To restore standards to protect the privacy of individually identifiable health information that were weakened by the August 2002 modifications, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Stop Taking Our Health Privacy 
(STOHP) Act of 2002''.

SEC. 2. FINDINGS.

     The Congress finds as follows:
            (1) People in the United States are deeply concerned about 
        the confidentiality of their health information. According to a 
        recent survey conducted by the Princeton Survey Research 
        Associates, 1 in 6 people in the United States has done 
        something out of the ordinary to keep personal health 
        information confidential, including withholding information, 
        providing inaccurate information, or, in some cases, avoiding 
        care entirely.
            (2) Pursuant to the Health Insurance Portability and 
        Accountability Act of 1996 (Public Law 104-191; 110 Stat. 1936 
        et seq.) (commonly referred to as ``HIPAA''), the Clinton 
        Administration issued comprehensive medical privacy regulations 
        which were promulgated in final form in December 2000.
            (3) Such regulations established a sound foundation of 
        privacy protections by prohibiting the use or disclosure of an 
        individual's health information unless specifically authorized 
        by the regulations or by the individual. The regulations also 
        provided individuals with the right to be notified of the 
        privacy practices of health plans, health care providers, and 
        health care clearinghouses regarding disclosure of their health 
        information, the right to access and copy their own health 
        records, and the right to request corrections of their health 
        records, among other provisions.
            (4) Such regulations took effect in April 2001 and require 
        health care providers, health plans (other than small health 
        plans) and health care clearinghouses to comply not later than 
        April 2003.
            (5) In August 2002, the Bush Administration issued a final 
        rule that significantly weakened medical privacy protections in 
        the December 2000 medical privacy rule.
            (6) The Bush Administration undermined medical privacy 
        protections by eliminating the rule's requirement that covered 
        entities obtain patient consent before using and disclosing 
        patient health information for treatment, payment, and health 
        care operations. This change means that patients' medical 
        records can be used and disclosed without their permission for 
        a wide range of purposes including business activities that 
        have nothing to do with the treatment of a patient, such as the 
        sale or merger of a health maintenance organization. This 
        change also allows the use and disclosure of information in 
        existing medical records even though patients disclosed the 
        information with the understanding and expectation that it 
        would not be further used or disclosed without their consent. 
        The elimination of consent compromises the confidentiality at 
        the heart of physician-patient relationships, which is 
        indispensable for the delivery of high-quality, thorough care.
            (7) The Bush Administration also undermined medical privacy 
        protections by expanding the circumstances under which 
        patients' information can be shared without their knowledge or 
        consent to include activities that consumers typically consider 
        marketing. This change was accomplished by narrowing the scope 
        of activities that are regulated by the provisions of the rule 
        governing marketing. Under this change, pharmacies and other 
        providers can use a consumer's medical information without 
        consent to mail the consumer unsolicited drug product 
        recommendations, without having to disclose fees paid by drug 
        companies for sending such communications or provide the 
        consumer an opportunity to decline to receive such 
        communications in the future.
            (8) The Bush Administration further undermined medical 
        privacy protections by changing the language in the section of 
        the rule governing public health to allow the disclosure of 
        medical information without patient permission to entities 
regulated by the Food and Drug Administration, such as pharmaceutical 
companies and medical device manufacturers, for an expanded and broad 
range of purposes which may include marketing campaigns. In contrast, 
the December 2000 rule allowed nonconsensual disclosure of patient 
health information for an exclusive list of public health related 
activities, such as for the purpose of reporting serious side effects 
from a prescription drug to the Food and Drug Administration.
            (9) Reversal of the Bush Administration's changes to the 
        December 2000 medical privacy rule is integral to any effort to 
        ensure medical privacy protection for consumers and preserve 
        access to high-quality health care in the United States.
            (10) Core medical privacy protections of the December 2000 
        medical privacy rule should be restored by--
                    (A) reinstating the patient consent requirement for 
                treatment, payment, and health care operations, while 
                ensuring that the requirement does not impede important 
                health care activities such as filling pharmaceutical 
                prescriptions and making referrals;
                    (B) returning to the December 2000 definition of 
                ``marketing'' and thus ensuring that activities 
                typically considered marketing, such as drug companies 
                paying pharmacies to send product recommendations to 
                patients, fall under the rule's privacy protections 
                relating to the use of patient health information for 
                marketing activities; and
                    (C) eliminating the broad ``public health'' 
                exemption created by the August 2002 rule.

SEC. 3. PURPOSE.

     The purpose of this Act is to restore patient privacy protections 
essential for high-quality health care that were undermined by the Bush 
Administration's August 2002 modifications of the December 2000 medical 
privacy rule.

SEC. 4. RESTORATION OF PRIVACY PROTECTIONS.

    (a) Consent for Uses or Disclosures To Carry Out Treatment, 
Payment, or Health Care Operations.--
            (1) In general.--The modifications made to section 164.506 
        of title 45, Code of Federal Regulations, by the August 2002 
        medical privacy rule shall have no force or effect.
            (2) Clarification regarding instances when consent is not 
        required.--In addition to the circumstances described in the 
        December 2000 medical privacy rule, and notwithstanding any 
        provision to the contrary, such section 164.506 shall be 
        construed and applied so as to permit a health care provider to 
        use or disclose an individual's protected health information 
        without obtaining the prior consent of the individual in the 
        following circumstances:
                    (A) A health care provider may use or disclose an 
                individual's protected health information to fill or 
                dispense a prescription, search for drug interactions 
                related to that prescription, and determine eligibility 
                and obtain authorization for payment regarding that 
                prescription, if the health care provider obtains 
                written consent from the individual as soon as 
                practicable.
                    (B) A health care provider may use or disclose an 
                individual's protected health information to carry out 
                treatment of that individual if--
                            (i) the individual and the health care 
                        provider have not had in-person communication 
                        regarding such treatment;
                            (ii) obtaining consent would be 
                        impracticable;
                            (iii) the health care provider determines, 
                        in the exercise of professional judgment, that 
                        the individual's consent is clearly inferred 
                        from the circumstances, such as an order or 
                        referral from another health care provider; and
                            (iv) the health care provider obtains 
                        written consent from the individual as soon as 
                        practicable.
    (b) Marketing.--
            (1) In general.--The modifications made by the August 2002 
        medical privacy rule to the definition of the term 
        ``marketing'' in section 164.501 of title 45, Code of Federal 
        Regulations, shall have no force or effect.
            (2) Treatment of certain communications.--The exception for 
        oral communications in paragraph (2)(i) of the definition of 
        the term ``marketing'' in section 164.501 of title 45, Code of 
        Federal Regulations, as contained in the December 2000 medical 
        privacy rule, shall have no force or effect.
            (3) Authorizations for marketing.--Section 164.508 of title 
        45, Code of Federal Regulations, shall be construed and applied 
        so as to require that, if an authorization is required for a 
        use or disclosure for marketing, the authorization shall be 
        considered invalid unless it--
                    (A) uses the term ``marketing'';
                    (B) states that the purpose of the use or 
                disclosure involved is marketing;
                    (C) describes the specific marketing uses and 
                disclosures authorized, including whether the protected 
                health information involved--
                            (i) may be used for purposes internal to 
                        the covered entity;
                            (ii) may be disclosed to, and used by, a 
                        business associate of the covered entity; and
                            (iii) may be disclosed to, and used by, any 
                        person or entity other than a business 
                        associate of the covered entity; and
                    (D) states that the use or disclosure of protected 
                health information for marketing will directly result 
                in remuneration to the covered entity from a third 
                party, in any case in which a covered entity expects, 
                or reasonably should expect, that such remuneration 
                will occur.
    (c) Public Health.--The modifications made to section 
164.512(b)(1)(iii) of title 45, Code of Federal Regulations, by the 
August 2002 medical privacy rule shall have no force or effect.

SEC. 5. DEFINITIONS; EFFECTIVE DATE.

    (a) In General.--For purposes of this Act:
            (1) December 2000 medical privacy rule.--The term 
        ``December 2000 medical privacy rule'' means the final rule on 
        standards for privacy of individually identifiable health 
        information published on December 28, 2000, in the Federal 
        Register (65 Fed. Reg. 82462), including the provisions of 
        title 45, Code of Federal Regulations, revised or added by such 
        rule.
            (2) August 2002 medical privacy rule.--The term ``August 
        2002 medical privacy rule'' means the final rule, published on 
        August 14, 2002, in the Federal Register (67 Fed. Reg. 53182), 
        that modified the December 2000 medical privacy rule.
    (b) Other Terms Defined.--For purposes of this Act:
            (1) Business associate; covered entity; health care 
        provider.--The terms ``business associate'', ``covered 
        entity'', and ``health care provider'' shall have the meaning 
        given such terms in section 160.103 of title 45, Code of 
        Federal Regulations, as contained in the December 2000 medical 
        privacy rule.
            (2) Disclosure; individual, protected health information; 
        treatment; use.--The terms ``disclosure'', ``individual'', 
        ``protected health information'', ``treatment'', and ``use'' 
        shall have the meaning given such terms in section 164.501 of 
        title 45, Code of Federal Regulations, as contained in the 
        December 2000 medical privacy rule.
    (c) Effective Date; No Regulations Required.--This Act shall take 
effect on the date of the enactment of this Act and does not require 
the issuance of regulations.

Summary: Stop Taking Our Health Privacy (STOHP) Act of 2002 - Declares that modifications made by an August 14, 2002, final rule affecting medical privacy to a Code of Federal Regulations (CFR) section concerning consent for uses or disclosures to carry out treatment, payment, or health care operations shall have no force or effect. Directs that such CFR section shall be construed and applied to permit a health care provider to use or disclose an individual's protected health information without prior consent under specified circumstances, provided that the provider obtains written consent from the individual as soon as practicable. Declares that a CFR section dealing with uses and disclosures for which an authorization is required shall be construed and applied so that an authorization shall be invalid unless it meets specified criteria, including that it describes the specific marketing uses and disclosures authorized. States that the modifications made by the August 14 final rule dealing with permitted disclosures for public health activities shall have no force or effect.