Prior to the issuance of the HIPAA privacy rule, federal laws did not address the confidentiality of health-care information collected and maintained by the private sector ( i.e. HIPAA

Several comprehensive medical records confidentiality bills were introduced during the past decade, with the end result being passage of the medical privacy requirements as part of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Section 264 of HIPAA requires HHS to submit to the Congress detailed recommendations on standards with respect to privacy rights for individually identifiable health information. HHS also recently issued a 20 page "Summary of the HIPAA Privacy Rule." The final privacy rule was criticized by some for its complexity, and for the imposition of substantial administrative and financial burdens on the health care industry. The August 2002 Privacy Rule

The Bush Administration and HHS re-opened the privacy rule to additional comment on February 8, 2001, and announced that it would accept further comments on the rule until March 30, 2001, see 66 Fed. On August 14, 2002, HHS published in the Federal Register the privacy rule with certain modifications, 67 Fed. Incidental Use and Disclosure. The December 2000 rule prevents a provider from disclosing protected health information to another entity for other than treatment purposes.
This report provides a brief overview of the modified HIPAA Privacy rule, "Standards for the Privacy of Individually Identifiable Health Information"("privacy rule") published on August 14, 2002 by the Department of Health and Human Services (HHS). Issuance of the modified Privacy Rule by the Bush Administration is the culmination of a decades long debate over access to medical records that has pitted privacy advocates and civil libertarians against employers and much of the health care industry. As required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), a privacy rule was issued in December 2000, and modified August 2002. The privacy rule went into effect April 14, 2001, with compliance required by April 2003 for most entities. The HIPAA Privacy Rule establishes a set of basic consumer protections and a series of regulatory permissions for uses and disclosures of protected health information. S. 16, introduced in the 108th Congress by Senator Daschle, would reverse some modifications to the rule. This report will be updated.