HHS's proposed rule on Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164, included a provision at section 164.510(d) relating to judicial and administrative proceedings. Orginally published as a proposed rule on Nov. 3, 1999, proposed modifications were published on March 27, 2002. The text below shows the judicial/administrative proceeding exception as it appeared on that date. See Office for Civil Rights, HHS, Proposed rule; modification, Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164, 67 Fed. Reg. 14775 (Mar. 27, 2002). The final version of this rule was renumbered as 45 CFR 164.512(e).

The regulation as it relates to judicial and administrative proceedings, as proposed at 64 Fed. Reg. 59917, 60056-57 (Nov. 3, 1999), provided:

Sec. 164.510 Uses and disclosures for which individual authorization is not required.

    A covered entity may use or disclose protected health information, for purposes other than treatment, payment, or health care operations, without the authorization of the individual, in the situations covered by this section and subject to the applicable requirements provided for by this section.

* * *

    (d) Disclosures and uses for judicial and administrative proceedings.--(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:
    (i) In response to an order of a court or administrative tribunal;
or
    (ii) Where the individual is a party to the proceeding and his or her medical condition or history is at issue and the disclosure is pursuant to lawful process or otherwise authorized by law.
    (2) Permitted use. Where the covered entity is itself a government agency, the covered entity may use protected health information in all cases in which it is permitted to disclose such information in the course of any judicial or administrative proceeding under paragraph
(d)(1) of this section.
    (3) Additional restriction. (i) Where the request for disclosure of protected health information is accompanied by a court order, the covered entity may disclose only that protected health information which the court order authorizes to be disclosed.
    (ii) Where the request for disclosure of protected health information is not accompanied by a court order, the covered entity may not disclose the information requested unless a request authorized by law has been made by the agency requesting the information or by legal counsel representing a party to litigation, with a written statement certifying that the protected health information requested concerns a litigant to the proceeding and that the health condition of such litigant is at issue at such proceeding.

In pertinent part, the regulation at 67 Fed. Reg. 14775, proposes to modify this provision as follows:

    9. Amend Sec. 164.510 as follows:

    a. Revise the first sentence of the introductory text.

* * *

    The revision reads as follows:

Sec. 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object.

    A covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section. * * *