[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 212)

[Assistant]
According to privacy_rule_2000:

result in abuse. Finally, upholding privacy protections benefits all persons who have or may be served by the covered entity as well as the general public, and not only the subject of the information.
If a complaint is received from someone who is not the subject of protected health information, the person who is the subject of this information may be concerned with the Secretary's investigation of this complaint. While we did not receive comments on this issue, we want to protect the privacy rights of this individual. This might

Frm 00140

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

involve the Secretary seeking to contact the individual to provide information as to how the Secretary will address individual's privacy concerns while resolving the complaint. Contacting all individuals may not be practicable in the case of allegations of systemic violations (e.g., where the allegation is that hundreds of medical records were wrongfully disclosed). Requiring That a Complainant Exhaust the Covered Entity's Internal Complaint Process Prior to Filing a Complaint With the Secretary

Comment: A number of commenters, primarily health plans, suggested that individuals should not be permitted to file a complaint with the Secretary until they exhaust the covered entity's own complaint process. Commenters stated that covered entities should have a certain period of time, such as ninety days, to correct the violation. Some commenters asserted that providing for filing a complaint with the Secretary will be very expensive for both the public and private sectors of the health care industry to implement. Other commenters suggested requiring the Secretary to inform the covered entity of any complaint it has received and not initiate an investigation or ''take enforcement action'' before the covered entity has time to address the complaint. Response: We have decided, for a number of reasons, to retain the approach as presented in the proposed rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 426)

[Assistant]
According to privacy_rule_2000:

ated that a hospital medical records department generally makes notations regarding information it releases, but that these notations do not include disclosures that the emergency department may make.
Several commenters proposed that the rule provide for patients to receive only an accounting of disclosures made by medical records departments or some other central location, which would relieve the burden of centralizing accounting for those entities who depend on paper records and tracking systems. Response: We disagree with commenters' arguments that covered entities should not be held accountable for the actions of their subdivisions or workforce members. Covered entities are responsible for accounting for the disclosures of protected health information made by the covered entity, in accordance with this rule. The particular person or department within the entity that made the disclosure is immaterial to the covered entity's obligation. In the final rule, we require covered entities to document each disclosure that is required to be included in an accounting. We do not, however, require this documentation to be maintained in a central registry. A covered hospital, for example, could maintain separate documentation of disclosures that are made from the medical records department and the emergency department. At the time an individual requests an accounting, this documentation could be integrated to provide a single accounting of disclosures made by the covered hospital. Alternatively, the covered hospital could centralize its processes

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00282

for making and documenting disclosures. We believe this provision provides covered entities with sufficient flexibility to meet their business needs without compromising individuals' rights to know how information about them is disclosed.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 536)

[Assistant]
According to privacy_rule_2000:

ve date. The notice must contain the date on which the notice is first in effect, which may not be earlier than the date on which the notice is printed or otherwise published. - (2) Optional elements.
(i) In addition to the information required by paragraph (b)(1) of this section, if a covered entity elects to limit the uses or disclosures that it is permitted to make under this subpart, the covered entity may describe its more limited uses or disclosures in its notice, provided that the covered entity may not include in its notice a limitation affecting its right to make a use or disclosure that is required by law or permitted by § 164.512(j)(1)(i). - (ii) For the covered entity to apply a change in its more limited uses and disclosures to protected health information created or received prior to issuing a revised notice, in accordance with § 164.530(i)(2)(ii), the notice must include the statements required by paragraph (b)(1)(v)(C) of this section. - (3) Revisions to the notice. The covered entity must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the individual's rights, the covered entity's legal duties, or other privacy practices stated in the notice. Except when required by law, a material change to any term of the notice may not be implemented prior to the effective date of the notice in which such material change is reflected. - (c) Implementation specifications: Provision of notice. A covered entity must make the notice required by this

Frm 00361

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(4) of this section, as applicable. (1) Specific requirements for health plans.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 168)

[Assistant]
According to hitech_omnibus_2013:

................ | 660,550                  | $2,052,665 |
| Total .......................................................................................................... | ........................
| ........................ | ........................ | $3,869,044 |

As in the interim final rule, we have also imputed a cost to the time individuals will spend calling the tollfree number. In estimating the time involved, we assumed that a person will spend five minutes per call. However, the person may not get through the first time and thus may have to call back a second time which could add another 5 minutes. Taking the average between 5 and 10 minutes, we used an average time of 7.5 minutes per caller. For purposes of imputing cost to an individual's time, we took the median compensation amount from the Bureau of Labor Statistics of $24.86 33 for all occupations. Dividing 60 by 7.5 minutes yields 8 calls per hour. Dividing the number of calls per hour into 660,550 calls and then multiplying by $24.86, gives us a cost of $2,052,665. ## Cost of Breaches Involving More Than 500 Individuals

If a covered entity experiences a breach of protected health information affecting more than 500 individuals of a State or jurisdiction, § 164.406 of the rule requires the entity to notify the media in the jurisdiction or State in which the individuals reside. In addition, § 164.408 of the rule requires the entity to notify the Secretary contemporaneously with notice to affected individuals in cases where 500 or more individuals are affected by a breach. As stated in the interim final rule, we anticipate that a covered entity will issue a press release when it must notify the media under § 164.406. The tasks involved in issuing the press release will be the drafting of the statement and clearing it through the entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 319)

[Assistant]
According to privacy_rule_2000:

e of protected health information and the reuse of this information by other agencies covered in proposed § 164.510, the President should issue an Executive Order barring such re-disclosure and reuse.
One of these groups specified that the Executive Order should bar re-use and re-disclosure of protected health information in actions against individuals. In contrast, some commenters advocated information-sharing between law enforcement and oversight agencies. Most of these commenters recognized that the NPRM would have allowed reuse and re-disclosure of protected health information from oversight to law

Frm 00211

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

enforcement agencies, and they supported this approach. Response: We believe that the language we have added to the rule, at §164.512(d)(2) and the corresponding explanation in the preamble, to clarify the boundary between disclosures for health oversight and for law enforcement purposes should partially address the concern expressed by some that oversight agencies will be the back door for access by law enforcement. In situations when the individual is the subject of an investigation or activity and the investigation or activity is not related to health care fraud, the requirements for disclosure to law enforcement must be met, and an oversight agency cannot request the information under its more general oversight authority. We acknowledge, however, that there will be instances under the rule when a health oversight agency (or a law enforcement agency in its oversight capacity) that has obtained protected health information appropriately will be able to redisclose the information to a law enforcement agency for law enforcement purposes. Under HIPAA, we have the authority to restrict redisclosure of protected health information only by covered entities. Re-disclosures by public agencies such as oversight agencies are not within the purview of this rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 92)

[Assistant]
According to hitech_omnibus_2013:

plex, while several commenters recommended that

18:57 Jan 24, 2013

PO 00000

Frm 00061

the final rule require NPPs to be shortened, simplified, and written in a clear, easily understandable manner.
In addition, while a few commenters suggested that HHS provide a sample or standard NPP, many more commenters requested flexibility in developing the content of their respective NPPs. Response: We believe that the additions to the NPP required by the final rule are necessary to fully inform individuals of the covered entity's privacy practices and their rights. The NPP should be provided in a clear, concise, and easy to understand manner, and we clarify that covered entities may use a ''layered notice'' to implement the Rule's provisions, so long as the elements required at §164.520(b) are included in the document that is provided for the individual. For example, a covered entity may satisfy the NPP provisions by providing the individual with both a short notice that briefly summarizes the individual's rights, as well as other information, and a longer notice, layered beneath the short notice that contains all the elements required by the Rule. Additionally, the Privacy Rule requires that the NPP be written in plain language, and we note that some covered entities may have obligations under other laws with respect to their communication with affected individuals. For example, to the extent a covered entity is obligated to comply with Title VI of the Civil Rights Act of 1964, the covered entity must take reasonable steps to ensure meaningful access for Limited English Proficient persons to the services of the covered entity, which could include translating the NPP into frequently encountered languages. In addition, we agree with the commenters who suggested that covered entities have flexibility and discretion to determine how to draft and prepare their NPPs.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 87)

[Assistant]
According to hitech_omnibus_2013:

has a right to opt out of receiving such communications. The final rule does not require covered entities to send pre-solicitation opt outs to individuals prior to the first fundraising communication.
We believe that because the individual will be on notice of the opportunity to opt out of receiving fundraising communications through the notice of privacy practices and the first fundraising communication itself will contain a clear and conspicuous opportunity to opt out, there is no need to require covered entities to incur the additional burden and cost of sending pre-solicitation opt outs. Under the Privacy Rule fundraising communications can take many forms, including communications made over the phone. Despite the fact that the HITECH Act refers only to written fundraising communications, because the Privacy Rule applies to communications made over the phone, we believe it would be counterintuitive to apply the strengthened opt out requirement to only written fundraising communications. Therefore, like fundraising communications made in writing, covered entities that make fundraising communications over the phone must clearly inform individuals that they have a right to opt out of further solicitations. Accordingly, to make clear that the opt out requirement applies to fundraising solicitations made over the phone, the final rule provides that the opt out requirement applies to each fundraising communication ''made'' rather than ''sent'' to an individual. We also emphasize that the notice and opt out requirements for fundraising communications apply only where the covered entity is using or disclosing protected health information to target the fundraising communication. If the covered entity does not use protected health information to send fundraising materials, then the notice and opt out requirements do not apply.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 436)

[Assistant]
According to privacy_rule_2000:

well within this mandate. Comments: Several commenters suggested that the documentation requirements not be established as a standard under the regulation, because standards are subject to penalties.
They recommend we delete the documentation standards and instead provide specific guidance and technical assistance. Several commenters objected to the suggestion in the NPRM that professional associations assist their members by developing appropriate policies for their membership. Several commentators representing professional associations believed this to be an onerous and costly burden for the associations, and suggested instead that we develop specific models which might require only minor modification. Some of these same associations were also concerned about liability issues in developing such guidelines. One commenter argued that sample forms, procedures, and policies should be provided as part of the Final Rule, so that practitioners would not be overburdened in meeting the demands of the regulations. They urged us to apply this provision only to larger entities. Response: The purpose of requiring covered entities to develop policies and procedures for implementing this regulation is to ensure that important decisions affecting individuals' rights and privacy interests are made thoughtfully, not on an ad hoc basis. The purpose of requiring covered entities to maintain written documentation of these policies is to facilitate workforce training, and to facilitate creation of the required notice of information practices. We further believe that requiring written documentation of key decisions about privacy will enhance accountability, both within the covered entity and to the Department, for compliance with this regulation. We do not include more specific guidance on the content of the required policies and procedures because of the vast difference in the size of covered entities and types of covered entities' businesses.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 30)

[Assistant]
According to fda_premarket_2023:

several methods including the use of cryptographic nonces (an arbitrary number used only once in a cryptographic communication);

75 See the definition of security strength in Appendix 5, Terminology.
## Contains Nonbinding Recommendations

- Provide mechanisms for verifying the authenticity of information originating from the device, such as telemetry. This is especially important for data that, if spoofed or otherwise modified, could result in patient harm, such as the link between a clinician programmer or monitoring device and an implanted device like a pacemaker, defibrillator, or neurostimulator; or the link between a continuous glucose monitor system and an automated insulin pump;
- Do not rely on cyclic redundancy checks (CRCs) as security controls. CRCs do not provide integrity or authentication protections in a security environment. While CRCs are an error detecting code and provide integrity protection against environmental factors (e.g., noise or EMC), they do not provide protections against an intentional or malicious actor; and
- Consider how the device and/or system should respond in event of authentication failure(s). ## Authorization

For the purposes of this guidance, authorization is the right or a permission that is granted to a system entity (e.g., a device, server, or software function) to access a system resource. More specifically, as a defensive measure, an authorization scheme enforces privileges (i.e., 'rights' associated with authenticated sessions, identities and/or roles). These privileges either permit allowed behavior, or refuse disallowed behavior in order to ensure that system resources are only accessed in accepted ways, by accepted parties. Within an adequately designed authorization scheme, the principle of least privileges 76 should be applied to users, system functions, and others, to only allow those entities the levels of system access necessary to perform a specific function.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 341)

[Assistant]
According to privacy_rule_2000:

he proposed rule would have provided open-ended access by law enforcement to victims' medical records because of this difficulty in evaluating law enforcement claims of their need for the information.
Response: We modify the NPRM in several ways that reduce covered entities' decisionmaking burdens. The final rule clarifies that covered entities may disclose protected health information about a victim of crime where a report is required by state or other law, and it requires the victim's agreement for disclosure in most other instances. The covered entity must make the decision whether to disclose only in limited circumstances: when there is no mandatory reporting law; or when the victim is unable to provide agreement and the law enforcement official represents that: the protected health information is needed to determine whether a violation of law by a person other than the victim has occurred, that the information will not be used against the victim, and that immediate law enforcement activity that depends on such information would be materially and adversely affected by waiting until the individual is able to agree to the disclosure. In these circumstances, we believe it is appropriate to rely on the covered entity, in the exercise of professional judgment, to determine whether the disclosure is in the individual's best interests. Other sections of this rule allow covered entities to reasonably rely on certain representations by law enforcement officials (see § 164.514, regarding verification,) and require disclosure of the minimum necessary protected health information for this purpose. Together, these provisions do not allow open-ended access or place undue responsibility on providers.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 5)

[Assistant]
According to hitech_omnibus_2013:

ent more of the HITECH Act's changes to HIPAA enforcement. In addition to the proposed modifications to implement the HITECH Act, the NPRM also proposed certain other modifications to the HIPAA Rules.
The NPRM proposed to permit the use of compound authorizations for conditioned and unconditioned research activities and requested comment regarding permitting authorizations for future research. Additionally, the NPRM proposed to modify the Privacy Rule's application to the individually identifiable health information of decedents and to permit covered entities that obtain the agreement of a parent to provide proof of immunization without written authorization to schools that are required to have such information. ## iii. The Genetic Information Nondiscrimination Act

The Genetic Information Nondiscrimination Act of 2008 (''GINA''), Pub. L. 110-233, 122 Stat. 881, prohibits discrimination based on an individual's genetic information in both the health coverage (Title I) and employment (Title II) contexts. In addition to the nondiscrimination provisions, section 105 of Title I of GINA contains new privacy protections for genetic information, which require the Secretary of HHS to revise the Privacy Rule to clarify that genetic information is health information and to prohibit group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes. On October 7, 2009, the Department published a proposed rule to strengthen the privacy protections for genetic information under the HIPAA Privacy Rule by implementing the protections for genetic information required by GINA and making related changes to the Rule. The 60-day public comment period for the proposed rule closed on December 7, 2009. The Department received about 25 comments on the proposed rule. ## II.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 22)

[Assistant]
According to security_rule_2003:

ce security.'' This is addressable because in certain circumstances, for example, a solo physician practice whose staff consists only of the physician's spouse, formal procedures may not be necessary.
The proposed ''Personnel security policy/procedure'' and ''record of access authorizations'' implementation features have been removed from this final rule, as they have been determined to be redundant. Implementation of the balance of the ''Workforce security'' implementation specifications and the

VerDate Jan<31>2003

other standards contained within this final rule will result in assurance that all personnel with access to electronic protected health information have the required access authority as well as appropriate clearances. a. Comment: The majority of comments concerned the supervision of maintenance personnel by an authorized knowledgeable person. Commenters stated this would not be feasible in smaller settings. For example, the availability of technically knowledgeable persons to ensure this supervision would be an issue. We were asked to either reword this implementation feature or delete it. Response: We agree that a ''knowledgeable'' person may not be available to supervise maintenance personnel. We have accordingly modified this implementation specification so that, in this final rule, we are adopting an addressable implementation specification titled, ''Authorization and/or supervision,'' requiring that workforce members, for example, operations and maintenance personnel, must either be supervised or have authorization when working with electronic protected health information or in locations where it resides (see §164.308(a)(3)(ii)(A)). Entities can decide on the feasibility of meeting this specification based on their risk analysis. b.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the differences between covered entity and business associate obligations under HIPAA?

[Assistant]
According to privacy_mod_2002:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

## 45 CFR Parts 160 and 164

RIN 0991-AB14

## Standards for Privacy of Individually Identifiable Health Information

AGENCY: Office for Civil Rights, HHS. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (''HHS'' or ''Department'') modifies certain standards in the Rule entitled ''Standards for Privacy of Individually Identifiable Health Information'' (''Privacy Rule''). The Privacy Rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996. The purpose of these modifications is to maintain strong protections for the privacy of individually identifiable health information while clarifying certain of the Privacy Rule's provisions, addressing the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieving unintended administrative burdens created by the Privacy Rule. DATES: This final rule is effective on October 15, 2002. FOR FURTHER INFORMATION CONTACT: Felicia Farmer, 1-866-OCR-PRIV (1866-627-7748) or TTY 1-866-7884989. ## SUPPLEMENTARY INFORMATION:

Availability of copies, and electronic access. Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 (or toll-free at 1-866-5121800) or by fax to (202) 512-2250. The cost for each copy is $10.00.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 7)

[Assistant]
According to fda_premarket_2023:

f processes that reduces the number and severity of vulnerabilities in products throughout the device lifecycle. Examples of such frameworks exist in many sectors, including the medical device sector.
Risk management for device manufacturers is the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle to ensure that the devices they manufacture are safe and effective. The Quality System (QS) regulation in 21 CFR Part 820 explicitly addresses risk management activities in 21 CFR 820.30(g). FDA issued a final rule 11 amending the device current good manufacturing practice (CGMP) requirements of the Quality System (QS) Regulation under 21 CFR 820 to align more closely with the international consensus standard for Quality Management Systems for medical devices used by many other regulatory authorities around the world, and the final rule incorporates risk management throughout its requirements. 12

The recommendations contained in this guidance are intended to supplement FDA's Postmarket Cybersecurity Guidance, and 'Content of Premarket Submissions for Device Software Functions,' hereafter referred to as the 'Premarket Software Guidance.' This guidance replaces the 2014 final guidance 'Content of Premarket Submissions for Management of Cybersecurity in Medical Devices.'

The recommendations in this guidance also generally align with or expand upon the recommendations in the Pre-Market Considerations for Medical Device Cybersecurity section of the International Medical Device Regulators Forum (IMDRF) final guidance 'Principles and Practices for Medical Device Cybersecurity,' issued in March 2020. Additionally, section 3305 of the Food and Drug Omnibus Reform Act of 2022 ('FDORA'), enacted on December 29, 2022, added section 524B 'Ensuring Cybersecurity of Medical Devices' to the FD&C Act.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the administrative safeguards under HIPAA?

[Assistant]
According to privacy_mod_2002:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

## 45 CFR Parts 160 and 164

RIN 0991-AB14

## Standards for Privacy of Individually Identifiable Health Information

AGENCY: Office for Civil Rights, HHS. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (''HHS'' or ''Department'') modifies certain standards in the Rule entitled ''Standards for Privacy of Individually Identifiable Health Information'' (''Privacy Rule''). The Privacy Rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996. The purpose of these modifications is to maintain strong protections for the privacy of individually identifiable health information while clarifying certain of the Privacy Rule's provisions, addressing the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieving unintended administrative burdens created by the Privacy Rule. DATES: This final rule is effective on October 15, 2002. FOR FURTHER INFORMATION CONTACT: Felicia Farmer, 1-866-OCR-PRIV (1866-627-7748) or TTY 1-866-7884989. ## SUPPLEMENTARY INFORMATION:

Availability of copies, and electronic access. Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 (or toll-free at 1-866-5121800) or by fax to (202) 512-2250. The cost for each copy is $10.00.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 134)

[Assistant]
According to privacy_mod_2002:

authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself. - (6) Documentation.
A covered entity must document and retain any signed authorization under this section as required by § 164.530(j). - (c) Implementation specifications: Core elements and requirements.-(1) Core elements. A valid authorization under this section must contain at least the following elements:
- (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. - (ii) The name or other specific identification of the person(s), or class

19:04 Aug 13, 2002

PO 00000

Frm 00089

- of persons, authorized to make the requested use or disclosure. - (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. - (iv) A description of each purpose of the requested use or disclosure. The statement ''at the request of the individual'' is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. - (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement ''end of the research study,'' ''none,'' or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. - (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. - (2) Required statements.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 89)

[Assistant]
According to privacy_rule_2000:

hold the information may not be providing the long term care and may not, therefore, be aware of the individual's coverage under the policy or that the individual is receiving long term care services.
An authorization obtained by the long term care insurer will help to demonstrate these facts to the providers holding the information, which will make them more confident that the individual intends for the information to be shared. Similarly, an insurer with subrogation obligations may need health information from the enrollee's providers to assess or prosecute the claim. A patient's new

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00059

physician may also need medical records from the patient's prior providers in order to treat the patient. Without an authorization that demonstrates the patient's intent for the information to be shared, the covered entity that maintains the protected health information may be reluctant to provide the information, even if that covered entity's consent permits such disclosure to occur. These authorizations may also be useful to accomplish clinical coordination and integration among covered entities that do not meet the definitions of affiliated covered entities or organized health care arrangements. For example, safety-net providers that participate in the Community Access Program (CAP) may not qualify as organized health care arrangements but may want to share protected health information with each other in order to develop and expand integrated systems of care for uninsured people. An authorization under this section would permit such providers to receive protected health information from other CAP participants to engage in such activities. Because of such concerns, we permit a covered entity to request the individual's authorization to obtain protected health information from another covered entity to carry out treatment, payment, and health care operations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 59)

[Assistant]
According to hitech_omnibus_2013:

xact words do not need to be used in the statement. We provide discretion for covered entities to craft appropriate language that reflects, for example, the specific type of remuneration they receive.
As we explained in the NPRM, with respect to the recipient of the information, if protected health information is

VerDate Mar<15>2010

disclosed for remuneration by a covered entity or business associate to another covered entity or business associate in compliance with the authorization requirements at proposed §164.508(a)(4)(i), the recipient covered entity or business associate could not redisclose the protected health information in exchange for remuneration unless a valid authorization was obtained in accordance with proposed §164.508(a)(4)(i). We requested comment on these provisions. At proposed § 164.508(a)(4)(ii), we set forth the exceptions to the authorization requirement. We proposed the exceptions provided for by section 13405(d)(2) of the HITECH Act, and also proposed to exercise the authority granted to the Secretary in section 13405(d)(2)(G) to include additional exceptions that we deemed to be similarly necessary and appropriate. These exceptions are discussed below. We requested comment on whether there were additional exceptions that should be included in the final regulation. First, we proposed to include an exception to cover exchanges for remuneration for public health activities pursuant to §§ 164.512(b) or 164.514(e). We added the reference to § 164.514(e) of the Privacy Rule to ensure that disclosures of protected health information for public health activities in limited data set form would also be excepted from the authorization requirement, in addition to disclosures that may occur under § 164.512(b) with more identifiable information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 13)

[Assistant]
According to breach_notification_2009:

ses of the statute, means an individual who is authorized to access protected health information, and thus, for clarity, we have substituted this language for the statutory language in the regulation.
Thus, a person who is authorized to access protected health information is similarly situated, for purposes of this regulation, to another person at the covered entity, business associate of the covered entity, or organized health care arrangement in which the covered entity participates, who is also authorized to access protected health information (even if the two persons may not be authorized to access the same types of protected health information). For example, a physician who has authority to use or disclose protected health information at a hospital by virtue of participating in an organized health care arrangement with the hospital is similarly situated to a nurse or billing employee at the hospital. In contrast, the physician is not similarly situated to an employee at the hospital who is not authorized to access protected health information. Additionally, we have interpreted ''same facility'' to mean the same covered entity, business associate, or organized health care arrangement in which the covered entity participates and have substituted this language in the regulation. By focusing on the legal entity or status of the entities as an organized health care arrangement when interpreting ''same facility,'' we believe we have more clearly captured the intent of the statute and have also alleviated commenter concerns that the term ''facility'' was too narrow. Therefore, the size of the covered entity,

10 45 CFR 160.103 also defines ''organized health care arrangement'' to include ''an organized system of health care in which more than one covered entity participates'' and in which the participating covered entities engage in certain joint utilization review, quality assessment and improvement, or payment activities.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 346)

[Assistant]
According to privacy_rule_2000:

tions that must be met before a covered entity may use or disclose protected health information. Those conditions are in addition to any conditions required of research entities under the Common Rule.
Covered entities will certainly be subject to laws and regulations in addition to the rule, but the rule does not require compliance with these other laws or regulations. For covered health care providers and health plans that are subject to both the final rule and the Common Rule, both sets of regulations will need to be followed. Comment: A few commenters suggested that the Common Rule should be extended to all research, regardless of funding source. Response: We generally agree with the commenters on the need to provide protections to all human subjects research, regardless of funding source. HIPAA, however, did not provide the Department with authority to extend the Common Rule beyond its current purview. For research that relies on the use or disclosure of protected health information by covered entities without authorization, the final rule applies the Common Rule's principles for protecting research subjects by, in most instances, requiring documentation of independent board review, and a finding that specified criteria designed to protect the privacy of prospective research subjects have been met. Comment: A large number of commenters agreed that the research use and disclosure of protected health information should not require authorization. Of these commenters, many supported the proposed rule's approach to research uses and disclosures without authorization, including many from health care provider organizations, the mental health community, and members of Congress. Others, while they agreed that the research use and disclosure should not require authorization disagreed with the NPRM's approach and proposed alternative models.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 9)

[Assistant]
According to privacy_rule_2000:

0 for the patient records of a family practice in South Carolina. Among the businessman's uses of the purchased records was selling them back to the former patients. (New York Times, August 14, 1991).
- A few weeks after an Orlando woman had her doctor perform some routine tests, she received a letter from a drug company promoting a treatment for her high cholesterol. (Orlando Sentinel, November 30, 1997). No matter how or why a disclosure of personal information is made, the harm to the individual is the same. In the face of industry evolution, the potential benefits of our changing health care system, and the real risks and occurrences of harm, protection of privacy must be built into the routine operations of our health care system. ## Privacy Is Necessary To Secure Effective, High Quality Health Care

While privacy is one of the key values on which our society is built, it is more than an end in itself. It is also necessary for the effective delivery of health care, both to individuals and to populations. The market failures caused by the lack

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00007

of effective privacy protections for health information are discussed below (see section V.C below). Here, we discuss how privacy is a necessary foundation for delivery of high quality health care. In short, the entire health care system is built upon the willingness of individuals to share the most intimate details of their lives with their health care providers. The need for privacy of health information, in particular, has long been recognized as critical to the delivery of needed medical care. More than anything else, the relationship between a patient and a clinician is based on trust. The clinician must trust the patient to give full and truthful information about their health, symptoms, and medical history.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the differences between covered entity and business associate obligations under HIPAA?

[Assistant]
According to 45cfr160:

[Skip to main content](#main-content)

Menu

[![GovInfo logo](/media/GovInfo_logo_gray.png)](/)
[Search](#searchHolder)

* Browse
  + [A to Z](/browse-a-z)
  + [Category](/app/browse/category)
  + [Date](/app/browse/date)
  + [Committee](/browse/committee)
  + [Author](/app/browse/author)
* About
  + [About](/about)
  + [Policies](/about/policies)
  + [Authentication](/about/authentication)
  + [Digital Preservation](/about/digital-preservation)
  + [History](/about/history)
  + [Agency Submission](/about/agency-submission)
  + [U.S. Government Information](/about/us-gov-info)
  + [FDsys Retirement](/about#fdsys-transition)
* Developers
  + [Developer Hub](/developers)
  + [API](https://api.govinfo.gov/docs)
  + [Bulk Data Repository](%20/bulkdata)
  + [Link Service](/link-docs)
  + [Feeds](/feeds)
  + [Sitemaps](/sitemaps)
  + [System Design](/developers/system-design)
* Features
  + [All Features](/features)
  + [Featured Content](/features/featured-content)
  + [News](/features/news)
  + [Release Notes](/features/release-notes)
  + [Finding Publications](/features/finding-publications)
* Help
  + [Help](/help)
  + [Finding Information](%20/help/finding-info)
  + [What's Available](/help/whats-available)
  + [Tutorials and Handouts](/help/tutorials-handouts)
  + [Other Resources](%20/help/other-resources)
* Feedback
  + [Submit Feedback](https://www.surveymonkey.com/r/govinfo-feedback-survey)
  + [Contact Us](/contact)

* [Toggle the Search Widget
  Search](#searchHolder)

# Page Not Found

![Icon: Share using Facebook](/sites/default/files/fb-icon-white.png)
![Icon: Share using Email](/sites/default/files/email-icon-white.png)
![Icon: Copy Link URL](/sites/default/files/link-icon-white.png)

[Help](/help/other)

---

**Error occurred.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 432)

[Assistant]
According to privacy_rule_2000:

undant or conflicting requirements. Response: Unlike the proposed regulation, the final regulation covers all protected health information, not just information that had at some point been electronic.
Thus, these commenters' assumption that the proposed Privacy Rule and the proposed Security Rule covered the same information is not the case, and taking the approach suggested by these comments would leave a significant number of health records unprotected. The safeguards required by this regulation are appropriate for both paper and electronic information. We will take care to ensure that the final Security Rule works in tandem with these requirements. Comments: One commenter requested that the final privacy rule be published before the final Security Rule, recognizing that the privacy policies must be in place before the security technology used to implement them could be worked out. Another

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00286

commenter asked that the final Security Rule be published immediately and not wait for an expected delay while privacy policies are worked out. Response: Now that this final privacy rule has been published in a timely manner, the final Security Rule can be harmonized with it and published soon. Comments: Several commenters echoed an association recommendation that, for those organizations that have implemented a computer based patient record that is compliant with the requirements of the proposed Security Rule, the minimum necessary rule should be considered to have been met by the implementation of role-based access controls. Response: The privacy regulation applies to paper records to which the proposed Security Rule does not apply. Thus, taking the approach suggested by these comments would leave a significant number of health records unprotected.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 450)

[Assistant]
According to privacy_rule_2000:

terprises in domestic and export markets. The impact of this final rule will be over $1 billion in the first year of implementation. Therefore, this rule is a major rule as defined in 5 U.S.C. 804(2).
Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects; distributive impacts; and equity). According to Executive Order 12866, a regulatory action is ''significant'' if it meets any one of a number of specified conditions, including having an annual effect on the economy of $100 million or more adversely affecting in a material way a sector of the economy, competition, or jobs, or if it raises novel legal or policy issues. The purpose of the regulatory impact analysis is to assist decisionmakers in understanding the potential ramifications of a regulation as it is being developed. The analysis is also intended to assist the public in understanding the general economic ramifications of a regulation, both in the aggregate as well as the major policy areas of a regulation and how they are likely to affect the major industries or sectors of the economy covered by it. In accordance with the Small Business Regulatory Enforcement and Fairness Act (Pub. L. 104-121), the Administrator of the Office of Information and Regulatory Affairs of the Office of Management and Budget (OMB) has determined that this rule is a major rule for the purpose of congressional review. The proposal for the privacy regulation included a preliminary regulatory impact analysis (RIA) which estimated the cost of the rule at $3.8 billion over five years. The preliminary

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

analysis also noted that a number of significant areas were not included in the estimate due to inadequate information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 160)

[Assistant]
According to hitech_omnibus_2013:

e lack data, and the rule may produce savings that may offset some or all of the added costs. We discuss these unquantified costs and benefits of the rule at the end of the Regulatory Impact Analysis.
As a result of the economic impact, and other costs that are described but not quantified in the regulatory analysis below, OMB has determined that this rule is an economically significant regulatory action within the meaning of section 3(f)(4) of Executive Order 12866. We present our analysis of the costs and benefits of the rule in sections C and D below. ## 2. Entities Subject to the Rule

This rule impacts covered health care providers, health insurance issuers, and third party administrators acting on behalf of health plans, which we estimate to total 698,238 entities. The rule also applies to approximately 1-2

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with million business associates and an unknown number of subcontractors. 23

Table 1 below shows the number of covered entities by class of provider and insurer that will be affected by the Rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 111)

[Assistant]
According to privacy_rule_2000:

.g. , as permitted by § 164.512(j) to avert an imminent threat to health or safety, for health oversight activities, to coroners or medical examiners, and in other circumstances permitted by the rule.
For

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00073

additional provisions permitting covered entities to disclose protected health information to law enforcement officials, see § 164.512(j)(1)(i) and (ii). Under the NPRM and under the final rule, to obtain protected health information, law enforcement officials must comply with whatever other law is applicable. In certain circumstances, while this provision could authorize a covered entity to disclose protected health information to law enforcement officials, there could be additional applicable statutes or rules that further govern the specific disclosure. If the preemption provisions of this regulation do not apply, the covered entity must comply with the requirements or limitations established by such other law, regulation or judicial precedent. See §§ 160.201 through 160.205. For example, if state law permits disclosure only after compulsory process with court review, a provider or payor is not allowed to disclose information to state law enforcement officials unless the officials have complied with that requirement. Similarly, disclosure of substance abuse patient records subject to, 42 U.S.C. 290dd-2, and the implementing regulations, 42 CFR part 2, continue to be governed by those provisions. In some instances, disclosure of protected health information to law enforcement officials will be compelled by other law, for example, by compulsory judicial process or compulsory reporting laws (such as laws requiring reporting of wounds from violent crimes, suspected child abuse, or suspected theft of controlled substances). As discussed above, disclosure of protected health information under such other mandatory law is permitted under §164.512(a).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 520)

[Assistant]
According to privacy_rule_2000:

requested by a covered entity for its own use or disclosure of protected health information that it maintains, the covered entity must comply with the following requirements. - (1) Required elements.
The authorization for the uses or disclosures described in this paragraph must, in addition to meeting the requirements of paragraph (c) of this section, contain the following elements:
- (i) For any authorization to which the prohibition on conditioning in paragraph (b)(4) of this section applies, a statement that the covered entity will not condition treatment, payment, enrollment in the health plan, or eligibility for benefits on the individual's providing authorization for the requested use or disclosure;
- (ii) A description of each purpose of the requested use or disclosure;
- (iii) A statement that the individual may:
- (A) Inspect or copy the protected health information to be used or disclosed as provided in § 164.524; and
- (B) Refuse to sign the authorization; and
- (iv) If use or disclosure of the requested information will result in

VerDate 11<MAY>2000

19:16 Dec 27, 2000

direct or indirect remuneration to the covered entity from a third party, a statement that such remuneration will result. - (2) Copy to the individual. A covered entity must provide the individual with a copy of the signed authorization. 2. (e) Implementation specifications: Authorizations requested by a covered entity for disclosures by others. If an authorization is requested by a covered entity for another covered entity to disclose protected health information to the covered entity requesting the authorization to carry out treatment, payment, or health care operations, the covered entity requesting the authorization must comply with the following requirements. - (1) Required elements. The authorization for the disclosures described in this paragraph must, in addition to meeting the requirements of paragraph (c) of this section, contain the following elements:
4.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 50)

[Assistant]
According to security_rule_2003:

(e)(2)(ii) and reworded to enhance flexibility and scalability. - Removed proposed §142.310, ''Electronic signature,'' and all subheadings. This section will be issued as a separate future regulation.
- Moved proposed §142.312, ''Effective date of the implementation of the security and electronic signature

17:54 Feb 19, 2003

PO 00000

Frm 00035

- standards,'' to § 164.318 and retitled as ''Compliance dates for the initial implementation of the security standards.'' Reworded and retitled subsections. - Added §164.310(d)(2)(ii), ''Media re-use procedures,'' implementation specification. - Added §164.105, ''Organizational requirements,'' with two standards, ''Health care component and ''Affiliated covered entities'' with related implementation specifications. - Added §164.312, ''Technical safeguards,'' encompassing the combined technical services and technical mechanisms standards (proposed § 142.308(c) and (d)). - Added §164.314(a)(1), ''Business associate contracts or other arrangements'' standard and related implementation specifications. - Added §164.314, ''Organizational requirements.''
- Added §164.314(b)(1), ''Requirements for group health plans'' standard and related implementation specifications. - Added §164.316(a), ''Policies and procedures'' standard. - Added §164.316, ''Policies and procedures and documentation requirements.''
- Added §164.316(b)(1), ''Documentation'' standard and related implementation specifications. - Renamed Addendum 1 as Appendix A. - Added §164.318, ''Compliance dates for the initial implementation of the security standards.''
- Removed Addendum 2. Definitions of terms used in this final rule are now incorporated into § 164.103 and §164.304, or within the rule itself. - Removed Addendum 3. ## V.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 496)

[Assistant]
According to privacy_rule_2000:

cy Rule, and it adheres to section 4(a) of Executive Order 13132, which expressly contemplates preemption when there is a conflict between exercising state and federal authority under federal statute.
Section 262 of HIPAA enacted Section 1178 of the Social Security Act, developing a ''general rule'' that state laws or provisions that are contrary to the provisions or requirements of Part C of Title XI, or the standards or implementation specifications adopted, or established thereunder are preempted. Several exceptions to this rule exist, each of which is designed to maintain a high degree of state autonomy. Moreover, section 4(b) of the Executive Order authorizes preemption of state law in the federal rule making context when there is ''the exercise of state authority is directly conflicts with the exercise of federal authority under federal statute * * *.'' Section 1178 (a)(2)(B) of HIPAA specifically preempts state laws related to the privacy of individually identifiable health information unless the state law is more stringent. Thus, we have interpreted state and local laws and regulations that would impose less stringent requirements for protection of individually identifiable health information as undermining the

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00337

agency's goal of ensuring that all patients who receive medical services are assured a minimum level of personal privacy. Particularly where the absence of privacy protection undermines an individual's access to health care services, both the personal and public interest is served by establishing federal rules. The final rule would establish national minimum standards with respect to the collection, maintenance, access, use, and disclosure of individually identifiable health information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 116)

[Assistant]
According to privacy_mod_2002:

til April 14, 2004, whichever is earlier. The effect of this proposal is to spread first-year costs over an additional year, with a corresponding postponement of the costs estimated for the out years.
However, the Department has no reliable information as to the number of contracts potentially affected by the modification or the average delay that will occur. Therefore, the Department is uncertain about the extent of the cost savings attributable to this modification. ## Response to Public Comments

Comment: While many commenters supported the business associate transition provisions as helpful to reducing the administrative burden and cost of compliance, commenters argued that the business associate provisions would still be very burdensome and costly to implement, especially for small and solo businesses. Response: The Department acknowledges that there are compliance costs associated with the business associate standards. However, no commenters supplied empirical, direct evidence in support of or contradictory to the Department's estimates of the cost savings associated with the business associate transition provisions. Therefore, our estimates remain unchanged. Comment: Some commenters disputed the estimated costs of complying with the business associate requirements based on the quantity of contracts (with suppliers, physicians, local agencies and national concerns), and the number of hours necessary to individually tailor and renegotiate all of these contracts. Response: These comments address the underlying costs of the business associate requirements and do not address the reduction in costs afforded through the sample business associate agreement language. Moreover, no empirical, direct evidence, based on accomplished workload rather than extrapolations of singular events, were provided to contradict the Department's calculations. Therefore, our estimates remain unchanged. Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

## 4.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 47)

[Assistant]
According to hitech_omnibus_2013:

d authorization under § 164.508. This includes making clear in the authorization that the individual may revoke the authorization at any time he or she wishes to stop receiving the marketing material.
Because the final rule will treat all subsidized treatment communications as marketing communications for which an authorization is required, the final rule also removes the language at proposed §164.514(f)(2), which proposed to require that such communications be accompanied by a statement in the notice and an opportunity for the individual to opt out of receiving such communications. We believe that the removal of the notice and opt out requirements for such communications and the addition of the requirement to obtain an authorization will provide covered entities with a more uniform system for treating all remunerated communications. Because the individual must now sign an authorization before the covered entity can make subsidized treatment communications, there is no longer any need to require each such communication to contain a clear and conspicuous opportunity for the individual to elect not to receive any more of these communications. Where the individual signs an authorization to receive such communications, the covered entity may use and disclose the individual's protected health information for the purposes of making such communications unless or until the individual revokes the authorization pursuant to § 164.508(a)(5). If the individual does not authorize the covered entity to use and disclose the individual's protected health information for the purposes of making subsidized treatment communications, then the covered entity is prohibited from doing so. We clarify that the final rule does nothing to modify the exceptions to the authorization requirement for marketing communications at § 164.508(a)(3)(i)(A) and (B).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 385)

[Assistant]
According to privacy_rule_2000:

government requests from this standard, other than when a disclosure is required by law. (See preamble to § 164.512(a) for the

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

rationale behind this policy).
When a disclosure is required by law, the minimum necessary standard does not apply, whether the recipient of the information is a government official or a private individual. At the same time, we understand that when certain government officials make requests for protected health information, some covered entities might feel pressure to comply that might not be present when the request is from a private individuals. For this reason, we allow (but do not require) covered entities to reasonably rely on the representations of public officials as to the minimum necessary information for the purpose. Comment: Some commenters argued that requests under proposed § 164.510 should not be subject to the minimum necessary standard, whether or not they are ''authorized by law.'' Others argued that for disclosures made for administrative proceedings pursuant to proposed §164.510, the minimum necessary standard should apply unless they are subject to a court order. Response: We found no compelling reason to exempt disclosures for purposes listed in the regulation from this standard, other than for disclosures required by law. When there is no such legal mandate, the disclosure is voluntary on the part of the covered entity, and it is therefore reasonable to expect the covered entity to make some effort to protect privacy before making such a disclosure. If the covered entity finds that redacting unnecessary information, or extracting the requested information, prior to making the disclosure, is too burdensome, it need not make the disclosure. Where there is ambiguity regarding what information is needed, some effort on the part of the covered entity can be expected in these circumstances.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 195)

[Assistant]
According to hitech_omnibus_2013:

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

*

Jkt 229001

sroberts on DSK5SPTVN1PROD with

- ■ 21. Revise § 160.410 to read as follows:

## §160.410 Affirmative defenses. - (a) The Secretary may not:
- (1) Prior to February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that the violation is punishable under 42 U.S.C. 1320d-6. - (2) On or after February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that a penalty has been imposed under 42 U.S.C. 1320d-6 with respect to such act. - (b) For violations occurring prior to February 18, 2009, the Secretary may not impose a civil money penalty on a covered entity for a violation if the covered entity establishes that an affirmative defense exists with respect to the violation, including the following:
- (1) The covered entity establishes, to the satisfaction of the Secretary, that it did not have knowledge of the violation, determined in accordance with the Federal common law of agency, and by exercising reasonable diligence, would not have known that the violation occurred; or
- (2) The violation is-
- (i) Due to circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated and is not due to willful neglect; and
- (ii) Corrected during either:
- (A) The 30-day period beginning on the first date the covered entity liable for the penalty knew, or by exercising reasonable diligence would have known, that the violation occurred; or
- (B) Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 371)

[Assistant]
According to privacy_rule_2000:

nformation of intelligence community employees and their dependents being considered for postings overseas, on the grounds that the scope of permissible disclosure without authorization was too broad.
While acknowledging that the intelligence community may have legitimate needs for its employees' protected health information, the commenters believed that the NPRM

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

failed to provide adequate procedural protections for the employees' information. A few comments also said that the intelligence community should be able to obtain their employees' health information only with authorization. In addition, commenters said that the intelligence community should make disclosure of protected health information a condition of employment. Response: Again, we agree that the NPRM's provision allowing disclosure of the protected health information of intelligence community employees without authorization was overly broad. Thus we eliminate it in the final rule. The intelligence community can obtain this information with authorization (pursuant to § 164.508), for example, when employees or their family members are being considered for an oversees assignment and when individuals are applying for employment with or seeking a contract from an intelligence community agency. ## National Security and Intelligence Activities and Protective Services for the President and Others

Comment: A number of comments opposed the proposed ''intelligence and national security activities'' provision of the law enforcement section (§ 164.510(f)(4)), suggesting that it was overly broad. These commenters were concerned that the provision lacked sufficient procedural safeguards to prevent abuse of protected health information. The Central Intelligence Agency (CIA) and the Department of Defense (DoD) also expressed concern over the provision's scope.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 44)

[Assistant]
According to privacy_mod_2002:

doctors, hospital, labs, etc., speak with patients by telephone, identify treatment options, and develop

VerDate Aug<2,>2002

preliminary treatment plans, all before the initial patient visit.
The prior consent requirement would prevent all of these important preliminary activities before the first patient visit, which would delay treatment in cases in which such delay cannot be tolerated. Other commenters continued to strongly support a consent requirement, consistent with their views expressed during the comment period in March 2001. Some argued that the NPRM approach would eliminate an important consumer protection and that such a ''radical'' approach to fixing the workability issues was not required. They recommended a targeted approach to fixing each problem, and suggested ways to fix each unintended consequence of the consent requirement, in lieu of removing the requirement to obtain consent. A few commenters argued for reinstating a consent requirement, but making it similar to the proposal for acknowledgment of notice by permitting flexibility and including a ''good faith'' standard. They also urged the Department to narrow the definition of health care operations and require that de-identified information be used where possible for health care operations. Finally, a few commenters continued to assert that consent should be strengthened by applying it to more covered entities, requiring it to be obtained more frequently, or prohibiting the conditioning of treatment on the obtaining of consent. Final Modifications. The Department continues to be concerned by the multitude of comments and examples demonstrating that the consent requirements would result in unintended consequences that would impede the provision of health care in many critical circumstances. We are also concerned that other such unintended consequences may exist which have yet to be brought to our attention.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What's the difference between required and addressable implementation specifications?

[Assistant]
According to 45cfr164:

[Skip to main content](#main-content)

Menu

[![GovInfo logo](/media/GovInfo_logo_gray.png)](/)
[Search](#searchHolder)

* Browse
  + [A to Z](/browse-a-z)
  + [Category](/app/browse/category)
  + [Date](/app/browse/date)
  + [Committee](/browse/committee)
  + [Author](/app/browse/author)
* About
  + [About](/about)
  + [Policies](/about/policies)
  + [Authentication](/about/authentication)
  + [Digital Preservation](/about/digital-preservation)
  + [History](/about/history)
  + [Agency Submission](/about/agency-submission)
  + [U.S. Government Information](/about/us-gov-info)
  + [FDsys Retirement](/about#fdsys-transition)
* Developers
  + [Developer Hub](/developers)
  + [API](https://api.govinfo.gov/docs)
  + [Bulk Data Repository](%20/bulkdata)
  + [Link Service](/link-docs)
  + [Feeds](/feeds)
  + [Sitemaps](/sitemaps)
  + [System Design](/developers/system-design)
* Features
  + [All Features](/features)
  + [Featured Content](/features/featured-content)
  + [News](/features/news)
  + [Release Notes](/features/release-notes)
  + [Finding Publications](/features/finding-publications)
* Help
  + [Help](/help)
  + [Finding Information](%20/help/finding-info)
  + [What's Available](/help/whats-available)
  + [Tutorials and Handouts](/help/tutorials-handouts)
  + [Other Resources](%20/help/other-resources)
* Feedback
  + [Submit Feedback](https://www.surveymonkey.com/r/govinfo-feedback-survey)
  + [Contact Us](/contact)

* [Toggle the Search Widget
  Search](#searchHolder)

# Page Not Found

![Icon: Share using Facebook](/sites/default/files/fb-icon-white.png)
![Icon: Share using Email](/sites/default/files/email-icon-white.png)
![Icon: Copy Link URL](/sites/default/files/link-icon-white.png)

[Help](/help/other)

---

**Error occurred. The page you requested cannot be found.**

Please report this error to [askGPO.](https://www.gpo.gov/error-pages/askgpo)

Provide the following information to help us resolve this problem: the URL of the page you were trying to acce


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 275)

[Assistant]
According to privacy_rule_2000:

fere with the attorney-client relationship, nor does it override professional judgement of business associates regarding the protected health information they need to discharge their responsibilities.
We do not require covered entities to second guess their professional business associates' reasonable requests to use or disclose protected health information in the course of the relationship. The attorney-client privilege covers only a small portion of information provided to attorneys and so is not a substitute for this requirement. More important, attorney-client privilege belongs to the client, in this case the covered entity, and not to the individual who is the subject of the information. The business associate requirements are intended to protect the subject of the information. With regard to government attorneys and other government agencies, we recognize that federal and other law often does not allow standard legal contracts among governmental entities, but instead requires agreements to be made through the Economy Act or other mechanisms; these are generally reflected in a memorandum of understanding (MOU). We therefore modify the proposed requirements to allow government agencies to meet the required ''satisfactory assurance'' through such MOUs that contain the same provisions required of business associate contracts. As discussed elsewhere, we believe that direct regulation of entities receiving protected health information can be as or more effective in protecting health

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

information as contracts. We therefore also allow government agencies to meet the required ''satisfactory assurances'' if law or regulations impose requirements on business associates consistent with the requirements specified for business associate contracts.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 153)

[Assistant]
According to hitech_omnibus_2013:

icy includes discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program.
Finally, we proposed a provision within the

VerDate Mar<15>2010

definition to clarify that ''underwriting purposes'' does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy. ## Overview of Public Comments

About ten commenters addressed the proposed definition of ''underwriting purposes.'' Four commenters generally supported the proposed definition. Other commenters expressed concern with the definition's inclusion of discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment (HRA) or participating in a wellness program. These commenters were concerned that prohibiting the use of genetic information, particularly family health history, for such purposes would have a detrimental impact on wellness and disease management programs. One commenter was concerned that the definition would prohibit dental insurance plans from offering preventive prognostic features to enrollees as part of the plan that test for susceptibility to dental decay and periodontal diseases. Enrollees that test positive would be provided with additional plan benefits as a supplement to the standard benefits to cover more aggressive preventive services. Finally, a few commenters were concerned that the broad definition of ''underwriting purposes'' would preclude plans from using HRAs and offering wellness programs even if no genetic information is requested or used. For example, one commenter was concerned that the definition would prohibit the use of ''personal habit'' information, such as information about smoking, or alcohol or drug use.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 236)

[Assistant]
According to privacy_rule_2000:

lowed to be

Frm 00156

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

disclosed for banking and payment processes rule would stifle innovation in continually evolving payment systems.
Thus, the commenter recommended that in the final rule, we eliminate the minimum necessary requirement for banking and payment processing and that we do not include a list of specific types of information allowed to be disclosed for banking and payment processes. On the other hand, several other commenters supported applying the minimum necessary standard to covered entities' disclosures to financial institutions for payment processing. In addition, these groups said that because financial institutions are not covered entities under the proposed rule, they urged Congress to enact comprehensive privacy legislation to limit financial institutions' use and re-disclosure of the minimally necessary protected health information they could receive under the proposed rule. Several of these commenters said that, in light of the increased ability to manipulate data electronically, they were concerned that financial institutions could use the minimal protected health information they received for making financial decisions. For example, one of these commenters said that a financial institution could identify an individual who had paid for treatment of domestic violence injuries and subsequently could deny the individual a mortgage based on that information. Response: We agree with the commenters who were concerned that a finite list of information could hamper systems innovation, and we eliminate the proposed list of data items. However, we disagree with the commenters who argued that the requirement for minimum necessary disclosures not apply to disclosures to financial institution or for payment activities.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 106)

[Assistant]
According to privacy_mod_2002:

ealth information held by a business associate, or receive an accounting of disclosures by a business associate, as provided for by the Privacy Rule's requirements at §§ 164.524, 164.526, and 164.528.
In addition, unlike the proposed Rule, the final Rule at §164.532(e)(3) explicitly provides that with respect to those business associate contracts that qualify for the transition period as described above, a covered entity is not relieved of its obligation

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

under §164.530(f) to mitigate, to the extent practicable, any harmful effect that is known to the covered entity of a use or disclosure of protected health information by its business associate in violation of the covered entity's policies and procedures or the requirements of this subpart, as required by § 164.530(f). The Department does not believe that a covered entity should be relieved during the transition period of its responsibilities with respect to cooperating with the Secretary or fulfilling an individual's rights with respect to protected health information held by the business associate, or mitigating any harmful effects of an inappropriate use or disclosure by the business associate. The transition period is intended to alleviate some of the burden on covered entities, but not at the expense of individuals' privacy rights. Eliminating these privacy protections and rights would severely weaken the Rule with respect to those covered entities with contracts that qualify for the transition period. Further, the Rule provides covered entities some discretion in implementing these requirements with respect to their business associates. For example, a covered entity does not need to provide an individual with access to protected health information held by a business associate if the only information the business associate holds is a duplicate of what the covered entity maintains and to which it has provided the individual access.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 70)

[Assistant]
According to security_rule_2003:

trative costs to providers and health plans compared to the alternatives, and the standard is promulgated in accordance with the rulemaking procedures of subchapter III of chapter 5 of title 5, U.S.C.
Section 1172 of the Act also sets forth consultation requirements that must be met before the Secretary may adopt standards. In the case of a standard that is developed, adopted, or modified by an SSO, the SSO must consult with the following Data Content Committees (DCCs) in the course of the development, adoption, or modification of the standard: The National Uniform Billing Committee (NUBC), the National Uniform Claim Committee (NUCC), the Workgroup for Electronic Data Interchange (WEDI), and the American Dental Association (ADA). In the case of any other standard, the Secretary is required to consult with each of the above-named groups before adopting the standard and must also comply with the provisions of section 1172(f) of the Act regarding consultation with the National Committee on Vital and Health Statistics (NCVHS). Section 1173 of the Act requires the Secretary to adopt standards for transactions, and data elements for such transactions, to enable the electronic exchange of health information. Section

Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

Jkt 200001


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 40)

[Assistant]
According to security_rule_2003:

determine that, in order to do business with it, a business associate must also employ equivalent measures. This would be a business decision and would not be governed by the provisions of this rule.
Security mechanisms relative to the transmission of electronic protected health information between entities may need to be agreed upon by

17:54 Feb 19, 2003

PO 00000

Frm 00028

both parties in order to successfully complete the transmission. However, the determination of the specific transmission mechanisms and the specific security features to be implemented remains a business decision. d. Comment: Several commenters asked whether existing contracts could be used to meet the requirement for a trading partner agreement, or does the rule require entry into a new contract specific to this purpose. Also, the commenters want to know about those whose working agreements do not involve written contractual agreement: Do they now need to set up formal agreements and incur the additional expense that would entail? Response: This final rule requires written agreements between covered entities and business associates. New contracts do not have to be entered into specifically for this purpose, if existing written contracts adequately address the applicable requirements (or can be amended to do so). e. Comment: Several commenters asked whether covered entities are responsible for the security of all individual health information sent to them, or only information sent by chain of trust partners. They also asked if they can refuse to process standard transactions sent to them in an unsecured fashion. In addition, they inquired if they can refuse to send secured information in standard transactions to entities not required by law to secure the information. One commenter asked if there is a formula for understanding in any particular set of relationships where the ultimate responsibility for compliance with the standards would lie.