# data[].attributes.body
The topic of this legal guide is the Health Insurance Portability and Accountability Act (HIPAA), specifically the Privacy Rule of Title II, as it pertains to regulations for the use and disclosure of an individual's protected health information (PHI).

My professional perspective is that of a corporate trainer in the insurance industry. I am currently a Claims Coordinator at Blue Cross Blue Shield of Texas, a division of Health Care Service Corporation (HCSC). HCSC operates Blue Cross Blue Shield plans in Illinois, Montana, New Mexico, Oklahoma, and Texas.

This topic was chosen due to it being the most significant federal and state law in the insurance and health care industries, affecting employees at all levels.

This legal guide will serve as a resource to other corporate trainers and learning and development specialists to aid in  the understanding of legal requirements at the federal, state, and corporate levels.

# data[].attributes.body
I interviewed Matthew Lawrence, Senior Privacy and Data Security Coordinator at Health Care Service Corporation.

HIPAA Importance and Training
Mr. Lawrence explained that HIPAA privacy is one of the things in U.S. health care that actually works. Individuals seek health care with the expectation that their very personal and sensitive information will be cared for in a way that shows respect. The law also provides remedies for situations where an individual's privacy has not been handled appropriately. HIPAA impacts training at HCSC in two different ways. First, the law requires training, this is actually  in the language of the law. Training must be done and,  because of the personal nature of the information, there is an intangible cultural impact to our organization. Training is not simply conducted to gain access to systems or to check a box on a list, it is a vital part of the customer experience. HCSC trains its employees to treat our members and their information with respect and care.

Best Practices

HCSC regularly monitors impermissible use and disclosure issues, breach notifications, physical and technical safeguards, and confidential communications requests.

HCSC has maintained a conservative approach to privacy and security. As a result, minimal updates are required related to HIPAA itself. Policies are frequently updated per federal, state, and contractual obligations.  HCSC complies with regulations of  the states  where HCSC operates and the states where our members reside.

The greatest safeguard of protecting our members' privacy is paying attention. Many of our errors/violations are caused by operators not paying attention or being distracted while handling patient information Ii.e. sending an explanation of benefits to an incorrect address).

Emerging Issues
Mr. Lawrence states currently HIPAA "is what it is" with few issues emerging.  He does anticipate additional privacy and security rules at the state levels. Each state has privacy safeguards in place to protect their citizens and updates are frequently made to enhance these provisions. HIPAA serves as the baseline while each state adds to it. Should America move to a single-payer model, adjustments to HIPAA would be required to balance inconsistencies among states. He concludes that from a privacy perspective, consistency could only be seen as a benefit (M.. Lawrence, personal conversation, December 6, 2019).

# data[].attributes.body
AHIP's Response to Modifying HIPAA Rules

America's Health Insurance Plans (AHIP), formerly the American Association of Health Plans, is the national association representing the health insurance community. The Vice-President of AHIP sent comments to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) after AHIP received a request for information about opportunities to modify HIPAA to improve coordinated care. AHIP made it clear that HIPAA has served as a solid standard for protecting health information and has worked well overall. HIPAA, enacted in 1996, was written well before the digital age when records were primarily paper-based. In the web-based article provided below is a link to the letter sent to HHS by AHIP . In this letter, AHIP outlined areas OCR could focus their resources to improve upon HIPAA's current provisions.
These areas include:
• overcoming challenges of sharing specific categories of information,
• implementing federal standards to preempt state law to streamline protocols,
• regulations and guidance for those acting in good faith to assist in an individual's care,
• education and outreach to inform people about the risks of sharing their health data in the digital age (i.e. apps, online, devices) and informing lawmakers to broaden the scope of HIPAA regulations (AHIP, 2019).

# data[].attributes.attachment_link.readable_text
On February 12, 2019, AHIP submitted comments in response to the Department of Health and Human Services' (HHS) Request for Information (RFI) on opportunities for modifying the Health Insurance Portability and Accountability Act (HIPAA) rules to improve coordinated care.

Our comments make clear that the HIPAA Privacy Rule has served as a solid framework and overall is working well for protecting individuals' health information. While the HIPAA Privacy Rule was written when paper-based records were predominantly used, the current policy considerations should take into account the ability to support interoperable and secure health information technology, as well as value-based payment models (e.g., e-measures). Our letter highlights several areas where we believe the agency should focus its resources.

# data[].attributes.attachment_link.title
AHIP Responds to HHS RFI on Modifying HIPAA Rules to Improve Care Coordination - AHIP

# data[].attributes.attachment_link.description
On February 12, 2019, AHIP submitted comments in response to the Department of Health and Human Services' (HHS) Request for Information (RFI) on opportunities for modifying the Health Insurance Portability and Accountability Act (HIPAA) rules to improve coordinated care.

# data[].attributes.body
HIPAA Training in the Digital Age

Aligning with AHIP's recommendations for HHS, training for the digital age of HIPAA is making headlines. HIPAA compliance training for 2019 is encouraged to include privacy strategies for digital health technology. The four items Wagenen (2019) highlights for compliance in our modern era include:
• Email and Messaging Solutions: these must be easy and secure. Encryption software is now easily available and secure. Simply including "private" or "PHI" in the subject line initiates encryption with many programs.
• Cloud Storage: cloud storage providers paid by health care providers to store PHI are considered business associates which are covered entities under HIPAA and must comply with HIPAA regulations.
• HIPAA Risk Assessments: understand weaknesses and potential vulnerabilities and how to fix them.
• Patient Security and HIPAA Compliance: patients wanting to photograph their test results with smartphones meet reluctance among providers. Patients have the right to view their health data in a form they choose which can include taking a photo.

# data[].attributes.attachment_link.provider_name
Technology Solutions That Drive Healthcare

# data[].attributes.attachment_link.readable_text
"There's no training required. It's very simple," Marvin Onyemaechi, the hospital's director of IT operations, tells HealthTech. Typing the word "private" in the subject line automatically triggers encryption. "That's all you need to do," he says.

These days, while email is important, it's also likely a single part of a strategy that spans several devices - even pagers are still active in the healthcare scene. For this reason, it's important for IT teams to consider a multipronged approach to HIPAA-compliant communications.

As Susan Snedaker, Tucson Medical Center's director of IT Infrastructure and operations, writes in an article for HealthTech: "Any one technology can help an organization keep PHI secure. But an array of HIPAA-compliant communications solutions - such as encrypted email to communicate with patients and secure messaging systems to facilitate time-sensitive internal communications - might be the better bet."
MORE FROM HEALTHTECH: Check out how Parkland Health improved care with a secure mobility strategy.
2. Understand HIPAA-Compliant Cloud Storage

Healthcare organizations have begun to adopt the cloud in earnest. But that move has also triggered concerns about privacy and security for data stored in the cloud. The good news is that an understanding of the basics of HIPAA compliance can assuage these fears and free providers to adopt cloud technology appropriately.

What are these basics? According to healthcare attorney and consultant David Harlow, any cloud storage provider should be approached by the payor or health provider as a business associate. "This means that CSPs storing PHI are subject to HIPAA and need to have appropriate administrative, physical and technical controls in place to address the requirements of the HIPAA Security Rule," he writes in HealthTech.

Once the cloud provider has been established as a business associate of the covered entity, the rest follows suit. Harlow writes: "The CE and the BA must have a business associate agreement (BAA) in place; the CE needs to understand the BA's cloud environment for purposes of its own risk analysis; both the CE and BA need to hold up their ends of the bargain in terms of implementing security controls; and so on."
MORE FROM HEALTHTECH: Learn more about how to ensure your healthcare cloud storage stays HIPAA compliant.
3. Conduct Regular HIPAA Risk Assessments

As part of HIPAA's Security Rule, entities covered under HIPAA must conduct risk assessments in order to stay compliant.

# data[].attributes.attachment_link.title
4 Important Items on Your 2019 HIPAA Compliance Checklist

# data[].attributes.attachment_link.description
"There's no training required. It's very simple," Marvin Onyemaechi, the hospital's director of IT operations, tells HealthTech . Typing the word "private" in the subject line automatically triggers encryption. "That's all you need to do," he says.

# data[].attributes.body
Enforcement Priorities and Breach Trends

OCR officials spoke at a conference to present HHS's focus on enforcement for 2020 and trending breaches seen in 2019. OCR emphasized their commitment to enforcement of HIPAA rights of access and  timely reporting of breaches and complaints. The Office also touched on how cases and investigations are selected to pursue by OCR itself,  those with a perceived importance as well as sending a message about compliance to the health care industry. OCR then announced the increasing trend of security breaches by way of hacking or information technology (IT) incidents. These types of breaches accounted for 61% of all breaches in the first quarter of 2019. OCR recommends the increased use of encryption and safeguard improvements to deter these types of breaches (Wilder, Otto, & Kwong, 2019).

# data[].attributes.attachment_link.readable_text
Regulators, industry experts, and researchers provided insight into health privacy and security enforcement trends, emerging threats, and new tools at a recent conference focused on the Health Insurance Portability and Accountability (HIPAA) regulatory framework. Moving into 2020, organizations with health data should be aware of:

Shifting OCR enforcement priorities;

Regulators' continued attention to key HIPAA compliance activities;

The changing threat landscape for health data; and

New guidance and frameworks for health data not regulated by HIPAA.

Enforcement Trends and Priorities
The Director of OCR, Roger Severino, and Serena Mosely-Day, Senior Advisor for HIPAA Compliance and Enforcement at OCR, were among the speakers at the annual " Safeguarding Health Information: Building Assurance Through HIPAA Security" conference co-hosted on October 16 and 17 by the National Institute of Standards and Technology (NIST) and the Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS). They emphasized OCR's focus on ensuring patients and their families have access to important information, including through the regulatory sprint for coordinated care (with potential changes to HIPAA), agency guidance (including new FAQs for health information and mobile apps), and enforcement actions.

Presentations at the conference highlighted OCR's changing emphases in enforcement and provided insight into how the agency is approaching its case selection and investigations.

OCR chooses cases based on perceived importance and message.

OCR chooses cases based on their import and potential message, with OCR's Director stating that "we go for big cases and small cases" and that the office has no monetary targets for its investigations and settlements. The recent Elite Dental Associates settlement is an example of OCR's willingness to pursue small cases with clear messages. Although the eventual settlement was only $10,000, the case was chosen in part to send a message about providers' appropriate use of social media. In the Elite Dental case, the provider allegedly posted patients' health information to an online review site in response to negative reviews - something OCR views as potentially problematic, especially if it involves revealing patients' names and treatment information publicly. As OCR's priorities change it is moving away from frequent enforcement on laptops and encryption towards enforcement for the HIPAA Right of Access and hacking cases.

OCR will take action to enforce the HIPAA Right of Access.

OCR highlighted its Right of Access Initiative, which settled its first case in September. Bayfront Health St. Petersburg settled with OCR after a complaint from a parent who struggled to get records related to her child's care. OCR has emphasized that providers must respond to requests for access within the required amount of time and need to ensure that they have the proper procedures in place to differentiate Right of Access requests from authorizations. Unlike authorizations, Right of Access Requests must be fulfilled within 30 days, and OCR has been hearing that sometimes organizations do not distinguish between these timelines and therefore fail to respond in a timely manner.

OCR emphasizes the importance of responding timely and appropriately to breaches and complaints.

OCR annually receives approximately 350 breach reports concerning 500 or more individuals. All of these breaches are investigated. However, the agency has made a point of noting that small breaches are also investigated, and that such investigations have led to settlements such as a $3.5 million settlement in 2018.

In addition, organizations should "pay attention to the red flags" and to update and monitor their risk analysis. A $3 million settlement in April 2019 has been used as an example of inadequate response, with OCR citing the entity's initial denial that there was a problem and failure to conduct an appropriate investigation.

The importance of cooperating with OCR investigators regardless of the source of the investigation was also underscored. This includes investigations stemming from complaints. OCR emphasized that the standard for breach notifications is "without unreasonable delay" from the time of discovery, regardless of how long it takes to conduct the forensics investigation and prepare to notify individuals. If notice can be made without unreasonable delay prior to 60 days, in the view of the agency, notice should be provided earlier, as expeditiously as possible, rather than waiting until day 60.

OCR reiterates importance of compliance cornerstones.

Given the growing threats posed by malicious insiders and persistent threats, OCR urged organizations to conduct "risk analysis at the front end" and described risk analysis as a major point of enforcement. Severino specifically recommended that organizations "really consider" testing employees about phishing, describing such training as "almost becoming standard," and that organizations "really consider two-factor authentication." He also emphasized the importance of appropriate access controls, including that "shared passwords are a huge no-no." It is important for organizations to have both technological safeguards and training to successfully prevent attacks.

OCR highlighted that many HIPAA-regulated entities continue to lack appropriate business associate agreements. In addition to being compliance violations, the lack of such an agreement can contribute to other violations such as a failure to respond appropriately to Right of Access requests or insufficient cooperation with OCR. Security incident procedures are an "often overlooked" administrative safeguard and emphasized the importance of appropriate documentation of breach risk assessments.
Emerging Trends in Breaches
OCR highlighted the increasing number of breaches related to hacking/IT incidents noting that "phishing attacks are one of the prime threat actors" and that "we're getting a lot more phishing attacks and network attacks." Speakers predicted that OCR would see a lot more breaches of this type in the future.

During the first three quarters of 2019, hacking/IT breaches made up 61% of reported breaches of 500 or more individuals, despite being only 28% of such reports over the last 10 years. Network servers and email were the location of 65% of 2019's breaches, a notable increase over historical percentages. Laptops and theft of PHI, once frequent sources of breaches, are less common now, which OCR attributes to increased use of encryption and improvements in safeguards and awareness. Phishing attacks have become increasingly well-targeted and sophisticated, making them more likely to be successful than past attempts containing outlandish claims or spelling errors. Insider threats are also an important area of focus for organizations.
New and Enhanced Frameworks and Tools
There are also notable developments in several initiatives in which government agencies are working together to provide guidance on privacy and security best practices.

NIST Privacy Framework
Following the success of the NIST Cybersecurity Framework, NIST is working on an aligned Privacy Framework. The tool is intended to help organizations operationalize privacy risk management and meet the requirements of multiple legal frameworks. NIST is soliciting public comments on its preliminary draft through October 24, 2019. Version 1.0 of the tool is expected to be published by the end of 2019. Our previous coverage of the framework can be found here.

Framework for the Use and Protection of Health Data Outside HIPAA
The National Committee on Vital and Health Statistics has developed a framework for protecting health data outside the HIPAA context. Its recommendations include the establishment of federal standards for health information security and privacy for health data registries, mobile device manufacturers, and mobile app creators. The Committee's report on the framework also urges the development of consumer guidance concerning direct-to-consumer genetic testing that is not protected by HIPAA.

HHS Security Risk Assessment Tool
The developers of HHS's Security Risk Assessment Tool are incorporating feedback received during webinars on the tool offered by the agency during the summer of 2019 into the next version of the tool, which is intended primarily for small- and mid-sized organizations. The feedback will be incorporated into the upcoming version of the tool in the form of enhancements to vulnerability ratings, improved reporting functionality, and cross-references to the NIST Cybersecurity Framework.

The conference agenda with links to presentations is available here.

Coverage of past years' conferences can be found here.

# data[].attributes.attachment_link.title
OCR Provides Insight into Enforcement Priorities and Breach Trends | HL Chronicle of Data Protection

# data[].attributes.attachment_link.description
Regulators, industry experts, and researchers provided insight into health privacy and security enforcement trends, emerging threats, and new tools at a recent conference focused on HIPAA. Moving into 2020, organizations with health data should be aware of: Shifting OCR enforcement priorities, regulators' continued attention to key HIPAA compliance activities, the changing threat landscape for health data, and new guidance and frameworks for health data not regulated by HIPAA.

# data[].attributes.body
Constitutional Law

Fourth Amendment
Although the right to privacy is not explicitly mentioned in the Constitution, the Fourth Amendment is often argued as protecting citizens' right to privacy. The Fourth Amendment states it is the right of the people to be secure against unreasonable searches and seizures (U.S. Const. amend IV).

# data[].attributes.attachment_link.readable_text
Constitution of the United States
Preamble Article I Article II Article III Article IV Article V Article VI
Article VII AMENDMENTS
Introduction

Written in 1787, ratified in 1788, and in operation since 1789, the United States Constitution is the world's longest surviving written charter of government. Its first three words - "We The People" - affirm that the government of the United States exists to serve its citizens. The supremacy of the people through their elected representatives is recognized in Article I, which creates a Congress consisting of a Senate and a House of Representatives. The positioning of Congress at the beginning of the Constitution affirms its status as the "First Branch" of the federal government.

The Constitution assigned to Congress responsibility for organizing the executive and judicial branches, raising revenue, declaring war, and making all laws necessary for executing these powers. The president is permitted to veto specific legislative acts, but Congress has the authority to override presidential vetoes by two-thirds majorities of both houses. The Constitution also provides that the Senate advise and consent on key executive and judicial appointments and on the approval for ratification of treaties.

For over two centuries the Constitution has remained in force because its framers successfully separated and balanced governmental powers to safeguard the interests of majority rule and minority rights, of liberty and equality, and of the federal and state governments. More a concise statement of national principles than a detailed plan of governmental operation, the Constitution has evolved to meet the changing needs of a modern society profoundly different from the eighteenth-century world in which its creators lived. To date, the Constitution has been amended 27 times, most recently in 1992. The first ten amendments constitute the Bill of Rights.

Annotated Constitutions

The Constitution of the United States of America: Analysis and Interpretation (popularly known as the Constitution Annotated) contains legal analysis and interpretation of the United States Constitution, based primarily on Supreme Court case law.

The Constitution of the United States of America, S.PUB.103-21 (1994) (pdf), prepared by the Office of the Secretary of the Senate with the assistance of Johnny H. Killian of the Library of Congress in 1994, provided the original text of each clause of the Constitution with an accompanying explanation of its meaning and how that meaning changed over time.

Italicized text indicates words and passages of the Constitution that were changed or affected by amendments.

Representatives and direct Taxes shall be apportioned among the several States which may be included within this Union, according to their respective Numbers, which shall be determined by adding to the whole Number of free Persons, including those bound to Service for a Term of Years, and excluding Indians not taxed, three fifths of all other Persons. The actual Enumeration shall be made within three Years after the first Meeting of the Congress of the United States, and within every subsequent Term of ten Years, in such Manner as they shall by Law direct. The Number of Representatives shall not exceed one for every thirty Thousand, but each State shall have at Least one Representative; and until such enumeration shall be made, the State of New Hampshire shall be entitled to chuse three, Massachusetts eight, Rhode-Island and Providence Plantations one, Connecticut five, New-York six, New Jersey four, Pennsylvania eight, Delaware one, Maryland six, Virginia ten, North Carolina five, South Carolina five, and Georgia three.

To coin Money, regulate the Value thereof, and of foreign Coin, and fix the Standard of Weights and Measures;

To provide for the Punishment of counterfeiting the Securities and current Coin of the United States;

To declare War, grant Letters of Marque and Reprisal, and make Rules concerning Captures on Land and Water;

To raise and support Armies, but no Appropriation of Money to that Use shall be for a longer Term than two Years;

To provide and maintain a Navy;

To make Rules for the Government and Regulation of the land and naval Forces;

The Electors shall meet in their respective States, and vote by Ballot for two Persons, of whom one at least shall not be an Inhabitant of the same State with themselves. And they shall make a List of all the Persons voted for, and of the Number of Votes for each; which List they shall sign and certify, and transmit sealed to the Seat of the Government of the United States, directed to the President of the Senate. The President of the Senate shall, in the Presence of the Senate and House of Representatives, open all the Certificates, and the Votes shall then be counted. The Person having the greatest Number of Votes shall be the President, if such Number be a Majority of the whole Number of Electors appointed; and if there be more than one who have such Majority, and have an equal Number of Votes, then the House of Representatives shall immediately chuse by Ballot one of them for President; and if no Person have a Majority, then from the five highest on the List the said House shall in like Manner chuse the President. But in chusing the President, the Votes shall be taken by States, the Representatives from each State having one Vote; a quorum for this Purpose shall consist of a Member or Members from two thirds of the States, and a Majority of all the States shall be necessary to a Choice. In every Case, after the Choice of the President, the Person having the greatest Number of Votes of the Electors shall be the Vice President. But if there should remain two or more who have equal Votes, the Senate shall chuse from them by Ballot the Vice-President.

In Case of the Removal of the President from Office, or of his Death, Resignation, or Inability to discharge the Powers and Duties of the said Office, the Same shall devolve on the Vice President, and the Congress may by Law provide for the Case of Removal, Death, Resignation or Inability, both of the President and Vice President, declaring what Officer shall then act as President, and such Officer shall act accordingly, until the Disability be removed, or a President shall be elected.

No Person held to Service or Labour in one State, under the Laws thereof, escaping into another, shall, in Consequence of any Law or Regulation therein, be discharged from such Service or Labour, but shall be delivered up on Claim of the Party to whom such Service or Labour may be due.

The Congress, whenever two thirds of both Houses shall deem it necessary, shall propose Amendments to this Constitution, or, on the Application of the Legislatures of two thirds of the several States, shall call a Convention for proposing Amendments, which, in either Case, shall be valid to all Intents and Purposes, as Part of this Constitution, when ratified by the Legislatures of three fourths of the several States, or by Conventions in three fourths thereof, as the one or the other Mode of Ratification may be proposed by the Congress; Provided that no Amendment which may be made prior to the Year One thousand eight hundred and eight shall in any Manner affect the first and fourth Clauses in the Ninth Section of the first Article; and that no State, without its Consent, shall be deprived of its equal Suffrage in the Senate.

All Debts contracted and Engagements entered into, before the Adoption of this Constitution, shall be as valid against the United States under this Constitution, as under the Confederation.

This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any state to the Contrary notwithstanding.

The Senators and Representatives before mentioned, and the Members of the several State Legislatures, and all executive and judicial Officers, both of the United States and of the several States, shall be bound by Oath or Affirmation, to support this Constitution; but no religious Test shall ever be required as a Qualification to any Office or public Trust under the United States.

The Ratification of the Conventions of nine States, shall be sufficient for the Establishment of this Constitution between the States so ratifying the Same.

Done in Convention by the Unanimous Consent of the States present the Seventeenth Day of September in the Year of our Lord one thousand seven hundred and Eighty seven and of the Independence of the United States of America the Twelfth In Witness whereof We have hereunto subscribed our Names,

G o. Washington-Presid t.

And deputy from Virginia

New Hampshire John Langdon

Nicholas Gilman

Massachusetts Nathaniel Gorham

Rufus King

Connecticut Wm. Saml. Johnson

Roger Sherman

New York Alexander Hamilton

New Jersey Wil: Livingston

David Brearley

Wm. Paterson

Jona. Dayton

Pennsylvania B Franklin

Thomas Mifflin

Robt Morris

Geo. Clymer

Thos. FitzSimons

Jared Ingersoll

James Wilson

Gouv Morris

Delaware Geo: Read

Gunning Bedford jun

John Dickinson

Richard Bassett

Jaco: Broom

Maryland James McHenry

Dan of St. Thos. Jenifer

Danl Carroll

Virginia John Blair-

James Madison Jr.

North Carolina Wm. Blount

Richd. Dobbs Spaight

Hu Williamson

South Carolina J. Rutledge

Charles Cotesworth Pinckney

Charles Pinckney

Pierce Butler

Georgia William Few

Abr Baldwin

Attest William Jackson Secretary

AMENDMENTS
Amendment I (1791) Amendment II (1791)
Amendment III (1791) Amendment IV (1791)
Amendment V (1791) Amendment VI (1791)
Amendment VII (1791) Amendment VIII (1791)
Amendment IX (1791) Amendment X (1791)
Amendment XI (1795/1798) Amendment XII (1804)
Amendment XIII (1865) Amendment XIV (1868)
Amendment XV (1870) Amendment XVI (1913)
Amendment XVII (1913) Amendment XVIII (1919)
Amendment XIX (1920) Amendment XX (1933)
Amendment XXI (1933) Amendment XXII (1951)
Amendment XXIII (1961) Amendment XXIV (1964)
Amendment XXV (1967) Amendment XXVI (1971)
Amendment XXVII (1992)

The Electors shall meet in their respective states and vote by ballot for President and Vice-President, one of whom, at least, shall not be an inhabitant of the same state with themselves; they shall name in their ballots the person voted for as President, and in distinct ballots the person voted for as Vice-President, and they shall make distinct lists of all persons voted for as President, and of all persons voted for as Vice-President, and of the number of votes for each, which lists they shall sign and certify, and transmit sealed to the seat of the government of the United States, directed to the President of the Senate;-The President of the Senate shall, in the presence of the Senate and House of Representatives, open all the certificates and the votes shall then be counted;-The person having the greatest Number of votes for President, shall be the President, if such number be a majority of the whole number of Electors appointed; and if no person have such majority, then from the persons having the highest numbers not exceeding three on the list of those voted for as President, the House of Representatives shall choose immediately, by ballot, the President. But in choosing the President, the votes shall be taken by states, the representation from each state having one vote; a quorum for this purpose shall consist of a member or members from two-thirds of the states, and a majority of all the states shall be necessary to a choice. And if the House of Representatives shall not choose a President whenever the right of choice shall devolve upon them, before the fourth day of March next following, then the Vice-President shall act as President, as in the case of the death or other constitutional disability of the President -The person having the greatest number of votes as Vice-President, shall be the Vice-President, if such number be a majority of the whole number of Electors appointed, and if no person have a majority, then from the two highest numbers on the list, the Senate shall choose the Vice-President; a quorum for the purpose shall consist of two-thirds of the whole number of Senators, and a majority of the whole number shall be necessary to a choice. But no person constitutionally ineligible to the office of President shall be eligible to that of Vice-President of the United States.

Section 1. All persons born or naturalized in the United States and subject to the jurisdiction thereof, are citizens of the United States and of the State wherein they reside. No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws.

Section 2. Representatives shall be apportioned among the several States according to their respective numbers, counting the whole number of persons in each State, excluding Indians not taxed. But when the right to vote at any election for the choice of electors for President and Vice President of the United States, Representatives in Congress, the Executive and Judicial officers of a State, or the members of the Legislature thereof, is denied to any of the male inhabitants of such State, being twenty-one years of age, and citizens of the United States, or in any way abridged, except for participation in rebellion, or other crime, the basis of representation therein shall be reduced in the proportion which the number of such male citizens shall bear to the whole number of male citizens twenty-one years of age in such State.

Section 3. No person shall be a Senator or Representative in Congress, or elector of President and Vice President, or hold any office, civil or military, under the United States, or under any State, who, having previously taken an oath, as a member of Congress, or as an officer of the United States, or as a member of any State legislature, or as an executive or judicial officer of any State, to support the Constitution of the United States, shall have engaged in insurrection or rebellion against the same, or given aid or comfort to the enemies thereof. But Congress may by a vote of two-thirds of each House, remove such disability.

Section 4. The validity of the public debt of the United States, authorized by law, including debts incurred for payment of pensions and bounties for services in suppressing insurrection or rebellion, shall not be questioned. But neither the United States nor any State shall assume or pay any debt or obligation incurred in aid of insurrection or rebellion against the United States, or any claim for the loss or emancipation of any slave; but all such debts, obligations and claims shall be held illegal and void.

Section 5. The Congress shall have power to enforce, by appropriate legislation, the provisions of this article.

The Senate of the United States shall be composed of two Senators from each State, elected by the people thereof, for six years; and each Senator shall have one vote. The electors in each State shall have the qualifications requisite for electors of the most numerous branch of the State legislatures.

When vacancies happen in the representation of any State in the Senate, the executive authority of such State shall issue writs of election to fill such vacancies: Provided, That the legislature of any State may empower the executive thereof to make temporary appointments until the people fill the vacancies by election as the legislature may direct.

This amendment shall not be so construed as to affect the election or term of any Senator chosen before it becomes valid as part of the Constitution.

Section 1. After one year from the ratification of this article the manufacture, sale, or transportation of intoxicating liquors within, the importation thereof into, or the exportation thereof from the United States and all territory subject to the jurisdiction thereof for beverage purposes is hereby prohibited.

Section 2. The Congress and the several States shall have concurrent power to enforce this article by appropriate legislation.

Section 3. This article shall be inoperative unless it shall have been ratified as an amendment to the Constitution by the legislatures of the several States, as provided in the Constitution, within seven years from the date of the submission hereof to the States by the Congress.

Section 1. The terms of the President and Vice President shall end at noon on the 20th day of January, and the terms of Senators and Representatives at noon on the 3d day of January, of the years in which such terms would have ended if this article had not been ratified; and the terms of their successors shall then begin.

Section 2. The Congress shall assemble at least once in every year, and such meeting shall begin at noon on the 3d day of January, unless they shall by law appoint a different day.

Section 3. If, at the time fixed for the beginning of the term of the President, the President elect shall have died, the Vice President elect shall become President. If a President shall not have been chosen before the time fixed for the beginning of his term, or if the President elect shall have failed to qualify, then the Vice President elect shall act as President until a President shall have qualified; and the Congress may by law provide for the case wherein neither a President elect nor a Vice President elect shall have qualified, declaring who shall then act as President, or the manner in which one who is to act shall be selected, and such person shall act accordingly until a President or Vice President shall have qualified.

Section 4. The Congress may by law provide for the case of the death of any of the persons from whom the House of Representatives may choose a President whenever the right of choice shall have devolved upon them, and for the case of the death of any of the persons from whom the Senate may choose a Vice President whenever the right of choice shall have devolved upon them.

Section 5. Sections 1 and 2 shall take effect on the 15th day of October following the ratification of this article.

Section 6. This article shall be inoperative unless it shall have been ratified as an amendment to the Constitution by the legislatures of three-fourths of the several States within seven years from the date of its submission.

Section 1. The eighteenth article of amendment to the Constitution of the United States is hereby repealed.

Section 2. The transportation or importation into any State, Territory, or possession of the United States for delivery or use therein of intoxicating liquors, in violation of the laws thereof, is hereby prohibited.

Section 3. This article shall be inoperative unless it shall have been ratified as an amendment to the Constitution by conventions in the several States, as provided in the Constitution, within seven years from the date of the submission hereof to the States by the Congress.

Section 1. The District constituting the seat of Government of the United States shall appoint in such manner as the Congress may direct:

A number of electors of President and Vice President equal to the whole number of Senators and Representatives in Congress to which the District would be entitled if it were a State, but in no event more than the least populous State; they shall be in addition to those appointed by the States, but they shall be considered, for the purposes of the election of President and Vice President, to be electors appointed by a State; and they shall meet in the District and perform such duties as provided by the twelfth article of amendment.

Section 2. The Congress shall have power to enforce this article by appropriate legislation.

Section 1. In case of the removal of the President from office or of his death or resignation, the Vice President shall become President.

Section 2. Whenever there is a vacancy in the office of the Vice President, the President shall nominate a Vice President who shall take office upon confirmation by a majority vote of both Houses of Congress.

Section 3. Whenever the President transmits to the President pro tempore of the Senate and the Speaker of the House of Representatives his written declaration that he is unable to discharge the powers and duties of his office, and until he transmits to them a written declaration to the contrary, such powers and duties shall be discharged by the Vice President as Acting President.

Section 4. Whenever the Vice President and a majority of either the principal officers of the executive departments or of such other body as Congress may by law provide, transmit to the President pro tempore of the Senate and the Speaker of the House of Representatives their written declaration that the President is unable to discharge the powers and duties of his office, the Vice President shall immediately assume the powers and duties of the office as Acting President.

Thereafter, when the President transmits to the President pro tempore of the Senate and the Speaker of the House of Representatives his written declaration that no inability exists, he shall resume the powers and duties of his office unless the Vice President and a majority of either the principal officers of the executive department or of such other body as Congress may by law provide, transmit within four days to the President pro tempore of the Senate and the Speaker of the House of Representatives their written declaration that the President is unable to discharge the powers and duties of his office. Thereupon Congress shall decide the issue, assembling within forty-eight hours for that purpose if not in session. If the Congress, within twenty-one days after receipt of the latter written declaration, or, if Congress is not in session, within twenty-one days after Congress is required to assemble, determines by two-thirds vote of both Houses that the President is unable to discharge the powers and duties of his office, the Vice President shall continue to discharge the same as Acting President; otherwise, the President shall resume the powers and duties of his office.

# data[].attributes.attachment_link.description
Constitution of the United States Preamble Article I Article II Article III Article IV Article V Article VI Article VII AMENDMENTS Introduction Written in 1787, ratified in 1788, and in operation since 1789, the United States Constitution is the world's longest surviving written charter of government.

# data[].attributes.body
Statutory/Public Law

Health Insurance Portability and Accountability Act of 1996
Passed in 1996 by President Bill Clinton, HIPAA was enacted to improve portability and continuity of health insurance coverage in various markets, to combat fraud, waste, and abuse in health insurance and health care delivery, to promote increased use of medical savings accounts, to improve access to long-term care coverage and services, to simplify the administration of health insurance, and to protect the privacy of individually identifiable health information. All covered entities are required to be HIPAA-compliant. These entities include health insurance companies, health maintenance organizations (HMO’s), company health plans, health care providers, and government programs paying for health care, such as Medicare and Medicaid. These entities are required to have physical, network, and process security measures in place to secure PHI (Health Insurance Portability and Accountability Act, § 264).

# data[].attributes.body
Administrative Law

DHHS Privacy Rule
Federal law establishes regulations for the Department of Health and Human Services to safeguard the privacy of individually identifiable health information, known as the Privacy Rule. The Privacy Rule bestows certain rights on individuals, including rights to access and amend their health care information and to request a record of when and why their PHI has been shared with others and for what purpose. This law protects all patient information held or transmitted by a covered entity and defines and limits the circumstances in which PHI may be used or disclosed (45 C.F.R. § 164.500-534).

# data[].attributes.attachment_link.provider_name
Electronic Code of Federal Regulations (eCFR)

# data[].attributes.attachment_link.readable_text
Home
gpo.gov
govinfo.gov

e-CFR Navigation Aids
Browse Simple Search
Advanced Search

- Boolean

- Proximity
Search History Search Tips Corrections Latest Updates User Info FAQs Agency List Incorporation By Reference
Related Resources

The Code of Federal Regulations (CFR) annual edition is the codification of the general and permanent rules published in the Federal Register by the departments and agencies of the Federal Government produced by the Office of the Federal Register (OFR) and the Government Publishing Office.

Download the Code of Federal Regulations in XML.

Download the Electronic Code of Federal Regulations in XML.

Monthly Title and Part user viewing data for the e-CFR is available for download in CSV format.

Parallel Table of Authorities and Rules for the Code of Federal Regulations and the United States Code
Text | PDF

Find, review, and submit comments on Federal rules that are open for comment and published in the Federal Register using Regulations.gov.

Purchase individual CFR titles from the U.S. Government Online Bookstore.

Find issues of the CFR (including issues prior to 1996) at a local Federal depository library.

[A1-C]

Electronic Code of Federal Regulations

Title 45: Public Welfare

PART 164-SECURITY AND PRIVACY
Contents
Subpart A-General Provisions§164.102 Statutory basis.
§164.103 Definitions.
§164.104 Applicability.
§164.105 Organizational requirements.
§164.106 Relationship to other parts.
Subpart B [Reserved]Subpart C-Security Standards for the Protection of Electronic Protected Health Information§164.302 Applicability.
§164.304 Definitions.
§164.306 Security standards: General rules.
§164.308 Administrative safeguards.
§164.310 Physical safeguards.
§164.312 Technical safeguards.
§164.314 Organizational requirements.
§164.316 Policies and procedures and documentation requirements.
§164.318 Compliance dates for the initial implementation of the security standards.
Appendix A to Subpart C of Part 164-Security Standards: Matrix
Subpart D-Notification in the Case of Breach of Unsecured Protected Health Information§164.400 Applicability.
§164.402 Definitions.
§164.404 Notification to individuals.
§164.406 Notification to the media.
§164.408 Notification to the Secretary.
§164.410 Notification by a business associate.
§164.412 Law enforcement delay.
§164.414 Administrative requirements and burden of proof.
Subpart E-Privacy of Individually Identifiable Health Information§164.500 Applicability.
§164.501 Definitions.
§164.502 Uses and disclosures of protected health information: General rules.
§164.504 Uses and disclosures: Organizational requirements.
§164.506 Uses and disclosures to carry out treatment, payment, or health care operations.
§164.508 Uses and disclosures for which an authorization is required.
§164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object.
§164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required.
§164.514 Other requirements relating to uses and disclosures of protected health information.
§164.520 Notice of privacy practices for protected health information.
§164.522 Rights to request privacy protection for protected health information.
§164.524 Access of individuals to protected health information.
§164.526 Amendment of protected health information.
§164.528 Accounting of disclosures of protected health information.
§164.530 Administrative requirements.
§164.532 Transition provisions.
§164.534 Compliance dates for initial implementation of the privacy standards.

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

Subpart A-General Provisions

§164.102 Statutory basis.

The provisions of this part are adopted pursuant to the Secretary's authority to prescribe standards, requirements, and implementation specifications under part C of title XI of the Act, section 264 of Public Law 104-191, and sections 13400-13424 of Public Law 111-5.

[78 FR 5692, Jan. 25, 2013]

§164.103 Definitions.

As used in this part, the following terms have the following meanings:

Common control exists if an entity has the power, directly or indirectly, significantly to influence or direct the actions or policies of another entity.

Common ownership exists if an entity or entities possess an ownership or equity interest of 5 percent or more in another entity.

Covered functions means those functions of a covered entity the performance of which makes the entity a health plan, health care provider, or health care clearinghouse.

Health care component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with §164.105(a)(2)(iii)(D).

Hybrid entity means a single legal entity:

(1) That is a covered entity;

(2) Whose business activities include both covered and non-covered functions; and

(3) That designates health care components in accordance with paragraph §164.105(a)(2)(iii)(D).

Law enforcement official means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to:

(1) Investigate or conduct an official inquiry into a potential violation of law; or

(2) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

Plan sponsor is defined as defined at section 3(16)(B) of ERISA, 29 U.S.C. 1002(16)(B).

Required by law means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.

[68 FR 8374, Feb. 20, 2003, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 34266, June 7, 2013]

§164.104 Applicability.

(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this part apply to the following entities:

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

(b) Where provided, the standards, requirements, and implementation specifications adopted under this part apply to a business associate.

[68 FR 8375, Feb. 20, 2003, as amended at 78 FR 5692, Jan. 25, 2013]

§164.105 Organizational requirements.

(a)(1) Standard: Health care component. If a covered entity is a hybrid entity, the requirements of this part, other than the requirements of this section, §§164.314, and 164.504, apply only to the health care component(s) of the entity, as specified in this section.

(2) Implementation specifications:

(i) Application of other provisions. In applying a provision of this part, other than the requirements of this section, §§164.314, and 164.504, to a hybrid entity:

(A) A reference in such provision to a "covered entity" refers to a health care component of the covered entity;

(B) A reference in such provision to a "health plan," "covered health care provider," or "health care clearinghouse," refers to a health care component of the covered entity if such health care component performs the functions of a health plan, health care provider, or health care clearinghouse, as applicable;

(C) A reference in such provision to "protected health information" refers to protected health information that is created or received by or on behalf of the health care component of the covered entity; and

(D) A reference in such provision to "electronic protected health information" refers to electronic protected health information that is created, received, maintained, or transmitted by or on behalf of the health care component of the covered entity.

(ii) Safeguard requirements. The covered entity that is a hybrid entity must ensure that a health care component of the entity complies with the applicable requirements of this part. In particular, and without limiting this requirement, such covered entity must ensure that:

(A) Its health care component does not disclose protected health information to another component of the covered entity in circumstances in which subpart E of this part would prohibit such disclosure if the health care component and the other component were separate and distinct legal entities;

(B) Its health care component protects electronic protected health information with respect to another component of the covered entity to the same extent that it would be required under subpart C of this part to protect such information if the health care component and the other component were separate and distinct legal entities;

(C) If a person performs duties for both the health care component in the capacity of a member of the workforce of such component and for another component of the entity in the same capacity with respect to that component, such workforce member must not use or disclose protected health information created or received in the course of or incident to the member's work for the health care component in a way prohibited by subpart E of this part.

(iii) Responsibilities of the covered entity. A covered entity that is a hybrid entity has the following responsibilities:

(A) For purposes of subpart C of part 160 of this subchapter, pertaining to compliance and enforcement, the covered entity has the responsibility of complying with this part.

(B) The covered entity is responsible for complying with §§164.316(a) and 164.530(i), pertaining to the implementation of policies and procedures to ensure compliance with applicable requirements of this part, including the safeguard requirements in paragraph (a)(2)(ii) of this section.

(C) The covered entity is responsible for complying with §§164.314 and 164.504 regarding business associate arrangements and other organizational requirements.

(D) The covered entity is responsible for designating the components that are part of one or more health care components of the covered entity and documenting the designation in accordance with paragraph (c) of this section, provided that, if the covered entity designates one or more health care components, it must include any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. Health care component(s) also may include a component only to the extent that it performs covered functions.

(b)(1) Standard: Affiliated covered entities. Legally separate covered entities that are affiliated may designate themselves as a single covered entity for purposes of this part.

(2) Implementation specifications-(i) Requirements for designation of an affiliated covered entity-(A) Legally separate covered entities may designate themselves (including any health care component of such covered entity) as a single affiliated covered entity, for purposes of this part, if all of the covered entities designated are under common ownership or control.

(B) The designation of an affiliated covered entity must be documented and the documentation maintained as required by paragraph (c) of this section.

(ii) Safeguard requirements. An affiliated covered entity must ensure that it complies with the applicable requirements of this part, including, if the affiliated covered entity combines the functions of a health plan, health care provider, or health care clearinghouse, §§164.308(a)(4)(ii)(A) and 164.504(g), as applicable.

(c)(1) Standard: Documentation. A covered entity must maintain a written or electronic record of a designation as required by paragraphs (a) or (b) of this section.

(2) Implementation specification: Retention period. A covered entity must retain the documentation as required by paragraph (c)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

[68 FR 8375, Feb. 20, 2003, as amended at 78 FR 5692, Jan. 25, 2013]

§164.106 Relationship to other parts.

In complying with the requirements of this part, covered entities and, where provided, business associates, are required to comply with the applicable provisions of parts 160 and 162 of this subchapter.

[78 FR 5693, Jan. 25, 2013]

Subpart B [Reserved]

Subpart C-Security Standards for the Protection of Electronic Protected Health Information

Authority: 42 U.S.C. 1320d-2 and 1320d-4; sec. 13401, Pub. L. 111-5, 123 Stat. 260.

Source: 68 FR 8376, Feb. 20, 2003, unless otherwise noted.

§164.302 Applicability.

A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.

[78 FR 5693, Jan. 25, 2013]

§164.304 Definitions.

As used in this subpart, the following terms have the following meanings:

Access means the ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource. (This definition applies to "access" as used in this subpart, not as used in subparts D or E of this part.)

Administrative safeguards are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information.

Authentication means the corroboration that a person is the one claimed.

Availability means the property that data or information is accessible and useable upon demand by an authorized person.

Confidentiality means the property that data or information is not made available or disclosed to unauthorized persons or processes.

Encryption means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.

Facility means the physical premises and the interior and exterior of a building(s).

Information system means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.

Integrity means the property that data or information have not been altered or destroyed in an unauthorized manner.

Malicious software means software, for example, a virus, designed to damage or disrupt a system.

Password means confidential authentication information composed of a string of characters.

Physical safeguards are physical measures, policies, and procedures to protect a covered entity's or business associate's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.

Security or Security measures encompass all of the administrative, physical, and technical safeguards in an information system.

Security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

Technical safeguards means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.

User means a person or entity with authorized access.

Workstation means an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.

[68 FR 8376, Feb. 20, 2003, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 5693, Jan. 25, 2013]

§164.306 Security standards: General rules.

(a) General requirements. Covered entities and business associates must do the following:

(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.

(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.

(4) Ensure compliance with this subpart by its workforce.

(b) Flexibility of approach. (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.

(2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors:

(i) The size, complexity, and capabilities of the covered entity or business associate.

(ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities.

(iii) The costs of security measures.

(iv) The probability and criticality of potential risks to electronic protected health information.

(c) Standards. A covered entity or business associate must comply with the applicable standards as provided in this section and in §§164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.

(d) Implementation specifications. In this subpart:

(1) Implementation specifications are required or addressable. If an implementation specification is required, the word "Required" appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word "Addressable" appears in parentheses after the title of the implementation specification.

(2) When a standard adopted in §164.308, §164.310, §164.312, §164.314, or §164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications.

(3) When a standard adopted in §164.308, §164.310, §164.312, §164.314, or §164.316 includes addressable implementation specifications, a covered entity or business associate must-

(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and

(ii) As applicable to the covered entity or business associate-

(A) Implement the implementation specification if reasonable and appropriate; or

(B) If implementing the implementation specification is not reasonable and appropriate-

$(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and

$(2) Implement an equivalent alternative measure if reasonable and appropriate.

(e) Maintenance. A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with §164.316(b)(2)(iii).

[68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013]

§164.308 Administrative safeguards.

(a) A covered entity or business associate must, in accordance with §164.306:

(1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.

(ii) Implementation specifications:

(A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

(B) Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a).

(C) Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.

(D) Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

(2) Standard: Assigned security responsibility. Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.

(3)(i) Standard: Workforce security. Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.

(ii) Implementation specifications:

(A) Authorization and/or supervision (Addressable). Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.

(B) Workforce clearance procedure (Addressable). Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.

(C) Termination procedures (Addressable). Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.

(4)(i) Standard: Information access management. Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.

(ii) Implementation specifications:

(A) Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.

(B) Access authorization (Addressable). Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.

(C) Access establishment and modification (Addressable). Implement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.

(5)(i) Standard: Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management).

(ii) Implementation specifications. Implement:

(A) Security reminders (Addressable). Periodic security updates.

(B) Protection from malicious software (Addressable). Procedures for guarding against, detecting, and reporting malicious software.

(C) Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies.

(D) Password management (Addressable). Procedures for creating, changing, and safeguarding passwords.

(6)(i) Standard: Security incident procedures. Implement policies and procedures to address security incidents.

(ii) Implementation specification: Response and reporting (Required). Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

(7)(i) Standard: Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.

(ii) Implementation specifications:

(A) Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.

(B) Disaster recovery plan (Required). Establish (and implement as needed) procedures to restore any loss of data.

(C) Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.

(D) Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans.

(E) Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components.

(8) Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.

(b)(1) Business associate contracts and other arrangements. A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with §164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(2) A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with §164.314(a), that the subcontractor will appropriately safeguard the information.

(3) Implementation specifications: Written contract or other arrangement (Required). Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of §164.314(a).

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§164.310 Physical safeguards.

A covered entity or business associate must, in accordance with §164.306:

(a)(1) Standard: Facility access controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.

(2) Implementation specifications:

(i) Contingency operations (Addressable). Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.

(ii) Facility security plan (Addressable). Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.

(iii) Access control and validation procedures (Addressable). Implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.

(iv) Maintenance records (Addressable). Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).

(b) Standard: Workstation use. Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.

(c) Standard: Workstation security. Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.

(d)(1) Standard: Device and media controls. Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.

(2) Implementation specifications:

(i) Disposal (Required). Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.

(ii) Media re-use (Required). Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.

(iii) Accountability (Addressable). Maintain a record of the movements of hardware and electronic media and any person responsible therefore.

(iv) Data backup and storage (Addressable). Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§164.312 Technical safeguards.

A covered entity or business associate must, in accordance with §164.306:

(a)(1) Standard: Access control. Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in §164.308(a)(4).

(2) Implementation specifications:

(i) Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.

(ii) Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.

(iii) Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

(iv) Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.

(b) Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

(c)(1) Standard: Integrity. Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

(2) Implementation specification: Mechanism to authenticate electronic protected health information (Addressable). Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.

(d) Standard: Person or entity authentication. Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.

(e)(1) Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.

(2) Implementation specifications:

(i) Integrity controls (Addressable). Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.

(ii) Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§164.314 Organizational requirements.

(a)(1) Standard: Business associate contracts or other arrangements. The contract or other arrangement required by §164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.

(2) Implementation specifications (Required)-

(i) Business associate contracts. The contract must provide that the business associate will-

(A) Comply with the applicable requirements of this subpart;

(B) In accordance with §164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and

(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by §164.410.

(ii) Other arrangements. The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of §164.504(e)(3).

(iii) Business associate contracts with subcontractors. The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by §164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.

(b)(1) Standard: Requirements for group health plans. Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to §164.504(f)(1)(ii) or (iii), or as authorized under §164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.

(2) Implementation specifications (Required). The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to-

(i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;

(ii) Ensure that the adequate separation required by §164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;

(iii) Ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and

(iv) Report to the group health plan any security incident of which it becomes aware.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§164.316 Policies and procedures and documentation requirements.

A covered entity or business associate must, in accordance with §164.306:

(a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in §164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.

(b)(1) Standard: Documentation. (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and

(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.

(2) Implementation specifications:

(i) Time limit (Required). Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

(ii) Availability (Required). Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.

(iii) Updates (Required). Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5695, Jan. 25, 2013]

§164.318 Compliance dates for the initial implementation of the security standards.

(a) Health plan. (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.

(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.

(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.

(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.

Appendix A to Subpart C of Part 164-Security Standards: Matrix

Subpart D-Notification in the Case of Breach of Unsecured Protected Health Information

Source: 74 FR 42767, Aug. 24, 2009, unless otherwise noted.

§164.400 Applicability.

The requirements of this subpart shall apply with respect to breaches of protected health information occurring on or after September 23, 2009.

§164.402 Definitions.

As used in this subpart, the following terms have the following meanings:

Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

(1) Breach excludes:

(i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part.

(ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part.

(iii) A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

(2) Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

(i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

(ii) The unauthorized person who used the protected health information or to whom the disclosure was made;

(iii) Whether the protected health information was actually acquired or viewed; and

(iv) The extent to which the risk to the protected health information has been mitigated.

Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111-5.

[78 FR 5695, Jan. 25, 2013]

§164.404 Notification to individuals.

(a) Standard-(1) General rule. A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, §§164.406(a), and 164.408(a), a breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity. A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity (determined in accordance with the federal common law of agency).

(b) Implementation specification: Timeliness of notification. Except as provided in §164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification-(1) Elements. The notification required by paragraph (a) of this section shall include, to the extent possible:

(A) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;

(B) A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);

(C) Any steps individuals should take to protect themselves from potential harm resulting from the breach;

(D) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and

(E) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.

(2) Plain language requirement. The notification required by paragraph (a) of this section shall be written in plain language.

(d) Implementation specifications: Methods of individual notification. The notification required by paragraph (a) of this section shall be provided in the following form:

(1) Written notice. (i) Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. The notification may be provided in one or more mailings as information is available.

(ii) If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual (as specified under §164.502(g)(4) of subpart E), written notification by first-class mail to either the next of kin or personal representative of the individual. The notification may be provided in one or more mailings as information is available.

(2) Substitute notice. In the case in which there is insufficient or out-of-date contact information that precludes written notification to the individual under paragraph (d)(1)(i) of this section, a substitute form of notice reasonably calculated to reach the individual shall be provided. Substitute notice need not be provided in the case in which there is insufficient or out-of-date contact information that precludes written notification to the next of kin or personal representative of the individual under paragraph (d)(1)(ii).

(i) In the case in which there is insufficient or out-of-date contact information for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means.

(ii) In the case in which there is insufficient or out-of-date contact information for 10 or more individuals, then such substitute notice shall:

(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and

(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.

(3) Additional notice in urgent situations. In any case deemed by the covered entity to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity may provide information to individuals by telephone or other means, as appropriate, in addition to notice provided under paragraph (d)(1) of this section.

§164.406 Notification to the media.

(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in §164.404(a)(2), notify prominent media outlets serving the State or jurisdiction.

(b) Implementation specification: Timeliness of notification. Except as provided in §164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of §164.404(c).

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§164.408 Notification to the Secretary.

(a) Standard. A covered entity shall, following the discovery of a breach of unsecured protected health information as provided in §164.404(a)(2), notify the Secretary.

(b) Implementation specifications: Breaches involving 500 or more individuals. For breaches of unsecured protected health information involving 500 or more individuals, a covered entity shall, except as provided in §164.412, provide the notification required by paragraph (a) of this section contemporaneously with the notice required by §164.404(a) and in the manner specified on the HHS Web site.

(c) Implementation specifications: Breaches involving less than 500 individuals. For breaches of unsecured protected health information involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§164.410 Notification by a business associate.

(a) Standard-(1) General rule. A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the Federal common law of agency).

(b) Implementation specifications: Timeliness of notification. Except as provided in §164.412, a business associate shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. (1) The notification required by paragraph (a) of this section shall include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, used, or disclosed during the breach.

(2) A business associate shall provide the covered entity with any other available information that the covered entity is required to include in notification to the individual under §164.404(c) at the time of the notification required by paragraph (a) of this section or promptly thereafter as information becomes available.

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§164.412 Law enforcement delay.

If a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered entity or business associate shall:

(a) If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official; or

(b) If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in paragraph (a) of this section is submitted during that time.

§164.414 Administrative requirements and burden of proof.

(a) Administrative requirements. A covered entity is required to comply with the administrative requirements of §164.530(b), (d), (e), (g), (h), (i), and (j) with respect to the requirements of this subpart.

(b) Burden of proof. In the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach, as defined at §164.402.

Subpart E-Privacy of Individually Identifiable Health Information

Authority: 42 U.S.C. 1320d-2, 1320d-4, and 1320d-9; sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

§164.500 Applicability.

(a) Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information.

(b) Health care clearinghouses must comply with the standards, requirements, and implementation specifications as follows:

(1) When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with:

(i) Section 164.500 relating to applicability;

(ii) Section 164.501 relating to definitions;

(iii) Section 164.502 relating to uses and disclosures of protected health information, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;

(iv) Section 164.504 relating to the organizational requirements for covered entities;

(v) Section 164.512 relating to uses and disclosures for which individual authorization or an opportunity to agree or object is not required, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;

(vi) Section 164.532 relating to transition requirements; and

(vii) Section 164.534 relating to compliance dates for initial implementation of the privacy standards.

(2) When a health care clearinghouse creates or receives protected health information other than as a business associate of a covered entity, the clearinghouse must comply with all of the standards, requirements, and implementation specifications of this subpart.

(c) Where provided, the standards, requirements, and implementation specifications adopted under this subpart apply to a business associate with respect to the protected health information of a covered entity.

(d) The standards, requirements, and implementation specifications of this subpart do not apply to the Department of Defense or to any other federal agency, or non-governmental organization acting on its behalf, when providing health care to overseas foreign national beneficiaries.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013]

§164.501 Definitions.

As used in this subpart, the following terms have the following meanings:

Correctional institution means any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by, or under contract to, the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. Other persons held in lawful custody includes juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, or others awaiting charges or trial.

Data aggregation means, with respect to protected health information created or received by a business associate in its capacity as the business associate of a covered entity, the combining of such protected health information by the business associate with the protected health information received by the business associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities.

Designated record set means:

(1) A group of records maintained by or for a covered entity that is:

(i) The medical records and billing records about individuals maintained by or for a covered health care provider;

(ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or

(iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals.

(2) For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.

Direct treatment relationship means a treatment relationship between an individual and a health care provider that is not an indirect treatment relationship.

Health care operations means any of the following activities of the covered entity to the extent that the activities are related to covered functions:

(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;

(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities;

(3) Except as prohibited under §164.502(a)(5)(i), underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of §164.514(g) are met, if applicable;

(4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;

(5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and

(6) Business management and general administrative activities of the entity, including, but not limited to:

(i) Management activities relating to implementation of and compliance with the requirements of this subchapter;

(ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer.

(iii) Resolution of internal grievances;

(iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and

(v) Consistent with the applicable requirements of §164.514, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.

Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.

Indirect treatment relationship means a relationship between an individual and a health care provider in which:

(1) The health care provider delivers health care to the individual based on the orders of another health care provider; and

(2) The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual.

Inmate means a person incarcerated in or otherwise confined to a correctional institution.

(1) Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

(2) Marketing does not include a communication made:

(i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication.

(ii) For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication:

(A) For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual;

(B) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits; or

(C) For case management or care coordination, contacting of individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment.

(3) Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual.

Payment means:

(1) The activities undertaken by:

(i) Except as prohibited under §164.502(a)(5)(i), a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or

(ii) A health care provider or health plan to obtain or provide reimbursement for the provision of health care; and

(2) The activities in paragraph (1) of this definition relate to the individual to whom health care is provided and include, but are not limited to:

(i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;

(ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics;

(iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing;

(iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;

(v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and

(vi) Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement:

(A) Name and address;

(B) Date of birth;

(C) Social security number;

(D) Payment history;

(E) Account number; and

(F) Name and address of the health care provider and/or health plan.

Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

Public health authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.

Treatment means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 74 FR 42769, Aug. 24, 2009; 78 FR 5695, Jan. 25, 2013]

§164.502 Uses and disclosures of protected health information: General rules.

(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

(1) Covered entities: Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows:

(i) To the individual;

(ii) For treatment, payment, or health care operations, as permitted by and in compliance with §164.506;

(iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §§164.502(b), 164.514(d), and 164.530(c) with respect to such otherwise permitted or required use or disclosure;

(iv) Except for uses and disclosures prohibited under §164.502(a)(5)(i), pursuant to and in compliance with a valid authorization under §164.508;

(v) Pursuant to an agreement under, or as otherwise permitted by, §164.510; and

(vi) As permitted by and in compliance with this section, §164.512, §164.514(e), (f), or (g).

(2) Covered entities: Required disclosures. A covered entity is required to disclose protected health information:

(i) To an individual, when requested under, and required by §164.524 or §164.528; and

(ii) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the covered entity's compliance with this subchapter.

(3) Business associates: Permitted uses and disclosures. A business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement pursuant to §164.504(e) or as required by law. The business associate may not use or disclose protected health information in a manner that would violate the requirements of this subpart, if done by the covered entity, except for the purposes specified under §164.504(e)(2)(i)(A) or (B) if such uses or disclosures are permitted by its contract or other arrangement.

(4) Business associates: Required uses and disclosures. A business associate is required to disclose protected health information:

(i) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the business associate's compliance with this subchapter.

(ii) To the covered entity, individual, or individual's designee, as necessary to satisfy a covered entity's obligations under §164.524(c)(2)(ii) and (3)(ii) with respect to an individual's request for an electronic copy of protected health information.

(5) Prohibited uses and disclosures.

(i) Use and disclosure of genetic information for underwriting purposes: Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan:

(A) Except as provided in paragraph (a)(5)(i)(B) of this section:

(1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and

(4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

(B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.

(ii) Sale of protected health information:

(A) Except pursuant to and in compliance with §164.508(a)(4), a covered entity or business associate may not sell protected health information.

(B) For purposes of this paragraph, sale of protected health information means:

(1) Except as provided in paragraph (a)(5)(ii)(B)(2) of this section, a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.

(2) Sale of protected health information does not include a disclosure of protected health information:

(i) For public health purposes pursuant to §164.512(b) or §164.514(e);

(ii) For research purposes pursuant to §164.512(i) or §164.514(e), where the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes;

(iii) For treatment and payment purposes pursuant to §164.506(a);

(iv) For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence as described in paragraph (6)(iv) of the definition of health care operations and pursuant to §164.506(a);

(v) To or by a business associate for activities that the business associate undertakes on behalf of a covered entity, or on behalf of a business associate in the case of a subcontractor, pursuant to §§164.502(e) and 164.504(e), and the only remuneration provided is by the covered entity to the business associate, or by the business associate to the subcontractor, if applicable, for the performance of such activities;

(vi) To an individual, when requested under §164.524 or §164.528;

(vii) Required by law as permitted under §164.512(a); and

(viii) For any other purpose permitted by and in accordance with the applicable requirements of this subpart, where the only remuneration received by the covered entity or business associate is a reasonable, cost-based fee to cover the cost to prepare and transmit the protected health information for such purpose or a fee otherwise expressly permitted by other law.

(b) Standard: Minimum necessary- Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

(2) Minimum necessary does not apply. This requirement does not apply to:

(i) Disclosures to or requests by a health care provider for treatment;

(ii) Uses or disclosures made to the individual, as permitted under paragraph (a)(1)(i) of this section or as required by paragraph (a)(2)(i) of this section;

(iii) Uses or disclosures made pursuant to an authorization under §164.508;

(iv) Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter;

(v) Uses or disclosures that are required by law, as described by §164.512(a); and

(vi) Uses or disclosures that are required for compliance with applicable requirements of this subchapter.

(c) Standard: Uses and disclosures of protected health information subject to an agreed upon restriction. A covered entity that has agreed to a restriction pursuant to §164.522(a)(1) may not use or disclose the protected health information covered by the restriction in violation of such restriction, except as otherwise provided in §164.522(a).

(d) Standard: Uses and disclosures of de-identified protected health information-(1) Uses and disclosures to create de-identified information. A covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.

(2) Uses and disclosures of de-identified information. Health information that meets the standard and implementation specifications for de-identification under §164.514(a) and (b) is considered not to be individually identifiable health information, i.e., de-identified. The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of §164.514, provided that:

(i) Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information; and

(ii) If de-identified information is re-identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.

(e)(1) Standard: Disclosures to business associates. (i) A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(ii) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with §164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(2) Implementation specification: Documentation. The satisfactory assurances required by paragraph (e)(1) of this section must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of §164.504(e).

(f) Standard: Deceased individuals. A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.

(g)(1) Standard: Personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.

(2) Implementation specification: Adults and emancipated minors. If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

(3)(i) Implementation specification: Unemancipated minors. If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if:

(A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative;

(B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service; or

(C) A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.

(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section:

(A) If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access in accordance with §164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis;

(B) If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with §164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and

(C) Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under §164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment.

(4) Implementation specification: Deceased individuals. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

(5) Implementation specification: Abuse, neglect, endangerment situations. Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative of an individual if:

(i) The covered entity has a reasonable belief that:

(A) The individual has been or may be subjected to domestic violence, abuse, or neglect by such person; or

(B) Treating such person as the personal representative could endanger the individual; and

(ii) The covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative.

(h) Standard: Confidential communications. A covered health care provider or health plan must comply with the applicable requirements of §164.522(b) in communicating protected health information.

(i) Standard: Uses and disclosures consistent with notice. A covered entity that is required by §164.520 to have a notice may not use or disclose protected health information in a manner inconsistent with such notice. A covered entity that is required by §164.520(b)(1)(iii) to include a specific statement in its notice if it intends to engage in an activity listed in §164.520(b)(1)(iii)(A)-(C), may not use or disclose protected health information for such activities, unless the required statement is included in the notice.

(j) Standard: Disclosures by whistleblowers and workforce member crime victims-(1) Disclosures by whistleblowers. A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce or a business associate discloses protected health information, provided that:

(i) The workforce member or business associate believes in good faith that the covered entity has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by the covered entity potentially endangers one or more patients, workers, or the public; and

(ii) The disclosure is to:

(A) A health oversight agency or public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of the covered entity or to an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by the covered entity; or

(B) An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct described in paragraph (j)(1)(i) of this section.

(2) Disclosures by workforce members who are victims of a crime. A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce who is the victim of a criminal act discloses protected health information to a law enforcement official, provided that:

(i) The protected health information disclosed is about the suspected perpetrator of the criminal act; and

(ii) The protected health information disclosed is limited to the information listed in §164.512(f)(2)(i).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53267, Aug. 14, 2002; 78 FR 5696, Jan. 25, 2013]

§164.504 Uses and disclosures: Organizational requirements.

(a) Definitions. As used in this section:

Plan administration functions means administration functions performed by the plan sponsor of a group health plan on behalf of the group health plan and excludes functions performed by the plan sponsor in connection with any other benefit or benefit plan of the plan sponsor.

Summary health information means information, that may be individually identifiable health information, and:

(1) That summarizes the claims history, claims expenses, or type of claims experienced by individuals for whom a plan sponsor has provided health benefits under a group health plan; and

(2) From which the information described at §164.514(b)(2)(i) has been deleted, except that the geographic information described in §164.514(b)(2)(i)(B) need only be aggregated to the level of a five digit zip code.

(b)-(d) [Reserved]

(e)(1) Standard: Business associate contracts. (i) The contract or other arrangement required by §164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable.

(ii) A covered entity is not in compliance with the standards in §164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate's obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

(iii) A business associate is not in compliance with the standards in §164.502(e) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor's obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

(2) Implementation specifications: Business associate contracts. A contract between the covered entity and a business associate must:

(i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that:

(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and

(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.

(ii) Provide that the business associate will:

(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law;

(B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;

(C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by §164.410;

(D) In accordance with §164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;

(E) Make available protected health information in accordance with §164.524;

(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with §164.526;

(G) Make available the information required to provide an accounting of disclosures in accordance with §164.528;

(H) To the extent the business associate is to carry out a covered entity's obligation under this subpart, comply with the requirements of this subpart that apply to the covered entity in the performance of such obligation.

(I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity's compliance with this subpart; and

(J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

(iii) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.

(3) Implementation specifications: Other arrangements. (i) If a covered entity and its business associate are both governmental entities:

(A) The covered entity may comply with this paragraph and §164.314(a)(1), if applicable, by entering into a memorandum of understanding with the business associate that contains terms that accomplish the objectives of paragraph (e)(2) of this section and §164.314(a)(2), if applicable.

(B) The covered entity may comply with this paragraph and §164.314(a)(1), if applicable, if other law (including regulations adopted by the covered entity or its business associate) contains requirements applicable to the business associate that accomplish the objectives of paragraph (e)(2) of this section and §164.314(a)(2), if applicable.

(ii) If a business associate is required by law to perform a function or activity on behalf of a covered entity or to provide a service described in the definition of business associate in §160.103 of this subchapter to a covered entity, such covered entity may disclose protected health information to the business associate to the extent necessary to comply with the legal mandate without meeting the requirements of this paragraph and §164.314(a)(1), if applicable, provided that the covered entity attempts in good faith to obtain satisfactory assurances as required by paragraph (e)(2) of this section and §164.314(a)(1), if applicable, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.

(iii) The covered entity may omit from its other arrangements the termination authorization required by paragraph (e)(2)(iii) of this section, if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate.

(iv) A covered entity may comply with this paragraph and §164.314(a)(1) if the covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with §§164.514(e)(4) and 164.314(a)(1), if applicable.

(4) Implementation specifications: Other requirements for contracts and other arrangements. (i) The contract or other arrangement between the covered entity and the business associate may permit the business associate to use the protected health information received by the business associate in its capacity as a business associate to the covered entity, if necessary:

(A) For the proper management and administration of the business associate; or

(B) To carry out the legal responsibilities of the business associate.

(ii) The contract or other arrangement between the covered entity and the business associate may permit the business associate to disclose the protected health information received by the business associate in its capacity as a business associate for the purposes described in paragraph (e)(4)(i) of this section, if:

(A) The disclosure is required by law; or

(B)(1) The business associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person; and

(2) The person notifies the business associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(5) Implementation specifications: Business associate contracts with subcontractors. The requirements of §164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by §164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.

(f)(1) Standard: Requirements for group health plans. (i) Except as provided under paragraph (f)(1)(ii) or (iii) of this section or as otherwise authorized under §164.508, a group health plan, in order to disclose protected health information to the plan sponsor or to provide for or permit the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO with respect to the group health plan, must ensure that the plan documents restrict uses and disclosures of such information by the plan sponsor consistent with the requirements of this subpart.

(ii) Except as prohibited by §164.502(a)(5)(i), the group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose summary health information to the plan sponsor, if the plan sponsor requests the summary health information for purposes of:

(A) Obtaining premium bids from health plans for providing health insurance coverage under the group health plan; or

(B) Modifying, amending, or terminating the group health plan.

(iii) The group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose to the plan sponsor information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.

(2) Implementation specifications: Requirements for plan documents. The plan documents of the group health plan must be amended to incorporate provisions to:

(i) Establish the permitted and required uses and disclosures of such information by the plan sponsor, provided that such permitted and required uses and disclosures may not be inconsistent with this subpart.

(ii) Provide that the group health plan will disclose protected health information to the plan sponsor only upon receipt of a certification by the plan sponsor that the plan documents have been amended to incorporate the following provisions and that the plan sponsor agrees to:

(A) Not use or further disclose the information other than as permitted or required by the plan documents or as required by law;

(B) Ensure that any agents to whom it provides protected health information received from the group health plan agree to the same restrictions and conditions that apply to the plan sponsor with respect to such information;

(C) Not use or disclose the information for employment-related actions and decisions or in connection with any other benefit or employee benefit plan of the plan sponsor;

(D) Report to the group health plan any use or disclosure of the information that is inconsistent with the uses or disclosures provided for of which it becomes aware;

(E) Make available protected health information in accordance with §164.524;

(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with §164.526;

(G) Make available the information required to provide an accounting of disclosures in accordance with §164.528;

(H) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from the group health plan available to the Secretary for purposes of determining compliance by the group health plan with this subpart;

(I) If feasible, return or destroy all protected health information received from the group health plan that the sponsor still maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible; and

(J) Ensure that the adequate separation required in paragraph (f)(2)(iii) of this section is established.

(iii) Provide for adequate separation between the group health plan and the plan sponsor. The plan documents must:

(A) Describe those employees or classes of employees or other persons under the control of the plan sponsor to be given access to the protected health information to be disclosed, provided that any employee or person who receives protected health information relating to payment under, health care operations of, or other matters pertaining to the group health plan in the ordinary course of business must be included in such description;

(B) Restrict the access to and use by such employees and other persons described in paragraph (f)(2)(iii)(A) of this section to the plan administration functions that the plan sponsor performs for the group health plan; and

(C) Provide an effective mechanism for resolving any issues of noncompliance by persons described in paragraph (f)(2)(iii)(A) of this section with the plan document provisions required by this paragraph.

(3) Implementation specifications: Uses and disclosures. A group health plan may:

(i) Disclose protected health information to a plan sponsor to carry out plan administration functions that the plan sponsor performs only consistent with the provisions of paragraph (f)(2) of this section;

(ii) Not permit a health insurance issuer or HMO with respect to the group health plan to disclose protected health information to the plan sponsor except as permitted by this paragraph;

(iii) Not disclose and may not permit a health insurance issuer or HMO to disclose protected health information to a plan sponsor as otherwise permitted by this paragraph unless a statement required by §164.520(b)(1)(iii)(C) is included in the appropriate notice; and (iv) Not disclose protected health information to the plan sponsor for the purpose of employment-related actions or decisions or in connection with any other benefit or employee benefit plan of the plan sponsor.

(g) Standard: Requirements for a covered entity with multiple covered functions. (1) A covered entity that performs multiple covered functions that would make the entity any combination of a health plan, a covered health care provider, and a health care clearinghouse, must comply with the standards, requirements, and implementation specifications of this subpart, as applicable to the health plan, health care provider, or health care clearinghouse covered functions performed.

(2) A covered entity that performs multiple covered functions may use or disclose the protected health information of individuals who receive the covered entity's health plan or health care provider services, but not both, only for purposes related to the appropriate function being performed.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53267, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5697, Jan. 25, 2013]

§164.506 Uses and disclosures to carry out treatment, payment, or health care operations.

(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under §164.508(a)(2) through (4) or that are prohibited under §164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.

(b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.

(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under §164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.

(c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.

(2) A covered entity may disclose protected health information for treatment activities of a health care provider.

(3) A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information.

(4) A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is:

(i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or

(ii) For the purpose of health care fraud and abuse detection or compliance.

(5) A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement.

[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5698, Jan. 25, 2013]

§164.508 Uses and disclosures for which an authorization is required.

(a) Standard: Authorizations for uses and disclosures-(1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.

(2) Authorization required: Psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in §164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:

(i) To carry out the following treatment, payment, or health care operations:

(A) Use by the originator of the psychotherapy notes for treatment;

(B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or

(C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and

(ii) A use or disclosure that is required by §164.502(a)(2)(ii) or permitted by §164.512(a); §164.512(d) with respect to the oversight of the originator of the psychotherapy notes; §164.512(g)(1); or §164.512(j)(1)(i).

(3) Authorization required: Marketing. (i) Notwithstanding any provision of this subpart, other than the transition provisions in §164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:

(A) A face-to-face communication made by a covered entity to an individual; or

(B) A promotional gift of nominal value provided by the covered entity.

(ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at §164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.

(4) Authorization required: Sale of protected health information. (i) Notwithstanding any provision of this subpart, other than the transition provisions in §164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in §164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.

(b) Implementation specifications: General requirements-(1) Valid authorizations. (i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable.

(ii) A valid authorization may contain elements or information in addition to the elements required by this section, provided that such additional elements or information are not inconsistent with the elements required by this section.

(2) Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects:

(i) The expiration date has passed or the expiration event is known by the covered entity to have occurred;

(ii) The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable;

(iii) The authorization is known by the covered entity to have been revoked;

(iv) The authorization violates paragraph (b)(3) or (4) of this section, if applicable;

(v) Any material information in the authorization is known by the covered entity to be false.

(3) Compound authorizations. An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except as follows:

(i) An authorization for the use or disclosure of protected health information for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of protected health information for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. Where a covered health care provider has conditioned the provision of research-related treatment on the provision of one of the authorizations, as permitted under paragraph (b)(4)(i) of this section, any compound authorization created under this paragraph must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the research activities described in the unconditioned authorization.

(ii) An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.

(iii) An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other such authorization under this section, except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits under paragraph (b)(4) of this section on the provision of one of the authorizations. The prohibition in this paragraph on combining authorizations where one authorization conditions the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits under paragraph (b)(4) of this section does not apply to a compound authorization created in accordance with paragraph (b)(3)(i) of this section.

(4) Prohibition on conditioning of authorizations. A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:

(i) A covered health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section;

(ii) A health plan may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by the health plan prior to an individual's enrollment in the health plan, if:

(A) The authorization sought is for the health plan's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations; and

(B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and

(iii) A covered entity may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.

(5) Revocation of authorizations. An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that:

(i) The covered entity has taken action in reliance thereon; or

(ii) If the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

(6) Documentation. A covered entity must document and retain any signed authorization under this section as required by §164.530(j).

(c) Implementation specifications: Core elements and requirements-(1) Core elements. A valid authorization under this section must contain at least the following elements:

(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.

(iv) A description of each purpose of the requested use or disclosure. The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.

(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement "end of the research study," "none," or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.

(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.

(2) Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:

(i) The individual's right to revoke the authorization in writing, and either:

(A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or

(B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by §164.520, a reference to the covered entity's notice.

(ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either:

(A) The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations in paragraph (b)(4) of this section applies; or

(B) The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.

(iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart.

(3) Plain language requirement. The authorization must be written in plain language.

(4) Copy to the individual. If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization.

[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5699, Jan. 25, 2013]

§164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object.

A covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section. The covered entity may orally inform the individual of and obtain the individual's oral agreement or objection to a use or disclosure permitted by this section.

(a) Standard: Use and disclosure for facility directories-(1) Permitted uses and disclosure. Except when an objection is expressed in accordance with paragraphs (a)(2) or (3) of this section, a covered health care provider may:

(i) Use the following protected health information to maintain a directory of individuals in its facility:

(A) The individual's name;

(B) The individual's location in the covered health care provider's facility;

(C) The individual's condition described in general terms that does not communicate specific medical information about the individual; and

(D) The individual's religious affiliation; and

(ii) Use or disclose for directory purposes such information:

(A) To members of the clergy; or

(B) Except for religious affiliation, to other persons who ask for the individual by name.

(2) Opportunity to object. A covered health care provider must inform an individual of the protected health information that it may include in a directory and the persons to whom it may disclose such information (including disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict or prohibit some or all of the uses or disclosures permitted by paragraph (a)(1) of this section.

(3) Emergency circumstances. (i) If the opportunity to object to uses or disclosures required by paragraph (a)(2) of this section cannot practicably be provided because of the individual's incapacity or an emergency treatment circumstance, a covered health care provider may use or disclose some or all of the protected health information permitted by paragraph (a)(1) of this section for the facility's directory, if such disclosure is:

(A) Consistent with a prior expressed preference of the individual, if any, that is known to the covered health care provider; and

(B) In the individual's best interest as determined by the covered health care provider, in the exercise of professional judgment.

(ii) The covered health care provider must inform the individual and provide an opportunity to object to uses or disclosures for directory purposes as required by paragraph (a)(2) of this section when it becomes practicable to do so.

(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes-(1) Permitted uses and disclosures. (i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care.

(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual's location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.

(2) Uses and disclosures with the individual present. If the individual is present for, or otherwise available prior to, a use or disclosure permitted by paragraph (b)(1) of this section and has the capacity to make health care decisions, the covered entity may use or disclose the protected health information if it:

(i) Obtains the individual's agreement;

(ii) Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or

(iii) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.

(3) Limited uses and disclosures when the individual is not present. If the individual is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual's incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person's involvement with the individual's care or payment related to the individual's health care or needed for notification purposes. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual's best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.

(4) Uses and disclosures for disaster relief purposes. A covered entity may use or disclose protected health information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities the uses or disclosures permitted by paragraph (b)(1)(ii) of this section. The requirements in paragraphs (b)(2), (b)(3), or (b)(5) of this section apply to such uses and disclosures to the extent that the covered entity, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.

(5) Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual's care or payment for health care prior to the individual's death, protected health information of the individual that is relevant to such person's involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5699, Jan. 25, 2013]

§164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required.

A covered entity may use or disclose protected health information without the written authorization of the individual, as described in §164.508, or the opportunity for the individual to agree or object as described in §164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity's information and the individual's agreement may be given orally.

(a) Standard: Uses and disclosures required by law. (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

(2) A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law.

(b) Standard: Uses and disclosures for public health activities-(1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for the public health activities and purposes described in this paragraph to:

(i) A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority;

(ii) A public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;

(iii) A person subject to the jurisdiction of the Food and Drug Administration (FDA) with respect to an FDA-regulated product or activity for which that person has responsibility, for the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity. Such purposes include:

(A) To collect or report adverse events (or similar activities with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations;

(B) To track FDA-regulated products;

(C) To enable product recalls, repairs, or replacement, or lookback (including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback); or

(D) To conduct post marketing surveillance;

(iv) A person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation; or

(v) An employer, about an individual who is a member of the workforce of the employer, if:

(A) The covered entity is a covered health care provider who provides health care to the individual at the request of the employer:

(1) To conduct an evaluation relating to medical surveillance of the workplace; or

(2) To evaluate whether the individual has a work-related illness or injury;

(B) The protected health information that is disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;

(C) The employer needs such findings in order to comply with its obligations, under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and

(D) The covered health care provider provides written notice to the individual that protected health information relating to the medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer:

(1) By giving a copy of the notice to the individual at the time the health care is provided; or

(2) If the health care is provided on the work site of the employer, by posting the notice in a prominent place at the location where the health care is provided.

(vi) A school, about an individual who is a student or prospective student of the school, if:

(A) The protected health information that is disclosed is limited to proof of immunization;

(B) The school is required by State or other law to have such proof of immunization prior to admitting the individual; and

(C) The covered entity obtains and documents the agreement to the disclosure from either:

(1) A parent, guardian, or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or

(2) The individual, if the individual is an adult or emancipated minor.

(2) Permitted uses. If the covered entity also is a public health authority, the covered entity is permitted to use protected health information in all cases in which it is permitted to disclose such information for public health activities under paragraph (b)(1) of this section.

(c) Standard: Disclosures about victims of abuse, neglect or domestic violence-(1) Permitted disclosures. Except for reports of child abuse or neglect permitted by paragraph (b)(1)(ii) of this section, a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence:

(i) To the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law;

(ii) If the individual agrees to the disclosure; or

(iii) To the extent the disclosure is expressly authorized by statute or regulation and:

(A) The covered entity, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or

(B) If the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.

(2) Informing the individual. A covered entity that makes a disclosure permitted by paragraph (c)(1) of this section must promptly inform the individual that such a report has been or will be made, except if:

(i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or

(ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.

(d) Standard: Uses and disclosures for health oversight activities-(1) Permitted disclosures. A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:

(i) The health care system;

(ii) Government benefit programs for which health information is relevant to beneficiary eligibility;

(iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or

(iv) Entities subject to civil rights laws for which health information is necessary for determining compliance.

(2) Exception to health oversight activities. For the purpose of the disclosures permitted by paragraph (d)(1) of this section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to:

(i) The receipt of health care;

(ii) A claim for public benefits related to health; or

(iii) Qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services.

(3) Joint activities or investigations. Nothwithstanding paragraph (d)(2) of this section, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of paragraph (d) of this section.

(4) Permitted uses. If a covered entity also is a health oversight agency, the covered entity may use protected health information for health oversight activities as permitted by paragraph (d) of this section.

(e) Standard: Disclosures for judicial and administrative proceedings-(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:

(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or

(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:

(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or

(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.

(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

(A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);

(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and

(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and:

(1) No objections were filed; or

(2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.

(iv) For the purposes of paragraph (e)(1)(ii)(B) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or

(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.

(v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and

(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

(vi) Notwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(v) of this section.

(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information.

(f) Standard: Disclosures for law enforcement purposes. A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable.

(1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information:

(i) As required by law including laws that require the reporting of certain types of wounds or other physical injuries, except for laws subject to paragraph (b)(1)(ii) or (c)(1)(i) of this section; or

(ii) In compliance with and as limited by the relevant requirements of:

(A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer;

(B) A grand jury subpoena; or

(C) An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that:

(1) The information sought is relevant and material to a legitimate law enforcement inquiry;

(2) The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and

(3) De-identified information could not reasonably be used.

(2) Permitted disclosures: Limited information for identification and location purposes. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that:

(i) The covered entity may disclose only the following information:

(A) Name and address;

(B) Date and place of birth;

(C) Social security number;

(D) ABO blood type and rh factor;

(E) Type of injury;

(F) Date and time of treatment;

(G) Date and time of death, if applicable; and

(H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.

(ii) Except as permitted by paragraph (f)(2)(i) of this section, the covered entity may not disclose for the purposes of identification or location under paragraph (f)(2) of this section any protected health information related to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue.

(3) Permitted disclosure: Victims of a crime. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime, other than disclosures that are subject to paragraph (b) or (c) of this section, if:

(i) The individual agrees to the disclosure; or

(ii) The covered entity is unable to obtain the individual's agreement because of incapacity or other emergency circumstance, provided that:

(A) The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim;

(B) The law enforcement official represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and

(C) The disclosure is in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.

(4) Permitted disclosure: Decedents. A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicion that such death may have resulted from criminal conduct.

(5) Permitted disclosure: Crime on premises. A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.

(6) Permitted disclosure: Reporting crime in emergencies. (i) A covered health care provider providing emergency health care in response to a medical emergency, other than such emergency on the premises of the covered health care provider, may disclose protected health information to a law enforcement official if such disclosure appears necessary to alert law enforcement to:

(A) The commission and nature of a crime;

(B) The location of such crime or of the victim(s) of such crime; and

(C) The identity, description, and location of the perpetrator of such crime.

(ii) If a covered health care provider believes that the medical emergency described in paragraph (f)(6)(i) of this section is the result of abuse, neglect, or domestic violence of the individual in need of emergency health care, paragraph (f)(6)(i) of this section does not apply and any disclosure to a law enforcement official for law enforcement purposes is subject to paragraph (c) of this section.

(g) Standard: Uses and disclosures about decedents-(1) Coroners and medical examiners. A covered entity may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. A covered entity that also performs the duties of a coroner or medical examiner may use protected health information for the purposes described in this paragraph.

(2) Funeral directors. A covered entity may disclose protected health information to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent. If necessary for funeral directors to carry out their duties, the covered entity may disclose the protected health information prior to, and in reasonable anticipation of, the individual's death.

(h) Standard: Uses and disclosures for cadaveric organ, eye or tissue donation purposes. A covered entity may use or disclose protected health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

(i) Standard: Uses and disclosures for research purposes-(1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for research, regardless of the source of funding of the research, provided that:

(i) Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by §164.508 for use or disclosure of protected health information has been approved by either:

(A) An Institutional Review Board (IRB), established in accordance with 7 CFR lc.107, 10 CFR 745.107, 14 CFR 1230.107, 15 CFR 27.107, 16 CFR 1028.107, 21 CFR 56.107, 22 CFR 225.107, 24 CFR 60.107, 28 CFR 46.107, 32 CFR 219.107, 34 CFR 97.107, 38 CFR 16.107, 40 CFR 26.107, 45 CFR 46.107, 45 CFR 690.107, or 49 CFR 11.107; or

(B) A privacy board that:

(1) Has members with varying backgrounds and appropriate professional competency as necessary to review the effect of the research protocol on the individual's privacy rights and related interests;

(2) Includes at least one member who is not affiliated with the covered entity, not affiliated with any entity conducting or sponsoring the research, and not related to any person who is affiliated with any of such entities; and

(3) Does not have any member participating in a review of any project in which the member has a conflict of interest.

(ii) Reviews preparatory to research. The covered entity obtains from the researcher representations that:

(A) Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research;

(B) No protected health information is to be removed from the covered entity by the researcher in the course of the review; and

(C) The protected health information for which use or access is sought is necessary for the research purposes.

(iii) Research on decedent's information. The covered entity obtains from the researcher:

(A) Representation that the use or disclosure sought is solely for research on the protected health information of decedents;

(B) Documentation, at the request of the covered entity, of the death of such individuals; and

(C) Representation that the protected health information for which use or disclosure is sought is necessary for the research purposes.

(2) Documentation of waiver approval. For a use or disclosure to be permitted based on documentation of approval of an alteration or waiver, under paragraph (i)(1)(i) of this section, the documentation must include all of the following:

(i) Identification and date of action. A statement identifying the IRB or privacy board and the date on which the alteration or waiver of authorization was approved;

(ii) Waiver criteria. A statement that the IRB or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:

(A) The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements;

(1) An adequate plan to protect the identifiers from improper use and disclosure;

(2) An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and

(3) Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

(B) The research could not practicably be conducted without the waiver or alteration; and

(C) The research could not practicably be conducted without access to and use of the protected health information.

(iii) Protected health information needed. A brief description of the protected health information for which use or access has been determined to be necessary by the institutional review board or privacy board, pursuant to paragraph (i)(2)(ii)(C) of this section;

(iv) Review and approval procedures. A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures, as follows:

(A) An IRB must follow the requirements of the Common Rule, including the normal review procedures (7 CFR 1c.108(b), 10 CFR 745.108(b), 14 CFR 1230.108(b), 15 CFR 27.108(b), 16 CFR 1028.108(b), 21 CFR 56.108(b), 22 CFR 225.108(b), 24 CFR 60.108(b), 28 CFR 46.108(b), 32 CFR 219.108(b), 34 CFR 97.108(b), 38 CFR 16.108(b), 40 CFR 26.108(b), 45 CFR 46.108(b), 45 CFR 690.108(b), or 49 CFR 11.108(b)) or the expedited review procedures (7 CFR 1c.110, 10 CFR 745.110, 14 CFR 1230.110, 15 CFR 27.110, 16 CFR 1028.110, 21 CFR 56.110, 22 CFR 225.110, 24 CFR 60.110, 28 CFR 46.110, 32 CFR 219.110, 34 CFR 97.110, 38 CFR 16.110, 40 CFR 26.110, 45 CFR 46.110, 45 CFR 690.110, or 49 CFR 11.110);

(B) A privacy board must review the proposed research at convened meetings at which a majority of the privacy board members are present, including at least one member who satisfies the criterion stated in paragraph (i)(1)(i)(B)(2) of this section, and the alteration or waiver of authorization must be approved by the majority of the privacy board members present at the meeting, unless the privacy board elects to use an expedited review procedure in accordance with paragraph (i)(2)(iv)(C) of this section;

(C) A privacy board may use an expedited review procedure if the research involves no more than minimal risk to the privacy of the individuals who are the subject of the protected health information for which use or disclosure is being sought. If the privacy board elects to use an expedited review procedure, the review and approval of the alteration or waiver of authorization may be carried out by the chair of the privacy board, or by one or more members of the privacy board as designated by the chair; and

(v) Required signature. The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the IRB or the privacy board, as applicable.

(j) Standard: Uses and disclosures to avert a serious threat to health or safety-(1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or

(ii) Is necessary for law enforcement authorities to identify or apprehend an individual:

(A) Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or

(B) Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody, as those terms are defined in §164.501.

(2) Use or disclosure not permitted. A use or disclosure pursuant to paragraph (j)(1)(ii)(A) of this section may not be made if the information described in paragraph (j)(1)(ii)(A) of this section is learned by the covered entity:

(i) In the course of treatment to affect the propensity to commit the criminal conduct that is the basis for the disclosure under paragraph (j)(1)(ii)(A) of this section, or counseling or therapy; or

(ii) Through a request by the individual to initiate or to be referred for the treatment, counseling, or therapy described in paragraph (j)(2)(i) of this section.

(3) Limit on information that may be disclosed. A disclosure made pursuant to paragraph (j)(1)(ii)(A) of this section shall contain only the statement described in paragraph (j)(1)(ii)(A) of this section and the protected health information described in paragraph (f)(2)(i) of this section.

(4) Presumption of good faith belief. A covered entity that uses or discloses protected health information pursuant to paragraph (j)(1) of this section is presumed to have acted in good faith with regard to a belief described in paragraph (j)(1)(i) or (ii) of this section, if the belief is based upon the covered entity's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority.

(k) Standard: Uses and disclosures for specialized government functions-(1) Military and veterans activities-(i) Armed Forces personnel. A covered entity may use and disclose the protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the appropriate military authority has published by notice in the Federal Register the following information:

(A) Appropriate military command authorities; and

(B) The purposes for which the protected health information may be used or disclosed.

(ii) Separation or discharge from military service. A covered entity that is a component of the Departments of Defense or Homeland Security may disclose to the Department of Veterans Affairs (DVA) the protected health information of an individual who is a member of the Armed Forces upon the separation or discharge of the individual from military service for the purpose of a determination by DVA of the individual's eligibility for or entitlement to benefits under laws administered by the Secretary of Veterans Affairs.

(iii) Veterans. A covered entity that is a component of the Department of Veterans Affairs may use and disclose protected health information to components of the Department that determine eligibility for or entitlement to, or that provide, benefits under the laws administered by the Secretary of Veterans Affairs.

(iv) Foreign military personnel. A covered entity may use and disclose the protected health information of individuals who are foreign military personnel to their appropriate foreign military authority for the same purposes for which uses and disclosures are permitted for Armed Forces personnel under the notice published in the Federal Register pursuant to paragraph (k)(1)(i) of this section.

(2) National security and intelligence activities. A covered entity may disclose protected health information to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act (50 U.S.C. 401, et seq.) and implementing authority (e.g., Executive Order 12333).

(3) Protective services for the President and others. A covered entity may disclose protected health information to authorized Federal officials for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056 or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by 18 U.S.C. 871 and 879.

(4) Medical suitability determinations. A covered entity that is a component of the Department of State may use protected health information to make medical suitability determinations and may disclose whether or not the individual was determined to be medically suitable to the officials in the Department of State who need access to such information for the following purposes:

(i) For the purpose of a required security clearance conducted pursuant to Executive Orders 10450 and 12968;

(ii) As necessary to determine worldwide availability or availability for mandatory service abroad under sections 101(a)(4) and 504 of the Foreign Service Act; or

(iii) For a family to accompany a Foreign Service member abroad, consistent with section 101(b)(5) and 904 of the Foreign Service Act.

(5) Correctional institutions and other law enforcement custodial situations-(i) Permitted disclosures. A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for:

(A) The provision of health care to such individuals;

(B) The health and safety of such individual or other inmates;

(C) The health and safety of the officers or employees of or others at the correctional institution;

(D) The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another;

(E) Law enforcement on the premises of the correctional institution; or

(F) The administration and maintenance of the safety, security, and good order of the correctional institution.

(ii) Permitted uses. A covered entity that is a correctional institution may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed.

(iii) No application after release. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.

(6) Covered entities that are government programs providing public benefits. (i) A health plan that is a government program providing public benefits may disclose protected health information relating to eligibility for or enrollment in the health plan to another agency administering a government program providing public benefits if the sharing of eligibility or enrollment information among such government agencies or the maintenance of such information in a single or combined data system accessible to all such government agencies is required or expressly authorized by statute or regulation.

(ii) A covered entity that is a government agency administering a government program providing public benefits may disclose protected health information relating to the program to another covered entity that is a government agency administering a government program providing public benefits if the programs serve the same or similar populations and the disclosure of protected health information is necessary to coordinate the covered functions of such programs or to improve administration and management relating to the covered functions of such programs.

(7) National Instant Criminal Background Check System. A covered entity may use or disclose protected health information for purposes of reporting to the National Instant Criminal Background Check System the identity of an individual who is prohibited from possessing a firearm under 18 U.S.C. 922(g)(4), provided the covered entity:

(i) Is a State agency or other entity that is, or contains an entity that is:

(A) An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; or

(B) A court, board, commission, or other lawful authority that makes the commitment or adjudication that causes an individual to become subject to 18 U.S.C. 922(g)(4); and

(ii) Discloses the information only to:

(A) The National Instant Criminal Background Check System; or

(B) An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; and

(iii)(A) Discloses only the limited demographic and certain other information needed for purposes of reporting to the National Instant Criminal Background Check System; and

(B) Does not disclose diagnostic or clinical information for such purposes.

(l) Standard: Disclosures for workers' compensation. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5699, Jan. 25, 2013; 78 FR 34266, June 7, 2013; 81 FR 395, Jan. 6, 2016]

§164.514 Other requirements relating to uses and disclosures of protected health information.

(a) Standard: De-identification of protected health information. Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.

(b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if:

(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and

(ii) Documents the methods and results of the analysis that justify such determination; or

(2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

(A) Names;

(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

(D) Telephone numbers;

(E) Fax numbers;

(F) Electronic mail addresses;

(G) Social security numbers;

(H) Medical record numbers;

(I) Health plan beneficiary numbers;

(J) Account numbers;

(K) Certificate/license numbers;

(L) Vehicle identifiers and serial numbers, including license plate numbers;

(M) Device identifiers and serial numbers;

(N) Web Universal Resource Locators (URLs);

(O) Internet Protocol (IP) address numbers;

(P) Biometric identifiers, including finger and voice prints;

(Q) Full face photographic images and any comparable images; and

(R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and

(ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.

(c) Implementation specifications: Re-identification. A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that:

(1) Derivation. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and

(2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(d)(1) Standard: minimum necessary requirements. In order to comply with §164.502(b) and this section, a covered entity must meet the requirements of paragraphs (d)(2) through (d)(5) of this section with respect to a request for, or the use and disclosure of, protected health information.

(2) Implementation specifications: Minimum necessary uses of protected health information. (i) A covered entity must identify:

(A) Those persons or classes of persons, as appropriate, in its workforce who need access to protected health information to carry out their duties; and

(B) For each such person or class of persons, the category or categories of protected health information to which access is needed and any conditions appropriate to such access.

(ii) A covered entity must make reasonable efforts to limit the access of such persons or classes identified in paragraph (d)(2)(i)(A) of this section to protected health information consistent with paragraph (d)(2)(i)(B) of this section.

(3) Implementation specification: Minimum necessary disclosures of protected health information. (i) For any type of disclosure that it makes on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information disclosed to the amount reasonably necessary to achieve the purpose of the disclosure.

(ii) For all other disclosures, a covered entity must:

(A) Develop criteria designed to limit the protected health information disclosed to the information reasonably necessary to accomplish the purpose for which disclosure is sought; and

(B) Review requests for disclosure on an individual basis in accordance with such criteria.

(iii) A covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when:

(A) Making disclosures to public officials that are permitted under §164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s);

(B) The information is requested by another covered entity;

(C) The information is requested by a professional who is a member of its workforce or is a business associate of the covered entity for the purpose of providing professional services to the covered entity, if the professional represents that the information requested is the minimum necessary for the stated purpose(s); or

(D) Documentation or representations that comply with the applicable requirements of §164.512(i) have been provided by a person requesting the information for research purposes.

(4) Implementation specifications: Minimum necessary requests for protected health information. (i) A covered entity must limit any request for protected health information to that which is reasonably necessary to accomplish the purpose for which the request is made, when requesting such information from other covered entities.

(ii) For a request that is made on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information requested to the amount reasonably necessary to accomplish the purpose for which the request is made.

(iii) For all other requests, a covered entity must:

(A) Develop criteria designed to limit the request for protected health information to the information reasonably necessary to accomplish the purpose for which the request is made; and

(B) Review requests for disclosure on an individual basis in accordance with such criteria.

(5) Implementation specification: Other content requirement. For all uses, disclosures, or requests to which the requirements in paragraph (d) of this section apply, a covered entity may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.

(e)(1) Standard: Limited data set. A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient, in accordance with paragraph (e)(4) of this section.

(2) Implementation specification: Limited data set: A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual:

(i) Names;

(ii) Postal address information, other than town or city, State, and zip code;

(iii) Telephone numbers;

(iv) Fax numbers;

(v) Electronic mail addresses;

(vi) Social security numbers;

(vii) Medical record numbers;

(viii) Health plan beneficiary numbers;

(ix) Account numbers;

(x) Certificate/license numbers;

(xi) Vehicle identifiers and serial numbers, including license plate numbers;

(xii) Device identifiers and serial numbers;

(xiii) Web Universal Resource Locators (URLs);

(xiv) Internet Protocol (IP) address numbers;

(xv) Biometric identifiers, including finger and voice prints; and

(xvi) Full face photographic images and any comparable images.

(3) Implementation specification: Permitted purposes for uses and disclosures. (i) A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations.

(ii) A covered entity may use protected health information to create a limited data set that meets the requirements of paragraph (e)(2) of this section, or disclose protected health information only to a business associate for such purpose, whether or not the limited data set is to be used by the covered entity.

(4) Implementation specifications: Data use agreement-(i) Agreement required. A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only if the covered entity obtains satisfactory assurance, in the form of a data use agreement that meets the requirements of this section, that the limited data set recipient will only use or disclose the protected health information for limited purposes.

(ii) Contents. A data use agreement between the covered entity and the limited data set recipient must:

(A) Establish the permitted uses and disclosures of such information by the limited data set recipient, consistent with paragraph (e)(3) of this section. The data use agreement may not authorize the limited data set recipient to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity;

(B) Establish who is permitted to use or receive the limited data set; and

(C) Provide that the limited data set recipient will:

(1) Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;

(2) Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement;

(3) Report to the covered entity any use or disclosure of the information not provided for by its data use agreement of which it becomes aware;

(4) Ensure that any agents to whom it provides the limited data set agree to the same restrictions and conditions that apply to the limited data set recipient with respect to such information; and

(5) Not identify the information or contact the individuals.

(iii) Compliance. (A) A covered entity is not in compliance with the standards in paragraph (e) of this section if the covered entity knew of a pattern of activity or practice of the limited data set recipient that constituted a material breach or violation of the data use agreement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful:

(1) Discontinued disclosure of protected health information to the recipient; and

(2) Reported the problem to the Secretary.

(B) A covered entity that is a limited data set recipient and violates a data use agreement will be in noncompliance with the standards, implementation specifications, and requirements of paragraph (e) of this section.

(f) Fundraising communications-(1) Standard: Uses and disclosures for fundraising. Subject to the conditions of paragraph (f)(2) of this section, a covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following protected health information for the purpose of raising funds for its own benefit, without an authorization meeting the requirements of §164.508:

(i) Demographic information relating to an individual, including name, address, other contact information, age, gender, and date of birth;

(ii) Dates of health care provided to an individual;

(iii) Department of service information;

(iv) Treating physician;

(v) Outcome information; and

(vi) Health insurance status.

(2) Implementation specifications: Fundraising requirements. (i) A covered entity may not use or disclose protected health information for fundraising purposes as otherwise permitted by paragraph (f)(1) of this section unless a statement required by §164.520(b)(1)(iii)(A) is included in the covered entity's notice of privacy practices.

(ii) With each fundraising communication made to an individual under this paragraph, a covered entity must provide the individual with a clear and conspicuous opportunity to elect not to receive any further fundraising communications. The method for an individual to elect not to receive further fundraising communications may not cause the individual to incur an undue burden or more than a nominal cost.

(iii) A covered entity may not condition treatment or payment on the individual's choice with respect to the receipt of fundraising communications.

(iv) A covered entity may not make fundraising communications to an individual under this paragraph where the individual has elected not to receive such communications under paragraph (f)(2)(ii) of this section.

(v) A covered entity may provide an individual who has elected not to receive further fundraising communications with a method to opt back in to receive such communications.

(g) Standard: Uses and disclosures for underwriting and related purposes. If a health plan receives protected health information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with the health plan, such health plan may only use or disclose such protected health information for such purpose or as may be required by law, subject to the prohibition at §164.502(a)(5)(i) with respect to genetic information included in the protected health information.

(h)(1) Standard: Verification requirements. Prior to any disclosure permitted by this subpart, a covered entity must:

(i) Except with respect to disclosures under §164.510, verify the identity of a person requesting protected health information and the authority of any such person to have access to protected health information under this subpart, if the identity or any such authority of such person is not known to the covered entity; and

(ii) Obtain any documentation, statements, or representations, whether oral or written, from the person requesting the protected health information when such documentation, statement, or representation is a condition of the disclosure under this subpart.

(2) Implementation specifications: Verification-(i) Conditions on disclosures. If a disclosure is conditioned by this subpart on particular documentation, statements, or representations from the person requesting the protected health information, a covered entity may rely, if such reliance is reasonable under the circumstances, on documentation, statements, or representations that, on their face, meet the applicable requirements.

(A) The conditions in §164.512(f)(1)(ii)(C) may be satisfied by the administrative subpoena or similar process or by a separate written statement that, on its face, demonstrates that the applicable requirements have been met.

(B) The documentation required by §164.512(i)(2) may be satisfied by one or more written statements, provided that each is appropriately dated and signed in accordance with §164.512(i)(2)(i) and (v).

(ii) Identity of public officials. A covered entity may rely, if such reliance is reasonable under the circumstances, on any of the following to verify identity when the disclosure of protected health information is to a public official or a person acting on behalf of the public official:

(A) If the request is made in person, presentation of an agency identification badge, other official credentials, or other proof of government status;

(B) If the request is in writing, the request is on the appropriate government letterhead; or

(C) If the disclosure is to a person acting on behalf of a public official, a written statement on appropriate government letterhead that the person is acting under the government's authority or other evidence or documentation of agency, such as a contract for services, memorandum of understanding, or purchase order, that establishes that the person is acting on behalf of the public official.

(iii) Authority of public officials. A covered entity may rely, if such reliance is reasonable under the circumstances, on any of the following to verify authority when the disclosure of protected health information is to a public official or a person acting on behalf of the public official:

(A) A written statement of the legal authority under which the information is requested, or, if a written statement would be impracticable, an oral statement of such legal authority;

(B) If a request is made pursuant to legal process, warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal is presumed to constitute legal authority.

(iv) Exercise of professional judgment. The verification requirements of this paragraph are met if the covered entity relies on the exercise of professional judgment in making a use or disclosure in accordance with §164.510 or acts on a good faith belief in making a disclosure in accordance with §164.512(j).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5700, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§164.520 Notice of privacy practices for protected health information.

(a) Standard: Notice of privacy practices-(1) Right to notice. Except as provided by paragraph (a)(2) or (3) of this section, an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information.

(2) Exception for group health plans. (i) An individual enrolled in a group health plan has a right to notice:

(A) From the group health plan, if, and to the extent that, such an individual does not receive health benefits under the group health plan through an insurance contract with a health insurance issuer or HMO; or

(B) From the health insurance issuer or HMO with respect to the group health plan through which such individuals receive their health benefits under the group health plan.

(ii) A group health plan that provides health benefits solely through an insurance contract with a health insurance issuer or HMO, and that creates or receives protected health information in addition to summary health information as defined in §164.504(a) or information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan, must:

(A) Maintain a notice under this section; and

(B) Provide such notice upon request to any person. The provisions of paragraph (c)(1) of this section do not apply to such group health plan.

(iii) A group health plan that provides health benefits solely through an insurance contract with a health insurance issuer or HMO, and does not create or receive protected health information other than summary health information as defined in §164.504(a) or information on whether an individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan, is not required to maintain or provide a notice under this section.

(3) Exception for inmates. An inmate does not have a right to notice under this section, and the requirements of this section do not apply to a correctional institution that is a covered entity.

(b) Implementation specifications: Content of notice-(1) Required elements. The covered entity must provide a notice that is written in plain language and that contains the elements required by this paragraph.

(i) Header. The notice must contain the following statement as a header or otherwise prominently displayed:

"THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

(ii) Uses and disclosures. The notice must contain:

(A) A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by this subpart to make for each of the following purposes: treatment, payment, and health care operations.

(B) A description of each of the other purposes for which the covered entity is permitted or required by this subpart to use or disclose protected health information without the individual's written authorization.

(C) If a use or disclosure for any purpose described in paragraphs (b)(1)(ii)(A) or (B) of this section is prohibited or materially limited by other applicable law, the description of such use or disclosure must reflect the more stringent law as defined in §160.202 of this subchapter.

(D) For each purpose described in paragraph (b)(1)(ii)(A) or (B) of this section, the description must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by this subpart and other applicable law.

(E) A description of the types of uses and disclosures that require an authorization under §164.508(a)(2)-(a)(4), a statement that other uses and disclosures not described in the notice will be made only with the individual's written authorization, and a statement that the individual may revoke an authorization as provided by §164.508(b)(5).

(iii) Separate statements for certain uses or disclosures. If the covered entity intends to engage in any of the following activities, the description required by paragraph (b)(1)(ii)(A) of this section must include a separate statement informing the individual of such activities, as applicable:

(A) In accordance with §164.514(f)(1), the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications; (B) In accordance with §164.504(f), the group health plan, or a health insurance issuer or HMO with respect to a group health plan, may disclose protected health information to the sponsor of the plan; or

(C) If a covered entity that is a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, intends to use or disclose protected health information for underwriting purposes, a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes.

(iv) Individual rights. The notice must contain a statement of the individual's rights with respect to protected health information and a brief description of how the individual may exercise these rights, as follows:

(A) The right to request restrictions on certain uses and disclosures of protected health information as provided by §164.522(a), including a statement that the covered entity is not required to agree to a requested restriction, except in case of a disclosure restricted under §164.522(a)(1)

(B) The right to receive confidential communications of protected health information as provided by §164.522(b), as applicable;

(C) The right to inspect and copy protected health information as provided by §164.524;

(D) The right to amend protected health information as provided by §164.526;

(E) The right to receive an accounting of disclosures of protected health information as provided by §164.528; and

(F) The right of an individual, including an individual who has agreed to receive the notice electronically in accordance with paragraph (c)(3) of this section, to obtain a paper copy of the notice from the covered entity upon request.

(v) Covered entity's duties. The notice must contain:

(A) A statement that the covered entity is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information;

(B) A statement that the covered entity is required to abide by the terms of the notice currently in effect; and

(C) For the covered entity to apply a change in a privacy practice that is described in the notice to protected health information that the covered entity created or received prior to issuing a revised notice, in accordance with §164.530(i)(2)(ii), a statement that it reserves the right to change the terms of its notice and to make the new notice provisions effective for all protected health information that it maintains. The statement must also describe how it will provide individuals with a revised notice.

(vi) Complaints. The notice must contain a statement that individuals may complain to the covered entity and to the Secretary if they believe their privacy rights have been violated, a brief description of how the individual may file a complaint with the covered entity, and a statement that the individual will not be retaliated against for filing a complaint.

(vii) Contact. The notice must contain the name, or title, and telephone number of a person or office to contact for further information as required by §164.530(a)(1)(ii).

(viii) Effective date. The notice must contain the date on which the notice is first in effect, which may not be earlier than the date on which the notice is printed or otherwise published.

(2) Optional elements. (i) In addition to the information required by paragraph (b)(1) of this section, if a covered entity elects to limit the uses or disclosures that it is permitted to make under this subpart, the covered entity may describe its more limited uses or disclosures in its notice, provided that the covered entity may not include in its notice a limitation affecting its right to make a use or disclosure that is required by law or permitted by §164.512(j)(1)(i).

(ii) For the covered entity to apply a change in its more limited uses and disclosures to protected health information created or received prior to issuing a revised notice, in accordance with §164.530(i)(2)(ii), the notice must include the statements required by paragraph (b)(1)(v)(C) of this section.

(3) Revisions to the notice. The covered entity must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the individual's rights, the covered entity's legal duties, or other privacy practices stated in the notice. Except when required by law, a material change to any term of the notice may not be implemented prior to the effective date of the notice in which such material change is reflected.

(c) Implementation specifications: Provision of notice. A covered entity must make the notice required by this section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(3) of this section, as applicable.

(1) Specific requirements for health plans. (i) A health plan must provide the notice:

(A) No later than the compliance date for the health plan, to individuals then covered by the plan;

(B) Thereafter, at the time of enrollment, to individuals who are new enrollees.

(ii) No less frequently than once every three years, the health plan must notify individuals then covered by the plan of the availability of the notice and how to obtain the notice.

(iii) The health plan satisfies the requirements of paragraph (c)(1) of this section if notice is provided to the named insured of a policy under which coverage is provided to the named insured and one or more dependents.

(iv) If a health plan has more than one notice, it satisfies the requirements of paragraph (c)(1) of this section by providing the notice that is relevant to the individual or other person requesting the notice.

(v) If there is a material change to the notice:

(A) A health plan that posts its notice on its web site in accordance with paragraph (c)(3)(i) of this section must prominently post the change or its revised notice on its web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan.

(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.

(2) Specific requirements for certain covered health care providers. A covered health care provider that has a direct treatment relationship with an individual must:

(i) Provide the notice:

(A) No later than the date of the first service delivery, including service delivered electronically, to such individual after the compliance date for the covered health care provider; or

(B) In an emergency treatment situation, as soon as reasonably practicable after the emergency treatment situation.

(ii) Except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt of the notice provided in accordance with paragraph (c)(2)(i) of this section, and if not obtained, document its good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained;

(iii) If the covered health care provider maintains a physical service delivery site:

(A) Have the notice available at the service delivery site for individuals to request to take with them; and

(B) Post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered health care provider to be able to read the notice; and

(iv) Whenever the notice is revised, make the notice available upon request on or after the effective date of the revision and promptly comply with the requirements of paragraph (c)(2)(iii) of this section, if applicable.

(3) Specific requirements for electronic notice. (i) A covered entity that maintains a web site that provides information about the covered entity's customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the web site.

(ii) A covered entity may provide the notice required by this section to an individual by e-mail, if the individual agrees to electronic notice and such agreement has not been withdrawn. If the covered entity knows that the e-mail transmission has failed, a paper copy of the notice must be provided to the individual. Provision of electronic notice by the covered entity will satisfy the provision requirements of paragraph (c) of this section when timely made in accordance with paragraph (c)(1) or (2) of this section.

(iii) For purposes of paragraph (c)(2)(i) of this section, if the first service delivery to an individual is delivered electronically, the covered health care provider must provide electronic notice automatically and contemporaneously in response to the individual's first request for service. The requirements in paragraph (c)(2)(ii) of this section apply to electronic notice.

(iv) The individual who is the recipient of electronic notice retains the right to obtain a paper copy of the notice from a covered entity upon request.

(d) Implementation specifications: Joint notice by separate covered entities. Covered entities that participate in organized health care arrangements may comply with this section by a joint notice, provided that:

(1) The covered entities participating in the organized health care arrangement agree to abide by the terms of the notice with respect to protected health information created or received by the covered entity as part of its participation in the organized health care arrangement;

(2) The joint notice meets the implementation specifications in paragraph (b) of this section, except that the statements required by this section may be altered to reflect the fact that the notice covers more than one covered entity; and

(i) Describes with reasonable specificity the covered entities, or class of entities, to which the joint notice applies;

(ii) Describes with reasonable specificity the service delivery sites, or classes of service delivery sites, to which the joint notice applies; and

(iii) If applicable, states that the covered entities participating in the organized health care arrangement will share protected health information with each other, as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement.

(3) The covered entities included in the joint notice must provide the notice to individuals in accordance with the applicable implementation specifications of paragraph (c) of this section. Provision of the joint notice to an individual by any one of the covered entities included in the joint notice will satisfy the provision requirement of paragraph (c) of this section with respect to all others covered by the joint notice.

(e) Implementation specifications: Documentation. A covered entity must document compliance with the notice requirements, as required by §164.530(j), by retaining copies of the notices issued by the covered entity and, if applicable, any written acknowledgments of receipt of the notice or documentation of good faith efforts to obtain such written acknowledgment, in accordance with paragraph (c)(2)(ii) of this section.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002; 78 FR 5701, Jan. 25, 2013]

§164.522 Rights to request privacy protection for protected health information.

(a)(1) Standard: Right of an individual to request restriction of uses and disclosures. (i) A covered entity must permit an individual to request that the covered entity restrict:

(A) Uses or disclosures of protected health information about the individual to carry out treatment, payment, or health care operations; and

(B) Disclosures permitted under §164.510(b).

(ii) Except as provided in paragraph (a)(1)(vi) of this section, a covered entity is not required to agree to a restriction.

(iii) A covered entity that agrees to a restriction under paragraph (a)(1)(i) of this section may not use or disclose protected health information in violation of such restriction, except that, if the individual who requested the restriction is in need of emergency treatment and the restricted protected health information is needed to provide the emergency treatment, the covered entity may use the restricted protected health information, or may disclose such information to a health care provider, to provide such treatment to the individual.

(iv) If restricted protected health information is disclosed to a health care provider for emergency treatment under paragraph (a)(1)(iii) of this section, the covered entity must request that such health care provider not further use or disclose the information.

(v) A restriction agreed to by a covered entity under paragraph (a) of this section, is not effective under this subpart to prevent uses or disclosures permitted or required under §164.502(a)(2)(ii), §164.510(a) or §164.512.

(vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:

(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and

(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.

(2) Implementation specifications: Terminating a restriction. A covered entity may terminate a restriction, if:

(i) The individual agrees to or requests the termination in writing;

(ii) The individual orally agrees to the termination and the oral agreement is documented; or

(iii) The covered entity informs the individual that it is terminating its agreement to a restriction, except that such termination is:

(A) Not effective for protected health information restricted under paragraph (a)(1)(vi) of this section; and

(B) Only effective with respect to protected health information created or received after it has so informed the individual.

(3) Implementation specification: Documentation. A covered entity must document a restriction in accordance with §160.530(j) of this subchapter.

(b)(1) Standard: Confidential communications requirements. (i) A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.

(ii) A health plan must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the health plan by alternative means or at alternative locations, if the individual clearly states that the disclosure of all or part of that information could endanger the individual.

(2) Implementation specifications: Conditions on providing confidential communications. (i) A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing.

(ii) A covered entity may condition the provision of a reasonable accommodation on:

(A) When appropriate, information as to how payment, if any, will be handled; and

(B) Specification of an alternative address or other method of contact.

(iii) A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.

(iv) A health plan may require that a request contain a statement that disclosure of all or part of the information to which the request pertains could endanger the individual.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002; 78 FR 5701, Jan. 25, 2013]

§164.524 Access of individuals to protected health information.

(a) Standard: Access to protected health information-(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for:

(i) Psychotherapy notes; and

(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

(2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances.

(i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.

(ii) A covered entity that is a correctional institution or a covered health care provider acting under the direction of the correctional institution may deny, in whole or in part, an inmate's request to obtain a copy of protected health information, if obtaining such copy would jeopardize the health, safety, security, custody, or rehabilitation of the individual or of other inmates, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the inmate.

(iii) An individual's access to protected health information created or obtained by a covered health care provider in the course of research that includes treatment may be temporarily suspended for as long as the research is in progress, provided that the individual has agreed to the denial of access when consenting to participate in the research that includes treatment, and the covered health care provider has informed the individual that the right of access will be reinstated upon completion of the research.

(iv) An individual's access to protected health information that is contained in records that are subject to the Privacy Act, 5 U.S.C. 552a, may be denied, if the denial of access under the Privacy Act would meet the requirements of that law.

(v) An individual's access may be denied if the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

(3) Reviewable grounds for denial. A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed, as required by paragraph (a)(4) of this section, in the following circumstances:

(i) A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;

(ii) The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or

(iii) The request for access is made by the individual's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

(4) Review of a denial of access. If access is denied on a ground permitted under paragraph (a)(3) of this section, the individual has the right to have the denial reviewed by a licensed health care professional who is designated by the covered entity to act as a reviewing official and who did not participate in the original decision to deny. The covered entity must provide or deny access in accordance with the determination of the reviewing official under paragraph (d)(4) of this section.

(b) Implementation specifications: Requests for access and timely action-(1) Individual's request for access. The covered entity must permit an individual to request access to inspect or to obtain a copy of the protected health information about the individual that is maintained in a designated record set. The covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement.

(2) Timely action by the covered entity. (i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.

(A) If the covered entity grants the request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, in accordance with paragraph (c) of this section.

(B) If the covered entity denies the request, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d) of this section.

(ii) If the covered entity is unable to take an action required by paragraph (b)(2)(i)(A) or (B) of this section within the time required by paragraph (b)(2)(i) of this section, as applicable, the covered entity may extend the time for such actions by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (b)(2)(i) of this section, as applicable, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request; and

(B) The covered entity may have only one such extension of time for action on a request for access.

(c) Implementation specifications: Provision of access. If the covered entity provides an individual with access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.

(1) Providing the access requested. The covered entity must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the protected health information about them in designated record sets. If the same protected health information that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the covered entity need only produce the protected health information once in response to a request for access.

(2) Form of access requested. (i) The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.

(ii) Notwithstanding paragraph (c)(2)(i) of this section, if the protected health information that is the subject of a request for access is maintained in one or more designated record sets electronically and if the individual requests an electronic copy of such information, the covered entity must provide the individual with access to the protected health information in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual.

(iii) The covered entity may provide the individual with a summary of the protected health information requested, in lieu of providing access to the protected health information or may provide an explanation of the protected health information to which access has been provided, if:

(A) The individual agrees in advance to such a summary or explanation; and

(B) The individual agrees in advance to the fees imposed, if any, by the covered entity for such summary or explanation.

(3) Time and manner of access. (i) The covered entity must provide the access as requested by the individual in a timely manner as required by paragraph (b)(2) of this section, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the protected health information, or mailing the copy of the protected health information at the individual's request. The covered entity may discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.

(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.

(4) Fees. If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:

(i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form;

(ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media;

(iii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and

(iv) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(iii) of this section.

(d) Implementation specifications: Denial of access. If the covered entity denies access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.

(1) Making other information accessible. The covered entity must, to the extent possible, give the individual access to any other protected health information requested, after excluding the protected health information as to which the covered entity has a ground to deny access.

(2) Denial. The covered entity must provide a timely, written denial to the individual, in accordance with paragraph (b)(2) of this section. The denial must be in plain language and contain:

(i) The basis for the denial;

(ii) If applicable, a statement of the individual's review rights under paragraph (a)(4) of this section, including a description of how the individual may exercise such review rights; and

(iii) A description of how the individual may complain to the covered entity pursuant to the complaint procedures in §164.530(d) or to the Secretary pursuant to the procedures in §160.306. The description must include the name, or title, and telephone number of the contact person or office designated in §164.530(a)(1)(ii).

(3) Other responsibility. If the covered entity does not maintain the protected health information that is the subject of the individual's request for access, and the covered entity knows where the requested information is maintained, the covered entity must inform the individual where to direct the request for access.

(4) Review of denial requested. If the individual has requested a review of a denial under paragraph (a)(4) of this section, the covered entity must designate a licensed health care professional, who was not directly involved in the denial to review the decision to deny access. The covered entity must promptly refer a request for review to such designated reviewing official. The designated reviewing official must determine, within a reasonable period of time, whether or not to deny the access requested based on the standards in paragraph (a)(3) of this section. The covered entity must promptly provide written notice to the individual of the determination of the designated reviewing official and take other action as required by this section to carry out the designated reviewing official's determination.

(e) Implementation specification: Documentation. A covered entity must document the following and retain the documentation as required by §164.530(j):

(1) The designated record sets that are subject to access by individuals; and

(2) The titles of the persons or offices responsible for receiving and processing requests for access by individuals.

[65 FR 82802, Dec. 28, 2000, as amended at 78 FR 5701, Jan. 25, 2013; 78 FR 34266, June 7, 2013; 79 FR 7316, Feb. 6, 2014]

§164.526 Amendment of protected health information.

(a) Standard: Right to amend. (1) Right to amend. An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set.

(2) Denial of amendment. A covered entity may deny an individual's request for amendment, if it determines that the protected health information or record that is the subject of the request:

(i) Was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment;

(ii) Is not part of the designated record set;

(iii) Would not be available for inspection under §164.524; or

(iv) Is accurate and complete.

(b) Implementation specifications: Requests for amendment and timely action-(1) Individual's request for amendment. The covered entity must permit an individual to request that the covered entity amend the protected health information maintained in the designated record set. The covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements.

(2) Timely action by the covered entity. (i) The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request, as follows.

(A) If the covered entity grants the requested amendment, in whole or in part, it must take the actions required by paragraphs (c)(1) and (2) of this section.

(B) If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d)(1) of this section.

(ii) If the covered entity is unable to act on the amendment within the time required by paragraph (b)(2)(i) of this section, the covered entity may extend the time for such action by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (b)(2)(i) of this section, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request; and

(B) The covered entity may have only one such extension of time for action on a request for an amendment.

(c) Implementation specifications: Accepting the amendment. If the covered entity accepts the requested amendment, in whole or in part, the covered entity must comply with the following requirements.

(1) Making the amendment. The covered entity must make the appropriate amendment to the protected health information or record that is the subject of the request for amendment by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.

(2) Informing the individual. In accordance with paragraph (b) of this section, the covered entity must timely inform the individual that the amendment is accepted and obtain the individual's identification of and agreement to have the covered entity notify the relevant persons with which the amendment needs to be shared in accordance with paragraph (c)(3) of this section.

(3) Informing others. The covered entity must make reasonable efforts to inform and provide the amendment within a reasonable time to:

(i) Persons identified by the individual as having received protected health information about the individual and needing the amendment; and

(ii) Persons, including business associates, that the covered entity knows have the protected health information that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.

(d) Implementation specifications: Denying the amendment. If the covered entity denies the requested amendment, in whole or in part, the covered entity must comply with the following requirements.

(1) Denial. The covered entity must provide the individual with a timely, written denial, in accordance with paragraph (b)(2) of this section. The denial must use plain language and contain:

(i) The basis for the denial, in accordance with paragraph (a)(2) of this section;

(ii) The individual's right to submit a written statement disagreeing with the denial and how the individual may file such a statement;

(iii) A statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual's request for amendment and the denial with any future disclosures of the protected health information that is the subject of the amendment; and

(iv) A description of how the individual may complain to the covered entity pursuant to the complaint procedures established in §164.530(d) or to the Secretary pursuant to the procedures established in §160.306. The description must include the name, or title, and telephone number of the contact person or office designated in §164.530(a)(1)(ii).

(2) Statement of disagreement. The covered entity must permit the individual to submit to the covered entity a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. The covered entity may reasonably limit the length of a statement of disagreement.

(3) Rebuttal statement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the statement of disagreement.

(4) Recordkeeping. The covered entity must, as appropriate, identify the record or protected health information in the designated record set that is the subject of the disputed amendment and append or otherwise link the individual's request for an amendment, the covered entity's denial of the request, the individual's statement of disagreement, if any, and the covered entity's rebuttal, if any, to the designated record set.

(5) Future disclosures. (i) If a statement of disagreement has been submitted by the individual, the covered entity must include the material appended in accordance with paragraph (d)(4) of this section, or, at the election of the covered entity, an accurate summary of any such information, with any subsequent disclosure of the protected health information to which the disagreement relates.

(ii) If the individual has not submitted a written statement of disagreement, the covered entity must include the individual's request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosure of the protected health information only if the individual has requested such action in accordance with paragraph (d)(1)(iii) of this section.

(iii) When a subsequent disclosure described in paragraph (d)(5)(i) or (ii) of this section is made using a standard transaction under part 162 of this subchapter that does not permit the additional material to be included with the disclosure, the covered entity may separately transmit the material required by paragraph (d)(5)(i) or (ii) of this section, as applicable, to the recipient of the standard transaction.

(e) Implementation specification: Actions on notices of amendment. A covered entity that is informed by another covered entity of an amendment to an individual's protected health information, in accordance with paragraph (c)(3) of this section, must amend the protected health information in designated record sets as provided by paragraph (c)(1) of this section.

(f) Implementation specification: Documentation. A covered entity must document the titles of the persons or offices responsible for receiving and processing requests for amendments by individuals and retain the documentation as required by §164.530(j).

§164.528 Accounting of disclosures of protected health information.

(a) Standard: Right to an accounting of disclosures of protected health information. (1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures:

(i) To carry out treatment, payment and health care operations as provided in §164.506;

(ii) To individuals of protected health information about them as provided in §164.502;

(iii) Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in §164.502;

(iv) Pursuant to an authorization as provided in §164.508;

(v) For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in §164.510;

(vi) For national security or intelligence purposes as provided in §164.512(k)(2);

(vii) To correctional institutions or law enforcement officials as provided in §164.512(k)(5);

(viii) As part of a limited data set in accordance with §164.514(e); or

(ix) That occurred prior to the compliance date for the covered entity.

(2)(i) The covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in §164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required.

(ii) If the agency or official statement in paragraph (a)(2)(i) of this section is made orally, the covered entity must:

(A) Document the statement, including the identity of the agency or official making the statement;

(B) Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and

(C) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of this section is submitted during that time.

(3) An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.

(b) Implementation specifications: Content of the accounting. The covered entity must provide the individual with a written accounting that meets the following requirements.

(1) Except as otherwise provided by paragraph (a) of this section, the accounting must include disclosures of protected health information that occurred during the six years (or such shorter time period at the request of the individual as provided in paragraph (a)(3) of this section) prior to the date of the request for an accounting, including disclosures to or by business associates of the covered entity.

(2) Except as otherwise provided by paragraphs (b)(3) or (b)(4) of this section, the accounting must include for each disclosure:

(i) The date of the disclosure;

(ii) The name of the entity or person who received the protected health information and, if known, the address of such entity or person;

(iii) A brief description of the protected health information disclosed; and

(iv) A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure under §164.502(a)(2)(ii) or §164.512, if any.

(3) If, during the period covered by the accounting, the covered entity has made multiple disclosures of protected health information to the same person or entity for a single purpose under §164.502(a)(2)(ii) or §164.512, the accounting may, with respect to such multiple disclosures, provide:

(i) The information required by paragraph (b)(2) of this section for the first disclosure during the accounting period;

(ii) The frequency, periodicity, or number of the disclosures made during the accounting period; and

(iii) The date of the last such disclosure during the accounting period.

(4)(i) If, during the period covered by the accounting, the covered entity has made disclosures of protected health information for a particular research purpose in accordance with §164.512(i) for 50 or more individuals, the accounting may, with respect to such disclosures for which the protected health information about the individual may have been included, provide:

(A) The name of the protocol or other research activity;

(B) A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;

(C) A brief description of the type of protected health information that was disclosed;

(D) The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;

(E) The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and

(F) A statement that the protected health information of the individual may or may not have been disclosed for a particular protocol or other research activity.

(ii) If the covered entity provides an accounting for research disclosures, in accordance with paragraph (b)(4) of this section, and if it is reasonably likely that the protected health information of the individual was disclosed for such research protocol or activity, the covered entity shall, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher.

(c) Implementation specifications: Provision of the accounting. (1) The covered entity must act on the individual's request for an accounting, no later than 60 days after receipt of such a request, as follows.

(i) The covered entity must provide the individual with the accounting requested; or

(ii) If the covered entity is unable to provide the accounting within the time required by paragraph (c)(1) of this section, the covered entity may extend the time to provide the accounting by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (c)(1) of this section, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting; and

(B) The covered entity may have only one such extension of time for action on a request for an accounting.

(2) The covered entity must provide the first accounting to an individual in any 12 month period without charge. The covered entity may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12 month period, provided that the covered entity informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.

(d) Implementation specification: Documentation. A covered entity must document the following and retain the documentation as required by §164.530(j):

(1) The information required to be included in an accounting under paragraph (b) of this section for disclosures of protected health information that are subject to an accounting under paragraph (a) of this section;

(2) The written accounting that is provided to the individual under this section; and

(3) The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002]

§164.530 Administrative requirements.

(a)(1) Standard: Personnel designations. (i) A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity.

(ii) A covered entity must designate a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by §164.520.

(2) Implementation specification: Personnel designations. A covered entity must document the personnel designations in paragraph (a)(1) of this section as required by paragraph (j) of this section.

(b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.

(2) Implementation specifications: Training. (i) A covered entity must provide training that meets the requirements of paragraph (b)(1) of this section, as follows:

(A) To each member of the covered entity's workforce by no later than the compliance date for the covered entity;

(B) Thereafter, to each new member of the workforce within a reasonable period of time after the person joins the covered entity's workforce; and

(C) To each member of the covered entity's workforce whose functions are affected by a material change in the policies or procedures required by this subpart or subpart D of this part, within a reasonable period of time after the material change becomes effective in accordance with paragraph (i) of this section.

(ii) A covered entity must document that the training as described in paragraph (b)(2)(i) of this section has been provided, as required by paragraph (j) of this section.

(c)(1) Standard: Safeguards. A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.

(2)(i) Implementation specification: Safeguards. A covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of this subpart.

(ii) A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

(d)(1) Standard: Complaints to the covered entity. A covered entity must provide a process for individuals to make complaints concerning the covered entity's policies and procedures required by this subpart and subpart D of this part or its compliance with such policies and procedures or the requirements of this subpart or subpart D of this part.

(2) Implementation specification: Documentation of complaints. As required by paragraph (j) of this section, a covered entity must document all complaints received, and their disposition, if any.

(e)(1) Standard: Sanctions. A covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity or the requirements of this subpart or subpart D of this part. This standard does not apply to a member of the covered entity's workforce with respect to actions that are covered by and that meet the conditions of §164.502(j) or paragraph (g)(2) of this section.

(2) Implementation specification: Documentation. As required by paragraph (j) of this section, a covered entity must document the sanctions that are applied, if any.

(f) Standard: Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect that is known to the covered entity of a use or disclosure of protected health information in violation of its policies and procedures or the requirements of this subpart by the covered entity or its business associate.

(g) Standard: Refraining from intimidating or retaliatory acts. A covered entity-

(1) May not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise by the individual of any right established, or for participation in any process provided for, by this subpart or subpart D of this part, including the filing of a complaint under this section; and

(2) Must refrain from intimidation and retaliation as provided in §160.316 of this subchapter.

(h) Standard: Waiver of rights. A covered entity may not require individuals to waive their rights under §160.306 of this subchapter, this subpart, or subpart D of this part, as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.

(i)(1) Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part. The policies and procedures must be reasonably designed, taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity, to ensure such compliance. This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of this subpart.

(2) Standard: Changes to policies and procedures. (i) A covered entity must change its policies and procedures as necessary and appropriate to comply with changes in the law, including the standards, requirements, and implementation specifications of this subpart or subpart D of this part.

(ii) When a covered entity changes a privacy practice that is stated in the notice described in §164.520, and makes corresponding changes to its policies and procedures, it may make the changes effective for protected health information that it created or received prior to the effective date of the notice revision, if the covered entity has, in accordance with §164.520(b)(1)(v)(C), included in the notice a statement reserving its right to make such a change in its privacy practices; or

(iii) A covered entity may make any other changes to policies and procedures at any time, provided that the changes are documented and implemented in accordance with paragraph (i)(5) of this section.

(3) Implementation specification: Changes in law. Whenever there is a change in law that necessitates a change to the covered entity's policies or procedures, the covered entity must promptly document and implement the revised policy or procedure. If the change in law materially affects the content of the notice required by §164.520, the covered entity must promptly make the appropriate revisions to the notice in accordance with §164.520(b)(3). Nothing in this paragraph may be used by a covered entity to excuse a failure to comply with the law.

(4) Implementation specifications: Changes to privacy practices stated in the notice. (i) To implement a change as provided by paragraph (i)(2)(ii) of this section, a covered entity must:

(A) Ensure that the policy or procedure, as revised to reflect a change in the covered entity's privacy practice as stated in its notice, complies with the standards, requirements, and implementation specifications of this subpart;

(B) Document the policy or procedure, as revised, as required by paragraph (j) of this section; and

(C) Revise the notice as required by §164.520(b)(3) to state the changed practice and make the revised notice available as required by §164.520(c). The covered entity may not implement a change to a policy or procedure prior to the effective date of the revised notice.

(ii) If a covered entity has not reserved its right under §164.520(b)(1)(v)(C) to change a privacy practice that is stated in the notice, the covered entity is bound by the privacy practices as stated in the notice with respect to protected health information created or received while such notice is in effect. A covered entity may change a privacy practice that is stated in the notice, and the related policies and procedures, without having reserved the right to do so, provided that:

(A) Such change meets the implementation specifications in paragraphs (i)(4)(i)(A)-(C) of this section; and

(B) Such change is effective only with respect to protected health information created or received after the effective date of the notice.

(5) Implementation specification: Changes to other policies or procedures. A covered entity may change, at any time, a policy or procedure that does not materially affect the content of the notice required by §164.520, provided that:

(i) The policy or procedure, as revised, complies with the standards, requirements, and implementation specifications of this subpart; and

(ii) Prior to the effective date of the change, the policy or procedure, as revised, is documented as required by paragraph (j) of this section.

(j)(1) Standard: Documentation. A covered entity must:

(i) Maintain the policies and procedures provided for in paragraph (i) of this section in written or electronic form;

(ii) If a communication is required by this subpart to be in writing, maintain such writing, or an electronic copy, as documentation; and

(iii) If an action, activity, or designation is required by this subpart to be documented, maintain a written or electronic record of such action, activity, or designation.

(iv) Maintain documentation sufficient to meet its burden of proof under §164.414(b).

(2) Implementation specification: Retention period. A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.

(k) Standard: Group health plans. (1) A group health plan is not subject to the standards or implementation specifications in paragraphs (a) through (f) and (i) of this section, to the extent that:

(i) The group health plan provides health benefits solely through an insurance contract with a health insurance issuer or an HMO; and

(ii) The group health plan does not create or receive protected health information, except for:

(A) Summary health information as defined in §164.504(a); or

(B) Information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.

(2) A group health plan described in paragraph (k)(1) of this section is subject to the standard and implementation specification in paragraph (j) of this section only with respect to plan documents amended in accordance with §164.504(f).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53272, Aug. 14, 2002; 71 FR 8433, Feb. 16, 2006; 74 FR 42769, Aug. 24, 2009]

§164.532 Transition provisions.

(a) Standard: Effect of prior authorizations. Notwithstanding §§164.508 and 164.512(i), a covered entity may use or disclose protected health information, consistent with paragraphs (b) and (c) of this section, pursuant to an authorization or other express legal permission obtained from an individual permitting the use or disclosure of protected health information, informed consent of the individual to participate in research, a waiver of informed consent by an IRB, or a waiver of authorization in accordance with §164.512(i)(1)(i).

(b) Implementation specification: Effect of prior authorization for purposes other than research. Notwithstanding any provisions in §164.508, a covered entity may use or disclose protected health information that it created or received prior to the applicable compliance date of this subpart pursuant to an authorization or other express legal permission obtained from an individual prior to the applicable compliance date of this subpart, provided that the authorization or other express legal permission specifically permits such use or disclosure and there is no agreed-to restriction in accordance with §164.522(a).

(c) Implementation specification: Effect of prior permission for research. Notwithstanding any provisions in §§164.508 and 164.512(i), a covered entity may, to the extent allowed by one of the following permissions, use or disclose, for research, protected health information that it created or received either before or after the applicable compliance date of this subpart, provided that there is no agreed-to restriction in accordance with §164.522(a), and the covered entity has obtained, prior to the applicable compliance date, either:

(1) An authorization or other express legal permission from an individual to use or disclose protected health information for the research;

(2) The informed consent of the individual to participate in the research;

(3) A waiver, by an IRB, of informed consent for the research, in accordance with 7 CFR 1c.116(d), 10 CFR 745.116(d), 14 CFR 1230.116(d), 15 CFR 27.116(d), 16 CFR 1028.116(d), 21 CFR 50.24, 22 CFR 225.116(d), 24 CFR 60.116(d), 28 CFR 46.116(d), 32 CFR 219.116(d), 34 CFR 97.116(d), 38 CFR 16.116(d), 40 CFR 26.116(d), 45 CFR 46.116(d), 45 CFR 690.116(d), or 49 CFR 11.116(d), provided that a covered entity must obtain authorization in accordance with §164.508 if, after the compliance date, informed consent is sought from an individual participating in the research; or

(4) A waiver of authorization in accordance with §164.512(i)(1)(i).

(d) Standard: Effect of prior contracts or other arrangements with business associates. Notwithstanding any other provisions of this part, a covered entity, or business associate with respect to a subcontractor, may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf pursuant to a written contract or other written arrangement with such business associate that does not comply with §§164.308(b), 164.314(a), 164.502(e), and 164.504(e), only in accordance with paragraph (e) of this section.

(e) Implementation specification: Deemed compliance-(1) Qualification. Notwithstanding other sections of this part, a covered entity, or business associate with respect to a subcontractor, is deemed to be in compliance with the documentation and contract requirements of §§164.308(b), 164.314(a), 164.502(e), and 164.504(e), with respect to a particular business associate relationship, for the time period set forth in paragraph (e)(2) of this section, if:

(i) Prior to January 25, 2013, such covered entity, or business associate with respect to a subcontractor, has entered into and is operating pursuant to a written contract or other written arrangement with the business associate that complies with the applicable provisions of §164.314(a) or §164.504(e) that were in effect on such date; and

(ii) The contract or other arrangement is not renewed or modified from March 26, 2013, until September 23, 2013.

(2) Limited deemed compliance period. A prior contract or other arrangement that meets the qualification requirements in paragraph (e) of this section shall be deemed compliant until the earlier of:

(i) The date such contract or other arrangement is renewed or modified on or after September 23, 2013; or

(ii) September 22, 2014.

(3) Covered entity responsibilities. Nothing in this section shall alter the requirements of a covered entity to comply with part 160, subpart C of this subchapter and §§164.524, 164.526, 164.528, and 164.530(f) with respect to protected health information held by a business associate.

(f) Effect of prior data use agreements. If, prior to January 25, 2013, a covered entity has entered into and is operating pursuant to a data use agreement with a recipient of a limited data set that complies with §164.514(e), notwithstanding §164.502(a)(5)(ii), the covered entity may continue to disclose a limited data set pursuant to such agreement in exchange for remuneration from or on behalf of the recipient of the protected health information until the earlier of:

(1) The date such agreement is renewed or modified on or after September 23, 2013; or

(2) September 22, 2014.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53272, Aug. 14, 2002; 78 FR 5702, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§164.534 Compliance dates for initial implementation of the privacy standards.

(a) Health care providers. A covered health care provider must comply with the applicable requirements of this subpart no later than April 14, 2003.

(b) Health plans. A health plan must comply with the applicable requirements of this subpart no later than the following as applicable:

(1) Health plans other than small health plans. April 14, 2003.

(2) Small health plans. April 14, 2004.

(c) Health clearinghouses. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 14, 2003.

[66 FR 12434, Feb. 26, 2001]

# data[].attributes.attachment_link.title
Electronic Code of Federal Regulations (eCFR)

# data[].attributes.attachment_link.description
Home gpo.gov govinfo.gov e-CFR Navigation Aids Browse Simple Search Advanced Search  - Boolean  - Proximity Search History Search Tips Corrections Latest Updates User Info FAQs Agency List Incorporation By Reference Related Resources The Code of Federal Regulations (CFR) annual edition is the codification of the general and permanent rules published in the Federal Register by the departments and agencies of the Federal Government produced by the Office of the Federal Register (OFR) and the Government Publishing Office.

# data[].attributes.body
Judicial Law

Connecticut Supreme Court
In Byrne v. Avery Center (2014), Connecticut's highest court paved the way for individuals to use HIPAA violations as a case for negligence. Byrne was a patient at the Avery Center for Obstetrics when her ex-boyfriend/child's father subpoenaed the center for her medical records in a paternity suit. The Avery Center sent a copy of her records to the court without contesting the subpoena or notifying Byrne. The ex-boyfriend  accessed the records via the court file and used information in the medical record to harass and extort money from Byrne. The trial court dismissed the case stating HIPAA does not allow private plaintiffs to bring action based on a public statute or federal common law. The Connecticut Supreme Court remanded the case back to the trial court who dismissed the case yet again (Byrne v. Avery Center, 2014). After further appeal by Byrne, the Supreme Court stated a person suffering harm as a result of a breach of confidentiality was entitled to damages. A jury in trial court decided in favor of Byrne and awarded $853,000 in damages (HIPAA Journal, 2018).

# data[].attributes.attachment_link.readable_text
Reversed and remanded.

Zarella, J., filed opinion concurring in part and dissenting in part, joined by Rogers, C.J.

Bruce L. Elstein, Bridgeport, with whom, on the brief, was Henry Elstein, Bridgeport, for the appellant (plaintiff). James F. Biondo, with whom, on the brief, was Audrey D. Medd, Stamford, for the appellee (defendant).
ROGERS, C.J., and NORCOTT, PALMER, ZARELLA, EVELEIGH, McDONALD and VERTEFEUILLE, Js. NORCOTT, J.

The listing of justices reflects their seniority status on this court as of the date of oral argument.
This case was originally scheduled to be argued before a panel of this court consisting of Chief Justice Rogers and Justices Norcott, Palmer, Zarella, Eveleigh, McDonald and Vertefeuille. Although Justice Palmer was not present when the case was argued before the court, he read the record and briefs and listened to a recording of oral argument prior to participating in this decision.

Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq., as a comprehensive legislative and regulatory scheme to, inter alia, protect the privacy of patients' health information given emerging advances in information technology. In this appeal, we determine whether HIPAA, which lacks a private right of action and preempts "contrary" state laws; 42 U.S.C. § 1320d-7 (2006); preempts state law claims for negligence and negligent infliction of emotional distress against a health care provider who is alleged to have improperly breached the confidentiality of a patient's medical records in the course of complying with a subpoena. The plaintiff, Emily Byrne, appeals from the judgment of the trial court dismissing counts two and four of the operative amended complaint (complaint) filed against the defendant, the Avery Center for Obstetrics and Gynecology, P.C. On appeal, the plaintiff contends that the trial court improperly concluded that her state law claims for negligence and negligent infliction of emotional distress were preempted by HIPAA. We conclude that, to the extent that Connecticut's common law provides a remedy for a health care provider's breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA does not preempt the plaintiff's state common-law causes of action for negligence or negligent infliction of emotional distress against the health care providers in this case and, further, that regulations of the Department of Health and Human Services (department) implementing HIPAA may inform the applicable standard of care in certain circumstances. Accordingly, we reverse the judgment of the trial court.

Title 42 of the United States Code, § 1320d-7 (a), provides in relevant part: "(1) ... Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form.

"(2) Exceptions

"A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall not supersede a contrary provision of State law, if the provision of State law-

"(A) is a provision the Secretary determines-

"(i) is necessary-

"(I) to prevent fraud and abuse;

"(II) to ensure appropriate State regulation of insurance and health plans;

"(III) for State reporting on health care delivery or costs; or

"(IV) for other purposes; or

"(ii) addresses controlled substances; or

"(B) subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information...."

We note that the trial court subsequently granted the plaintiff's motion to add Douglas Wolinsky, the bankruptcy trustee appointed by the United States Bankruptcy Court for the District of Vermont, as a party plaintiff. See General Statutes § 52-108; Practice Book § 9-18. For the sake of convenience, all references to the plaintiff in this opinion are to Byrne.

Ordinarily, the trial court's dismissal of counts two and four of the operative complaint would not constitute an appealable final judgment. See Kelly v. New Haven, 275 Conn. 580, 594, 881 A.2d 978 (2005). We note, however, that the plaintiff obtained permission to file the present appeal with the Appellate Court pursuant to Practice Book § 61-4. This appeal was subsequently transferred to this court pursuant to General Statutes § 51-199(c) and Practice Book § 65-1.

We also note that the defendant filed a cross appeal to the Appellate Court from the trial court's denial of its motion for summary judgment with respect to counts one and three of the complaint. After a hearing, the Appellate Court dismissed the defendant's cross appeal for lack of a final judgment, noting that the defendant had not obtained permission pursuant to Practice Book § 61-4 to appeal from that aspect of the trial court's decision.

The trial court's memorandum of decision sets forth the following undisputed facts and procedural history. "Before July 12, 2005, the defendant provided the plaintiff [with] gynecological and obstetrical care and treatment. The defendant provided its patients, including the plaintiff, with notice of its privacy policy regarding protected health information and agreed, based on this policy and on law, that it would not disclose the plaintiff's health information without her authorization.

"In May, 2004, the plaintiff began a personal relationship with Andro Mendoza, which lasted until September, 2004. ... In October, 2004, she instructed the defendant not to release her medical records to Mendoza. In March, 2005, she moved from Connecticut to Vermont where she presently lives. On May 31, 2005, Mendoza filed paternity actions against the plaintiff in Connecticut and Vermont. Thereafter, the defendant was served with a subpoena requesting its presence together with the plaintiff's medical records at the New Haven Regional Children's [Probate Court] on July 12, 2005. The defendant did not alert the plaintiff of the subpoena, file a motion to quash it or appear in court. Rather, the defendant mailed a copy of the plaintiff's medical file to the court around July 12, 2005. In September, 2005, '[Mendoza] informed [the] plaintiff by telephone that he reviewed [the] plaintiff's medical file in the court file.' On September 15, 2005, the plaintiff filed a motion to seal her medical file, which was granted. The plaintiff alleges that she suffered harassment and extortion threats from Mendoza since he viewed her medical records." (Footnotes altered.)

We note that the operative complaint in the present case alleges that the plaintiff discovered she was pregnant around the same time she terminated her relationship with Mendoza.

We also note that, according to the operative complaint, Mendoza has utilized the information contained within these records to file numerous civil actions, including paternity and visitation actions, against the plaintiff, her attorney, her father and her father's employer, and to threaten her with criminal charges.

The plaintiff subsequently brought this action against the defendant. Specifically, the operative complaint in the present case alleges that the defendant: (1) breached its contract with her when it violated its privacy policy by disclosing her protected health information without authorization; (2) acted negligently by failing to use proper and reasonable care in protecting her medical file, including disclosing it without authorization in violation of General Statutes § 52-146o and the department's regulations implementing HIPAA; (3) made a negligent misrepresentation, upon which the plaintiff relied to her detriment, that her "medical file and the privacy of her health information would be protected in accordance with the law"; and (4) engaged in conduct constituting negligent infliction of emotional distress. After discovery, the parties filed cross motions for summary judgment.

General Statutes § 52-146 o provides: "(a) Except as provided in sections 52-146c to 52-146j, inclusive, and subsection (b) of this section, in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding, a physician or surgeon, as defined in subsection (b) of section 20-7b, shall not disclose (1) any communication made to him by, or any information obtained by him from, a patient or the conservator or guardian of a patient with respect to any actual or supposed physical or mental disease or disorder, or (2) any information obtained by personal examination of a patient, unless the patient or his authorized representative explicitly consents to such disclosure.

"(b) Consent of the patient or his authorized representative shall not be required for the disclosure of such communication or information (1) pursuant to any statute or regulation of any state agency or the rules of court, (2) by a physician, surgeon or other licensed health care provider against whom a claim has been made, or there is a reasonable belief will be made, in such action or proceeding, to his attorney or professional liability insurer or such insurer's agent for use in the defense of such action or proceeding, (3) to the Commissioner of Public Health for records of a patient of a physician, surgeon or health care provider in connection with an investigation of a complaint, if such records are related to the complaint, or (4) if child abuse, abuse of an elderly individual, abuse of an individual who is physically disabled or incompetent or abuse of an individual with intellectual disability is known or in good faith suspected."

We note that the legislature made certain technical changes to § 52-146 o subsequent to the events underlying the present appeal. See Public Acts 2011, No. 11-129, § 20. For purposes of convenience and clarity, however, all references to § 52-146 o within this opinion are to the current revision of the statute.

Specifically, the plaintiff alleged, in paragraphs 25(f), (g), (h), (i) and (j) of the complaint, violations of the following regulations of the department: (1) 45 C.F.R. § 164.512(e)(1)(ii) by "failing to seek itself or obtain 'satisfactory assurances' from the person seeking the information in that the person seeking the information failed to provide to the defendant proof that reasonable efforts were made to either ... [e]nsure that the plaintiff was provided sufficient notice of the request, or ... [s]eek a qualified protective order"; (2) 45 C.F.R. § 164.512(e)(1)(iii) "in failing to determine that the plaintiff had not received satisfactory notice of the request for her records from the face of the subpoena"; (3) 45 C.F.R. §§ 164.508(b)(2) and 164.508c (1)-(3) "in that the subpoena was not a valid authorization to produce the records"; (4) 45 C.F.R. § 164.522 "in failing to follow the plaintiff's request for additional privacy protection of her protected health information from production to the party requesting it"; and (5) 45 C.F.R. § 164.502 "in failing to determine and produce only the minimum necessary data requested."

With respect to the plaintiff's negligence based claims in counts two and four of the complaint, the trial court agreed with the defendant's contention that "HIPAA preempts 'any action dealing with confidentiality/privacy of medical information,' " which prompted the court to treat the summary judgment motion as one seeking dismissal for lack of subject matter jurisdiction. In its memorandum of decision, the trial court first considered the plaintiff's negligence claims founded on the violations of the regulations implementing HIPAA. The court first observed the "well settled" proposition that HIPAA does not create a private right of action, requiring claims of violations instead to be raised through the department's administrative channels. The trial court then relied on Fisher v. Yale University, Superior Court, judicial district of New Haven, Complex Litigation Docket, Docket No. X10-CV-04-4003207-S (April 3, 2006), and Meade v. Orthopedic Associates of Windham County, Superior Court, judicial district of Windham, Docket No. CV-06-4005043-S (December 27, 2007), and rejected the plaintiff's claim that she had not utilized HIPAA as the basis of her cause of action, but rather, relied on it as " 'evidence of the appropriate standard of care' for claims brought under state law, namely, negligence." Emphasizing that the courts cannot supply a private right of action that the legislature intentionally had omitted, the trial court noted that the "plaintiff has labeled her claims as negligence claims, but this does not change their essential nature. They are HIPAA claims." The trial court further determined that the plaintiff's statutory negligence claims founded on a violation of § 52-146o were similarly preempted because the state statute had been superseded by HIPAA, and thus the plaintiff's state statutory claim "amount[ed] to a claim for a HIPAA violation, a claim for which there is no private right of action."

In Fisher, a judge of the Superior Court concluded that HIPAA's omission of a private right of action preempts, under 42 U.S.C. § 1320d-7 (a)(2)(B), state law causes of action arising from health care providers' breaches of patient privacy. Specifically, the court concluded that a plaintiff's claim, which was brought under the Connecticut Unfair Trade Practices Act (CUTPA), General Statutes § 42-110a et seq., challenging a hospital's "fail[ure] to comply with HIPAA's privacy requirements" was preempted because "[i]f Congress had intended to allow for a private action as part of this program, it could have included it in the legislation or authorized the Secretary [of the department] to provide for the same by rulemaking," and "[t]herefore, to the extent CUTPA permits a private right of action for a HIPAA violation, CUTPA constitutes a 'contrary' provision of state law and falls within the ambit of the HIPAA general preemption rule." Fisher v. Yale University, supra, Superior Court, Docket No. X10-CV-04-4003207-S. In so concluding, the court rejected the plaintiff's argument that, "since a violation of HIPAA is a violation of a clearly delineated public policy, it is actionable under CUTPA, and that the ability of a plaintiff to bring the action will result in greater privacy protection to her as a subject of individually identifiable health information." Id.; see also Salatto v. Hospital of Saint Raphael, Superior Court, judicial district of New Haven, Docket No. CV-09-5032170-S, 2010 WL 4351811 (October 6, 2010) (The trial court granted a motion for summary judgment as to the plaintiff's "negligence per se claims [that] assert that the defendant violated his right to confidentiality, pursuant to HIPAA. It is well settled that HIPAA does not create a private right of action."); Meade v. Orthopedic Associates of Windham County, supra, Superior Court, Docket No. CV-06-4005043-S ("[t]his court concurs with the reasoning in Fisher and, therefore, finds that the plaintiff's CUTPA claim is preempted by HIPAA and does not provide a private right of action").

The trial court further disagreed with the plaintiff's argument analogizing HIPAA to the federal Occupational Safety and Health Act, 29 U.S.C. § 651 et seq., whose regulations "may be used as evidence of the standard of care in a negligence action against an employer"; Wagner v. Clark Equipment Co., 243 Conn. 168, 188, 700 A.2d 38 (1997); observing that "[n]o such history exists for HIPAA regulations."

Specifically, the trial court noted the "stark difference" between § 52-146 o and the more comprehensive safeguards for the disclosure of medical records in administrative and judicial proceedings set forth by 45 C.F.R. § 164.512(e); see footnote 12 of this opinion; and observed that, "[t]o the extent that § 52-146 o permits disclosure of protected medical records pursuant to a subpoena without the safeguards required by HIPAA, it is both contrary to and less stringent than HIPAA and therefore superseded by HIPAA."

The trial court concluded similarly with respect to the plaintiff's common-law negligence claims, observing that, under the regulatory definitions implementing HIPAA's preemption provision; see 42 U.S.C. § 1320d-7 (a); 45 C.F.R. § 160.202 (2004); to "the extent that common-law negligence permits a private right of action for claims that amount to HIPAA violations, it is a contrary provision of law and subject to HIPAA's preemption rule. Because it is not more stringent, according to the definition of 45 C.F.R. § 160.202, the preemption exception does not apply." For the same reasons, the trial court dismissed count four of the complaint, claiming negligent infliction of emotional distress.

Title 45 of the Code of Federal Regulations (2004), § 160.202, implements 42 U.S.C. § 1320d-7, and provides: "For purposes of this subpart, the following terms have the following meanings:

"Contrary, when used to compare a provision of [s]tate law to a standard, requirement, or implementation specification adopted under this subchapter, means:

"(1) A covered entity would find it impossible to comply with both the [s]tate and [f]ederal requirements; or

"(2) The provision of [s]tate law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of the Act, section 264 of [Public Law] 104-191, as applicable.

"More stringent means, in the context of a comparison of a provision of [s]tate law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a [s]tate law that meets one or more of the following criteria:

"(1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is:

"(i) Required by the Secretary in connection with determining whether a covered entity is in compliance with this subchapter; or

"(ii) To the individual who is the subject of the individually identifiable health information.

"(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable.

"(3) With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information.

"(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable.

"(5) With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration.

"(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.

" Relates to the privacy of individually identifiable health information means, with respect to a [s]tate law, that the [s]tate law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way.

" State law means a constitution, statute, regulation, rule, common law, or other [s]tate action having the force and effect of law." (Emphasis in original.)

With respect to the remainder of the pending motions, the trial court first denied, on the basis of its previous preemption determinations, the plaintiff's motion for summary judgment, which had claimed that the defendant's conduct in responding to the subpoena violated the HIPAA regulations, specifically 45 C.F.R. § 164.512(e), as a matter of law. The trial court denied, however, the defendant's motion for summary judgment with respect to the remaining counts of the complaint, namely, count one alleging breach of contract and count three alleging negligent misrepresentation, determining that genuine issues of material fact existed with respect to contract formation through the defendant's privacy policy, and whether the plaintiff had received and relied upon that policy. Thus, the trial court denied the defendant's motion for summary judgment as to counts one and three of the complaint, and dismissed counts two and four of the complaint for lack of subject matter jurisdiction. This appeal followed. See footnote 3 of this opinion.

Title 45 of the Code of Federal Regulations, § 164.512, provides in relevant part: "A covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity's information and the individual's agreement may be given orally.

"(a) Standard: Uses and disclosures required by law. (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

"(2) A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law.

On appeal, the plaintiff claims that the trial court improperly determined that HIPAA preempted her negligence based state law claims. Conceding that there is no private right of action under HIPAA, the plaintiff asserts that she is not asserting a claim for relief premised solely on a violation of HIPAA, but rather, relies heavily on Merrell Dow Pharmaceuticals, Inc. v. Thompson, 478 U.S. 804, 106 S.Ct. 3229, 92 L.Ed.2d 650 (1986), Acosta v. Byrum, 180 N.C.App. 562, 638 S.E.2d 246 (2006), and R.K. v. St. Mary's Medical Center, Inc., 229 W.Va. 712, 735 S.E.2d 715 (2012), cert. denied, --- U.S. ----, 133 S.Ct. 1738, 185 L.Ed.2d 788 (2013), in support of the proposition that common-law negligence actions, with HIPAA informing the standard of care, may complement rather than "obstruct" HIPAA for preemption purposes. Citing, inter alia, Mead v. Burns, 199 Conn. 651, 662-63, 509 A.2d 11 (1986), and Wendland v. Ridgefield Construction Services, Inc., 184 Conn. 173, 181, 439 A.2d 954 (1981), the plaintiff emphasizes that the use of other state law causes of action to enforce statutes otherwise lacking private rights of action has been upheld by this court in the analogous contexts of the Connecticut Unfair Insurance Practices Act, General Statutes § 38a-815 et seq., and the federal Occupational Safety and Health Act (OSHA), 29 U.S.C. § 651 et seq., and its state counterpart, General Statutes § 31-367 et seq. The plaintiff further argues that, under HIPAA and its implementing regulation; see 42 U.S.C. § 1320d-7 (a)(1); 45 C.F.R. § 160.202; her state law claims for relief are not preempted because it is not "contrary to" HIPAA to provide for damages under state common-law claims for privacy breaches.

In response, the defendant relies on the long line of federal and state cases establishing that there is no private right of action, express or implied, under HIPAA. See, e.g., O'Donnell v. Blue Cross Blue Shield of Wyoming, 173 F.Supp.2d 1176 (D.Wyo.2001); Fisher v. Yale University, supra, Superior Court, Docket No. X10-CV-04-4003207-S. Observing that "playing word games does not change the underlying theory of liability," the defendant relies on Young v. Carran, 289 S.W.3d 586 (Ky.App.2008), review denied, 2009 Ky. LEXIS 592 (Ky. August 19, 2009), and Bonney v. Stephens Memorial Hospital, 17 A.3d 123 (Me.2011), and contends that, because there is no private right of action under HIPAA, "a plaintiff cannot use a violation of HIPAA as the standard of care for underlying claims, such as negligence." The defendant further emphasizes that the plaintiff's negligence claim relying on § 52-146 o is preempted because HIPAA is more stringent than the state statute. Finally, the defendant also argues briefly, in what appears to be either alternative grounds for affirming the judgment of the trial court or matters likely to arise on remand, that: (1) there is no private right of action under § 52-146 o; and (2) it was not obligated, as a matter of law, to inform the plaintiff that it had complied with a subpoena, and its compliance with the subpoena did not violate her privacy rights.

Similarly, the plaintiff also asks us, as a matter of judicial economy in the event of a remand, to determine, as a matter of law, whether the defendant's act of mailing the medical records into court in response to the subpoena complied with General Statutes § 52-143 and the federal regulatory provisions under HIPAA, namely, 45 C.F.R. § 164.512(e)(1)(ii) and (iii), with respect to notifying the plaintiff or seeking a qualified protective order. See footnote 12 of this opinion. We address this claim in part II A of this opinion.

We note at the outset that whether Connecticut's common law provides a remedy for a health care provider's breach of its duty of confidentiality, including in the context of responding to a subpoena, is not an issue presented in this appeal. Thus, assuming, without deciding, that Connecticut's common law recognizes a negligence cause of action arising from health care providers' breaches of patient privacy in the context of complying with subpoenas, we agree with the plaintiff and conclude that such an action is not preempted by HIPAA and, further, that the HIPAA regulations may well inform the applicable standard of care in certain circumstances.

For additional background discussion of health care providers' common-law duty to protect patient confidences, and the related cause of action, compare, for example, Biddle v. Warren General Hospital, 86 Ohio St.3d 395, 715 N.E.2d 518 (1999), with Quarles v. Sutherland, 215 Tenn. 651, 389 S.W.2d 249 (1965).

I

PREEMPTION CLAIMS

The defendant's claim that HIPAA preemption shifts the exclusive venue for the resolution of all disputes relating to that statute from the state court to the federal administrative forum implicates our subject matter jurisdiction. See, e.g., Stokes v. Norwich Taxi, LLC, 289 Conn. 465, 488 and n. 18, 958 A.2d 1195 (2008). As the trial court properly noted, the defendant's summary judgment essentially was a "motion to dismiss [that] ... properly attacks the jurisdiction of the court, essentially asserting that the plaintiff cannot as a matter of law and fact state a cause of action that should be heard by the court.... A motion to dismiss tests, inter alia, whether, on the face of the record, the court is without jurisdiction.... [O]ur review of the court's ultimate legal conclusion and resulting [determination] of the motion to dismiss will be de novo.... In undertaking this review, we are mindful of the well established notion that, in determining whether a court has subject matter jurisdiction, every presumption favoring jurisdiction should be indulged." (Citation omitted; internal quotation marks omitted.) Conboy v. State, 292 Conn. 642, 650, 974 A.2d 669 (2009); see also Practice Book § 10-31(a)(1).

Whether state causes of action are preempted by federal statutes and regulations is a question of law over which our review is plenary. See, e.g., Hackett v. J.L.G. Properties, LLC, 285 Conn. 498, 502-503, 940 A.2d 769 (2008). Thus, we note that "the ways in which federal law may [preempt] state law are well established and in the first instance turn on congressional intent.... Congress' intent to supplant state authority in a particular field may be express[ed] in the terms of the statute." (Internal quotation marks omitted.) Id. at 503, 940 A.2d 769; see also id. at 504, 940 A.2d 769 ("The question of preemption is one of federal law, arising under the supremacy clause of the United States constitution.... Determining whether Congress has exercised its power to preempt state law is a question of legislative intent." [Internal quotation marks omitted.] ).

Turning to the HIPAA provisions at issue in this appeal, we note by way of background that, "[r]ecognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996. HIPAA's Administrative Simplification provisions, [§§] 261 through 264 of [Public Law 104-191], were designed to improve the efficiency and effectiveness of the health care system by facilitating the exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, and health care providers who transmit information in connection with such transactions....

"Within the Administrative Simplification section, Congress included another provision-[§] 264-outlining a two-step process to address the need to afford certain protections to the privacy of health information maintained under HIPAA. First, [§] 264(a) directed [the department] to submit to Congress within twelve months of HIPAA's enactment 'detailed recommendations on standards with respect to the privacy of individually identifiable health information.' ... Second, if Congress did not enact further legislation pursuant to these recommendations within thirty-six months of the enactment of HIPAA, [the department] was to promulgate final regulations containing such standards." (Citations omitted; footnote omitted.) South Carolina Medical Assn. v. Thompson, 327 F.3d 346, 348 (4th Cir.), cert. denied, 540 U.S. 981, 124 S.Ct. 464, 157 L.Ed.2d 371 (2003). Because Congress ultimately failed to pass any additional legislation, the department's final regulations implementing HIPAA, known collectively as the "Privacy Rule," were "promulgated in February 2001," with compliance phased in over the next few years. Id. at 349.

"The Privacy Rule forbids an organization subject to its requirements (a 'covered entity') from using or disclosing an individual's health information ('protected health information') except as mandated or permitted by its provisions.... 'Covered entities' generally include health plans, health care clearinghouses and health care providers such as physicians, hospitals and HMOs.... 'Protected health information' encompasses any individually identifiable health information held or transmitted by a covered entity in any form or medium, whether electronic, paper or oral...." (Citations omitted.) Arons v. Jutkowitz, 9 N.Y.3d 393, 412-13, 880 N.E.2d 831, 850 N.Y.S.2d 345 (2007); id. (discussing, inter alia, 45 C.F.R. §§ 164.502[a][1], 164.512[e] ).

In the litigation context specifically, as reflected in 45 C.F.R. § 164.512(e)(1)(i) and (ii), the "Privacy Rule also permits covered entities to use or disclose protected health information without authorization pursuant to a court or administrative order so long as only the protected health information covered by the order is disclosed ... or in response to a subpoena, discovery request or other lawful process if the entity has received satisfactory assurances that the party seeking the disclosure has made reasonable efforts to ensure that the individual has been given notice of the request, or has made reasonable efforts to secure a qualified protective order from a court or administrative tribunal...." (Citations omitted.) Id. at 414, 850 N.Y.S.2d 345, 880 N.E.2d 831; see footnote 12 of this opinion for the text of 45 C.F.R. § 164.512(e).

With respect to the preemptive effect of HIPAA, 42 U.S.C. § 1320d-7 (a)(i) provides that: "Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form." (Emphasis added.) See footnote 1 of this opinion for the complete text of 42 U.S.C. § 1320d-7. The department's regulations, namely, 45 C.F.R. § 160.202 (2004) and 45 C.F.R. § 160.203, provide additional explication of HIPAA's preemptive effect. Specifically, 45 C.F.R. § 160.203 provides as a "general rule" that a "standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law." (Emphasis added.) A state law is "contrary" to HIPAA if "(1) A covered entity would find it impossible to comply with both the [s]tate and [f]ederal requirements; or (2) [t]he provision of [s]tate law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of [HIPPA], [§] 264 of [Public Law] 104-191, as applicable." (Emphasis added.) 45 C.F.R. § 160.202 (2004). The regulations define a "[s]tate law" as "a constitution, statute, regulation, rule, common law, or other [s]tate action having the force and effect of law." (Emphasis added.) 45 C.F.R. § 160.202 (2004).

As relevant to this appeal, state laws exempted from preemption include those that "[relate] to the privacy of individually identifiable health information and [are] more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter." (Emphasis added; footnote added.) 45 C.F.R. § 160.203(b). A state law is "[m]ore stringent" "in the context of a comparison of a provision of [s]tate law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, [if it] meets one or more of the following criteria:

Also exempted from preemption are: (1) provisions of state law approved by the secretary of the department subject to certain conditions; see 45 C.F.R. § 160.203(a); (2) a "provision of [s]tate law, including [s]tate procedures established under such law, as applicable, [which] provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention"; 45 C.F.R. § 160.203(c); and (3) a "provision of [s]tate law [that] requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals." 45 C.F.R. § 160.203(d).

"(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable....

"(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information." 45 C.F.R. § 160.202 (2004); see also footnote 11 of this opinion.

This statutory and regulatory background brings us to the question in the present appeal, namely, whether HIPAA preempts a state law claim sounding in negligence arising from a health care provider's alleged breach of physician-patient confidentiality in the course of complying with a subpoena. It is by now well settled that the "statutory structure of HIPAA ... precludes implication of a private right of action. [Section] 1320d-6 [of title 42 of the United States Code] expressly provides a method for enforcing its prohibition upon use or disclosure of individual's health information-the punitive imposition of fines and imprisonment for violations." (Footnote added.) University of Colorado Hospital Authority v. Denver Publishing Co., 340 F.Supp.2d 1142, 1145 (D.Colo.2004); see also, e.g., 42 U.S.C. § 1320d-5 (providing for administrative enforcement by department and state attorneys general); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir.2010); Acara v. Banks, 470 F.3d 569, 571 (5th Cir.2006); Rzayeva v. United States, 492 F.Supp.2d 60, 83 (D.Conn.2007); O'Donnell v. Blue Cross Blue Shield of Wyoming, supra, 173 F.Supp.2d at 1180-81.

Title 42 of the United States Code, § 1320d-6 provides: "(a) Offense

"A person who knowingly and in violation of this part-

"(1) uses or causes to be used a unique health identifier;

"(2) obtains individually identifiable health information relating to an individual; or

"(3) discloses individually identifiable health information to another person,

"shall be punished as provided in subsection (b) of this section. For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d-9 (b)(3) of this title) and the individual obtained or disclosed such information without authorization.

"(b) Penalties

"A person described in subsection (a) of this section shall-

"(1) be fined not more than $50,000, imprisoned not more than [one] year, or both;

"(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than [five] years, or both; and

"(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than [ten] years, or both."

Nevertheless, it is similarly well established that, "[o]rdinarily, state causes of action are not [preempted] solely because they impose liability over and above that authorized by federal law." (Internal quotation marks omitted.) English v. General Electric Co., 496 U.S. 72, 89, 110 S.Ct. 2270, 110 L.Ed.2d 65 (1990); see also id. at 87-90, 110 S.Ct. 2270 (state tort claim for intentional infliction of emotional distress arising from termination of whistleblower not preempted by federal legislation intended to occupy field of nuclear safety, even with statutes' provision of administrative remedy for whistleblower violations). As a corollary, "a complaint alleging a violation of a federal statute as an element of a state cause of action, when Congress has determined that there should be no private, federal cause of action for the violation, does not state a claim 'arising under the [c]onstitution, laws, or treaties of the United States' " for purposes of federal question jurisdiction under 28 U.S.C. § 1331. Merrell Dow Pharmaceuticals, Inc. v. Thompson, supra, 478 U.S. at 817, 106 S.Ct. 3229; see also Grable & Sons Metal Products, Inc. v. Darue Engineering & Mfg., 545 U.S. 308, 319, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005) ( "[a] general rule of exercising federal jurisdiction over state claims resting on federal mislabeling and other statutory violations would thus have heralded a potentially enormous shift of traditionally state cases into federal courts").

Consistent with these principles, the regulatory history of the HIPAA demonstrates that neither HIPAA nor its implementing regulations were intended to preempt tort actions under state law arising out of the unauthorized release of a plaintiff's medical records. As the plaintiff aptly notes, one commenter during the rulemaking process had "raised the issue of whether a private right of action is a greater penalty, since the proposed federal rule has no comparable remedy." Standards for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82,462, 82,582 (December 28, 2000). In its administrative commentary to the final rule as promulgated in the Federal Register, the department responded to this question by stating, inter alia, that "the fact that a state law allows an individual to file [a civil action] to protect privacy does not conflict with the HIPAA penalty provisions," namely, fines and imprisonment. (Emphasis added.) Id. This agency commentary on final rules in the Federal Register is significant evidence of regulatory intent. See, e.g., Exelon Generation Co., LLC v. Local 15, International Brotherhood of Electrical Workers, AFL-CIO, 676 F.3d 566, 573-75 (7th Cir.2012); Southeast Alaska Conservation Council v. United States Army Corps of Engineers, 486 F.3d 638, 648 (9th Cir.2007), rev'd on other grounds sub nom. Coeur Alaska, Inc. v. Southeast Alaska Conservation Council, 557 U.S. 261, 129 S.Ct. 2458, 174 L.Ed.2d 193 (2009). Indeed, "[w]here an agency has authoritatively interpreted its own rule, courts generally defer to that reading unless it is plainly erroneous or inconsistent with the regulation." (Internal quotation marks omitted.) Exelon Generation Co., LLC v. Local 15, International Brotherhood of Electrical Workers, AFL-CIO, supra, at 570.

This question had been raised in connection with proposed language for 45 C.F.R. § 160.202 that would have specifically defined the application of the phrase "more stringent" in a variety of contexts, including stating that "more stringent" means, "[w]ith respect to penalties, provides greater penalties." (Emphasis added.) Standards for Privacy of Individually Identifiable Health Information, 64 Fed.Reg. 59,918, 60,051 (November 3, 1999); see also id., at p. 59,997 (explaining department's initial decision to provide specific definitions). In the commentary to the final rule, the department stated that it had "reconsidered the proposed 'penalty' provision of the proposed definition of 'more stringent' and have eliminated it. The HIPAA statute provides for only two types of penalties: fines and imprisonment. Both types of penalties could be imposed in addition to the same type of penalty imposed by a state law, and should not interfere with the imposition of other types of penalties that may be available under state law. Thus, we think it is unlikely that there would be a conflict between state and federal law in this respect, so that the proposed criterion is unnecessary and confusing." Standards for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82,462, 82,582 (December 28, 2000).

Consistent with this regulatory history, the parties' briefs and our independent research disclose a number of cases from the federal and sister state courts holding that HIPAA, and particularly its implementation through the Privacy Rule regulations, does not preempt causes of action, when they exist as a matter of state common or statutory law, arising from health care providers' breaches of patient confidentiality in a variety of contexts; indeed, several have determined that HIPAA may inform the relevant standard of care in such actions. See but cf. I.S. v. Washington University, United States District Court, Docket No. 4:11CV235SNLJ, 2011 WL 2433585 (E.D.Mo. June 14, 2011) (The court rejected the defendant's argument that the "negligence per se" count of the plaintiff's complaint, premised on HIPAA violations, "in reality is a claim for violation of HIPAA, which is impermissible under federal law," but remanding claim to state court because it "does not raise any compelling federal interest nor is a substantial federal question presented. Although HIPAA is clearly implicated in the claim for negligence per se, said claim fall[s] within that broad class of state law claims based on federal regulations in the state court...." [Internal quotation marks omitted.] ); Harmon v. Maury County, United States District Court, Docket No. 1:05CV0026, 2005 WL 2133697 (M.D.Tenn. August 31, 2005) (concluding that plaintiffs' negligence per se claims founded on violation of HIPAA privacy regulation were not preempted because "HIPAA's provisions do not completely preempt state law and expressly preserve state laws that are not inconsistent with its terms" and "there is no private remedy under federal law and the critical interest is the privacy interests of the [p]laintiffs"); Fanean v. Rite Aid Corp. of Delaware, Inc., 984 A.2d 812, 823 (Del.Super.2009) (concluding that claim of negligence per se could not be premised on HIPAA violation, but following Toll Bros., Inc. v. Considine, 706 A.2d 493 [Del.1998], holding "that a common law negligence claim can be predicated upon OSHA requirements," in concluding that common-law negligence claim could utilize HIPAA as "guidepost for determining the standard of care"); Young v. Carran, supra, 289 S.W.3d at 588-89 (rejecting plaintiff's attempt to use HIPAA as foundation for damages claim under state "negligence per se" statute, but observing that state case law permits use of federal statutes otherwise to inform standard of care in common-law negligence action); Bonney v. Stephens Memorial Hospital, supra, 17 A.3d at 128 ("[a]lthough ... HIPAA standards, like state laws and professional codes of conduct, may be admissible to establish the standard of care associated with a state tort claim, [HIPAA] itself does not authorize a private action"); Yath v. Fairview Clinics, N.P., 767 N.W.2d 34, 49-50 (Minn.App.2009) (concluding that state statutory cause of action for improper disclosure of medical records was not preempted by HIPAA because "[a]lthough the penalties under the two laws differ, compliance with [the Minnesota statute] does not exclude compliance with HIPAA," and "[r]ather than creating an 'obstacle' to HIPAA, [the Minnesota statute] supports at least one of HIPAA's goals by establishing another disincentive to wrongfully disclose a patient's health care record"); Acosta v. Byrum, supra, 180 N.C.App. at 571-73, 638 S.E.2d 246 (The court concluded that the trial court improperly dismissed the negligent infliction of emotional distress case because the allegation that, when the psychiatrist "provided his medical access code ... [he] violated the rules and regulations established by HIPAA ... does not state a cause of action under HIPAA. Rather, [the] plaintiff cites to HIPAA as evidence of the appropriate standard of care, a necessary element of negligence."); Sorensen v. Barbuto, 143 P.3d 295, 299 n. 2 (Utah App.2006) (The court noted that, in concluding that the trial court improperly dismissed the plaintiff's claim for breach of professional duties, that the defendant physician "contends that [the plaintiff] is not entitled to a private right of action for breach of professional standards," but that the plaintiff "does not contend in his brief, however, that a private right of action exists. Rather, [the plaintiff] asserts that the professional standards contribute to the proper standard of care, citing [HIPAA], the American Medical Association's Principles of Medical Ethics, and the Hippocratic Oath."); R.K. v. St. Mary's Medical Center, Inc., supra, 229 W.Va. at 719-21, 735 S.E.2d 715 (concluding that state law claims for, inter alia, negligence, outrageous conduct, and invasion of privacy arising from defendant hospital staff's disclosure of plaintiff's psychiatric treatment records to his wife's divorce attorney, were not preempted by HIPAA and that goals of common-law remedies and HIPAA "are similar" in that "both protect the privacy of an individual's health care information"); Espinoza v. Gold Cross Services, Inc., 234 P.3d 156, 158-59 (Utah App.2010) (contrasting similar actions brought under California's unfair competition statute and declining to consider HIPAA copy fee schedules in concluding that plaintiff's common-law unjust enrichment claim arising from defendant's allegedly excessive copying fees failed because "[w]e have no basis in state or federal law to enforce federal regulations promulgated under HIPAA, either directly or as a component of a state cause of action").

We also note the body of case law establishing that, in the absence of a private right of action under HIPAA, the federal courts lack jurisdiction to remove actions containing a state law claim relying on HIPAA to support the standard of care. This body of case law indicates HIPAA's failure to preempt state law causes of action by implication. See Hearn v. Reynolds, 876 F.Supp.2d 798, 799-800 (S.D.Miss.2012) (remanding removed case to state court because, although complaint stated that "publications amounted to HIPAA violations," "HIPAA creates no private right of action" and complaint indicated that plaintiff "is concerned primarily with an intent to injure his standing in the community rather than a disclosure of his medical history"); Baum v. Keystone Mercy Health Plan, 826 F.Supp.2d 718, 721 (E.D.Pa.2011) (remanding removed case to state court although HIPAA "is implicated because the federal statute requires [d]efendants to 'reasonably safeguard protected health information,' such as the information on the misplaced USB drive, 'from any intentional or unintentional use or disclosure' ... this is a fairly straightforward state-law tort case" with claims of negligence, negligence per se and violations of Pennsylvania's unfair trade practices statute); K.V. v. Women's Healthcare Network, LLC, United States District Court, Docket No. 07-0228-CV-W-DW, 2007 WL 1655734 (W.D.Mo. June 6, 2007) (The court remanded the removed case, claiming negligence and negligence per se arising from HIPAA violations, to the state court because "the parties concede that various courts around the country have determined that there is no express or implied private cause of action under HIPAA. Additionally, the state law claim raised in [c]ount [9] does not raise a substantial federal question of great federal interest. The privacy standards imposed by HIPAA are not uniquely federal and do not raise any issue of great federal interest."); Harmon v. Maury County, United States District Court, Docket No. 1:05CV0026, 2005 WL 2133697 (M.D.Tenn. August 31, 2005) (The court remanded the removed case to the state court because, although the plaintiffs' negligence per se claims cited HIPAA privacy regulation, "Congress did not provide an exclusive federal remedy under HIPAA and HIPAA does not completely preempt state law. There is no compelling federal interest nor is a substantial federal question presented. [The] [p]laintiffs' claims fall within that broad class of state law claims based on federal regulations in the state court, as described in [ Grable & Sons Metal Products, Inc. v. Darue Engineering & Mfg., supra, 545 U.S. at 308, 125 S.Ct. 2363].").

We find misplaced the defendant's reliance on the Kentucky decision in Young v. Carran, supra, 289 S.W.3d at 586, and the Maine decision in Bonney v. Stephens Memorial Hospital, supra, 17 A.3d at 123. The court in Young held only that HIPAA does not provide a private right of action-a proposition not challenged by the plaintiff in this appeal-and that the HIPAA regulations could not be used to support a negligence per se claim because of a Kentucky statute that previously had been interpreted by the state's Supreme Court to limit negligence per se claims to violations only of Kentucky state statutes. See Young v. Carran, supra, at 588-89, citing T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526, 530 (Ky.2006). Indeed, the Kentucky court indicated that a properly pleaded claim of negligence, rather than negligence per se, could be founded on federal regulatory violations, noting that, in T & M Jewelry, Inc., the Kentucky Supreme Court had "used provisions of the federal Gun Control Act of 1968 to define a duty of care for purposes of a common law negligence action-not a ... negligence per se claim." Young v. Carran, supra, at 589.

Bonney similarly held only that HIPAA did not afford the plaintiffs therein a private right of action, and specifically noted that "HIPAA standards, like state laws and professional codes of conduct, may be admissible to establish the standard of care associated with a state tort claim," which is precisely what the plaintiff in this appeal seeks to do. Bonney v. Stephens Memorial Hospital, supra, 17 A.3d at 127-28.

Finally, we disagree with the defendant's attempt to diminish the Utah Court of Appeals decision in Sorensen v. Barbuto, supra, 143 P.3d at 299 n. 2, which had rejected the claim that the plaintiff was "not entitled to a private right of action for breach of professional standards," which included "HIPAA, the American Medical Association's Principles of Medical Ethics, and the Hippocratic Oath." The Utah court emphasized that the plaintiff therein did not contend that those provisions afforded him a private right of action, but "[r]ather ... that the professional standards contribute to the proper standard of care...." Id. Plainly implicit in this conclusion is that it is proper in Utah to utilize HIPAA as evidence of the standard of care in negligence actions.

On the basis of the foregoing authorities, we conclude that, if Connecticut's common law recognizes claims arising from a health care provider's alleged breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA and its implementing regulations do not preempt such claims. We further conclude that, to the extent it has become the common practice for Connecticut health care providers to follow the procedures required under HIPAA in rendering services to their patients, HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to such claims arising from allegations of negligence in the disclosure of patients' medical records pursuant to a subpoena. The availability of such private rights of action in state courts, to the extent that they exist as a matter of state law, do not preclude, conflict with, or complicate health care providers' compliance with HIPAA. On the contrary, negligence claims in state courts support "at least one of HIPAA's goals by establishing another disincentive to wrongfully disclose a patient's health care record." Yath v. Fairview Clinics, N.P., supra, 767 N.W.2d at 50. Accordingly, we conclude that the trial court improperly dismissed counts two and four of the plaintiff's complaint, sounding in negligence and negligent infliction of emotional distress.

Although it is not entirely clear from her brief, the record, or the allegations in the operative complaint whether the plaintiff seeks to use the HIPAA regulations simply as evidence of the standard of care, or as a basis for negligence per se, this lack of clarity does not affect our preemption analysis. We note, however, that whether the particular HIPAA regulations at issue are suitable for use as a legislatively imposed standard of care for purposes of establishing negligence per se is a potentially complex question of law that has not been adequately briefed by the parties herein, and therefore, is one that we need not decide in this appeal. See, e.g., Gore v. People's Savings Bank, 235 Conn. 360, 380, 665 A.2d 1341 (1995) ("[i]n deciding whether the legislature intended to provide for such statutory liability, we look to the language of the statute and to the legislative history and purposes underlying the provision's enactment").

II

OTHER CLAIMS

Beyond the preemption issue, the parties raise two other matters that require attention because they may provide us with an opportunity to address issues that are likely to arise on remand or potentially provide an alternative basis for affirming the judgment of the trial court, at least in part. See, e.g., Total Recycling Services of Connecticut, Inc. v. Connecticut Oil Recycling Services, LLC, 308 Conn. 312, 325, 63 A.3d 896 (2013). Specifically, we address: (1) the parties' request that we determine whether the defendant was negligent as a matter of law by not informing the plaintiff of the subpoena and by mailing the plaintiff's medical records into court; and (2) the defendant's argument that it is entitled to summary judgment on the plaintiff's state statutory claims because § 52-146 o does not provide a private right of action.

A

We first note that the plaintiff asks us, as a matter of judicial economy in the event of a remand, to determine, as a matter of law, whether the defendant's act of mailing the medical records into court in response to the subpoena complied with General Statutes § 52-143 and the federal regulatory provisions under HIPAA, namely, 45 C.F.R. § 164.512(e)(1)(ii) and (iii), with respect to notifying the plaintiff or seeking a qualified protective order. See footnote 12 of this opinion. In response, the defendant, relying on the deposition testimony of its HIPAA consultant, contends that its act of mailing the records to the Probate Court complied with Connecticut and federal law, as its staff complied with the directions of the attorney who had issued the subpoena and its privacy policy had unequivocally informed the plaintiff that it would use or disclose health information in response to a subpoena without patient authorization or the opportunity to object. The defendant posits that the true responsibility for the breach of the plaintiff's privacy lies with the members of the Probate Court staff who did not seal the records upon receipt pending a court order making them available to counsel.

Given the apparently undeveloped factual record at this point, and the fact that the plaintiff's breach of contract and negligent misrepresentation claims remain pending, requiring further proceedings before the trial court; see footnote 3 of this opinion; we decline to address this claim further, other than to note that state court pretrial practices must be HIPAA compliant; see, e.g., Law v. Zuckerman, 307 F.Supp.2d 705, 710-11 (D.Md.2004); Arons v. Jutkowitz, 9 N.Y.3d 393, 415, 880 N.E.2d 831, 850 N.Y.S.2d 345 (2007); a requirement that extends to responses to subpoenas. See State v. La Cava, Superior Court, judicial district of Danbury, Docket No. CR-06-0128258-S, 2007 WL 1599888 (May 17, 2007) (43 Conn. L. Rptr. 417, 418) (The trial court granted the hospital's motion to quash the subpoena of the hospital records requested pursuant to General Statutes § 4-104 because "delivery of the hospital record to the clerk of court authorized by § 4-104 constitutes a transfer of protected health information to an outside entity. Yet, under 45 C.F.R. § 164.512[e][1][ii], a hospital cannot transfer protected health information to an outside entity without receiving the satisfactory assurances set forth in 45 C.F.R. § 164.512[e][1][ii][A] or [B], or complying with the requirements of 45 C.F.R. § 164.512[e][1][vi]. Hence, a covered entity would find it impossible to comply with § 4-104 without violating 45 C.F.R. § 164.512[e].").

B

We next turn to the defendant's argument, founded on the Superior Court's decision in Meade v. Orthopedic Associates of Windham County, supra, Superior Court, Docket No. CV-06-4005043-S, that it is entitled to summary judgment on the plaintiff's state law statutory claims under § 52-146 o because that statute does not provide a private right of action. The plaintiff does not contend otherwise in her reply brief. Indeed, her arguments on other points therein suggest that her claims in this case are limited to violations of the state common law. We decline to reach the defendant's statutory argument because we do not read the plaintiff's complaint as asserting a statutory right of action under § 52-146 o. Accordingly, we take no position on whether § 52-146 o provides a statutory right of action.

"The interpretation of pleadings is always a question of law for the court.... Our review of the trial court's interpretation of the pleadings therefore is plenary.... Furthermore, we long have eschewed the notion that pleadings should be read in a hypertechnical manner. Rather, [t]he modern trend, which is followed in Connecticut, is to construe pleadings broadly and realistically, rather than narrowly and technically.... [T]he complaint must be read in its entirety in such a way as to give effect to the pleading with reference to the general theory upon which it proceeded, and do substantial justice between the parties.... Our reading of pleadings in a manner that advances substantial justice means that a pleading must be construed reasonably, to contain all that it fairly means, but carries with it the related proposition that it must not be contorted in such a way so as to strain the bounds of rational comprehension.... Although essential allegations may not be supplied by conjecture or remote implication ... the complaint must be read in its entirety in such a way as to give effect to the pleading with reference to the general theory upon which it proceeded, and do substantial justice between the parties.... As long as the pleadings provide sufficient notice of the facts claimed and the issues to be tried and do not surprise or prejudice the opposing party, we will not conclude that the complaint is insufficient to allow recovery." (Citations omitted; internal quotation marks omitted.) Grenier v. Commissioner of Transportation, 306 Conn. 523, 536-37, 51 A.3d 367 (2012).

The operative complaint asserts four counts, each captioned with a common-law cause of action, namely, (1) breach of contract, (2) negligence, (3) negligent misrepresentation, and (4) negligent infliction of emotional distress. The alleged violation of § 52-146 o is mentioned once as a specification of negligence in count two, negligence, which is incorporated by reference into count four, stating that "the defendant was negligent and [careless] in one or more of the following ways.... It disclosed the medical file, without authority, in violation of ... § 52-146 o." In context, with all of the captioned causes of action arising from the common law, we read this single mention of § 52-146 o as providing one of several bases for establishing the standard of care applicable to the plaintiff's common-law negligence claims and not as asserting an independent cause of action. See footnote 22 of this opinion and accompanying text. Thus, we conclude that the plaintiff's complaint does not plead a statutory cause of action arising under § 52-146 o, and decline to decide whether that statute provides such a private right of action.

The judgment is reversed and the case is remanded to the trial court for further proceedings according to law. In this opinion PALMER, EVELEIGH, McDONALD and VERTEFEUILLE, Js., concurred.

ZARELLA, J., with whom ROGERS, C.J., joins, concurring in part and dissenting in part.

I agree with parts I and II A of the majority opinion. I respectfully disagree, however, with the majority's decision in part II B of the opinion not to reach and decide the defendant's statutory claim. The majority concludes that the plaintiff did not assert an independent claim under General Statutes § 52-146 o because that claim is contained in counts two and four of the amended complaint alleging negligence and negligent infliction of emotional distress, respectively, instead of in a separate count. In my view, however, the majority indulges in an overly technical reading of counts two and four that is inconsistent with the modern view of pleading, which rejects a narrow, formalistic reading of the pleadings in favor of construing pleadings broadly and applying common sense. See, e.g., Fuessenich v. DiNardo, 195 Conn. 144, 150-51, 487 A.2d 514 (1985); Bombero v. Marchionne, 11 Conn.App. 485, 496, 528 A.2d 396 ( Borden, J., dissenting), cert. denied, 205 Conn. 801, 529 A.2d 719 (1987); DeMartin v. Yale-New Haven Hospital, 4 Conn.App. 387, 390, 494 A.2d 1222, cert. denied, 197 Conn. 813, 499 A.2d 62 (1985). I thus believe that counts two and four, in which one of the plaintiff's assertions is that the defendant "disclosed the medical file, without authority, in violation of ... § 52-146 o," directly allege a violation of the statute, and the fact that the allegation is not contained in a separate count is immaterial because the trial court and the parties have treated counts two and four throughout the proceedings as asserting a statutory violation. Accordingly, I believe that the statutory claim was properly raised and should have been decided by this court.

I finally emphasize that, because this court has determined that the issue of whether Connecticut's common law provides a remedy for a health care provider's breach of its duty of confidentiality in the course of complying with a subpoena has not been raised, the issue remains unresolved, which leaves the parties and the trial court to determine the most appropriate course of action as the litigation proceeds.

* * *

"(e) Standard: Disclosures for judicial and administrative proceedings.-(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:

"(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or

"(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:

"(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or

"(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.

"(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

"(A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);

"(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and

"(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and:

"( 1) No objections were filed; or

"( 2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.

"(iv) For the purposes of paragraph (e)(1)(ii)(B) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

"(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or

"(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.

"(v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

"(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and

"(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

"(vi) Notwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(iv) of this section.

"(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information...." (Emphasis in original.)

* * *

# data[].attributes.attachment_link.title
Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C, 102 A.3d 32 | Casetext

# data[].attributes.attachment_link.description
Reversed and remanded. Zarella, J., filed opinion concurring in part and dissenting in part, joined by Rogers, C.J. Bruce L. Elstein, Bridgeport, with whom, on the brief, was Henry Elstein, Bridgeport, for the appellant (plaintiff). James F. Biondo, with whom, on the brief, was Audrey D. Medd, Stamford, for the appellee (defendant).

# data[].attributes.body
Texas' Privacy Policy

The Department of State Health Services’ Privacy Policy, in compliance with the Texas Medical Privacy Act, requires covered entities to provide employee training regarding the maintenance and protection of PHI. Training must be customized to the entities' operations as well as the employee’s scope of employment. The law also requires Texas to publish patients’ privacy rights, a list of state agencies that govern covered entities with contact information, and each agency’s complaint enforcement process. Other provisions under the Privacy Policy include consequences of violations of compliance, breaches of PHI, and penalties (25 T.A.C. § 1.501).

# data[].attributes.attachment_link.readable_text
(a) Purpose. (1) The purpose of this section is to inform individuals of the department's privacy practices and establish department procedures to allow individuals to exercise their rights under the federal Standards for Privacy of Individually Identifiable Health Information, 45 Code of Federal Regulations (C.F.R.) Parts 160 and 164, which were promulgated to implement the Health Insurance Portability and Accountability Act of 1996 (HIPAA). (2) The department is a hybrid entity as that term is defined in 45 C.F.R. §164.103. The department has designated its health care components in accordance with 45 C.F.R. §164.105(a)(2)(iii)(C). Unless otherwise specified, this section applies only to the designated health care components within the department. (b) Definitions. Unless otherwise specified, terms have the meaning assigned by 45 C.F.R. §160.103, §164.103, and §164.501, or their common use meaning. (1) Department--The Department of State Health Services. (2) Designated health care component--A program or office within the department that performs services or functions as a covered entity. (4) Health and Human Services (HHS) System--Interchangeably known as the HHS Enterprise, the coordinating entity providing common direction for the five agencies that comprise it are as follows: (A) Health and Human Services Commission (HHSC); (B) Department of Aging and Disability Services (DADS); (C) Department of Assistive and Rehabilitative Services (DARS); (D) Department of Family and Protective Services (DFPS); and (E) Department of State Health Services (DSHS). (5) Protected health information (PHI)--Individually identifiable health information about an individual, including demographic information, which relates to the individual's past, present, or future physical or mental health condition, provision of health care, or payment for the provision of health care. (6) Record--Any item, collection, or grouping of information that includes PHI and is created, maintained, collected, used, or disseminated by or for a designated health care component of the department. (c) Right to notice of privacy practices. (1) An individual has the right to receive notice of how the department uses and discloses PHI and of the individual's rights and the department's duties with respect to PHI. (2) A designated health care component of the department where an individual receives services shall post the notice of privacy practices in a prominent location. (d) Right of access to protected health information. (1) An individual has the right to view or obtain a copy of PHI about the individual for as long as the PHI is maintained by the department. (2) An individual shall follow the Public Information Act, Government Code, Chapter 552, and the department's procedures in §1.251 of this title (relating to Procedures for Handling Requests for Public Information) to access and obtain copies of PHI about the individual held by the department. Requests that are submitted by entities or by persons authorized by state or federal law to obtain an individual's medical or behavioral health records, which were created within department mental health facilities, other state hospitals, clinics, or laboratories are excluded from following the requirements of the Public Information Act. (3) The department shall follow the time requirements and access procedures in the Public Information Act and in §1.251 of this title to provide access to and copies of records under this section. (4) The department shall charge the same amount for copies of records under this section as charged for copies under the Public Information Act and §1.251 of this title or as specified by other state or federal law. (6) If the denial is reviewable, the department shall provide the individual with instructions in a denial letter about how to request a review of the decision. (e) Right to request an amendment to a designated record set. (1) An individual has the right to request an amendment to PHI about the individual in a designated record set. (2) An individual shall follow the procedures in §1.503 of this title (relating to an Individual's Right to Correction of Incorrect Information) to request an amendment to PHI in a designated record set. (3) The department shall follow the procedures in §1.504 of this title (relating to Correction Procedure) for amendments to designated record sets under this section. (4) The department may deny a request for amendment for any of the following reasons: (A) the department could deny access to the information under subsection (d) of this section; (B) the department did not create the information; (C) the information is not contained in a designated record set; or (D) the information is correct and complete. (5) If the request for amendment is denied, the department shall send a letter explaining the decision and include instructions on how the individual can submit a written statement of disagreement with the department's decision. The written statement must contain specific facts that explain the basis for the disagreement. (f) Right to receive an accounting of certain disclosures made by a designated health care component of the department. (1) An individual has the right to receive an accounting of certain disclosures of the individual's PHI made by a designated health care component of the department. (2) The types of disclosures that must be included in the accounting are described in 45 C.F.R. §164.528. (3) An individual may submit a written request for a list of the designated health care components of the department to the department's Privacy Officer at the Privacy Officer's electronic mail address at hipaa.privacy@dshs.state.tx.us or by mail to the DSHS Privacy Officer, Mail Code 1915, P.O. Box 149347, Austin, Texas 78714-9347. (4) An individual may submit a written request for an accounting of certain disclosures of the individual's PHI made by a designated health care component of the department to either: (A) the designated health care component of the department that is in possession of the individual's PHI; or (B) the department's Privacy Officer at the Privacy Officer's electronic mail address at hipaa.privacy@dshs.state.tx.us or by mail to the DSHS HIPAA Privacy Officer, Mail Code 1915, P.O. Box 149347, Austin, Texas 78714-9347. (5) A request for a report submitted to the department's Privacy Officer must include the name(s) of the designated health care component of the department from which a report is requested. (g) Right to request further limits on uses and disclosures of protected health information. (1) An individual has the right to request that the department restrict its uses and disclosures of PHI about the individual; however, the department is not required to agree to any restrictions that are not required by law, rule, or regulation. (2) An individual may submit a written request for restrictions of uses and disclosures to the department's Privacy Officer at the Privacy Officer's electronic mail address at hipaa.privacy@dshs.state.tx.us or by mail to the DSHS HIPAA Privacy Officer, Mail Code 1915, P.O. Box 149347, Austin, Texas 78714-9347. (h) Right to request confidential communication from a designated health care component of the department by different means or at different locations. (1) An individual has the right to submit a written request that the individual receive communications of PHI from a designated health care component of the department in a way and in a place that is most appropriate for the individual. The written request must specify the reasonable accommodations that are required and the designated health care component of the department to which the request relates. (2) An individual may submit a written request for accommodation to: (A) the designated health care component of the department that is in possession of the individual's PHI; or (B) the department's Privacy Officer at the Privacy Officer's electronic mail address at hipaa.privacy@dshs.state.tx.us or by mail to the DSHS Privacy Officer, Mail Code 1915, P.O. Box 149347, Austin, Texas 78714-9347. (3) The department shall provide a written approval or denial of the request for accommodation. (i) Complaints. (1) An individual has the right to complain about the department's privacy policies or how the department complies with its privacy policies related to PHI. (3) An individual may download a copy of a complaint form and instructions on how to file it at: (A) the department's HIPAA Internet web site at http://www.dshs.state.tx.us/hipaa/privacycomplaints.shtm; or (B) the U.S. Department Health and Human Services, OCR's Internet web site at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html. (j) Uses and disclosures of protected health information among HHS System agencies, and other state agencies. (1) As authorized or required by law, programs or offices among HHS System agencies, and other state agencies may share PHI as necessary to accomplish the public health, health care oversight, business, and other essential functions of the HHS System, and other state agencies. (2) The department shall use and disclose PHI within the department in accordance with the applicable requirements in 45 C.F.R. §164.504, and federal and state statutes that require the department to protect the confidentiality of PHI.

# data[].attributes.attachment_link.description
(a) Purpose. (1) The purpose of this section is to inform individuals of the department's privacy practices and establish department procedures to allow individuals to exercise their rights under the federal Standards for Privacy of Individually Identifiable Health Information, 45 Code of Federal Regulations (C.F.R.)

# data[].attributes.body
HCSC's Code of Ethics and Conduct

HCSC’s Code of Ethics and Conduct requires its employees to protect the PHI of it members, providers, and its own employees. The Code emphasizes protection of this information, both internally and externally, to avoid improper use and disclosure, violations of federal and state laws, and violation of the organization’s agreements with customers and government agencies (Health Care Service Corporation, 2018).

# data[].attributes.body
This presentation provides an overview of the basics of HIPAA. Topics include the background and purpose of the HIPAA Privacy Rule, how HIPAA applies to those in the health care industry, a glossary of HIPAA terms, and consequences of failure to comply. The presentation is designed for those in patient care settings; however, the information provided is succinct and informative for all industries subject to HIPAA compliance (Medical Protective, 2015).

# data[].attributes.body
The following are recommendations/best practices for maintaining compliance with HIPAA regulations at the federal, state, and local levels. These measures should be included in training and practices across the organization.

Safeguards for access to patient information , such as encryption and password protection, for various types of devices (Becker, 2017).

Frequently evaluate policies and procedures to ensure documentation is up to date (Becker, 2017).

Only supply the minimum amount of information necessary for inquiries of a legitimate business need.

Limit business processes focusing on sensitive information to specific roles or severity levels.

Personal initiative to remain current on HIPAA policies and regulations.

Regular internal review of policies and compliance audits (M. Lawrence, personal communication, December 6, 2019).

Keep training relevant to the employee's role with less focus on the background and history of HIPAA (HIPAA Journal, 2019).

# data[].attributes.body
America's Health Insurance Plans (2019). AHIP responds to HHS RFI on modifying HIPAA rules to improve care coordination. Retrieved from https://www.ahip.org/ahip-responds-to-hhs-rfi-on-modifying-hipaa-rules-to-improve-care-coordination/

Becker, B. (2017, May 16). Questions and answers to improve security and avoid penalties. Retrieved from https://www.hipaajournal.com/hipaa-compliance-best-practices-8809/

Emily Byrne v. Avery Center for Obstetrics and Gynecology, P.C., 314 Conn. 433 (2014).

Health Care Service Corporation (2018). Code of Ethics and Conduct § 3.1. Retrieved from http://www.hcsc.com/pdf/hcsc_code_conduct.pdf

Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 264, 110 Stat. 1936-2103(1996).

HIPAA Journal (2018, December 21). $853,000 awarded to patient whose PHI was impermissibly disclosed to former boyfriend. Retrieved from https://www.hipaajournal.com/853000-awarded-to-patient-whose-phi-was-impermissibly-disclosed-to-former-boyfriend/

HIPAA Journal (2019). HIPAA training requirements. Retrieved from https://www.hipaajournal.com/hipaa-training-requirements/

Medical Protective (2015). HIPAA basic privacy training. Retrieved from https://www.medpro.com/documents/10502/3281585/HIPAA+Basics+2015.pdf

Privacy of Health Information under the Health Insurance Portability and Accountability Act of 1996, 25 Tex. Admin. Code § 1.501 (2012).

Privacy of Individually Identifiable Health Information, 45 C.F.R. § 164.500-534 (2013).

U.S. Const. amend. IV

Wagenen, J.V. (2019, February 19). 4 important items on your 2019 HIPAA compliance checklist. Retrieved from https://healthtechmagazine.net/article/2019/02/4-important-items-your-2019-hipaa-compliance-checklist-perfcon

Wilder, M., Otto, P., & Kwong, K. (2019, October 21).

OCR provides insight into enforcement priorities and breach trends. Retrieved from https://www.hldataprotection.com/2019/10/articles/health-privacy-hipaa/ocr-provides-insight-into-enforcement-priorities-and-breach-trends/