I 

108TH CONGRESS 

1ST SESSION H. R. 1709

To restore standards to protect the privacy of individually identifiable health 

information that were weakened by the August 2002 modifications, and 

for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 10, 2003

Mr. MARKEY (for himself, Mr. ROHRABACHER, Mr. WAXMAN, and Mr. DINGELL) introduced the following bill; which was referred to the Committee 

on Energy and Commerce, and in addition to the Committees on Ways 

and Means, and Education and the Workforce, for a period to be subsequently determined by the Speaker, in each case for consideration of such 

provisions as fall within the jurisdiction of the committee concerned 

A BILL

To restore standards to protect the privacy of individually 

identifiable health information that were weakened by 

the August 2002 modifications, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Stop Taking Our 

5 Health Privacy (STOHP) Act of 2003’’. 

6 SEC. 2. FINDINGS. 

7 The Congress finds as follows: 
2

•HR 1709 IH 

1 (1) People in the United States are deeply con2 cerned about the confidentiality of their health infor3 mation. According to a survey conducted by the 

4 Princeton Survey Research Associates, 1 in 6 people 

5 in the United States has done something out of the 

6 ordinary to keep personal health information con7 fidential, including withholding information, pro8 viding inaccurate information, or, in some cases, 

9 avoiding care entirely. 

10 (2) Pursuant to the Health Insurance Port11 ability and Accountability Act of 1996, commonly re12 ferred to as ‘‘HIPAA’’ (Public Law 104–191; 110 

13 Stat. 1936 et seq.), the Department of Health and 

14 Human Services issued comprehensive medical pri15 vacy regulations, which were promulgated in final 

16 form in December 2000. 

17 (3) These regulations established a sound foun18 dation of privacy protections by prohibiting the use 

19 or disclosure of an individual’s health information 

20 unless specifically authorized by the regulations or 

21 by the individual. The regulations also required 

22 health care providers such as physicians and health 

23 clinics, health plans, and health care clearinghouses, 

24 which are responsible for handling transactions such 

25 as billing between health plans and providers, to no-
3

•HR 1709 IH 

1 tify individuals about privacy practices regarding 

2 disclosure of health information. The regulations 

3 also provided individuals with the right to access and 

4 copy their own health records, and the right to re5 quest corrections of their health records, among 

6 other provisions. 

7 (4) The regulations took effect on April 14, 

8 2000, and required health care providers, health 

9 plans (other than small health plans), and health 

10 care clearinghouses to comply not later than April 

11 14, 2003. 

12 (5) On August 14, 2002, the Department of 

13 Health and Human Services issued modifications to 

14 the December 2000 medical privacy rule that signifi15 cantly weakened privacy protections. 

16 (6) These modifications eliminated the require17 ment that health care providers, health plans, and 

18 health care clearinghouses obtain patient consent be19 fore using or disclosing patient health information 

20 for treatment, payment, or health care operations. 

21 This change means that patients’ medical informa22 tion can be used or disclosed without their permis23 sion for a wide range of purposes, including business 

24 activities that have nothing to do with patient care, 

25 such as the sale or merger of a health maintenance 
4

•HR 1709 IH 

1 organization (HMO). This change also permits the 

2 use and disclosure of information in existing medical 

3 records even though patients disclosed the informa4 tion with the understanding and expectation that it 

5 would not be used or disclosed without their consent. 

6 The elimination of consent compromises the con7 fidentiality that is the heart of physician-patient re8 lationships and is indispensable for the delivery of 

9 high-quality health care. 

10 (7) The August 2002 modifications also under11 mined medical privacy protections by expanding the 

12 circumstances under which patients’ information can 

13 be shared without their knowledge or consent to in14 clude activities that consumers typically consider 

15 marketing. This change permits pharmacies and 

16 other providers to use consumers’ medical informa17 tion without their permission to mail them unsolic18 ited drug product recommendations. Furthermore, 

19 providers are not required to disclose fees paid to 

20 them by drug companies for sending such commu21 nications nor provide consumers with the choice to 

22 opt out of such future communications. 

23 (8) The August 2002 modifications further un24 dermined medical privacy protections by changing 

25 the section of the rule governing public health. The 
5

•HR 1709 IH 

1 change allows providers to disclose medical informa2 tion without patient permission to entities regulated 

3 by the Food and Drug Administration, such as phar4 maceutical companies and medical device manufac5 turers, for a broad range of purposes including mar6 keting campaigns. In contrast, the December 2000 

7 rule allowed nonconsensual disclosure of patient 

8 health information for a limited list of public health9 related activities, such as reporting serious side ef10 fects from a prescription drug to the Food and Drug 

11 Administration. 

12 (9) Reversal of the August 2002 modifications 

13 to the medical privacy rule is integral to any effort 

14 to ensure privacy protections for consumers’ per15 sonal health information and preserve access to 

16 high-quality health care in the United States. 

17 (10) Congress should restore core medical pri18 vacy protections of the December 2000 medical pri19 vacy rule by—

20 (A) reinstating the patient consent require21 ment for treatment, payment, and health care 

22 operations, while ensuring that the requirement 

23 does not impede important health care activities 

24 such as filling pharmaceutical prescriptions and 

25 making physician referrals; 
6

•HR 1709 IH 

1 (B) returning to the December 2000 defi2 nition of ‘‘marketing’’ and thus ensuring that 

3 activities typically considered ‘‘marketing,’’ such 

4 as drug companies paying pharmacies to send 

5 product recommendations to patients, fall under 

6 the rule’s privacy protections governing mar7 keting activities; and 

8 (C) eliminating the broad ‘‘public health’’ 

9 loophole created by the August 2002 rule. 

10 SEC. 3. PURPOSE. 

11 The purpose of this Act is to restore patient privacy 

12 protections essential for high-quality health care that were 

13 undermined by the August 2002 modifications of the De14 cember 2000 medical privacy rule. 

15 SEC. 4. RESTORATION OF PRIVACY PROTECTIONS. 

16 (a) CONSENT FOR USES OR DISCLOSURES TO CARRY

17 OUT TREATMENT, PAYMENT, OR HEALTH CARE OPER18 ATIONS.—

19 (1) IN GENERAL.—The modifications made to 

20 section 164.506 of title 45, Code of Federal Regula21 tions, by the August 2002 medical privacy rule shall 

22 have no force or effect. 

23 (2) CLARIFICATION REGARDING INSTANCES

24 WHEN CONSENT IS NOT REQUIRED.— In addition to 

25 the circumstances described in the December 2000 
7

•HR 1709 IH 

1 medical privacy rule, and notwithstanding any provi2 sion to the contrary, such section 164.506 shall be 

3 construed and applied so as to permit a health care 

4 provider to use or disclose an individual’s protected 

5 health information without obtaining the prior con6 sent of the individual in the following circumstances: 

7 (A) A health care provider may use or dis8 close an individual’s protected health informa9 tion to fill or dispense a prescription, search for 

10 drug interactions related to that prescription, 

11 and determine eligibility and obtain authoriza12 tion for payment regarding that prescription, if 

13 the health care provider obtains written consent 

14 from the individual as soon as practicable. 

15 (B) A health care provider may use or dis16 close an individual’s protected health informa17 tion to carry out treatment of that individual 

18 if—

19 (i) the individual and the health care 

20 provider have not had in-person commu21 nication regarding such treatment; 

22 (ii) obtaining consent would be im23 practicable; 

24 (iii) the health care provider deter25 mines, in the exercise of professional judg-
8

•HR 1709 IH 

1 ment, that the individual’s consent is clear2 ly inferred from the circumstances, such as 

3 an order or referral from another health 

4 care provider; and 

5 (iv) the health care provider obtains 

6 written consent from the individual as soon 

7 as practicable. 

8 (b) MARKETING.—

9 (1) IN GENERAL.—The modifications made by 

10 the August 2002 medical privacy rule to the defini11 tion of the term ‘‘marketing’’ in section 164.501 of 

12 title 45, Code of Federal Regulations, shall have no 

13 force or effect. 

14 (2) TREATMENT OF CERTAIN COMMUNICA15 TIONS.—The exception for oral communications in 

16 paragraph (2)(i) of the definition of the term ‘‘mar17 keting’’ in section 164.501 of title 45, Code of Fed18 eral Regulations, as contained in the December 2000 

19 medical privacy rule, shall have no force or effect. 

20 (3) AUTHORIZATIONS FOR MARKETING.—Sec21 tion 164.508 of title 45, Code of Federal Regula22 tions, shall be construed and applied so as to require 

23 that, if an authorization is required for a use or dis24 closure for marketing, the authorization shall be 

25 considered invalid unless it—
9

•HR 1709 IH 

1 (A) uses the term ‘‘marketing’’; 

2 (B) states that the purpose of the use or 

3 disclosure involved is marketing; 

4 (C) describes the specific marketing uses 

5 and disclosures authorized, including whether 

6 the protected health information involved—

7 (i) may be used for purposes internal 

8 to the covered entity; 

9 (ii) may be disclosed to, and used by, 

10 a business associate of the covered entity; 

11 and 

12 (iii) may be disclosed to, and used by, 

13 any person or entity other than a business 

14 associate of the covered entity; and 

15 (D) states that the use or disclosure of 

16 protected health information for marketing will 

17 directly result in remuneration to the covered 

18 entity from a third party, in any case in which 

19 a covered entity expects, or reasonably should 

20 expect, that such remuneration will occur. 

21 (c) PUBLIC HEALTH.—The modifications made to 

22 section 164.512(b)(1)(iii) of title 45, Code of Federal Reg23 ulations, by the August 2002 medical privacy rule shall 

24 have no force or effect. 
10

•HR 1709 IH 

1 SEC. 5. DEFINITIONS; EFFECTIVE DATE. 

2 (a) IN GENERAL.—For purposes of this Act: 

3 (1) DECEMBER 2000 MEDICAL PRIVACY RULE.—

4 The term ‘‘December 2000 medical privacy rule’’ 

5 means the final rule on standards for privacy of in6 dividually identifiable health information published 

7 on December 28, 2000, in the Federal Register (65 

8 Fed. Reg. 82462), including the provisions of title 

9 45, Code of Federal Regulations, revised or added 

10 by such rule. 

11 (2) AUGUST 2002 MEDICAL PRIVACY RULE.—

12 The term ‘‘August 2002 medical privacy rule’’ 

13 means the final rule, published on August 14, 2002, 

14 in the Federal Register (67 Fed. Reg. 53182), that 

15 modified the December 2000 medical privacy rule. 

16 (b) OTHER TERMS DEFINED.—For purposes of this 

17 Act: 

18 (1) BUSINESS ASSOCIATE; COVERED ENTITY; 

19 HEALTH CARE PROVIDER.—The terms ‘‘business as20 sociate’’, ‘‘covered entity’’, and ‘‘health care pro21 vider’’ shall have the meaning given such terms in 

22 section 160.103 of title 45, Code of Federal Regula23 tions, as contained in the December 2000 medical 

24 privacy rule. 

25 (2) DISCLOSURE; INDIVIDUAL, PROTECTED

26 HEALTH INFORMATION; TREATMENT; USE.—The 
11

•HR 1709 IH 

1 terms ‘‘disclosure’’, ‘‘individual’’, ‘‘protected health 

2 information’’, ‘‘treatment’’, and ‘‘use’’ shall have the 

3 meaning given such terms in section 164.501 of title 

4 45, Code of Federal Regulations, as contained in the 

5 December 2000 medical privacy rule. 

6 (c) EFFECTIVE DATE; NO REGULATIONS RE7 QUIRED.—This Act shall take effect on the date of the 

8 enactment of this Act and does not require the issuance 

9 of regulations.

Æ