To Protect the Privacy of Protected Health Information in Oversight Investigations

This executive order restricts law enforcement from using protected health information discovered during health oversight investigations for unrelated civil, administrative, or criminal matters, unless the Deputy Attorney General (or DoD General Counsel for military personnel) authorizes it after determining that public interest clearly outweighs potential harm to patients. It also requires annual reporting to the President on such uses.

Federal Register Open PDF 65 FR 81321

Impact dates

Dec 20, 2001
First annual report to President on protected health information use requests and authorizations

Key directives

Deputy Attorney General must personally authorize use of protected health information for unrelated non-health oversight investigations
DoD General Counsel serves as authorizing official for military personnel records
Authorization requires 'clearly outweigh' standard: public interest and need for disclosure must clearly outweigh potential injury to patient, physician-patient relationship, and treatment services
Appropriate safeguards against unauthorized use must be imposed when use is authorized
Annual report to President required from DOJ (incorporating DoD data) on requests, grants, denials, requesting agencies, and authorized uses

Who is ordered

Timeline

Immediate

EO takes effect upon signing; restrictions on use of protected health information in unrelated investigations become operative

Near term (90d)

First annual report to President due within one year of signing (by December 20, 2001)

Long term

Ongoing annual reporting requirement continues indefinitely
Enduring structural limitation on executive branch use of health data across administrations

Risks & tensions

Vague 'clearly outweighs' standard leaves significant discretion to Deputy Attorney General without judicial review; no enforcement mechanism for patients
EO explicitly disclaims creating any enforceable legal rights (Section 4d), making compliance essentially internal executive discipline
Potential tension between health fraud enforcement and patient privacy when investigators encounter evidence of non-health crimes
DoD carve-out for military personnel creates dual-track system with different authorizing officials
Annual reporting requirement may be weakened or ignored by subsequent administrations without consequence given non-justiciability