Prescription Privacy Protection Act of 1998

Summary: Prescription Privacy Protection Act of 1998 - Prohibits a pharmacy owner, pharmacist, or pharmacy employee from disclosing prescription data to any person or governmental agency (other than the individual who is the subject of the data or another owner or employee of the pharmacy) without written consent from the data subject, except:  (1) to the physician who wrote the prescription; (2) to a parent or guardian in certain circumstances; (3) to the data subject's agent under a power of attorney; (4) to specified agents of the owner; (5) in connection with certain judicial, administrative, or law enforcement matters; or (6) where necessary to support an application for health benefits from an insurance provider or governmental agency.  Mandates a civil monetary penalty for violations.  Declares that this Act does not preempt State laws imposing requirements in addition to those in this Act.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Prescription Privacy Protection Act 
of 1998''.

SEC. 2. RESTRICTION ON DISSEMINATION OF PRESCRIPTION INFORMATION.

    Except as provided in section 3, a pharmacy owner, pharmacist, or 
employee of a pharmacy may not disclose prescription data to any person 
or governmental agency, other than the individual who is the subject of 
the data or another owner or employee of the pharmacy, without having 
obtained from such individual a written consent to the disclosure that 
satisfies the requirements of section 4.

SEC. 3. EXCEPTIONS.

    A pharmacy owner, pharmacist, or employee of a pharmacy may make a 
disclosure of prescription data otherwise prohibited under section 2, 
if the disclosure is made under one of the following conditions:
            (1) To the physician who wrote the prescription that is the 
        subject of the prescription data.
            (2) To a parent or guardian of the individual who is the 
        subject of the prescription data, or to a court-appointed 
        attorney representing the individual, but only where the 
        individual is a minor.
            (3) To a guardian of the individual who is the subject of 
        the prescription data, or to a court-appointed attorney 
        representing the individual, but only where the individual is 
        not capable, because of a physical or mental condition, to 
        effect a written consent that satisfies the requirements of 
        section 4.
            (4) To an agent of the individual who is the subject of the 
        prescription data, where the agent is acting under authority 
        granted in a power of attorney.
            (5) In the case of a pharmacy owner, to an agent of the 
        owner, where the disclosure is necessary for the purpose of a 
        carrying out a written contract between the agent and the owner 
        under which the agent--
                    (A) is required to perform administrative services 
                for the owner; and
                    (B) is prohibited from disclosing the prescription 
                data to any person other than the owner.
            (6) For purposes of complying with a judicial or 
        administrative subpoena or a court order.
            (7) For purposes of providing information requested in a 
        law enforcement investigation, an audit, a pharmacist licensure 
        procedure, or a professional review.
            (8) In the course of oral testimony in a deposition or 
        court proceeding.
            (9) Where the disclosure is necessary to support an 
        application for receipt of health care benefits from a health 
        insurance provider or a governmental agency.
            (10) Where the disclosure is made for the purpose of 
        permitting any person to carry out a duty or authority under 
        title XVIII or XIX of the Social Security Act.

SEC. 4. CONSENT.

    A pharmacy owner, pharmacist, or employee of a pharmacy may make a 
disclosure of prescription data to any person or governmental agency 
other than the individual who is the subject of the data, if the owner, 
pharmacist, or employee has obtained from such individual a written 
consent to the disclosure that includes the following information:
            (1) The name of the individual who is the subject of the 
        data.
            (2) The name of the physician who wrote the prescription 
        that is the subject of the data.
            (3) The nature of the data authorized to be disclosed.
            (4) The date on which the consent expires.
            (5) The date on which the consent is executed.
            (6) The signature of the individual who is the subject of 
        the data.

SEC. 5. REGULATIONS AND ENFORCEMENT.

    (a) Regulations.--The Secretary of Health and Human Services and 
the Secretary of Labor shall jointly promulgate regulations to enforce 
this Act.
    (b) Violation.--
            (1) In general.--Any person who the Secretary of Health and 
        Human Services or the Secretary of Labor determines has 
        substantially and materially failed to comply with this Act, or 
        a regulation promulgated by such Secretary under this Act, 
        shall be subject, in addition to any other penalties that may 
        be prescribed by law, to a civil penalty of not more than 
        $10,000 for each such violation.
            (2) Procedures for imposition of penalties.--Section 1128A 
        of the Social Security Act, other than subsections (a) and (b) 
        and the second sentence of subsection (f) of that section, 
        shall apply to the imposition of a civil monetary penalty under 
        paragraph (1) in the same manner as such provisions apply with 
        respect to the imposition of a penalty under section 1128A of 
        such Act.

SEC. 6. PREEMPTION.

    This Act shall not preempt any State law that is not inconsistent 
with this Act, but that imposes additional requirements with respect to 
a prohibition under this Act.

SEC. 7. DEFINITIONS.

    For purposes of this Act:
            (1) Guardian.--The term ``guardian'' means a court-approved 
        or court-appointed guardian of an individual.
            (2) Parent.--The term ``parent'' means a biological, 
        adoptive, or foster parent.
            (3) Pharmacist.--The term ``pharmacist'' means a person who 
        is licensed to engage in the practice of pharmacology.
            (4) Pharmacy owner.--The term ``pharmacy owner'' means any 
        person that operates a licensed pharmacy.
            (5) Physician.--The term ``physician'' means a health care 
        professional who is legally authorized to write prescriptions 
        for pharmaceutical products.
            (6) Prescription data.--The term ``prescription data'' 
        means any written, printed, or electronically recorded 
        information maintained by a pharmacist or pharmacy owner that 
        indicates the pharmaceutical product or drug therapy prescribed 
        by a physician. Such term includes information such as brand 
        name, scientific name, manufacturer, and medical use of the 
        pharmaceutical product or drug therapy.