Department of Health and Human Services, Office of the Secretary: Standards for Privacy of Individually Identifiable Health Information

Department of Health and Human Services, Office of the Secretary: Standards for Privacy of Individually Identifiable Health Information, GAO-02-1046R, August 22, 2002

B-291122



August 22, 2002

The Honorable Edward M. Kennedy
Chairman
The Honorable Judd Gregg
Ranking Minority Member
Committee on Health, Education, Labor, and Pensions
United States Senate


The Honorable W.J. Billy Tauzin
Chairman
The Honorable John D. Dingell
Ranking Minority Member
Committee on Energy and Commerce
House of Representatives


Subject: Department of Health and Human Services, Office of the Secretary: Standards for Privacy of Individually Identifiable Health Information

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Department of Health and Human Services (HHS), Office of the Secretary, entitled Standards for Privacy of Individually Identifiable Health Information (RIN: 0991-AB14). We received the rule on August 9, 2002. It was published in the Federal Register as a final rule on August 14, 2002. 67 Fed. Reg. 53182.

The final rule modifies HHS's previously issued rule entitled Standards for Privacy of Individually Identifiable Health Information. 65 Fed. Reg. 82462, December 28, 2000. According to HHS, the modifications maintain strong protections for the privacy of individually identifiable health information while clarifying certain provisions of the rule, addressing the unintended negative effects of the rule on health care quality or access to health care, and relieving unintended administrative burdens.

Enclosed is our assessment of the HHS's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. Our review indicates that HHS complied with the applicable requirements.

If you have any questions about this report, please contact James W. Vickers, Assistant General Counsel, at (202) 512-8210. The official responsible for GAO evaluation work relating to the subject matter of the rule is William Scanlon, Managing Director, Health Care. Mr. Scanlon can be reached at (202) 512-7114.



signed

Kathleen E. Wannisky
Managing Associate General Counsel

Enclosure

cc: Ann Stallion
Regulations Coordinator
Department of Health and
Human Services

ENCLOSURE

ANALYSIS UNDER 5 U.S.C. 801(a)(1)(B)(i)-(iv) OF A MAJOR RULE
ISSUED BY THE
DEPARTMENT OF HEALTH AND HUMAN SERVICES,
OFFICE OF THE SECRETARY
ENTITLED
"STANDARDS FOR PRIVACY OF INDIVIDUALLY
IDENTIFIABLE HEALTH INFORMATION"
(RIN: 0991-AB14)


(i) Cost-benefit analysis

HHS estimated that the December 28, 2000, privacy rule cost of compliance would be $17.6 billion over 10 years. HHS estimates that the modifications contained in the instant final rule will result in savings of at least $100 million over 10 years.

(ii) Agency actions relevant to the Regulatory Flexibility Act, 5 U.S.C. 603-605, 607, and 609

HHS has determined that the final rule will not have a significant economic impact on a substantial number of small entities. HHS estimates that there are approximately 465,000 covered small entities and even if all of the projected $100 million savings over 10 years was accrued to them, the impact would be de minimis.

(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532-1535

According to HHS, the final rule does not contain either an intergovernmental or private sector mandate, as defined in title II, of more than $100 million in any one year.

(iv) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. 551 et seq.

The final rule was issued using the notice and comment procedures contained at 5 U.S.C. 553. On March 27, 2002, HHS published an Notice of Proposed Rulemaking in the Federal Register. 67 Fed. Reg. 14776. In response, HHS received more than 11,400 comments, which are discussed in the preamble to the final rule.

Paperwork Reduction Act, 44 U.S.C. 3501-3520

The final rule contains modified information collections that are subject to review by the Office of Management and Budget. The preamble to the final rule contains the information required by the Paperwork Reduction Act, including the estimated annual burden estimate, and requests public comments on the collections.

Statutory authorization for the rule

The final rule is promulgated pursuant to the authority contained in sections 1171 through 1179 of the Social Security Act (42 U.S.C. 1320d through 1329d-8) as added by section 262 of Public Law 104-191, 110 Stat. 2021-2031, and section 264 of Public Law 104-191 (42 U.S.C. 1320d-2 note).

Executive Order No. 12866

The final rule was reviewed by OMB and found to be an economically significant regulatory action.

Executive Order No. 13132 (Federalism)

HHS has determined that the final rule would not significantly affect the rights, roles, and responsibilities of states. The modification that has the most direct effect on federalism regards the rights of parents and minors under state law. The rule makes clear that HHS's intent is to defer to state law with regard to such rights.