HHS Process for Requesting State Preemption of HIPAA

[Federal Register: March 11, 2003 (Volume 68, Number 47)]
[Notices]
[Page 11554-11555]
[DOCID:fr11mr03-57]

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office for Civil Rights

Notice of Address for Submission of Requests for Preemption Exception Determinations

AGENCY: Office for Civil Rights, HHS.

ACTION: Notification of address for submission of requests for preemption exception determinations.

SUMMARY: This notice advises that, in accordance with the requirements of 45 CFR 160.204(b), a request to except a provision of State law from preemption by a federal standard, requirement, or implementation specification adopted under the Administrative Simplification title of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, must be submitted in writing to the

The requirements for submission of a request for an exception determination are described in the Supplemental Information below, and can be found at 45 CFR 160.203-205.

EFFECTIVE DATES: Requests for preemption exception determinations may be submitted a the designated address upon publication of this notice.

SUPPLEMENTAL INFORMATION: Section 1178(a)(1) of the Social Security Act (the Act), as added by section 262 of HIPAA, Public Law 104-191, establishes a general rule that State law provisions which are contrary to the standards, requirements, or implementation specifications adopted or established by the Secretary of Health and Human Services pursuant to the Administrative Simplification title of HIPAA are preempted by the Federal requirements. The Act, as amended, at sections 1178(a)(2), 1178(b) and 1178(c) provides for certain exceptions to this general rule. Regulations implementing the preemption rule and its exceptions are codified at 45 CFR part 160, subpart B. This notice pertains to section 1178(a)(2)(A) of the Act, which sets forth the circumstances under which the Secretary of Health and Human Services, or his designee, may make a determination that a contrary provision of State law will not be preempted by the Administrative Simplication title of HIPAA. ¹

¹ The Secretary does not have the legal authority to make determinations with respect to the exceptions to preemption in section 1178(a)(2)(B), 1178(b) and 1178(c) of the Act. Thus, the Secretary will not make exception determinations with respect to section 1178(a)(2)(B), which excepts from preemption contrary provisions of State law that relate to the privacy of individually identifiable health information and, under section 264(c)(2) of HIPAA, are "more stringent" than the federal requirements. Similarly, the Secretary does not have the legal authority to make determinations with respect to State laws that are excepted from preemption under sections 1178(b), concerning certain State laws providing for public health reporting, surveillance, investigation, or intervention, or 1178(c), concerning State laws requiring a health plan to report or provide access to information concerning management audits, financial audits, program monitoring or evaluation, or licensure or certificaiton of facilities or individuals.

Section 1178(a)(2)(A) of the Act provides that requests may be made for an exception to the general rule of Federal preemption, where the Secretary determines that a contrary provision of State law meets certain criteria. These criteria for a Secretarial exception determination are set forth at 45 CFR 160.203(a), as follows:"(a) A determination is made by the Secretary under Sec. 160.204 that the provision of State law:

1. Is necessary:
   1. To prevent fraud and abuse related to the provision of or payment for health care;
   2. To ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation;
   3. For State reporting on health care delivery or costs; or
   4. For purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement, or implementation specification under part 164 of this subchapter is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or
2. Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law."

In addition, only State laws that are "contrary" to the Federal requirements are subject to preemption, and thus eligible for an exception determination. See 45 CFR 160.203. As defined at 45 CFR 160.202, "contrary" means that it would be impossible for a covered entity to comply with both the State and Federal requirements, or that the State law is an obstacle to accomplishing the full purposes and objectives of the Administration Simplification provisions of HIPAA.

The regulations also provide that a request to except a provision of State law from preemption under 45 CFR 160.203(a) must be submitted to the Secretary in writing. If the request is from a State, it must be submitted through its chief elected official, or his or her designee. The request must:

1. Identify the provision of State law for which the exception is requested;
2. identify the particular standard, requirement, or implementation specification for which the exception is requested;
3. specify the part of the standard or other provision that will not be implemented if the exception determination is made or the additional data to be collected based on the exception, as appropriate;
4. state how the exception determination would affect health care providers, health plans and other entities; and
5. the reasons why the State law should not be preempted, including how the contrary State law meets one or more of the specific criteria in 45 CFR 160.203(a).

The Secretary may also request additional information that may be necessary for him to make the exception determination. See 45 CFR 160.204.

This notice establishes that, for the purposes of 45 CFR 160.204, exception determination requests should be addressed to the

To expedite handling, the envelope should also state: "ATTN: Exception Determination Request."

² This notice identifies the address where all exception determinations should be submitted. The Secretary delegated to the Director of the Office for Civil Rights (OCR) the authority to make exception determinations as they may relate to the Privacy Rule. See 65 FR 82381. The Secretary, or his designee, shall make exception determinations with respect to requests concerning the other Administrative Simplification Rules.

The Federal standard, requirement, or implementation specification remains in effect until an exception determination is made. When such determinations are made, we will promptly inform the public through publication of notice in the Federal Register and on the Department's web sites, including the OCR web site at http://www.hhs.gov/ocr/hipaa/.

The OCR Web site and the Web site for the Centers for Medicare and Medicaid Services, http://www.cms.hhs.gov/hipaa/, may also be consulted for more information about the Administrative Simplification provisions (including the Privacy Rule). In addition, answers to frequently asked questions about preemption and exception determinations will be available on the OCR web site soon.

FOR FURTHER INFORMATION CONTACT:

Telephone number: (202) 205-8725.

Dated: January 29, 2003.
Richard M. Campanelli,
Director, Office for Civil Rights.
[FR Doc. 03-5774 Filed 3-10-03; 8:45 am]

BILLING CODE 4153-01-M

Go to TOP