View Rule

Statement of Need: The Department received many inquires from Congress, industry, and private citizens about how the rule will operate, and concerns over the complexity and workability of the rule. On July 6, 2001, in response to these and other comments, the Department issued guidance to address some of the misunderstandings regarding the rule, and to provide clarifications on various provisions. The Department has preliminarily determined that some modifications to the Privacy Rule would be appropriate. Entities covered by the Privacy Rule have until April 14, 2003 to come into compliance (and until April 14, 2004 for small health plans). Timely action is needed so that covered entites can implement these modifications to meet these deadlines with minimal cost and disruption.

Summary of the Legal Basis: Section 262 of the Health Insurance Portability and Accountability Act of 1996, adding Section 1174 to the Social Security Act (42 U.S.C. 1320d-3), generally provides that the Department, in reference to the privacy and other standards, "shall review the standards ... and shall adopt modifications to the standards (including additions to the standards), as determined appropriate .... Any addition or modification to a standard shall be completed in a manner which minimizes the disruption and cost of compliance."

Alternatives: Modifications to the Privacy Rule requires rulemaking. Therefore, there are no alternatives to regulatory action.

Anticipated Costs and Benefits: The changes proposed in this rulemaking are intended to address the possible adverse effects of the final privacy standards on an individual?s access to, or the quality of, health care. The Privacy Rule was estimated to produce net costs of $17.6 billion, with net present value costs of $11.8 billion (2003 dollars) over ten years (2003-2012). The modifications touch on five of the key policy areas addressed by the final regulatory impact analysis, including consent, notice, research, marketing, and business associates. The Department estimates the modification in this proposal would lower the net cost of the Privacy Rule by approximately $100 million over ten years. The benefits of these modifications would be lower costs, and enhanced implementation and compliance with the Privacy Rule without compromising the protection of individually identifiable health information or access to quality health care.

Risks: Not applicable.