1. U.S. Department of Health and Human Services
Office for Civil Rights
HIPAA Administrative Simplification
Regulation Text
45 CFR Parts 160, 162, and 164
(Unofficial Version, as amended through February 16, 2006)
18. HIPAA Administrative Simplification Regulation Text
March 2006
PART 160 – GENERAL ADMINISTRATIVE 160.502 Definitions.
REQUIREMENTS 160.504 Hearing before an ALJ.
160.506 Rights of the parties.
Subpart A – General Provisions 160.508 Authority of the ALJ.
160.101 Statutory basis and purpose.
160.510 Ex parte contacts.
160.102 Applicability.
160.512 Prehearing conferences.
160.103 Definitions.
160.514 Authority to settle.
160.104 Modifications.
160.516 Discovery.
160.518 Exchange of witness lists, witness
Subpart B – Preemption of State Law statements, and exhibits.
160.201 Applicability.
160.520 Subpoenas for attendance at hearing.
160.202 Definitions.
160.522 Fees.
160.203 General rule and exceptions.
160.524 Form, filing, and service of papers.
160.204 Process for requesting exception
160.526 Computation of time.
determinations.
160.528 Motions.
160.205 Duration of effectiveness of exception
160.530 Sanctions.
determinations.
160.532 Collateral estoppel.
160.534 The hearing.
Subpart C - Compliance and Investigations 160.536 Statistical sampling.
160.300 Applicability.
160.538 Witnesses.
160.302 Definitions.
160.540 Evidence.
160.304 Principles for achieving compliance.
160.542 The record.
160.306 Complaints to the Secretary.
160.544 Post hearing briefs.
160.308 Compliance reviews.
160.546 ALJ’s decision.
160.310 Responsibilities of covered entities.
160.548 Appeal of the ALJ’s decision.
160.312 Secretarial action regarding complaints and
160.550 Stay of the Secretary’s decision.
compliance reviews.
160.552 Harmless error.
160.314 Investigational subpoenas and inquiries.
160.316 Refraining from intimidation or retaliation.
Authority: 42 U.S.C. 1302(a), 42 U.S.C. 1320d
1320d-8, and sec. 264 of Pub. L. 104-191, 110 Stat.
Subpart D—Imposition of Civil Money Penalties 2033-2034 (42 U.S.C. 1320d-2(note)) and 5 U.S.C.
160.400 Applicability.
552.
160.402 Basis for a civil money penalty.
160.404 Amount of a civil money penalty.
Subpart A—General Provisions
160.406 Violations of an identical requirement or
prohibition.
§ 160.101 Statutory basis and purpose.
160.408 Factors considered in determining the
The requirements of this subchapter implement
amount of a civil money penalty.
sections 1171 through 1179 of the Social Security Act
160.410 Affirmative defenses.
(the Act), as added by section 262 of Public Law
160.412 Waiver.
104–191, and section 264 of Public Law 104–191.
160.414 Limitations.
160.416 Authority to settle.
§ 160.102 Applicability.
160.418 Penalty not exclusive.
(a) Except as otherwise provided, the standards,
160.420 Notice of proposed determination.
requirements, and implementation specifications
160.422 Failure to request a hearing.
adopted under this subchapter apply to the following
160.424 Collection of penalty.
entities:
160.426 Notification of the public and other agencies.
(1) A health plan.
(2) A health care clearinghouse.
Subpart E—Procedures for Hearings (3) A health care provider who transmits any
160.500 Applicability.
-1
19. HIPAA Administrative Simplification Regulation Text
March 2006
health information in electronic form in connection or from another business associate of such covered
with a transaction covered by this subchapter. entity or arrangement, to the person.
(b) To the extent required under the Social (2) A covered entity participating in an organized
Security Act, 42 U.S.C. 1320a–7c(a)(5), nothing in health care arrangement that performs a function or
this subchapter shall be construed to diminish the activity as described by paragraph (1)(i) of this
authority of any Inspector General, including such definition for or on behalf of such organized health
authority as provided in the Inspector General Act of care arrangement, or that provides a service as
1978, as amended (5 U.S.C. App.). described in paragraph (1)(ii) of this definition to or
for such organized health care arrangement, does not,
[65 FR 82798, Dec. 28, 2000, as amended at 67 FR simply through the performance of such function or
53266, Aug. 14, 2002] activity or the provision of such service, become a
business associate of other covered entities
§ 160.103 Definitions. participating in such organized health care
Except as otherwise provided, the following arrangement.
definitions apply to this subchapter: (3) A covered entity may be a business associate
Act means the Social Security Act. of another covered entity.
ANSI stands for the American National Standards CMS stands for Centers for Medicare & Medicaid
Institute. Services within the Department of Health and Human
Business associate: Services.
(1) Except as provided in paragraph (2) of this Compliance date means the date by which a
definition, business associate means, with respect to a covered entity must comply with a standard,
covered entity, a person who: implementation specification, requirement, or
(i) On behalf of such covered entity or of an modification adopted under this subchapter.
organized health care arrangement (as defined in Covered entity means:
§164.501 of this subchapter) in which the covered (1) A health plan.
entity participates, but other than in the capacity of a (2) A health care clearinghouse.
member of the workforce of such covered entity or (3) A health care provider who transmits any
arrangement, performs, or assists in the performance health information in electronic form in connection
of: with a transaction covered by this subchapter.
(A) A function or activity involving the use or Disclosure means the release, transfer, provision
disclosure of individually identifiable health of, access to, or divulging in any other manner of
information, including claims processing or information outside the entity holding the
administration, data analysis, processing or information.
administration, utilization review, quality assurance, EIN stands for the employer identification number
billing, benefit management, practice management, assigned by the Internal Revenue Service, U.S.
and repricing; or Department of the Treasury. The EIN is the taxpayer
(B) Any other function or activity regulated by identifying number of an individual or other entity
this subchapter; or (whether or not an employer) assigned under one of
(ii) Provides, other than in the capacity of a the following:
member of the workforce of such covered entity, (1) 26 U.S.C. 6011(b), which is the portion of the
legal, actuarial, accounting, consulting, data Internal Revenue Code dealing with identifying the
aggregation (as defined in §164.501 of this taxpayer in tax returns and statements, or
subchapter), management, administrative, corresponding provisions of prior law.
accreditation, or financial services to or for such (2) 26 U.S.C. 6109, which is the portion of the
covered entity, or to or for an organized health care Internal Revenue Code dealing with identifying
arrangement in which the covered entity participates, numbers in tax returns, statements, and other required
where the provision of the service involves the documents.
disclosure of individually identifiable health Electronic media means:
information from such covered entity or arrangement, (1) Electronic storage media including memory
-2
20. HIPAA Administrative Simplification Regulation Text
March 2006
devices in computers (hard drives) and any (2) Sale or dispensing of a drug, device,
removable/transportable digital memory medium, equipment, or other item in accordance with a
such as magnetic tape or disk, optical disk, or digital prescription.
memory card; or Health care clearinghouse means a public or
(2) Transmission media used to exchange private entity, including a billing service, repricing
information already in electronic storage media. company, community health management information
Transmission media include, for example, the internet system or community health information system, and
(wide-open), extranet (using internet technology to “value-added” networks and switches, that does either
link a business with information accessible only to of the following functions:
collaborating parties), leased lines, dial-up lines, (1) Processes or facilitates the processing of
private networks, and the physical movement of health information received from another entity in a
removable/transportable electronic storage media. nonstandard format or containing nonstandard data
Certain transmissions, including of paper, via content into standard data elements or a standard
facsimile, and of voice, via telephone, are not transaction.
considered to be transmissions via electronic media, (2) Receives a standard transaction from another
because the information being exchanged did not entity and processes or facilitates the processing of
exist in electronic form before the transmission. health information into nonstandard format or
Electronic protected health information means nonstandard data content for the receiving entity.
information that comes within paragraphs (1)(i) or Health care provider means a provider of services
(1)(ii) of the definition of protected health (as defined in section 1861(u) of the Act, 42 U.S.C.
information as specified in this section. 1395x(u)), a provider of medical or health services
Employer is defined as it is in 26 U.S.C. 3401(d). (as defined in section 1861(s) of the Act, 42 U.S.C.
Group health plan (also see definition of health 1395x(s)), and any other person or organization who
plan in this section) means an employee welfare furnishes, bills, or is paid for health care in the
benefit plan (as defined in section 3(1) of the normal course of business.
Employee Retirement Income and Security Act of Health information means any information,
1974 (ERISA), 29 U.S.C. 1002(1)), including insured whether oral or recorded in any form or medium, that:
and self-insured plans, to the extent that the plan (1) Is created or received by a health care
provides medical care (as defined in section provider, health plan, public health authority,
2791(a)(2) of the Public Health Service Act (PHS employer, life insurer, school or university, or health
Act), 42 U.S.C. 300gg–91(a)(2)), including items and care clearinghouse; and
services paid for as medical care, to employees or (2) Relates to the past, present, or future physical
their dependents directly or through insurance, or mental health or condition of an individual; the
reimbursement, or otherwise, that: provision of health care to an individual; or the past,
(1) Has 50 or more participants (as defined in present, or future payment for the provision of health
section 3(7) of ERISA, 29 U.S.C. 1002(7)); or care to an individual.
(2) Is administered by an entity other than the Health insurance issuer (as defined in section
employer that established and maintains the plan. 2791(b)(2) of the PHS Act, 42 U.S.C.
HHS stands for the Department of Health and 300gg–91(b)(2) and used in the definition of health
Human Services. plan in this section) means an insurance company,
Health care means care, services, or supplies insurance service, or insurance organization
related to the health of an individual. Health care (including an HMO) that is licensed to engage in the
includes, but is not limited to, the following: business of insurance in a State and is subject to State
(1) Preventive, diagnostic, therapeutic, law that regulates insurance. Such term does not
rehabilitative, maintenance, or palliative care, and include a group health plan.
counseling, service, assessment, or procedure with Health maintenance organization (HMO) (as
respect to the physical or mental condition, or defined in section 2791(b)(3) of the PHS Act, 42
functional status, of an individual or that affects the U.S.C. 300gg–91(b)(3) and used in the definition of
structure or function of the body; and health plan in this section) means a federally qualified
-3