What were the major modifications to the HIPAA Privacy Rule that the Department of Health and Human Services (HHS) adopted in August 2002?

Answer:

Based on the information received through public comments, testimony at public hearings, meetings at the request of industry and other stakeholders, as well as other communications, HHS identified a number of areas in which the Privacy Rule, as issued in December 2000, would have had potential unintended effects on health care quality or access. As a result, HHS proposed modifications that would maintain strong protections for the privacy of individually identifiable health information, address the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieve unintended administrative burdens created by the Privacy Rule.

Final modifications to the Rule were adopted on August 14, 2002. Among other things, the modifications addressed the following aspects of the Privacy Rule:

• Uses and disclosures for treatment, payment and health care operations, including eliminating the requirement for the individual’s consent for these activities;
• The notice of privacy practices that covered entities must provide to patients;
• Uses and disclosures for marketing purposes;
• Minimum necessary uses and disclosures;
• Parents as the personal representatives of unemancipated minors;
• Uses and disclosures for research purposes; and
• Transition provisions, including business associate contracts.

In addition to these key areas, the modifications included changes to certain other provisions where necessary to clarify the Privacy Rule, and a list of technical corrections intended as editorial or typographical corrections to the Privacy Rule.

For more information about the final modifications to the Privacy Rule, see Modifications to the Standards for Privacy of Individually Identifiable Health Information – Final Rule.

Learn more about health information privacy.

Date Created: 12/19/2002
Last Updated: 12/11/2006