This page explains in the briefest possible form the scope of the new privacy rules promulgated by the Department of Health and Human Services in December 2000. We've also included HHS's summary of its new regulations.

Coverage: Health plans, health clearing ouses, and health care providers that conduct certain electronic transactions. Self-insured health plans with less than 50 participants are excluded.

Protected Information: All medical records and individually identifiable health information, however communicated. Rules for de-identifying records are established.

Limits on Disclosure and Use: Permissible for purposes of treatment, payment and operations pursuant to patient's general advance consent. Disclosure to patient or personal representative, or in emergencies, is permitted. A health care organization may withhold treatment from patient who does not consent. Use or disclosure for non-health care purposes is not permitted without written, voluntary, truly informed patient permission. Treatment or coverage cannot be conditioned on consent to non-health care use. Patient consent can be revoked at any time by a writing. Except for treatment purposes and a few other exceptions, disclosure must be limited to the minimum necessary for the purposes of the disclosure. Even for treatment purposes, disclosure must be limited to what is reasonably necessary to accomplish the purpose for which the request was made.

Permitted Disclosure without Consent: Disclosure is permitted to faciliate: Oversight of the health care system; public health; research approved by an independent privacy board or institutional review board; certain marketing and fundraising committees if targeted individuals are given the opportunity to opt out from receiving future communications; judical or administrative proceedings; certain law enforcment activities; emergencies and serious health/safety threats; certain other specified circumstances.

Disclosure is also permitted to "business associates" that assist covered entities in ministerial functions like billing, administration, etc. Covered entities are responsible for the conduct of their business associates.

Patient Control and Access: Health care organizations must notify patients re their privacy rights and have written privacy procedures; patients may see, copy and request amendments to their records; patients may request restrictions on the use of their records although providers need not comply; patients may complain to their provider (which must establish a grievance procedure) or to HHS about violations.

Preemption: The regulations preempt less stringent state laws but not more stringent state laws, except where state laws permit disclosures for civil purposes.

Effective Date: 2003.