Overdose Prevention and Patient Safety Act

Summary: Overdose Prevention and Patient Safety Act This bill amends the Public Health Service Act to align federal privacy standards for substance use disorder (SUD) patient records more closely with standards under the Health Insurance Portability and Accountability Act (HIPAA). Specifically, the bill authorizes the disclosure of SUD patient records without a patient's written consent to: (1) a covered entity for the purposes of treatment, payment, and health care operations, as long as the disclosure is made in accordance with HIPAA; and (2) a public health authority, as long as the content of the disclosure meets HIPAA standards regarding de-identified information. Current law authorizes disclosure of SUD patient records without a patient's written consent only to medical personnel in a medical emergency, to specified personnel for research or program evaluations, or pursuant to a court order. The bill also repeals and replaces criminal penalties for certain violations involving SUD patient records with the HIPAA civil penalty structure. It also applies HIPAA criminal penalties to wrongful disclosures of SUD patient records. In addition, the bill expands the current prohibition against using SUD patient records in criminal proceedings to include any use in specified federal, state, and local criminal and civil actions. The bill prohibits certain discrimination based on the release of SUD information under this bill.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Overdose Prevention and Patient 
Safety Act''.

SEC. 2. CONFIDENTIALITY AND DISCLOSURE OF RECORDS RELATING TO SUBSTANCE 
              USE DISORDER.

    (a) Conforming Changes Relating to Substance Use Disorder.--
Subsections (a) and (h) of section 543 of the Public Health Service Act 
(42 U.S.C. 290dd-2) are each amended by striking ``substance abuse'' 
and inserting ``substance use disorder''.
    (b) Disclosures to Covered Entities Consistent With HIPAA.--
Paragraph (2) of section 543(b) of the Public Health Service Act (42 
U.S.C. 290dd-2(b)) is amended by adding at the end the following:
                    ``(D) To a covered entity or to a program or 
                activity described in subsection (a), for the purposes 
                of treatment, payment, and health care operations, so 
                long as such disclosure is made in accordance with 
                HIPAA privacy regulation. Any redisclosure of 
                information so disclosed may only be made in accordance 
                with this section.''.
    (c) Disclosures of De-identified Health Information to Public 
Health Authorities.--Paragraph (2) of section 543(b) of the Public 
Health Service Act (42 U.S.C. 290dd-2(b)), as amended by subsection 
(b), is further amended by adding at the end the following:
                    ``(E) To a public health authority, so long as such 
                content meets the standards established in section 
                164.514(b) of title 45, Code of Federal Regulations (or 
                successor regulations) for creating de-identified 
                information.''.
    (d) Definitions.--Subsection (b) of section 543 of the Public 
Health Service Act (42 U.S.C. 290dd-2) is amended by adding at the end 
the following:
            ``(3) Definitions.--For purposes of this subsection:
                    ``(A) Covered entity.--The term `covered entity' 
                has the meaning given such term for purposes of HIPAA 
                privacy regulation.
                    ``(B) Health care operations.--The term `health 
                care operations' has the meaning given such term for 
                purposes of HIPAA privacy regulation.
                    ``(C) HIPAA privacy regulation.--The term `HIPAA 
                privacy regulation' has the meaning given such term 
                under section 1180(b)(3) of the Social Security Act.
                    ``(D) Individually identifiable health 
                information.--The term `individually identifiable 
                health information' has the meaning given such term for 
                purposes of HIPAA privacy regulation.
                    ``(E) Payment.--The term `payment' has the meaning 
                given such term for purposes of HIPAA privacy 
                regulation.
                    ``(F) Public health authority.--The term `public 
                health authority' has the meaning given such term for 
                purposes of HIPAA privacy regulation.
                    ``(G) Treatment.--The term `treatment' has the 
                meaning given such term for purposes of HIPAA privacy 
                regulation.''.
    (e) Use of Records in Criminal, Civil, or Administrative 
Investigations, Actions, or Proceedings.--Subsection (c) of section 543 
of the Public Health Service Act (42 U.S.C. 290dd-2) is amended to read 
as follows:
    ``(c) Use of Records in Criminal, Civil, or Administrative 
Contexts.--Except as otherwise authorized by a court order under 
subsection (b)(2)(C) or by the consent of the patient, a record 
referred to in subsection (a) may not--
            ``(1) be entered into evidence in any criminal prosecution 
        or civil action before a Federal or State court;
            ``(2) form part of the record for decision or otherwise be 
        taken into account in any proceeding before a Federal agency;
            ``(3) be used by any Federal, State, or local agency for a 
        law enforcement purpose or to conduct any law enforcement 
        investigation of a patient; or
            ``(4) be used in any application for a warrant.''.
    (f) Penalties.--Subsection (f) of section 543 of the Public Health 
Service Act (42 U.S.C. 290dd-2) is amended to read as follows:
    ``(f) Penalties.--The provisions of sections 1176 and 1177 of the 
Social Security Act shall apply to a violation of this section to the 
extent and in the same manner as such provisions apply to a violation 
of part C of title XI of such Act. In applying the previous sentence--
            ``(1) the reference to `this subsection' in subsection 
        (a)(2) of such section 1176 shall be treated as a reference to 
        `this subsection (including as applied pursuant to section 
        543(f) of the Public Health Service Act)'; and
            ``(2) in subsection (b) of such section 1176--
                    ``(A) each reference to `a penalty imposed under 
                subsection (a)' shall be treated as a reference to `a 
                penalty imposed under subsection (a) (including as 
                applied pursuant to section 543(f) of the Public Health 
                Service Act)'; and
                    ``(B) each reference to `no damages obtained under 
                subsection (d)' shall be treated as a reference to `no 
                damages obtained under subsection (d) (including as 
                applied pursuant to section 543(f) of the Public Health 
                Service Act)'.''.
    (g) Antidiscrimination.--Section 543 of the Public Health Service 
Act (42 U.S.C. 290dd-2) is amended by adding at the end the following:
    ``(i) Antidiscrimination.--
            ``(1) In general.--No entity shall discriminate against an 
        individual on the basis of information received by such entity 
        pursuant to a disclosure made under subsection (b) in--
                    ``(A) admission or treatment for health care;
                    ``(B) hiring or terms of employment;
                    ``(C) the sale or rental of housing; or
                    ``(D) access to Federal, State, or local courts.
            ``(2) Recipients of federal funds.--No recipient of Federal 
        funds shall discriminate against an individual on the basis of 
        information received by such recipient pursuant to a disclosure 
        made under subsection (b) in affording access to the services 
        provided with such funds.''.
    (h) Notification in Case of Breach.--Section 543 of the Public 
Health Service Act (42 U.S.C. 290dd-2), as amended by subsection (g), 
is further amended by adding at the end the following:
    ``(j) Notification in Case of Breach.--
            ``(1) Application of hitech notification of breach 
        provisions.--The provisions of section 13402 of the HITECH Act 
        (42 U.S.C. 17932) shall apply to a program or activity 
        described in subsection (a), in case of a breach of records 
        described in subsection (a), to the same extent and in the same 
        manner as such provisions apply to a covered entity in the case 
        of a breach of unsecured protected health information.
            ``(2) Definitions.--In this subsection, the terms `covered 
        entity' and `unsecured protected health information' have the 
        meanings given to such terms for purposes of such section 
        13402.''.
    (i) Sense of Congress.--It is the sense of the Congress that any 
person treating a patient through a program or activity with respect to 
which the confidentiality requirements of section 543 of the Public 
Health Service Act (42 U.S.C. 290dd-2) apply should access the 
applicable State-based prescription drug monitoring program as a 
precaution against substance use disorder.
    (j) Regulations.--
            (1) In general.--The Secretary of Health and Human 
        Services, in consultation with appropriate Federal agencies, 
        shall make such revisions to regulations as may be necessary 
        for implementing and enforcing the amendments made by this 
        section, such that such amendments shall apply with respect to 
        uses and disclosures of information occurring on or after the 
        date that is 12 months after the date of enactment of this Act.
            (2) Easily understandable notice of privacy practices.--Not 
        later than 1 year after the date of enactment of this Act, the 
        Secretary of Health and Human Services, in consultation with 
        appropriate experts, shall update section 164.520 of title 45, 
        Code of Federal Regulations, so that covered entities provide 
        notice, written in plain language, of privacy practices 
        regarding patient records referred to in section 543(a) of the 
        Public Health Service Act (42 U.S.C. 290dd-2(a)), including--
                    (A) a statement of the patient's rights, including 
                self-pay patients, with respect to protected health 
                information and a brief description of how the 
                individual may exercise these rights (as required by 
                paragraph (b)(1)(iv) of such section 164.520); and
                    (B) a description of each purpose for which the 
                covered entity is permitted or required to use or 
                disclose protected health information without the 
                patient's written authorization (as required by 
                paragraph (b)(2) of such section 164.520).
    (k) Development and Dissemination of Model Training Programs for 
Substance Use Disorder Patient Records.--
            (1) Initial programs and materials.--Not later than 1 year 
        after the date of the enactment of this Act, the Secretary of 
        Health and Human Services (referred to in this subsection as 
        the ``Secretary''), in consultation with appropriate experts, 
        shall identify the following model programs and materials (or 
        if no such programs or materials exist, recognize private or 
        public entities to develop and disseminate such programs and 
        materials):
                    (A) Model programs and materials for training 
                health care providers (including physicians, emergency 
                medical personnel, psychiatrists, psychologists, 
                counselors, therapists, nurse practitioners, physician 
                assistants, behavioral health facilities and clinics, 
                care managers, and hospitals, including individuals 
                such as general counsels or regulatory compliance staff 
                who are responsible for establishing provider privacy 
                policies) concerning the permitted uses and 
                disclosures, consistent with the standards and 
                regulations governing the privacy and security of 
                substance use disorder patient records promulgated by 
                the Secretary under section 543 of the Public Health 
                Service Act (42 U.S.C. 290dd-2), as amended by this 
                section, for the confidentiality of patient records.
                    (B) Model programs and materials for training 
                patients and their families regarding their rights to 
                protect and obtain information under the standards and 
                regulations described in subparagraph (A).
            (2) Requirements.--The model programs and materials 
        described in subparagraphs (A) and (B) of paragraph (1) shall 
        address circumstances under which disclosure of substance use 
        disorder patient records is needed to--
                    (A) facilitate communication between substance use 
                disorder treatment providers and other health care 
                providers to promote and provide the best possible 
                integrated care;
                    (B) avoid inappropriate prescribing that can lead 
                to dangerous drug interactions, overdose, or relapse; 
                and
                    (C) notify and involve families and caregivers when 
                individuals experience an overdose.
            (3) Periodic updates.--The Secretary shall--
                    (A) periodically review and update the model 
                programs and materials identified or developed under 
                paragraph (1); and
                    (B) disseminate such updated programs and materials 
                to the individuals described in paragraph (1)(A).
            (4) Input of certain entities.--In identifying, reviewing, 
        or updating the model programs and materials under this 
        subsection, the Secretary shall solicit the input of relevant 
        stakeholders.
    (l) Rules of Construction.--Nothing in this Act or the amendments 
made by this Act shall be construed to limit--
            (1) a patient's right, as described in section 164.522 of 
        title 45, Code of Federal Regulations, or any successor 
        regulation, to request a restriction on the use or disclosure 
        of a record referred to in section 543(a) of the Public Health 
        Service Act (42 U.S.C. 290dd-2(a)) for purposes of treatment, 
        payment, or health care operations; or
            (2) a covered entity's choice, as described in section 
        164.506 of title 45, Code of Federal Regulations, or any 
        successor regulation, to obtain the consent of the individual 
        to use or disclose a record referred to in such section 543(a) 
        to carry out treatment, payment, or health care operation.
    (m) Sense of Congress.--It is the sense of the Congress that--
            (1) patients have the right to request a restriction on the 
        use or disclosure of a record referred to in section 543(a) of 
        the Public Health Service Act (42 U.S.C. 290dd-2(a)) for 
        treatment, payment, or health care operations; and
            (2) covered entities should make every reasonable effort to 
        the extent feasible to comply with a patient's request for a 
        restriction regarding such use or disclosure.

            Passed the House of Representatives June 20, 2018.

            Attest:

                                                 KAREN L. HAAS,

                                                                 Clerk.