[§164. Repealed. Oct. 10, 1940, ch. 851, § 4, 54 Stat. 1111 — repealed] — Inbound Citations

Citations to 45 U.S.C. § 164 as a whole

• 15 U.S.C. § 2208(e)(2)

  Go to provision →
  (2) other applicable regulations, including parts 160, 162, and 164 of title 45, Code of Federal Regulations (as in effect on March 12, 2019).
• 26 U.S.C. § 9826(b)(4)(A)

  Go to provision →
  (A) An entity providing pharmacy benefit management services on behalf of a group health plan shall report information under paragraph (1) in a manner consistent with the privacy regulations promulgated under section 13402(a) of the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17932(a)) and consistent with the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations) (referred to in this paragraph as the “HIPAA privacy regulations”) and shall restrict the use and disclosure of such information according to such privacy regulations and such HIPAA privacy regulations.
• 29 U.S.C. § 1108(b)(2)(C)(vi)(IV)

  Go to provision →
  (IV) modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations); or
• 29 U.S.C. § 1185o(b)(4)(A)

  Go to provision →
  (A) An entity providing pharmacy benefit management services on behalf of a group health plan or a health insurance issuer offering group health insurance coverage shall report information under paragraph (1) in a manner consistent with the privacy regulations promulgated under section 17932(a) of title 42 and consistent with the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations) (referred to in this paragraph as the “HIPAA privacy regulations”) and shall restrict the use and disclosure of such information according to such privacy regulations and such HIPAA privacy regulations.
• 42 U.S.C. § 290dd–2(k)(5)

  Go to provision →
  (5) The term “HIPAA regulations” has the meaning given such term for purposes of parts 160 and 164 of title 45, Code of Federal Regulations.
• 42 U.S.C. § 300gg–121(b)(4)(A)

  Go to provision →
  (A) An entity providing pharmacy benefit management services on behalf of a group health plan or a health insurance issuer offering group health insurance coverage shall report information under paragraph (1) in a manner consistent with the privacy regulations promulgated under section 17932 of this title and consistent with the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations) (referred to in this paragraph as the “HIPAA privacy regulations”) and shall restrict the use and disclosure of such information according to such privacy regulations and such HIPAA privacy regulations.
• 42 U.S.C. § 300jj–19(e)(1)(B)

  Go to provision →
  (B) To promote awareness that an individual has a right of access to inspect, obtain a copy of, and transmit to a third party a copy of such individual’s protected health information pursuant to the Health Information Portability and Accountability Act, Privacy Rule (subpart E of part 164 of title 45, Code of Federal Regulations), the Director of the Office for Civil Rights, in consultation with the National Coordinator, shall assist individuals and health care providers in understanding a patient’s rights to access and protect personal health information under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191), including providing best practices for requesting personal health information in a computable format, including using patient portals or third-party applications and common cases when a provider is permitted to exchange and provide access to health information.”.²
• 42 U.S.C. § 17931(c)

  Go to provision →
  (c) For the first year beginning after February 17, 2009, and annually thereafter, the Secretary of Health and Human Services shall, after consultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi)¹ of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009.
• 42 U.S.C. § 17935(b)(1)(B)

  Go to provision →
  (B) Not later than 18 months after February 17, 2009, the Secretary shall issue guidance on what constitutes “minimum necessary” for purposes of subpart E of part 164 of title 45, Code of Federal Regulation.¹ In issuing such guidance the Secretary shall take into consideration the guidance under section 17953(c) of this title and the information necessary to improve patient outcomes and to detect, prevent, and manage chronic disease.
• 42 U.S.C. § 17936(a)(1)

  Go to provision →
  (1) A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of such title.
• 42 U.S.C. § 17936(a)(2)

  Go to provision →
  (2) A communication by a covered entity or business associate that is described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations if the covered entity receives or has received direct or indirect payment in exchange for making such communication, except where—

  (i) such communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication; and

  (ii) any payment received by such covered entity in exchange for making a communication described in clause (i) is reasonable in amount;

  (B) each of the following conditions apply—

  (i) the communication is made by the covered entity; and

  (ii) the covered entity making such communication obtains from the recipient of the communication, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization (as described in paragraph (b) of such section) with respect to such communication; or

  (C) each of the following conditions apply—

  (i) the communication is made by a business associate on behalf of the covered entity; and

  (ii) the communication is consistent with the written contract (or other written arrangement described in section 164.502(e)(2) of such title) between such business associate and covered entity.
• 42 U.S.C. § 17938

  Go to provision →
  Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
• 42 U.S.C. § 17939(c)(1)

  Go to provision →
  (1) Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act (42 U.S.C. 1320d–5) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
• 42 U.S.C. § 17940

  Go to provision →
  The Secretary shall provide for periodic audits to ensure that covered entities and business associates that are subject to the requirements of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009, comply with such requirements.
• 42 U.S.C. § 17953(a)(1)

  Go to provision →
  (1) For the first year beginning after February 17, 2009, and annually thereafter, the Secretary shall prepare and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report concerning complaints of alleged violations of law, including the provisions of this subchapter as well as the provisions of subparts C and E of part 164 of title 45, Code of Federal Regulations, (as such provisions are in effect as of February 17, 2009) relating to privacy and security of health information that are received by the Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year—

  (A) the number of such complaints;

  (B) the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided;

  (C) the number of such complaints that have resulted in the imposition of civil monetary penalties or have been resolved through monetary settlements, including the nature of the complaints involved and the amount paid in each penalty or settlement;

  (D) the number of compliance reviews conducted and the outcome of each such review;

  (E) the number of subpoenas or inquiries issued;

  (F) the Secretary’s plan for improving compliance with and enforcement of such provisions for the following year; and

  (G) the number of audits performed and a summary of audit findings pursuant to section 17940 of this title.