CUI Registry

Authorities and Sanctions

Category-Subcategory:	Privacy-Health Information
Category Description:	Refers to personal information, or, in some cases, "personally identifiable information," as defined in OMB M-07-16, or "means of identification" as defined in 18 USC 1028(d)(7).
Subcategory Description:	As per 42 USC 1320d(4), “health information” means any information, whether oral or recorded in any form or medium, that— (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

Select Safeguarding/Dissemination or Sanction Authority to view statutory/regulatory language in a new window.
Authority links are updated based on regular re-publication of the United States Code and Code of Federal Regulations.

Safeguarding and/or Dissemination Authority	Sanctions
18 USC 3486(e)
18 USC 4247(e)
42 USC 242m(d)
38 USC 7332(a)	38 USC 5705
38 USC 5705	38 USC 5705
42 USC 12112(d)	42 USC 12188
42 USC 1320d-2(d)(2)	42 USC 1320d-5 42 USC 1320d-6(b)
42 USC 1320d-2 note(b)(Public Law 104-191, Section 264)	42 USC 1320d-5 42 USC 1320d-6(b)
42 USC 15044(c)
42 USC 290dd-2(a)	42 USC 290dd-2(f)
20 CFR 401.200(g)	20 CFR 401.200(h)
29 CFR 1630.14(b)(1)
42 CFR 2.1(a)	42 CFR 2.1(f)
42 CFR 2.12(a)	42 CFR 2.1(f)
42 CFR 2.13(c)	42 CFR 2.1(f)
42 CFR 2.16(a)	42 CFR 2.1(f)
42 CFR 2.2(a)	42 CFR 2.2(f)
42 CFR 2.21(b)	42 CFR 2.2(f)
45 CFR 164.306(a)
45 CFR 164.310(a)(1)
45 CFR 164.502(a)
45 CFR 164.508(a)
45 CFR 164.530(c)	45 CFR 164.530(e)