[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 6)

[Assistant]
According to fda_premarket_2023:

ch a premarket submission is not required (e.g., for 510(k)-exempt devices). This guidance also applies to cyber devices, as defined in section 524B of the FD&C Act, which are a subset of devices.
Generally, the recommendations in this guidance apply to the device constituent part of a combination product 2 (such as drug-device and biologic-device combination products) when the device constituent part presents cybersecurity considerations, 3 including but not limited to

1 For the purposes of this guidance, 'device software function' means a software function that meets the definition of a device in section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act). For the purposes of this guidance, the term 'function' is a distinct purpose of the product, which could be the intended use or a subset of the intended use of the product. For more information, see FDA's guidance 'Multiple Function Device Products: Policy and Considerations.'

2 21 CFR 3.2(e). 3 21 CFR 4.2. ## Contains Nonbinding Recommendations

devices that include a device software function or that contain software (including firmware) or programmable logic. For more information, contact the FDA review division that will have the lead review for the combination product. 4

As IDE submissions have a different benefit-risk threshold and are not marketing authorizations, specific recommendations for IDE submission documentation are provided in Appendix 3. Additionally, Appendix 5 contains terminology used throughout the guidance. ## III. Background

FDA recognizes that medical device cybersecurity is a shared responsibility among interested parties throughout the use environment of the medical device system, including healthcare facilities, patients, healthcare providers, and manufacturers of medical devices.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.522(a)(1) require?

[Assistant]
According to privacy_rule_2000:

§164.522(a)(1)(i)(B), the right to request restrictions applies to disclosures to persons assisting in the individual's care under


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 419)

[Assistant]
According to privacy_rule_2000:

contract between a covered entity and its business associate should stipulate that the business associate is required to amend protected health information in accordance with the amendment provisions.
Otherwise, these commenters argued, there would be a gap in the individual's right to have erroneous information corrected, because the covered entity could deny a request for amendment of information created by a business associate. Response: We agree that information created by the covered entity or by the covered entity's business associates should be subject to amendment. This requirement is consistent with the requirement to make information created by a business associate available for inspection and copying. We have revised the rule to require covered entities to specify in the business associate contract that the business associate will make protected health information available for amendment and will incorporate amendments accordingly. (See § 164.504(e).)

Comment: One commenter argued that covered entities should be required to presume information must be corrected where an individual informs the entity that an adjudicative process has made a finding of medical identity theft. Response: Identity theft is one of many reasons why protected health information may be inaccurate, and is one of many subjects that may result in an adjudicative process relevant to the accuracy of protective health information. We believe that this provision accommodates this situation without a special provision for identity theft. Comment: Some commenters asserted that the proposed rule's requirement that action must be taken on individuals' requests within 60 days of the receipt of the request was unreasonable and burdensome. A few commenters proposed up to three 30day extensions for ''extraordinary'' (as defined by the entity) requests. Response: We agree that 60 days will not always be a sufficient amount of time to adequately respond to these requests.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 8)

[Assistant]
According to fda_premarket_2023:

ions. The quality systems requirements are found in the QS regulation in 21 CFR Part 820. Depending on the device, QS requirements may be relevant at the premarket stage, postmarket stage, 15 or both.
In the premarket context, in order to demonstrate a reasonable assurance of safety and effectiveness for certain devices with cybersecurity risks, documentation outputs related to the ongoing requirements of the QS regulation may be one source of documentation to include as

13  While section 524B(b)(4) of the FD&C Act authorizes FDA to promulgate additional cybersecurity requirements via regulation, FDA is not required to promulgate a regulation to elaborate on the new requirements specified in section 524B of the FD&C Act. 14 In addition to the cybersecurity requirements set forth in section 524B(b) of the FD&C Act, section 524B(b)(4) of the FD&C Act requires cyber device manufacturers to comply with any other such requirements FDA sets forth in regulations 'to demonstrate reasonable assurance that the device and related systems are cybersecure.'

15 In the postmarket context, design controls may also be important to ensure medical device cybersecurity and maintain medical device safety and effectiveness. FDA recommends that device manufacturers implement comprehensive cybersecurity risk management programs and documentation consistent with the QS regulation, including but not limited to complaint handling (21 CFR 820.198), quality audit (21 CFR 820.22), corrective and preventive action (21 CFR 820.100), software validation and risk analysis (21 CFR 820.30(g)), and servicing (21 CFR 820.200). ## Contains Nonbinding Recommendations

part of the premarket submission. 16 This guidance is intended to explain how such documentation that may be relevant for QS regulation compliance can also be used to show how a sponsor or manufacturer is addressing cybersecurity considerations relevant to a device.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 51)


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 112)

[Assistant]
According to privacy_mod_2002:

M\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

replaced with the word ''specifications.''

## IV. Final Regulatory Impact Analysis

Federal law (5 U.S.C. 804(2), as added by section 251 of Pub. L. No.
104-21), specifies that a ''major rule'' is any rule that the Office of Management and Budget finds is likely to result in:

- A major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies, or geographic regions; or
- An annual effect on the economy of $100 million or more;
- Significant adverse effects in competition, employment, investment productivity, innovation, or on the ability of United States based enterprises to compete with foreignbased enterprises in domestic and export markets. The impact of the modifications adopted in this rulemaking will have an annual effect on the economy of at least $100 million. Therefore, this Rule is a major rule as defined in 5 U.S.C. 804(2). Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects; distributive impacts; and equity). According to Executive Order 12866, a regulatory action is ''significant'' if it meets any one of a number of specified conditions, including having an annual effect on the economy of $100 million or more, adversely affecting in a material way a sector of the economy, competition, or jobs, or if it raises novel legal or policy issues. The purpose of the regulatory impact analysis is to assist decisionmakers in understanding the potential ramifications of a regulation as it is being developed. The analysis is also intended to assist the public in understanding the general economic ramifications of the regulatory changes.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the administrative safeguards under HIPAA?

[Assistant]
According to nist_sp800-66r2:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 147)

[Assistant]
According to hitech_omnibus_2013:

sures, and to only use or disclose genetic information as required or expressly permitted by the Rule, or as otherwise authorized by the individual who is the subject of the genetic information. ## 2.
Section 160.101-Statutory Basis and Purpose

We have revised § 160.101, which describes the statutory basis of the HIPAA Rules, to include a reference to section 1180 of the Social Security Act,

VerDate Mar<15>2010

as added by section 105 of GINA (Pub. L. 110-233). ## 3. Section 160.103-Definitions

The final rule modifies § 160.103 of the Privacy Rule to: (1) Revise the definition of ''health information'' to make clear that the term includes ''genetic information;'' (2) add definitions for the GINA-related terms of ''family member,'' ''genetic information,'' ''genetic services,'' ''genetic test,'' and ''manifestation or manifested;'' and (3) make technical corrections to the definition of ''health plan.'' With respect to the GINA-related terms, the final rule adopts definitions that are generally consistent with the definitions of such terms promulgated in the implementing regulations for sections 101-103 of GINA. This will facilitate compliance for those health plans subject to both the privacy as well as the nondiscrimination provisions of GINA. a. Definition of ''Health information'' Proposed Rule

Prior to enactment of GINA, the Department issued guidance that genetic information is health information protected by the Privacy Rule to the extent that such information is individually identifiable and held by a covered entity (subject to the general exclusions from the definition of ''protected health information''). 17 Section 105 of GINA requires the Secretary to revise the Privacy Rule to make clear that genetic information is health information under the Rule. Thus, the Department proposed to modify the definition of ''health information'' at § 160.103 to explicitly provide that such term includes genetic information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 342)

[Assistant]
According to privacy_rule_2000:

NPRM provision allowing disclosure without authorization to coroners and medical examiners. Response: The final rule retains the NPRM's basic approach to disclosure of coroners and medical examiners.
It allows covered entities to disclose protected health information without authorization to coroners and medical examiners, for identification of a deceased person, determining cause of death, or other duties authorized by law. Comment: In the preamble to the NPRM, we said we had considered but rejected the option of requiring covered entities to redact from individuals' medical records any information identifying other persons before disclosing the record to a coroner or medical examiner. We solicited comment on whether health care providers routinely identify other persons specifically in an individual's medical record and if so, whether in the final rule we should require health care providers to redact information about the other person before providing it to a coroner or medical examiner. A few commenters said that medical records typically do not include information about persons other than the patient. One commenter said that patient medical records occasionally reference others such as relatives or employers. These commenters recommended requiring redaction of such information in any report sent to a coroner or medical examiner. On the other hand, other commenters said that redaction should not be required. These commenters generally based their recommendation on the burden and delay associated with redaction. In addition to citing the complexity and time involved in redaction of medical records provided to coroners, one commenter said that health plans and covered health care providers were not trained to determine the identifiable information necessary for coroners and medical examiners to do thorough investigations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 465)

[Assistant]
According to privacy_rule_2000:

hey will be of comparable responsibility, and therefore comparable pay, in larger institutions. The initial year cost for privacy officials will be $723 million; the tenyear cost will be $5.9 billion.
## Internal Complaints

The final rule requires each covered entity to have an internal process to allow an individual to file a complaint concerning the covered entity's compliance with its privacy policies and procedures. The requirement includes designating a contact person or office responsible for receiving complaints and documenting the disposition of them, if any. This function may be performed by the privacy official, but because it is a distinct right under the final rule and may be performed by someone else, we are costing it separately. The covered entity only is required to receive and document a complaint (no response is required), which we assume will take, on average, ten minutes (the complaint can be oral or in writing). The Department believes that such complaints will be uncommon. We have assumed that one in every thousand patients will file a complaint, which is approximately 10.6 million complaints over ten years. Based on a weightedaverage hourly wage of $47.28 at ten minutes per complaint, the cost of this policy is $6.6 million in the first year. Using wage growth and patient growth assumptions, the cost of this policy is $103 million over ten years. ## Disclosure Tracking and History

The final rule requires providers to be able to produce a record of all disclosures of protected health information, except in certain circumstances. The exceptions include disclosures for treatment, payment, health care operations, or disclosures to an individual. This requirement will require a notation in the record (electronic or paper) of when, to whom, and what information was disclosed, as well as the purpose of such disclosure or a copy of an individual's written authorization or request for a disclosure.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 89)

[Assistant]
According to privacy_mod_2002:

ce acknowledgment requirement be modified to allow for an individual's oral acknowledgment of the notice, so long as the provider maintained a record that the individual's acknowledgment was obtained.
Some commenters did not support the proposal's written notice acknowledgment as a suitable alternative to the consent requirement, stating that such a requirement would not provide individuals with

19:04 Aug 13, 2002

PO 00000

Frm 00059

comparable privacy protections or rights. It was stated that there are a number of fundamental differences between a consent and an acknowledgment of the notice. For example, one commenter argued that asking individuals to acknowledge receipt of the notice does not provide a comparable ''initial moment'' between the provider and the individual, especially when the individual is only asked to acknowledge receipt of the notice, and not whether they have read or understood it, or have questions. Further, commenters argued that the notice acknowledgment process would not be the same as seeking the individual's permission through a consent process. Some of these commenters urged that the Department retain the consent requirements and make appropriate modifications to fix the known operational problems associated with the requirement. A few commenters urged that the Department strengthen the notice acknowledgment process. Some commenters suggested that the Department do so by eliminating the ''good faith'' aspect of the standard and simply requiring certain health care providers to obtain the written acknowledgment, with appropriate exceptions for emergencies and other situations where it may not be practical to do so. It was also suggested that the Department require providers to ensure that the consumer has an understanding of the information provided in the notice.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 277)

[Assistant]
According to privacy_rule_2000:

hem from the authorized disclosures in the contract. In addition, the commenter expressed concern that the proposal did not authorize business partners and their employees to engage in whistleblowing.
The commenter concluded that this omission was unintended since the proposal's provision at proposed §164.518(c)(4) relieved the covered entity, covered entity's employees, business partner, and the business partner's employees from liability for disclosing protected health information to law enforcement and to health oversight agencies when reporting improper activities, but failed to specifically authorize business partners and their employees to engage in whistleblowing in proposed §164.510(f), ''Disclosures for law enforcement.''

Response: Under our statutory authority, we cannot directly regulate entities that are not covered entities; thus, we cannot regulate most business associates, or 'authorize' them to use or disclose protected health information. We agree with the result sought by the commenter, and accomplish it by ensuring that such whistle blowing disclosures by business associates and others do not constitute a violation of this rule on the part of the covered entity. Comment: Some commenters suggested that the need to terminate contracts that had been breached would be particularly problematic when the contracts were with single-source business partners used by health care providers. For example, one commenter explained that when the Department awards single-source contracts, such as to a Medicare carrier acting as a fiscal intermediary that then becomes a business partner of a health care provider, the physician is left with no viable alternative if required to terminate the contract. Response: In most cases, we expect that there will be other entities that could be retained by the covered entity as a business associate to carry out those functions on its behalf or provide the necessary services.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 48)

[Assistant]
According to privacy_mod_2002:

nt believes that narrowing the definition of ''health care operations'' will place serious burdens on covered entities and impair their ability to conduct legitimate business and management functions.
Comment: Some commenters requested that the regulation text state more specifically that a voluntary consent cannot substitute for an authorization when an authorization is otherwise required under the Privacy Rule. Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

Response: The Department agrees and modifies the regulation text, at §164.506(b)(2), to make this clear. As stated in the preamble to the NPRM, the Department intends to enforce strictly the requirement for obtaining an individual's authorization, in accordance with § 164.508, for uses and disclosures of protected health information for purposes not otherwise permitted or required by the Privacy Rule. A consent obtained voluntarily would not be sufficient to permit a use or disclosure which, under the Privacy Rule, requires an authorization or is otherwise expressly conditioned under the Rule. For example, a consent under §164.506 could not be obtained in lieu of an authorization required by §164.508 or a waiver of authorization by an IRB or Privacy Board under §164.512(i) to disclose protected health information for research purposes. Comment: Some commenters requested that, if the Department decides to allow consent on a voluntary basis, the Privacy Rule include requirements for those covered entities that voluntarily choose to obtain consents. Response: The goal of the NPRM approach was to enhance flexibility for covered entities by allowing them to design a consent process that best matches their needs. The Department learned over the past year that no single consent process works for all covered entities.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 145)

[Assistant]
According to privacy_rule_2000:

of an individual may exercise the rights of the individual, including the right to inspect and copy protected health information about the individual that is relevant to such person's representation.
The provision permits covered entities to refuse to treat a personal representative as the individual, generally, if the covered entity has a reasonable belief that the individual has been or will be subjected to domestic violence, abuse or neglect by the personal representative, or that treating the personal representative as the individual may endanger the individual and, in its professional judgment, the covered entity decides that it is not in the best interest of the individual to treat such person as the personal representative. In addition to that provision, we add a new provision at § 164.524(a)(3)(iii) to clarify that a covered entity may deny a request to inspect or copy protected health information if the information is requested by a personal representative of the individual and a licensed health care professional has determined that, in the exercise of professional judgment, such access is reasonably likely to cause substantial harm to the individual who is the subject of the information or to another person. The health care professional need not have a reasonable belief that the personal representative has abused or neglected the individuals and the harm that is likely to result need not be limited to the individual who is the subject of the requested protected health information. Therefore, a covered entity can recognize a person as a personal representative but deny such person access to protected health information as a personal representative. We do not intend these provisions to create a legal duty for the covered entity to review all of the relevant protected health information before releasing it. Rather, we are preserving the flexibility and judgment of covered entities to deny access under appropriate circumstances.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the differences between covered entity and business associate obligations under HIPAA?

[Assistant]
According to 45cfr162:

[Skip to main content](#main-content)

Menu

[![GovInfo logo](/media/GovInfo_logo_gray.png)](/)
[Search](#searchHolder)

* Browse
  + [A to Z](/browse-a-z)
  + [Category](/app/browse/category)
  + [Date](/app/browse/date)
  + [Committee](/browse/committee)
  + [Author](/app/browse/author)
* About
  + [About](/about)
  + [Policies](/about/policies)
  + [Authentication](/about/authentication)
  + [Digital Preservation](/about/digital-preservation)
  + [History](/about/history)
  + [Agency Submission](/about/agency-submission)
  + [U.S. Government Information](/about/us-gov-info)
  + [FDsys Retirement](/about#fdsys-transition)
* Developers
  + [Developer Hub](/developers)
  + [API](https://api.govinfo.gov/docs)
  + [Bulk Data Repository](%20/bulkdata)
  + [Link Service](/link-docs)
  + [Feeds](/feeds)
  + [Sitemaps](/sitemaps)
  + [System Design](/developers/system-design)
* Features
  + [All Features](/features)
  + [Featured Content](/features/featured-content)
  + [News](/features/news)
  + [Release Notes](/features/release-notes)
  + [Finding Publications](/features/finding-publications)
* Help
  + [Help](/help)
  + [Finding Information](%20/help/finding-info)
  + [What's Available](/help/whats-available)
  + [Tutorials and Handouts](/help/tutorials-handouts)
  + [Other Resources](%20/help/other-resources)
* Feedback
  + [Submit Feedback](https://www.surveymonkey.com/r/govinfo-feedback-survey)
  + [Contact Us](/contact)

* [Toggle the Search Widget
  Search](#searchHolder)

# Page Not Found

![Icon: Share using Facebook](/sites/default/files/fb-icon-white.png)
![Icon: Share using Email](/sites/default/files/email-icon-white.png)
![Icon: Copy Link URL](/sites/default/files/link-icon-white.png)

[Help](/help/other)

---

**Error occurred.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 122)

[Assistant]
According to privacy_rule_2000:

e members be available to serve in assignments throughout the world. The final rule permits disclosures to officials who need protected health information to determine availability for duty worldwide.
Section 101(b)(5) of the Foreign Service Act requires the Department of State to mitigate the impact of hardships, disruptions, and other unusual conditions on families of Foreign Service Officers. Section 904 requires the Department to establish a health care program to promote and maintain the physical and mental health of Foreign Service member family members. The final rule permits disclosure of protected health information to officials who need protected health information for a family member to accompany a Foreign Service member abroad. This exemption does not permit the disclosure of specific medical conditions, diagnoses, or other specific medical information. It permits only the disclosure of the limited information needed to determine whether the individual should be granted a security clearance or whether the Foreign Service member of his or her family members should be posted to a certain overseas assignment. ## Application to Correctional Facilities

The NPRM would have excluded the individually identifiable health information of correctional facility inmates and detention facility detainees from the definition of protected health information. Thus, none of the NPRM's

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

proposed privacy protections would have applied to correctional facility inmates or to detention facility detainees while they were in these facilities or after they had been released. The final rule takes a different approach.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 167)

[Assistant]
According to hitech_omnibus_2013:

e those costs. The interim final rule estimated that it would cost approximately $240 to publish a public notice in a newspaper. Assuming the covered entity will publish two notices, the cost is $480.
32 This number includes all individuals affected by breaches involving 500 or more individuals

VerDate Mar<15>2010

Multiplying this amount by the 1,190 estimated breaches yields $571,200. Also, as noted in the interim final rule, if a HIPAA covered entity has a Web site, we assume there will be no cost to post the notice to the Web site. We believe this overestimates the overall cost of publishing a notice, as many covered entities will elect to post the public notice only on their Web site, and not in a newspaper. As outlined in the interim final rule, the cost of setting up a toll-free phone number is a straight forward process of contacting any one of a number of service providers who offer toll-free service. The interim final rule found that the prices for toll-free service range from $0.027 per minute for a basic mail box arrangement to $0.07 per minute. A major, national phone service company offers toll-free service for $15 per month per toll-free number and per minute charge of $0.07. There is a one-time charge of $15. As in the interim final rule, we use the costs of $15 per month plus $15 activation fee and $0.07 per minute. Since the regulation requires providers to maintain a toll-free number for three months, the monthly charge plus initial fee per breach will be $60. To estimate the number of calls to the toll-free number, the interim final rule assumed that more individuals than those affected by the breach requiring substitute notice would call out of concern that their protected health information might have been compromised. The interim final rule estimated that a number equal to all affected individuals of all breaches would call the toll-free number.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 508)

[Assistant]
According to privacy_rule_2000:

(B). Protected health information means individually identifiable health information:

- (1) Except as provided in paragraph (2) of this definition, that is:
2. (i) Transmitted by electronic media;
3.
(ii) Maintained in any medium described in the definition of electronic media at § 162.103 of this subchapter; or
4. (iii) Transmitted or maintained in any other form or medium. - (2) Protected health information excludes individually identifiable health information in:
6. (i) Education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. 1232g; and
7. (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv). Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. Public health authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 547)

[Assistant]
According to privacy_rule_2000:

losure for purposes of that project, provided that the covered entity complies with all limitations placed by the consent, authorization, or other express legal permission obtained from an individual.
(ii) If the consent, authorization, or other express legal permission obtained from an individual is a general consent to participate in the project, and a covered entity is conducting or participating in the research, such covered entity may, with respect to protected health information that it created or received as part of the project before or after the applicable compliance date of this subpart, make a use or disclosure for purposes of that project, provided that the covered entity complies with all limitations placed by the consent, authorization, or other express legal permission obtained from an individual. (4) If, after the applicable compliance date of this subpart, a covered entity agrees to a restriction requested by an individual under § 164.522(a), a subsequent use or disclosure of

Frm 00368

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

protected health information that is subject to the restriction based on a consent, authorization, or other express legal permission obtained from an individual as given effect by paragraph (b) of this section, must comply with such restriction. ## §164.534 Compliance dates for initial implementation of the privacy standards. - (a) Health care providers. A covered health care provider must comply with the applicable requirements of this subpart no later than February 26, 2003. - (b) Health plans. A health plan must comply with the applicable requirements of this subpart no later than the following date, as applicable:

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00369

Fmt 4701

Sfmt 4700

- (1) Health plans other than small health plans -February 26, 2003. - (2) Small health plans -February 26, 2004. 3. (c) Health care clearinghouses.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 43)

[Assistant]
According to nist_sp800-66r2:

---------------------------------------------------------------------------|
|                  | • Have the results of each test been documented and any problems with the test reviewed and corrected?
• If full testing is infeasible, has a tabletop scenario (e.g., a classroom-like exercise) been considered? • How frequently will the plan be tested (e.g., annually)? • When should the plan be revised? |

## 5.1.8. Evaluation (§ 164.308(a)(8)) 78

HIPAA Standard: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart. Table 15.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 331)

[Assistant]
According to privacy_rule_2000:

e intrusive in state functions. At least one commenter argued that the requirement for prior process places unreasonable restrictions on the right of the states to regulate law enforcement activities.
Response: This rule regulates the ability of health care clearinghouses, health plans, and covered health care providers to use and disclose health information. It does not regulate the behavior of law enforcement officials or the courts, nor does it prevent states from regulating law enforcement officials. All regulations have some effects on entities that are not directly regulated. We have considered those effects in this instance and have determined that the provisions of the rule are necessary to protect the privacy of individuals. Comment: One commenter argued that state licensing boards should be exempt from restrictions placed on law enforcement officials, because state licensing and law enforcement are different activities. Response: Each state's law determines what authorities are granted to state licensing boards. Because state laws differ in this regard, we cannot make a blanket determination that state licensing officials are or are not law enforcement officials under this regulation. We note, however, that the oversight of licensed providers generally is included as a health oversight activity at § 164.512(d). ## Relationship to Existing Rules and Practices

Comment: Many commenters expressed concern that the proposed rule would have expanded current law enforcement access to protected health information. Many commenters said that the NPRM would have weakened their current privacy practices with respect to law enforcement access to health records.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 472)

[Assistant]
According to privacy_rule_2000:

hours for hospitals and health plans. The larger figure for hospitals and health plans reflects the fact that they are likely to have a more extensive array of relationships with business associates.
The cost for the changes in business associate contracts is estimated to be $103 million. This will be an initial year cost only because the Department assumes that this contract language will become standard in future contracts. In addition, the Department has estimated the cost for business associates to comply with the minimum necessary provisions. As part of the minimum necessary provisions, covered entities will have to establish policies to ensure that only the minimum necessary protected health information is shared with business associates. To the extent that data are exchanged, covered entities will have to review the data and systems programs to assure compliance. For non-hospital providers, we estimate that the first year will require an average of three hours to review existing agreements, and thereafter, they will require an additional hour to assure business associate compliance. We estimate that hospitals will require an additional 200 hours the first year and 16 hours in subsequent years; health plans will require an additional 112 hours the first year and 8 hours in subsequent years. As in other areas, we have assumed a weighted average wage for the respective sectors. The cost of the covered entities assuring business associates' complying with the minimum necessary is $197 million in the first year, and a total of $697 million over ten years. (These estimates include the both the cost for the covered entity and the business associates.)

## Inspection and Copying

In the NPRM estimate, inspection and copying were a major cost. Based on data and information from the public comments and further fact-finding, however, the Department has re- estimated these policies and found them to be much less expensive.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 178)

[Assistant]
According to privacy_rule_2000:

usively provide health insurance, even if limited in scope. Comment: One commenter recommended that the Secretary clarify that ''health plan'' does not include property and casualty benefit providers.
The commenter stated that the clarifying language is needed given the ''catchall'' category of entities defined as ''any other individual plan or group health plan, or combination thereof, that

Frm 00117

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

provides or pays for the cost of medical care,'' and asserted that absent clarification there could be serious confusion as to whether property and casualty benefit providers are ''health plans'' under the rule. Response: We agree and as described above have added language to the final rule to clarify that the ''excepted benefits'' as defined under 42 U.S.C. 300gg-91(c)(1), which includes liability programs such as property and casualty benefit providers, are not health plans for the purposes of this rule. Comment: Some commenters recommended that the Secretary replace the term ''medical care'' with ''health care.'' It was observed that ''health care'' was defined in the proposal, and that this definition was used to define what a health care provider does. However, they observed that the definition of ''health plan'' refers to the provision of or payment for ''medical care,'' which is not defined. Another commenter recommended that HHS add the parenthetical phrase ''as such term is defined in section 2791 of the Public Health Service Act'' after the phrase ''medical care.''

Response: We disagree with the first recommendation. We understand that the term ''medical care'' can be easily confused with the term ''health care.'' However, the two terms are not synonymous. The term ''medical care'' is a statutorily defined term and its use is critical in making a determination as to whether a health plan is considered a ''health plan'' for purposes of administrative simplification.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 170)

[Assistant]
According to hitech_omnibus_2013:

ion revised NPPs over and above their existing printing obligations (4/12 × 613 million = 204 million). Printing costs for 204 million NPPs will be $20.4 million (204 million × $0.10 = $20.4 million).
Therefore, the total cost for providers is approximately $40.4 million ($20 million + $20.4 million = $40.4 million). For health plans, the costs related to the NPP consist of developing and drafting the revised NPP, and, for certain health plans, the costs of printing and mailing the notice out-ofcycle because the revision is a material change. See § 164.520(c)(1)(v)(A). With the exception of a few large health plans, most health plans do not selfadminister their plans. Most plans are either health insurance issuers (approximately 730) or utilize third party administrators that act on their behalf in the capacity of business associates. We identified approximately 750 third party administrators acting as business associates for ERISA plans. We

37 We identified 698,238 entities that must prepare and deliver NPPs that are shown in Table 1 above. This includes 696,758 HIPAA covered entities that are health care providers, including hospitals, nursing facilities, doctor offices, outpatient care centers, medical diagnostic, imaging service, home health service and other ambulatory care service covered entities, medical equipment suppliers, and pharmacies. For the purposes of our calculation, we have rounded this number to 697,000. Table 1 also includes 730 health insurance carriers and 750 third party administrators working on behalf of covered health plans. The cost estimates for these entities are addressed later. 18:57 Jan 24, 2013

PO 00000

Frm 00111

have revised our earlier estimate of 3,500 third party administrators after learning that the majority of these entities act as welfare administrators and do not administer health plans. In addition, some public non-Federal health plans may use third party administrators.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.514(e)(3)(ii) require?

[Assistant]
According to privacy_mod_2002:

§164.514(e)(3)(ii) to make clear that a covered entity may engage a business associate to create a limited data set, in the same way it can use a business associate to create de-identified data. As with de-identified data, a business associate relationship arises even if the limited data set is not being created for the covered entity's own use. For instance, if a researcher needs county data, but the covered entity's data contains only the postal address of the individual, a business associate may be used to convert the covered entity's geographical information into that needed by the researc


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 57)

[Assistant]
According to security_rule_2003:

the entire customer base. ## 4. System Vendors

Systems vendors that provide computer software applications to health care providers and other billers of health care services would likely be affected.
These vendors would have to develop software solutions that would allow health plans, providers, and other users of electronic transactions to protect these transactions and the information in their databases from unauthorized access to their systems. Their costs would also probably be passed along to their customer bases. ## F. Factors in Establishing the Security Standard

## 1. General Effect

In assessing the impact of these standards, it is first necessary to focus on the general nature of the standards, their scalability, and the fact that they are not dependent upon specific technologies. These factors will make it possible for covered entities to implement them with the least possible impact on resources. Because there is no national security standard in widespread use throughout the industry, adopting any of the candidate standards would require most health care providers, health plans, and health care clearinghouses to at least conduct

17:54 Feb 19, 2003

PO 00000

Frm 00040

an assessment of how their current security measures conform to the new standards. However, we assume that most, if not all, covered entities already have at least some rudimentary security measures in place. Covered entities that identify gaps in their current measures would need to establish or revise their security precautions. It is also important to note that the standards specify what goals are to be achieved, but give the covered entity some flexibility to determine how to meet those goals. This is different from the transaction standards, where all covered entities must use the exact same implementation guide. With respect to security, covered entities will be able to blend security processes now in place with new processes. This should significantly reduce compliance costs.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 4)

[Assistant]
According to breach_notification_2009:

although that covered entity may be in compliance with the Security Rule, following a breach of this information, the covered entity would have to provide breach notification to affected individuals.
For example, a covered entity that has a large database of protected health information may choose, based on their risk assessment under the Security Rule, to rely on firewalls and other access controls to make the information inaccessible, as opposed to encrypting the information. While the Security Rule permits the use of firewalls and access controls as reasonable and appropriate safeguards, a covered entity that seeks to ensure breach notification is not required in the event of a breach of the information in the database would need to encrypt the information pursuant to the guidance. We also received several comments asking for clarification and additional detail regarding the forms of information and the specific devices and protocols described in the guidance. As a result, we provide clarification regarding the forms of information addressed in the National Institute of Standards and Technology (NIST) publications referenced in the guidance. We clarify that ''data in motion'' includes data that is moving through a network, including wireless transmission, whether by e-mail or structured electronic interchange, while ''data at rest'' includes data that resides in databases, file systems, flash drives, memory, and any other structured storage method. ''Data in use'' includes data in the process of being created, retrieved, updated, or deleted, and ''data disposed'' includes discarded paper records or recycled electronic media. Additionally, many commenters suggested that access controls be included in the guidance as a method for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] How should organizations implement physical controls?

[Assistant]
According to fda_premarket_2023:

## Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

## Guidance for Industry and Food and Drug Administration Staff

Document issued on June 27, 2025. A draft select update to this document was issued on March 13, 2024. This document supersedes 'Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,' issued September 27, 2023. For questions about this document regarding CDRH-regulated devices, contact CyberMed@fda.hhs.gov. For questions about this document regarding CBER-regulated devices, contact the Office of Communication, Outreach, and Development (OCOD) at 1-800-835-4709 or 240-402-8010, or by email at industry.biologics@fda.hhs.gov. <!-- image -->

U.S. Department of Health and Human Services Food and Drug Administration Center for Devices and Radiological Health Center for Biologics Evaluation and Research

## Public Comment

You may submit electronic comments and suggestions at any time for Agency consideration to https://www.regulations.gov. Submit written comments to the Dockets Management Staff, Food and Drug Administration, 5630 Fishers Lane, Room 1061, (HFA-305), Rockville, MD 20852. Identify all comments with the docket number FDA-2021-D-1158. Comments may not be acted upon by the Agency until the document is next revised or updated. ## Additional Copies

## CDRH

Additional copies are available from the Internet. You may also send an email request to CDRH-Guidance@fda.hhs.gov to receive a copy of the guidance. Please include the document number GUI00001825 and complete title of the guidance in the request.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 30)

[Assistant]
According to hitech_omnibus_2013:

the amount of a civil money penalty within the penalty range. The Department did not propose to modify the Secretary's discretion in how to apply the factors-i.e., as either mitigating or aggravating.
## Overview of Public Comments

We received one comment requesting that the Department limit the number of mitigating factors it will consider when determining penalty amounts and apply

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with civil money penalties in every case of noncompliance, including where resolution and compliance have been achieved by informal means. The commenter also argued that a covered entity's or business associate's financial condition or financial difficulties should not be considered as mitigating factors in determining the amount of civil money penalties. The commenter recommended that penalties should apply to all violators except those who despite due diligence could not discover the violation, who reported the violation immediately, and who fully corrected the problem within 30 days of discovery. We received two comments in support of considering reputational harm in the computation of civil money penalties. One commenter emphasized that reputational harm addresses harm to individuals' dignity interest and recommended the inclusion of ''other'' harm as well. However, another covered entity expressed concern that damages for reputational harm are difficult to quantify and, therefore, claims might lead to protracted litigation and expensive settlements, ultimately increasing the costs of health care. Finally, we received one comment requesting examples of situations involving a cognizable claim of reputational harm. We also received several comments requesting that the Department continue to consider the degree of culpability when determining the amount of a civil money penalty.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 253)

[Assistant]
According to privacy_rule_2000:

ER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

require authorization. The relationship between the covered entity and the TPA may be subject to the business associate requirements of §§ 164.502 and 164.504.
Disclosures by covered entities to plan sponsors, including employers, for the purpose of plan administration are addressed in § 164.504. Comment: Commenters suggested that as disease management is defined only as an element of treatment, it could only be carried out by health care providers, and not health plans. They opposed this approach because health plans also conduct such programs, and are indeed required to do it by accreditation standards and HCFA Managed Care Organization standards. Response: We agree that the placement of disease management in the proposed definition of treatment suggested that health plans could not conduct such programs. We revise the final rule to clarify that health plans may conduct population based care management programs as a health care operation activity. Comment: Some commenters stated that the rule should require that disease management only be done with the approval of the treating physician or at least with the knowledge of the physician. Response: We disagree with this comment because we do not believe that this privacy rule is an appropriate venue for setting policies regarding the management of health care costs or treatment. Comment: Some industry groups stated that if an activity involves selling products, it is not disease management. They asked for a definition that differentiates use of information for the best interests of patient from uses undertaken for ''ulterior purposes'' such as advertising, marketing, or promoting separate products. Response: We eliminate the definition of ''disease management'' from the rule. Often however, treatment decisions involve discussing the relevant advantages and disadvantages of products and services.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.520(c)(1)(v) require?

[Assistant]
According to hitech_omnibus_2013:

§164.520(c)(1)(v)(A). We anticipate that most, if not all, affected entities will take advantage of this option and will not send the NPP in a separate mailing. As such, we expect that the vast majority of health insurers will not incur any out-of-cycle NPP dissemination costs.

Nonetheless, to account for any costs that might be incurred by a small

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with minority of health insurers to distribute the revised NPPs in a separate mailing, we have calculated the costs to these entities of doing so. We describe


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 16)

[Assistant]
According to privacy_mod_2002:

ification were concerned that a covered entity may abuse its access to the individually identifiable health information in its employment records by using that information for discriminatory purposes.
Many commenters expressed concern that an employee's health information created, maintained, or transmitted by the covered entity in its health care capacity would be considered an employment record and, therefore, would not be considered protected health information. Some of these commenters argued for the inclusion of special provisions, similar to the ''adequate separation'' requirements for disclosure of protected health information from group health plan to plan sponsor functions (§ 164.504(f)), to heighten the protection for an employee's individually identifiable health information when moving between a covered entity's

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

health care functions and its employer functions. A number of commenters also suggested types of records that the Department should consider to be ''employment records'' and, therefore, excluded from the definition of ''protected health information.'' The suggested records included records maintained under the FMLA or the Americans with Disabilities Act (ADA), as well as records relating to occupational injury, disability insurance eligibility, sick leave requests and justifications, drug screening results, workplace medical surveillance, and fitness-for-duty test results. One commenter suggested that health information related to professional athletes should qualify as an employment record. Final Modifications.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 293)

[Assistant]
According to privacy_rule_2000:

thorizations described in §§ 164.506 and 164.508 should not be construed as waivers of a patient's evidentiary privilege. See the discussions under § 164.506 and ''Relationship to Other Laws,'' above.
VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

## Research Information Unrelated to Treatment

## Definition of Research Information Unrelated to Treatment

Comment: The majority of commenters, including many researchers and health care providers, objected to the proposed definition of research information unrelated to treatment, asserting that the privacy rule should not distinguish research information unrelated to treatment from other forms of protected health information. Even those who supported the proposed distinction between research information related and unrelated to treatment suggested alternative definitions for research information unrelated to treatment. A large number of commenters were concerned that the definition of research information unrelated to treatment was vague and unclear and, therefore, would be difficult or impossible to apply. These commenters asserted that in many instances it would not be feasible to ascertain whether research information bore some relation to treatment. In addition, several commenters asserted that the need for distinguishing research information unrelated to treatment from other forms of protected health information was not necessary because the proposed rule's general restrictions for the use and disclosure of protected health information and the existing protections for research information were sufficiently strong. Of the commenters who supported the proposed distinction between research information related and unrelated to treatment, very few supported the proposed definition of research unrelated to treatment.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 437)

[Assistant]
According to privacy_rule_2000:

procedures. It does not apply to medical records. Comments: Comments on the six year retention period were mixed. Some commenters endorsed the six-year retention period for maintaining documentation.
One of the comments stated this retention period would assist physicians legally. Other commenters believed that the retention period would be an undue burden. One commenter noted that most State Board of Pharmacy regulations require

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

pharmacies to keep records for two years, so the six year retention period would triple document retention costs. Response: We established the retention period at six years because this is the statute of limitations for the civil monetary penalties. This rule does not apply to all pharmacy records, but only to the documentation required by this rule. ## Section 164.530(k)-Group Health Plans

There were no comments directly about this section because it was not included in the proposed rule. ## Section 164.532-Transition Provisions

Comment: Commenters urged the Department to clarify whether the ''reach of the transition requirement'' is limited to a particular time frame, to the provider's activities in a particular job, or work for a particular employer. For example, one commenter questioned how long a nurse is a covered entity after she moves from a job reviewing files with protected health information to an administrative job that does not handle protected health information; or whether an occupational health nurse who used to transmit first reports of injury to her company's workers' compensation carrier last year but no longer does so this year because of a carrier change still is a covered entity. Response: Because this comment addresses a question of enforcement, we will address it in the enforcement regulation.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 205)

[Assistant]
According to hitech_omnibus_2013:

sociate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with § 164.514(e)(4) and §164.314(a)(1), if applicable.
- (4) Implementation specifications: Other requirements for contracts and other arrangements. (i) The contract or other arrangement between the covered entity and the business associate may permit the business associate to use the protected health information received by the business associate in its capacity as a business associate to the covered entity, if necessary:
- (A) For the proper management and administration of the business associate; or
- (B) To carry out the legal responsibilities of the business associate. - (ii) The contract or other arrangement between the covered entity and the business associate may permit the business associate to disclose the protected health information received by the business associate in its capacity as a business associate for the purposes described in paragraph (e)(4)(i) of this section, if:

18:57 Jan 24, 2013

PO 00000

Frm 00134

- (A) The disclosure is required by law; or
- (B)( 1 ) The business associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person; and
- ( 2 ) The person notifies the business associate of any instances of which it is aware in which the confidentiality of the information has been breached. - (5) Implementation specifications: Business associate contracts with subcontractors. The requirements of §164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by § 164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 518)

[Assistant]
According to privacy_rule_2000:

organized health care arrangement and that have a joint notice under §164.520(d) may comply with this section by a joint consent. - (2) Implementation specifications: Requirements for joint consents.
(i) A joint consent must:
- (A) Include the name or other specific identification of the covered entities, or classes of covered entities, to which the joint consent applies; and
- (B) Meet the requirements of this section, except that the statements required by this section may be altered to reflect the fact that the consent covers more than one covered entity. - (ii) If an individual revokes a joint consent, the covered entity that receives the revocation must inform the other entities covered by the joint consent of the revocation as soon as practicable. ## § 164.508 Uses and disclosures for which an authorization is required. - (a) Standard: Authorizations for uses and disclosures. (1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization. - (2) Authorization required: psychotherapy notes.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 117)

[Assistant]
According to hitech_omnibus_2013:

d entities and business associates, we have removed the harm standard and modified the risk assessment to focus more objectively on the risk that the protected health information has been compromised.
Thus, breach notification is not required under the final rule if a covered entity or business associate, as applicable, demonstrates through a risk assessment that there is a low probability that the protected health information has been compromised, rather than demonstrate that there is no significant risk of harm to the individual as was provided under

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with the interim final rule. The final rule also identifies the more objective factors covered entities and business associates must consider when performing a risk assessment to determine if the protected health information has been compromised and breach notification is necessary. Although some commenters urged us to implement a bright line standard, requiring notification for all impermissible uses and disclosures without any assessment of risk, we believe that a risk assessment is necessary. The statute acknowledges, by including a specific definition of breach and identifying exceptions to this definition, as well as by providing that an unauthorized acquisition, access, use, or disclosure of protected health information must compromise the security or privacy of such information to be a breach, that there are several situations in which unauthorized acquisition, access, use, or disclosure of protected health information is so inconsequential that it does not warrant notification. In addition to the statutory exceptions that have been included in both the interim final rule and this final rule, there may be other similar situations that do not warrant breach notification.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 264)

[Assistant]
According to privacy_rule_2000:

ate protected health information over which the minor maintains control from protected health information with respect to which the minor's parent has rights as a personal representative of the minor.
A covered provider may disclose protected health information to a parent, regardless of a confidentiality agreement, if there is an imminent threat to the minor or another person, in accordance with § 164.512(j)(1)(i). Comment: Several commenters suggested that we add a provision in the final rule to provide minors and parents with concurrent rights under certain circumstances, particularly when the minor reaches 16 years of age or when a parent authorizes his or her minor child to exercise these rights concurrently. Response: We do not add such provision in the final rule. We believe that establishing concurrent rights through this rule could result in problems that effect the quality of health care if the minor and the parent were to disagree on the exercise of their rights. The rule would not prevent a parent from allowing a minor child to make decisions about his or her protected health information and acting consistently with the minor's decision. In all cases, either the parent has the right to act for the individual with respect to protected health information, or the minor has the right to act for himself or herself. The rule does not establish concurrent rights for parents and minors. Comment: Commenters requested clarification about the rights of an adult or emancipated minor with respect to protected health information concerning health care services rendered while the person was an unemancipated minor. 7 Confidentiality in Adolescent Health Care, a joint policy statement of the American Academy of Pediatrics; the American Academy of Family Physicians; the American College of Obstetricians and Gynecologists; NAACOG-The Organization for Obstetric, Gynecologic, and Neonatal Nurses; and the National Medical Association.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 513)

[Assistant]
According to privacy_rule_2000:

unctions of a health plan, health care provider, or health care clearinghouse, the affiliated covered entity complies with paragraph (g) of this section. (e)(1) Standard: Business associate contracts.
(i) The contract or other arrangement between the covered entity and the business associate required by §164.502(e)(2) must meet the requirements of paragraph (e)(2) or (e)(3) of this section, as applicable. (ii) A covered entity is not in compliance with the standards in §164.502(e) and paragraph (e) of this section, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate's obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful:

(A) Terminated the contract or arrangement, if feasible; or

(B) If termination is not feasible, reported the problem to the Secretary. (2) Implementation specifications: Business associate contracts. A contract between the covered entity and a business associate must:

(i) Establish the permitted and required uses and disclosures of such information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that:

(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and

(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] When must a HIPAA breach be reported to HHS?

[Assistant]
According to nist_sp800-66r2:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 14)

[Assistant]
According to privacy_mod_2002:

this proposal. Additional comments received on this issue are discussed below in the section entitled, ''Response to Other Public Comments.''

Numerous commenters supported the proposed modifications.
Generally, these commenters claimed the modifications would prevent inconvenience to consumers, and facilitate timely access to health care. Specifically, these commenters indicated that health care would be delayed and consumers would be inconvenienced if covered entities were required to obtain individual consent or

19:04 Aug 13, 2002

PO 00000

Frm 00010

authorization before they could access health records that are newly acquired assets resulting from the sale, transfer, merger, or consolidation of all or part of a covered entity. Commenters further claimed that the administrative burden of acquiring individual permission and culling records of consumers who do not give consent would be too great, and would cause some entities to simply store or destroy the records instead. Consequently, health information would be inaccessible, causing consumers to be inconvenienced and health care to be delayed. Some commenters noted that the proposed modifications recognize the realities of business without compromising the availability or quality of health care or diminishing privacy protections one would expect in the handling of protected health information during the course of such business transactions. Opposition to the proposed modifications was limited, with commenters generally asserting that the transfer of records in such circumstances would not be in the best interests of individuals. Final Modifications. The Department agrees with the commenters that supported the proposed modifications and, therefore, adopts the modifications to the definition of health care operations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 53)

[Assistant]
According to hitech_omnibus_2013:

te subcontractors with the requirements for covered entities with regard to their business associates. We also proposed changes to the specific business associate agreement provisions at § 164.504(e).
First, we proposed to revise § 164.504(e)(2)(ii)(B) through (D) to provide that the contract will require that: in (B), business associates comply, where applicable, with the Security Rule with regard to electronic protected health information; in (C), business associates report breaches of unsecured protected health information to covered entities, as required by § 164.410; and in (D), in accordance with § 164.502(e)(1)(ii), business associates ensure that any subcontractors that create or receive protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information. These revisions were proposed to align the requirements for the business associate agreement with the requirements in the HITECH Act and elsewhere within the HIPAA Rules. Additionally, we proposed to add a new agreement provision at §164.504(e)(2)(ii)(H) (and to renumber the current paragraphs (H) and (I) accordingly) to requires that, to the extent the business associate is to carry out a covered entity's obligation under this subpart, the business associate must comply with the requirements of the Privacy Rule that apply to the covered entity in the performance of such obligation. This provision would clarify that when a covered entity delegates a responsibility under the Privacy Rule to the business associate, the business associate would be contractually required to comply with the requirements of the Privacy Rule in the same manner as they apply to the covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 40)

[Assistant]
According to privacy_rule_2000:

t or omission complained of occurred, unless this time limit is waived by the Secretary for good cause shown. Sixth, §160.310(b) requires cooperation with investigations as well as compliance reviews.
Seventh, § 160.310 (c)(1) provides that the Secretary must be provided access to a covered entity's facilities, books, records, accounts, and other sources of information, including

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00027

protected health information, at any time and without notice where exigent circumstances exist, such as where documents might be hidden or destroyed. Eighth, the provision proposed at § 164.522(d) that would prohibit covered entities from taking retaliatory action against individuals for filing a complaint with the Secretary or for certain other actions has been changed and moved to §164.530. Ninth, §160. 312(a)(2) deletes the reference in the proposed rule to using violation findings as a basis for initiating action to secure penalties. This deletion is not a substantive change. This language was removed because penalties will be addressed in the enforcement regulation. As in the NPRM, the Secretary may promulgate alternative procedures for complaints relating to national security. For example, to protect classified information, we may promulgate rules that would allow an intelligence community agency to create a separate body within that agency to receive complaints. The Department plans to issue an Enforcement Rule that applies to all of the regulations that the Department issues under the Administrative Simplification provisions of HIPAA. This regulation will address the imposition of civil monetary penalties and the referral of criminal cases where there has been a violation of this rule. Penalties are provided for under section 262 of HIPAA. The Enforcement Rule would also address the topics covered by Subpart C below. It is expected that this Enforcement Rule would replace Subpart C.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 170)

[Assistant]
According to privacy_rule_2000:

e describe and delimit the exact nature of the exemption in the regulatory text. See § 164.500(b). We will monitor developments in this sector should the basic business-tobusiness relationship change.
Comment: A number of comments relate to the proposed definition of health care clearinghouse. Many commenters suggested that we expand the definition. They suggested that additional types of entities be included in the definition of health care clearinghouse, specifically medical transcription services, billing services, coding services, and ''intermediaries.'' One commenter suggested that the definition be expanded to add entities that receive standard transactions, process them and clean them up, and then send them on, without converting them to any standard format. Another commenter suggested that the health care clearinghouse definition be expanded to include entities that do not perform translation but may receive protected health information in a standard format and have access to that information. Another commenter stated that the list of covered entities should include any organization that receives or maintains individually identifiable health information. One organization recommended that we expand the health care clearinghouse definition to include the concept of a research data clearinghouse, which would collect individually identifiable health information from other covered entities to generate research data files for release as de-identified data or with appropriate confidentiality safeguards. One commenter stated that HHS had gone beyond Congressional intent by including billing services in the definition. Response: We cannot expand the definition of ''health care clearinghouse'' to cover entities not covered by the definition of this term in the statute. In the final regulation, we

Frm 00112

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

make a number of changes to address public comments relating to definition.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 13)

[Assistant]
According to fda_premarket_2023:

support the risk analysis activities. As part of the risk assessment, FDA recommends threat modeling be performed throughout the design process and be inclusive of all medical device system elements.
30 Details on the content for security risk management plans and reports beyond those specifically identified can be found in AAMI TIR57 Principles for medical device security-Risk management and ANSI/AAMI SW96 Standard for medical device security - Security risk management for device manufacturers . https://doi.org/10.2345/9781570208621.ch1

31 While security architecture is likely captured as a component of the security risk management process, it is discussed separately for the purposes of this guidance due to the level of detail recommended to be provided by manufacturers in order to facilitate FDA review of the safety and effectiveness of the device. ## The threat model should:

- Identify medical device system risks and mitigations as well as inform the pre- and post-mitigation risks considered as part of the cybersecurity risk assessment;
- State any assumptions about the medical device system or environment of use (e.g., hospital networks are inherently hostile, therefore manufacturers are recommended to assume that an adversary controls the network with the ability to alter, drop, and replay packets); and
- Capture cybersecurity risks introduced through the supply chain, manufacturing, deployment, interoperation with other devices, maintenance/update activities, and decommission activities that might otherwise be overlooked in a traditional safety risk assessment process. FDA recommends that premarket submissions include threat modeling documentation to demonstrate how the medical device system has been analyzed to identify potential security risks that could impact safety and effectiveness. There are a number of methodologies and/or combinations of methods for threat modeling that manufacturers may choose to use.