In the following categories we propose use and disclosure provisions that respond to the unique circumstances of certain federal programs. We request comment on whether additional provisions are necessary to comply with the suitability and national security determination requirements of Executive Order 10450, as amended, and other national security laws.
[Please label comments about this section with the subject: “Military services”]
To address the special circumstances of the Armed Forces and their health care systems, we propose to permit military and other federal providers and health plans to use and disclose protected health information about active duty members of the Armed Forces for certain purposes, and to exclude from coverage under this rule health information about certain persons who receive care from military providers.
The primary purpose of the health care system of the military services differs in its basic character from that of the health care system of society in general. The special nature of military service is acknowledged by the Constitutional provision for separate lawmaking for them (U.S. Constitution, article I, section 8, clause 14) and in their separate criminal justice system under the Uniform Code of Military Justice (10 U.S.C. 801, et seq.).
The military health care system, like other federal and civilian health care systems, provides medical care and treatment to its beneficiary population. However, it also serves a critical national defense purpose, ensuring that the Armed Forces are in a state of medical readiness to permit the discharge of those responsibilities as directed by the National Command Authority.
The health and well-being of military members is key and essential. This is true whether such personnel are serving in the continental United States or overseas or whether such service is combat-related or not. In all environments, operational or otherwise, the Armed Forces must be assured that its personnel are medically qualified to perform their responsibilities. This is critical as each and every person performs a vital service upon which others must rely in executing a specified defense requirement. Unqualified personnel not only jeopardize the possible success of an assignment or operation, but they pose an undue risk and danger to others.
To assure that such persons are medically fit, health information is provided to proper command authorities regarding military members performing certain critical functions for medical screening and other purposes so that determinations can be made regarding the ability of such personnel to perform assigned duties. For example, health information is provided regarding:
The military and the Coast Guard obtain such information from their own health care systems, as well as from other agencies that provide health care to service members, such as the Department of Transportation (DOT), which is responsible for the United States Coast Guard and other federal agencies which provide medical care to members of the Armed Forces (e.g., the Department of State (DOS) provides such care to military attaches and Marine security personnel assigned to embassies and consulates overseas, the Department of Veterans Affairs provides care in certain areas of the country or in cases involving specialized services). Other health care providers could also provide information, for example, when a private sector physician treats a member injured in an accident.
The special needs of the DOD and DOT for accessing information for purposes other than treatment, payment or health care operations were recognized in the Secretary’s Recommendations. We considered several options for accommodating the unique circumstances of a military health care environment. We considered providing special rule-making authority to the DOD and other federal agencies which provide care to members of the military, but HIPAA does not allow for such delegation by the Secretary of HHS. Therefore, we propose that health care providers and health plans of the DOD, the DOT, the DOS, the Department of Veterans Affairs as well as any other person or entity providing health care to Armed Forces personnel, could use or disclose protected health information without individual authorization for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission.
The appropriate military command authorities, the circumstances in which use or disclosure without individual authorization would be required, and the activities for which such use or disclosure would occur in order to assure proper execution of the military mission, would be identified through Federal Register notices promulgated by the DOD or the DOT (for the Coast Guard). The verification requirements in § 164.518(c) would apply to disclosures permitted without authorization.
This proposal would not confer authority on the DOD or the DOT to enact rules which would permit use or disclosure of health information that is restricted or controlled by other statutory authority.
The Department of Defense, as well as other federal agencies, provide medical care to foreign military and diplomatic personnel, as well as their dependents. Such care is provided pursuant to either statutory authority (e.g., 10 U.S.C. 2549) or international agreement. The care may be delivered either in the United States or overseas. Also, where health care is provided in the United States, it may be furnished by non-government providers when government delivered care is not available or the beneficiary elects to obtain private as opposed to government health care. Examples include:
We believe that the statute was not intended to cover this unique class of beneficiaries. These persons are receiving U.S., either private or governmental, furnished health care, either in the United States or overseas, because of the beneficiary’s military or diplomatic status. For such personnel, we believe that the country-to-country agreements or federal statutes which call for, or authorize, such care in furtherance of a national defense or foreign policy purpose should apply. We propose to exclude foreign military and diplomatic personnel and their dependents who receive health care provided by or paid for by the DOD or other federal agency, or by an entity acting on its behalf pursuant to a country-to-country agreement or federal statute, from the definition of an “individual” in § 164.504. Therefore, the health information created about such persons by a DOD or other federal agency health care provider would not be protected under this rule. However, information created about such persons by covered health care providers whose services are not paid for by or provided on behalf of a federal agency would be protected health information.
The Department of Defense, as well as other federal agencies and U.S.-based non- governmental organizations, provide health care to foreign nationals overseas incident to U.S. sponsored missions or operations. Such care is provided pursuant to federal statute, international agreement, international organization sponsorship, or incident to military operations (including humanitarian and peacekeeping operations). Examples include:
We believe that the statute did not contemplate these unique beneficiary populations. Under circumstances where healthcare is being furnished to foreign nationals incident to sanctioned U.S. activities overseas, application of these proposed rules could have the unintended effect of impeding or frustrating the conduct of such activities, and producing incongruous results. Examples include:
Therefore, we propose to exclude overseas foreign national beneficiaries of health care provided by the DOD or other federal agency, or by non-governmental organizations acting on behalf of a federal agency, from the definition of an individual. This exclusion would mean that any health information created when providing health care to this population would not be protected health information and therefore not covered by these rules.
Upon completion of an individual's military service, the DOD routinely transfers that person's entire military service record, including protected health information, to the Department of Veterans Affairs so the file can be retrieved quickly if the individual or his/her dependents apply for veterans benefits. This practice was initiated in an effort to expedite veterans benefits eligibility determinations by ensuring timely access to complete, accurate information on the veteran's military service. Under the proposed rule, the transfer of these files would require individual authorization if protected health information is included. While this change could increase the time necessary for benefits processing in some cases, we believe the privacy interests outweigh the related administrative challenges. We invite comment on whether our assessment of costs and benefits is accurate. We also invite comment on alternative methods for ensuring privacy while expediting benefits processing.