Healthcare Privacy and Anti-Fraud Act

Summary: Healthcare Privacy and Anti-Fraud Act - Amends the Patient Protection and Affordable Care Act to require the Secretary of Health and Human Services (HHS) to issue guidance (including concerning liability) to protect the privacy of individually identifiable information submitted to, or accessed by, health care exchange navigators. Requires entities receiving grants under the navigator program to ensure that their employees undergo background checks, take an oath not to disclose individually identifiable information, and meet educational and licensure requirements comparable to those applicable to health insurance agents and brokers in the state. Imposes criminal penalties for disclosure of individually identifiable information and misrepresentation as a navigator. Directs the Secretary to annually make available a list of entities providing navigator services and a list of those determined to be ineligible or convicted of offenses described in this Act. Amends the Internal Revenue Code to exempt individuals from the penalty for not maintaining minimum essential coverage for any month if the failure resulted from advice of a navigator or a person purporting to provide such services.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Healthcare Privacy and Anti-Fraud 
Act''.

SEC. 2. TRAINING, BACKGROUND CHECKS, AND NONDISCLOSURE FOR PATIENT 
              NAVIGATORS.

    (a) In General.--Section 1311(i) of the Patient Protection and 
Affordable Care Act (42 U.S.C. 18031(i)) is amended by adding at the 
end the following:
            ``(7) Security and nondisclosure.--
                    ``(A) Guidance by secretary.--Not later than 90 
                days after the date of enactment of this paragraph, the 
                Secretary shall issue guidance on the implementation of 
                this paragraph in order to protect the privacy of 
                individually identifiable information submitted to, or 
                accessed by, navigators under this subsection.
                    ``(B) Background checks.--
                            ``(i) In general.--An entity that receives 
                        a grant under this subsection shall ensure that 
                        universal background checks are conducted on 
                        all employees of the entity prior to such 
                        employees providing navigator services to 
                        individuals, or prior to such employees having 
                        access to individually identifiable information 
                        as a result of providing such services. Such 
                        background checks shall, at minimum, include a 
                        criminal background check, fingerprinting, and 
                        credit report.
                            ``(ii) Limitation.--An individual who has 
                        been found guilty of a felony, or guilty of a 
                        misdemeanor involving deceit or dishonestly 
                        (including identity theft, fraud, or perjury), 
                        under Federal or State law shall not be 
                        employed by an entity described in clause (i).
                    ``(C) Oath.--
                            ``(i) In general.--Prior to commencing 
                        employment with an entity that receives a grant 
                        under this subsection, an individual described 
                        in clause (ii) shall have sworn or taken an 
                        oath that he or she will not disclose any 
                        individually identifiable information obtained 
                        in the course of their employment (except 
                        information relevant to the commission of a 
                        felony when provided to an appropriate law 
                        enforcement authority).
                            ``(ii) Individual described.--An individual 
                        is described in this clause if such individual 
                        is being employed by an entity described in 
                        clause (i) as a navigator, a non-navigator 
                        assistant, or as an employee with access to 
                        individually identifiable information.
                    ``(D) Educational, training, and licensure 
                requirements.--Prior to conducting navigation services 
                for an entity under this subsection, an individual 
                shall meet educational and licensure requirements that 
                are identical or comparable to those currently 
                applicable to health insurance agents and brokers 
                within the State in which they seek to provide 
                navigation services, including the completion of at 
                least 30 hours of training (including training on 
                privacy rights under this Act and other relevant 
                Federal laws).
                    ``(E) Liability.--Not later than 90 days after the 
                date of the enactment of this paragraph, the 
                Secretary--
                            ``(i) shall issue guidance concerning how 
                        liability and penalties will be applied by the 
                        Secretary in instances of failure to comply 
                        with requirements of this paragraph, including 
                        where consumer outreach and enrollment 
                        assistance causes harm to an individual as a 
                        result of misuse or negligence in protection 
                        and privacy of individually identifiable 
                        information;
                            ``(ii) shall determine whether such 
                        liability lies with the navigator or non-
                        navigator assistance personnel involved or 
                        whether liability lies with the entity that 
                        received the grant under this subsection; and
                            ``(iii) shall determine whether the 
                        individuals or entities identified under clause 
                        (ii) are required to obtain professional 
                        liability coverage.
                    ``(F) Penalties.--
                            ``(i) In general.--Whoever having sworn or 
                        taken the oath described under subparagraph 
                        (C), publishes or communicates any individually 
                        identifiable information which comes into his 
                        or her possession by reason of his or her being 
                        employed (or otherwise providing services) 
                        under this subsection, shall be fined not more 
                        than $5,000 or imprisoned not more than 5 
                        years, or both.
                            ``(ii) Misrepresentation.--Any person who 
                        knowingly and falsely represents that such 
                        person is, or holds himself or herself out as, 
                        a navigator under this subsection shall be 
                        fined not more than $5,000 or imprisoned not 
                        more than 5 years, or both.
                            ``(iii) Enhanced penalty for sale or 
                        transfer.--A person who commits the offense 
                        described under clause (i) with the intent to 
                        sell, transfer, or use individually 
                        identifiable information for commercial 
                        advantage, personal gain, or malicious harm 
                        shall be fined not more than $250,000, 
                        imprisoned for not more than 10 years, or both.
                    ``(G) Greater protections.--Nothing in 
                subparagraphs (A), (B), (C) or (D) shall be construed 
                to prohibit States from imposing additional standards 
                and protections to protect consumer information.
            ``(8) List of navigators.--Not later than 90 days after the 
        date of enactment of this paragraph, and annually thereafter, 
        the Secretary shall make available a list of entities providing 
        navigator services in accordance with this subsection and a 
        list of entities that have been determined to be ineligible to 
        provide such services or who have been convicted of a violation 
        under paragraph (7).''.
    (b) Limitation on Liability.--Section 5000A(e) of the Internal 
Revenue Code of 1986 is amended by adding at the end the following:
            ``(6) Reliance on navigator advice.--Any applicable 
        individual who for any month failed to obtain minimum essential 
        coverage as a result of the good faith reliance on the advice 
        of a patient navigator, counselor, or other employee of an 
        entity receiving a grant under section 1311(i) of the Patient 
        Protection and Affordable Care Act (or a person purporting to 
        be such a navigator, counselor, or other employee).''.
    (c) Effective Date.--The amendment made by subsection (a) shall 
take effect on the date of the enactment of this Act and shall apply to 
grants made before, on, or after the date of the enactment of this Act. 
The Secretary of Health and Human Services shall provide for the prompt 
modification of such grants made before the date of the enactment of 
this Act in order to comply with the requirement imposed by such 
amendment.