[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance?

[Assistant]
According to security_rule_2003:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160, 162, and 164 [CMS-0049-F] RIN 0938-AI57

## Health Insurance Reform: Security Standards

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Final rule. SUMMARY: This final rule adopts standards for the security of electronic protected health information to be implemented by health plans, health care clearinghouses, and certain health care providers. The use of the security standards will improve the Medicare and Medicaid programs, and otherFederal health programs and private health programs, and the effectiveness and efficiency of the health care industry in general by establishing a level of protection for certain electronic health information. This final rule implements some of the requirements of the Administrative Simplification subtitle of the Health Insurance Portability andAccountability Act of 1996 (HIPAA). DATES: Effective Date: These regulations are effective on April 21, 2003. Compliance Date: Covered entities, with the exception of small health plans, must comply with the requirements of this final rule by April 21, 2005. Small health plans must comply with the requirements of this final rule by April 21, 2006. FOR FURTHER INFORMATION CONTACT: William Schooler, (410) 786-0089. SUPPLEMENTARY INFORMATION:

## Availability of Copies and Electronic Access

To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 or by faxing to (202) 5122250. The cost for each copy is $10.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 445)

[Assistant]
According to privacy_rule_2000:

es of close to $2.0 billion nationally. Another commenter indicated that authorization costs will be at least double the notice dissemination costs due to the cost of both outbound and return postage.
Response: Public commenters and subsequent factfinding clearly indicate that most providers with patient contact already obtain authorizations for release of records, so for them there is virtually no new cost. Further, this comment does not reflect the actual regulatory requirement. For example, there is no need to engage in mailing and remailing of forms, and we do not foresee any reason why there should be any significant calls involved. Comment: A commenter criticized the percentage (1%) that we used to calculate the number of health care encounters expected to result in requests to withhold the release of protected information. This respondent postulates that even if one in six patients who encounter the U.S. health care system opt to restrict access to their records, the total expected national cost per year could rise to $900 million. Response: The final regulation requirements regarding the release of protected health information has been substantially changed, thereby greatly reducing the potential cost burden. A fuller explanation of the cost is provided below in the regulatory impact analysis. Comment: An additional issue raised by commenters was the added cost of seeking authorizations for health promotion and disease management activities, health care operations that traditionally did not require such action. Response: In the final regulation, a covered entity can use medical information collected for treatment or operations for its own health promotion and disease management efforts without obtaining additional authorization. Therefore, there is no additional cost incurred. ## Business Associates

Comment: A number of commenters were concerned about the cost of monitoring business partners.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 64)

[Assistant]
According to hitech_omnibus_2013:

05(d)(2)(B) of the HITECH Act clearly states that any remuneration received in exchange for research disclosures must reflect only the cost of preparation and transmittal of the data for such purpose.
In response to comments about the types of costs that are permitted in the reasonable cost-based fee to prepare and transmit the data, we clarify that this may include both direct and indirect costs, including labor, materials, and supplies for generating, storing, retrieving, and transmitting the protected health information; labor and supplies to ensure the protected health information is disclosed in a permissible manner; as well as related capital and overhead costs. However, fees charged to incur a profit from the disclosure of protected health information are not allowed. We believe allowing a profit margin would not be consistent with the language contained in Section 13405 of the HITECH Act. We intend to work with the research community to provide guidance and help the research community reach a common understanding of appropriate cost-based limitations on remuneration. We retain the exceptions proposed for treatment and payment disclosures without modification and agree with commenters that these exceptions are necessary to make clear that these core health care functions may continue. Similarly, we retain the exception to the remuneration prohibition for disclosures for the transfer, merger, or consolidation of all or part of a covered entity with another covered entity, or an entity that following such activity will become a covered entity, and related due diligence, to ensure that such disclosures may continue to occur in accordance with the Privacy Rule. We retain the proposed exception for

18:57 Jan 24, 2013

PO 00000

Frm 00043

disclosures that are otherwise required by law to ensure a covered entity can continue to meet its legal obligations without imposing an authorization requirement.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the required HIPAA security measures?

[Assistant]
According to breach_notification_2009:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0991-AB56

## Breach Notification for Unsecured Protected Health Information

AGENCY: Office for Civil Rights, Department of Health and Human Services.

ACTION: Interim final rule with request for comments.

SUMMARY: The Department of Health and Human Services (HHS) is issuing this interim final rule with a request for comments to require notification of breaches of unsecured protected health information. Section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA) that was enacted on February 17, 2009, requires HHS to issue interim final regulations within 180 days to require covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and their business associates to provide notification in the case of breaches of unsecured protected health information. For purposes of determining what information is ''unsecured protected health information,'' in this document HHS is also issuing an update to its guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.

DATES: Effective Date: This interim final rule is effective September 23, 2009.

Comment Date: Comments on the provisions of this interim final rule are due on or before October 23, 2009. Comments on the information collection requirements associated with this rule are due on or before September 8, 2009.

ADDRESSES: You may submit comments, identified by RIN 0991-AB56, by any of the following methods (please do not submit duplicate comments):

- Regular, Express, or Overnight Mail: U.S. Department of Health and Human Services, Office for Civil Rights, Attention: HITECH Breach Notification, Hubert H. Humphrey Building, Room
- Federal eRulemaking Portal: http://


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 479)

[Assistant]
According to privacy_rule_2000:

ivacy concerns that led these individuals to respond affirmatively. However, for the purposes of this estimate, we assume that privacy concerns were responsible for the majority of positive responses.
Based on the Harris-Equifax survey estimate that seven percent of people did not seek services for physical or mental health conditions due to fears about job prospects or other opportunities, we assume that the proportion of people diagnosed with cancer who did not seek earlier treatment due to these fears is also seven percent. Applying this seven percent figure to the estimated number of total cancer cases (8.37 million) gives us an estimate of 586,000 people who did not seek earlier cancer treatment due to privacy concerns. We estimate annual lost wages due to cancer morbidity and mortality per cancer patient by dividing total lost wages ($68.7 billion) by the number of cancer patients (8.37 million), which rounds to $8,200. We then assume that cancer patients who seek earlier treatment would achieve a one-third reduction in cancer mortality and morbidity due to earlier treatment. The assumption of a one-third reduction in mortality and morbidity is derived from a study showing a one-third reduction in colorectal cancer mortality due to colorectal cancer screening. 63 We could have chosen a lower or higher treatment success rate. By multiplying 586,000 by $8,200 by one-third, we calculate that $1.6 billion in lost wages could be saved each year by encouraging more people to seek early cancer treatment through enhanced privacy protections. This estimate illustrates the potential savings

63 Jack S. Mandel, et al., ''Reducing Mortality from Colorectal Cancer by Screening for Fecal Occult Blood,'' The New England Journal of Medicine, May 13, 1993, Vol, 328, No. 19. E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

in lost wages due to cancer that could be achieved with greater privacy protections.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 19)

[Assistant]
According to privacy_mod_2002:

an incidental use or disclosure as a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a by-product of an otherwise permitted use or disclosure.
The Department proposed that an incidental use or disclosure be permissible only to the extent that the covered entity had applied reasonable safeguards as required by § 164.530(c), and implemented the minimum necessary standard, where applicable, as required by §§ 164.502(b) and 164.514(d). Overview of Public Comments. The following discussion provides an overview of the public comment received on this proposal. Additional comments received on this issue are discussed below in the section entitled, ''Response to Other Public Comments.''

The Department received many comments on its proposal to permit certain incidental uses and disclosures, the majority of which expressed strong support for the proposal. Many of these commenters indicated that such a policy would help to ensure that essential health care communications and practices are not chilled by the Privacy Rule. A few commenters opposed the Department's proposal to permit certain incidental uses and disclosures, one of whom asserted that the burden on medical staff to take precautions not to be overheard is minimal compared to the potential harm to patients if incidental disclosures were to be considered permissible. Final Modifications. In response to the overwhelming support of commenters on this proposal, the Department adopts the proposed provision at § 164.502(a)(1)(iii), explicitly permitting certain incidental uses and disclosures that occur as a byproduct of a use or disclosure otherwise permitted under the Privacy Rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 429)

[Assistant]
According to privacy_rule_2000:

or the purpose of establishing or checking a computer system. Response: This activity falls within the definition of health care operations and is, therefore, excluded from the accounting requirement.
## Section 164.530-Administrative Requirements

Section 164.530(a)-Designation of a Privacy Official and Contact Person

Comment: Many of the commenters on this topic objected to the cost of establishing a privacy official, including the need to hire additional staff, which might need to include a lawyer or other highly paid individual. Response: We believe that designation of a privacy official is essential to ensure a central point of accountability within each covered entity for privacyrelated issues. The privacy official is charged with developing and implementing the policies and procedures for the covered entity, as required throughout the regulation, and for compliance with the regulation generally. While the costs for these activities are part of the costs of compliance with this rule, not extra costs associated with the designation of a privacy official, we do anticipate that there will be some cost associated with this requirement. The privacy official role may be an additional responsibility given to an existing employee in the

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00284

covered entity, such as an office manager in a small entity or an information officer or compliance official in a larger institution. Cost estimates for the privacy official are discussed in detail in the overall cost analysis. Comment: A few commenters argued for more flexibility in meeting the requirement for accountability. One health care provider maintained that covered entities should be able to establish their own system of accountability.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 304)

[Assistant]
According to privacy_rule_2000:

that will receive direct

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

or indirect remuneration from a third party for the use or disclosure, to state that fact in the authorization.
Remuneration from a third party includes payments such as a fixed price per disclosure, compensation for the costs of compiling and sending the information to be disclosed, and, with respect to marketing communications, a percentage of any sales generated by the marketing communication. For example, a device manufacturer may offer to pay a fixed price per name and address of individuals with a particular diagnosis, so that the device manufacturer can market its new device to people with the diagnosis. The device manufacturer may also offer the covered entity a percentage of the profits from any sales generated by the marketing materials sent. If a covered entity seeks an authorization to make such a disclosure, the authorization must state that the remuneration will occur. We believe individuals should have the opportunity to weigh the covered entity's potential conflict of interest when deciding to authorize the covered entity's use or disclosure of protected health information. We believe that the term ''remuneration from a third party'' clarifies our intent to describe a direct, tangible exchange, rather than the mere fact that parties intend to profit from their enterprises. Comment: One commenter suggested we require covered entities to request authorizations in a manner that does not in itself disclose sensitive information. Response: We agree that covered entities should make reasonable efforts to avoid unintentional disclosures. In §164.530(c)(2), we require covered entities to have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 127)

[Assistant]
According to privacy_rule_2000:

limit the amount of protected health information used/disclosed. g. The cost of limiting the use/ disclosure. h. Any other factors that the covered entity believed were relevant to the determination.
The proposal shifted the ''minimum necessary'' burden off of covered providers when they were being audited by a health plan. The preamble explained that the duty would have been shifted to the payor to request the minimum necessary information for the audit purpose, although the regulatory text did not include such a requirement. Outside of the audit context, the preamble stated that a health plan would be required, when requesting a disclosure, to limit its requests to the information required to achieve the purpose of the request; the regulation text did not include this requirement. The preamble stated that disclosure of an entire medical record, in response to a request for something other than the entire medical record, would presumptively violate the minimum necessary standard. This final rule significantly modifies the proposed requirements for implementing the minimum necessary standard. For all uses and many disclosures and requests for disclosures from other covered entities, we require covered entities to implement policies and procedures for ''minimum necessary'' uses and disclosures. Implementation of such policies and procedures is required in lieu of making the ''minimum necessary'' determination for each separate use or disclosure as discussed in the proposal. Disclosures to or requests by a health care provider for treatment purposes are not subject to the standard (see §164.502). Specifically (and as further described below), the proposed requirement for individual review of all uses of protected health information is replaced with a requirement for covered entities to implement policies and procedures that restrict access and uses based on the specific roles of members of the covered entity's workforce.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 134)

[Assistant]
According to privacy_rule_2000:

st of the rule, we specify minimum requirements, not best practices. Covered entities may want to include more detail. We note that all federal agencies must still comply with the Privacy Act of 1974.
This means that federal agencies that are covered entities or have covered health care components must comply with the notice requirements of the Privacy Act as well as those included in this rule. In addition, covered entities may want or be required to produce more than one notice in order to satisfy the notice content requirements under this rule. For example, a covered entity that conducts business in multiple states with different laws regarding the uses and disclosures that the covered entity is permitted to make without authorization may be required to produce a different notice for each state. A covered entity that conducts business both as part of an organized health care arrangement or affiliated covered entity and as an independent enterprise (e.g., a physician who sees patients through an on-call arrangement with a hospital and through an independent private practice) may want to adopt different privacy practices with respect to each line of business; such a covered entity would be required to produce a different notice describing the practices for each line of business. Covered entities must produce notices that accurately describe the privacy practices that are relevant to the individuals receiving the notice. ## Required Elements

## Plain Language

As in the proposed rule, we require the notice to be written in plain language. A covered entity can satisfy the plain language requirement if it makes a reasonable effort to: organize material to serve the needs of the reader; write short sentences in the active voice, using ''you'' and other pronouns; use common, everyday words in sentences; and divide material into short sections.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 19)

[Assistant]
According to fda_premarket_2023:

ty testing, see Section V.C, below. Manufacturers may include the demonstration of security controls that are comparable or in addition to those described in Appendix 1 in their premarket submissions.
If using alternate controls that are not described in this document, manufacturers should provide documentation and tracing of specific design features and security controls to the associated risks in order to demonstrate that they provide appropriate levels of safety and effectiveness. As cybersecurity design controls are established early in the development phase, FDA recommends that device manufacturers utilize the FDA Q-submission process to discuss design considerations for cybersecurity risk management throughout the device lifecycle with the agency. 43 Additional information on premarket documentation recommendations for design controls are discussed in the Security Architecture Views section below. ## 2. Security Architecture Views

In addition to the design control requirements, 44 21 CFR 820.100 requires that manufacturers establish and maintain procedures for implementing corrective and preventive action, which must include, among other things, requirements for analyzing quality data to identify existing and potential causes of quality problems. FDA recommends that manufacturers develop and maintain security architecture view documentation as a part of the process for the design, development, and maintenance of the medical device system. If corrective and preventive actions are identified, these views can be used to help identify impacted functionality and solutions that address the risks. FDA recommends that premarket submissions include the architecture views described in this section. These architecture views can contribute to the demonstration of safety and effectiveness in premarket submissions by illustrating how the controls to address cybersecurity risks have been applied to the medical device system.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 60)

[Assistant]
According to security_rule_2003:

tected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.
Protected health information means individually identifiable health information:

- (1) Except as provided in paragraph (2) of this definition, that is:
2. (i) Transmitted by electronic media;
3. (ii) Maintained in electronic media; or
4. (iii) Transmitted or maintained in any other form or medium. - (2) Protected health information excludes individually identifiable health information in:
6. (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;
7. (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and
8. (iii) Employment records held by a covered entity in its role as employer. *

*

*

*

*

Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information. *

*

*

*

*

## PART 162-ADMINISTRATIVE REQUIREMENTS

1. The authority citation for part 162 is revised to read as follows:

Authority: Secs. 1171 through 1179 of the Social Security Act (42 U.S.C. 1320d-1320d8), as added by sec. 262 of Pub. L. 104-191, 110 Stat. 2021-2031, and sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)). ## §162.103 [Amended]

2. In § 162.103, the definition of ''electronic media'' is removed. ## PART 164-SECURITY AND PRIVACY

1. The authority citation for part 164 is revised to read as follows:

Authority: Secs. 1171 through 1179 of the Social Security Act (42 U.S.C. 1320d-1320d8), as added by sec. 262 of Pub. L. 104-191, 110 Stat. 2021-2031, and 42 U.S.C. 1320d2 and 1320d-4, sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)). 2. A new § 164.103 is added to read as follows:

## §164.103 Definitions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 157)

[Assistant]
According to hitech_omnibus_2013:

except to the extent doing so would be inconsistent with the prohibition in GINA and this final rule at §164.502(a)(5)(i) against using or disclosing genetic information for underwriting purposes. 9.
Section 164.520-Notice of Privacy Practices for Protected Health Information

## Proposed Rule

As discussed above in Section IV with regard to the changes made to § 164.520 pursuant to the HITECH Act, § 164.520 of the Privacy Rule sets out the requirements for most covered entities to have and distribute a Notice of Privacy Practices (NPP). With respect to the NPP, the Department believes that

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with individuals should be informed of their rule with respect to genetic information in the health coverage context. Thus, the

new rights and protections under this Department proposed in §164.520(b)(1)(iii)(D) to require health plans that use or disclose protected health information for underwriting to include a statement in their NPP that they are prohibited from using or disclosing protected health information that is genetic information about an individual for such purposes. Without such a specific statement, individuals would not be aware of this restriction and the general statements regarding permitted uses and disclosures for treatment, payment, and health care operations in the NPP of a health plan that performs underwriting would not be accurate (i.e., the NPP would state that the health plan may use or disclose PHI for purposes of payment and health care operations, which would not be true with respect to genetic information when the use or disclosure is for underwriting purposes).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 143)

[Assistant]
According to hitech_omnibus_2013:

otifications were provided. ## VI. Modifications to the HIPAA Privacy Rule Under GINA

## A. Background

The Genetic Information Nondiscrimination Act of 2008 (''GINA''), Public Law 110-233, 122 Stat.
881, prohibits discrimination based on an individual's genetic information in both the health coverage and employment contexts. With respect to health coverage, Title I of GINA generally prohibits discrimination in premiums or contributions for group coverage based on genetic information, proscribes the use of genetic information as a basis for determining eligibility or setting premiums in the individual and Medicare supplemental (Medigap) insurance markets, and limits the ability of group health plans, health insurance issuers, and Medigap issuers to collect genetic information or to request or require that individuals undergo genetic testing. Title II of GINA generally prohibits use of genetic information in the employment context, restricts employers and other entities covered by Title II from requesting, requiring, or purchasing genetic

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with information, and strictly limits such entities from disclosing genetic information. The Departments of Labor, Treasury, and Health and Human Services (HHS) are responsible for administering and enforcing the GINA Title I nondiscrimination provisions, and the Equal Employment Opportunity Commission (EEOC) is responsible for administering and enforcing the GINA Title II nondiscrimination provisions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 54)

[Assistant]
According to hitech_omnibus_2013:

Finally, several commenters requested that the Department provide a model business associate agreement. ## Final Rule

The final rule adopts the proposed modifications to §§ 164.502(e) and 164.504(e).
As we discussed above, while section 13404 of the HITECH Act provides that business associates are now directly liable for civil money penalties under the HIPAA Privacy Rule for impermissible uses and disclosures and for the additional HITECH requirements in Subtitle D that are made applicable to covered entities, it does not apply all of the requirements of the Privacy Rule to business associates and thus, the final rule does not. Therefore, business associates are not required to comply with other provisions of the Privacy Rule, such as providing a notice of privacy practices or designating a privacy official, unless the covered entity has chosen to delegate such a responsibility to the business associate, which would then make it a contractual requirement for which contractual liability would attach. Concerning commenters' questions about the continued need for business associate agreements given the new direct liability on business associates for compliance, we note that section 13404 of the HITECH Act expressly refers and ties business associate liability to making uses and disclosures in accordance with the uses and disclosures laid out in such agreements, rather than liability for compliance with the Privacy Rule generally. Further, section 13408 of the HITECH Act requires certain data transmission and personal health record vendors to have in place business associate agreements with the covered entities they serve.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_postmarket_2016 say about HIPAA compliance? (Part 13)

[Assistant]
According to fda_postmarket_2016:

ommendations

- A device manufacturer is notified of an open, unused communication port by the U.S. Department of Homeland Security Industrial Control Systems-Cyber Emergency Response Team (ICS-CERT).
Subsequent analyses show that a design feature of the device prevents unauthorized remote firmware download onto the device. The threat is mitigated substantially by the need for physical access due to this device feature and the residual risk of patient harm is considered 'acceptable.' The manufacturer takes steps to further enhance the device's security by taking steps to close the unused communication port(s) and provide adequate communication to device users (e.g., user facilities) to facilitate the patch. If the manufacturer closes the open communication ports, the change would be considered a cybersecurity routine update or patch, a type of device enhancement. The change does not require reporting under 21 CFR part 806 (see the 'Distinguishing Medical Device Recalls from Medical Enhancements Guidance' [http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedo cuments/ucm418469.pdf] for additional clarity of reporting requirements and recommendations for device enhancements). - A device manufacturer receives a user complaint that a recent security software scan of the PC component of a class III medical device has indicated that the PC is infected with malware. The outcome of a manufacturer investigation and impact assessment confirms the presence of malware and that the primary purpose of the malware is to collect internet browsing information. The manufacturer also determines that the malware has actively collected browsing information, but that the device's safety and essential performance is not and would not be impacted by such collection. The manufacturer's risk assessment determines that the risk of patient harm due to the vulnerability is controlled.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 16)

[Assistant]
According to hitech_omnibus_2013:

edia'' that house electronic data. Second, we proposed to add to paragraph (2) of the definition of ''electronic media'' a reference to intranets, to clarify that intranets come within the definition.
Third, we proposed to change the word ''because'' to ''if'' in the final sentence of paragraph (2) of the definition of ''electronic media.'' The definition assumed that no transmissions made by voice via telephone existed in electronic form before transmission; the evolution of technology has made this assumption obsolete since some voice technology is digitally produced from an information system and transmitted by phone. ## Overview of Public Comments

The Department received comments in support of the revised definition and the flexibility created to account for later technological developments. Certain other commenters raised concerns that changes to the definition could have unintended impacts when applied to the administrative transaction and code set requirements. One commenter specifically supported the change in language from ''because'' to ''if,'' noting the distinction was important to provide protection for digital audio recordings containing protected health information. One commenter suggested including the

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with word ''immediately'' in the final sentence of paragraph (2) to indicate that fax transmissions are excluded from the definition of electronic media if the information being exchanged did not exist in electronic form immediately before the transmission. Several commenters sought clarification as to whether data that is retained in office machines, such as facsimiles and photocopiers, is subject to the Privacy and Security Rules. ## Final Rule

The final rule adopts the definition as proposed with two additional modifications.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 356)

[Assistant]
According to privacy_rule_2000:

vacy board members have varying backgrounds and appropriate professional competency as necessary to review the effect of the research protocol on the individual's privacy rights and related interests.
We believe that this criterion for privacy board membership requires that members already have the necessary knowledge or that they be trained to address privacy issues that arise in the conduct of research that involves the use of protected health information. In addition, we note that the Common Rule (§ /�����������������������������/����������������������������� .107(a)) already imposes a general requirement that IRB members posses adequate training and experience to adequately evaluate the research which it reviews. IRBs are also authorized to obtain the services of consultants (§ /�����������������������������/����������������������������� .107(f)) to provide expertise not available on the IRB. We believe that these existing requirements in the Common Rule already require that an IRB have the necessary privacy expertise. ## Waiver Criteria

Comment: A large number of comments supported the proposed rule's criteria for the waiver of authorization by an IRB or privacy board. Response: While we agree that several of the waiver criteria should be retained in the final rule, we have made changes to the waiver criteria to address some of the comments we received on specific criteria. These reason for these changes are discussed in the response to comments below. Comment: In addition to the proposed waiver criteria, several commenters recommended that the final rule also instruct IRBs and privacy boards to consider the type of protected health information and the sensitivity of the information to be disclosed in determining whether to grant a waiver, in whole or in part, of the authorization requirements.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 389)

[Assistant]
According to privacy_rule_2000:

s or receives protected health information other than as a business associate of a covered entity, it is permitted and required to obtain authorizations to the same extent as any other covered entity.
Comment: A few commenters suggested we require covered entities to publicly disclose, on the covered entity's website or upon request, all of their marketing arrangements. Response: While we agree that such a requirement would provide individuals with additional information about how their information would be used, we do not feel that such a significant intrusion into the business practices of the covered entity is warranted. Comment: Some commenters argued that if an activity falls within the scope of payment, it should not be considered marketing. Commenters strongly supported an approach which would bar an activity from being construed as ''marketing'' even if performing that activity would result in financial gain to the covered entity. In a similar vein, we were urged to adopt the position that if an activity was considered payment, treatment or health care operations, it could not be further evaluated to determine whether it should be excluded as marketing. Response: We considered the approach offered by commenters but decided against it. Some activities, such as the marketing of a covered entity's own health-related products or services, are now included in the definition of health care operations, provided certain requirements are met. Other types of activities, such as the sale of a patient list to a marketing firm, would not be permitted under this rule without authorization from the individual. We do not believe that we can envision every possible disclosure of health information that would violate the privacy of an individual, so any list would be incomplete.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 113)

[Assistant]
According to hitech_omnibus_2013:

ry in guidance'' and provides that the guidance specify the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.
Covered entities and business associates that implement the specified technologies and methodologies with respect to protected health information are not required to provide notifications in the event of a breach of such informationthat is, the information is not considered ''unsecured'' in such cases. As required by the Act, the Secretary initially issued this guidance on April

VerDate Mar<15>2010

17, 2009 (it was subsequently published at 74 FR 19006 on April 27, 2009). The guidance listed and described encryption and destruction as the two technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals. In cases in which notification is required, the Act at section 13402 prescribes the timeliness, content, and methods of providing the breach notifications. Section 13402 required HHS to issue within 180 days of enactment interim final regulations to implement these breach notification requirements. The Department issued an interim final rule on August 24, 2009, with a 60-day public comment period (74 FR 42740). The interim final rule became effective on September 23, 2009. In the preamble to the interim final rule, the Department also re-issued without substantive change its Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals that was initially issued on April 17, 2009. The Guidance continues to specify encryption and destruction as the two methods for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals-or ''secured''-and thus, exempt from the breach notification obligations. See 74 FR 42741-43. ## B.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What are the physical safeguards under HIPAA?

[Assistant]
According to security_rule_2003:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160, 162, and 164 [CMS-0049-F] RIN 0938-AI57

## Health Insurance Reform: Security Standards

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Final rule. SUMMARY: This final rule adopts standards for the security of electronic protected health information to be implemented by health plans, health care clearinghouses, and certain health care providers. The use of the security standards will improve the Medicare and Medicaid programs, and otherFederal health programs and private health programs, and the effectiveness and efficiency of the health care industry in general by establishing a level of protection for certain electronic health information. This final rule implements some of the requirements of the Administrative Simplification subtitle of the Health Insurance Portability andAccountability Act of 1996 (HIPAA). DATES: Effective Date: These regulations are effective on April 21, 2003. Compliance Date: Covered entities, with the exception of small health plans, must comply with the requirements of this final rule by April 21, 2005. Small health plans must comply with the requirements of this final rule by April 21, 2006. FOR FURTHER INFORMATION CONTACT: William Schooler, (410) 786-0089. SUPPLEMENTARY INFORMATION:

## Availability of Copies and Electronic Access

To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 or by faxing to (202) 5122250. The cost for each copy is $10.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 87)

[Assistant]
According to privacy_rule_2000:

st inform the individual that, when the information is used or disclosed pursuant to the authorization, it may be subject to re-disclosure by the recipient and may no longer be protected by this rule.
Seventh, the authorization must include the individual's signature and the date of the signature. Once we adopt the standards for electronic signature, another of the required administrative simplification standards we are required to adopt under HIPAA, an electronic signature that meets those standards will be sufficient under this rule. We do not require verification of the individual's identity or authentication of the individual's signature. Finally, if the authorization is signed by a personal representative of the individual, the representative must indicate his or her authority to act for the individual. As in the proposed rule, the authorization must be written in plain language. See the preamble discussion regarding notice of privacy practices (§ 164.520) for a discussion of the plain language requirement. We do not provide a model authorization in this rule. We will provide further guidance on this issue prior to the compliance date. ## Section 164.508(d)-Authorizations Requested by a Covered Entity for Its Own Uses and Disclosures

We proposed to require covered entities to include additional elements in authorizations initiated by the covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 163)

[Assistant]
According to privacy_rule_2000:

d concern that clergy, religious practitioners, and other faith-based service providers would have to abide by the rule and asked that the Department exempt prayer healing and non-medical health care.
Response: The Secretary provides the following clarifications in response to these comments. To the extent that a ''department-operated hospital'' meets the definition of a ''health care provider'' and conducts any of the standard transactions, it is a covered entity for the purposes of this rule. We agree that a state Crime Victim Compensation Program is not a covered entity if it is not a health care provider that conducts standard transactions, health plan, or health care clearinghouse. Further, as described above, employers are not covered entities. In addition, we agree that workers' compensation insurers, property and casualty insurers, reinsurers, and stoploss insurers are not covered entities, as they do not meet the statutory definition of ''health plan.'' See further discussion in the preamble on § 160.103 regarding the definition of ''health plan.'' However, activities related to ceding, securing, or placing a contract for reinsurance, including stop-loss insurance, are health care operations in the final rule. As such, reinsurers and stop-loss insurers may obtain protected health information from covered entities. Also, in response to the comment regarding religious practitioners, the Department clarifies that ''health care'' as defined under the rule does not include methods of healing that are solely spiritual. Therefore, clergy or other religious practitioners that provide solely religious healing services are not health care providers within the meaning of this rule, and consequently not covered entities for the purposes of this rule. Comment: A few commenters expressed general uncertainty and requested clarification as to whether certain entities were covered entities for the purposes of this rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 223)

[Assistant]
According to privacy_rule_2000:

nsidered health care operations. Others questioned whether such studies or research performed internal to a covered entity are ''health care operations'' even if generalizable results may be produced.
Response: We agree that some health care operations have many of the characteristics of research studies and in the NPRM asked for comments on how to make this distinction. While a clear answer was not suggested in any of the comments, the comments generally together with our fact finding lead to the provisions in the final rule. The distinction between health care operations and research rests on whether the primary purpose of the study is to produce ''generalizable knowledge.'' We have modified the definition of health care operations to include ''quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities. '' If the primary purpose of the activity is to produce generalizable knowledge, the activity fits within this rule's definition of ''research'' and the covered entity must comply with §§164.508 or 164.512, including obtaining an authorization or the approval of an institutional review board or privacy board. If not and the activity otherwise meets the definition of health care operations, the activity is not research and may be conducted under the health care operations provisions of this rule. In some instances, the primary purpose of the activity may change as preliminary results are analyzed. An activity that was initiated as an internal outcomes evaluation may produce information that the covered entity wants to generalize. If the purpose of a study changes and the covered entity does intend to generalize the results, the covered entity should document the change in status of the activity to establish that they did not violate the requirements of this rule.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 43)

[Assistant]
According to privacy_mod_2002:

le position of having to decide whether to withhold treatment when an individual did not provide consent or proceed to use information to treat the individual in violation of the consent requirements.
19:04 Aug 13, 2002

PO 00000

Frm 00029

- The transition provisions would have resulted in significant operational problems, and the inability to access health records would have had an adverse effect on quality activities, because many providers currently are not required to obtain consent for treatment, payment, or health care operations. - could have hampered treatment and resulted in large institutional providers deciding that it would be necessary to obtain consent at each patient encounter instead. - Providers that are required by law to treat were concerned about the mixed messages to patients and interference with the physician-patient relationship that would have resulted because they would have had to ask for consent to use or disclose protected health information for treatment, payment, or health care operations, but could have used or disclosed the information for such purposes even if the patient said ''no.''

As a result of the large number of treatment-related obstacles raised by various types of health care providers that would have been required to obtain consent, the Department became concerned that individual fixes would be too complex and could possibly overlook important problems. Instead, the Department proposed an approach designed to protect privacy interests by affording patients the opportunity to engage in important discussions regarding the use and disclosure of their health information through the strengthened notice requirement, while allowing activities that are essential to quality health care to occur unimpeded (see section III.H. of the preamble for a discussion of the strengthened notice requirements).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 449)

[Assistant]
According to privacy_rule_2000:

ed relevance to the regulation actually proposed. The following are examples of assumptions and costs in the analysis that do not match privacy policies or requirements stated in the proposed rule. 1.
Authorizations: The study assumed rules requiring new authorizations from current subscribers to use their data for treatment, payment of claims, or other health plan operations. The proposed rule would have prohibited providers or plans from obtaining patient authorization to use data for treatment, payment or health care operations, and the final rule makes obtaining consent for these purposes voluntary for all health plans and for providers that do not have direct treatment relationships with individuals. 2. Disclosure History: The study assumes that providers, health plans, and clearinghouses would have to track all disclosures of health information. Under the NPRM and the final rule, plans, providers and clearinghouses are only required to account for disclosures that are not for treatment, payment, and health care operations, a small minority of all disclosures. 3. Inspection, Copying, and Amendment: The study assumed requirements to allow patients and their subscribers to inspect, copy, and amend all information that includes their name, social security number or other identifying feature ( e.g. customer service calls, internal memorandum, claim runs). However, the study assumed broader access than provided in the rule, which requires access only to information in records used to make decisions about individuals, not all records with identifiable information. 4. Infrastructure development: The study attributed significant costs to infrastructure implementation of (computer systems, training, and other compliance costs). As explained below, the compliance requirements are much less extensive than assumed in this study.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 51)

[Assistant]
According to security_rule_2003:

d entity implement policies and procedures to document repairs and modifications to the physical components of a facility that are related to security (for example, hardware, walls, doors, and locks).
We believe that 15,500 entities will have to repair or modify physical components, most of which will need to be done in the first year of implementation. In the following years, we estimate that 500 entities will need to make repairs or modifications. We estimate that it will take 10 minutes to document each repair or modification for a burden of 2,583 hours the first year and 83 hours annually subsequently. This section requires that a covered entity create a retrievable, exact copy of electronic protected health information, where needed, before movement of equipment. We believe that the burden associated with this requirement is not subject to the PRA. It is good business practice for entities to backup their data files, and as such is usual and customary among the entities subject to them. A burden associated with a requirement conducted in the normal course of business is exempt from the PRA as defined in 5 CFR 1320.3(b)(2). ## Section 164.314 Organizational Requirements

This section requires that a covered entity report to the Secretary problems with a business associate's pattern of an activity or practice of the business associate that constitute a material breach or violation of the business associate's obligation under the contract or other arrangement if it is not feasible to terminate the contract or arrangement. We believe that 10 entities will need to comply with this reporting requirement and that it will take them 60 minutes to comply with this requirement for an annual burden of 10 hours.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 10)

[Assistant]
According to privacy_mod_2002:

ding specifically anti-kickback, fraud and abuse, or self-referral statutes or regulations, or to authorize or permit any activity or transaction currently proscribed by such statutes and regulations.
Examples of such laws include the anti-kickback statute (section 1128B(b) of the Social Security Act), safe harbor regulations (42 CFR part 1001), Stark law (section 1877 of the Social Security Act) and regulations (42 CFR parts 411 and 424), and HIPAA statute on self-referral (section 1128C of the Social Security Act). The definition

Fmt 4701

Sfmt 4700

E:\FR\FM\14AUR4.SGM

pfrm17

PsN: 14AUR4

Jkt 197001

of ''marketing'' is solely applicable to the Privacy Rule and the permissions granted by the Rule are only for a covered entity's use or disclosure of protected health information. In particular, although this regulation defines the term ''marketing'' to exclude communications to an individual to recommend, purchase, or use a product or service as part of the treatment of the individual or for case management or care coordination of that individual, such communication by a ''white coat'' health care professional may violate the anti-kickback statute. Similar examples for pharmacist communications with patients relating to the marketing of products on behalf of pharmaceutical companies were identified by the OIG as problematic in a 1994 Special Fraud Alert (December 19, 1994, 59 FR 65372). Other violations have involved home health nurses and physical therapists acting as marketers for durable medical equipment companies. Although a particular communication under the Privacy Rule may not require patient authorization because it is not marketing, or may require patient authorization because it is ''marketing'' as the Rule defines it, the arrangement may nevertheless violate other statutes and regulations administered by HHS, the Department of Justice, or other Federal or State agency.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 65)

[Assistant]
According to security_rule_2003:

This standard does not apply with respect to-
- (i) The transmission by a covered entity of electronic protected health information to a health care provider concerning the treatment of an individual.
- (ii) The transmission of electronic protected health information by a group health plan or an HMO or health insurance issuer on behalf of a group health plan to a plan sponsor, to the extent that the requirements of §164.314(b) and § 164.504(f) apply and are met; or
- (iii) The transmission of electronic protected health information from or to other agencies providing the services at §164.502(e)(1)(ii)(C), when the covered entity is a health plan that is a government program providing public

VerDate Jan<31>2003

- benefits, if the requirements of §164.502(e)(1)(ii)(C) are met. - (3) A covered entity that violates the satisfactory assurances it provided as a business associate of another covered entity will be in noncompliance with the standards, implementation specifications, and requirements of this paragraph and § 164.314(a). - (4) Implementation specifications: Written contract or other arrangement (Required). Document the satisfactory assurances required by paragraph (b)(1) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of § 164.314(a). ## §164.310 Physical safeguards. A covered entity must, in accordance with § 164.306:

- (a)(1) Standard: Facility access controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. - (2) Implementation specifications:
- (i) Contingency operations (Addressable). Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 47)

[Assistant]
According to privacy_mod_2002:

e options, we do not believe that any would address all of the issues that were brought to the Department's attention during the comment process or would be the best approach for regulating this area.
For example, the suggestion to treat pharmacists as indirect treatment providers would not be consistent with the current regulatory definition of that term and would not have addressed

VerDate Aug<2,>2002

other referral situations. This approach was also rejected by some pharmacists who view themselves as providing treatment directly to individuals. The suggestion to allow certain uses and disclosures prior to first patient encounter would not address concerns of tracking consents, use of historical data for quality purposes, or the concerns of emergency treatment providers. The Department desired a global approach to resolving the problems raised by the prior consent requirement, so as not to add additional complexity to the Privacy Rule or apply different standards to different types of direct treatment providers. This approach is consistent with the basic goal of the Rule to provide flexibility as necessary for the standards to work for all sectors of the health care industry. More global approaches suggested were carefully considered, but each had some flaw or failed to address all of the treatment-related concerns brought to our attention. For example, those who suggested that the Rule be modified to require a good faith effort to obtain consent at first service delivery failed to explain how that approach would provide additional protection than the approach we proposed. The Department also decided against eliminating the consent requirement only for uses and disclosures for treatment, or only for uses of protected health information but not for disclosures, because these options fall short of addressing all of the problems raised.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 122)

[Assistant]
According to hitech_omnibus_2013:

persons who need access to protected health information to carry out their duties and to disclose an amount of protected health information reasonably necessary to achieve the purpose of a disclosure.
The Privacy Rule requires covered entities to determine and define in their policies and procedures how the minimum necessary standard applies to their own uses and disclosures. Thus, covered entities are in a good position to know when such policies and procedures have been violated and to assess the probability that the incident has compromised the security or privacy of the information. Finally, we will consider including further guidance regarding the interaction between the minimum necessary standard and the breach notification requirements in the guidance required by section 13405(b)(1)(B) of the HITECH Act. Comment: Several commenters asked that we clarify the differences between ''acquisition,'' ''access,'' ''use,'' and ''disclosure'' in the exceptions in the final rule. These commenters expressed confusion regarding the use of these terms in the first two exceptions to the definition of breach, stating that the term ''acquisition'' connotes a disclosure of information, and thus, the exception regarding unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or business associate implicitly includes disclosures of protected health information. Response: While the Privacy Rule uses the terms ''use'' and ''disclosure,'' we included both ''acquisition'' and ''access'' in the regulatory text for consistency with the statutory language. We interpret ''acquisition'' and ''access''

VerDate Mar<15>2010

to information based on their plain meanings and believe that both terms are encompassed within the current definitions of ''use'' and ''disclosure'' in the HIPAA Rules.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 285)

[Assistant]
According to privacy_rule_2000:

disclose protected health information for treatment, payment, and health care operations. In addition, we have eliminated the provision prohibiting other covered entities from obtaining such consents.
We note that the consents that covered entities are permitted to obtain relate to their own uses and disclosures of protected health information for treatment, payment, and health care operations and not to the practices of others. If a covered entity wants to obtain the individual's permission to receive protected health information from another covered entity, it must do so using an authorization under § 164.508. ## ''Consent'' versus ''Authorization''

Comment: In general, commenters did not distinguish between ''consent'' and ''authorization.'' Commenters used both terms to refer to the individual's giving permission for the use and disclosure of protected health information by any entity. Response: In the final rule we have made an important distinction between consent and authorization. Under the final rule, we refer to the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations as ''consent.'' The provisions in the final rule relating to consent are largely contained in § 164.506. The process by which a covered entity seeks agreement from an individual to use or disclose protected health information for other purposes, or to authorize another covered entity to disclose protected health information to the requesting covered entity, are termed ''authorizations'' and the provisions relating to them are found in § 164.508. ## Consent Requirements

Comment: Many commenters believed that consent might be problematic in that it could allow covered entities to refuse enrollment or services if the individual does not grant the consent.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 156)

[Assistant]
According to privacy_rule_2000:

nst individuals who exercise any right, or participate in any process established by the privacy rule (Part 164 Subpart E), and include as an example the filing of a complaint with the covered entity.
## Waiver of Rights

In the final regulation, but not in the proposed regulation, we provide that a covered entity may not require individuals to waive their rights to file a complaint with the Secretary or their other rights under this rule as a condition of the provision of treatment, payment, enrollment in a health plan or eligibility for benefits. This provision ensures that covered entities do not take away the rights that individuals have been provided in Parts 160 and 164. ## Requirements for Policies and Procedures, and Documentation Requirements

In § 164.520 of the NPRM, we proposed to require covered entities to develop and document their policies and procedures for implementing the requirements of the rule. In the final regulation we retain this approach, but specify which standards must be documented in each of the relevant sections. In this section, we state the general administrative requirements applicable to all policies and procedures required throughout the regulation. In § 164.530(i), (j), and (k) of the final rule, we amend the NPRM language in several respects. In § 164.530(i) we require that the policies and procedures be reasonably designed to comply with the standards, implementation specifications, and other requirements of the relevant part of the regulation, taking into account the size of the covered entity and the nature of the activities undertaken by the covered entity that relate to protected health information. However, we clarify that the requirements that policies and procedures be reasonably designed may not be interpreted to permit or excuse any action that violates the privacy regulation.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 368)

[Assistant]
According to privacy_rule_2000:

ustrative only, and it was not intended to limit the types of

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

persons who could make such a credible representation to a covered entity.
Comment: One commenter questioned under what circumstances proposed §164.510(k) would apply instead of proposed §164.510(f)(5), ''Urgent Circumstances,'' which permitted covered entities to disclose protected health information to law enforcement officials about individuals who are or are suspected to be victims of a crime, abuse, or other harm, if the law enforcement official represents that the information is needed to determine whether a violation of law by a person other than the victim has occurred and immediate law enforcement activity that depends upon obtaining such information may be necessary. Response: First, we note that inclusion of this provision as §164.510(f)(5) was a drafting error which subsequently was clarified in technical corrections to the NPRM. In fact, proposed § 164.510(f)(3) addressed the identical circumstances, which in this subsection were titled ''Information about a Victim of Crime or Abuse.'' The scenarios described under §164.510(f)(3) may or may not involve serious and imminent threats to health or safety. Second, as discussed in the main section of the preamble to § 164.512(j), we recognize that in some situations, more than one section of this rule potentially could apply with respect to a covered entity's potential disclosure of protected health information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 41)

[Assistant]
According to nist_sp800-66r2:

| Key Activities | Description | Sample Questions | |----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | • Consider whether any vendor/service provider arrangements are critical to operations and address them as appropriate to ensure availability and reliability.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.504(c)(2) require?

[Assistant]
According to privacy_rule_2000:

§164.504(c)(2).

The term ''primary functions'' in the definition of ''hybrid entity'' is not meant to operate with mathematical precision. Rather, we intend that a more common sense evaluation take place: Is most of what the covered entity does related to its health care functions? If so, then the whole entity should be covered. Entities with different insurance lines, if not separately incorporated, present a particular issue with respect to this analysis. Because the definition of ''health plan'' excludes many types of insurance products (in the exclusion under paragraph (2)(i) of the defin


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 507)

[Assistant]
According to privacy_rule_2000:

The communication is made orally; or
8. (ii) The communication is in writing and the covered entity does not receive direct or indirect remuneration from a third party for making the communication. 9.
Organized health care arrangement means:
- (1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

- (2) An organized system of health care in which more than one covered entity participates, and in which the participating covered entities:
2. (i) Hold themselves out to the public as participating in a joint arrangement; and
3. (ii) Participate in joint activities that include at least one of the following:
4. (A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;
5. (B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or
6. (C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 38)

[Assistant]
According to nist_sp800-66r2:

Determine the Goals of an Incident Response                                                         | • Gain an understanding as to what constitutes a true security incident. Under the HIPAA Security Rule, a security incident is the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system (45 CFR § 164.304). • Ensure that the incident response program covers all parts of the organization in which ePHI is created, stored, processed, or transmitted. • Determine how the organization will respond to a security incident. • Establish a reporting mechanism and a process to coordinate responses to the security incident. • Provide direct technical assistance, advise vendors to address product-related problems, and provide liaisons to legal and criminal investigative groups, as needed. | • Has the HIPAA-required security risk assessment resulted in a list of potential physical or technological events that could lead to a breach of security? • Is there a procedure in place for reporting and handling incidents? • Has an analysis been conducted that relates reasonably anticipated organizational threats (that could result in a security incident) to the methods that would be used for mitigation? • Have the key functions of the organization been prioritized to determine what would need to be restored first in the event of a disruption? 69 |
| 2. Develop and Deploy an Incident Response Team or Other Reasonable and Appropriate Response Mechanism | • Determine whether the size, scope, mission, and other aspects of the organization justify the reasonableness and appropriateness of maintaining a standing incident response team. • Identify appropriate individuals to be part of a formal incident response team if the organization has determined that implementing an incident response team is reasonable and appropriate.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 24)

[Assistant]
According to fda_premarket_2023:

r premarket submissions so that FDA can assess whether the manufacturer has sufficiently addressed how to maintain the safety and effectiveness of the device after marketing authorization is achieved.
For cyber devices, 'a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures' is required (see section 524B(b)(1) of the FD&C Act and Section VII.C.1 of this guidance). Cybersecurity management plans should include the following elements:

- Personnel responsible;
- Sources, methods, and frequency for monitoring and identifying vulnerabilities (e.g., researchers, NIST national vulnerability database (NIST NVD), third-party software manufacturers);
- Identify and address vulnerabilities identified in CISA's Known Exploited Vulnerabilities Catalog;
- Periodic security testing;
- Timeline to develop and release patches;
- Update processes;
- Patching capability (i.e., rate at which update can be delivered to devices);
- Description of their coordinated vulnerability disclosure process; and
- Description of how the manufacturer intends to communicate forthcoming remediations, patches, and updates to customers. Additional recommendations on coordinated vulnerability disclosure plans may be found in FDA's Postmarket Cybersecurity Guidance. ## VII. Cyber Devices

This section identifies the cybersecurity information FDA considers to generally be necessary to support obligations under section 524B of the FD&C Act for cyber devices. This section provides recommendations specifically for cyber devices. Manufacturers of cyber devices should also consider the recommendations throughout this guidance to help meet their obligations under section 524B of the FD&C Act. ## A.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 53)

[Assistant]
According to privacy_mod_2002:

proposal in a number of ways. For example, a number of health plans and others requested that the Department eliminate the condition that both covered entities have a relationship with the individual.
Some of these commenters explained that such a restriction would impede some fraud and abuse activities, credentialing investigations, and quality assurance research and outcome studies. Some commenters asked that the Department clarify that the condition that both covered entities have a relationship with the individual would not be limited to a current relationship, but also would include a past relationship with the individual. VerDate Aug<2,>2002

In addition, many commenters requested that the Department expand the proposed provision to allow for disclosures for any type of health care operation of another covered entity, or at least additional activities beyond those specified in the proposal. Some health plans commented that they may need information from a health care provider in order for the health plan to resolve member or internal grievances, provide customer service, arrange for legal services, or conduct medical review or auditing activities. A number of commenters requested that the proposal be expanded to allow for disclosures for another covered entity's underwriting or premium rating. Some commenters also requested that the Department expand the provision to allow for disclosures to non-covered entities. In particular, a number of these commenters urged that the Department allow disclosures to non-covered insurers for fraud and abuse purposes. Some of these commenters specifically requested that the Department allow for disclosures to affiliated entities or nonhealth care components of the covered entity for purposes of investigating fraud and abuse. A few commenters requested that the Rule allow for disclosures to a non-covered health care provider for that provider's operations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 167)

[Assistant]
According to privacy_rule_2000:

heck, or electronic funds transfer; (e) for reporting to consumer reporting agencies; or (f) for complying with: (i) a civil or criminal subpoena; or (ii) a federal or state law regulating the entity.
These companies expressed concern that the proposed rule did not include the full text of section 1179 when discussing the list of activities that were exempt from the rule's requirements. Accordingly, they recommended including in the final rule either a full listing of or a reference to section 1179's full list of exemptions. Furthermore, these firms opposed applying the proposed rule's minimum necessary standard for disclosure of protected health information to financial institutions because of section 1179. These commenters suggest that in light of section 1179, HHS lacks the authority to impose restrictions on financial institutions and other entities when they engage in activities described in that section. One commenter expressed concern that even though proposed §164.510(i) would have permitted covered entities to disclose certain information to financial institutions for banking and payment processes, it did not state clearly that financial institutions and other entities described in section 1179 are exempt from the rule's requirements. Response: We interpret section 1179 of the Act to mean that entities engaged in the activities of a financial institution, and those acting on behalf of a financial institution, are not subject to this regulation when they are engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments for a financial institution. The statutory reference to 12 U.S.C.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] How should organizations implement physical controls?

[Assistant]
According to privacy_rule_2000:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

## Office of the Secretary

## 45 CFR Parts 160 and 164

Rin: 0991-AB08

## Standards for Privacy of Individually Identifiable Health Information

AGENCY : Office of the Assistant Secretary for Planning and Evaluation, DHHS. ACTION

: Final rule. SUMMARY : This rule includes standards to protect the privacy of individually identifiable health information. The rules below, which apply to health plans, health care clearinghouses, and certain health care providers, present standards with respect to the rights of individuals who are the subjects of this information, procedures for the exercise of those rights, and the authorized and required uses and disclosures of this information. The use of these standards will improve the efficiency and effectiveness of public and private health programs and health care services by providing enhanced protections for individually identifiable health information. These protections will begin to address growing public concerns that advances in electronic technology and evolution in the health care industry are resulting, or may result, in a substantial erosion of the privacy surrounding individually identifiable health information maintained by health care providers, health plans and their administrative contractors. This rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and

Accountability Act of 1996. DATES : The final rule is effective on February 26, 2001. ## FOR FURTHER INFORMATION CONTACT :

Kimberly Coleman, 1-866-OCR-PRIV (1-866-627-7748) or TTY 1-866-7884989. ## SUPPLEMENTARY INFORMATION :

Availability of copies, and electronic access. Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 59)

[Assistant]
According to security_rule_2003:

external groups included the NCVHS Workgroup on Standards and Security, the Workgroup for Electronic Data Interchange, the National Uniform Claim Committee, and the National Uniform Billing Committee.
Most of these groups have State officials as members. We also received comments on the proposed regulation from these organizations. In accordance with the provisions of Executive Order 12866, this rule has been reviewed by the Office of Management and Budget. ## List of Subjects

## 45 CFR Part 160

Electronic transactions, Employer benefit plan, Health, Health care, Health facilities, Health insurance, Health

Fmt 4701

Sfmt 4700

E:\FR\FM\20FER2.SGM

20FER2

Jkt 200001

records, Medicaid, Medical research, Medicare, Privacy, Reporting and record keeping requirements. ## 45 CFR Part 162

Administrative practice and procedure, Health facilities, Health insurance, Hospitals, Medicaid, Medicare, report and recordkeeping requirement. ## 45 CFR Part 164

Administrative practice and procedure, Health facilities, Health insurance, Hospitals, Medicaid, Medicare, Electronic Information System, Security, Report and recordkeeping requirement. For the reasons set forth in the preamble, the Department of Health and Human Services amends title 45, subtitle A, subchapter C, parts 160, 162, and 164 as set forth below:

## PART 160-GENERAL ADMINISTRATIVE REQUIREMENTS

1. The authority citation for part 160 continues to read as follows:

Authority: Sec. 1171 through 1179 of the Social Security Act, (42 U.S.C. 1320d1329d-8) as added by sec. 262 of Pub. L. 104-191, 110 Stat. 2021-2031 and sec. 264 of Pub. L. 104-191 (42 U.S.C. 1320d-2(note)). 2. In § 160.103, the definitions of ''disclosure'', ''electronic media'', ''electronic protected health health care arrangement'', ''protected health information,'' and ''use'' are added in alphabetical order to read as

information,'' ''individual,'' ''organized follows:

## §160.103 Definitions.