Skip to Content

Rule

Standards for Privacy of Individually Identifiable Health Information

Document Details

Information about this document as published in the Federal Register.

Published Document

This document has been published in the Federal Register. Use the PDF linked in the document sidebar for the official electronic format.

Start Preamble Start Printed Page 12434

AGENCY:

Office for Civil Rights, HHS.

ACTION:

Final rule; correction of effective and compliance dates.

SUMMARY:

This action corrects the effective date of the final rules adopting standards for privacy of individually identifiable health information published on December 28, 2000, in the Federal Register (65 FR 82462), resulting in a new effective date of April 14, 2001. The change in the effective date delays, by operation of law, the compliance dates published in the final rules. The compliance dates in the final rules are revised accordingly.

DATES:

1. The effective date of the Standards for Privacy of Individually Identifiable Health Information published in the Federal Register on December 28, 2000, at 65 FR 82462 as amended by this final rule is April 14, 2001.

2. The revision to 45 CFR 164.534 is effective April 14, 2001.

Start Further Info

FOR FURTHER INFORMATION CONTACT:

Kimberly Coleman, 1-866-OCR-PRIV (1-866-627-7748) or TTY 1-866-788-4989.

End Further Info End Preamble Start Supplemental Information

SUPPLEMENTARY INFORMATION:

On December 28, 2000, we published in the Federal Register final rules adopting standards for the privacy of individually identifiable health information (Privacy Rule). The Privacy Rule is the second in a series of rules mandated by sections 261-264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. In general, the Privacy Rule establishes in 45 CFR Part 160 a set of definitions applicable to the entire set of HIPAA rules, requirements for requesting that a state law be excepted from preemption by the statute, and compliance and enforcement requirements. The Privacy Rule also establishes a new Subpart E of Part 164. Subpart E establishes standards which entities covered by the statute—health plans, health care clearinghouses, and certain health care providers—are required to comply with to protect the privacy of certain individually identifiable health information (“protected health information”). The standards establish requirements relating to the uses and disclosures of protected health information, the rights of individuals with respect to their protected health information, and the procedures for exercising those rights.

We have determined that the report to the Congress required by 5 U.S.C. 801(a)(1) was not received, as previously thought, concurrent with the transmission of the Rule to the Federal Register. The required report was received by the Congress on February 13, 2001. Under 5 U.S.C. 801(a)(3)(A), the effective date of a major rule is, as pertinent here, “the later of the date occurring 60 days after the date on which * * * the Congress receives the [required] report * * *, or * * * the rule is published in the Federal Register * * *”. Thus, the published effective date, which was 60 days following the date of publication of the Rule in the Federal Register, is erroneous; rather, under 5 U.S.C. 801(a)(3)(A), the actual effective date of the Privacy Rule is 60 days after the receipt by the Congress of the final rule, or April 14. This final rule corrects the previously published effective date of the Privacy Rule accordingly.

Because the correction of the effective date is required by law, we find good cause under 5 U.S.C. 553(b)(3)(B) and 553(d)(3) to waive public comment thereon and to make the correction effective immediately upon publication today in the Federal Register.

Under section 1175 of the Social Security Act, 42 U.S.C. 1320d-4, enacted by section 262 of HIPAA, most covered entities have two years following initial adoption of a HIPAA standard to come into compliance with the standard; small health plans have three years. Since a HIPAA standard is adopted when the rule adopting it becomes effective, the change in effective date, by operation of law, has the effect of moving the statutory compliance dates forward by a commensurate period. As the compliance dates are part of the text of the Privacy Rule (45 CFR 164.534), they are being amended to reflect the change in the effective date.

This amendment is technical in nature and is required by statute, in light of the change of the effective date of the Privacy Rule. Consequently, we find that good causer under 5 U.S.C. 553(b)(3)(B) exists for waiving prior public comment on the revision to § 164.534.

Start List of Subjects

List of Subjects

End List of Subjects Start Signature

Dated: February 22, 2001.

Tommy G. Thompson,

Secretary.

End Signature Start Amendment Part

For the reasons set forth in the preamble, § 164.534 of title 45, Code of Federal Regulations, is amended as follows:

End Amendment Part Start Amendment Part

1. The authority citation for Subpart E of 45 Code of Federal Regulations Part 164 is revised to read as follows:

End Amendment Part Start Authority

Authority: 42 U.S.C. 1320d-2 and 1320d-4, sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)).

End Authority Start Amendment Part

2. Section 164.534 of Subpart E of 45 Code of Federal Regulations Part 164 is revised to read as follows:

End Amendment Part
Compliance dates for initial implementation of the privacy standards.

(a) Health care providers. A covered health care provider must comply with the applicable requirements of this subpart no later than April 14, 2003.

(b) Health plans. A health plan must comply with the applicable requirements of this subpart no later than the following as applicable:

(1) Health plans other han small health plans. April 14, 2003.

(2) Small health plans. April 14, 2004.

(c) Health clearinghouses. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 14, 2003.

End Supplemental Information

[FR Doc. 01-4810 Filed 2-23-01; 1:00 pm]

BILLING CODE 4150-04-M