Promulgation of “Standards for Privacy of Individually Identifiable Health Information: Final Rule”

With the exception of this essay, all articles in this text were written early in 2000. At that time, the Department of Health and Human Services (HHS) was deep in the process of formulating federal standards for the protection of individually identifiable health information. Congress initiated this process in 1996 when it passed the Health Insurance Portability and Accountability Act (HIPAA). In this act, Congress required that steps be taken to improve “the efficiency and effectiveness of the health care system by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.”1 In this mandate, Congress sought to achieve two goals: administrative simplification and cost reduction for electronically transmitted health information. At the same time, Congress recognized that these goals could not be achieved in the absence of a uniform set of standards for protecting the privacy and confidentiality of such medical records. Thus, in drafting the HIPAA, Congress required the Secretary of HHS to develop recommendations for medical privacy and to submit these recommendations to Congress for possible legislative action. It also specified that if Congress failed to enact legislation on this topic by August 21, 1999, the Secretary of HHS would be responsible for promulgating regulations containing standards with respect to the privacy of electronically transmitted, individually identifiable health information.