Related Links

Web Seminars

The Department of Health and Human Services has published a final rule to exempt four federal "systems of records," or computer systems, from several provisions of the Privacy Act. These systems include one used to track alleged violations of HIPAA's administrative simplification provisions.

In general, the HIPAA information tracking system called HITS, "consists of an electronic repository of information, documents, and supplementary paper document files resulting from investigations of alleged violations of the transactions and code sets, security and unique identifier provisions of HIPAA," according to the rule. "HITS' purpose is to support investigations of complainants, determinations as to whether there were violations as charged in the original complaint, referral of violations to law enforcement entities as necessary, and maintenance and retrieval of records that contain the results of the complaint investigations. The system of records covers individuals who have submitted complaints alleging violations of the provisions of HIPAA. Investigative files maintained in HITS are received either as electronic documents or as paper records that are compiled for law enforcement purposes."

The other exempted systems of records under the final rule are the Automated Survey Processing Environment Complaints/Incidents Tracking System covering complaints against health care facilities; the Organ Procurement Organizations System covering complaints; and the CMS Fraud Investigation Database.

HHS published the final rule in the Federal Register on Sept. 26, available here.