[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 75)

[Assistant]
According to nist_sp800-66r2:

United States

## US-CERT

United States Computer Emergency Readiness Team

## VPN

Virtual Private Network

## Appendix B. Glossary

This appendix provides definitions for terms within this document that are defined principally in the HIPAA Security Rule. ## addressable

To meet the addressable implementation specifications, a covered entity or business associate must (i) assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting the electronic protected health information; and (ii) as applicable to the covered entity or business associate - (A) Implement the implementation specification if reasonable and appropriate; or (B) if implementing the implementation specification is not reasonable and appropriate-(1) document why it would not be reasonable and appropriate to implement the implementation specification; and (2) implement an equivalent alternative measure if reasonable and appropriate. [Sec. Rule, §164.306(d)(3)]

## administrative safeguards

Administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information. [Sec. Rule, §164.304]

## affiliated covered entities

Legally separate covered entities that are affiliated may designate themselves as a single covered entity for the purposes of this part. [Sec. Rule, §164.105(b)]

## authentication

The corroboration that a person is the one claimed. [Sec. Rule, §164.304]

## availability

The property that data or information is accessible and usable upon demand by an authorized person. [Sec.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 3)

[Assistant]
According to fda_premarket_2023:

|
| 3. | 3. | Interoperability Considerations ..................................................................................
| 14                                                                                |
| 4. | 4. | Third-Party Software Components............................................................................. | 15                                                                                |
| 5. | 5. | Security Assessment of Unresolved Anomalies......................................................... | 18                                                                                |
| 6. | 6. | TPLC Security Risk Management.............................................................................. | 18                                                                                |
| B. | B. | Security Architecture...................................................................................................... | 19                                                                                |
| 1. | 1. | Implementation of Security Controls .........................................................................


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 10)

[Assistant]
According to privacy_rule_2000:

privacy concerns and another 87 percent reported having had a patient request to withhold information from their records. For an example of this phenomenon in a particular demographic group, see Drs.
Bearman, Ford, and Moody, ''Foregone Health Care among Adolescents,'' JAMA, vol. 282, no. 23 (999); Cheng, T.L., et al., ''Confidentiality in Health Care: A Survey of Knowledge, Perceptions, and Attitudes among High School Students,'' JAMA, vol. 269, no. 11 (1993), at 1404-1407. The absence of strong national standards for medical privacy has widespread consequences. Health care professionals who lose the trust of their patients cannot deliver high-quality care. In 1999, a coalition of organizations representing various stakeholders including health plans, physicians, nurses, employers, disability and mental health advocates, accreditation organizations as well as experts in public health, medical ethics, information systems, and health policy adopted a set of ''best principles'' for health care privacy that are consistent with the standards we lay out here. (See the Health Privacy Working Group, ''Best Principles for Health Privacy''

## (July, 1999) (Best Principles Study). The Best Principles Study states that-

To protect their privacy and avoid embarrassment, stigma, and discrimination, some people withhold information from their health care providers, provide inaccurate information, doctor-hop to avoid a consolidated medical record, pay out-ofpocket for care that is covered by insurance, and-in some cases-avoid care altogether. Best Principles Study, at 9. In their comments on our proposed rule, numerous organizations representing health plans, health providers, employers, and others acknowledged the value of a set of national privacy standards to the efficient operation of their practices and businesses.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 55)

[Assistant]
According to nist_sp800-66r2:

nsible for coordinating the disposal of data and the reuse of the hardware and software? • Are workforce members appropriately trained on the security risks to ePHI when reusing software and hardware?
102                                                                                |
| 3. Maintain Accountability for Hardware and Electronic Media Implementation Specification (Addressable)       | • Maintain a record of the movements of hardware and electronic media and any person responsible for them. • Ensure that ePHI is not inadvertently released or shared with any unauthorized party. | • Have policies and procedures been implemented that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility and the movement of these items within the facility? |

102  See Sec. 5.1.5, HIPAA Standard: Security Awareness and Training.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 486)

[Assistant]
According to privacy_rule_2000:

. Individuals routinely request copies of such information, in whole or in part, for purposes that include providing health information to another health care provider or as part of legal proceedings.
The amount of inspection and copying of individually identifiable health information that occurs for these purposes is not expected to change as a result of the final regulation. The final regulation establishes the right of individuals to inspect and copy protected health information about them. Although this is an important right, the Department does not expect it to result in dramatic increases in requests from individuals. We assume that most health care providers currently have procedures for allowing patients to inspect and copy this information. The economic impact on small businesses of requiring covered entities to provide individuals with access to protected health information should be relatively small. Moreover, entities can recoup the costs of copying such information by charging reasonable cost-based fees. ## Amendments to Protected Health Information

Many health care providers and health plans currently make provisions to help patients expedite amendments and corrections of their medical record where appropriate. If an error exists, both the patient and the health care provider on health plan benefit from the correction. However, as with inspection and copying, a person's right to request amendment and correction of individually identifiable health information about them is not guaranteed by all states. Based on these assumptions, the Department concludes that the principal economic effect of the final rule will be to expand the right to request amendments to protected health information held by health plans and covered health care providers to those who are currently granted such right by state law. In addition, the rule may draw additional attention to the issue of record inaccuracies and stimulate patient demand for amendment of medical records.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 57)

[Assistant]
According to privacy_mod_2002:

ganized health care arrangement.'' The group health plan (or the HMO with respect to the group health plan) may disclose protected health information to a plan sponsor in accordance with § 164.504(f).
Comment: Several commenters requested that the Department expand the definition of ''payment'' to include disclosures to a responsible party. Additionally, these commenters urged that the Department permit covered entities (and their business associates) to use and disclose protected health information as permitted by other law, rather than only as required by law. These commenters were concerned that the Privacy Rule would impede the ability of first-party billing companies, collection agencies, and accounts receivable management companies to continue to bill and communicate, on behalf of a health care provider, with the responsible party on an account when that person is different from the individual to whom health care services were provided; report outstanding receivables owed by the responsible party on an account to a credit reporting agency; and perform collection litigation services. Response: The Department does not believe a modification to the definition of ''payment'' is necessary. The Privacy Rule permits a covered entity, or a business associate acting on behalf of a covered entity ( e.g., a collection agency),

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

to disclose protected health information as necessary to obtain payment for health care, and does not limit to whom such a disclosure may be made. See the definition of ''payment'' in § 164.501. Therefore, a collection agency, as a business associate of a covered entity, is permitted to contact persons other than the individual to whom health care is provided as necessary to obtain payment for such services.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 123)

[Assistant]
According to privacy_rule_2000:

ity to another; (5) law enforcement on the premises of the correctional institution; and (6) the administration and maintenance of the safety, security, and good order of the correctional institution.
This section is intended to allow, for example, a prison's doctor to disclose to a van driver transporting a criminal that the individual is a diabetic and frequently has seizures, as well as information about the appropriate action to take if the individual has a seizure while he or she is being transported. We permit covered entities to disclose protected health information about these individuals if the correctional institution or law enforcement official represents that the protected health information is necessary for these purposes. Under 164.514(h), a covered entity may reasonably rely on the representation of such public officials. ## Application to Public Benefits Programs Required to Share Eligibility Information

We create a new provision for covered entities that are a government program providing public benefits. This provision allows the following disclosures of protected health information. First, where other law requires or expressly authorizes information relating to the eligibility for, or enrollment in more than one public program to be shared among such public programs and/or maintained in a single or combined data system, a public agency that is administering a health plan may maintain such a data base and may disclose information relating to such eligibility or enrollment in the health plan to the extent authorized by such other law. Where another public entity has determined that the appropriate balance between the need for efficient administration of public programs and public funds and individuals' privacy

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00081

interests is to allow information sharing for these limited purposes, we do not upset that determination.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 292)

[Assistant]
According to privacy_rule_2000:

ovision of law requires the disclosure of these notes, a covered entity may make the disclosure under § 164.512(a). The final rule, however, does not require the disclosure of these notes to Medicare.
Comment: One commenter expressed concern that by filing a complaint an

Frm 00193

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

individual would be required to reveal sensitive information to the public. Another commenter suggested that complaints regarding noncompliance in regard to psychotherapy notes should be made to a panel of mental health professionals designated by the Secretary. This commenter also proposed that all patient information would be maintained as privileged, would not be revealed to the public, and would be kept under seal after the case is reviewed and closed. Response: We appreciate this concern and the Secretary will ensure that individually identifiable health information and other personal information contained in complaints will not be available to the public. This Department seeks to protect the privacy of individuals to the fullest extent possible, while permitting the exchange of records required to fulfill its administrative and program responsibilities. The Freedom of Information Act, 5 U.S.C. 552, and the HHS implementing regulation, 45 CFR part 5, protect records about individuals if the disclosure would constitute an unwarranted invasion of their personal privacy, as does the Privacy Act, 5 U.S.C. 552a. See the discussion of FOIA and the Privacy Act in the ''Relationship to Other Federal Laws'' section of the preamble. Information that the Secretary routinely withholds from the public in its current enforcement activities includes individual names, addresses, and medical information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 164)

[Assistant]
According to hitech_omnibus_2013:

and are therefore in the baseline. We did not include these costs in our analysis of the annual costs. We have followed the same approach to estimating the costs as outlined in the interim final rule.
We examined the cost of notifying affected individuals by first class mail, issuing substitute notice in major media or on a Web site along with a toll-free phone number, notifying prominent media in the event of a

31 Department of Labor, Occupational Employment Statistics; Healthcare Practitioner and

VerDate Mar<15>2010

breach involving more than 500 individuals, and notifying the Secretary of a breach, as well as the costs of investigating and documenting breaches. Some commenters requested that we include the cost of modifying contracts with business associates to potentially define the breach notification obligations between the parties. We note that costs to modify business associate agreements generally to comply with the new HITECH provisions are discussed elsewhere in this impact analysis. ## Cost of Notifying Affected Individuals by First Class Mail or Email

Section 164.404 requires all covered entities to notify affected individuals of a breach either by first class mail, or if the individual has agreed, by email. In the interim final rule, we assumed that approximately one half of notices sent to affected individuals would be sent via first-class mail, while the rest would be sent via email. By comparison, in the Federal Trade Commission's (FTC) final breach notification rule, the FTC assumed that 90 percent of the notices sent to individuals affected by a breach requiring notification under the FTC rule would be emailed and only 10 percent would be sent by regular first class mail. Since the firms that the FTC regulates are primarily web-based, assuming that the vast majority of communications would be conducted through email is a reasonable assumption.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 67)

[Assistant]
According to security_rule_2003:

(a)(2)(i)(D) of this section if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate. (b)(1) Standard: Requirements for group health plans.
Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to

18:40 Feb 19, 2003

PO 00000

Frm 00047

§164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan. - (2) Implementation specifications (Required). The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to-
2. (i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;
3. (ii) Ensure that the adequate separation required by §164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;

(iii) Ensure that any agent, including a subcontractor, to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and

(iv) Report to the group health plan any security incident of which it becomes aware. ## §164.316 Policies and procedures and documentation requirements. A covered entity must, in accordance with § 164.306:

- (a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 439)

[Assistant]
According to privacy_rule_2000:

t § 164.524 below. Section 164.524 below has also been reorganized to follow the organization of the analogous provisions of the Transactions Rule. The underlying policy, however, remains as proposed.
## Extend the Compliance Date

Comment: Some commenters recommended that the compliance date be extended. A number of comments objected that the time frame for compliance with the proposed standards is unrealistically short. It was pointed out that providers and others would have to do the following, among other things, prior to the applicable compliance date: assess their current systems and departments, determine which state laws were preempted and which were not, update and reprogram computer systems, train workers, create and implement the required privacy policies and procedures, and create or update contracts with business partners. One comment also noted that the task of coming into compliance during the same time period with the other regulations being issued under HIPAA would further complicate the task. These comments generally supported an extension of the compliance dates by one or more years. Other comments supported extending the compliance dates on the ground that the complexity of the tasks involved in implementing the regulation would be a heavy financial burden for providers and others, and that they should be given more time to comply, in order to spread the associated capital and workforce costs over a longer period. It was also suggested that there be provision for granting extensions of the compliance date, based on some criteria, such as a good faith effort to comply or that the compliance dates be extended to two years following completion of a ''stateby-state preemption analysis'' by the Department. Response: The Secretary acknowledges that covered entities will have to make changes to their policies and procedures during the period between the effective date of the rules below and the applicable compliance dates.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 180)

[Assistant]
According to hitech_omnibus_2013:

n order to ensure an individual's restriction request is honored. Rather, the final rule leaves it to the discretion of the provider as to how to flag information that is the subject of a restriction.
Further, the final rule provides flexibility as to how restriction requests for certain services, such as bundled services, are to be handled, as well as what reasonable efforts should be made to obtain payment from an individual whose original form of payment has been dishonored, prior to resorting to billing the health plan for the service. Finally, in response to comments regarding the potential burden and cost of doing so, the final rule does not require health care providers to inform downstream providers who may receive the individual's protected health information, such as a pharmacy or specialist, of a restriction, given the lack of automated technologies to support such a requirement. Notwithstanding the above, we acknowledge that there will be some additional burden on certain health care providers to ensure an individual's request to restrict a disclosure to a health plan is honored where such a request would not have been honored in the past. However, we do not have data to inform quantifying an estimated cost in this area. For example, we do not have data on the number of providers that currently accommodate requests from self-pay patients to restrict disclosures versus those that do not, the number of requests that covered health care providers receive today that would now require a restriction, nor even the number of requests for restrictions generally that covered health care providers currently receive. ## e.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 35)

[Assistant]
According to fda_premarket_2023:

- For every communication path that exists between any two assets in the security use case view (and/or explanatory text), including indirect connections when there is at least one intermediate asset (e.g., an app), the following details should be provided: - A list of the communication interfaces and paths, including communication paths (e.g., between two assets through an intermediary), and any unused interfaces; - An indication of whether the path is used for data, code, and/or commands, and type of data/information/code being transferred; - Protocol name(s), version number(s), and ports/channels/frequencies; - Detailed descriptions of the primary and all available functionality for each medical device system asset, including assessment of any functionality that is built in but not currently used or enabled (e.g., dormant application functionality or ports), including assurance that this functionality cannot be activated and/or misused; - Access control models or features (if any) for every asset (such as privileges, user accounts/groups, passwords); - Users' roles and levels of responsibility if they interact with the assets and communication channels; - Any 'handoff' sequences from one communication path to another (e.g., from asset to asset, network to network, or Bluetooth to Wi-Fi), and how the data, code, and/or commands are


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 51)

[Assistant]
According to privacy_mod_2002:

lth care operations, the Department also received comments about the difficulty that the Privacy Rule would place on health plans trying to obtain information needed for quality assessment activities.
Health plans informed the Department that they need to obtain individually identifiable health information from health care providers for the plans' quality-related activities, accreditation, and performance measures, such as Health Plan Employer Data and Information Set

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

(HEDIS). Commenters explained that the information provided to plans for payment purposes ( e.g. , claims or encounter information) may not be sufficient for quality assessment or accreditation purposes. The NCVHS, in response to public testimony on this issue at its August 2001 hearing, also recommended that the Department amend the Privacy Rule to allow for uses and disclosures for quality-related activities among covered entities, without the individual's written authorization. Based on these concerns, the Department proposed to modify §164.506 to permit a covered entity to disclose protected health information for the payment activities of another covered entity or any health care provider, and also for certain types of health care operations of another covered entity. The proposal would broaden the uses and disclosures that are permitted without authorization as part of treatment, payment, and health care operations so as not to interfere inappropriately with access to quality and effective health care, while limiting this expansion in order to continue to protect the privacy expectations of the individual. Specifically, the Department proposed the following. First, the Department proposed to add to § 164.506(c)(1) language stating that a covered entity may use or disclose protected health information for its own treatment, payment, or health care operations without prior permission.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 35)

[Assistant]
According to nist_sp800-66r2:

Conduct a Training Needs Assessment                | • Determine the training needs of the organization. • Interview and involve key personnel in assessing security training needs. • Use feedback and analysis of past events to help determine training needs. • Review organizational behavior issues, past incidents, and/or breaches to determine what training is missing or needs reinforcement, improvement, or periodic reminders. | • What awareness, training, and education programs are needed? Which are required? • Is the organization monitoring current threats to determine possible areas of training needs? • Are there current, relevant threats (e.g., phishing, ransomware) about which personnel need training? • Do workforce members need training on any particular organization devices (e.g., IoT devices) or technology that pose a risk to ePHI? • What is the current status regarding how these needs are being addressed (e.g., how well are current efforts working)? • Where are the gaps between the needs and what is being done (e.g., what more needs to be done)? • What are the training priorities in terms of content and audience? |
| 2. Develop and Approve a Training Strategy and a Plan | • Address the specific HIPAA policies that require security awareness and training in the security awareness and training program. • Set organizational expectations for protecting ePHI. • In the security awareness and training program, outline the program's scope, goals, target audiences, learning objectives, deployment methods, and evaluation and measurement techniques, as well as the frequency of training. | • Is there a procedure in place to ensure that everyone in the organization receives security awareness training, including teleworkers and remote personnel? • What type of security training is needed to address specific technical topics based on job responsibility? • When should training be scheduled to ensure that compliance deadlines are met?


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 73)

[Assistant]
According to privacy_rule_2000:

n addition to or not directly related to the provision of insurance, the health insurance issuer or HMO may be a business associate with respect to those additional functions, activities, or services.
In addition, group health plans that provide health benefits only through an insurance contract and do not create, maintain, or receive protected health information (except for summary information described below or information that merely states whether an individual is enrolled in or has been disenrolled from the plan) do not have to meet the notice requirements of § 164.520 or the administrative requirements of §164.530, except for the documentation requirement in § 164.530(j), because these requirements are satisfied by the issuer or HMO that is providing benefits under the group health plan. A group health plan, however, may not permit a health insurance issuer or HMO to disclose protected health information to a plan sponsor unless the notice required in 164.520 indicate such disclosure may occur. The final rule also permits a health plan that is providing insurance to a group health plan to provide summary information to the plan sponsor to permit the plan sponsor to solicit premium bids from other health plans or for the purpose of modifying, amending, or terminating the plan. The rule provides that summary information is information that summarizes claims history, claims expenses, or types of claims experienced by individuals for whom the plan sponsor has provided health benefits under a group health plan, provided that specified identifiers are not included. Summary information may be disclosed under this provision even if it does not meet the definition of de-identified information. As part of the notice requirements in § 164.520, health plans must inform individuals that they may disclose protected health information to plan sponsors.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 104)

[Assistant]
According to privacy_rule_2000:

e central to the purpose of health care oversight agencies (covered under proposed §164.510(c)). In the final rule, we make substantial changes to these provisions, in an attempt to prevent confusion.
In § 164.512(d)(2), we include explicit decision rules indicating when an investigation is considered law enforcement and when an investigation is considered oversight under this regulation. An investigation or activity is not considered health oversight for purposes of this rule if: (1) The individual is the subject of the investigation or activity; and (2) The investigation or activity does not arise out of and is not directly related to: (a) The receipt of health care; (b) a claim for public benefits related to health; or (c) qualification for, or receipt of public benefits or services where a patient's health is integral to the claim for benefits or services. In such cases, where the individual is the subject of the investigation and the investigation does not relate to issues (a) through (c), the rules regarding disclosure for law enforcement purposes (see § 164.512(f)) apply. For the purposes of this rule, we intend for investigations regarding issues (a) through (c) above to mean investigations of health care fraud. Where the individual is not the subject of the activity or investigation, or where the investigation or activity relates to the subject matter in (a) through (c) of the preceding sentence, a covered entity may make a disclosure pursuant to § 164.512(d)(1). For example, when the U.S. Department of Labor's Pension and Welfare Benefits Administration (PWBA) needs to analyze protected health information about health plan enrollees in order to conduct an audit or investigation of the health plan ( i.e., the enrollees are not subjects of the investigation) to investigate potential fraud by the plan, the health plan may disclose protected health information to the PWBA under the health oversight rules.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 163)

[Assistant]
According to hitech_omnibus_2013:

s, we rely entirely on our experience with breach notifications received by the Secretary during calendar years 2010 and 2011, for projecting the ongoing, annual costs of the breach notification rule.
Based on our experience in those years, we project the likely number of breaches, number of affected individuals, and costs associated with this regulation. We have not attempted to predict future costs because, as discussed above, while we anticipate the overall number of breaches and the overall costs of implementing the breach notification provisions to fall over time, we do not currently have enough data to establish such a trend. ## Affected Entities

The entities affected by the breach notification regulation are outlined in the impact statement of the interim final

VerDate Mar<15>2010

rule. HIPAA covered entities and their business associates must comply with these regulations. We estimate that approximately 700,000 HIPAA covered entities will be subject to the final rule, although many fewer will experience a breach requiring them to fulfill the breach notification requirements. How many breaches will require notification? Although this final rule modifies the definition of breach at § 164.402 to remove the harm standard, we do not believe that this will have a significant effect on the number of breaches reported to HHS or on the number of individuals affected. As discussed in Section V above, this final rule removes the harm standard and implements a more objective risk assessment for evaluating whether an impermissible use or disclosure is a breach. As a result,

18:57 Jan 24, 2013

PO 00000

Frm 00107

covered entities must still perform a risk assessment following an impermissible use or disclosure of protected health information to determine the probability that the protected health information has been compromised.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 93)

[Assistant]
According to privacy_rule_2000:

formation. Under the final rule, we also establish provisions for disclosure of directory information to clergy that are slightly different from those which apply for disclosure to the general public.
Subject to the individual's right to object or restrict the disclosure, the final rule permits a covered entity to disclose to a member of the clergy: (1) The individual's name; (2) the individual's general condition in terms that do not communicate specific medical information about the individual; (3) the individual's location in the facility; and (4) the individual's religious affiliation. A disclosure of directory information may be made to members of the clergy even if they do not inquire about an individual by name. We note that the rule in no way requires a covered health care provider to inquire about the religious affiliation of an individual, nor must individuals supply that information to the facility. Individuals are free to determine whether they want their religious affiliation disclosed to clergy through facility directories. We believe that allowing clergy to access patient information pursuant to this section does not violate the Establishment Clause of the First Amendment, which prohibits laws ''respecting an establishment of religion.'' Courts traditionally turn to the Lemon test when evaluating laws that might raise Establishment Clause concerns. A law does not violate the Clause if it has a secular purpose, is not primarily to advance religion, and does not cause excessive government entanglement with religion. The privacy regulation passes this test because its purpose is to protect the privacy of individuals-regardless of their religious affiliation-and it does not cause excessive government entanglement. More specifically, although this section provides a special rule for members of the clergy, it does so as an accommodation to patients who seek to engage in religious conduct.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 274)

[Assistant]
According to privacy_rule_2000:

itly detailed in its contract. However, the final rule expands the proposed exception for disclosures of protected health information by a covered health care provider to another health care provider.
The final rule allows such disclosures without a business associate contract for any activities that fall under the definition of ''treatment.'' We agree with the commenter that the administrative burdens of requiring contracts in staff privileges arrangements would not be outweighed by any potential privacy enhancements from such a requirement. Although the exception for disclosure of protected health information for treatment could be sufficient to relieve physicians and hospitals of the contract requirement, we also believe that this arrangement does not meet the true meaning of ''business associate,'' because both the hospital and physician are providing services to the patient, not to each other. We therefore also add an exception to § 164.502(e)(1) that explicitly states that a contract is not required when the association involves a health care facility and another health care provider with privileges at that facility, if the purpose is providing health care to the individual. We have also added other exceptions in §164.502(e)(1)(ii) to the requirement to obtain ''satisfactory assurances'' under §164.502(e)(1)(i). We do not require a business associate arrangement between group health plans and their plan sponsors because other, albeit analogous, requirements apply under §164.504(f) that are more tailored to the specifics of that legal relationship. We do not require business associate arrangements between government health plans providing public benefits and other agencies conducting certain functions for the health plan, because these arrangements are typically very constrained by other law. Comment: Many commenters expressed concern that required contracts for federal agencies would adversely affect oversight activities, including investigations and audits.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 39)

[Assistant]
According to security_rule_2003:

se covered entities must already conform to the regulation

Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

Jkt 200001

requirements, a ''chain of trust'' agreement does not add to overall security.
Compliance with the regulation should be sufficient. Response: We believe the commenters are correct that the rule as proposed would-(1) not allow for scalability; and (2) would lead an entity to believe it is responsible, and liable, for making sure all entities down the line maintain the same level of security. The confusion here seems to come from the phrase ''same level of security.'' Our intention was that each trading partner would maintain reasonable and appropriate safeguards to protect the information. We did not mean that partners would need to implement the same security technology or measures and procedures. We have replaced the proposed ''Chain of trust'' standard with a standard for ''Business associate contracts and other arrangements.''

When another entity is acting as a business associate of a covered entity, we require the covered entity to require the other entity to protect the electronic protected health information that it creates, receives, maintains or transmits on the covered entity's behalf. The level of security afforded particular electronic protected health information should not decrease just because the covered entity has made the business decision to entrust a business associate with using or disclosing that information in connection with the performance of certain functions instead of doing those functions itself. Thus, the rule below requires covered entities to require their business associates to implement certain safeguards and take other measures to ensure that the information is safeguarded (see § 164.308(b)(1) and §164.314(a)(1)).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 33)

[Assistant]
According to security_rule_2003:

covered entities may be required by other Federal law to adhere to additional, or more stringent security measures. Section 1178(a)(2) of the statute provides several exceptions to this general rule.
With regard to protected health information, the preemption of State laws and the relationship of the Privacy Rule to other Federal laws is discussed in the Privacy Rule beginning at 65 FR 82480; the preemption provisions of the rule are set out at 45 CFR part 160, subpart B. It should be noted that although the Privacy Rule does not incorporate a requirement for an ''audit trail'' function, it does call for providing an accounting of certain disclosures of protected health information to an

Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

Jkt 200001

individual upon request. There has been a tendency to assume that this Privacy Rule requirement would be satisfied via some sort of process involving audit trails. We caution against assuming that the Security Rule's requirement for an audit capability will satisfy the Privacy Rule's requirement regarding accounting for disclosures of protected health information. The two rules cover overlapping, but not identical information. Further, audit trails are typically used to record uses within an electronic information system, while the Privacy Rule requirement for accounting applies to certain disclosures outside of the covered entity (for example, to public health authorities). ## 3. Integrity (§ 164.312(c)(1))

We proposed under the ''Data authentication'' requirement, that each organization be required to corroborate that data in its possession have not been altered or destroyed in an unauthorized manner and provided examples of mechanisms that could be used to accomplish this task. We adopt the proposed requirement for data authentication in the final rule as an addressable implementation specification ''Mechanism to authenticate data,'' under the ''Integrity'' standard. a.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 36)

[Assistant]
According to hitech_omnibus_2013:

vered, the entity need not become a hybrid entity so as to avoid applying the Privacy Rule to health information the entity holds in its role as employer, such as sick leave requests of its employees.
Such information is already excluded from the definition of ''protected health information'' as employment records and thus, the Privacy Rule does not apply to this information. However, the identifiable health information the entity holds as a covered health care provider (e.g., the information the clinic holds about employees who have received treatment) is protected health information and generally may not be shared with the employer for employment purposes without the individual's authorization. ## ii. Section 164.105(a)(2)(iii)(C)

We proposed to modify this section to re-designate § 164.105(a)(2)(iii)(C) as (D), and to include a new paragraph (C), which makes clear that, with respect to a hybrid entity, the covered entity itself, and not merely the health care component, remains responsible for complying with §§164.314 and 164.504 regarding business associate arrangements and other organizational requirements. Hybrid entities may need to execute legal contracts and conduct other organizational matters at the level of the legal entity rather than at the level of the health care component. The final rule adopts this change. ## iii. Section 164.105(b)(1)

The final rule fixes a minor typographical error in this paragraph by redesignating the second paragraph (1) as paragraph (2). ## iv. Section 164.105(b)(2)(ii)

The final rule simplifies this paragraph by collapsing subparagraphs (A), (B), and (C) regarding the obligations of an affiliated entity to comply with the Privacy and Security Rules into one provision. ## d. Section 164.106-Relationship to Other Parts

The final rule adds a reference in this provision to business associates, consistent with their inclusion elsewhere throughout the other HIPAA Rules. VerDate Mar<15>2010

2.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 55)

[Assistant]
According to security_rule_2003:

than 10 percent higher in 2002 than it was in 1998. This increase is mainly driven by more active threats and increased personnel costs offsetting decreases in technology costs over the past 4 years.
However, spending by companies who have anticipated the security rule or who have independently made business decisions to implement security policies and procedures as good business practice(s) has already occurred, and probably will cancel out the increased costs of implementation. Therefore, Gartner expects the cost of complying with the HIPAA security standards to be about the same now as it was in 1998. ## 2. Synchronizing Standards

The timelines for the implementation of the initial HIPAA standards (transactions, identifiers, and security) are no longer closely synchronized. However, we do not believe that this lack of synchronization will have a significant impact on the cost of implementing security. The analysis provided by the Gartner group indicated that implementing security standards is being viewed by entities as a separate task from implementing the transaction standards, and that this is not having a significant impact on costs. As with other HIPAA standards, most current entities will have a 2-year implementation period before compliance with the standards is required. Covered entities will develop their own implementation schedules, and may phase in various security measures over that time period. ## 3. Relationship to Privacy Standards

The publication of the final Privacy Rules (45 CFR parts 160 and 164) on December 28, 2000 in the Federal Register (65 FR 82462) and on August 14, 2002 (67 FR 53182) has affected the impact of this regulation significantly. Covered entities must implement the privacy standards by April 14, 2003 (April 14, 2004 for small health plans). The implementation of privacy standards reduces the cost of implementing the security standards in two significant areas.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the technical safeguards under HIPAA?

[Assistant]
According to hitech_omnibus_2013:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

## RIN 0945-AA03

Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules

AGENCY: Office for Civil Rights, Department of Health and Human Services. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (HHS or ''the Department'') is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (''the HITECH Act'' or ''the Act'') to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities. DATES: Effective date: This final rule is effective on March 26, 2013. Compliance date: Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013. FOR FURTHER INFORMATION CONTACT: Andra Wicks 202-205-2292. SUPPLEMENTARY INFORMATION:

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

sroberts on DSK5SPTVN1PROD with

## I.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 97)

[Assistant]
According to privacy_mod_2002:

Similarly, the Department believes that it is impracticable to account for incidental disclosures, which by their very nature, may be uncertain or unknown to the covered entity at the time they occur.
Incidental disclosures are permitted as long as reasonable safeguards and minimum necessary standards have been observed for the underlying communication. Moreover, incidental disclosures may most often happen in the context of a communication that relates to treatment or health care operations. In that case, the underlying disclosure is not subject to an accounting and it would be arbitrary to require an accounting for a disclosure that was merely incidental to such a communication. The Department however disagrees with commenters who requested that other public purpose disclosures not be subject to the accounting requirement. Although the Rule permits disclosure for a variety of public purposes, they are not routine disclosures of the individual's information. The accounting requirement was designed as a means for the individual to find out the non-routine purposes for which his or her protected health information was disclosed by the covered entity, so as to increase the individual's awareness of persons or entities other than the individual's health care provider or health plan in possession of this information. To eliminate some or all of these public purposes would defeat the core purpose of the accounting requirement. The Department disagrees with commenters' proposal to exempt all research disclosures made pursuant to a waiver of authorization from the accounting requirement. Individuals have a right to know what information about them has been disclosed without their authorization, and for what purpose(s). However, the Department agrees that the Rule's accounting requirements could have the undesired effect of causing covered entities to halt disclosures of protected health information for research.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 72)

[Assistant]
According to nist_sp800-66r2:

ffect, whichever is later. | Security Rule documented as appropriate? • Have documentation retention requirements under HIPAA been aligned with the organization's other data retention policies? |
| 3.
Ensure That Documentation is Available to Those Responsible for Implementation Implementation Specification (Required) | • Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains. | • Is the location of the documentation known to all staff who need to access it? • Is availability of the documentation made known as part of education, training, and awareness activities? 149                                                                                |

149  See Sec. 5.1.5, HIPAA Standard: Security Awareness and Training.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_postmarket_2016 say about HIPAA compliance? (Part 10)

[Assistant]
According to fda_postmarket_2016:

ng the temperature reading of a thermometer may have different risks than a cybersecurity vulnerability affecting the dosage of an insulin infusion pump because of the severity of patient harm. ## VI.
Medical Device Cybersecurity Risk Management

As part of their risk management process consistent with 21 CFR part 820, a manufacturer should establish, document, and maintain throughout the medical device lifecycle an ongoing process for identifying hazards associated with the cybersecurity of a medical device, estimating and evaluating the associated risks, controlling these risks, and monitoring the effectiveness of the controls. This process should include risk analysis, risk evaluation, risk control, and incorporation of production and post-production information. Elements identified in the Appendix of this guidance should be included as part of the manufacturer's cybersecurity risk management program to support an effective risk management process. Manufacturers should have a defined process to systematically conduct a risk evaluation and determine whether a cybersecurity vulnerability affecting a medical device presents an acceptable or unacceptable risk. It is not possible to describe all hazards, associated risks, and/or controls associated with medical device cybersecurity vulnerabilities in this guidance. It is also not possible to describe all scenarios where risk is controlled or uncontrolled. Rather, FDA recommends that manufacturers define and document their process for objectively assessing the cybersecurity risk for their device(s). As outlined below, it is recommended that such a process focus on assessing the risk of patient harm by considering:

- 1) The exploitability of the cybersecurity vulnerability, and
- 2) The severity of patient harm if the vulnerability were to be exploited. Such analysis should also incorporate consideration of compensating controls and risk mitigations. ## A.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 31)

[Assistant]
According to fda_premarket_2023:

ich it operates:

- Select industry-standard cryptographic algorithms and protocols, and select appropriate key generation, distribution, management and protection, as well as robust nonce mechanisms.
- Use current NIST recommended standards for cryptography (e.g., FIPS 140-3 78 ) or equivalent-strength cryptographic protection that are expected to be considered cryptographically strong throughout the service life of the device. - Manufacturers should not implement cryptographic algorithms that have been deprecated or disallowed in applicable standards or best practices (e.g., NIST SP 800-131A, Transitioning the Use of Cryptographic Algorithms and Key Lengths). Implementation of algorithms with a status of 'legacy use' should be discussed with FDA during a pre-submission meeting. - Design a system architecture and implement security controls to prevent a situation where the full compromise of any single device can result in the ability to reveal keys for other devices. - For example, avoid using master-keys stored on device, or key derivation algorithms based solely on device identifiers or other readily discoverable information. - For example, avoid using device serial numbers as keys or as part of keys. Device serial numbers may be disclosed by patients seeking additional information on their device or might be disclosed during a device recall to identify affected

78  See NIST FIPS 140-3 Security Requirements for Cryptographic Modules . https://doi.org/10.6028/NIST.FIPS.1403

## Contains Nonbinding Recommendations

products and should be avoided as part of the key generation process (e.g., publickey cryptography can be employed to help meet this objective). - Implement cryptographic protocols that permit negotiated parameters/versions such that the most recent, secure configurations are used, unless otherwise necessary. - Do not allow downgrades, or version rollbacks, unless absolutely necessary for safety reasons, and log and document the event.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What is considered a breach under HIPAA?

[Assistant]
According to nist_sp800-66r2:

may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existi


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 528)

[Assistant]
According to privacy_rule_2000:

llowing:
- (i) Identification and date of action. A statement identifying the IRB or privacy board and the date on which the alteration or waiver of authorization was approved;
- (ii) Waiver criteria.
A statement that the IRB or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:
- (A) The use or disclosure of protected health information involves no more than minimal risk to the individuals;
- (B) The alteration or waiver will not adversely affect the privacy rights and the welfare of the individuals;
- (C) The research could not practicably be conducted without the alteration or waiver;
- (D) The research could not practicably be conducted without access to and use of the protected health information;
- (E) The privacy risks to individuals whose protected health information is to be used or disclosed are reasonable in relation to the anticipated benefits if any to the individuals, and the importance of the knowledge that may reasonably be expected to result from the research;
- (F) There is an adequate plan to protect the identifiers from improper use and disclosure;
- (G) There is an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers, or such retention is otherwise required by law; and
- (H) There are adequate written assurances that the protected health

Frm 00356

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart. - (iii) Protected health information needed.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 86)

[Assistant]
According to privacy_rule_2000:

'laboratory results from July 1998'' or ''all laboratory results'' or ''results of MRI performed in July 1998.'' The covered entity can then use or disclose that information and only that information.
If the covered entity does not understand what information is covered by the authorization, the use or disclosure is not permitted unless the covered entity clarifies the request. There are no limitations on the information that can be authorized for disclosure. If an individual wishes to authorize a covered entity to disclose his or her entire medical record, the authorization can so specify. In order for the covered entity to disclose the entire medical record, the authorization must be specific enough to ensure that the individual has a clear understanding that the entire record will be disclosed. For example, if the Social Security Administration seeks authorization for release of all health information to facilitate the processing of benefit applications, then the description on the authorization form must specify ''all health information'' or the equivalent. In some instances, a covered entity may be reluctant to undertake the effort to review the record and select portions relevant to the request (or redact portions not relevant). In such circumstances, covered entities may provide the entire record to the individual, who may then redact and release the more limited information to the requestor. This rule does not require a covered entity to disclose information pursuant to an individual's authorization. Second, the authorization must include the name or other specific identification of the person(s) or class of persons that are authorized to use or disclose the protected health information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 105)

[Assistant]
According to privacy_mod_2002:

2003, rather than the effective date of the modification, or, even less so, to any

VerDate Aug<2,>2002

business associate arrangement regardless of whether a written contract currently exists.
A covered entity that does not have a written contract with a business associate prior to the effective date of this modification does not encounter the same burdens described by other commenters associated with having to reopen and renegotiate many existing contracts at once. The Department believes that such a covered entity should be able to enter into a compliant business associate contract by the compliance date of the Rule. Further, those covered entities whose business associate contracts come up for renewal or modification prior to the compliance date have the opportunity to bring such contracts into compliance by April 14, 2003. Thus, a covered entity that enters into a business associate contract after the effective date of this modification, or that has a contract that is renewed or modified prior to the compliance date of the Rule, is not eligible for the transition period and is required to have a business associate contract in place that meets the applicable requirements of §§164.502(e) and 164.504(e) by the Privacy Rule's compliance date of April 14, 2003. Further, as in the proposed Rule, the transition provisions apply only to written contracts or other written arrangements. Oral contracts or other arrangements are not eligible for the transition period. The Department clarifies, however, that nothing in these provisions requires a covered entity to come into compliance with the business associate contract provisions prior to April 14, 2003.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 476)

[Assistant]
According to privacy_rule_2000:

health information, either under permissible exceptions to the disclosure rules or through an individual's expressed authorization, will likely incur some costs complying with provisions of this rule.
Samples of state and local agencies or programs encompassed by the broad scope of this rule include: Medicaid, State Children's Health Insurance Programs, county hospitals, state mental health facilities, state or local nursing facilities, local health clinics, and public health surveillance activities, among others. We have included state and local costs in the estimation of total costs in this section. The greatest cost and administrative burden on the state and local government will fall to agencies and programs that act as covered entities, by virtue of being either a health plan or provider, such as Medicaid, State Children's Health Insurance Programs, and county hospitals. These and other health insurance or provider programs operated by state and local government are subject to requirements placed on covered entities under this rule, including, but not limited to, those outlined in this section (Section E) of the impact analysis. Many of these state and local programs already afford privacy protections for individually identifiable health information through the Privacy Act. For example, state governments often become subject to Privacy Act requirements when they contract with the federal government. This rule is expected to create additional requirements beyond those covered by the Privacy Act. Furthermore, we anticipate that most state and local health programs will, to some extent, need to modify their existing Privacy Act practices to fully comply with this rule. The cost to state

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

and local programs that function as health plans will be different than the private sector, much as the federal costs vary from private health plans.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the physical safeguards under HIPAA?

[Assistant]
According to hitech_omnibus_2013:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

## RIN 0945-AA03

Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules

AGENCY: Office for Civil Rights, Department of Health and Human Services. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (HHS or ''the Department'') is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (''the HITECH Act'' or ''the Act'') to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities. DATES: Effective date: This final rule is effective on March 26, 2013. Compliance date: Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013. FOR FURTHER INFORMATION CONTACT: Andra Wicks 202-205-2292. SUPPLEMENTARY INFORMATION:

VerDate Mar<15>2010

18:57 Jan 24, 2013

Jkt 229001

sroberts on DSK5SPTVN1PROD with

## I.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 121)

[Assistant]
According to privacy_rule_2000:

ation to Intelligence Community

The NPRM would have provided an exemption from its proposed requirements to the intelligence community. As defined in section 4 of the National Security Act, 50 U.S.C.
401a, the intelligence community includes: the Office of the Director of Central Intelligence Agency; the Office of the Deputy Director of Central Intelligence; the National Intelligence Council and other such offices as the Director may designate; the Central Intelligence Agency; the National Security Agency; the Defense Intelligence Agency; the National Imagery and Mapping Agency ; the National Reconnaissance Office; other offices within the DOD for the collection of specialized national intelligence through reconnaissance programs; the intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Federal Bureau of Investigation, the Department of the Treasury, and the Department of Energy; the Bureau of Intelligence and Research of the Department of State; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of Central Intelligence and the head of the department or agency concerned, as an element of the intelligence community. It would have allowed a covered entity to use without individual authorization protected health information of employees of the intelligence community, and of their dependents, if such dependents were being considered for posting abroad. The final rule does not include such an exemption. Rather, the final rule does not except intelligence community employees and their dependents from the general rule requiring an authorization in order for protected health information to be used and disclosed.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 85)

[Assistant]
According to hitech_omnibus_2013:

dditionally, the Privacy Rule has always required that such communications contain a description of how the individual may opt out of receiving further fundraising communications (§164.514(f)(2)(ii)).
With respect to the proposed requirement that the method for an individual to elect not to receive further fundraising communications should not cause the individual to incur an undue burden or more than a nominal cost, we generally agree with the commenters who suggested that the final rule be flexible and not prescriptive. Under the final rule, covered entities are free to decide what methods individuals can use to opt out of receiving further fundraising communications, as long as the chosen methods do not impose an undue burden or more than a nominal cost on individuals. Covered entities should consider the use of a toll-free phone number, an email address, or similar opt out mechanisms that provide individuals with simple, quick, and inexpensive ways to opt out of receiving further fundraising communications. Covered entities may employ multiple opt out methods, allowing individuals to determine which opt out method is the simplest and most convenient for them, or a single method that is reasonably accessible to all individuals wishing to opt out. In response to commenters who expressed concern about the cost of setting up a toll-free phone number, we clarify that covered entities may require individuals who wish to opt out of further fundraising communications to do so through other methods, (e.g., through the use of a local phone number), where appropriate, as long as the method or methods adopted do not impose an undue burden or cost on the individual. We encourage covered entities to consider the size of the population to which they are sending the communications, the geographic distribution, and any other factors that may help determine which opt out method(s) is most appropriate and least burdensome to individuals.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 444)

[Assistant]
According to privacy_rule_2000:

s regardless of storage medium, HHS must make a distinction in its cost estimates between records stored electronically and those which must be accessed by manual means, since these costs will differ.
Response: The cost estimates made for regulations are not intended to provide such refined gradations; rather, they are intended to show the overall costs for the regulation as a whole and its major components. For inspections and copying (and virtually all other areas for which estimates are made) estimates are based on averages; particular providers may experience greater or lesser costs than the average cost used in this analysis. Comment: Several commenters noted that the Department did not appear to include the cost of establishing storage systems, retrieval fees and the cost of searching for records, and that these costs, if included, would significantly increase the Department's estimate. Response: Currently, providers keep and maintain medical records and often provide copies to other providers and patients. Therefore, much of the cost of maintaining records already exists. Indeed, based on public comments, the Department has concluded that there will be relatively few additional copies requested as the result of this regulation (see below). We have measured and attributed to this regulation the incremental cost, which is the standard for conducting this kind of analysis. Comment: A federal agency expressed concern over the proposal to allow covered entities to charge a fee for copying personal health information based on reasonable costs. The agency requests personal health information from many covered entities and pays a fee that it establishes. Allowing covered entities to establish the fee, the agency fears, may cost them significantly more than the current amounts they pay and as a result, could adversely affect their program.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 286)

[Assistant]
According to privacy_rule_2000:

n for these purposes, including if the covered entity is required to do so by other law. Though we do not believe any states currently require such authorizations, we wanted to avoid future conflicts.
These changes should resolve the concerns raised by commenters regarding conflicts with state laws that require consent, authorization, or other types of written legal permission for uses and disclosures of protected health information. Frm 00189

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

Comment: Some commenters noted that there would be circumstances when consent is impossible or impractical. A few commenters suggested that in such situations patient information be deidentified or reviewed by an objective third party to determine if consent is necessary. Response: Covered health care providers with direct treatment relationships are required to obtain consent to use or disclose protected health information to carry out treatment, payment, and health care operations. In certain treatment situations where the provider is permitted or required to treat an individual without the individual's written consent to receive health care, the provider may use and disclose protected health information created or obtained in the course of that treatment without the individual's consent under this rule (see § 164.506(a)(3)). In these situations, the provider must attempt to obtain the individual's consent and, if the provider is unable to obtain consent, the provider must document the attempt and the reason consent could not be obtained. Together with the uses and disclosures permitted under §§ 164.510 and 164.512, the concerns raised regarding situations in which it is impossible or impractical for covered entities to obtain the individual's permission to use or disclose protected health information about the individual have been addressed.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_postmarket_2016 say about HIPAA compliance? (Part 5)

[Assistant]
According to fda_postmarket_2016:

e, or recover from the effects of cyber threats, or voluntarily disseminate critical infrastructure information to its members or others involved in the detection and response to cybersecurity issues.
6

The ISAOs (https://www.dhs.gov/isao) are intended to be: Inclusive (groups from any and all sectors, both non-profit and for-profit, expert or novice, should be able to participate in an ISAO); Actionable (groups will receive useful and practical cybersecurity risk, threat indicator, and incident information via automated, real-time mechanisms if they choose to participate in an ISAO); Transparent (groups interested in an ISAO model will have adequate understanding of how that model operates and if it meets their needs); and Trusted (participants in an ISAO can request that their information be treated as Protected Critical Infrastructure Information (https://www.dhs.gov/pcii-program). Such information is shielded from any release otherwise required by the Freedom of Information Act or State Sunshine Laws and is exempt from regulatory use and civil litigation if the information satisfies the requirements of the Critical Infrastructure Information Act of 2002 (6 U.S.C. §§ 131 et seq.)). The FDA Center for Devices and Radiological Health has entered into a Memorandum of Understanding with one such ISAO, the National Health Information Sharing & Analysis Center, (NH-ISAC) 7 in order to assist in the creation of an environment that fosters stakeholder collaboration and communication, and encourages the sharing of information about cybersecurity threats and vulnerabilities that may affect the safety, effectiveness, integrity, and security of the medical devices and the surrounding Health IT infrastructure. 6 See Homeland Security Act (https://www.dhs.gov/xlibrary/assets/hr\_5005\_enr.pdf), 6 U.S.C. § 212 (2002). 7 See Memorandum of Understanding between the National Health Information Sharing & Analysis Center, Inc.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 46)

[Assistant]
According to privacy_mod_2002:

ress legal permission obtained for uses and disclosures of protected health information for treatment, payment, and health care operations prior to the compliance date of the Privacy Rule are deleted.
The proposal to permit a covered entity to use or disclose protected health information for these purposes without consent or authorization would apply to any protected health information held by a covered entity whether created or received before or after the compliance date. Therefore, transition provisions are not necessary. This final Rule also includes conforming changes to the definition of ''more stringent'' in § 160.202; the text of § 164.500(b)(1)(v), §§ 164.508(a)(2)(i) and (b)(3)(i), and § 164.520(b)(1)(ii)(B); the introductory text of §§ 164.510 and 164.512, and the title of § 164.512 to eliminate references to required consent. ## Response to Other Public Comments

Comment: There were three categories of commenters with respect to the Rule's general approach to consentthose that supported the changes proposed in the NPRM provisions, those that requested targeted changes to the consent requirement, and those that requested that the consent requirement be strengthened. Many commenters supported the NPRM approach to consent, making consent to use or disclose protected health information for treatment, payment, and health care operations voluntary for all covered entities. These commenters said that this approach provided flexibility for covered entities to address consent in a way that is consistent with their practices. These commenters also stated that the NPRM approach assured that the Privacy Rule would not interfere with or delay necessary treatment.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 20)

[Assistant]
According to security_rule_2003:

covered entities have the flexibility to implement the standard in a manner consistent with numerous factors, including such things as, but not limited to, their size, degree of risk, and environment.
We have deleted the implementation specification calling for an organizational security policy, as it duplicated requirements of the security management and training standard. We note that the implementation specification for a risk analysis at §164.308(a)(1)(ii)(A) does not specifically require that a covered entity perform a risk analysis often enough to ensure that its security measures are adequate to provide the level of security required by § 164.306(a). In the proposed rule, an assurance of adequate security was framed as a requirement to keep security measures ''current.'' We continue to believe that security measures must remain current, and have added regulatory language in §164.306(e) as a more precise way of communicating that security measures

Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

Jkt 200001

in general that must be periodically reassessed and updated as needed. The risk analysis implementation specification contains other terms that merit explanation. Under §164.308(a)(1)(ii)(A), the risk analysis must look at risks to the covered entity's electronic protected health information. A thorough and accurate risk analysis would consider ''all relevant losses'' that would be expected if the security measures were not in place. ''Relevant losses'' would include losses caused by unauthorized uses and disclosures and loss of data integrity that would be expected to occur absent the security measures. b. Comment: Relative to the development of an entity's sanction policy, one commenter asked that we describe the sanction penalties for breach of security.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 50)

[Assistant]
According to privacy_rule_2000:

ed rule. We define the term in order to describe certain arrangements in which participants need to share protected health information about their patients to manage and benefit the common enterprise.
To allow uses and disclosures of protected health information for these arrangements, we also add language to the definition of ''health care operations.'' See discussion of that term above. We include five arrangements within the definition of organized health care arrangement. The arrangements involve clinical or operational integration among legally separate covered entities in which it is often necessary to share protected health information for the joint management and operations of the arrangement. They may range in legal structure, but a key component of these arrangements is that individuals who obtain services from them have an expectation that these arrangements are integrated and that they jointly manage their operations. We include within the definition a clinically integrated care setting in which individuals typically receive health care from more than one health care provider. Perhaps the most common example of this type of organized health care arrangement is the hospital setting, where a hospital and a physician with staff privileges at the hospital together provide treatment to the individual. Participants in such clinically integrated settings need to be able to share health information freely not only for treatment purposes, but also to improve their joint operations. For example, any physician with staff privileges at a hospital must be able to participate in the hospital's morbidity and mortality reviews, even when the particular physician's patients are not being discussed. Nurses and other hospital personnel must also be able to participate. These activities benefit the common enterprise, even when the benefits to a particular participant are not evident.