Skip to main content Back to Top


Final Privacy Rule Released by HHS

Cheryl A. Thompson

The Department of Health and Human Services (HHS) has published what it calls the final modifications to the federal standards protecting the privacy of patients’ individually identifiable health information. Hospitals, pharmacies, and most other health care providers have until April 14, 2003, to comply with the standards.

Initially developed under the Clinton administration and released a month before President Bush took office, the privacy rule underwent review by the new administration. HHS invited the public to comment on the rule, which differed substantially from what had been proposed in 1999. The department issued clarifications in July 2001 (see August 15, 2001, AJHP News), formally proposed modifications in March 2002, and published the final rule in mid-August.

Without the formal process, the clarifications would not have been part of the rule to which health care providers and plans must abide. One of these clarifications explained that pharmacists are not required to have a patient sign a consent form before they review personal health information, such as allergies and concomitant therapies, vital to properly filling a prescription.

Development of the privacy rule fell to HHS in August 1999, after Congress did not meet its self-imposed deadline to pass a bill that detailed a comprehensive set of national standards to protect personal health information. This requirement for a federal law or administrative rule was part of the Health Insurance Portability and Accountability Act of 1996.