SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Genetic Research Privacy Protection 
Act''.

SEC. 2. PROTECTION OF PRIVACY OF INDIVIDUALS WHO ARE RESEARCH SUBJECTS.

    (a) In General.--Subsection (d) of section 301 of the Public Health 
Service Act (42 U.S.C. 241) is amended to read as follows:
    ``(d) Protection of Privacy of Individuals Who Are Research 
Subjects.--
            ``(1) Issuance of certificate.--
                    ``(A) In general.--If a person is engaged in 
                biomedical, behavioral, clinical, or other research, in 
                which identifiable, sensitive information is collected 
                (including research on mental health and research on 
                the use and effect of alcohol and other psychoactive 
                drugs), the Secretary, in coordination with other 
                Departments, as applicable--
                            ``(i) shall issue to such person a 
                        certificate of confidentiality to protect the 
                        privacy of individuals who are the subjects of 
                        such research if the research is funded wholly 
                        or in part by the Federal Government; and
                            ``(ii) may, upon application by a person 
                        engaged in research, issue to such person a 
                        certificate of confidentiality to protect the 
                        privacy of such individuals if the research is 
                        not so funded.
                    ``(B) Result of certificate.--Except as provided in 
                subparagraph (C), any person to whom a certificate is 
                issued under subparagraph (A) to protect the privacy of 
                individuals described in such subparagraph shall not 
                disclose or provide to any other person not connected 
                with the research the name of such an individual or any 
                information, document, or biospecimen that contains 
                identifiable, sensitive information about such an 
                individual and that was created or compiled for 
                purposes of the research.
                    ``(C) Exceptions.--The disclosure prohibition in 
                subparagraph (B) shall not apply to disclosure or use 
                that is--
                            ``(i) required by Federal, State, or local 
                        laws, excluding instances described in 
                        subparagraph (D);
                            ``(ii) necessary for the medical treatment 
                        of the individual to whom the information, 
                        document, or biospecimen pertains;
                            ``(iii) made with the consent of the 
                        individual to whom the information, document, 
                        or biospecimen pertains; or
                            ``(iv) made for the purposes of other 
                        scientific research that is in compliance with 
                        applicable Federal regulations governing the 
                        protection of human subjects in research.
                    ``(D) Prohibition on compelling disclosure.--Any 
                person to whom a certificate is issued under 
                subparagraph (A) to protect the privacy of an 
                individual described in such subparagraph shall not, in 
                any Federal, State, or local civil, criminal, 
                administrative, legislative, or other proceeding, 
                disclose or provide the name of such individual or any 
                such information, document, or biospecimen that 
                contains identifiable, sensitive information about the 
                individual and that was created or compiled for 
                purposes of the research.
                    ``(E) Immunity.--Identifiable, sensitive 
                information protected under subparagraph (A), and all 
                copies thereof, shall be immune from the legal process, 
                and shall not, without the consent of the individual to 
                whom the information pertains, be admissible as 
                evidence or used for any purpose in any action, suit, 
                or other judicial, legislative, or administrative 
                proceeding.
                    ``(F) Terms of protection.--Identifiable, sensitive 
                information collected by a person to whom a certificate 
                has been issued under subparagraph (A), and all copies 
                thereof, shall be subject to the protections afforded 
                by this section for perpetuity.
                    ``(G) Minimizing administrative burden.--The 
                Secretary shall take steps to minimize the burden to 
                researchers, streamline the process, and reduce the 
                time it takes to comply with the requirements of this 
                subsection.
            ``(2) Rule of construction.--Nothing in this subsection 
        shall be construed to limit the access of an individual who is 
        a subject of research to information about himself or herself 
        collected during such individual's participation in the 
        research.
            ``(3) Definitions.--For purposes of this subsection, the 
        term `identifiable, sensitive information' means information 
        that is about an individual and that is gathered or used during 
        the course of research described in paragraph (1)(A) and--
                    ``(A) through which an individual is identified; or
                    ``(B) for which there is a risk, as determined by 
                current scientific practices or statistical methods, 
                that some combination of the information, the request, 
                and other available data sources could be used to 
                deduce the identity of an individual.''.
    (b) Applicability.--Beginning on the date of enactment of this Act, 
all persons engaged in research and authorized by the Secretary of 
Health and Human Services to protect information under section 301(d) 
of the Public Health Service Act (42 U.S.C. 241(d)) prior to the date 
of enactment of this Act shall be subject to the requirements of such 
section (as amended by this Act).

SEC. 3. PROTECTION OF IDENTIFIABLE, SENSITIVE INFORMATION.

    Section 301 of the Public Health Service Act (42 U.S.C. 241) is 
amended by adding at the end the following:
    ``(f)(1) The Secretary may exempt from disclosure under section 
552(b)(3) of title 5, United States Code, biomedical information that 
is about an individual and that is gathered or used during the course 
of biomedical research if--
            ``(A) an individual is identified; or
            ``(B) there is a risk, as determined by current scientific 
        practices or statistical methods, that some combination of the 
        information, the request, and other available data sources 
        could be used to deduce the identity of an individual.
    ``(2)(A) Each determination of the Secretary under paragraph (1) to 
exempt information from disclosure shall be made in writing and 
accompanied by a statement of the basis for the determination.
    ``(B) Each such determination and statement of basis shall be 
available to the public, upon request, through the Office of the Chief 
FOIA Officer of the Department of Health and Human Services.
    ``(3) Nothing in this subsection shall be construed to limit a 
research participant's access to information about such participant 
collected during the participant's participation in the research.''.
Genetic Research Privacy Protection Act This bill amends the Public Health Service Act to revise provisions regarding disclosure by researchers of the identifiable, sensitive information of research subjects. The Department of Health and Human Services (HHS) must prohibit researchers from disclosing such information from federally funded research to persons not connected to the research. Researchers may apply to have other research covered by this prohibition. Disclosures of such information are permitted if required by law, necessary for the medical treatment of the research subject, made with the consent of the subject, or made for the purposes of other research that is in compliance with regulations regarding protection of subjects. HHS may exempt identifiable information collected for biomedical research from disclosure under the Freedom of Information Act.
Genetic Research Privacy Protection Act