HIPAA Regulations: General Provisions: Definitions: Health Information - § 160.103
As Contained in the HHS HIPAA Rules
|
HHS Regulations as Amended January 2013 |
Health information any information, including genetic information, whether oral or recorded in any form or medium, that:
-
Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
-
Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
| HHS Description and Commentary From the January 2013 Amendments General Provisions: Definitions - Health Information |
Proposed Rule
Prior to enactment of GINA, the Department issued guidance that genetic information is health information protected by the Privacy Rule to the extent that such information is individually identifiable and held by a covered entity (subject to the general exclusions from the definition of “protected health information”). Section 105 of GINA requires the Secretary to revise the Privacy Rule to make clear that genetic information is health information under the Rule. Thus, the Department proposed to modify the definition of “health information” at § 160.103 to explicitly provide that such term includes genetic information.
The Department received a few comments expressing specific support for and one comment against the proposed inclusion of the term “genetic information” in the definition of “health information.” The commenters supporting the revision to the definition of “health information” indicated that such an inclusion was necessary to clarify that genetic information is health information. The commenter against the proposed inclusion to the definition argued that although GINA directs the Department to treat genetic information as health information, the language of GINA does not require a change to the definition of “health information,” and this change would create costs for health plans, which would have to update all their policies and procedures to reflect the change.
Final Rule
The final rule adopts the proposed modification to the definition of “health information” at § 160.103. This modification to the definition is a necessary clarification to the Privacy Rule based on the statutory language. Given that revising the definition of “health information” to include genetic information does not substantively change the scope of the Privacy Rule, it is unclear why such a change alone would require revisions to a health plan’s policies and procedures. Health plans that perform underwriting will otherwise need to revise their policies and procedures as necessary to comply with this final rule, as well as the modifications to the HIPAA Rules required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. Thus, to the extent the concern about this modification stems from the fact that a health plan’s policies and procedures quote the prior regulatory definition of “health information,” the health plan can revise the definition at the time it is otherwise updating its policies and procedures to comply with these rules.
| HHS Response to Comments Received From the Original Rulemaking General Provisions: Definitions - Health Information |
The response to comments on health information is included in the response to comments on individually identifiable health information, in the preamble discussion of § 164.501.