Standards for Privacy of Individually Identifiable Health Information

IV. Final Regulatory Impact Analysis

Federal law (5 U.S.C. 804(2), as added by section 251 of Pub. L. No. 104–21), specifies that a ‘‘major rule’’ is any rule that the Office of Management and Budget finds is likely to result in:

• An annual effect on the economy of $100 million or more;
  
  
• A major increase in costs or prices for consumers, individual industries, Federal, State, or local government
  agencies, or geographic regions; or
  
  
• Significant adverse effects in competition, employment, investment productivity, innovation, or on the ability of United States based enterprises to compete with foreign based enterprises in domestic and export markets.

The impact of the modifications adopted in this rulemaking will have an annual effect on the economy of at least
$100 million. Therefore, this Rule is a major rule as defined in 5 U.S.C. 804(2).

Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects; distributive impacts; and equity). According to Executive Order 12866, a regulatory action is ‘‘significant’’ if it meets any one of a number of specified conditions, including having an annual effect on the economy of $100 million or more, adversely affecting in a material way a sector of the economy, competition, or jobs, or if it raises novel legal or policy issues. The purpose of the regulatory impact analysis is to assist decisionmakers in understanding the potential ramifications of a regulation as it is being developed. The analysis is also intended to assist the public in understanding the general economic ramifications of the regulatory changes.

The December 2000 preamble to the Privacy Rule included a regulatory impact analysis (RIA), which estimated
the cost of the Privacy Rule at $17.6 billion over ten years. 65 FR 82462, 82758. The modifications to the Privacy
Rule adopted by this rulemaking are a result of comment by the industry and the public at large identifying a number of unintended consequences of the Privacy Rule that could adversely affect access to, or the quality of, health care delivery. These modifications should facilitate implementation and compliance with the Privacy Rule, and lower the costs and burdens associated with the Privacy Rule while maintaining the confidentiality of protected health information. The Department estimates the impact of the modifications adopted in this rulemaking will be a net reduction of costs associated with the Privacy Rule of at least $100 million over ten years.

The modifications affect five areas of the Privacy Rule that will have an economic impact: (1) consent; (2) notice;
(3) marketing; (4) research; and (5) business associates. In addition, this rulemaking contains a number of
changes that, though important, can be categorized as clarifications of intended policy. For example, the modifications permit certain uses and disclosures of protected health information that are incidental to an otherwise permitted use or disclosure. This change recognizes such practices as the need for physicians to talk to patients in semiprivate hospital rooms or nurses to communicate with others in public areas, and avoids the costs covered entities might have incurred to reconfigure facilities as necessary to ensure absolute privacy for these common treatment-related communications. This and other modifications adopted in this rulemaking (other than those described below) clarify the intent of the standards in the Privacy Rule and, as such, do not change or alter the associated costs that were estimated for the Privacy Rule. Public comments have indicated that these provisions would be interpreted in a way that could significantly increase costs. However, because that was not
the intent of the December 2000 Privacy Rule, the Department is not ascribing cost savings to the clarification of these provisions.

A. Summary of Costs and Benefits in the December 2000 Regulatory Impact Statement

The Privacy Rule was estimated to produce net costs of $17.6 billion, with net present value costs of $11.8 billion
(2003 dollars) over ten years (2003 - 2012). The Department estimates the modifications in this proposal would
lower the net cost of the Privacy Rule by approximately $100 million over ten years.

Measuring both the economic costs and benefits of health information privacy was recognized as a difficult task. The paucity of data and incomplete information on current industry privacy and information system practices made cost estimation a challenge. Benefits were difficult to measure because they are, for the most part, inherently intangible. Therefore, the regulatory impact analysis in the Privacy Rule focused on the key policy areas addressed by the privacy standards, some of which are affected by the modifications adopted in this rulemaking.

[Top of Page] [Previous] [Next: Prevent Barriers]