HIPAA Regulations: General Provisions: Definitions: Individual - § 160.103
As Contained in the HHS HIPAA Rules
|
HHS Regulations |
Individual means the person who is the subject of protected health information.
| HHS Description General Provisions: Definitions - Individual |
We proposed to define “individual” to mean the person who is the subject of the protected health information. We proposed that the term include, with respect to the signing of authorizations and other rights (such as access, copying, and correction), the following types of legal representatives:
(1) With respect to adults and emancipated minors, legal representatives (such as court-appointed guardians or persons with a power of attorney), to the extent to which applicable law permits such legal representatives to exercise the person's rights in such contexts.
(2) With respect to unemancipated minors, a parent, guardian, or person acting in loco parentis, provided that when a minor lawfully obtains a health care service without the consent of or notification to a parent, guardian, or other person acting in loco parentis, the minor shall have the exclusive right to exercise the rights of an individual with respect to the protected health information relating to such care.
(3) With respect to deceased persons, an executor, administrator, or other person authorized under applicable law to act on behalf of the decedent's estate.
In addition, we proposed to exclude from the definition:
(1) Foreign military and diplomatic personnel and their dependents who receive health care provided by or paid for by the Department of Defense or other federal agency or by an entity acting on its behalf, pursuant to a country-to-country agreement or federal statute.
(2) Overseas foreign national beneficiaries of health care provided by the Department of Defense or other federal agency or by a non-governmental organization acting on its behalf.
In the final rule, we eliminate from the definition of “individual” the provisions designating a legal representative as the “individual” for purposes of exercising certain rights with regard to protected health information. Instead, we include in the final rule a separate standard for “personal representatives.” A covered entity must treat a personal representative of an individual as the individual except under specified circumstances. See discussion in § 164.502(g) regarding personal representatives.
In addition, we eliminate from the definition of “individual” the above exclusions for foreign military and diplomatic personnel and overseas foreign national beneficiaries. We address the special circumstances for use and disclosure of protected health information about individuals who are foreign military personnel in § 164.512(k). We address overseas foreign national beneficiaries in § 164.500, “Applicability.” The protected health information of individuals who are foreign diplomatic personnel and their dependents are not subject to special treatment under the final rule.
Individually identifiable health information about one individual may exist in the health records of another individual; health information about one individual may include health information about a second person. For example, a patient's medical record may contain information about the medical conditions of the patient's parents, children, and spouse, as well as their names and contact information. For the purpose of this rule, if information about a second person is included within the protected health information of an individual, the second person is not the person who is the subject of the protected health information. The second person is not the “individual” with regard to that protected health information, and under this rule thus does not have the individual's rights (e.g., access and amendment) with regard to that information.
| HHS Response to Comments Received General Provisions: Definitions - Individual |
Comment: A few commenters stated that foreign military and diplomatic personnel, and their dependents, and overseas foreign national beneficiaries, should not be excluded from the definition of “individual.”
Response: We agree with concerns stated by commenters and eliminate these exclusions from the definition of “individual” in the final rule. Special rules for use and disclosure of protected health information about foreign military personnel are stated in § 164.512(k). Under the final rule, protected health information about diplomatic personnel is not accorded special treatment. While the exclusion of overseas foreign national beneficiaries has been deleted from the definition of “individual,” we have revised § 164.500 to indicate that the rule does not apply to the Department of Defense or other federal agencies or non-governmental organizations acting on its behalf when providing health care to overseas foreign national beneficiaries. This means that the rule will not cover any health information created incident to the provision of health care to foreign nationals overseas by U.S. sponsored missions or operations. (See § 164.500 and its corresponding preamble for details and the rationale for this policy.)
Comment: Several commenters expressed concern about the interrelationship of the definition of “individual” and the two year privacy protection for deceased persons.
Response: In the final rule, we eliminate the two year limit on privacy protection for protected health information about deceased individuals and require covered entities to comply with the requirements of the rule with respect to the protected health information of deceased individuals as long as they hold such information. See discussion under § 164.502.