Privacy of Individually Identifiable Health Information, GAO-02-1046R, B-291122, August 22, 2002
Highlights
This is our report on a major rule promulgated by the Department of Health and Human Services (HHS). It was published in the Federal Register as a final rule on August 14. Enclosed is our assessment of the HHS's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report. The official responsible for GAO evaluation work relating to the subject matter of the rule is William Scanlon. HHS estimates that the modifications contained in the instant final rule will result in savings of at least $100 million over 10 years. (ii) Agency actions relevant to the Regulatory Flexibility Act. 609 HHS has determined that the final rule will not have a significant economic impact on a substantial number of small entities.
Privacy of Individually Identifiable Health Information, GAO-02-1046R, B-291122, August 22, 2002
The Honorable Edward M. Kennedy Chairman The Honorable Judd Gregg Ranking Minority Member Committee on Health, Education, Labor, and Pensions United States Senate
The Honorable W.J. "Billy" Tauzin Chairman The Honorable John D. Dingell Ranking Minority Member Committee on Energy and Commerce House of Representatives
Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Department of Health and Human Services (HHS), Office of the Secretary, entitled "Standards for Privacy of Individually Identifiable Health Information" (RIN: 0991-AB14). We received the rule on August 9, 2002. It was published in the Federal Register as a final rule on August 14, 2002. 67 Fed. Reg. 53182.
The final rule modifies HHS's previously issued rule entitled "Standards for Privacy of Individually Identifiable Health Information." 65 Fed. Reg. 82462, December 28, 2000. According to HHS, the modifications maintain strong protections for the privacy of individually identifiable health information while clarifying certain provisions of the rule, addressing the unintended negative effects of the rule on health care quality or access to health care, and relieving unintended administrative burdens.
Enclosed is our assessment of the HHS's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. Our review indicates that HHS complied with the applicable requirements.
If you have any questions about this report, please contact James W. Vickers, Assistant General Counsel, at (202) 512-8210. The official responsible for GAO evaluation work relating to the subject matter of the rule is William Scanlon, Managing Director, Health Care. Mr. Scanlon can be reached at (202) 512-7114.
signed
Kathleen E. Wannisky
Managing Associate General Counsel
Enclosure
cc: Ann Stallion
Regulations Coordinator
Department of Health and Human Services
ENCLOSURE
ANALYSIS UNDER 5 U.S.C. Sec. 801(a)(1)(B)(i)-(iv) OF A MAJOR RULE ISSUED BY THE DEPARTMENT OF HEALTH AND HUMAN SERVICES, OFFICE OF THE SECRETARY ENTITLED "STANDARDS FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION" (RIN: 0991-AB14)
(i) Cost-benefit analysis
HHS estimated that the December 28, 2000, privacy rule cost of compliance would be $17.6 billion over 10 years. HHS estimates that the modifications contained in the instant final rule will result in savings of at least $100 million over 10 years.
(ii) Agency actions relevant to the Regulatory Flexibility Act, 5 U.S.C. Secs. 603-605, 607, and 609
HHS has determined that the final rule will not have a significant economic impact on a substantial number of small entities. HHS estimates that there are approximately 465,000 covered small entities and even if all of the projected $100 million savings over 10 years was accrued to them, the impact would be de minimis.
(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. Secs. 1532-1535
According to HHS, the final rule does not contain either an intergovernmental or private sector mandate, as defined in title II, of more than $100 million in any one year.
(iv) Other relevant information or requirements under acts and executive orders
Administrative Procedure Act, 5 U.S.C. Secs. 551 et seq.
The final rule was issued using the notice and comment procedures contained at 5 U.S.C. 553. On March 27, 2002, HHS published an Notice of Proposed Rulemaking in the Federal Register. 67 Fed. Reg. 14776. In response, HHS received more than 11,400 comments, which are discussed in the preamble to the final rule.
Paperwork Reduction Act, 44 U.S.C. Secs. 3501-3520
The final rule contains modified information collections that are subject to review by the Office of Management and Budget. The preamble to the final rule contains the information required by the Paperwork Reduction Act, including the estimated annual burden estimate, and requests public comments on the collections.
Statutory authorization for the rule
The final rule is promulgated pursuant to the authority contained in sections 1171 through 1179 of the Social Security Act (42 U.S.C. 1320d through 1329d-8) as added by section 262 of Public Law 104-191, 110 Stat. 2021-2031, and section 264 of Public Law 104-191 (42 U.S.C. 1320d-2 note).
Executive Order No. 12866
The final rule was reviewed by OMB and found to be an "economically significant" regulatory action.
Executive Order No. 13132 (Federalism)
HHS has determined that the final rule would not significantly affect the rights, roles, and responsibilities of states. The modification that has the most direct effect on federalism regards the rights of parents and minors under state law. The rule makes clear that HHS's intent is to defer to state law with regard to such rights.