|
|
Final Standards for
Privacy of Individually Identifiable Health Information
Subpart A - General Provisions
§160.101 Statutory basis and purpose.
The requirements of this subchapter implement sections 1171 through
1179 of the Social Security Act (the Act), as added by section 262
of Public Law 104-191, and section 264 of Public Law 104-191.
§160.102 Applicability.
- Except as otherwise provided, the standards,
requirements, and implementation specifications adopted under
this subchapter apply to the following entities:
- A health plan.
- A health care clearinghouse.
- A health care provider who transmits any health information
in electronic form in connection with a transaction covered
by this subchapter.
- To the extent required under section
201(a)(5) of the Health Insurance Portability Act of 1996, (Pub.
L. 104-191), nothing in this subchapter shall be construed to
diminish the authority of any Inspector General, including such
authority as provided in the Inspector General Act of 1978, as
amended (5 U.S.C. App.).
§ 160.103 Definitions.
Except as otherwise provided, the following definitions apply to
this subchapter:
Act means the Social Security Act.
ANSI stands for the American National Standards Institute.
Business associate:
- Except as provided in paragraph (2) of this definition,
business associate means, with respect to a covered entity,
a person who:
- On behalf of such covered entity or of an organized health
care arrangement (as defined in §164.501 of this subchapter)
in which the covered entity participates, but other than in
the capacity of a member of the workforce of such covered
entity or arrangement, performs, or assists in the performance
of:
- A function or activity involving the use or disclosure
of individually identifiable health information, including
claims processing or administration, data analysis, processing
or administration, utilization review, quality assurance,
billing, benefit management, practice management, and
repricing; or
- Any other function or activity regulated by this subchapter;
or
- Provides, other than in the capacity of a member of the
workforce of such covered entity, legal, actuarial, accounting,
consulting, data aggregation (as defined in §
164.501 of this subchapter), management, administrative,
accreditation, or financial services to or for such covered
entity, or to or for an organized health care arrangement
in which the covered entity participates, where the provision
of the service involves the disclosure of individually identifiable
health information from such covered entity or arrangement,
or from another business associate of such covered entity
or arrangement, to the person.
- A covered entity participating in an organized health care arrangement
that performs a function or activity as described by paragraph
(1)(i) of this definition for or on behalf of such organized health
care arrangement, or that provides a service as described in paragraph
(1)(ii) of this definition to or for such organized health care
arrangement, does not, simply through the performance of such
function or activity or the provision of such service, become
a business associate of other covered entities participating in
such organized health care arrangement.
- A covered entity may be a business associate of another covered
entity.
Compliance date means the date by which a covered
entity must comply with a standard, implementation specification,
requirement, or modification adopted under this subchapter.
Covered entity means:
- A health plan.
- A health care clearinghouse.
- A health care provider who transmits any health information
in electronic form in connection with a transaction covered by
this subchapter.
Group health plan (also see definition of health
plan in this section) means an employee welfare benefit plan
(as defined in section 3(1) of the Employee Retirement Income and
Security Act of 1974 (ERISA), 29 U.S.C. 1002(1)), including insured
and self-insured plans, to the extent that the plan provides medical
care (as defined in section 2791(a)(2) of the Public Health Service
Act (PHS Act), 42 U.S.C. 300gg-91(a)(2)), including items and services
paid for as medical care, to employees or their dependents directly
or through insurance, reimbursement, or otherwise, that:
- Has 50 or more participants (as defined in section 3(7) of
ERISA, 29 U.S.C. 1002(7)); or
- Is administered by an entity other than the employer that established
and maintains the plan.
HCFA stands for Health Care Financing Administration
within the Department of Health and Human Services.
HHS stands for the Department of Health and
Human Services.
Health care means care, services, or supplies related
to the health of an individual. Health care includes, but
is not limited to, the following:
- Preventive, diagnostic, therapeutic, rehabilitative, maintenance,
or palliative care, and counseling, service, assessment, or procedure
with respect to the physical or mental condition, or functional
status, of an individual or that affects the structure or function
of the body; and
- Sale or dispensing of a drug, device, equipment, or other item
in accordance with a prescription.
Health care clearinghouse means a public or
private entity, including a billing service, repricing company,
community health management information system or community health
information system, and “value-added” networks and switches,
that does either of the following functions:
- Processes or facilitates the processing of health information
received from another entity in a nonstandard format or containing
nonstandard data content into standard data elements or a standard
transaction.
- Receives a standard transaction from another entity and processes
or facilitates the processing of health information into nonstandard
format or nonstandard data content for the receiving entity.
Health care provider means a provider of services
(as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)),
a provider of medical or health services (as defined in section
1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or
organization who furnishes, bills, or is paid for health care in
the normal course of business.
Health information means any information,
whether oral or recorded in any form or medium, that:
- Is created or received by a health care provider, health plan,
public health authority, employer, life insurer, school or university,
or health care clearinghouse; and
- Relates to the past, present, or future physical or mental health
or condition of an individual; the provision of health care to
an individual; or the past, present, or future payment for the
provision of health care to an individual.
Health insurance issuer (as defined in section 2791(b)(2)
of the PHS Act, 42 U.S.C. 300gg-91(b)(2) and used in the definition
of health plan in this section) means an insurance company,
insurance service, or insurance organization (including an HMO)
that is licensed to engage in the business of insurance in a State
and is subject to State law that regulates insurance. Such term
does not include a group health plan.
Health maintenance organization (HMO) (as
defined in section 2791(b)(3) of the PHS Act, 42 U.S.C. 300gg-91(b)(3)
and used in the definition of health plan in this section)
means a federally qualified HMO, an organization recognized as an
HMO under State law, or a similar organization regulated for solvency
under State law in the same manner and to the same extent as such
an HMO.
Health plan means an individual or group plan
that provides, or pays the cost of, medical care (as defined in
section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg- 91(a)(2)).
- Health plan includes the following, singly or in combination:
- A group health plan, as defined in this section.
- A health insurance issuer, as defined in this section.
- An HMO, as defined in this section.
- Part A or Part B of the Medicare program under title XVIII
of the Act.
- The Medicaid program under title XIX of the Act, 42 U.S.C.
1396, et seq.
- An issuer of a Medicare supplemental policy (as defined
in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)).
- An issuer of a long-term care policy, excluding a nursing
home fixed- indemnity policy.
- An employee welfare benefit plan or any other arrangement
that is established or maintained for the purpose of offering
or providing health benefits to the employees of two or more
employers.
- The health care program for active military personnel under
title 10 of the United States Code.
- The veterans health care program under 38 U.S.C. chapter
17.
- The Civilian Health and Medical Program of the Uniformed
Services (CHAMPUS)(as defined in 10 U.S.C. 1072(4)).
- The Indian Health Service program under the Indian Health
Care Improvement Act, 25 U.S.C. 1601, et seq.
- The Federal Employees Health Benefits Program under 5 U.S.C.
8902, et seq.
- An approved State child health plan under title XXI of the
Act, providing benefits for child health assistance that meet
the requirements of section 2103 of the Act, 42 U.S.C. 1397,
et seq.
- The Medicare + Choice program under Part C of title XVIII
of the Act, 42 U.S.C. 1395w-21 through 1395w-28.
- A high risk pool that is a mechanism established under State
law to provide health insurance coverage or comparable coverage
to eligible individuals.
- Any other individual or group plan, or combination of individual
or group plans, that provides or pays for the cost of medical
care (as defined in section 2791(a)(2) of the PHS Act, 42
U.S.C. 300gg-91(a)(2)).
- Health plan excludes:
- Any policy, plan, or program to the extent that it provides,
or pays for the cost of, excepted benefits that are listed
in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1);
and
- A government-funded program (other than one listed in paragraph
(1)(i)- (xvi)of this definition):
- Whose principal purpose is other than providing, or
paying the cost of, health care; or
- Whose principal activity is:
- The direct provision of health care to persons;
or
- The making of grants to fund the direct provision
of health care to persons.
Implementation specification means specific
requirements or instructions for implementing a standard.
Modify or modification refers
to a change adopted by the Secretary, through regulation, to a standard
or an implementation specification.
Secretary means the Secretary of Health and Human
Services or any other officer or employee of HHS to whom the authority
involved has been delegated.
Small health plan means a health plan with
annual receipts of $5 million or less.
Standard means a rule, condition, or requirement:
- Describing the following information for products, systems,
services or practices:
- Classification of components.
- Specification of materials, performance, or operations;
or
- Delineation of procedures; or
- With respect to the privacy of individually identifiable health
information.
Standard setting organization (SSO) means
an organization accredited by the American National Standards Institute
that develops and maintains standards for information transactions
or data elements, or any other standard that is necessary for, or
will facilitate the implementation of, this part.
State refers to one of the following:
- For a health plan established or regulated by Federal law,
State has the meaning set forth in the applicable section
of the United States Code for such health plan.
- For all other purposes, State means any of the several
States, the District of Columbia, the Commonwealth of Puerto Rico,
the Virgin Islands, and Guam.
Trading partner agreement means an agreement related
to the exchange of information in electronic transactions, whether
the agreement is distinct or part of a larger agreement, between
each party to the agreement. (For example, a trading partner agreement
may specify, among other things, the duties and responsibilities
of each party to the agreement in conducting a standard transaction.)
Transaction means the transmission of information
between two parties to carry out financial or administrative activities
related to health care. It includes the following types of information
transmissions:
- Health care claims or equivalent encounter information.
- Health care payment and remittance advice.
- Coordination of benefits.
- Health care claim status.
- Enrollment and disenrollment in a health plan.
- Eligibility for a health plan.
- Health plan premium payments.
- Referral certification and authorization.
- First report of injury.
- Health claims attachments.
- Other transactions that the Secretary may prescribe by regulation.
Workforce means employees, volunteers, trainees,
and other persons whose conduct, in the performance of work for
a covered entity, is under the direct control of such entity, whether
or not they are paid by the covered entity.
§ 160.104 Modifications.
- Except as provided in paragraph (b) of this section, the Secretary
may adopt a modification to a standard or implementation specification
adopted under this subchapter no more frequently than once every
12 months.
- The Secretary may adopt a modification at any time during the
first year after the standard or implementation specification
is initially adopted, if the Secretary determines that the modification
is necessary to permit compliance with the standard or implementation
specification.
- The Secretary will establish the compliance date for any standard
or implementation specification modified under this section.
- The compliance date for a modification is no earlier than
180 days after the effective date of the final rule in which
the Secretary adopts the modification.
- The Secretary may consider the extent of the modification
and the time needed to comply with the modification in determining
the compliance date for the modification.
- The Secretary may extend the compliance date for small health
plans, as the Secretary determines is appropriate.
|
 |
 |
