having any recourse if the whistleblower's suspicions were unfounded. Response: In this rule, we do not regulate the activities of whistleblowers. Rather, we regulate the activities of covered entities, and determine when they may be held responsible under this rule for whistleblowing activities of their workforce or business associates when that whistleblowing involves the disclosure of protected health information. Similarly, we regulate when covered entities must and need not sanction their workforce who disclose protected health information in violation of the covered entity's policies and procedures, when that disclosure is for whistleblowing purposes. See §164.530(e). This rule does not address a covered entity's recourse against a whistleblower under other applicable law. We do not hold covered entities responsible under this rule for

VerDate 11<MAY>2000

19:16 Dec 27, 2000

whistleblowing disclosures of protected health information under the circumstances described in § 164.502(j).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 57)

[Assistant]
According to nist_sp800-66r2:

how zero trust architecture principals can aid in the organization's approach to access control. See Appendix F for more information. 105 See Sec. 5.1.4, HIPAA Standard: Information Access Management.
| Key Activities                                                                                | Description                                                                                | Sample Questions                                                                                |
|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 3. Ensure That All System Users Have Been Assigned a Unique Identifier 106 Implementation Specification (Required) | • Assign a unique name and/or number for identifying and tracking user identity. • Ensure that system activity can be traced to a specific user.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 205)

[Assistant]
According to privacy_rule_2000:

DER2

Sfmt 4700

Comment: Several commenters expressed concern that the privacy regulation would eliminate the parents' ability to have access to information in their children's school health records.
Because the proposed regulation suggests that school-based clinics keep health records separate from other educational files, these comments argued that the regulation is contrary to the spirit of FERPA, which provides parents with access rights to their children's educational files. Response: As noted in the ''Relationship to Other Federal Laws'' provision of the preamble, to the extent information in school-based clinics is not protected health information because it is an education record, the FERPA access requirements apply and this regulation does not. For more detail regarding the rule's application to unemancipated minors, see the preamble discussion about ''Personal Representatives.''

## Federal Employees Compensation Act

Comment: One comment noted that the Federal Employees Compensation Act (''FECA'') requires claimants to sign a release form when they file a claim. This commenter suggested that the privacy regulation should not place additional restrictions on this type of release form. Response: We agree. In the final rule, we have added a new provision, §164.512(l), that permits covered entities to make disclosures authorized under workers' compensation and similar laws. This provision would permit covered entities to make disclosures authorized under FECA and not require a different release form. ## Federal Employees Health Benefits Program

Comment: A few comments expressed concern about the preemption effect on FEHBP and wanted clarification that the privacy regulation does not alter the existing preemptive scope of the program. Response: We do not intend to affect the preemptive scope of the FEHBP. The Federal Employee Health Benefit Act of 1998 preempts any state law that ''relates to'' health insurance or plans. 5 U.S.C. 8902(m).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 63)

[Assistant]
According to security_rule_2003:

ards means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it. User means a person or entity with authorized access.
Workstation means an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment. ## §164.306 Security standards: General rules. (a) General requirements. Covered entities must do the following:

- (1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits. - (2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. - (3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part. - (4) Ensure compliance with this subpart by its workforce. 5. (b) Flexibility of approach. - (1) Covered entities may use any security measures that allow the covered entity to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart. (2) In deciding which security measures to use, a covered entity must take into account the following factors:

(i) The size, complexity, and capabilities of the covered entity. Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

- (ii) The covered entity's technical infrastructure, hardware, and software security capabilities. - (iii) The costs of security measures. - (iv) The probability and criticality of potential risks to electronic protected health information. - (c) Standards. A covered entity must comply with the standards as provided in this section and in § 164.308, §164.310, § 164.312, § 164.314, and §164.316 with respect to all electronic protected health information. - (d) Implementation specifications.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 13)

[Assistant]
According to nist_sp800-66r2:

and Media Controls | 164.310(d)(1) | Accountability (A) | | Device and Media Controls | 164.310(d)(1) | Data Backup and Storage (A) | | Technical Safeguards | Technical Safeguards | Technical Safeguards | | Access Control | 164.312(a)(1) | Unique User Identification (R) | 15 See https://www.hhs.gov/hipaa/index.html and https://www.hhs.gov/hipaa/for-professionals/security/index.html.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 495)

[Assistant]
According to privacy_rule_2000:

s. An individual may request that a covered entity provide an accounting for disclosure for a period of time less than six years from the date of the individual's request, as outlined in this section.
## Section 164.530-Administrative Requirements

A covered entity must maintain such policies and procedures in written or electronic form where policies or procedures with respect to protected health information are required by this subpart. Where a communication is required by this subpart to be in writing, a covered entity must maintain such writing, or an electronic copy, as documentation; and where an action or activity is required by this subpart to be documented, it must maintain a written or electronic record of such action or activity. While these requirements are subject to the PRA, we believe the burden associated with these requirements is exempt from the PRA as stipulated under 5 CFR 1320.3(b)(2). Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

We have submitted a copy of this rule to OMB for its review of the information collection requirements in §§ 160.204, 160.306, 160.310, 164.502, 164.504, 164.506, 164.508, 164.510, 164.512, 164.514, 164.520, 164.522, 164.524, 164.526, 164.528, and Sec. 164.530. These requirements are not effective until they have been approved by OMB. If you comment on any of these information collection and record keeping requirements, please mail copies directly to the following: Health Care Financing Administration, Office of Information Services, Division of HCFA Enterprise Standards, Room N214-26, 7500 Security Boulevard, Baltimore, MD 21244-1850. ATTN: John Burke and to the Office of Information and Regulatory Affairs, Office of Management and Budget, Room 10235, New Executive Office Building, Washington, DC 20503. ATTN: Allison Herron Eydt, HCFA Desk Officer. ## IX.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 28)

[Assistant]
According to breach_notification_2009:

and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year).
This interim final rule is not an economically significant rule because we estimate that the breach notification requirements are not expected to cost more than $100 million per year. Nevertheless, because of the public interest in this rule, we have prepared an RIA that to the best of our ability presents the costs and benefits of the proposed rule. We request comments on the economic analysis provided in this proposed rule. The RFA requires agencies to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. The scope of the interim final rule will apply to all HIPAA covered entities and their business associates. Based on U.S. business census data provided to the Small Business Administration Office of Advocacy there were 605,845 entities classified under the North American Industrial Classification System (NAICS) 62. Code 62 encompasses physicians, dentists, ambulatory care centers, kidney dialysis centers, family planning clinics, home care services, mental health and drug rehabilitation centers, medical laboratories, hospitals and nursing facilities. In addition, based on data from the Centers for Medicare & Medicaid Services, we estimate that there are 107,567 suppliers of durable medical equipment and prosthetics. Almost all of these health providers fall under the RFA's definition of a small entity by either meeting the Small Business Administration's (SBA's) size standard of a small business or by being a non-dominant nonprofit organization. The SBA's size standard for NAICS 62 ranges between $7 million and $34.5 million in annual receipts. Also covered under HIPAA are health insurance firms and third party administrators (NAICS codes 524114 and 524292).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 16)

[Assistant]
According to security_rule_2003:

data, with resulting loss of public trust, and potential legal action. For example, a covered entity with poor facility access controls and procedures would be susceptible to hacking of its databases.
A provider with appropriate security protections already in place would only need to ensure that the protections are documented and are reassessed periodically to ensure that they continue to be appropriate and are actually being implemented. Our decision to classify many implementation specifications as addressable, rather than mandatory, provides even more flexibility to covered entities to develop costeffective solutions. We believe that insurers who already have effective security programs in place will have met many of the requirements of this regulation. c. Comment: One commenter believes the rule is arbitrary and capricious in its requirements without any justification that they will significantly improve the security of medical records and with the likelihood that their implementation may actually increase the vulnerability of the data. The commenter noted that the data backup requirements increase access to data and that security awareness training provides more information to employees. Response: The standards are based on generally accepted security procedures, existing industry standards and guidelines, and recommendations contained in the National Research Council's 1997 report For The Record:

VerDate Jan<31>2003

Protecting Electronic Health Information, Chapter 6. We also consulted extensively with experts in the field of security throughout the health care industry. The standards are consistent with generally accepted security principles and practices that are already in widespread use. Data backup need not result in increased access to that data. Backups should be stored in a secure location with controlled access. The appropriate secure location and access control will vary, based upon the security needs of the covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 380)

[Assistant]
According to privacy_rule_2000:

safe harbor standards, the number of demographic variables retained in the databases will be relatively small, so that it is appropriate to accept a relatively low number as a minimum geographic size.
In applying this provision, covered entities must replace the (currently 18) forbidden 3-digit zip codes with zeros and thus treat them as a single geographic area (with >20,000 population). The list of the forbidden 3digit zip codes will be maintained as part of the updated Secretarial guidance referred to above. Currently, they are: 022, 036, 059, 102, 203, 555, 556, 692, 821, 823, 830, 831, 878, 879, 884, 893, 987, and 994. This will result in an average 3-digit zip code area population of 287,858 which should result in an average of about 4% unique records using the 6 variables described above from the Census Short Form. Although this level of unique records will be much higher in the smaller geographic areas, the actual risk of identification will be much lower because of the limited availability of comparable data in publically available, identified databases, and will be further reduced by the low probability that someone will expend the resources to try to identify records when the chance of success is so small and uncertain. We think this compromise will meet the current need for an easy method to identify geographic area while providing adequate protection from reidentification. If a greater level of geographical detail is required for a particular use, the information will have to be obtained through another permitted mechanism or be subjected to a specific de-identification determination as described above. We will monitor the availability of identified public data and the concomitant re-identification risks, both theoretical and actual, and adjust this safe harbor in the future as necessary.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 82)

[Assistant]
According to nist_sp800-66r2:

deletion in a multi-tenant environment. | Adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment (e.g., in a cloud computing environment).
|
| Violate isolation in a multi-tenant environment. | Adversary circumvents or defeats isolation mechanisms in a multi-tenant environment (e.g., in a cloud computing environment) to observe, corrupt, or deny service to hosted services and information or data. |
| Compromise critical information systems via physical access. | Adversary obtains physical access to organizational information systems and makes modifications. |
| Compromise information systems or devices used externally and reintroduced into the enterprise. | Adversary installs malware on information systems or devices while the systems/devices are external to organizations in order to subsequently infect organizations when reconnected. |
| Compromise the software of organizational critical information systems. | Adversary inserts malware or otherwise corrupts critical internal organizational information systems. |
| Compromise organizational information systems to facilitate exfiltration of data or information. | Adversary implants malware into internal organizational information systems where the malware can identify and exfiltrate valuable information over time. |
| Compromise mission-critical information. | Adversary compromises the integrity of mission-critical information, thus preventing or impeding the ability of organizations to which information is supplied from carrying out operations. |
| Compromise the design, manufacturing, and/or distribution of information system components (including hardware, software, and firmware). | Adversary compromises the design, manufacturing, and/or distribution of critical information system components at selected suppliers. |
| Conduct an attack (i.e., direct or coordinate attack tools or activities).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 53)

[Assistant]
According to nist_sp800-66r2:

Identify All Methods of Physical Access to Workstations and Devices     | • Document the different ways that users access workstations and other devices that create, store, process, or transmit ePHI. Be sure to consider the multitude of computing devices (e.g., medical equipment, IoT devices, tablets, smart phones). • Consider any mobile devices that leave the physical facility as well as remote workers who access devices that create, store, process, or transmit ePHI. | • Is there an inventory of all current device locations? • Are any devices located in public areas? • Are laptops or other computing devices used as workstations to create, access, store, process, or transmit ePHI? |
| 2. Analyze the Risks Associated with Each Type of Access 99                | • Determine which type of access identified in Key Activity 1 poses the greatest threat to the security of ePHI. | • Do any devices leave the facility? • Are any devices housed in areas that are more vulnerable to unauthorized use, theft, or viewing of the data they contain? • What are the options for modifying the current access configuration to protect ePHI? |
| 3. Identify and Implement Physical Safeguards for Workstations and Devices | • Implement physical safeguards and other security measures to minimize the possibility of inappropriate access to ePHI through computing devices. • If there are impediments to physically securing devices and/or the facilities where devices are located, additional safeguards should be considered, such as: o Limiting device capabilities to access ePHI o Limiting user permissions to access ePHI o Device encryption o Stringent access controls (e.g., multi-factor authentication [MFA]) o Screen lock | • Are physical safeguards implemented for all devices that access ePHI to restrict access to authorized users?


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 21)

[Assistant]
According to hitech_omnibus_2013:

§ 160.312 so that the Secretary may move directly to a civil money penalty without exhausting informal resolution efforts at her discretion, particularly in cases involving willful neglect violations.
## Response to Other Public Comments

Comment: A number of commenters requested further clarification on the scope and depth of what constitutes a ''preliminary review of the facts'' for purposes of determining whether facts indicate a possible violation due to willful neglect and thus, warrant a formal complaint investigation or compliance review. Certain commenters suggested that a preliminary review of the facts should go beyond merely a

VerDate Mar<15>2010

review of the allegations asserted in a complaint. Response: As noted above, currently the Department conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. The Department anticipates that some complaints, on their face, or reports or referrals that form the basis of a potential compliance review, will contain sufficient information to indicate a possible violation due to willful neglect, and some may not. In any event, the Department may on a case-by-case basis expand the preliminary review and conduct additional inquiries for purposes of identifying a possible violation due to willful neglect. Notwithstanding the scope of a preliminary review, OCR will determine if an indicated violation was due to willful neglect based on the evidence from its investigation of the allegations, even if a violation due to willful neglect was not indicated at the preliminary review stage. b. Section 160.310-Protected Health Information Obtained by the Secretary Proposed Rule

Section 160.310 requires that covered entities make information available to and cooperate with the Secretary during complaint investigations and compliance reviews.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 35)

[Assistant]
According to breach_notification_2009:

f the findings from the database for the year 2008, categorized by the number of individuals affected by each breach. We chose 2008 because it is the latest year for which we have a full year of data.
## TABLE 3-NUMBER OF BREACHES BY NUMBER OF AFFECTED FOR 2008

| Affected size                                                                                | Data                                                                                | Year 2008                   |
|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
| Unknown ..................................................................................... | Breaches .................................................................................... Affected Individuals .................................................................... | 36 ........................


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 39)

[Assistant]
According to breach_notification_2009:

| ........................ | ........................ | $4,200    |
| Direct Calling Charges @$.07/min × 5 minutes ................. | ........................ | ........................
| 622                            | 1,010,461                          | 1,011,084 |
| Labor cost @$30/hr × 5 min per call .................................. | ........................ | ........................ | 4,445                          | 7,217,580                          | 7,222,025 |
| Total .............................................................................. | 840                              | 3,360                           | 5,067                          | 8,228,041                          | 8,237,309 |

In addition to the cost of the toll-free number and staff time answering calls, we also imputed a cost to the time individuals will spend calling the tollfree number. In estimating the time involved, we assumed that a person will spend five minutes per call. However, the person may not get through the first time and thus may have to call back a second time which could add another 5 minutes. Taking the average between 5 and 10 minutes, we used an average call time of 7.5 minutes. For purposes of imputing cost to an individual's time, we took the mean compensation amount from the Bureau of Labor Statistics of $20.32 for all occupations at http://www.bls.gov/oes/ current/oes \_ nat.htm. Dividing 60 by 7.5 minutes yields 8 calls per hour. Dividing the number of calls per hour into 2,888,804 calls and then multiplying by $20, gives us a cost of $7,222,010. We invite the public to comment on our analysis and assumptions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 210)

[Assistant]
According to privacy_rule_2000:

provisions of the preamble. ## Tribal Law

Comments: One commenter suggested that the consultation process with tribal governments described in the NPRM was inadequate under Executive Order No. 13084.
In addition, the commenter expressed concern that the disclosures for research purposes as permitted by the NPRM would conflict with a number of tribal laws that offer individuals greater privacy rights with respect to research and reflects cultural appropriateness. In particular, the commenter referenced the Health Research Code for the Navajo Nation which creates a entity with broader authority over research conducted on the Navajo Nation than the local IRB and requires informed consent by study participants. Other laws mentioned by the commenter included the Navajo Nation Privacy and Access to Information Act and a similar policy applicable to all health care providers within the Navajo Nation. The

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00139

commenter expressed concern that the proposed regulation research provisions would override these tribal laws. Response: We disagree with the comment that the consultation with tribal governments undertaken prior to the proposed regulation is inadequate under Executive Order No. 13084. As stated in the proposed regulation, the Department consulted with representatives of the National Congress of American Indians and the National Indian Health Board, as well as others, about the proposals and the application of HIPAA to the Tribes, and the potential variations based on the relationship of each Tribe with the IHS for the purpose of providing health services. In addition, Indian and tribal governments had the opportunity to, and did, submit substantive comments on the proposed rules. Additionally, disclosures permitted by this regulation do not conflict with the policies as described by this commenter.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the technical safeguards under HIPAA?

[Assistant]
According to security_rule_2003:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160, 162, and 164 [CMS-0049-F] RIN 0938-AI57

## Health Insurance Reform: Security Standards

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Final rule. SUMMARY: This final rule adopts standards for the security of electronic protected health information to be implemented by health plans, health care clearinghouses, and certain health care providers. The use of the security standards will improve the Medicare and Medicaid programs, and otherFederal health programs and private health programs, and the effectiveness and efficiency of the health care industry in general by establishing a level of protection for certain electronic health information. This final rule implements some of the requirements of the Administrative Simplification subtitle of the Health Insurance Portability andAccountability Act of 1996 (HIPAA). DATES: Effective Date: These regulations are effective on April 21, 2003. Compliance Date: Covered entities, with the exception of small health plans, must comply with the requirements of this final rule by April 21, 2005. Small health plans must comply with the requirements of this final rule by April 21, 2006. FOR FURTHER INFORMATION CONTACT: William Schooler, (410) 786-0089. SUPPLEMENTARY INFORMATION:

## Availability of Copies and Electronic Access

To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 or by faxing to (202) 5122250. The cost for each copy is $10.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 8)

[Assistant]
According to hitech_omnibus_2013:

en applying the Privacy Rule. PSQIA provides for the establishment of PSOs to receive reports of patient safety events or concerns from providers and provide analyses of events to reporting providers.
A reporting provider may be a HIPAA

18:57 Jan 24, 2013

PO 00000

Frm 00006

covered entity and, thus, information reported to a PSO may include protected health information that the PSO may analyze on behalf of the covered provider. The analysis of such information is a patient safety activity for purposes of PSQIA and the Patient Safety Rule, 42 CFR 3.10, et seq. While the HIPAA Rules as written would treat a PSO as a business associate when the PSO was performing quality analyses and other activities on behalf of a covered health care provider, we proposed this change to the definition of ''business associate'' to more clearly align the HIPAA and Patient Safety Rules. ## Overview of Public Comment

Commenters on this topic supported the express inclusion of patient safety activities within the definition of ''business associate.''

## Final Rule

The final rule adopts the proposed modification. ii. Inclusion of Health Information Organizations (HIO), E-Prescribing Gateways, and Other Persons That Facilitate Data Transmission; as Well as Vendors of Personal Health Records

## Proposed Rule

Section 13408 of the HITECH Act provides that an organization, such as a Health Information Exchange Organization, E-prescribing Gateway, or Regional Health Information Organization, that provides data transmission of protected health information to a covered entity (or its business associate) and that requires access on a routine basis to such protected health information must be treated as a business associate for purposes of the Act and the HIPAA Privacy and Security Rules.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 462)

[Assistant]
According to privacy_rule_2000:

Department considers the estimates to be averages across the entire class of health care providers, hospitals, or health plans in question. Underlying all annual cost estimates are growth projections.
For growth in the number of patients, the Department used data from the National Ambulatory Medical Care Survey, the National Hospital Ambulatory Medical Care Survey, the National Home and Hospice Survey, the National Nursing Home Survey, and information from the American Hospital Association. For growth in the number of health care workers, the Department used data from the Bureau of Health Professions in the Department's Health Resources Services Administration (HRSA). For insurance coverage growth (private and military coverage), we used a five-year average

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00306

annual growth rate in employersponsored, individual, military, and overall coverage growth from the Census Bureau's CPS, 1995-1999. To estimate growth in the number of Medicare and Medicaid enrollees, the Department used the enrollment projections of the Health Care Financing Administration's Office of the Actuary. For growth in the number of hospitals, health care providers and health plans, trend rates were derived from the Census Bureau's Statistics of U.S. Businesses, using SIC code-specific five-year annual average growth rate from 1992-1997 (the most recent data available). For wage growth, the Department used the same assumptions made in the Medicare Trustees' Hospital Insurance Trust Fund report for 2000. In some areas, the Department was able to obtain very reliable data, such as survey data from the Statistics of U.S. Businesses and the Medical Expenditures Panel Survey (MEPS). In numerous areas, however, there was too little information or data to support quantitative estimates. As a result, the Department relied on data provided in the public comments or subsequent factfinding to provide a basis for making key assumptions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 39)

[Assistant]
According to hitech_omnibus_2013:

alable and flexible, so that entities of different types and sizes can implement the standards and implementation specifications in a manner that is reasonable and appropriate for their circumstances.
We do not mandate the use of specific technologies, or require uniform policies and procedures for compliance, because we recognize the diversity of regulated entities and appreciate the unique characteristics of their environments. Comment: Two commenters suggested providing subcontractors with additional time to comply with the provisions of the Security Rule. Response: We decline to delay application of the requirements under the Security Rule to subcontractors beyond the compliance dates provided by this final rule. As we emphasized above, the Security Rule already requires covered entities to establish business associate agreements that require business associates to ensure that their subcontractors implement reasonable and appropriate safeguards to protect the security of electronic protected health information they handle. Comment: A few commenters proposed alternative ways to apply security requirements to subcontractors, such as exempting subcontractors from compliance with the Security Rule if they have already completed security

VerDate Mar<15>2010

assessments and met the security requirements under other State and Federal laws or only requiring subcontractors to comply with the minimum necessary standard and to utilize ''reasonable'' security measures with regard to protected health information. Response: We decline to adopt an exemption or otherwise limit subcontractors' responsibility to safeguard individuals' electronic protected health information. To ensure appropriate and strong security protections for electronic protected health information, subcontractors are required to comply with the Security Rule to the same extent as business associates with a direct relationship with a covered entity. ## D.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 115)

[Assistant]
According to hitech_omnibus_2013:

ation where a covered entity or a business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.
For example, if

18:57 Jan 24, 2013

PO 00000

Frm 00076

a covered entity, due to a lack of reasonable safeguards, sends a number of explanations of benefits (EOBs) to the wrong individuals and a few of the EOBs are returned by the post office, unopened, as undeliverable, the covered entity can conclude that the improper addressees could not reasonably have retained the information. The EOBs that were not returned as undeliverable, however, and that the covered entity knows were sent to the wrong individuals, should be treated as potential breaches. As another example, if a nurse mistakenly hands a patient the discharge papers belonging to another patient, but she quickly realizes her mistake and recovers the protected health information from the patient, this would not constitute a breach if the nurse can reasonably conclude that the patient could not have read or otherwise retained the information. With respect to any of the three exceptions discussed above, a covered entity or business associate has the burden of proof, pursuant to §164.414(b) (discussed below), for showing why breach notification was not required. Accordingly, the covered entity or business associate must document why the impermissible use or disclosure falls under one of the above exceptions. ## Overview of Public Comments

Of the approximately 85 public comments received on the interim final rule addressing the definition of breach, approximately 70 of those comments addressed the harm standard and risk assessment approach in the interim final rule. We received approximately 60 comments in support of the harm standard and the risk assessment approach. The commenters in support of this approach included providers, health plans, professional associations, and certain members of Congress.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 63)

[Assistant]
According to nist_sp800-66r2:

ed as altered by unauthorized users or improperly altered by authorized users, is a process in place to respond? • Is this response process tied to organizational incident management processes? |
| 6.
Establish a Monitoring Process to Assess How the Implemented Process is Working       | • Review existing processes to determine whether objectives are being addressed. 136 • Continually reassess integrity processes as technology and operational environments change to determine whether they need to be revised. 137        | • Are there reported instances of information integrity problems? Have they decreased since integrity procedures were implemented? 138 • Does the process, as implemented, provide a higher level of assurance that information integrity is being maintained? |

136 See Sec. 5.1.8, HIPAA Standard: Evaluation. 137 See Sec. 5.1.8, HIPAA Standard: Evaluation. 138 See Sec. 5.1.6, HIPAA Standard: Security Incident Procedures. ## 5.3.4. Person or Entity Authentication (§ 164.312(d)) 139

HIPAA Standard: Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed. Table 24.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 6)

[Assistant]
According to privacy_mod_2002:

es at § 164.514(e). Many also supported the requirement that authorizations notify the individual of marketing that results in direct or indirect remuneration to the covered entity from a third party.
They argued that for patients to make informed decisions, they must be notified of potential financial conflicts of interest. However, some commenters opposed the authorization requirement for marketing, arguing instead for the disclosure and opt-out requirements at §164.514(e) or for a one-time, blanket authorization from an individual for their marketing activities. Commenters were sharply divided on whether the Department had properly defined what is and what is not marketing. Most of those opposed to the Department's proposed definitions objected to the elimination of healthrelated communications for which the covered entity received remuneration from the definition of ''marketing.'' They argued that these communications would have been subject to the consumer protections in § 164.514(e) but, under the proposal, could be made without any protections at all. The mere presence of remuneration raised conflict of interest concerns for these commenters, who feared patients would be misled into thinking the covered entity was acting solely in the patients' best interest when recommending an alternative medication or treatment. Of particular concern to these commenters was the possibility of a third party, such as a pharmaceutical company, obtaining a health care provider's patient list to market its own products or services directly to the patients under the guise of recommending an ''alternative treatment'' on behalf of the provider.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 68)

[Assistant]
According to privacy_mod_2002:

metimes be necessary to continue using and disclosing protected health information even after an individual has revoked his or her authorization in order to preserve the integrity of a research study.
Therefore, the Department has clarified that the reliance exception at § 164.508(b)(5)(i) would permit the continued use and disclosure of protected health information already obtained pursuant to a valid authorization to the extent necessary to preserve the integrity of the research study. A requirement for documentation of IRB or Privacy Board review and approval of the continued use or disclosure of protected health information after an individual's authorization had been revoked could protect patient privacy. However, the Department believes that the additional burden on the IRB or Privacy Board could be substantial, and is not warranted at this time. Comment: A commenter requested clarification that the ''reliance exception'' does not permit covered entities as researchers to continue analyzing data once an individual has revoked his or her authorization. Response: As discussed above, the Department disagrees with this comment. Patient privacy must be balanced against other public goods, such as research and the risk of compromising such research projects if researchers could not continue to use such data. The Department determined that permitting continued uses and disclosures of protected health information already obtained to protect the integrity of research, even after an individual's authorization has been revoked, would pose minimal privacy risk to individuals without compromising research. Comment: Several commenters suggested permitting the proposed authorization requirement for a ''description of each purpose of the requested use or disclosure'' at §164.508 to be sufficiently broad to encompass future unspecified research.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 25)

[Assistant]
According to breach_notification_2009:

iate to temporarily delay a notification, notice, or posting if a law enforcement official states orally that a notification would impede a criminal investigation or cause damage to national security.
However, in this case, the covered entity or business associate is required to document the statement and the identity of the official and delay notification for no longer than 30 days, unless a written statement meeting the above requirements is provided during that time. We interpret these provisions as tolling the time within which notification is required under §§164.404, 164.406, 164.408, and 164.410, as applicable. ## H. Administrative Requirements and Burden of Proof-164.414

Section 164.414(a) requires covered entities to comply with the administrative requirements of §164.530(b), (d), (e), (g), (h), (i), and (j) of the Privacy Rule with respect to the breach notification provisions of this subpart. These provisions, for example, require covered entities and business

15:01 Aug 21, 2009

PO 00000

Frm 00017

associates to develop and document policies and procedures, train workforce members on and have sanctions for failure to comply with these policies and procedures, permit individuals to file complaints regarding these policies and procedures or a failure to comply with them, and require covered entities to refrain from intimidating or retaliatory acts. Thus, a covered entity is required to consider and incorporate the requirements of this subpart with respect to its administrative compliance and other obligations. In addition to §164.414(a), to make clear that these provisions apply to this subpart as well as subpart E, we have made conforming modifications in each of the above sections of the Privacy Rule to include a reference to this subpart D.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 58)

[Assistant]
According to hitech_omnibus_2013:

ady have been renegotiated in good faith to meet the applicable provisions in the HITECH Act, covered entities should review such agreements to determine whether they meet the final rule's provisions.
If

18:57 Jan 24, 2013

PO 00000

Frm 00039

they do not, these covered entities then have the transition period to make whatever additional changes are necessary to conform to the final rule. The transition period is also available to those agreements that require compliance with all applicable laws (to the extent the agreements were otherwise in compliance with the HIPAA Rules prior to this final rule), but that do not fully meet the new requirements in this final rule. However, we do not deem such contracts as compliant beyond the transition period because they would not sufficiently reflect the new requirements. 4. Section 164.508-Uses and Disclosures for Which an Authorization Is Required

a. Sale of Protected Health Information Proposed Rule

Section 164.508 of the Privacy Rule permits a covered entity to use and disclose protected health information for purposes not otherwise permitted by the Rule if it has obtained a valid written authorization from the individual who is the subject of the information. This section also specifies two circumstances in which authorization from the individual must be obtained: (1) Most uses and disclosures of psychotherapy notes; and (2) uses and disclosures for marketing purposes. Section 13405(d) of the HITECH Act added a third circumstance that requires authorization, specifically the sale of protected health information. Section 13405(d)(1) prohibits a covered entity or business associate from receiving direct or indirect remuneration in exchange for the disclosure of protected health information unless the covered entity has obtained an individual's authorization pursuant to § 164.508 that states whether the protected health information can be further exchanged for remuneration by the entity receiving the information.