The Hipaa Omnibus Rule: Implications for Public Health Policy and Practice

Institute of Medicine. Beyond the HIPAA Privacy Rule: enhancing privacy, improving health through research. National Academies Press: Washington; 2009.

Pub. L. No. 111-5, 123 Stat. 115, 226-79 (2009), codified at 42 U.S.C. §§ 300jjet seq.; §§ 17901 et seq.

McGraw D . Privacy and health information technology. Washington: O'Neill Institute for National and Global Health Law; 2009, at 5-6. Also available from: URL: http://www.law.georgetown.edu/oneillinstitute/national-health-law/legal-solutions-in-health-reform/Privacy.html [cited 2013 Jun 30].

Department of Health and Human Services (US). Standards for privacy of individually identifiable health information: final rule. Fed Reg 2000; 65:82462–829.

Department of Health and Human Services (US). Standards for privacy of individually identifiable health information: final rule. Fed Reg 2002; 67:53182–3273.

Department of Health and Human Services (US). The Privacy Rule [cited 2013 Jun 30]. Available from: URL: http://www.hhs.gov/ocr/privacy/hipaa/administrative

45 C.F.R. §160.103.

45 C.F.R. §164.502(a)(2).

45 C.F.R. §164.502(a).

45 C.F.R. §164.506(a).

45 C.F.R. §164.508(a).

45 C.F.R. §164.512(b).

45 C.F.R. §164.514(b).

45 C.F.R. §164.514(e).

Goldstein MM . The health privacy provisions in The American Recovery and Reinvestment Act of 2009: implications for public health policy and practice. Public Health Rep 2010; 125:343–9.

Department of Health and Human Services (US). Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA Rules: final rule. Fed Reg 2013; 78:5566–702.

Department of Health and Human Services (US). Modifications to the HIPAA privacy, security, and enforcement rules under the Health Information Technology for Economic and Clinical Health Act: proposed rule. Fed Reg 2010; 75:40868–924.

Department of Health and Human Services (US). HIPAA administrative simplification: enforcement: interim final rule; request for comments. Fed Reg 2009; 74:56123–31.

Department of Health and Human Services (US). Breach notification for unsecured protected health information: interim final rule with request for comments. Fed Reg 2009; 74:42740–70.

Centers for Medicare & Medicaid Services (US). Interim final rules prohibiting discrimination based on genetic information in health insurance coverage and group health plans. Fed Reg 2009; 74:51664–797.

45 C.F.R. §164.524(c)(2)(ii).

45 C.F.R. §164.522(a).

McGraw D . Final HIPAA rules a major step forward, but there's more work to be done. iHealthBeat 2013 Feb 8. Also available from: URL: http://www.ihealthbeat.org/perspectives/2013/final-hipaa-rules-a-major-step-forward-but-theres-more-work-to-be-done.aspx# [cited 2013 Jun 30].

45 C.F.R. §164.501.

45 C.F.R. §164.508(b)(3)(i).

45 C.F.R. §164.508(c)(1)(iv).

Department of Health and Human Services (US). Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA Rules: final rule. Fed Reg 2013; 78:5566–702, at 5611-3.

45 C.F.R. §164.402.

Department of Health and Human Services (US). Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA Rules: final rule. Fed Reg 2013; 78:5566–702, at 5584-5.

45 C.F.R. §160.408.

45 C.F.R. §160.404(b).

45 C.F.R. §164.532(d).

Department of Health and Human Services (US). Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA Rules: final rule. Fed Reg 2013; 78:5566–702, at 5607.

Department of Health and Human Services (US). Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. 2012 Nov 26 [cited 2013 Jun 30]. Available from: URL: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/De-identification/hhs_deid_guidance.pdf

Westin AF . IOM project survey findings on health research and privacy. Presented at the Institute of Medicine Committee Meeting; 2006 Oct 2; Washington. Also available from: URL: http://www.iom.edu/∼/media/Files/Activity%20Files/Research/HIPAAandResearch/AlanWestinIOMsrvyRept.ashx [cited 2013 Jun 30].

Caine K Hanania R . Patients want granular privacy control over health information in electronic medical records. J Am Med Inform Assoc 2013; 20:7–15.