Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0945-AA03

Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules

AGENCY:

Office for Civil Rights, Department of Health and Human Services.

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or “the Department”) is issuing this final rule to: Modify the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Enforcement Rules to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act (“the HITECH Act” or “the Act”) to strengthen the privacy and security protection for individuals' health information; modify the rule for Breach Notification for Unsecured Protected Health Information (Breach Notification Rule) under the HITECH Act to address public comment received on the interim final rule; modify the HIPAA Privacy Rule to strengthen the privacy protections for genetic information by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA); and make certain other modifications to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (the HIPAA Rules) to improve their workability and effectiveness and to increase flexibility for and decrease burden on the regulated entities.

DATES:

Effective date:

This final rule is effective on March 26, 2013.

Compliance date:

Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013.

FOR FURTHER INFORMATION CONTACT:

Andra Wicks 202-205-2292.

SUPPLEMENTARY INFORMATION:

I. Executive Summary and Background

A. Executive Summary

i. Purpose of the Regulatory Action

Need for the Regulatory Action

This final rule is needed to strengthen the privacy and security protections established under the Health Insurance Portability and Accountability of 1996 Act (HIPAA) for individual's health information maintained in electronic health records and other formats. This final rule also makes changes to the HIPAA rules that are designed to increase flexibility for and decrease burden on the regulated entities, as well as to harmonize certain requirements with those under the Department's Human Subjects Protections regulations. These changes are consistent with, and arise in part from, the Department's obligations under Executive Order 13563 to conduct a retrospective review of our existing regulations for the purpose of identifying ways to reduce costs and increase flexibilities under the HIPAA Rules. We discuss our specific burden reduction efforts more fully in the Regulatory Impact Analysis.

This final rule is comprised of four final rules, which have been combined to reduce the impact and number of times certain compliance activities need to be undertaken by the regulated entities.

Legal Authority for the Regulatory Action

The final rule implements changes to the HIPAA Rules under a number of authorities. First, the final rule modifies the Privacy, Security, and Enforcement Rules to strengthen privacy and security protections for health information and to improve enforcement as provided for by the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA). The rule also includes final modifications to the Breach Notification Rule, which will replace an interim final rule originally published in 2009 as required by the HITECH Act. Second, the final rule revises the HIPAA Privacy Rule to increase privacy protections for genetic information as required by the Genetic Information Nondiscrimination Act of 2008 (GINA). Finally, the Department uses its general authority under HIPAA to make a number of changes to the Rules that are intended to increase workability and flexibility, decrease burden, and better harmonize the requirements with those under other Departmental regulations.

ii. Summary of Major Provisions

This omnibus final rule is comprised of the following four final rules:

1. Final modifications to the HIPAA Privacy, Security, and Enforcement Rules mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act, and certain other modifications to improve the Rules, which were issued as a proposed rule on July 14, 2010. These modifications:

• Make business associates of covered entities directly liable for compliance with certain of the HIPAA Privacy and Security Rules' requirements.

• Strengthen the limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of protected health information without individual authorization.

• Expand individuals' rights to receive electronic copies of their health information and to restrict disclosures to a health plan concerning treatment for which the individual has paid out of pocket in full.

• Require modifications to, and redistribution of, a covered entity's notice of privacy practices.

• Modify the individual authorization and other requirements to facilitate research and disclosure of child immunization proof to schools, and to enable access to decedent information by family members or others.

• Adopt the additional HITECH Act enhancements to the Enforcement Rule not previously adopted in the October 30, 2009, interim final rule (referenced immediately below), such as the provisions addressing enforcement of noncompliance with the HIPAA Rules due to willful neglect.

2. Final rule adopting changes to the HIPAA Enforcement Rule to incorporate the increased and tiered civil money penalty structure provided by the HITECH Act, originally published as an interim final rule on October 30, 2009.

3. Final rule on Breach Notification for Unsecured Protected Health Information under the HITECH Act, which replaces the breach notification rule's “harm” threshold with a more objective standard and supplants an interim final rule published on August 24, 2009.

4. Final rule modifying the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act (GINA) to prohibit most health plans from using or disclosing genetic information for underwriting purposes, which was published as a proposed rule on October 7, 2009.

iii. Costs and Benefits

This final rule is anticipated to have an annual effect on the economy of $100 million or more, making it an economically significant rule under Executive Order 12866. Accordingly, we have prepared a Regulatory Impact Analysis that presents the estimated costs and benefits of the proposed rule. The total cost of compliance with the rule's provisions is estimated to be between $114 million and $225.4 million in the first year of implementation and approximately $14.5 million annually thereafter. Costs associated with the rule include: (i) Costs to HIPAA covered entities of revising and distributing new notices of privacy practices to inform individuals of their rights and how their information is protected; (ii) costs to covered entities related to compliance with breach notification requirements; (iii) costs to a portion of business associates to bring their subcontracts into compliance with business associate agreement requirements; and (iv) costs to a portion of business associates to achieve full compliance with the Security Rule. We summarize these costs in Table 1 below and explain the components and distribution of costs in detail in the Regulatory Impact Analysis.

We are not able to quantify the benefits of the rule due to lack of data and the impossibility of monetizing the value of individuals' privacy and dignity, which we believe will be enhanced by the strengthened privacy and security protections, expanded individual rights, and improved enforcement enabled by the rule. We also believe that some entities affected by the rule will realize cost savings as a result of provisions that simplify and streamline certain requirements, and increase flexibility, under the HIPAA Rules. However, we are unable to quantify such cost savings due to a lack of data. We describe such benefits in the Regulatory Impact Analysis.

Table 1—Estimated Costs of the Final Rule

Cost element

Approximate number of affected entities

Total cost

Notices of Privacy Practices

700,000 covered entities

$55.9 million.

Breach Notification Requirements

19,000 covered entities

14.5 million.

1

Business Associate Agreements

250,000-500,000 business associates of covered entities

21 million-42 million.

Security Rule Compliance by Business Associates

200,000-400,000 business associates of covered entities

22.6 million-113 million.

Total

114 million-225.4 million.

B. Statutory and Regulatory Background

i. HIPAA and the Privacy, Security, and Enforcement Rules

The

HIPAA Privacy, Security, and Enforcement Rules implement certain of the Administrative Simplification provisions of title II, subtitle F, of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), which added a new part C to title XI of the Social Security Act (sections 1171-1179 of the Social Security Act, 42 U.S.C. 1320d-1320d-8). The HIPAA Administrative Simplification provisions provided for the establishment of national standards for the electronic transmission of certain health information, such as standards for certain health care transactions conducted electronically and code sets and unique identifiers for health care providers and employers. The HIPAA Administrative Simplification provisions also required the establishment of national standards to protect the privacy and security of personal health information and established civil money penalties for violations of the Administrative Simplification provisions. The Administrative Simplification provisions of HIPAA apply to three types of entities, which are known as “covered entities”: health care providers who conduct covered health care transactions electronically, health plans, and health care clearinghouses.

1

The costs associated with breach notification will be incurred on an annual basis. All other costs are expected in the first year of implementation.

The HIPAA Privacy Rule, 45 CFR Part 160 and Subparts A and E of Part 164, requires covered entities to have safeguards in place to ensure the privacy of protected health information, sets forth the circumstances under which covered entities may use or disclose an individual's protected health information, and gives individuals rights with respect to their protected health information, including rights to examine and obtain a copy of their health records and to request corrections. Covered entities that engage business associates to work on their behalf must have contracts or other arrangements in place with their business associates to ensure that the business associates safeguard protected health information, and use and disclose the information only as permitted or required by the Privacy Rule.

The HIPAA Security Rule, 45 CFR Part 160 and Subparts A and C of Part 164, applies only to protected health information in electronic form and requires covered entities to implement certain administrative, physical, and technical safeguards to protect this electronic information. Like the Privacy Rule, covered entities must have contracts or other arrangements in place with their business associates that provide satisfactory assurances that the business associates will appropriately safeguard the electronic protected health information they create, receive, maintain, or transmit on behalf of the covered entities.

The HIPAA Enforcement Rule, 45 CFR Part 160, Subparts C-E, establishes rules governing the compliance responsibilities of covered entities with respect to the enforcement process, including the rules governing investigations by the Department, rules governing the process and grounds for establishing the amount of a civil money penalty where a violation of a HIPAA Rule has been found, and rules governing the procedures for hearings and appeals where the covered entity challenges a violation determination.

Since the promulgation of the HIPAA Rules, legislation has been enacted requiring modifications to the Rules. In particular, the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted on February 17, 2009, as title XIII of division A and title IV of division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Public Law 111-5, modifies certain provisions of the Social Security Act pertaining to the HIPAA Rules, as well as requires certain modifications to the Rules themselves, to strengthen HIPAA privacy, security, and enforcement. The

Act also provides new requirements for notification of breaches of unsecured protected health information by covered entities and business associates. In addition, the Genetic Information Nondiscrimination Act of 2008 (GINA) calls for changes to the HIPAA Privacy Rule to strengthen privacy protections for genetic information. This final rule implements the modifications required by GINA, as well as most of the privacy, security, and enforcement provisions of the HITECH Act. This final rule also includes certain other modifications to the HIPAA Rules to improve their workability and effectiveness.

ii. The Health Information Technology for Economic and Clinical Health Act

The HITECH Act is designed to promote the widespread adoption and interoperability of health information technology. Subtitle D of title XIII, entitled “Privacy,” supports this goal by adopting amendments designed to strengthen the privacy and security protections for health information established by HIPAA. These provisions include extending the applicability of certain of the Privacy and Security Rules' requirements to the business associates of covered entities; requiring that Health Information Exchange Organizations and similar organizations, as well as personal health record vendors that provide services to covered entities, shall be treated as business associates; requiring HIPAA covered entities and business associates to provide for notification of breaches of “unsecured protected health information”; establishing new limitations on the use and disclosure of protected health information for marketing and fundraising purposes; prohibiting the sale of protected health information; and expanding individuals' rights to access their protected health information, and to obtain restrictions on certain disclosures of protected health information to health plans. In addition, subtitle D adopts provisions designed to strengthen and expand HIPAA's enforcement provisions.

We discuss these statutory provisions in more detail below where we describe section-by-section how this final rule implements the provisions. We do not address in this rulemaking the accounting for disclosures requirement in section 13405 of the Act, which is the subject of a separate proposed rule published on May 31, 2011, at 76 FR 31426, or the penalty distribution methodology requirement in section 13410(c) of the Act, which will be the subject of a future rulemaking.

Since enactment of the HITECH Act a number of steps have been taken to implement the strengthened privacy, security, and enforcement provisions through rulemakings and related actions. On August 24, 2009, the Department published interim final regulations to implement the breach notification provisions at section 13402 of the HITECH Act (74 FR 42740), which were effective September 23, 2009. Similarly, the Federal Trade Commission (FTC) published final regulations implementing the breach notification provisions at section 13407 for personal health record vendors and their third party service providers on August 25, 2009 (74 FR 42962), effective September 24, 2009. For purposes of determining to what information the HHS and FTC breach notification regulations apply, the Department also issued, first on April 17, 2009 (published on April 27, 2009, 74 FR 19006), and then later with its interim final rule, the guidance required by the HITECH Act under 13402(h) specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Additionally, to conform the provisions of the Enforcement Rule to the HITECH Act's tiered and increased civil money penalty structure, which became effective on February 18, 2009, the Department published an interim final rule on October 30, 2009 (74 FR 56123), effective November 30, 2009.

The Department published a notice of proposed rulemaking (NPRM) on July 14, 2010, (75 FR 40868) to implement many of the remaining privacy, security, and enforcement provisions of the HITECH Act. The public was invited to comment on the proposed rule for 60 days following publication. The comment period closed on September 13, 2010. The Department received about 300 comments on the NPRM.

The NPRM proposed to extend the applicability of certain of the Privacy and Security Rules' requirements to the business associates of covered entities, making business associates directly liable for violations of these requirements. Additionally, the NPRM proposed to define a subcontractor as a business associate to ensure any protected health information the subcontractor creates or receives on behalf of the business associate is appropriately safeguarded. The NPRM proposed to establish new limitations on the use and disclosure of protected health information for marketing and fundraising purposes and to prohibit the sale of protected health information without an authorization. The NPRM also proposed to expand an individual's right to obtain an electronic copy of an individual's protected health information, and the right to restrict certain disclosures of protected health information to a health plan for payment or health care operations purposes. In addition, the NPRM proposed to further modify the Enforcement Rule to implement more of the HITECH Act's changes to HIPAA enforcement.

In addition to the proposed modifications to implement the HITECH Act, the NPRM also proposed certain other modifications to the HIPAA Rules. The NPRM proposed to permit the use of compound authorizations for conditioned and unconditioned research activities and requested comment regarding permitting authorizations for future research. Additionally, the NPRM proposed to modify the Privacy Rule's application to the individually identifiable health information of decedents and to permit covered entities that obtain the agreement of a parent to provide proof of immunization without written authorization to schools that are required to have such information.

iii. The Genetic Information Nondiscrimination Act

The Genetic Information Nondiscrimination Act of 2008 (“GINA”), Pub. L. 110-233, 122 Stat. 881, prohibits discrimination based on an individual's genetic information in both the health coverage (Title I) and employment (Title II) contexts. In addition to the nondiscrimination provisions, section 105 of Title I of GINA contains new privacy protections for genetic information, which require the Secretary of HHS to revise the Privacy Rule to clarify that genetic information is health information and to prohibit group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes.

On October 7, 2009, the Department published a proposed rule to strengthen the privacy protections for genetic information under the HIPAA Privacy Rule by implementing the protections for genetic information required by GINA and making related changes to the Rule. The 60-day public comment period for the proposed rule closed on December 7, 2009. The Department received about 25 comments on the proposed rule.

II. Overview of the Final Rule

In this final rule the Department finalizes the modifications to the HIPAA Privacy, Security, and Enforcement Rules to implement many of the

privacy, security, and enforcement provisions of the HITECH Act and make other changes to the Rules; modifies the Breach Notification Rule; finalizes the modifications to the HIPAA Privacy Rule to strengthen privacy protections for genetic information; and responds to the public comments received on the proposed and interim final rules. Section III below describes the effective and compliance dates of the final rule. Section IV describes the changes to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act and other modifications that were proposed in July 2010, as well as the modifications to the Enforcement Rule under the HITECH Act that were addressed in the interim final rule published in October 2009. Section V describes the changes to the Breach Notification Rule. Section VI discusses the changes to the HIPAA Privacy Rule to strengthen privacy protections for genetic information.

III. Effective and Compliance Dates

With respect to the HITECH Act requirements, section 13423 of the Act provides that the provisions in subtitle D took effect one year after enactment, i.e., on February 18, 2010, except as specified otherwise. However, there are a number of exceptions to this general rule. For example, the tiered and increased civil money penalty provisions of section 13410(d) were effective for violations occurring after the date of enactment, and sections 13402 and 13407 of the Act regarding breach notification required interim final rules within 180 days of enactment, with effective dates 30 days after the publication of such rules. Other provisions of the Act have later effective dates. For example, the provision at section 13410(a)(1) of the Act providing that the Secretary's authority to impose a civil money penalty will only be barred to the extent a criminal penalty has been imposed, rather than in cases in which the offense in question merely constitutes an offense that is criminally punishable, became effective for violations occurring on or after February 18, 2011. The discussion below generally pertains to the statutory provisions that became effective on February 18, 2010, or, in a few cases, on a later date.

Proposed Rule

We proposed that covered entities and business associates would have 180 days beyond the effective date of the final rule to come into compliance with most of the rule's provisions. We believed that a 180-day compliance period would suffice for future modifications to the HIPAA Rules, and we proposed to add a provision at § 160.105 to address the compliance date generally for implementation of new or modified standards in the HIPAA Rules. We proposed that § 160.105 would provide that with respect to new standards or implementation specifications or modifications to standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates would be required to comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. For future modifications to the HIPAA Rules necessitating a longer compliance period, we would specify a longer period in the regulatory text. Finally, we proposed to retain the compliance date provisions at §§ 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively, for historical purposes only.

Overview of Public Comments

Most of the comments addressing the proposed compliance periods as outlined above fell into three categories. First, several commenters supported the proposed compliance timelines and agreed that 180 days is sufficient time for covered entities, business associates, and subcontractors of all sizes to come into compliance with the final rule. Second, a few commenters supported the proposed 180-day compliance period, but expressed concern that the Department may wish to extend the 180-day compliance period in the future, if it issues modifications or new provisions that require a longer compliance period. Third, several commenters requested that the Department extend the 180-day compliance period both with regard to the modifications contained in this final rule and with regard to the more general proposed compliance deadline, as they believe 180 days is an insufficient amount of time for covered entities, business associates, and subcontractors to come into compliance with the modified rules, particularly with regard to changes in technology.

Final Rule

The final rule is effective on March 26, 2013. Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to come into compliance with most of the final rule's provisions, including the modifications to the Breach Notification Rule and the changes to the HIPAA Privacy Rule under GINA. We understand that some covered entities, business associates, and subcontractors remain concerned that a 180-day period does not provide sufficient time to come into compliance with the modifications. However, we believe not only that providing a 180-day compliance period best comports with section 1175(b)(2) of the Social Security Act, 42 U.S.C. 1320d-4, and our implementing provision at § 160.104(c)(1), which require the Secretary to provide at least a 180-day period for covered entities to comply with modifications to standards and implementation specifications in the HIPAA Rules, but also that providing a 180-day compliance period best protects the privacy and security of patient information, in accordance with the goals of the HITECH Act.

In addition, to make clear to the industry our expectation that going forward we will provide a 180-day compliance date for future modifications to the HIPAA Rules, we adopt the provision we proposed at § 160.105, which provides that with respect to new or modified standards or implementation specifications in the HIPAA Rules, except as otherwise provided, covered entities and business associates must comply with the applicable new or modified standards or implementation specifications no later than 180 days from the effective date of any such change. In cases where a future modification necessitates a longer compliance period, the Department will expressly provide for one, as it has done in this rulemaking with respect to the time permitted for business associate agreements to be modified.

For the reasons proposed, the final rule also retains the compliance date provisions at §§ 164.534 and 164.318, which provide the compliance dates of April 14, 2003, and April 20, 2005, for initial implementation of the HIPAA Privacy and Security Rules, respectively. We note that § 160.105 regarding the compliance date of new or modified standards or implementation specifications does not apply to modifications to the provisions of the HIPAA Enforcement Rule, because such provisions are not standards or implementation specifications (as the terms are defined at § 160.103). Such provisions are in effect and apply at the time the final rule becomes effective or as otherwise specifically provided. In addition, as explained above, our general rule for a 180-day compliance period for new or modified standards would not apply where we expressly provide a different compliance period in

the regulation for one or more provisions. For purposes of this rule, the 180-day compliance period would not govern the time period required to modify those business associate agreements that qualify for the longer transition period in § 164.532, as we discuss further below.

Finally, the provisions of section 13402(j) of the HITECH Act apply to breaches of unsecured protected health information discovered on or after September 23, 2009, the date of the publication of the interim final rule. Thus, during the 180 day period before compliance with this final rule is required, covered entities and business associates are still required to comply with the breach notification requirements under the HITECH Act and must continue to comply with the requirements of the interim final rule. We believe that this transition period provides covered entities and business associates with adequate time to come into compliance with the revisions in this final rule and at the same time to continue to fulfill their breach notification obligations under the HITECH Act.

IV. Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the HITECH Act; Other Modifications to the HIPAA Rules

The discussion below provides a section-by-section description of the final rule, as well as responds to public comments where substantive comments were received regarding particular provisions.

A. Subparts A and B of Part 160: Statutory Basis and Purpose, Applicability, Definitions, and Preemption of State Law

Subpart A of Part 160 of the HIPAA Rules contains general provisions that apply to all of the HIPAA Rules. Subpart B of Part 160 contains the regulatory provisions implementing HIPAA's preemption provisions. We proposed to amend a number of these provisions. Some of the proposed, and now final, changes are necessitated by the statutory changes made by the HITECH Act and GINA, while others are of a technical or conforming nature.

1. Subpart A—General Provisions, Section 160.101—Statutory Basis and Purpose

This section sets out the statutory basis and purpose of the HIPAA Rules. We proposed and include in this final rule a technical change to include references to the provisions of GINA and the HITECH Act upon which most of the regulatory changes below are based.

2. Subpart A—General Provisions, Section 160.102—Applicability

This section sets out to whom the HIPAA Rules apply. We proposed to add and include in this final rule a new paragraph (b) to make clear, consistent with the HITECH Act, that certain of the standards, requirements, and implementation specifications of the subchapter apply to business associates.

3. Subpart A—General Provisions, Section 160.103—Definitions

Section 160.103 contains definitions of terms that appear throughout the HIPAA Rules. The final rule modifies a number of these definitions to implement the HITECH Act and make other needed changes.

a. Definition of “Business Associate”

The HIPAA Privacy and Security Rules permit a covered entity to disclose protected health information to a business associate, and allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, provided the covered entity obtains satisfactory assurances in the form of a contract or other arrangement that the business associate will appropriately safeguard the information. The HIPAA Rules define “business associate” generally to mean a person who performs functions or activities on behalf of, or certain services for, a covered entity that involve the use or disclosure of protected health information. We proposed a number of modifications to the definition of “business associate” to implement the HITECH Act, to conform the term to the statutory provisions of the Patient Safety and Quality Improvement Act of 2005 (PSQIA), 42 U.S.C. 299b-21, et seq., and to make other changes to the definition.

i. Inclusion of Patient Safety Organizations

Proposed Rule

We proposed to add patient safety activities to the list of functions and activities a person may undertake on behalf of a covered entity that give rise to a business associate relationship. PSQIA, at 42 U.S.C. 299b-22(i)(1), provides that Patient Safety Organizations (PSOs) must be treated as business associates when applying the Privacy Rule. PSQIA provides for the establishment of PSOs to receive reports of patient safety events or concerns from providers and provide analyses of events to reporting providers. A reporting provider may be a HIPAA covered entity and, thus, information reported to a PSO may include protected health information that the PSO may analyze on behalf of the covered provider. The analysis of such information is a patient safety activity for purposes of PSQIA and the Patient Safety Rule, 42 CFR 3.10, et seq. While the HIPAA Rules as written would treat a PSO as a business associate when the PSO was performing quality analyses and other activities on behalf of a covered health care provider, we proposed this change to the definition of “business associate” to more clearly align the HIPAA and Patient Safety Rules.

Overview of Public Comment

Commenters on this topic supported the express inclusion of patient safety activities within the definition of “business associate.”

Final Rule

The final rule adopts the proposed modification.

ii. Inclusion of Health Information Organizations (HIO), E-Prescribing Gateways, and Other Persons That Facilitate Data Transmission; as Well as Vendors of Personal Health Records

Proposed Rule

Section 13408 of the HITECH Act provides that an organization, such as a Health Information Exchange Organization, E-prescribing Gateway, or Regional Health Information Organization, that provides data transmission of protected health information to a covered entity (or its business associate) and that requires access on a routine basis to such protected health information must be treated as a business associate for purposes of the Act and the HIPAA Privacy and Security Rules. Section 13408 also provides that a vendor that contracts with a covered entity to allow the covered entity to offer a personal health record to patients as part of the covered entity's electronic health record shall be treated as a business associate. Section 13408 requires that such organizations and vendors enter into a written business associate contract or other arrangement with the covered entity in accordance with the HIPAA Rules.

In accordance with the Act, we proposed to modify the definition of “business associate” to explicitly designate these persons as business associates. Specifically, we proposed to include in the definition: (1) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect

to protected health information to a covered entity and that requires routine access to such protected health information; and (2) a person who offers a personal health record to one or more individuals on behalf of a covered entity.

We proposed to refer to “Health Information Organization” in the NPRM rather than “Health Information Exchange Organization” as used in the Act because it is our understanding that “Health Information Organization” is the more widely recognized and accepted term to describe an organization that oversees and governs the exchange of health-related information among organizations.

2

The Act also specifically refers to Regional Health Information Organizations; however, we did not believe the inclusion of the term in the definition of “business associate” was necessary as a Regional Health Information Organization is simply a Health Information Organization that governs health information exchange among organizations within a defined geographic area.

3

Further, the specific terms of “Health Information Organization” and “E-prescribing Gateway” were included as merely illustrative of the types of organizations that would fall within this paragraph of the definition of “business associate.” We requested comment on the use of these terms within the definition and whether additional clarifications or additions were necessary.

2

Department of Health and Human Services Office of the National Coordinator for Health Information Technology, The National Alliance for Health Information Technology Report to the Office of the National Coordinator for Health Information Technology: Defining Key Health Information Terms, Pg. 24 (2008).

3

Id.

at 25.

Section 13408 also provides that the data transmission organizations that the Act requires to be treated as business associates are those that require access to protected health information on a routine basis. Conversely, data transmission organizations that do not require access to protected health information on a routine basis would not be treated as business associates. This is consistent with our prior interpretation of the definition of “business associate,” through which we have stated that entities that act as mere conduits for the transport of protected health information but do not access the information other than on a random or infrequent basis are not business associates. See

http://www.hhs.gov/ocr/privacy/hipaa/faq/providers/business/245.html

. In contrast, entities that manage the exchange of protected health information through a network, including providing record locator services and performing various oversight and governance functions for electronic health information exchange, have more than “random” access to protected health information and thus, would fall within the definition of “business associate.”

Overview of Public Comments

Commenters generally supported the inclusion of Health Information Organizations, personal health record vendors, and similar entities in the definition of “business associate.” However, commenters sought various clarifications as discussed below.

Commenters generally supported use of the term Health Information Organization in lieu of more restrictive terms, such as Regional Health Information Organization. Some commenters suggested that the term Health Information Organization be defined, so as to avoid confusion as the industry develops, and suggested various alternatives for doing so. Several commenters recommended that the Office for Civil Rights (OCR) maintain a Web site link that lists current terms for entities that OCR considers to be Health Information Organizations.

Other commenters requested clarification on what it means to have “access on a routine basis” to protected health information for purposes of the definition and determining whether certain entities are excluded as mere conduits. For example, commenters asked whether the definition of business associate would include broadband suppliers or internet service providers, vendors that only have the potential to come into contact with protected health information, or entities contracted on a contingency basis that may at some point in the future have access to protected health information. Several document storage companies argued that entities like theirs should be characterized as conduits, as they do not view the protected health information they store.

Several commenters sought clarification regarding when personal health record vendors would be considered business associates. For example, commenters asked whether personal health record vendors would be business associates when the vendor provided the personal health record in collaboration with the covered entity, when the personal health record is linked to a covered entity's electronic health record, or when the personal health record is offered independently to the individual, among other scenarios. One commenter suggested that a vendor offering a personal health record to a patient on behalf of a covered entity only acts as a conduit because there is no access by the vendor to protected health information; another commenter suggested that personal health record vendors be business associates only when they have routine access to protected health information.

Final Rule

The final rule adopts the language that expressly designates as business associates: (1) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires routine access to such protected health information; and (2) a person who offers a personal health record to one or more individuals on behalf of a covered entity.

We decline to provide a definition for Health Information Organization. We recognize that the industry continues to develop and thus the type of entities that may be considered Health Information Organizations continues to evolve. For this reason, we do not think it prudent to include in the regulation a specific definition at this time. We anticipate continuing to issue guidance in the future on our web site on the types of entities that do and do not fall within the definition of business associate, which can be updated as the industry evolves.

Regarding what it means to have “access on a routine basis” to protected health information with respect to determining which types of data transmission services are business associates versus mere conduits, such a determination will be fact specific based on the nature of the services provided and the extent to which the entity needs access to protected health information to perform the service for the covered entity. The conduit exception is a narrow one and is intended to exclude only those entities providing mere courier services, such as the U.S. Postal Service or United Parcel Service and their electronic equivalents, such as internet service providers (ISPs) providing mere data transmission services. As we have stated in prior guidance, a conduit transports information but does not access it other than on a random or infrequent basis as necessary to perform the transportation service or as required by other law. For example, a telecommunications company may have occasional, random access to protected health information when it reviews whether the data transmitted over its network is arriving

at its intended destination. Such occasional, random access to protected health information would not qualify the company as a business associate. In contrast, an entity that requires access to protected health information in order to perform a service for a covered entity, such as a Health Information Organization that manages the exchange of protected health information through a network on behalf of covered entities through the use of record locator services for its participants (and other services), is not considered a conduit and, thus, is not excluded from the definition of business associate. We intend to issue further guidance in this area as electronic health information exchange continues to evolve.

We note that the conduit exception is limited to transmission services (whether digital or hard copy), including any temporary storage of transmitted data incident to such transmission. In contrast, an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information. We recognize that in both situations, the entity providing the service to the covered entity has the opportunity to access the protected health information. However, the difference between the two situations is the transient versus persistent nature of that opportunity. For example, a data storage company that has access to protected health information (whether digital or hard copy) qualifies as a business associate, even if the entity does not view the information or only does so on a random or infrequent basis. Thus, document storage companies maintaining protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold. To help clarify this point, we have modified the definition of “business associate” to generally provide that a business associate includes a person who “creates, receives,

maintains,

or transmits” (emphasis added) protected health information on behalf of a covered entity.

Several commenters sought clarification on when a personal health record vendor would be providing a personal health record “on behalf of” a covered entity and thus, would be a business associate for purposes of the HIPAA Rules. As with data transmission services, determining whether a personal health record vendor is a business associate is a fact specific determination. A personal health record vendor is not a business associate of a covered entity solely by virtue of entering into an interoperability relationship with a covered entity. For example, when a personal health record vendor and a covered entity establish the electronic means for a covered entity's electronic health record to send protected health information to the personal health record vendor pursuant to the individual's written authorization, it does not mean that the personal health record vendor is offering the personal health record on behalf of the covered entity, even if there is an agreement between the personal health record vendor and the covered entity governing the exchange of data (such as an agreement specifying the technical specifications for exchanging of data or specifying that such data shall be kept confidential). In contrast, when a covered entity hires a vendor to provide and manage a personal health record service the covered entity wishes to offer its patients or enrollees, and provides the vendor with access to protected health information in order to do so, the personal health record vendor is a business associate.

A personal health record vendor may offer personal health records directly to individuals and may also offer personal health records on behalf of covered entities. In such cases, the personal health record vendor is only subject to HIPAA as a business associate with respect to personal health records that are offered to individuals on behalf of covered entities.

We also clarify that, contrary to one commenter's suggestion, a personal health record vendor that offers a personal health record to a patient on behalf of a covered entity does not act merely as a conduit. Rather, the personal health record vendor is maintaining protected health information on behalf of the covered entity (for the benefit of the individual). Further, a personal health record vendor that operates a personal health record on behalf of a covered entity is a business associate if it has access to protected health information, regardless of whether the personal health record vendor actually exercises this access. We believe the revisions to the definition of “business associate” discussed above clarify these points. As with other aspects of the definition of “business associate,” we intend to provide future guidance on when a personal health record vendor is a business associate for purposes of the HIPAA Rules.

Response to Other Public Comments

Comment:

One commenter recommended that the term “person” used in describing who provides transmission services to a covered entity be clarified to apply also to entities and organizations.

Response:

The term “person” as defined at § 160.103 includes entities as well as natural persons.

Comment:

One commenter asked whether subcontractors that support business associates with personal health record related functions are subject to the breach notification requirements under the HIPAA Breach Notification Rule or that of the FTC.

Response:

As discussed below, a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of a business associate, including with respect to personal health record functions, is a HIPAA business associate and thus, is subject to the HIPAA Breach Notification Rule and not that of the FTC. The analysis of whether a subcontractor is acting on behalf of a business associate is the same analysis as discussed above with respect to whether a business associate is acting on behalf of a covered entity.

iii. Inclusion of Subcontractors

Proposed Rule

We proposed in the definition of “business associate” to provide that subcontractors of a covered entity, i.e., those persons that perform functions for or provide services to a business associate other than in the capacity as a member of the business associate's workforce, are also business associates to the extent that they require access to protected health information. We also proposed to define “subcontractor” in § 160.103 as a person who acts on behalf of a business associate, other than in the capacity of a member of the workforce of such business associate. Even though we used the term “subcontractor,” which implies there is a contract in place between the parties, the definition would apply to an agent or other person who acts on behalf of the business associate, even if the business associate has failed to enter into a business associate contract with the person. We requested comment on the use of the term “subcontractor” and its proposed definition.

The intent of the proposed extension of the Rules to subcontractors was to avoid having privacy and security protections for protected health information lapse merely because a function is performed by an entity that is a subcontractor rather than an entity

with a direct relationship with a covered entity. Allowing such a lapse in privacy and security protections could allow business associates to avoid liability imposed upon them by sections 13401 and 13404 of the Act. Further, applying HIPAA privacy and security requirements directly to subcontractors also ensures that the privacy and security protections of the HIPAA Rules extend beyond covered entities to those entities that create or receive protected health information in order for the covered entity to perform its health care functions. Therefore, we proposed that downstream entities that work at the direction of or on behalf of a business associate and handle protected health information would also be required to comply with the applicable Privacy and Security Rule provisions in the same manner as the primary business associate, and likewise would incur liability for acts of noncompliance. This proposed modification would not require the covered entity to have a contract with the subcontractor; rather, the obligation would remain on each business associate to obtain satisfactory assurances in the form of a written contract or other arrangement that a subcontractor will appropriately safeguard protected health information. For example, if a business associate, such as a third party administrator, hires a company to handle document and media shredding to securely dispose of paper and electronic protected health information, then the shredding company would be directly required to comply with the applicable requirements of the HIPAA Security Rule (e.g., with respect to proper disposal of electronic media) and the Privacy Rule (e.g., with respect to limiting its uses and disclosures of the protected health information in accordance with its contract with the business associate).

Overview of Public Comments

While some commenters generally supported extending the business associate provisions of the Rules to subcontractors, many opposed such an extension arguing, among other things, that doing so was not the intent of Congress and beyond the statutory authority of the Department, that confusion may ensue with covered entities seeking to establish direct business associate contracts with subcontractors or prohibiting business associates from establishing subcontractor relationships altogether, and/or that creating direct liability for subcontractors will discourage such entities from operating and participating in the health care industry. Some commenters asked how far down the “chain” of subcontractors do the HIPAA Rules apply—i.e., do the Rules apply only to the first tier subcontractor or to all subcontractors down the chain.

In response to our request for comment on this issue, several commenters were concerned that use of the term subcontractor was confusing and instead suggested a different term be used, such as business associate contractor or downstream business associate, to avoid confusion between primary business associates of a covered entity and subcontractors. Other commenters suggested changes to the definition of subcontractor itself to better clarify the scope of the definition.

Several commenters requested specific guidance on who is and is not a subcontractor under the definitions of “business associate” and “subcontractor.” For example, one commenter asked whether an entity that shreds documents for a business associate for the business associate's activities and not for the covered entity, would qualify as a subcontractor. Another commenter asked whether disclosures by a business associate of protected health information for its own management and administration or legal needs creates a subcontractor relationship. Other commenters recommended that subcontractors without routine access to protected health information, or who do not access protected health information at all for their duties, not be considered business associates.

Final Rule

The final rule adopts the proposal to apply the business associate provisions of the HIPAA Rules to subcontractors and thus, provides in the definition of “business associate” that a business associate includes a “subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.” In response to comments, we clarify the definition of “subcontractor” in § 160.103 to provide that subcontractor means: “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.” Thus, a subcontractor is a person to whom a business associate has delegated a function, activity, or service the business associate has agreed to perform for a covered entity or business associate. A subcontractor is then a business associate where that function, activity, or service involves the creation, receipt, maintenance, or transmission of protected health information. We also decline to replace the term “subcontractor” with another, as we were not persuaded by any of the alternatives suggested by commenters (e.g., “business associate contractor,” “downstream business associate,” or “downstream entity”).

We disagree with the commenters that suggested that applying the business associate provisions of the HIPAA Rules to subcontractors is beyond the Department's statutory authority. In the HITECH Act, Congress created direct liability under the HIPAA Privacy and Security Rules for persons that are not covered entities but that create or receive protected health information in order for a covered entity to perform its health care functions, to ensure individuals' personal health information remains sufficiently protected in the hands of these entities. As stated in the NPRM, applying the business associate provisions only to those entities that have a direct relationship with a covered entity does not achieve that intended purpose. Rather, it allows privacy and security protections for protected health information to lapse once a subcontractor is enlisted to assist in performing a function, activity, or service for the covered entity, while at the same time potentially allowing certain primary business associates to avoid liability altogether for the protection of the information the covered entity has entrusted to the business associate. Further, section 13422 of the HITECH Act provides that each reference in the Privacy subtitle of the Act to a provision of the HIPAA Rules refers to such provision as in effect on the date of enactment of the Act

or to the most recent update of such provision

(emphasis added). Thus, the Act does not bar the Department from modifying definitions of terms in the HIPAA Rules to which the Act refers. Rather, the statute expressly contemplates that modifications to the terms may be necessary to carry out the provisions of the Act or for other purposes.

Further, we do not agree that covered entities will be confused and seek to establish direct business associate contracts with subcontractors or will prohibit business associates from engaging subcontractors to perform functions or services that require access to protected health information. The final rule makes clear that a covered entity is not required to enter into a contract or other arrangement with a business associate that is a subcontractor. See §§ 164.308(b)(1) and 164.502(e)(1)(i). In addition, as commenters did not present direct evidence to the contrary, we do not believe that covered entities will begin

prohibiting business associates from engaging subcontractors as a result of the final rule, in cases where they were not doing so before. Rather, we believe that making subcontractors directly liable for violations of the applicable provisions of the HIPAA Rules will help to alleviate concern on the part of covered entities that protected health information is not adequately protected when provided to subcontractors.

The Department also believes that the privacy and security protections for an individual's personal health information and associated liability for noncompliance with the Rules should not lapse beyond any particular business associate that is a subcontractor. Thus, under the final rule, covered entities must ensure that they obtain satisfactory assurances required by the Rules from their business associates, and business associates must do the same with regard to subcontractors, and so on, no matter how far “down the chain” the information flows. This ensures that individuals' health information remains protected by all parties that create, receive, maintain, or transmit the information in order for a covered entity to perform its health care functions. For example, a covered entity may contract with a business associate (contractor), the contractor may delegate to a subcontractor (subcontractor 1) one or more functions, services, or activities the business associate has agreed to perform for the covered entity that require access to protected health information, and the subcontractor may in turn delegate to another subcontractor (subcontractor 2) one or more functions, services, or activities it has agreed to perform for the contractor that require access to protected health information, and so on. Both the contractor and all of the subcontractors are business associates under the final rule to the extent they create, receive, maintain, or transmit protected health information.

With respect to requests for specific guidance on who is and is not a subcontractor, we believe the above changes to the definition provide further clarity. We also provide the following in response to specific comments. Disclosures by a business associate pursuant to § 164.504(e)(4) and its business associate contract for

its own

management and administration or legal responsibilities do not create a business associate relationship with the recipient of the protected health information because such disclosures are made outside of the entity's role as a business associate. However, for such disclosures that are not required by law, the Rule requires that the business associate obtain reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person notifies the business associate of any instances of which it is aware that the confidentiality of the information has been breached. See § 164.504(e)(4)(ii)(B).

In contrast, disclosures of protected health information by the business associate to a person who will assist the business associate in performing a function, activity, or service for a covered entity or another business associate may create a business associate relationship depending on the circumstances. For example, an entity hired by a business associate to appropriately dispose of documents that contain protected health information is also a business associate and subject to the applicable provisions of the HIPAA Rules. If the documents to be shredded do not contain protected health information, then the entity is not a business associate. We also clarify that the same interpretations that apply to determining whether a first tier contractor is a business associate also apply to determining whether a subcontractor is a business associate. Thus, our interpretation of who is and is not excluded from the definition of business associate as a conduit also applies in the context of subcontractors as well. We refer readers to the above discussion regarding transmission services and conduits.

iv. Exceptions to Business Associate

Proposed Rule

Sections 164.308(b)(2) and 164.502(e)(1)(ii) of the HIPAA Rules currently describe certain circumstances, such as when a covered entity discloses protected health information to a health care provider concerning the treatment of an individual, in which a covered entity is not required to enter into a business associate contract or other arrangement with the recipient of the protected health information. We proposed to move these provisions to the definition of “business associate” itself as exceptions to make clear that the Department does not consider the recipients of the protected health information in these circumstances to be business associates. The movement of these exceptions also was intended to help clarify that a person or an entity is a business associate if the person or entity meets the definition of “business associate,” even if a covered entity, or business associate with respect to a subcontractor, fails to enter into the required business associate contract with the person or entity.

Final Rule

The Department did not receive substantive public comment on this proposal. The final rule includes the exceptions within the definition of “business associate.”

v. Technical Changes to the Definition

Proposed Rule

For clarity and consistency, we also proposed to change the term “individually identifiable health information” in the current definition of “business associate” to “protected health information,” since a business associate has no obligation under the HIPAA Rules with respect to individually identifiable health information that is not protected health information.

Final Rule

The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modification to the definition. Additionally, as indicated above, we have revised the definition of business associate to clarify that a business associate includes an entity that “creates, receives, maintains, or transmits” protected health information on behalf of a covered entity. This change is intended to make the definition more consistent with language at § 164.308(b) of the Security Rule and § 164.502(e) of the Privacy Rule, as well as to clarify that entities that maintain or store protected health information on behalf of a covered entity are business associates, even if they do not actually view the protected health information.

vi. Response to Other Public Comments

Comment:

One commenter suggested that some covered entities do not treat third party persons that handle protected health information onsite as a business associate.

Response:

A covered entity may treat a contractor who has his or her duty station onsite at a covered entity and who has more than incidental access to protected health information as either a member of the covered entity's workforce or as a business associate for purposes of the HIPAA Rules.

Comment:

A few commenters asked for confirmation that researchers are not considered business associates. In addition, the Secretary's Advisory

Committee on Human Research Protections, in its November 23, 2010, letter to the Secretary providing comments on the NPRM, asked the Department to confirm that outsourced research review, approval, and continuing oversight functions (such as through using an external or independent Institutional Review Board) similarly do not give rise to a business associate relationship.

Response:

A person or entity is a business associate only in cases where the person or entity is conducting a function or activity regulated by the HIPAA Rules on behalf of a covered entity, such as payment or health care operations, or providing one of the services listed in the definition of “business associate,” and in the performance of such duties the person or entity has access to protected health information. Thus, an external researcher is not a business associate of a covered entity by virtue of its research activities, even if the covered entity has hired the researcher to perform the research. See

http://www.hhs.gov/ocr/privacy/hipaa/faq/business_associates/239.html

. Similarly, an external or independent Institutional Review Board is not a business associate of a covered entity by virtue of its performing research review, approval, and continuing oversight functions.

However, a researcher may be a business associate if the researcher performs a function, activity, or service for a covered entity that does fall within the definition of business associate, such as the health care operations function of creating a de-identified or limited data set for the covered entity. See paragraph (6)(v) of the definition of “health care operations.” Where the researcher is also the intended recipient of the de-identified data or limited data set, the researcher must return or destroy the identifiers at the time the business associate relationship to create the data set terminates and the researcher now wishes to use the de-identified data or limited data set (subject to a data use agreement) for a research purpose.

Comment:

A few commenters asked for clarification as to whether the business associate provisions applied to banking and financial institutions. Commenters sought clarification as to whether the exemption at § 1179 of the HIPAA statute for financial institutions was applicable to subcontractors.

Response:

This final rule is not intended to affect the status of financial institutions with respect to whether they are business associates. The HIPAA Rules, including the business associate provisions, do not apply to banking and financial institutions with respect to the payment processing activities identified in § 1179 of the HIPAA statute, for example, the activity of cashing a check or conducting a funds transfer. Section 1179 of HIPAA exempts certain activities of financial institutions from the HIPAA Rules, to the extent that these activities constitute authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments for health care or health plan premiums. However, a banking or financial institution may be a business associate where the institution performs functions above and beyond the payment processing activities identified above on behalf of a covered entity, such as performing accounts receivable functions on behalf of a health care provider.

We clarify that our inclusion of subcontractors in the definition of business associate does not impact the exclusion of financial institutions from the definition of “business associates” when they are only conducting payment processing activities that fall under § 1179 of the HIPAA statute. Accordingly, a business associate need not enter into a business associate agreement with a financial institution that is solely conducting payment activities that are excluded under § 1179.

Comment:

One commenter sought clarification of the status of a risk management group or malpractice insurance company that receives protected health information when contracted with a covered entity to mitigate the covered entity's risk and then contracts with legal groups to represent the covered entity during malpractice claims.

Response:

A business associate agreement is not required where a covered entity purchases a health plan product or other insurance, such as medical liability insurance, from an insurer. However, a business associate relationship could arise if the insurer is performing a function on behalf of, or providing services to, the covered entity that does not directly relate to the provision of insurance benefits, such as performing risk management or assessment activities or legal services for the covered entity, that involve access to protected health information.

b. Definition of “Electronic Media”

Proposed Rule

The term “electronic media” was originally defined in the Transactions and Code Sets Rule issued on August 17, 2000 (65 FR 50312) and was included in the definitions at § 162.103. That definition was subsequently revised and moved to § 160.103. The purpose of that revision was to clarify that the physical movement of electronic media from place to place is not limited to magnetic tape, disk, or compact disk, so as to allow for future technological innovation. We further clarified that transmission of information not in electronic form before the transmission (e.g., paper or voice) is not covered by this definition. See 68 FR 8339, Feb. 20, 2003.

In the NPRM, we proposed to revise the definition of “electronic media” in the following ways. First, we proposed to revise paragraph (1) of the definition to replace the term “electronic storage media” with “electronic storage material” to conform the definition of “electronic media” to its current usage, as set forth in the National Institute for Standards and Technology (NIST) “Guidelines for Media Sanitization” (

Definition of Medium,

NIST SP 800-88, Glossary B, p. 27 (2006)). The NIST definition, which was updated subsequent to the issuance of the Privacy and Security Rules, was developed in recognition of the likelihood that the evolution of the development of new technology would make use of the term “electronic storage media” obsolete in that there may be “storage material” other than “media” that house electronic data. Second, we proposed to add to paragraph (2) of the definition of “electronic media” a reference to intranets, to clarify that intranets come within the definition. Third, we proposed to change the word “because” to “if” in the final sentence of paragraph (2) of the definition of “electronic media.” The definition assumed that no transmissions made by voice via telephone existed in electronic form before transmission; the evolution of technology has made this assumption obsolete since some voice technology is digitally produced from an information system and transmitted by phone.

Overview of Public Comments

The Department received comments in support of the revised definition and the flexibility created to account for later technological developments. Certain other commenters raised concerns that changes to the definition could have unintended impacts when applied to the administrative transaction and code set requirements. One commenter specifically supported the change in language from “because” to “if,” noting the distinction was important to provide protection for digital audio recordings containing protected health information. One commenter suggested including the

word “immediately” in the final sentence of paragraph (2) to indicate that fax transmissions are excluded from the definition of electronic media if the information being exchanged did not exist in electronic form

immediately

before the transmission. Several commenters sought clarification as to whether data that is retained in office machines, such as facsimiles and photocopiers, is subject to the Privacy and Security Rules.

Final Rule

The final rule adopts the definition as proposed with two additional modifications. First, in paragraph (2) we remove the parenthetical language referring to “wide open” with respect to the Internet and “using Internet technology to link a business with information accessible only to collaborating parties” with respect to extranets and intranets. The parenthetical language initially helped clarify what was intended by key words within the definition. As these key words have become more generally understood and guidance has become available through the NIST regarding specific key terms, such as intranet, extranet, and internet, (see, for example, NIST IR 7298 Revision 1, Glossary of Key Information Security Terms, February 2011, available at

http://csrc.nist.gov/publications/nistir/ir7298-rev1/nistir-7298-revision1.pdf

), we believe the parenthetical language is no longer helpful. Second, we do accept the recommendation that we alter the language in paragraph (2) to include the word “immediately,” to exclude transmissions when the information exchanged did not exist in electronic form immediately before transmission. This modification clarifies that a facsimile machine accepting a hardcopy document for transmission is not a covered transmission even though the document may have originated from printing from an electronic file.

We do not believe these changes will have unforeseen impacts on the application of the term in the transactions and code sets requirements at Part 162.

In response to commenters' concerns that photocopiers, facsimiles, and other office machines may retain electronic data, potentially storing protected health information when used by covered entities or business associates, we clarify that protected health information stored, whether intentionally or not, in photocopier, facsimile, and other devices is subject to the Privacy and Security Rules. Although such devices are not generally relied upon for storage and access to stored information, covered entities and business associates should be aware of the capabilities of these devices to store protected health information and must ensure any protected health information stored on such devices is appropriately protected and secured from inappropriate access, such as by monitoring or restricting physical access to a photocopier or a fax machine that is used for copying or sending protected health information. Further, before removal of the device from the covered entity or business associate, such as at the end of the lease term for a photocopier machine, proper safeguards should be followed to remove the electronic protected health information from the media.

c. Definition of “Protected Health Information”

Proposed Rule

For consistency with the proposed modifications to the period of protection for decedent information at § 164.502(f) (discussed below), the Department proposed to modify the definition of “protected health information” at § 160.103 to provide that the Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years.

Overview of Public Comment

The public comments received on this proposal are discussed and responded to below in the section describing the modifications to § 164.502(f).

Final Rule

For the reasons stated in the section regarding § 164.502(f), the final rule adopts the proposed modification to the definition of “protected health information.”

d. Definition of “State”

Proposed Rule

The HITECH Act at section 13400 includes a definition of “State” to mean “each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.” This definition varies from paragraph (2) of the HIPAA definition of “State” at § 160.103, which does not include reference to American Samoa and the Northern Mariana Islands. Thus, for consistency with the definition applied to the HIPAA Rules by the HITECH Act, we proposed to add reference to American Samoa and the Commonwealth of the Northern Mariana Islands in paragraph (2) of the definition of “State” at § 160.103.

Final Rule

The Department did not receive substantive public comment on this proposal and the final rule adopts the proposed modifications to the definition of “State.”

e. Other Changes to the Definitions in Section 160.103

In addition to the changes discussed above, the final rule makes the following changes as proposed in the NPRM to various definitions in § 160.103:

(1) Relocates the definitions of “administrative simplification provision,” “ALJ,” “civil money penalty,” “respondent,” and “violation or violate” from § 160.302 to § 160.103 for ease of reference;

(2) Adds a reference to sections 13400-13424 of the HITECH Act to the definition of “administrative simplification provision”;

(3) Removes a comma from the definition of “disclosure” inadvertently inserted into the definition in a prior rulemaking;

(4) Replaces the term “individually identifiable health information” with “protected health information” in the definition of “standard” to better reflect the scope of the Privacy and Security Rules;

(5) Adds a reference to “business associate” following the reference to “covered entity” in the definitions of “respondent” and “compliance date,” in recognition of the potential liability imposed on business associates for violations of certain provisions of the Privacy and Security Rules by sections 13401 and 13404 of the Act; and

(6) Revises the definition of “workforce member” in § 160.103 to make clear that the term includes the employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a business associate, is under the direct control of the business associate, because some provisions of the Act and the Privacy and Security Rules place obligations on the business associate with respect to workforce members.

4. Subpart B—Preemption of State Law

a. Section 160.201—Statutory Basis

Proposed Rule

We proposed to modify § 160.201 regarding the statutory basis for the preemption of State law provisions to add a reference to section 264(c) of HIPAA, which contains the statutory basis for the exception to preemption at § 160.203(b) for State laws that are more stringent than the HIPAA Privacy Rule. We also proposed to add a reference to

section 13421(a) of the HITECH Act, which applies HIPAA's preemption rules to the HITECH Act's privacy and security provisions. Finally, we proposed to re-title the provision to read “Statutory basis” instead of “Applicability.”

Overview of Public Comments

Several commenters expressed concerns about the lack of uniform Federal and State privacy laws and the resultant confusion and expense associated with determining which laws apply to a given circumstance, particularly as more and more health care entities operate across multiple state lines. Commenters recommended that the Department make efforts to engage States and other partners to examine divergent Federal and State requirements and to attempt to coordinate various disclosure rules to drive Federal-State consensus.

Final Rule

The final rule adopts the proposed modifications. In response to the comments concerned with the lack of uniform Federal and State privacy laws, we note that the preemption provisions of the HIPAA Rules are based on section 1178 of the Social Security Act and section 264(c)(2) of HIPAA. Through these statutory provisions, Congress made clear that the HIPAA privacy requirements are to supersede only contrary provisions of State law, and not even in all such cases, such as where the provision of State law provides more stringent privacy protections than the HIPAA Privacy Rule. Accordingly, the HIPAA Privacy Rule provides a Federal floor of privacy protections, with States free to impose more stringent privacy protections should they deem appropriate.

b. Section 160.202—Definitions

i. Definition of “Contrary”

Proposed Rule

The term “contrary” is defined in § 160.202 to make clear when the preemption provisions of HIPAA apply to State law. For the reasons set forth on page 40875 of the July 2010 NPRM, we proposed to amend the definition of “contrary” by inserting references to business associates in paragraph (1) of the definition. We also expanded the reference to the HITECH statutory provisions in paragraph (2) of the definition to encompass all of the sections of subtitle D of the HITECH Act, rather than merely to section 13402, which was added by the breach notifications interim final rule. These changes would give effect to section 13421(a).

Final Rule

The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modifications.

ii. Definition of “More Stringent”

Proposed Rule

The term “more stringent” is part of the statutory preemption language under HIPAA. HIPAA preempts State law that is contrary to a HIPAA privacy standard unless, among other exceptions, the State law is more stringent than the contrary HIPAA privacy standard. We proposed to amend the definition to add a reference to business associates.

Final Rule

The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modification.

B. Subparts C and D of Part 160: Amendments to the Enforcement Rule

Section 13410 of the HITECH Act made several amendments to the Social Security Act to strengthen the HIPAA Enforcement Rule, which applies to the Secretary's enforcement of all of the HIPAA Administrative Simplification Rules, as well as the Breach Notification Rule.

On October 30, 2009, the Department issued an interim final rule (IFR) revising the Enforcement Rule to incorporate the provisions of section 13410(d) of the HITECH Act that took effect immediately to apply to violations of the HIPAA Rules occurring after the enactment date of February 18, 2009. See 74 FR 56123. In general, section 13410(d) of the HITECH Act revised section 1176(a) of the Social Security Act to establish four categories of violations that reflect increasing levels of culpability and four corresponding tiers of penalty amounts that significantly increased the minimum penalty amount for each violation, with a maximum penalty amount of $1.5 million annually for all violations of an identical provision. Section 13410(d) also amended section 1176(b) of the Social Security Act by removing the previous affirmative defense to the imposition of penalties if the covered entity did not know and with the exercise of reasonable diligence would not have known of the violation (these violations are now punishable under the lowest tier of penalties), and by providing a prohibition on the imposition of penalties for any violation that is timely corrected, as long as the violation was not due to willful neglect. The IFR updated the HIPAA Enforcement Rule to reflect these statutory amendments. The IFR did not make amendments with respect to those enforcement provisions of section 13410 of the HITECH Act that were not effective immediately upon enactment.

In its July 2010 NPRM, the Department proposed a number of additional modifications to the Enforcement Rule to reflect other provisions of section 13410 of the HITECH Act, some of which became effective on February 18, 2010, or were to become effective at a later date: (1) Requiring that the Secretary formally investigate complaints indicating violations due to willful neglect, and impose civil money penalties upon finding violations due to willful neglect; (2) making business associates of covered entities directly liable for civil money penalties for violations of certain provisions of the HIPAA Rules; (3) requiring the Secretary to determine civil money penalty amounts based upon the nature and extent of the harm resulting from a violation; and (4) providing that the Secretary's authority to impose a civil money penalty will be barred only to the extent a criminal penalty has been imposed with respect to an act under Section 1177, rather than in cases in which the act constitutes an offense that is criminally punishable under Section 1177.

The following discussion describes the enforcement provisions of the IFR and the NPRM, responds to public comment received by the Department on both rules, and describes the final modifications to the Enforcement Rule adopted by this final rule. In addition to the modifications discussed below, this final rule also adopts the NPRM proposal to add the term “business associate” to the following provisions of the Enforcement Rule: §§ 160.300; 160.304; 160.306(a) and (c); 160.308; 160.310; 160.312; 160.316; 160.401; 160.402; 160.404(b); 160.406; 160.408(c) and (d); and 160.410(a) and (c). This is done to implement sections 13401 and 13404 of the Act, which impose direct civil money penalty liability on business associates for their violations of certain provisions of the HIPAA Rules.

1. Subpart C of Part 160—Compliance and Investigations

a. Sections 160.304, 160.306, 160.308, and 160.312—Noncompliance Due to Willful Neglect

Proposed Rule

Section 13410(a) of the HITECH Act adds a new subsection (c) to section 1176 of the Social Security Act, which requires the Department to formally investigate a complaint if a preliminary investigation of the facts of the complaint indicates a possible violation due to willful neglect (section 1176(c)(2)) and to impose a civil money penalty for a violation due to willful neglect (section 1176(c)(1)). The Department proposed a number of modifications to Subpart C of the Enforcement Rule to implement these provisions.

First, § 160.306(c) of the Enforcement Rule currently provides the Secretary with discretion to investigate HIPAA complaints through the use of the word “may.” As a practical matter, however, the Department currently conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. Nonetheless, to implement section 1176(c)(2), the Department proposed to add a new paragraph (1) to § 160.306(c) (and to make conforming changes to the remainder of § 160.306(c)) to make clear that the Secretary will investigate any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect. Under proposed § 160.306(c)(2), the Secretary would have continued discretion with respect to investigating any other complaints.

Second, the Department proposed to modify § 160.308 by adding a new paragraph (a) to provide that the Secretary will conduct a compliance review to determine whether a covered entity or business associate is complying with the applicable administrative simplification provision when a preliminary review of the facts indicates a possible violation due to willful neglect. Like § 160.306(c) with respect to complaints, the current § 160.308(c) provides the Secretary with discretion to conduct compliance reviews. While section 13410(a) of the HITECH Act specifically mentions complaints and not compliance reviews with respect to willful neglect, the Department proposed to treat compliance reviews in the same manner because it believed doing so would strengthen enforcement with respect to potential violations of willful neglect and would ensure that investigations, whether or not initiated by a complaint, would be handled in a consistent manner. Under proposed § 160.308(b), the Secretary would continue to have discretion to conduct compliance reviews in circumstances not indicating willful neglect.

Third, given the HITECH Act's requirement that the Secretary impose a penalty for any violation due to willful neglect, the Department proposed changes to § 160.312, which currently requires the Secretary to attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. The NPRM proposed to provide instead in § 160.312(a) that the Secretary “may” rather than “will” attempt to resolve investigations or compliance reviews indicating noncompliance by informal means. This change would permit the Department to proceed with a willful neglect violation determination as appropriate, while also permitting the Department to seek resolution of complaints and compliance reviews that did not indicate willful neglect violations by informal means (e.g., where the covered entity or business associate did not know and by exercising reasonable diligence would not have known of a violation, or where the violation is due to reasonable cause).

Finally, the Department proposed a conforming change to § 160.304(a), which currently requires the Secretary to seek, to the extent practicable, the cooperation of covered entities in obtaining compliance with the HIPAA Rules. The NPRM proposed to clarify that the Secretary would continue to do so “consistent with the provisions of this subpart” in recognition of the new HITECH Act requirement to impose a civil money penalty for a violation due to willful neglect. While the Secretary often will still seek to correct indications of noncompliance through voluntary corrective action, there may be circumstances (such as circumstances indicating willful neglect), where the Secretary may proceed directly to formal enforcement.

Overview of Public Comments

One commenter supported maintaining the current language at §§ 160.306 and 160.308 of the Enforcement Rule, providing the Secretary with discretion to conduct complaint investigations and compliance reviews, regardless of indications of willful neglect. One commenter suggested that OCR look to whether facts indicate a “probable,” rather than “possible,” violation due to willful neglect to limit the likelihood of unnecessary formal investigations or compliance reviews. While one commenter supported the proposal to require a compliance review in circumstances indicating a possible violation due to willful neglect, others argued that requiring compliance reviews in such circumstances is not required by the statute, will detract from resources to investigate complaints, and will be duplicative if a formal complaint investigation is also underway.

Several commenters expressed concern over the proposal at § 160.312(a) to give the Secretary discretion, rather than to require the Secretary, to attempt to resolve investigations or compliance reviews indicating noncompliance by informal means, even in cases of noncompliance that did not involve willful neglect (e.g., cases involving reasonable cause or lack of knowledge of a violation). Commenters indicated support for the Department's seeking compliance through voluntary corrective action as opposed to formal enforcement proceedings and argued that the Department should retain the requirement for the Secretary to attempt informal resolution in all circumstances except those involving willful neglect. One commenter recommended that the Secretary be able to assess penalties regardless of whether corrective action was obtained.

Final Rule

The final rule adopts the modifications to §§ 160.304, 160.306, 160.308, and 160.312, as proposed in the NPRM. The Department believes these changes to the enforcement provisions to be appropriate given the HITECH Act's requirements at section 13410(a) with respect to circumstances indicating or involving noncompliance due to willful neglect. We do not provide in the Rule that the Secretary will investigate when a preliminary review of the facts indicates a “probable” rather than “possible” violation due to willful neglect as the statute requires an investigation even in cases indicating a “possible” violation due to willful neglect. In response to commenters concerned about requiring the Secretary to conduct compliance reviews in circumstances in which facts indicate a possible violation due to willful neglect, we continue to believe that, while not expressly required by the statute, doing so appropriately strengthens enforcement with respect to violations due to willful neglect and ensures consistency in the handling of complaints and compliance reviews in

which violations due to willful neglect are indicated. We emphasize that the Department retains discretion to decide whether to conduct a compliance review (or complaint investigation) where a preliminary review of the facts indicates a degree of culpability less than willful neglect. Further, with respect to commenter concerns about duplication between complaint investigations and compliance reviews, we clarify that the Department generally conducts compliance reviews to investigate allegations of violations of the HIPAA Rules brought to the Department's attention through a mechanism other than a complaint. For example, the Department may use a compliance review to investigate allegations of violations of the Rules brought to our attention through a media report, or from a State or another Federal agency. If the Department initiates an investigation of a complaint because its preliminary review of the facts indicates a possible violation due to willful neglect, the Department is not also required to initiate a compliance review under § 160.308 because doing so would initiate a duplicative investigation.

With respect to § 160.312, where the Rule previously mandated that the Secretary attempt to resolve indicated violations of the HIPAA Rules by informal means, the final rule now provides the Secretary with the discretion to do so, to reflect Section 13410 of the HITECH Act with regard to violations due to willful neglect. Nothing in Section 13410 of the HITECH Act limits the Secretary's ability to resolve such cases by informal means. However, through its introduction of higher penalties and its mandate for formal investigations with regard to possible violations due to willful neglect, Section 13410 strengthens enforcement and accordingly we have revised § 160.312 so that the Secretary may move directly to a civil money penalty without exhausting informal resolution efforts at her discretion, particularly in cases involving willful neglect violations.

Response to Other Public Comments

Comment:

A number of commenters requested further clarification on the scope and depth of what constitutes a “preliminary review of the facts” for purposes of determining whether facts indicate a possible violation due to willful neglect and thus, warrant a formal complaint investigation or compliance review. Certain commenters suggested that a preliminary review of the facts should go beyond merely a review of the allegations asserted in a complaint.

Response:

As noted above, currently the Department conducts a preliminary review of every complaint received and proceeds with the investigation in every eligible case where its preliminary review of the facts indicates a possible violation of the HIPAA Rules. The Department anticipates that some complaints, on their face, or reports or referrals that form the basis of a potential compliance review, will contain sufficient information to indicate a possible violation due to willful neglect, and some may not. In any event, the Department may on a case-by-case basis expand the preliminary review and conduct additional inquiries for purposes of identifying a possible violation due to willful neglect. Notwithstanding the scope of a preliminary review, OCR will determine if an indicated violation was due to willful neglect based on the evidence from its investigation of the allegations, even if a violation due to willful neglect was not indicated at the preliminary review stage.

b. Section 160.310—Protected Health Information Obtained by the Secretary

Proposed Rule

Section 160.310 requires that covered entities make information available to and cooperate with the Secretary during complaint investigations and compliance reviews. Section 160.310(c)(3) provides that any protected health information obtained by the Secretary in connection with an investigation or compliance review will not be disclosed by the Secretary, except as necessary for determining and enforcing compliance with the HIPAA Rules or as otherwise required by law. In the proposed rule, we proposed to modify this paragraph to also allow the Secretary to disclose protected health information if permitted under the Privacy Act at 5 U.S.C. 552a(b)(7). Section 5 U.S.C. 552a(b)(7) permits the disclosure of a record on an individual contained within a government system of records protected under the Privacy Act to another agency or instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law and if the agency has made a written request to the agency that maintains the record. The proposed change would permit the Secretary to coordinate with other law enforcement agencies, such as the State Attorneys General pursuing civil actions to enforce the HIPAA Rules on behalf of State residents pursuant to section 13410(e) of the Act, or the FTC pursuing remedies under other consumer protection authorities.

Overview of Public Comments

One commenter requested clarification and transparency on how or if Federal regulators such as OCR and the FTC will collaborate, when such information sharing will be initiated or occur as a routine process, or whether Federal and State agencies will work together to enforce suspected violations.

Final Rule

To facilitate cooperation between the Department and other law enforcement agencies, the final rule adopts the modifications to § 160.310(c)(3) as proposed in the NPRM. In response to the comment regarding transparency in how the Department is or will cooperate with other agencies in enforcement, we note that the Department's web site at

http://www.hhs.gov/ocr/enforcement/

contains information about how the Department coordinates with the Department of Justice to refer cases involving possible criminal HIPAA violations and how the Department has worked with the FTC to coordinate enforcement actions for violations that implicate both HIPAA and the FTC Act. Further, the Department will be working closely with State Attorneys General to coordinate enforcement in appropriate cases, as provided under section 13410(e) of the HITECH Act. The Department will continue to update its web site as necessary and appropriate to maintain transparency with the public and the regulated community about these coordinated activities and its other enforcement actions and activities.

2. Subpart D—Imposition of Civil Money Penalties

a. Section 160.401—Definitions

Section 160.401 defines “reasonable cause,” “reasonable diligence,” and “willful neglect.” Given that section 13410(d) of the HITECH Act uses these terms to describe the increasing levels of culpability for which increasing minimum levels of penalties may be imposed, the Department moved these definitions in the IFR from their prior placement at § 160.410, which pertains only to affirmative defenses, to § 160.401, so that they would apply to the entirety of Subpart D of Part 160 and the provisions regarding the imposition of civil money penalties. The IFR did not modify the definitions themselves as the HITECH Act did not amend the definitions.

Even though the HITECH Act did not amend the definitions of these terms,

the Department in its NPRM proposed certain modifications to the definition of “reasonable cause” to clarify the mens rea (state of mind) required for this category of violations, and to avoid the situation where certain violations would not fall within one of the established penalty tiers. This modification is discussed below. The Department did not propose modifications to the definitions of “reasonable diligence” and “willful neglect.”

In the NPRM, the Department also included examples and guidance as to how the Department planned to apply the definitions of “reasonable cause,” “reasonable diligence,” and “willful neglect” to distinguish among the tiers of culpability. 75 FR 40877-40879. As commenters generally found this guidance helpful, the Department intends to publish the guidance on its web site.

Modifications to the Definition of “Reasonable Cause”

Proposed Rule

Reasonable cause is currently defined at § 160.401 to mean: “circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated.” This definition is consistent with the Supreme Court's ruling in

United States

v.

Boyle,

469 U.S. 241, 245 (1985), which focused on whether circumstances were beyond the regulated person's control, thereby making compliance unreasonable. See 70 FR 20224, 20238. Prior to the HITECH Act, section 1176 of the Social Security Act provided an affirmative defense to the imposition of a civil money penalty if the covered entity established that its violation was due to reasonable cause and not willful neglect and was corrected within a 30-day period (or such additional period determined by the Secretary to be appropriate).

As described above, section 13410(d) of the HITECH Act revised section 1176 of the Social Security Act to establish four tiers of increasing penalty amounts to correspond to the levels of culpability associated with the violation. The first category of violation (and lowest penalty tier) covers situations where the covered entity or business associate did not know, and by exercising reasonable diligence would not have known, of a violation. The second category of violation (and next highest penalty tier) applies to violations due to reasonable cause and not to willful neglect. The third and fourth categories apply to circumstances where the violation was due to willful neglect that is corrected within a certain time period (second highest penalty tier) and willful neglect that is not corrected (highest penalty tier). The mens rea, or state of mind, associated with the tiers is clear with respect to the first, third, and fourth categories, in that there is no mens rea with respect to the lowest category of violation, while the existence of mens rea is presumed with respect to the third and fourth categories of violation.

However, the current definition of “reasonable cause” does not address mens rea with respect to the second category of violations. Therefore, the Department proposed to amend the definition of “reasonable cause” at § 160.401 to clarify the mens rea associated with the reasonable cause category of violations and to clarify the full scope of violations that will come within the category. Specifically, the Department proposed to modify the definition of “reasonable cause” to mean “an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.” Thus, the proposed definition would now include violations due both to circumstances that would make it unreasonable for the covered entity or business associate, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated, as well as to other circumstances in which a covered entity or business associate has knowledge of a violation but lacks the conscious intent or reckless indifference associated with the willful neglect category of violations.

Overview of Public Comments

Commenters addressing the definition of “reasonable cause” expressed general support for the proposed clarifications to the scope of this category of violations.

Final Rule

The final rule adopts the proposed modifications to the definition.

b. Section 160.402—Basis for a Civil Money Penalty

Proposed Rule

Section 160.402(a) states generally that the Secretary will impose a civil money penalty upon a covered entity if the Secretary determines that the covered entity violated an administrative simplification provision. Section 164.402, in paragraphs (b) and (c), provides the basis for a civil money penalty against a covered entity where more than one covered entity is responsible for a violation, where an affiliated covered entity is responsible for a violation, and where an agent of a covered entity is responsible for a violation.

The proposed rule proposed to remove the exception at § 160.402(c) for covered entity liability for the acts of its agent in cases where the agent is a business associate, the relevant contract requirements have been met, the covered entity did not know of a pattern or practice of the business associate in violation of the contract, and the covered entity did not fail to act as required by the Privacy or Security Rule with respect to such violations. The proposed rule also proposed to add a parallel provision in a new paragraph (2) at § 160.402(c) that would provide for civil money penalty liability against a business associate for the acts of its agent. The existing language of § 160.402(c) regarding the liability of covered entities for the acts of their agents would be re-designated as paragraph (1).

These proposed changes would make covered entities and business associates liable under § 160.402(c) for the acts of their business associate agents, in accordance with the Federal common law of agency, regardless of whether the covered entity has a compliant business associate agreement in place. Section 160.402(c) closely tracks the language in section 1128A(l) of the Social Security Act, which is made applicable to HIPAA by section 1176(a)(2) of such Act, which states that “a principal is liable for penalties * * * under this section for the actions of the principal's agents acting within the scope of the agency.” One reason for removing the exception to the general provision at § 160.402(c), as we explained in the NPRM, is to ensure, where a covered entity or business associate has delegated out an obligation under the HIPAA Rules, that a covered entity or business associate would remain liable for penalties for the failure of its business associate agent to perform the obligation on the covered entity or business associate's behalf.

Overview of Public Comments

Several commenters requested that the Department clarify and provide additional guidance regarding how the Federal common law of agency applies to business associate relationships. These commenters expressed an overall concern that applying the Federal common law of agency to business

associate relationships would add unnecessary confusion to and place an undue burden on business associate relationships. Several commenters argued that the proposed change would require covered entities and business associates to determine whether their business associates or business associate subcontractors are agents, resulting in costly and burdensome challenges when drafting business associate contracts and monitoring ongoing relationships. One commenter argued that the Federal common law of agency should not be applied to covered entity and business associate relationships because it does not generally control when the parties have entered into a contractual agreement that specifies their respective rights and obligations. Instead, the commenter argued, the contractual provisions control, and are interpreted and enforced in accordance with State law specified by the contract.

Final Rule

This final rule adopts the proposed modifications to § 160.402(c). We do not believe that this change will place an undue burden on covered entities and business associates. As we explained in the NPRM, a covered entity's liability for acts of its agents is customary under common law. See 75 FR 40880. Further, section 1128A(l) of the Social Security Act, applicable to HIPAA covered entities and now business associates by section 1176(a)(2) of the Act, states that a principal is liable for civil money penalties for the actions of the principal's agent acting within the scope of agency. Before the changes to § 160.402(c) were finalized in this rule, if a covered entity failed to comply with the business associate provisions in the HIPAA Rules, a covered entity potentially would have been liable for the actions of its business associate agent. Thus, we believe that the notion that a principal is liable for the acts of its agent should not be an unfamiliar concept to covered entities and business associates. However, we appreciate and understand the commenters' concerns and take this opportunity to provide additional guidance.

While section 1128A(l) is silent as to how to define “principal,” “agent,” and “scope of agency,” § 160.402(c) references the Federal common law of agency. As we explained in the Enforcement Rule preamble, 71 FR 8390, 8403-04, adopting the Federal common law to determine the definitions and application of these terms achieves nationwide uniformity in the implementation of the HIPAA Rules. We believe that relying on the Federal common law is particularly important because of HIPAA's express objective of furthering the efficiency and effectiveness of the health care system as a whole. Further, adopting the Federal common law here is consistent with the precept that Federal statutes are meant to have uniform nationwide application. Therefore, we disagree with the comment that argued that Federal common law should not be applied with respect to relationships between covered entities and business associates.

An analysis of whether a business associate is an agent will be fact specific, taking into account the terms of a business associate agreement as well as the totality of the circumstances involved in the ongoing relationship between the parties. The essential factor in determining whether an agency relationship exists between a covered entity and its business associate (or business associate and its subcontractor) is the right or authority of a covered entity to control the business associate's conduct in the course of performing a service on behalf of the covered entity. The right or authority to control the business associate's conduct also is the essential factor in determining whether an agency relationship exists between a business associate and its business associate subcontractor. Accordingly, this guidance applies in the same manner to both covered entities (with regard to their business associates) and business associates (with regard to their subcontractors).

The authority of a covered entity to give interim instructions or directions is the type of control that distinguishes covered entities in agency relationships from those in non-agency relationships. A business associate generally would not be an agent if it enters into a business associate agreement with a covered entity that sets terms and conditions that create contractual obligations between the two parties. Specifically, if the only avenue of control is for a covered entity to amend the terms of the agreement or sue for breach of contract, this generally indicates that a business associate is not acting as an agent. In contrast, a business associate generally would be an agent if it enters into a business associate agreement with a covered entity that granted the covered entity the authority to direct the performance of the service provided by its business associate after the relationship was established. For example, if the terms of a business associate agreement between a covered entity and its business associate stated that “a business associate must make available protected health information in accordance with § 164.524 based on the instructions to be provided by or under the direction of a covered entity,” then this would create an agency relationship between the covered entity and business associate for this activity because the covered entity has a right to give interim instructions and direction during the course of the relationship. An agency relationship also could exist between a covered entity and its business associate if a covered entity contracts out or delegates a particular obligation under the HIPAA Rules to its business associate. As discussed above, whether or not an agency relationship exists in this circumstance again would depend on the right or authority to control the business associate's conduct in the performance of the delegated service based on the right of a covered entity to give interim instructions.

While these principles are well established under the Federal common law of agency, we again note that any analysis regarding scope of agency depends on the facts of each circumstance. Several factors are important to consider in any analysis to determine the scope of agency: (1) The time, place, and purpose of a business associate agent's conduct; (2) whether a business associate agent engaged in a course of conduct subject to a covered entity's control; (3) whether a business associate agent's conduct is commonly done by a business associate to accomplish the service performed on behalf of a covered entity; and (4) whether or not the covered entity reasonably expected that a business associate agent would engage in the conduct in question.

The terms, statements, or labels given to parties (e.g., independent contractor) do not control whether an agency relationship exists. Rather, the manner and method in which a covered entity actually controls the service provided decides the analysis. As mentioned above, an analysis of whether a business associate is an agent will be fact specific and consider the totality of the circumstances involved in the ongoing relationship between the parties. We note here several circumstances that are important. The type of service and skill level required to perform the service are relevant factors in determining whether a business associate is an agent. For example, a business associate that is hired to perform de-identification of protected health information for a small provider would likely not be an agent because the small provider likely would not have the expertise to provide interim instructions regarding this activity to the business associate. Also, an agency relationship would not likely exist when a covered entity is legally or

otherwise prevented from performing the service or activity performed by its business associate. For example, the accreditation functions performed by a business associate cannot be performed by a covered entity seeking accreditation because a covered entity cannot perform an accreditation survey or award accreditation. We also note that a business associate can be an agent of a covered entity: (1) Despite the fact that a covered entity does not retain the right or authority to control every aspect of its business associate's activities; (2) even if a covered entity does not exercise the right of control but evidence exists that it holds the authority to exercise that right; and (3) even if a covered entity and its business associate are separated by physical distance (e.g., if a covered entity and business associate are located in different countries).

Response to Other Public Comments

Comment:

One commenter asked whether the Department intends to eliminate the exceptions afforded by the Federal common law of agency. This commenter also argued that if a business associate were an agent of a covered entity, and a HIPAA compliant business associate agreement was in place, any deviation from the terms in the agreement would be by definition outside the scope of agency.

Response:

As we discussed above, § 160.402(c) provides that covered entities and business associates are liable for the acts of their business associate agents, in accordance with the Federal common law of agency. Section 160.402(c) is derived from section 1128A(l) of the Social Security Act which states that “a principal is liable for penalties * * * under this section for the actions of the principal's agents acting within the scope of the agency.” Accordingly, § 160.402(c) incorporates the Federal common law of agency, which includes the understanding that for a principal to be liable for the actions of an agent, the agent must be acting within the scope of agency. Thus, the exceptions to the Federal common law of agency (as the commenter identified them) are incorporated in the final rule at § 160.402(c).

We do not agree with the commenter that any deviation from the terms in a business associate contract would be by definition outside the scope of agency. A business associate agent's conduct generally is within the scope of agency when its conduct occurs during the performance of the assigned work or incident to such work, regardless of whether the work was done carelessly, a mistake was made in the performance, or the business associate disregarded a covered entity's specific instruction. For example, a business associate agent would likely be acting within the scope of agency if it impermissibly disclosed more than the minimum necessary information to a health plan for purposes of payment, even if the disclosure is contrary to clear instructions of the covered entity. In contrast, a business associate agent's conduct generally is outside the scope of agency when its conduct is solely for its own benefit (or that of a third party), or pursues a course of conduct not intended to serve any purpose of the covered entity.

Comment:

One commenter stated that the proposed change would impose strict liability on covered entities for the actions of third parties not under their control. Another commenter stated that an agent would always fall within the scope of a workforce member, which by definition is not a business associate.

Response:

We disagree with both comments and believe that the comments may reflect a misunderstanding of the proposed change. First, as explained above, § 160.402(c) closely tracks the language in section 1128A(l) of the Social Security Act, which is made applicable to HIPAA by section 1176(a)(2) of such Act. It does not make a covered entity or business associate liable for the acts of third parties that are not under its control because such third parties are not its agents. With regard to the second comment, an agent could always fall within the definition of a workforce member because of the direct control requirement in that definition, but the definition of business associate excludes a workforce member. This definitional exclusion allows the covered entity to determine whether, for example, to provide training to the agent under the Privacy Rule. A covered entity would be required to provide training to a workforce member but not to a business associate agent. However, the covered entity is required to enter into a business associate agreement with a business associate agent that it does not treat as a workforce member. The proposed change to § 160.402(c) simply makes the covered entity or business associate liable for the acts of its agents acting within the scope of agency, whether the agents are workforce members or business associates. See the definitions of “business associate” and “workforce member” at § 160.103.

c. Section 160.404—Amount of a Civil Monetary Penalty

Interim Final Rule

The IFR amended § 160.404 to revise the range of potential civil money penalty amounts a covered entity (or business associate) will be subject to for violations occurring on or after February 18, 2009, as a result of section 13410(d) of the HITECH Act.

Prior to the HITECH Act, section 1176(a) of the Social Security Act authorized the Secretary to impose a civil money penalty of not more than $100 for each violation, with the total amount imposed on a covered entity for all violations of an identical requirement or prohibition during a calendar year not to exceed $25,000. As described above, section 13410(d) of the HITECH Act modified section 1176(a) to establish tiers of increasing penalty amounts for violations based on increasing levels of culpability associated with each tier.

Accordingly, the IFR adopted at § 160.404(b) the new penalty scheme provided for at section 13410(d) of the HITECH Act for violations occurring on or after February 18, 2009. The IFR retained the pre-HITECH maximum penalty amounts of not more than $100 per violation and $25,000 for identical violations during a calendar year, for violations occurring before February 18, 2009.

In adopting the HITECH Act's penalty scheme, the Department recognized that section 13410(d) contained apparently inconsistent language (i.e., its reference to two penalty tiers “for each violation,” each of which provided a penalty amount “for all such violations” of an identical requirement or prohibition in a calendar year). To resolve this inconsistency, with the exception of violations due to willful neglect that are not timely corrected, the IFR adopted a range of penalty amounts between the minimum given in one tier and the maximum given in the second tier for each violation and adopted the amount of $1.5 million as the limit for all violations of an identical provision of the HIPAA rules in a calendar year. For violations due to willful neglect that are not timely corrected, the IFR adopted the penalty amount of $50,000 as the minimum for each violation and $1.5 million for all such violations of an identical requirement or prohibition in a calendar year.

Specifically, the IFR revised § 160.404 to provide, for violations occurring on or after February 18, 2009, the new HITECH penalty scheme, as follows: (1) For violations in which it is established that the covered entity did not know

and, by exercising reasonable diligence, would not have known that the covered entity violated a provision, an amount not less than $100 or more than $50,000 for each violation; (2) for a violation in which it is established that the violation was due to reasonable cause and not to willful neglect, an amount not less than $1000 or more than $50,000 for each violation; (3) for a violation in which it is established that the violation was due to willful neglect and was timely corrected, an amount not less than $10,000 or more than $50,000 for each violation; and (4) for a violation in which it is established that the violation was due to willful neglect and was not timely corrected, an amount not less than $50,000 for each violation; except that a penalty for violations of the same requirement or prohibition under any of these categories may not exceed $1,500,000 in a calendar year. See Table 2 below.

Table 2—Categories of Violations and Respective Penalty Amounts Available

Violation category—Section 1176(a)(1)

Each violation

All such violations of an identical provision in a calendar year

(A) Did Not Know

$100-$50,000

$1,500,000

(B) Reasonable Cause

1,000-50,000

1,500,000

(C)(i) Willful Neglect-Corrected

10,000-50,000

1,500,000

(C)(ii) Willful Neglect-Not Corrected

50,000

1,500,000

In applying these amounts, the Department will not impose the maximum penalty amount in all cases but rather will determine the penalty amounts as required by the statute at section 1176(a)(1) and the regulations at § 160.408 (i.e., based on the nature and extent of the violation, the nature and extent of the resulting harm, and the other factors set forth at § 160.408).

Further, for counting violations, the Department continues to utilize the methodology discussed in prior preambles of the Enforcement Rule. See 70 FR 20224, 20233-55 (April 18, 2005) and 71 FR 8390, 8404-07 (February 16, 2006). For violations that began prior to February 18, 2009, and continue after that date, the Department will treat violations occurring before February 18, 2009, as subject to the penalties in effect prior to February 18, 2009, and violations occurring on or after February 18, 2009, as subject to the penalties in effect on or after February 18, 2009.

Overview of Public Comments

Most comments on the civil money penalty amounts expressed concern with the new penalty structure set forth in the IFR. A few of these commenters expressed a generalized concern about the potential impact the available penalty amounts might have on covered entities, particularly smaller entities. One commenter argued that the Secretary should not fine entities for violations of which a covered entity had no knowledge or those due to reasonable cause, and that civil money penalties should only be imposed as a last resort. A few commenters expressed concern with the Secretary's wide range of discretion in determining a civil money penalty amount and suggested that the regulations or guidance should further define how the Secretary would determine such an amount.

Some commenters specifically expressed concern about the maximum penalty amounts set forth for each violation (i.e., $50,000) and for all violations of an identical provision in a calendar year ($1,500,000). Commenters argued that the IFR's penalty scheme is inconsistent with the HITECH Act's establishment of different tiers based on culpability because the outside limits were the same for all culpability categories and this ignored the outside limits set forth by the HITECH Act within the lower penalty tiers, rendering those limits meaningless. A few commenters expressed particular concern with what they believed to be the unfair ability of the Secretary to impose the maximum penalty amounts to violations falling within the two lowest categories of culpability (i.e., did not know violations and violations due to reasonable cause and not willful neglect).

Final Rule

This final rule retains the revised penalty structure in § 160.404(b) as implemented by the IFR. We continue to believe the penalty amounts are appropriate and reflect the most logical reading of the HITECH Act, which provides the Secretary with discretion to impose penalties for each category of culpability up to the maximum amount described in the highest penalty tier.

With respect to those comments expressing concern about the discretion available to the Secretary under the adopted scheme we emphasize again that the Department will not impose the maximum penalty amount in all cases but will rather determine the amount of a penalty on a case-by-case basis, depending on the nature and extent of the violation and the nature and extent of the resulting harm, as required by the HITECH Act, as well as the other factors set forth at § 160.408. In response to those commenters particularly concerned about the impact of penalties on smaller entities, we note that the other factors include both the financial condition and size of the covered entity or business associate. These factors are discussed more fully below.

In addition, with respect to comments expressing specific concern about fairness regarding those violations of which an entity did not know or by exercising reasonable diligence would not have known or for which there was a reasonable cause and not willful neglect, we note that in both cases an entity may establish that an affirmative defense applies under § 160.410, where the entity corrects the violation within 30 days from the date the entity had knowledge of the violation or with the exercise of reasonable diligence would have had knowledge of the violation, or during a period determined appropriate by the Secretary based upon the nature and extent of the entity's failure to comply. These affirmative defenses are described more fully below.

In addition, Section 13410(d) of the HITECH Act and Section 1176(a) of the Social Security Act, give the Secretary further ability to waive a civil money penalty, in whole or in part, under certain circumstances. Thus, to the extent an entity fails to correct such violations within the mandated timeframe, the Secretary may also utilize her waiver authority provided for at § 160.412, to waive the penalty amount in whole or in part, to the extent that payment of the penalty would be excessive relative to the violation.

Further, pursuant to 42 U.S.C. 1320a-7a(f), the Secretary always has the discretion to settle any issue or case or to compromise the amount of a civil money penalty assessed for a violation of the HIPAA Rules.

Finally, in the event an entity believes that a civil money penalty has been imposed unfairly, the entity could exercise its right under § 160.504 to appeal the imposition of a civil money penalty in a hearing before an administrative law judge.

Response to Other Public Comments

Comment:

We received a few comments in response to the IFR and NPRM requesting clarification as to how the Secretary will count violations for purposes of calculating civil money penalties. One commenter requested clarification as to how the numbers of “occurrences” are determined, suggesting that penalties could be very significant, and vary significantly, depending on the counting methodology utilized. The Department also received one comment asking whether a violation is defined as one event. This commenter queried, for example, whether the loss of unsecured electronic media would be considered as a single violation, even if the media contained several hundred records. The commenter also asked for confirmation that $1,500,000 is the aggregate limit of all fines for all violations in a given calendar year which would apply across an entire enterprise, regardless of violations occurring in different business units.

Response:

How violations are counted for purposes of calculating a civil money penalty vary depending on the circumstances surrounding the noncompliance. Generally speaking, where multiple individuals are affected by an impermissible use or disclosure, such as in the case of a breach of unsecured protected health information, it is anticipated that the number of identical violations of the Privacy Rule standard regarding permissible uses and disclosures would be counted by the number of individuals affected. Further, with respect to continuing violations, such as lack of appropriate safeguards for a period of time, it is anticipated that the number of identical violations of the safeguard standard would be counted on a per day basis (i.e., the number of days the entity did not have appropriate safeguards in place to protect the protected health information). Note also that in many breach cases, there will be both an impermissible use or disclosure, as well as a safeguards violation, for each of which the Department may calculate a separate civil money penalty. We refer readers to prior Enforcement Rule preambles for additional discussion on the counting methodology. See 70 FR 20224, 20233-55 (April 18, 2005) and 71 FR 8390, 8404-07 (February 16, 2006).

With respect to whether the aggregate CMP limit of $1.5 million would apply to all violations in a given calendar year, across an entire enterprise, regardless of violations occurring in different business units of the enterprise, we note that the Enforcement Rule's penalty scheme, and thus the limit for identical violations in a calendar year applies to the legal entity that is a covered entity or business associate. However, as we indicated above, a covered entity or business associate may be liable for multiple violations of multiple requirements, and a violation of each requirement may be counted separately. As such, one covered entity or business associate may be subject to multiple violations of up to a $1.5 million cap for each violation, which would result in a total penalty above $1.5 million.

d. Section 160.408—Factors Considered in Determining the Amount of a Civil Money Penalty

Proposed Rule

Section 160.408 implements section 1176(a)(2) of the Social Security Act, which requires the Secretary, when imposing a civil money penalty, to apply the provisions of section 1128A of the Social Security Act “in the same manner as such provisions apply to the imposition of a civil money penalty under section 1128A.” In determining a penalty amount, section 1128A requires the Secretary to take into account the nature of the claims and the circumstances under which they were presented; the degree of culpability, history of prior offenses and financial condition of the person presenting the claims; and such other matters as justice may require.

Section 160.408 adopted these factors and provided a more specific list of circumstances within each. Because the Enforcement Rule applies to a number of rules, which apply to an enormous number of entities and circumstances, the Secretary has the discretion to decide whether and how to consider the factors (i.e., as either aggravating or mitigating) in determining the amount of a civil money penalty.

As previously indicated, section 13410(d) of the HITECH Act modified section 1176(a)(1) of the Social Security Act to require that the Department base determinations of appropriate penalty amounts on the nature and extent of the violation and the nature and extent of the harm resulting from such violation. However, the HITECH Act did not modify section 1176(a)(2),which continues to require application of the factors in section 1128A.

The proposed rule proposed to revise the structure and list of factors at § 160.408 to make explicit the new HITECH Act requirement that the Secretary consider the nature and extent of the violation and the nature and extent of the harm resulting from the violation, in addition to those factors enumerated in section 1128A. We proposed to exclude, however, the factor at § 160.408(c) regarding the degree of culpability of the covered entity, which originated in section 1128A, because culpability is now reflected in the penalty tiers.

Specifically, the Department proposed to revise § 160.408(a) to identify “the nature and extent of the violation,” “the nature and extent of the harm resulting from the violation,” and the “history of prior compliance with the administrative simplification provision, including violations by the covered entity or business associate,” the “financial condition of the covered entity or business associate,” and “such other matters as justice may require,” as the five general factors the Secretary will consider in determining a civil money penalty. Under each of these categories, we proposed to reorganize and list the specific factors that may be considered.

In addition, in the first, second, and third factors, we proposed to add certain circumstances which may be considered in determining a penalty amount. Under the first factor, we proposed to add “the number of individuals affected” as relevant to the extent of a violation. Under the second factor, we proposed to add “reputational harm” to the specific circumstances which may be considered, to make clear that reputational harm is as cognizable a form of harm as physical or financial harm. Finally, in the third factor, the Department proposed to modify the phrase “prior violations” to “indications of noncompliance,” because use of the term “violation” is generally reserved for instances where the Department has made a formal finding of a violation through a notice of proposed determination. However, a covered entity's general history of HIPAA compliance is relevant in determining the amount of a civil money penalty within the penalty range.

The Department did not propose to modify the Secretary's discretion in how to apply the factors—i.e., as either mitigating or aggravating.

Overview of Public Comments

We received one comment requesting that the Department limit the number of mitigating factors it will consider when determining penalty amounts and apply

civil money penalties in every case of noncompliance, including where resolution and compliance have been achieved by informal means. The commenter also argued that a covered entity's or business associate's financial condition or financial difficulties should not be considered as mitigating factors in determining the amount of civil money penalties. The commenter recommended that penalties should apply to all violators except those who despite due diligence could not discover the violation, who reported the violation immediately, and who fully corrected the problem within 30 days of discovery.

We received two comments in support of considering reputational harm in the computation of civil money penalties. One commenter emphasized that reputational harm addresses harm to individuals' dignity interest and recommended the inclusion of “other” harm as well. However, another covered entity expressed concern that damages for reputational harm are difficult to quantify and, therefore, claims might lead to protracted litigation and expensive settlements, ultimately increasing the costs of health care. Finally, we received one comment requesting examples of situations involving a cognizable claim of reputational harm.

We also received several comments requesting that the Department continue to consider the degree of culpability when determining the amount of a civil money penalty. One commenter specifically recommended that the Department consider whether unauthorized access has occurred when determining civil money penalty amounts. We also received one comment suggesting that the Department revise proposed § 160.408(c) to recognize as a mitigating factor whether the current violation is inconsistent with an entity's prior history of compliance.

With respect to the evaluation of a covered entity's or business associate's history of prior compliance, we received a number of comments expressing concern that replacing “violations” with “indications of noncompliance” would create ambiguity, and would not adequately inform covered entities and business associates of the factors that the Department will consider when determining civil money penalty amounts. The commenters expressed concern that expanding the evaluation of prior compliance beyond documented, formal findings of noncompliance would permit the Department to rely on information of dubious credibility. Commenters requested that, to prevent uncertainty, the Department either retain the term “violations” or provide a clear definition, including examples, of “indications of noncompliance.”

Finally, we received several comments requesting additional examples and guidance on how the Department will apply the factors in assessing penalty amounts.

Final Rule

The final rule adopts the proposed modifications. We do not eliminate the factors concerning an entity's financial condition, as such factors are based on the requirement in section 1128A(d) of the Social Security Act. We emphasize that the goal of enforcement is to ensure that violations do not recur without impeding access to care. Further, we note that an entity's financial condition can affect a civil money penalty in either direction, that is, while an entity in poor financial condition may face a lesser penalty if its financial condition affected its ability to comply, an entity with greater financial resources could be subject to higher penalties for violations, in part because it had the resources to maintain compliance.

When considering the nature of the violation, the Department intends to consider factors such as the time period during which the violation(s) occurred and the number of individuals affected. Such considerations reflect the nature of the violation, specifically with respect to potential violations that affect a large number of individuals, for example, where disclosure of protected health information in multiple explanation of benefits statements (EOBs) that were mailed to the wrong individuals resulted from one inadequate safeguard but affected a large number of beneficiaries. However, we do recognize that these specific circumstances might also be considered under § 160.406, with respect to counting violations. See 71 FR 8390, 8409.

Whether reputational harm is implicated in a HIPAA violation will be a fact-specific inquiry. We emphasize, however, that we do not consider reputational harm to arise solely from the unlawful disclosure of protected health information relating to medical diagnoses that may be considered especially sensitive, such as sexually transmitted infections or mental health disorders. Rather, the facts of the situation will determine whether reputational harm has occurred, such as whether the unlawful disclosure resulted in adverse effects on employment, standing in the community, or personal relationships. With respect to requests to consider “other” harm or whether unauthorized access has occurred, we reiterate that, in determining the nature and extent of the harm involved, we may consider all relevant factors, not just those expressly included in the text of the regulation.

Regarding the shift in terminology from “history of violations” to “prior indications of noncompliance,” we note that use of the terms “violation” or “violate” generally indicates that the Department has made a formal finding of a violation through a notice of proposed determination. Because the Department has a number of enforcement tools, such as informal resolution through a corrective action plan, the number of “violations” incurred by a covered entity or business associate does not constitute an accurate picture of a covered entity's or business associate's general history of compliance with all HIPAA Rules, which is relevant in determining the amount of a civil money penalty within the penalty range. See 71 FR 8390, 8408. As such, the Department modified the provision to reflect the Department's policy of considering the covered entity's or business associate's general history of compliance with the HIPAA Rules when determining a civil money penalty.

With regard to the phrase “indications of noncompliance,” we first clarify that a mere complaint does not constitute an indication of noncompliance. Instead, prior indications of noncompliance may refer to the number of times the Department has investigated an entity in the past and discovered indications of noncompliance that the Department resolved by informal means, such as satisfactory corrective action voluntarily taken by the covered entity. Finally, we agree that an entity's history of compliance—not only a history of noncompliance—is important, and will consider such a factor.

e. Section 160.410—Affirmative Defenses

Interim Final Rule and Proposed Rule

As noted above, the IFR made changes to the affirmatives defenses found in the Enforcement Rule at § 160.410 to implement the modifications to section 1176(b) of the Social Security Act made by section 13410(d) of the HITECH Act. Specifically, the IFR removed the previous affirmative defense to the imposition of penalties if the covered entity did not know and with the exercise of reasonable diligence would not have known of the violation (since such violations are now punishable under the lowest tier of penalties), and by providing a prohibition on the

imposition of penalties for any violation that is corrected within a 30-day time period, as long as the violation was not due to willful neglect.

The proposed rule included additional modifications to § 160.410 to conform to the changes made to section 1176(b) by the HITECH Act. Specifically, we proposed to implement the revision of section 1176(b)(1) of the Social Security Act by providing in § 160.410(a)(1) and (2) that the affirmative defense of criminally “punishable” is applicable to penalties imposed prior to February 18, 2011, and on or after February 18, 2011, the Secretary's authority to impose a civil money penalty will only be barred to the extent a covered entity or business associate can demonstrate that a criminal penalty has been imposed. Additionally, the Department also proposed modifications to the affirmative defenses in § 160.410 for violations occurring prior to February 18, 2009, to ensure the prior definition of “reasonable cause” continued to apply in such circumstances and avoiding any potential issues regarding a retroactive application of the revised term.

Final Rule

The final rule adopts the proposed modifications to § 160.410. The Department did not receive any comments in response to the NPRM's proposed revisions to this section.

f. Section 160.412—Waiver

Prior to February 18, 2009, § 160.412 stated that “[f]or violations described in § 160.410(b)(3)(i) that are not corrected within the period described in § 160.410(b)(3)(ii), the Secretary may waive the civil money penalty, in whole or in part, to the extent that payment of the penalty would be excessive relative to the violation.” This language implicitly recognized a covered entity's ability to claim an affirmative defense to the imposition of a civil money penalty, under what was then § 160.410(b)(2), by establishing that it did not have knowledge of the violation, determined in accordance with the Federal common law of agency, and by exercising reasonable diligence, would not have known that the violation occurred. While section 13410(d) of the HITECH Act revised section 1176(b) of the Social Security Act to eliminate the affirmative defense for such violations, absent corrective action during a 30-day period, it did not revise the Secretary's waiver authority. As a result, the Enforcement IFR amended § 160.412 to reflect the revisions made to § 160.410 to provide that “[r]egardless of whether violations occur before, on, or after February 18, 2009, the Secretary had the authority to provide a waiver for violations due to reasonable cause and not willful neglect that are not timely corrected (pursuant to the correction period in revised § 160.410(a)(3)(ii) or (b)(2)(ii), as applicable).” See 74 FR 56129.

The proposed rule included conforming changes to § 160.412 to align the provision with the revisions to § 160.410. See 75 FR 40881. The proposed revision would effectively provide the Secretary with the authority to waive a civil money penalty, in whole or in part, for violations described in § 160.410(b)(2) (occurring prior to February 18, 2009, and due to circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated) or § 160.410(c) (occurring on or after February 18, 2009, and involving an establishment to the satisfaction of the Secretary that the violation is not due to willful neglect) and that are not corrected within the period specified under such paragraphs.

Overview of Public Comments

The Department received a few comments in response to the IFR regarding the Secretary's authority to waive the imposition of a civil money penalty for violations occurring on or after February 18, 2009, each of which urged that the Secretary's waiver authority be extended to apply also to penalties for violations of which a covered entity did not know, or through the exercise of reasonable diligence, would not have known, in addition to reasonable cause violations, because “did not know” violations are a less culpable category of violation than reasonable cause violations.

Final Rule

The final rule adopts the modifications to § 160.412 proposed in the NPRM, which addresses the concerns of the above commenters on the IFR.

g. Section 160.418—Penalty Not Exclusive

Proposed Rule

We proposed to revise this section to incorporate a reference to the provision of PSQIA at 42 U.S.C. 299b-22 that provides that penalties are not to be imposed under both PSQIA and the HIPAA Privacy Rule for the same violation.

Final Rule

The Department did not receive substantive public comment on this proposal. The final rule adopts the proposed modification to § 160.418.

h. Section 160.420—Notice of Proposed Determination

Interim Final Rule

The Enforcement IFR also amended § 160.420(a)(4) to add the requirement that, in addition to the proposed penalty amount, the Secretary identify in a notice of proposed determination the applicable violation category in § 160.404 upon which the proposed penalty amount is based. While not statutorily required, the Enforcement IFR included this amendment to provide covered entities and business associates with additional information that would increase their understanding of the violation findings in the notice of proposed determination.

Overview of Public Comment

The Department received three comments supporting this amendment.

Final Rule

The final rule retains the provision as modified in the IFR.

i. Calculation of the 30-Day Cure Period for Willful Neglect Violations

Interim Final Rule

In its discussion of the HITECH Act's revision of affirmative defenses, the Department noted that section 1176(b)(2)(A) of the Social Security Act still operates to exclude violations due to willful neglect from those that, if timely corrected, would be exempt from the Secretary's imposition of a civil money penalty. However, a covered entity's timely action to correct still would be determinative with respect to which of the two tiers of willful neglect penalty amounts would apply. To determine the appropriate penalty tier for such violations, the Department stated it would calculate the 30-day cure period in the same manner as described for determining whether an affirmative defense applied. That is, the Department would look at when a covered entity first had actual or constructive knowledge of a violation due to willful neglect, based on evidence gathered during its investigation, on a case-by-case basis. See 74 FR 56128 (October 30, 2009), 70 FR 20224, 20237-8 (April 18, 2005) and 71 FR 8390, 8410 (February 16, 2006) for prior, more detailed discussions about the Department's determination of when knowledge exists.

Because the Department recognized that the minimum penalty amount under the HITECH Act of a violation due to willful neglect that is corrected during the 30-day cure period is significantly less than that for a violation due to willful neglect that is not timely corrected (equating to a $40,000 minimum penalty amount difference), the IFR specifically requested comment on whether there are alternative approaches to calculating the beginning of the 30-day cure period for this purpose.

Overview of Public Comments

While a few commenters expressed support for utilizing the current scheme in determining which tier should apply to a violation due to willful neglect, other commenters expressed concerns with this approach due to the uncertainty with determining exactly when the cure period begins and that a business associate's knowledge of a violation could be imputed to the covered entity prior to the business associate notifying the covered entity, as well as concerns if the Secretary does not notify an entity of a potential violation in a timely manner. A few commenters suggested that the 30-day cure period begin once the Department notifies the covered entity of a complaint.

Final Rule

The final rule retains the policy that the 30-day cure period for violations due to willful neglect, like those not due to willful neglect, begins on the date that an entity first acquires actual or constructive knowledge of the violation and will be determined based on evidence gathered by the Department during its investigation, on a case-by-case basis.

First, the requirement that an entity have knowledge that a “violation” has occurred, and not only of the facts underlying the violation, is a higher standard than that which is often required by other law. Also, as a practical matter, the date an entity has actual or constructive knowledge of a violation will vary depending on the circumstances involved, and may be the result of notice by a workforce member or business associate, a complaint received by a health care consumer, or notification by the Department that a complaint has been filed. However, other sources of information exist that could establish knowledge, including internal indications of a potential noncompliance such as unusual access or audit log activity.

While we understand commenters' concerns relating to the uncertainty inherent to constructive knowledge, we believe that it provides an appropriate incentive that is consistent with the strengthened enforcement of the HIPAA Rules, as provided in the HITECH Act. Reliance on notification by a complainant or the Department would not encourage self-correction or an entity's establishment of a compliance program that proactively prevents, detects and corrects indications of noncompliance. If the cure period were solely based on external notification, it is quite possible that entities would have little or no incentive to make corrections of noncompliance until long after an incident occurred, if ever. In response to concerns that constructive knowledge may be imputed to the principal when an agent fails to notify the responsible entity, we note that an agent must be acting within the scope of agency for a covered entity or a business associate to be liable for the agent's acts or failures to act. An agent that fails to notify a covered entity or business associate may be acting outside its scope of authority as an agent. In such a circumstance, the agent's knowledge is not imputed to the principal under the Federal Common Law of Agency.

Finally, an entity will have the opportunity to submit evidence establishing its knowledge or lack of knowledge, during the Department's investigation. Entities will also have a right to request a hearing to appeal a finding about knowledge in a notice of proposed determination to the extent they believe the finding is not based on a preponderance of the evidence. An administrative law judge would then review the finding and affirm or modify it.

Response to Other Public Comments

Comment:

A few commenters suggested that 30 days may not be sufficient for a covered entity to complete corrective action, particularly with respect to large organizations with complex systems, structures and relationships. One commenter suggested there should be a process available to allow an organization to apply for a reasonable extension to complete the cure.

Response:

In response to commenters' concern about the length of the 30-day cure period, we note that this time period is defined by statute at section 1176(b) of the Social Security Act, and was not modified by section 13410(d) of the HITECH Act. Thus, we believe there is no authority upon which to base a modification to the length of the cure period.

Comment:

One commenter requested that the Department clarify whether the new enforcement provisions will apply to violations of all HIPAA Administrative Simplification provisions or just to the privacy and security requirements.

Response:

The enforcement regulations at 45 CFR Part 160, Subparts C, D, and E, relate to compliance with, and the enforcement of, all of the Administrative Simplification regulations adopted under subtitle F of Title II of HIPAA, including the Standards for Electronic Transactions and Code Sets (Transactions and Code Sets Rule(s) (referred to in both a singular and plural sense); Standards for Privacy of Individually Identifiable Health Information (HIPAA Privacy Rule); Standard Unique Employer Identifier (EIN Rule); Security Standards (HIPAA Security Rule); and Standard Unique Health Identifier for Health Care Providers (NPI Rule). In addition, the Enforcement Rule applies to the Breach Notification Rule for HIPAA covered entities and business associates.

C. Subparts A and C of Part 164: General Provisions and Modifications to the Security Rule

We proposed implementing modifications to the Security Rule as a result of the HITECH Act and to make certain other changes. Below we respond to comments received on the proposed changes as well as describe the final rule provisions. We also discuss the final technical and conforming changes to the general provisions in Subpart A of Part 164, which applies to the Security, Privacy, and Breach Notification Rules, and respond to comments where substantive comments were received on these changes.

1. Technical Changes to Subpart A—General Provisions

a. Section 164.102—Statutory Basis

This section sets out the statutory basis of Part 164. We proposed and include in this final rule a technical change to include a reference to the provisions of sections 13400 through 13424 of the HITECH Act upon which the regulatory changes discussed below are based.

b. Section 164.104—Applicability

This section sets out to whom Part 164 applies. We proposed to replace the existing paragraph (b) with an applicability statement for business associates, consistent with the provisions of the HITECH Act. Paragraph (b) makes clear that, where provided, the standards, requirements, and implementation specifications of the HIPAA Privacy, Security, and

Breach Notification Rules apply to business associates. We also proposed to remove as unnecessary the existing language in § 164.104(b) regarding the obligation of a health care clearinghouse to comply with § 164.105 relating to organizational requirements of covered entities. This final rule adopts these changes as proposed.

c. Section 164.105—Organizational Requirements

Section 164.105 outlines the organizational requirements and implementation specifications for health care components of covered entities and for affiliated covered entities. As § 164.105 now also applies to Subpart D of Part 164 regarding breach notification for unsecured protected health information, we proposed to remove several specific references to Subparts C and E throughout this section to make clear that the provisions of this section also apply to Subpart D of Part 164. The final rule adopts these modifications.

In addition, we proposed the following modifications to this section.

i. Section 164.105(a)(2)(ii)(C)-(E)

Proposed Rule

As a covered entity's obligation to ensure that a health care component complies with the Privacy and Security Rules is already set out at § 164.105(a)(2)(ii), we proposed to modify this section to remove as unnecessary paragraphs (C) and (D), which pertain to the obligation of a covered entity to ensure that any component that performs business associate-like activities and is included in the health care component complies with the requirements of the Privacy and Security Rules, and to re-designate paragraph (E) as (C). Additionally, we requested comment on whether we should require, rather than permit as was the case at § 164.105(a)(2)(iii)(C), a covered entity that is a hybrid entity to include a component that performs business associate-like activities within its health care component so that such components are directly subject to the Rules.

Overview of Public Comments

Several commenters recommended that hybrid entities should retain the flexibility to either include or exclude business associates from the healthcare component. Two of these commenters stated this option would allow the covered entity to distinguish the functions and responsibilities of the business associate as separate from the health care component, which would result in better compliance, as covered entities would evaluate each business associate separately for compliance purposes. Further, commenters argued that, as the covered entity is ultimately legally liable for compliance

This text is long and has been trimmed here. Open the source document for the complete record.