DoDM 602518.pdf

DOD MANUAL 6025.18

IMPLEMENTATION OF THE HEALTH INSURANCE PORTABILITY

AND ACCOUNTABILITY ACT (HIPAA) PRIVACY RULE IN DOD

HEALTH CARE PROGRAMS

Originating Component: Office of the Under Secretary of Defense for Personnel and Readiness

Effective: March 13, 2019

Releasability: Cleared for public release. This manual is available on the Directives

Division Website at http://www.esd.whs.mil/DD/.

Reissues and Cancels: DoD 6025.18-R, “DoD Health Information Privacy Regulation,”

January 24, 2003

Approved by: James N. Stewart, Assistant Secretary of Defense for Manpower and

Reserve Affairs, Performing the Duties of the Under Secretary of Defense for Personnel and Readiness

Purpose: This issuance, in accordance with the authority in DoD Directive (DoDD) 5124.02, implements the policy in DoD Instruction (DoDI) 6025.18, assigns responsibilities, and provides procedures for:

• DoD compliance with the privacy regulations adopted under HIPAA, Public Law 104-191, at:

o Part 160 and Part 164, Subpart E of Title 45, Code of Federal Regulations (CFR) (also known and referred to in this issuance as the “HIPAA Privacy Rule”).

o Part 160 and Part 164, Subpart D of Title 45, CFR (also known and referred to in this issuance as the “HIPAA Breach Rule”).

• Integration of HIPAA compliance with related information privacy and security requirements, health information technology development, and associated procurement activities.

DoDM 6025.18, March 13, 2019

TABLE OF CONTENTS 2

TABLE OF CONTENTS

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1. Applicability

1.2. Policy

1.3. Information Collections

SECTION 2: RESPONSIBILITIES

2.1. Director, DHA

2.2. DoD Component Heads of DoD Covered Entities

SECTION 3: AUTHORITIES, SCOPE, ENFORCEMENT, OTHER LAWS, AND ORGANIZATIONAL

RESPONSIBILITIES

3.1. Legal Authorities in General

a. General Provisions

b. Uses and Disclosures of PHI

c. Uses and Disclosures of PHI Special Rules and Requirements

d. DoD Covered Entity Obligations Regarding Individual Rights

e. Breach Response Provisions

f. Additional Administrative Requirements for the MHS to Implement Health

Information Privacy Protections

3.2. Scope, Enforcement, and Relationship to Other Laws

a. Inspector General

b. Preemption of State Law

c. Compliance and Enforcement by the Secretary of HHS

d. Relationship to the Privacy Act

e. No Private Cause of Action

f. Relationship to Section 552 of Title 5, U.S.C., Also Known as the “Freedom of

Information Act (FOIA).”

3.3. Organizational Roles and Responsibilities

a. Covered Entities in the MHS

b. The MHS and Organized Health Care Arrangements

c. Business Associate Arrangements among and for DoD Components

d. Requirements for a Covered Entity with Multiple Covered Functions

e. DoD as a Hybrid Entity

SECTION 4. USES AND DISCLOSURES OF PHI

4.1. General Rules on Uses or Disclosures of PHI

a. Standard: Permitted and Prohibited Uses and Disclosures

b. Implementation Specifications: Treatment, Payment, and Health Care Operations. . 25

c. Implementation Specifications: Disclosures through Health Information Exchange. 26

4.2. Uses And Disclosures for Which an Authorization Is Required

a. Standard Operating Procedures

b. Implementation Specifications: General Requirements

c. Implementation Specifications: Core Elements and Requirements

4.3. Uses and Disclosures Requiring an Opportunity for Individual to Agree or to Object. . 31

a. Standard: Use and Disclosure for Facility Directories

TABLE OF CONTENTS 3

b. Standard: Uses and Disclosures for Involvement in the Individual’s Care and Notification Purposes

4.4. Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required

a. Standard: Uses and Disclosures Required by Law

b. Standard: Uses and Disclosures for Public Health Activities

c. Standard: Disclosures About Victims of Abuse, Neglect, or Domestic Violence

d. Standard: Uses and Disclosures for Health Oversight Activities

e. Standard: Uses and Disclosures for Judicial and Administrative Proceedings

f. Standard: Disclosures for Law Enforcement Purposes

g. Standard: Uses and Disclosures About Decedents

h. Standard: Uses and Disclosures for Cadaveric Organ, Eye, or Tissue Donation

Purposes

i. Standard: Uses and Disclosures for Research Purposes

j. Standard: Uses and Disclosures to Avert Serious Threat to Health or Safety

k. Standard: Uses and Disclosures for Specialized Government Functions

l. Standard: Disclosures for Workers Compensation

4.5. Special Rules and Other Requirements Relating to Uses And Disclosures of PHI

a. De-Identification of PHI

b. Minimum Necessary Rule

c. Limited Data Set

d. Incidental Use and Disclosure Rule

e. Standard: Disclosure to Business Associates

f. Standard: Disclosures by Whistleblowers and Workforce Crime Victims

g. Personal Representatives

h. Standard: Deceased Individuals

i. Verification of Identity Before Disclosure of PHI

j. Special Rules for Substance Use Disorder Records

k. Special Rules for Genetic Information

SECTION 5. RIGHTS OF INDIVIDUALS

5.1. Notice of Privacy Practices (NoPP) for PHI

a. Standard: NoPP

b. Implementation Specifications: Content of MHS NoPP

c. Implementation Specifications: Provision of MHS NoPP

d. Implementation Specifications: Joint Notice by Separate Covered Entities

e. Implementation Specifications: Documentation

5.2. Rights to Request Privacy Protection for PHI

a. Right to Request Restriction

b. Right to Request Confidential Communications

5.3. Access of Individuals to PHI

a. Standard: Access to PHI

b. Implementation Specifications: Requests for Access and Timely Action

c. Implementation Specifications: Provision of Access

d. Implementation Specifications: Denial of Access

e. Implementation Specifications: Documentation

TABLE OF CONTENTS 4

5.4. Amendment of PHI

a. Standard: Right to Amend

b. Implementation Specifications: Requests for Amendment and Timely Action

c. Implementation Specifications: Accepting the Amendment

d. Implementation Specifications: Denying the Amendment

e. Implementation Specifications: Actions on Notices of Amendment

f. Implementation Specifications: Documentation

g. Relationship to the Privacy Act

5.5. Accounting of Disclosures of PHI

a. Standard: Right to an Accounting of Disclosures of PHI

b. Implementation Specifications: Content of Accounting

c. Implementation Specification: Provision of Accounting

d. Implementation Specification: Documentation

e. Relationship to the Privacy Act

SECTION 6: BREACH RESPONSE

6.1. Breach Response Obligations

a. Requirement

b. DHA Privacy Office Roles and Authority

6.2. Breach Response Procedures

a. Overview

b. Initial Reporting

c. Assessments

d. Individual Notification

e. Media Notification

f. Reporting to Secretary of HHS

g. Special Rules

h. Documentation

6.3. Breach Risk Analysis Template

a. Risk analysis

b. Updates to template

SECTION 7: ADMINISTRATIVE AND TRANSITION PROVISIONS

7.1. Personnel Requirements

a. Personnel Designations

b. Training

c. Sanctions

7.2. Protections for Individuals and Others

a. Complaints

b. Standard: Refraining from Intimidating or Retaliatory Acts

c. Standard: Waiver of Rights

7.3. Other Covered Entity Requirements

a. Safeguards

b. Standard: Mitigation

c. Policies and Procedures

d. Documentation

7.4. Compliance Dates and Transition Provisions

TABLE OF CONTENTS 5

a. Standard: Effect of Prior Authorizations

b. Business Associate Arrangements and Data Use Agreements

GLOSSARY

G.1. Acronyms G.2. Definitions

REFERENCES

SECTION 1: GENERAL ISSUANCE INFORMATION 6

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1. APPLICABILITY.

a. This issuance applies to:

(1) OSD, the Military Departments (including the Coast Guard at all times, including when it is a Service in the Department of Homeland Security (DHS) by agreement with that Department), the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this issuance as the “DoD Components”).

(a) Within the DoD Components, this issuance applies to the following as DoD covered entities under the HIPAA Privacy Rule: all DoD health plans and all DoD health care providers that engage in electronic standard transactions and that are, in the case of institutional health care providers, organized under the management authority of, or in the case of covered individual health care providers, assigned to or employed by, the Defense Health Agency (DHA), the Department of the Army, the Department of the Navy, or the Department of the Air Force (referred to collectively in this issuance as “DoD covered entities”).

(b) Not all institutional health care providers or individual health care providers affiliated with the Military Services are DoD covered entities.

(c) This issuance applies to DoD Components when acting as HIPAA business associates.

(d) In addition to DoD Components, this issuance also applies to certain elements of the U.S. Coast Guard, as provided in Paragraph 3.3.(b)(1)-(2).

(2) Non-DoD government agencies and Military Health System (MHS) contractors that meet the definition of a business associate with respect to the protected health information (PHI) of a DoD covered entity where the contract or other written arrangement makes this issuance or DoDI 6025.18 applicable.

b. This issuance does not apply to:

(1) A DoD drug testing program carried out under the authority of DoDI 1010.01 or DoDI 1010.09.

(2) The provision of health care to foreign national beneficiaries of the MHS when such care is provided in a country other than the United States.

(3) The Armed Forces Repository of Specimen Samples for the Identification of Remains.

SECTION 1: GENERAL ISSUANCE INFORMATION 7

(4) The provision of health care to enemy prisoners of war, retained personnel, civilian internees, and other detainees under the provisions of DoDD 2310.01E.

(5) Education records maintained by domestic or overseas schools operated by the DoD.

(6) Records maintained by day care centers operated by the DoD.

(7) Military Entrance Processing Stations.

(8) DoD Medical Examination Review Board.

(9) Armed Forces Medical Examiner System.

(10) Armed Forces Health Surveillance Branch.

(11) Reserve and National Guard component medical personnel who are outside the authority of the military treatment facilities (MTFs) and do not engage in electronic standard transactions covered by this issuance.

(12) Health care providers participating in the provider networks of DHA managed care support contractors, except to the extent that the agreements between such contractors and providers apply this issuance to such providers.

1.2. POLICY.

a. In accordance with Paragraph 1.2.a.(1) of DoDI 6025.18, DoD covered entities and business associates must follow the HIPAA Privacy and Breach Rules as implemented in this issuance.

b. In accordance with Paragraph 1.2.a.(2) of DoDI 6025.18, DoD covered entities and business associates must comply with requirements applicable to federal entities, relating to:

(1) Section 552a of Title 5, United States Code (U.S.C.), also known as and referred to in this issuance as the “Privacy Act,” as amended; and DoD Privacy Program issuances, including DoD 5400.11-R.

(2) Federal rules protecting the confidentiality of patient records in federally assisted substance use disorder programs.

(3) DoD cybersecurity requirements.

(4) Applicable DoD and DoD Component issuances affecting the management of records maintained by or for a DoD covered entity.

c. In accordance with Paragraphs 1.2.a.-c. of DoDI 6025.18, DoD covered entities and business associates must also follow the policies, as implemented by this issuance, relating to:

SECTION 1: GENERAL ISSUANCE INFORMATION 8

(1) Military command authorities and the need to dispel stigma associated with seeking mental health services and substance misuse education services.

(2) Contracting policies and procedures.

(3) Health information system interoperability, the electronic exchange of PHI, and electronic health record system technology development and clinical policy.

(4) Records retention and destruction requirements.

1.3. INFORMATION COLLECTIONS.

a. The breach response reporting requirement, referred to in Paragraph 2.2.b. and Section 6, does not require licensing with a report control symbol in accordance with Paragraph 1.b.(8) of Volume 1 of DoD Manual 8910.01.

b. The compliance reports, referred to in Paragraphs 2.2.c.(3) and 3.2.c.(4)(a), do not require licensing with a report control symbol in accordance with Paragraph 1.b.(8) of Volume 1 of DoD Manual 8910.01.

c. The complaints to the Department of Health and Human Services (HHS), referred to in Paragraphs 3.2.c.(2) and 7.2.a., do not require licensing with a report control symbol in accordance with Paragraph 1.b.(8) of Volume 1 of DoD Manual 8910.01.

SECTION 2: RESPONSIBILITIES 9

SECTION 2: RESPONSIBILITIES

2.1. DIRECTOR, DHA. Under the authority, direction, and control of the Under Secretary of Defense for Personnel and Readiness, through the Assistant Secretary of Defense for Health Affairs (ASD(HA)), the Director, DHA:

a. Oversees DoD covered entities’ implementation of DoDI 6025.18 to foster the development and expansion of health information system interoperability, the electronic exchange of PHI, and electronic health record system management, in a manner that provides reasonable safeguards for the confidentiality, integrity, and availability of PHI created, received, maintained, or transmitted through electronic media.

b. Acts as the proponent for implementation of the HIPAA rules by issuing guidance to the MHS and DHA or preparing guidance for the MHS and DHA to be issued by the Office of the ASD(HA) or DHA, as appropriate, taking into account relevant HHS guidance. Such MHS and DHA guidance may also be issued through the DHA Privacy Office. Guidance issued through the DHA Privacy Office will be made effective as of its posting to the DHA Privacy Office Website or the DHA Publications Website, as appropriate.

c. Appoints a HIPAA Privacy and Security Officer for DHA.

d. Through the Chief, DHA Privacy Office:

(1) Issues guidance to the MHS and acts as the proponent for HIPAA implementation through this issuance, taking into account HHS guidance. Guidance issued by the DHA Privacy Office will be made effective as of its posting to the DHA Privacy Office Website or the DHA Publications website, as appropriate.

(2) Coordinates with the DHA Chief Information Officer and other appropriate officials with regard to the Director, DHA, responsibility to effectively integrate implementation of the HIPAA Privacy Rule with DoD cybersecurity requirements, health information system interoperability, electronic information exchange, individuals’ access to their PHI and communications with their providers, and related contracting matters.

(3) Recommends to the Director, DHA, proposed changes to this issuance or other new guidance when warranted by regulatory changes; DoD, DHA, or MHS governance changes;

operational experience; or reconsideration of the provisions of this issuance.

2.2. DOD COMPONENT HEADS OF DOD COVERED ENTITIES. The DoD Component heads of DoD covered entities:

a. Fulfill the rights of individuals concerning PHI as provided in Section 5.

b. Carry out breach response requirements in the event of a breach of PHI as provided in Section 6.

SECTION 2: RESPONSIBILITIES 10

c. Perform the personnel and other administrative requirements necessary to implement health information privacy protections, including but not limited to:

(1) Designating a HIPAA privacy officer and a contact person or office for each DoD covered entity such as an MTF within the DoD Component. A DoD covered entity’s HIPAA privacy officer may also be the designated HIPAA Security Officer for that DoD covered entity in accordance with in DoDI 8580.02.

(2) Maintaining records.

(3) Submitting compliance reports requested by HHS.

(4) Cooperating with complaint investigations and compliance reviews.

(5) Permitting access to information, as provided in Paragraphs 5.3. and 7.1. through 7.4.

d. Ensure contracts include requirements to protect DoD PHI, and are monitored for compliance.

e. Adhere to guidance from the Director, DHA; and the Chief, DHA Privacy Office, in carrying out the responsibilities as provided in this paragraph.

f. Monitor guidance provided by the DHA. This includes:

(1) All applicable guidance issued through the DHA Privacy Office, DHA Medical Record Management offices, and the DHA Chief Information Officer/Health Information Technology Directorate.

(2) Consultations with those offices as necessary to ensure that implementation of the HIPAA Privacy Rule is effectively integrated in accordance with Part 160 and Part 164, Subpart C of Title 45, CFR, also known and referred to in this issuance as the “HIPAA Security Rule,” and other DoD cybersecurity requirements.

SECTION 3: AUTHORITIES, SCOPE, ENFORCEMENT, OTHER LAWS, AND ORGANIZATIONAL

RESPONSIBILITIES 11

SECTION 3: AUTHORITIES, SCOPE, ENFORCEMENT, OTHER LAWS,

AND ORGANIZATIONAL RESPONSIBILITIES

3.1. LEGAL AUTHORITIES IN GENERAL.

a. General Provisions.

(1) Preemption of State Law. Subject to the exceptions specified in Paragraph 3.2.b., this issuance applies to the activities of the MHS without regard to any contrary provision of State law.

(2) Relationship with the Privacy Act. In general, PHI covered by this issuance is also covered by the Privacy Act and the DoD Privacy Program issuances when the information pertains to a living U.S. citizen or alien lawfully admitted for permanent residence. As provided in Paragraph 3.2.d., DoD covered entities under this issuance must also comply with DoD Privacy Program issuances.

(3) Other Matters of General Authority. Other matters of general authority under this issuance are addressed in Paragraph 3.2.

b. Uses and Disclosures of PHI.

(1) General Prohibition. In general, PHI of individuals must not be used or disclosed by DoD covered entities or their business associates, except for specifically permitted or required purposes. Uses and disclosures of PHI are discussed in Paragraphs 4.1. through 4.5. This issuance applies to the PHI of living individuals and individuals deceased for fewer than 50 years.

(2) Uses and Disclosures of PHI for Treatment, Payment, and Health Care Operations.

Subject to the specific provisions of Paragraphs 4.1. through 4.5., DoD covered entities may use and disclose PHI for treatment, payment, or health care operations. These activities are generally permitted, consistent with Paragraphs 4.1. through 4.5., to be conducted without the need for authorization from the subject of the PHI being used or disclosed, because these are essential, everyday activities of health plans and health care providers.

(3) General Prohibition on Other Uses and Disclosures of PHI Without Written Authorization. Except for purposes of treatment, payment, and health care operations (discussed in Paragraph 3.1.b.(2)) and other exceptions (discussed in Paragraphs 3.1.b.(3) through 3.1.b.(5)), other uses and disclosures of PHI are generally prohibited without the written authorization of the individual. Specific provisions pertaining to this general rule are addressed in Paragraph 4.2., including specifications for valid authorizations.

(a) Special Rules for Psychotherapy Notes. Paragraph 4.2.a.(2) establishes special rules that protect the privacy of psychotherapy notes even more so than other health information.

Unless a use or disclosure of psychotherapy notes is specifically permitted by an exception in

RESPONSIBILITIES 12

Paragraph 4.2.a.(2), a use or disclosure of psychotherapy notes may only be made if the DoD covered entity obtains an authorization for such use or disclosure.

(b) Special Rule for Genetic Information Paragraph 4.5.k. establishes a special rule prohibiting health plans from using or disclosing PHI that is genetic information for underwriting, even if the affected individual has executed an authorization for such purposes.

(4) Other Uses and Disclosures That Are Permissible Unless Objected To. Individuals must be given an opportunity to object to uses and disclosures that involve patient directories providing limited information about patients receiving treatment; information provided to others involved in the health care of the patient; and information used for disaster relief purposes. The specific provisions applicable to these uses and disclosures are in Paragraph 4.3.

(5) Other Permitted and Required Uses and Disclosures That May be Made Without Authorization or Opportunity to Object. Subject to specific terms and conditions addressed in Section 4, DoD covered entities may use or disclose PHI without the individual's authorization or opportunity to object in the following situations:

(a) When required by law, as provided in Paragraph 4.4.a.

(b) For public health purposes, as provided in Paragraph 4.4.b.

(c) Involving victims of abuse or neglect, as provided in Paragraph 4.4.c.

(d) For health oversight activities authorized by law, as provided in Paragraph 4.4.d.

(e) For judicial or administrative proceedings, as provided in Paragraph 4.4.e.

(f) For law enforcement purposes, as provided in Paragraph 4.4.f.

(g) Concerning decedents in limited circumstances, as provided in Paragraph 4.4.g.

(h) For cadaveric organ, eye, or tissue donation purposes, as provided in Paragraph 4.4.h.

(i) For research involving minimal risk, as provided in Paragraph 4.4.i.

(j) To avert a serious threat to health or safety, as provided in Paragraph 4.4.j.

(k) For specialized government functions, including certain activities relating to Military Services' personnel, as provided in Paragraph 4.4.k.

(l) For workers’ compensation programs, as provided in Paragraph 4.4.l.

c. Uses and Disclosures of PHI Special Rules and Requirements. A number of special rules and other requirements relating to uses and disclosures of PHI are established. As provided in Paragraph 4.5., these include:

(1) Standards for de-identification of PHI, as provided in Paragraph 4.5.a.

RESPONSIBILITIES 13

(2) Requirements for using and disclosing the minimum amount necessary to accomplish a valid use or disclosure purpose, as provided in Paragraph 4.5.b.

(3) Clarification regarding incidental uses and disclosures, as provided in Paragraph 4.5.d.

(4) Disclosures to business associates, as provided in Paragraph 4.5.e.

(5) Disclosures by whistleblowers and workforce member crime victims, as provided in Paragraph 4.5.f.

(6) Rules for dealing with personal representatives on behalf of individuals, as provided in Paragraph 4.5.g.

d. DoD Covered Entity Obligations Regarding Individual Rights. In general, DoD covered entities are obligated to fulfill individual rights stated in the HIPAA Privacy Rule to:

(1) Receive a notice of the ways the MHS may use and disclose their PHI, and of their rights and the MHS’ legal duties with respect to PHI, as provided in Paragraph 5.1.

(2) Request additional privacy protections, as provided in Paragraph 5.2. This includes a right to request restrictions on certain uses and disclosures, and a right to receive confidential communications by alternative means or at alternative locations when reasonable, as provided in Paragraphs 5.2.a. and 5.2.b.

(3) Access to inspect and obtain a copy of PHI about them, subject to some limitations, as provided in Paragraph 5.3.

(4) Amend PHI about them if it is inaccurate or incomplete, under procedures outlined in Paragraph 5.4.

(5) Receive, upon request, an accounting of certain disclosures of their PHI, as provided in Paragraph 5.5.

(6) To ensure compliance with the obligations related to the fulfillment of individual rights, DoD covered entities must require that workforce members adhere to the implementation specifications outlined in Section 5 when workforce members seek to exercise their individual rights.

e. Breach Response Provisions. The Final Rule for Breach Notification for Unsecured Protected Health Information, issued by HHS pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act, is codified in Parts 160 and 164, Subpart D, of Title 45, CFR (Subpart D is also known as the “HIPAA Breach Rule”). These breach response requirements for the MHS, DoD covered entities, and their business associates are in Section 6.

f. Additional Administrative Requirements for the MHS to Implement Health Information Privacy Protections. To the extent provided in Section 7, the MHS and each DoD

RESPONSIBILITIES 14

covered entity is required to implement a series of administrative requirements to protect the privacy of health information, including the:

(1) Designation of a HIPAA privacy officer, as provided in Paragraphs 2.1.c., 2.2.c.(1), and 7.1.a.

(2) Training of the workforce involved in functions covered by this issuance as provided in Paragraph 7.1.b.

(3) Establishment of administrative, technical, and physical safeguards to protect the privacy of PHI as provided in Paragraph 7.3.a.

(4) Creation of a complaint process, as provided in Paragraph 7.2.a.

(5) Establishment of appropriate policies, procedures, and processes for determining and applying sanctions against workforce members who fail to comply with requirements of this issuance, as provided in Paragraph 7.1.c.

(6) Mitigation of harmful effects of improper uses and disclosures of PHI, as provided in Paragraph 7.3.b.

(7) Prohibition of intimidating or retaliatory acts relating to the exercise of rights under this issuance, as provided in Paragraph 7.2.b.

(8) Prohibition from requiring individuals to waive rights under this issuance, as provided in Paragraph 7.2.c.

(9) Implementation of policies and procedures to implement privacy protections, as provided in Paragraph 7.3.c.

(10) Documentation and retention requirements of this issuance, as provided in Paragraph 7.3.d.

(11) Compliance with transition provisions for individual authorizations effective prior to publication of this issuance are provided in Paragraph 7.4.a.

3.2. SCOPE, ENFORCEMENT, AND RELATIONSHIP TO OTHER LAWS.

a. Inspector General. Pursuant to Section 1320a-7c(a)(5) of Title 42, U.S.C., nothing in this issuance should be construed to diminish the authority of any statutory Inspector General, including such authority as provided in the Appendix of Title 5, U.S.C., also known as the “Inspector General Act of 1978.”

b. Preemption of State Law. Subject to the exceptions specified in this paragraph, this issuance generally applies to the activities of the MHS without regard to contrary provisions of State law. In general, the HIPAA Privacy Rule establishes rules, exceptions, and procedures governing the determination of the preemption of State law.

RESPONSIBILITIES 15

(1) As a general rule, a standard, requirement, or implementation specification adopted under the HIPAA Privacy Rule that is contrary to a provision of State law preempts the provision of State law. Exceptions include circumstances in which the provision of State law, including State procedures established under such law, as applicable, provide for the reporting of disease or injury, child or domestic abuse or neglect, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.

(2) State laws pertaining to health care generally are not applicable to DoD health care programs and activities. However, there are some matters in which DoD rules and procedures call for the DoD Components to follow State law.

(a) In cases involving disclosure of PHI about a minor to a parent, guardian, or person acting in loco parentis of such minor, the State law where the treatment is provided must be applied.

(b) If there is a conflict between this issuance and State law, this issuance must apply, unless DoD rules, procedures, or other applicable policy call for the DoD Components to follow State law with respect to the matter at issue.

c. Compliance and Enforcement by the Secretary of HHS.

(1) Applicability of HHS Rules and Procedures to DoD. Rules and procedures established by the Secretary of HHS pursuant to the HIPAA rules for covered entities and their business associates are applicable through this Manual to DoD covered entities and their business associates.

(2) Complaints to HHS.

(a) Complaint Submissions. A person who believes the MHS, a DoD covered entity within the MHS, or a business associate is not complying with the applicable requirements of the HIPAA Privacy, Breach, or Security Rules, may file a complaint with HHS pursuant to Section 160.306 of Title 45, CFR. Such complaints must meet the following requirements established by HHS:

1. A complaint must be filed in writing, either on paper or electronically.

2. A complaint must name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the HIPAA rules.

3. A complaint must be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless the Secretary of HHS waives this time limit for good cause shown.

4. The Secretary of HHS may prescribe additional procedures for the filing of complaints, as well as the place and manner of filing, by notice in the Federal Register. The HHS complaint form and instructions for filing a complaint are available through the HHS Office for Civil Rights and its website.

RESPONSIBILITIES 16

(b) HHS Investigation.

1. In Part 160, Subparts C-E, of Title 45, CFR, also known and referred to in this issuance as the “HIPAA Enforcement Rule,” Section 160.306(c)(1) requires the Secretary of HHS to investigate any complaint filed under Section 160.306 of Title 45, CFR, when a preliminary review of the facts indicates a possible violation due to willful neglect.

2. The Secretary of HHS may investigate any other complaint filed under Section 160.306 of Title 45, CFR.

3. Such investigation may include a review of the pertinent policies, procedures, or practices of the MHS (including any supplemental or local policies, procedures, or practices at the DoD covered entity-level) or business associate, and of the circumstances regarding any alleged acts or omissions concerning compliance.

4. At the time of the initial written communication with the MHS, DoD covered entity, or business associate about the complaint, the Secretary of HHS will describe the acts or omissions that are the basis of the complaint, as required by Section 160.306(c)(4) of the HIPAA Enforcement Rule.

(3) Compliance Reviews.

(a) Section 160.308(a) of Title 45, CFR requires the Secretary of HHS to conduct compliance reviews to determine whether a covered entity or business associate is complying with the applicable requirements of the HIPAA rules when a preliminary review of the facts indicates a possible violation due to willful neglect.

(b) The Secretary of HHS may conduct a compliance review to determine whether a covered entity or business associate is complying with the HIPAA rules in any other circumstance.

(4) Responsibilities of Covered Entities in Relation to HHS Compliance and Enforcement.

(a) Records and Compliance Reports. A covered entity or business associate must keep records and submit compliance reports, in such time and manner and containing such information as the Secretary of HHS determines necessary, to ascertain whether the covered entity or business associate has complied or is complying with the applicable requirements of the HIPAA rules.

(b) Cooperate With Complaint Investigations and Compliance Reviews. A covered entity or business associate must cooperate with the Secretary of HHS if the Secretary of HHS undertakes an investigation or compliance review of the policies, procedures, or practices of a covered entity or business associate to determine whether it is complying with the HIPAA rules.

RESPONSIBILITIES 17

(c) Permit Access to Information.

1. A covered entity or business associate must permit the Secretary of HHS access during normal business hours to its facilities, books, records, accounts, and other sources of information, including PHI, that are pertinent to ascertaining compliance with the applicable requirements of the HIPAA rules. If the Secretary of HHS determines that exigent circumstances exist, such as when documents may be hidden or destroyed, a covered entity or business associate must permit access by the Secretary of HHS at any time and without notice.

2. If any information required of a covered entity or business associate under this paragraph is in the exclusive possession of any other agency, institution, or person and the other agency, institution, or person fails or refuses to furnish the information, the covered entity or business associate must so certify and set forth what efforts it has made to obtain the information.

3. PHI obtained by the Secretary of HHS in connection with an investigation or compliance review will not be disclosed by the Secretary of HHS, except if necessary for ascertaining or enforcing compliance with the applicable requirements of the HIPAA rules, or if otherwise required by law.

4. In the event any information sought by the Secretary of HHS under Paragraph 3.2.c.(4)(c) is classified in the interest of national security or defense, the covered entity or business associate must make appropriate arrangements for access by the Secretary of HHS consistent with applicable requirements for handling classified information.

(5) Penalties for Non-compliance. Section 1320d-6 of Title 42, U.S.C., establishes civil and criminal penalties for non-compliance with the HIPAA rules. For HIPAA Rule violations occurring on or after February 18, 2009, there are:

(a) Civil penalties of not less than $100 for each violation.

(b) Civil penalties of not more than $1,500,000 when identical violations during a calendar year occur.

(c) Criminal penalties of fines of up to $250,000 and imprisonment up to 1 year, for wrongful disclosure by any covered entity, employee, or other individual of individually identifiable health information.

(6) Violations Attributed to Covered Entity. The covered entity is liable, in accordance with the federal common law of agency, for a civil money penalty for a violation based on the act or omission of any agent of the covered entity, including a workforce member or business associate, acting within the scope of the agency.

(7) Privacy Violations of Business Associates. A business associate is liable, in accordance with the federal common law of agency, for a civil money penalty for a violation based on the act or omission of any agent of the business associate, including a workforce member or a subcontractor, acting within the scope of the agency.

RESPONSIBILITIES 18

d. Relationship to the Privacy Act. In addition to responsibilities for compliance with this issuance, DoD covered entities are also responsible for compliance with DoD Privacy Program issuances.

(1) Although nothing in this issuance violates DoD Privacy Program issuances, compliance with this issuance does not necessarily satisfy all the requirements of the DoD Privacy Program issuances. For example, an authorized disclosure under Paragraph 4.4. may require additional actions, such as the establishment of a “routine use” in the system of records notice for the system of records in which the PHI is maintained, which specifically identifies to whom the disclosure is made and for what purpose.

(2) Compliance with the DoD Privacy Program issuances in connection with PHI does not necessarily satisfy all the requirements of this issuance. For example, an authorized routine use of medical records under the DoD Privacy Program issuances is not necessarily a permitted use or disclosure under this issuance.

(3) Nothing in this issuance creates an individual right or DoD obligation under the DoD Privacy Program issuances (i.e., DoDD 5400.11 or DoD 5400.11-R).

e. No Private Cause of Action.

(1) There is no private cause of action under the HIPAA rules or this issuance. Potential remedies for alleged violations of the HIPAA rules are those referred to in Paragraph 3.2.c.

Potential remedies for alleged violations of this issuance are addressed in Paragraphs 7.1.c. and 7.2.a. Nothing in this issuance gives an individual a right to initiate a legal action in court for any alleged violations.

(2) Although, as stated in Paragraph 3.2.d., there is overlap between this issuance and DoD Privacy Program issuances, alleged or actual violations of this issuance do not necessarily constitute a violation of DoD Privacy Program issuances or give rise to a cause of action under the Privacy Act.

f. Relationship to Section 552 of Title 5, U.S.C., Also Known as the “Freedom of Information Act (FOIA).”

(1) In general, FOIA requires federal agencies to make available the records in the possession of the agencies to members of the public who request them. FOIA, however, is subject to exemptions, such as when such disclosure would cause an unwarranted invasion of the personal privacy of an individual or privacy of other individuals such as a deceased individual’s surviving family members.

(2) Access to PHI, other than that specifically provided for in this issuance, would generally cause an unwarranted invasion of personal privacy of the individual to whom the PHI pertains. However, in any case in which FOIA requires disclosure, nothing in this Manual prohibits disclosure.

RESPONSIBILITIES 19

(3) Requests under FOIA are handled in accordance with DoDM 5400.07. Application of FOIA exemptions to information about deceased individuals requires a different analysis than that applicable to living individuals and is provided in Paragraph 4.5.h.

3.3. ORGANIZATIONAL ROLES AND RESPONSIBILITIES. DoD covered entities, and DoD Components that are business associates of DoD covered entities, must take on certain roles and responsibilities to comply with this issuance.

a. Covered Entities in the MHS.

(1) The MHS is comprised of the following DoD covered entities: all DoD health plans and all DoD institutional health care providers that engage in standard electronic transactions and that are organized under the management authority of, or individual providers assigned to or employed by, any of the following:

(a) DHA.

(b) The Department of the Army.

(c) The Department of the Navy.

(d) The Department of the Air Force.

(2) Not all health care providers affiliated with the Military Services are DoD covered entities. DoD health care provider covered entities include:

(a) Health care personnel and related assets of the Department of the Army under the Surgeon General of the Army, including Headquarters staff, including any other organizational level within the Army Medical Service, and the DoD covered entity identified in Paragraph 3.3.a.(4)(b)1. Policies and procedures supplementing MHS-wide HIPAA policies are principally established by the Surgeon General of the Army, but may also be established by or on behalf of the Chief of Staff of the Army, the Assistant Secretary of the Army for Manpower and Reserve Affairs, or the Secretary of the Army.

(b) Health care personnel and related assets of the Department of the Navy under the Surgeon General of the Navy, including any other organizational level within the Navy, and the DoD covered entity identified in Paragraph 3.3.a.(4)(b)2. Policies and procedures supplementing MHS-wide HIPAA policies are principally established for Navy health care personnel and related assets by the Surgeon General of the Navy, but may also be established by or on behalf of the Chief of Naval Operations, the Assistant Secretary of the Navy for Manpower and Reserve Affairs, or the Secretary of the Navy.

(c) Health care personnel and related assets of the Department of the Air Force under the Surgeon General of the Air Force and the DoD covered entity identified in Paragraph 3.3.a.(4)(b)3. Policies and procedures supplementing MHS-wide HIPAA policies are principally established for Air Force health care personnel and related assets by the Surgeon General of the Air Force, but may also be established by or on behalf of the Chief of Staff of the

RESPONSIBILITIES 20

Air Force, the Assistant Secretary of the Air Force for Manpower and Reserve Affairs, or the Secretary of the Air Force.

(d) Health care personnel and related assets of the DHA, including the MTFs that operate under the authority of the DHA. Policies and procedures supplementing MHS-wide HIPAA policies are principally established for DHA health care personnel and related assets by the Director, DHA, or the Director’s designee.

(3) All such covered entities are under the common control of the ASD(HA). These DoD covered entities are designated as a single HIPAA covered entity under the management control of the ASD(HA), and, for purposes of activities subject to this issuance, under the management responsibility of the Director, DHA.

(4) In carrying out responsibilities in this issuance, including appointment of HIPAA privacy and security officers, each DoD covered entity (such as an MTF) must establish its own supplementary policies and procedures for complying with this issuance and directions of the Director, DHA.

(a) Contracted health care providers providing personal services or non-personal services to the MTF, are required to comply with all requirements of or arising from this issuance to the same extent as health care providers who are employees of the MTF. It is the responsibility of the DoD component that establishes the contract to ensure that it includes requirements under this Manual.

(b) All health care providers who are DoD covered entities under this issuance and who are not providing services in or on behalf of an MTF (for example, shipboard or field deployed medical personnel) are included in a DoD covered entity, as follows:

1. Providers under the control of the Department of the Army are included in a DoD covered entity under the Surgeon General of the Army.

2. Providers under the control of the Department of the Navy are included in a DoD covered entity under the Surgeon General of the Navy.

3. Providers under the control of the Department of the Air Force are included in a DoD covered entity under the Surgeon General of the Air Force.

(5) Policies and procedures for the MHS are established principally by the ASD(HA) as authorized by DoDD 5136.01, but may also be established by the Under Secretary of Defense for Personnel and Readiness or the Secretary of Defense. Such policies and procedures may also be established by the Director, DHA, to the extent of the Director’s authorities in accordance with DoDD 5136.13, or as otherwise delegated by the ASD(HA).

b. The MHS and Organized Health Care Arrangements.

(1) For certain purposes under this issuance, such as the establishment of a DoD covered entity’s rules and procedures for uses and disclosures of PHI for treatment, payment, or health care operations, such rules and procedures established by an organized health care arrangement

RESPONSIBILITIES 21

of which the DoD covered entity is a part are recognized as the rules and procedures of the DoD covered entity. For this purpose, the MHS, as a single covered entity, and certain elements of the Coast Guard are identified as an organized health care arrangement.

(2) The MHS is also part of an organized health care arrangement with the Coast Guard.

The following elements of the Coast Guard are part of that organized health care arrangement:

(a) Providers under the control of the Commandant, U.S. Coast Guard; and under the Director, Health, Safety, and Work-life Directorate of the U.S. Coast Guard.

(b) The Coast Guard Health Care Program.

c. Business Associate Arrangements among and for DoD Components.

(1) Arrangements for Government and Non-Government Business Associates. DoD Components sometimes perform functions for covered entities that are covered functions under this issuance. In other cases, business associate functions for DoD covered entities may be carried out by other government agencies or by non-governmental entities under contract.

Business associates are:

(a) DoD Components that do not require a written business associate agreement.

(b) Other government agencies that require a memorandum of agreement (or other applicable documentation of the arrangement) between the DoD Component and the other government agency.

(c) Other entities that require a contract or agreement between the DoD Component and the other entity, in accordance with Paragraphs 3.3.c.(2) and 4.5.e.(3).

(2) Business Associate Contracts.

(a) The contract or other arrangement required by Paragraph 4.5.e.(3) must establish the permitted and required uses and disclosures of PHI by the business associate, and must also meet the requirements of Paragraphs 3.3.c.(1)(b) and (c), 3.3.c.(3), or 3.3.c.(5), as applicable.

(b) A DoD covered entity is not in compliance with the standards in Paragraph 4.5.e.(3) and this paragraph if the DoD covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate’s obligation under the contract or other arrangement, unless the DoD covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

(c) A business associate is not in compliance with the standards in Paragraph 4.5.e.(2) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor’s obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

RESPONSIBILITIES 22

(3) Business Associate Uses and Disclosures. DHA guidance provides standard business associate agreement language to be included, when appropriate, in contracts or agreements that involve access to or handling of PHI by DoD covered entity business associates. The DHA standard language is designed to satisfy the following requirements applicable to uses and disclosures of PHI by business associates. Additional requirements may be included in contracts and agreements at the discretion of the DoD covered entity.

(a) A business associate may not use or further disclose PHI in a manner that would violate the requirements of this issuance if done by the DoD covered entity, except that the business associate may engage in the following uses and disclosures if permitted by its contract or other arrangement:

1. A business associate may use and disclose PHI for the proper management and administration of the business associate.

2. A business associate may provide data aggregation services relating to the health care operations of the DoD covered entity.

(b) A business associate must:

1. Use or disclose PHI only as permitted or required by this issuance or as required by law.

2. Use appropriate safeguards and comply, where applicable, with the HIPAA Security Rule and other DoD cybersecurity requirements with respect to electronic PHI, to prevent use or disclosure of the information other than as allowed by this issuance.

3. Report to the DoD covered entity any use or disclosure of PHI not allowed by this issuance (or by the contract with the DoD covered entity) of which the business associate becomes aware. This includes breaches as required by Section 6.

4. Ensure any subcontractors that create, receive, maintain, or transmit PHI on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such PHI in accordance with the HIPAA Privacy Rule.

5. Make available PHI in accordance with the access provisions of Paragraph 5.3., including Paragraph 5.3.c.(2)(a) regarding access to information and Paragraph 5.3.c.(2)(d) regarding individual directions to transmit information to a person designated by the individual.

6. Make available PHI for amendment and incorporate any amendments to PHI in accordance with Paragraph 5.4.

7. Make available the information required to provide an accounting of disclosures in accordance with Paragraph 5.5.

8. To the extent the business associate is to carry out a DoD covered entity’s obligations under this issuance, comply with the requirements of this issuance that apply to the DoD covered entity in the performance of such obligation.

RESPONSIBILITIES 23

9. Make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by the business associate on behalf of, the DoD covered entity available to the Secretary of HHS and to the Director, DHA, for purposes of investigating or determining the DoD covered entity’s compliance with the HIPAA rules.

10. Return or destroy, at the termination of the performance of the business associate’s functions, all PHI received from, or created or received by the business associate on behalf of the DoD covered entity that the business associate still maintains in any form. If such return or destruction is not feasible, the business associate must maintain compliance with this issuance with respect to any retained copies of the information, and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

Any action taken should be appropriately documented.

(4) Other Arrangements.

(a) If a DoD covered entity and its business associate are both government entities:

1. The DoD covered entity may comply with this paragraph and Enclosure 4, Paragraph 1.i.(5) of DoDI 8580.02, if applicable, by entering into a memorandum of understanding with the business associate that contains the terms that accomplish the objectives of Paragraph 3.3.c.(3) and Enclosure 4, Paragraph 1.i.(5)(a) of DoDI 8580.02, if applicable.

2. The DoD covered entity may comply with this paragraph and Enclosure 4, Paragraph 1.i.(5) of DoDI 8580.02, if applicable, if other law (including regulations adopted by the DoD covered entity or its business associate) contains requirements…