I

104TH CONGRESS

2D SESSION H. R. 3482

To protect the privacy of health information in the age of genetic and

other new technologies, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

MAY 16, 1996

Mr. MCDERMOTT (for himself, Mr. SERRANO, and Ms. PELOSI) introduced the

following bill; which was referred to the Committee on Commerce, and

in addition to the Committee on Government Reform and Oversight, for

a period to be subsequently determined by the Speaker, in each case for

consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To protect the privacy of health information in the age

of genetic and other new technologies, and for other

purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Medical Privacy in the Age of New Technologies Act of

6 1996’’.

7 (b) TABLE OF CONTENTS.—The table of contents for

8 this Act is as follows:
2

•HR 3482 IH

Sec. 1. Short title; table of contents.

Sec. 2. Findings and purposes.

Sec. 3. Definitions.

TITLE I—INDIVIDUALS’ RIGHTS

Subtitle A—Review of Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Correction or amendment of protected health information.

Sec. 103. Notice of information practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

Sec. 113. Prohibition against retaliation.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Sec. 201. General rules regarding use and disclosure.

Sec. 202. Authorizations for disclosure of protected health information for

treatment or payment.

Sec. 203. Authorizations for disclosure of protected health information for purposes other than treatment or payment.

Sec. 204. Creation of nonidentifiable and coded information.

Sec. 205. Next of kin and directory information.

Sec. 206. Emergency circumstances.

Sec. 207. Oversight.

Sec. 208. Accreditation.

Sec. 209. Public health.

Sec. 210. Health research.

Sec. 211. Judicial and administrative purposes.

Sec. 212. General requirements governing subpoenas.

Sec. 213. Additional requirements for law enforcement access.

TITLE III—SANCTIONS

Subtitle A—Civil Sanctions

Sec. 301. Civil penalty.

Sec. 302. Civil action.

Subtitle B—Criminal Sanctions

Sec. 311. Wrongful disclosure of protected health information.

TITLE IV—MISCELLANEOUS

Sec. 401. Regulations.

Sec. 402. Relationship to other laws.

Sec. 403. Effective dates.

Sec. 404. Applicability.

1 SEC. 2. FINDINGS AND PURPOSES.

2 (a) FINDINGS.—The Congress finds as follows:
3

•HR 3482 IH

1 (1) Health information plays a vital role in

2 every aspect of an individual’s life. It includes some

3 of the most sensitive information available about an

4 individual.

5 (2) An individual’s health information is cur6 rently accessible to many people who do not need the

7 information to provide health care to the individual,

8 often without the individual’s knowledge or consent.

9 (3) Individuals will be deterred from using the

10 health care system unless they are assured that the

11 confidentiality of their health information will be re12 spected.

13 (4) There exists little Federal protection of the

14 confidentiality of an individual’s health information.

15 (5) While health information often is trans16 ferred across State lines, protection of the confiden17 tiality of health information varies greatly from

18 State to State, with little protection in some States.

19 (6) New technologies increase the importance of

20 addressing new threats to the confidentiality of

21 health information. For example, technologies that

22 permit an individual’s health information to be com23 puterized increase the possibility of unauthorized

24 electronic access to the information. Technologies

25 that provide genetic information provide information
4

•HR 3482 IH

1 not just about an individual’s current health but also

2 about the individual’s potential future health and the

3 health of the individual’s relatives. This creates po4 tential new uses and abuses of genetic health infor5 mation that need to be addressed by legislation.

6 (7) The potential benefits from new genetic

7 technologies will not be realized if individuals cannot

8 trust that their health information is safe from un9 authorized uses.

10 (b) PURPOSES.—The purposes of this Act are as fol11 lows:

12 (1) To recognize that there is a right to privacy

13 with respect to health information, including genetic

14 information, and that this right must be protected

15 accordingly.

16 (2) To ensure that an individual’s interest in

17 the privacy of their health information cannot be

18 overridden without meaningful notice and informed

19 consent, except in limited circumstances where there

20 is a compelling public interest.

21 (3) To provide individuals—

22 (A) access to health information of which

23 they are the subject; and
5

•HR 3482 IH

1 (B) the power to challenge the accuracy

2 and completeness of, and amend or correct,

3 records containing such information.

4 (4) To establish a minimum Federal standard

5 for the protection of health information which will

6 promote confidentiality while allowing efficient

7 transfer of health information between States.

8 (5) To help ensure the confidentiality of com9 puterized or electronically transferred health infor10 mation.

11 (6) To restrict the gathering of aggregate

12 health information for financial gain or other pur13 poses without each subject’s knowledge or consent.

14 (7) To establish strong and effective remedies

15 for violations of this Act.

16 SEC. 3. DEFINITIONS.

17 As used in this Act:

18 (1) ACCREDITING BODY.—The term ‘‘accredit19 ing body’’ means a body, committee, organization, or

20 institution that has been authorized by law, or is

21 recognized by a health care regulating authority,

22 with respect to accreditation, licensing, or

23 credentialing of health care providers or health care

24 facilities.
6

•HR 3482 IH

1 (2) CODED HEALTH INFORMATION.—The term

2 ‘‘coded health information’’ means any protected

3 health information—

4 (A) in which all identifying information

5 has been replaced by a unique identifier, and

6 where neither the remaining information nor

7 the unique identifier, on its face, identifies an

8 individual;

9 (B) which cannot easily be used or manip10 ulated in a manner that reveals the identity of

11 an individual; and

12 (C) which can only be linked or matched to

13 other information in a manner that reveals the

14 identity of an individual by a person authorized

15 to carry out such functions under section 204.

16 (3) DISCLOSE.—The term ‘‘disclose’’ when used

17 with respect to protected health information that is

18 held by a health information trustee, means to re19 lease, transfer, provide access to, or otherwise di20 vulge the information to any person other than an

21 individual who is the subject of the information.

22 Such term includes the placement of protected

23 health information into a computerized data base,

24 networked computer system, or any other electronic

25 or magnetic data system, that more than one person
7

•HR 3482 IH

1 may access by any means. Such term does not in2 clude oral communication between an individual who

3 is the subject of protected health information and a

4 health care provider delivering health care to such

5 individual.

6 (4) ELECTRONIC.—The term ‘‘electronic’’, when

7 used with reference to information, means—

8 (A) in electronic or magnetic form;

9 (B) in an optical storage form;

10 (C) computer-based;

11 (D) computer-associated; or

12 (E) in some other form that—

13 (i) is appropriate for non-paper-based

14 information processing or storage; and

15 (ii) exists on the date of the enact16 ment of this Act or is developed subse17 quent to such date.

18 (5) HEALTH CARE.—The term ‘‘health care’’

19 means—

20 (A) any sale or dispensing of a drug, de21 vice, equipment, or other item to an individual,

22 or for the use of an individual, pursuant to a

23 prescription; and
8

•HR 3482 IH

1 (B) any preventive, predictive, diagnostic,

2 therapeutic, rehabilitative, maintenance, or pal3 liative care, counseling, service, or procedure—

4 (i) with respect to the physical or

5 mental condition of an individual; or

6 (ii) affecting the structure or function

7 of the human body or any part of the

8 human body, including individual cells and

9 their components.

10 (6) HEALTH CARE PROVIDER.—The term

11 ‘‘health care provider’’ means a person who, with re12 spect to a specific item of protected health informa13 tion, receives, creates, uses, maintains, or discloses

14 the information while acting in whole or in part in

15 the capacity of—

16 (A) a person who is licensed, certified, reg17 istered, or otherwise authorized by law to pro18 vide an item or service that constitutes health

19 care, in the ordinary course of business or prac20 tice of a profession; or

21 (B) a Federal or State program that di22 rectly provides items or services that constitute

23 health care to beneficiaries.

24 (7) HEALTH INFORMATION TRUSTEE.—The

25 term ‘‘health information trustee’’ means—
9

•HR 3482 IH

1 (A) a person who is a health care provider,

2 health plan, health oversight agency, public

3 health authority, health researcher, employer,

4 insurer, school, institution of higher education,

5 or insurance support organization, insofar as

6 the person creates, receives, obtains, maintains,

7 uses, or transmits protected health information;

8 or

9 (B) any employee, agent, or contractor of

10 a person described in subparagraph (A), insofar

11 as the employee, agent, or contractor creates,

12 receives, obtains, maintains, uses, or transmits

13 protected health information.

14 (8) HEALTH OVERSIGHT AGENCY.—The term

15 ‘‘health oversight agency’’ means a person who—

16 (A) performs or oversees the performance

17 of an assessment, investigation, or prosecution

18 relating to—

19 (i) compliance with legal or fiscal

20 standards pertinent to health care fraud,

21 including fraudulent claims regarding

22 health care, health services or equipment,

23 or related activities and items; or

24 (ii) the protection of individuals from

25 harm, abuse, neglect, or exploitation; and
10

•HR 3482 IH

1 (B) is a public agency, acting on behalf of

2 a public agency, acting pursuant to a require3 ment of a public agency, or carrying out activi4 ties under a Federal or State law governing an

5 assessment, investigation, or prosecution de6 scribed in subparagraph (A).

7 (9) HEALTH PLAN.—The term ‘‘health plan’’

8 means any health insurance plan, including any hos9 pital or medical service plan, dental or other health

10 service plan or health maintenance organization

11 plan, or other program providing payment for health

12 care, whether or not funded through the purchase of

13 insurance.

14 (10) HEALTH RESEARCHER.—The term ‘‘health

15 researcher’’ means a person who conducts, using

16 protected health information, a systematic investiga17 tion, or research development, testing, or evaluation,

18 to develop or contribute to scientific or medical

19 knowledge.

20 (11) INDIVIDUAL REPRESENTATIVE.—The term

21 ‘‘individual representative’’ means any individual le22 gally empowered to make decisions concerning the

23 provision of health care to an individual (where the

24 individual lacks the legal capacity under State law to
11

•HR 3482 IH

1 make such decisions) or the administrator or execu2 tor of the estate of a deceased individual.

3 (12) INSURANCE SUPPORT ORGANIZATION.—

4 (A) IN GENERAL.—Subject to subpara5 graph (B), the term ‘‘insurance support organi6 zation’’ means any person who regularly en7 gages, in whole or in part, in the practice of as8 sembling and providing information about indi9 viduals to an insurer or health plan for insur10 ance transactions, including—

11 (i) the furnishing of consumer reports

12 or investigative consumer reports to an in13 surer or health plan for use in connection

14 with an insurance transaction; or

15 (ii) the collection of personal informa16 tion from insurers, health plans, or other

17 insurance support organizations for the

18 purpose of detecting or preventing fraud or

19 material misrepresentation in connection

20 with insurance underwriting or insurance

21 claim activity.

22 (B) PERSONS EXCLUDED.—Such term

23 does not include any person who is treated as

24 a health information trustee under any other

25 provision of this Act.
12

•HR 3482 IH

1 (13) LAW ENFORCEMENT INQUIRY.—The term

2 ‘‘law enforcement inquiry’’ means an official law en3 forcement investigation or proceeding inquiring into

4 a violation of, or failure to comply with, any law.

5 (14) NONIDENTIFIABLE HEALTH INFORMA6 TION.—The term ‘‘nonidentifiable health informa7 tion’’ means information that would be protected

8 health information, except that—

9 (A) it is impossible to ascertain, based on

10 the information, or on any codes or identifiers

11 related to the information, the identity of any

12 individual whose health or condition is the sub13 ject of the information; and

14 (B) it cannot be linked or matched by a

15 foreseeable method to any other information

16 that pertains to any such individual.

17 (15) PERSON.—The term ‘‘person’’ means any

18 of the following:

19 (A) An individual.

20 (B) A government.

21 (C) A governmental subdivision, agency or

22 authority.

23 (D) A corporation.

24 (E) A company.

25 (F) An association.
13

•HR 3482 IH

1 (G) A firm.

2 (H) A partnership.

3 (I) A society.

4 (J) An estate.

5 (K) A trust.

6 (L) A joint venture.

7 (M) An individual representative.

8 (N) Any other legal entity.

9 (16) PROTECTED HEALTH INFORMATION.—The

10 term ‘‘protected health information’’ means any in11 formation, including information derived from a bio12 logical sample from the human body and demo13 graphic information about an individual, whether

14 oral or recorded in any form or medium, that—

15 (A) is created or received by a health infor16 mation trustee or an accrediting body;

17 (B) relates to—

18 (i) the past, present, or future phys19 ical or mental health, predisposition, or

20 condition of an individual, or individuals

21 related by blood to the individual;

22 (ii) the provision of health care to an

23 individual; or
14

•HR 3482 IH

1 (iii) the past, present, or future pay2 ment for the provision of health care to an

3 individual; and

4 (C)(i) identifies such individual;

5 (ii) with respect to which there is a reason6 able basis to believe that the information can be

7 used to identify such individual; or

8 (iii) could be linked or matched by a fore9 seeable method to any other information which

10 pertains to such individual.

11 (17) PROTECTED HEALTH INFORMATION

12 SUBFILE.—The term ‘‘protected health information

13 subfile’’ means any amount of protected health in14 formation which is segregated pursuant to section

15 201(c).

16 (18) PUBLIC HEALTH AUTHORITY.—The term

17 ‘‘public health authority’’ means an authority or in18 strumentality of the United States, a State, or a po19 litical subdivision of a State that—

20 (A) is charged by statute with responsibil21 ity for public health matters; and

22 (B) is engaged in such activities as injury

23 reporting, public health surveillance, and public

24 health investigation or intervention.
15

•HR 3482 IH

1 (19) SECRETARY.—The term ‘‘Secretary’’

2 means the Secretary of Health and Human Services.

3 (20) STATE.—The term ‘‘State’’ includes the

4 District of Columbia, Puerto Rico, the Virgin Is5 lands, Guam, American Samoa, and the Northern

6 Mariana Islands.

7 (21) WRITING.—The term ‘‘writing’’ means

8 writing in either a paper-based or electronic form.

9 TITLE I—INDIVIDUALS’ RIGHTS

10 Subtitle A—Review of Protected

11 Health Information by Subjects

12 of the Information

13 SEC. 101. INSPECTION AND COPYING OF PROTECTED

14 HEALTH INFORMATION.

15 (a) IN GENERAL.—Except as provided in subsections

16 (b) and (h), a health information trustee shall permit an

17 individual who is the subject of protected health informa18 tion, or the individual’s designee, to inspect and copy pro19 tected health information concerning the individual, in20 cluding records created under section 102, that the trustee

21 maintains. A health information trustee may require an

22 individual to reimburse the trustee for the reasonable cost

23 of such inspection and copying.

24 (b) EXCEPTION.—
16

•HR 3482 IH

1 (1) IN GENERAL.—A health care provider who

2 is delivering, or has delivered, health care to an indi3 vidual who is the subject of protected health infor4 mation relating to such health care is not required

5 by this section to permit inspection or copying of the

6 information, where such inspection or copying rea7 sonably could be expected to endanger the life or

8 physical or mental safety of any individual.

9 (2) ALTERNATIVE DISCLOSURE.—In any case

10 where a health care provider determines that the

11 provider, pursuant to paragraph (1), will not permit

12 an individual to inspect or copy protected health in13 formation, the provider may permit inspection or

14 copying by the individual’s designee.

15 (c) DENIAL OF A REQUEST FOR INSPECTION OR

16 COPYING.—If a health information trustee denies a re17 quest for inspection or copying under subsection (b), the

18 trustee shall inform the individual in writing of—

19 (1) the reasons for the denial of the request;

20 (2) any procedures for further review of the de21 nial; and

22 (3) the individual’s right to file with the trust23 ee, if the individual so wishes, a concise statement

24 setting forth the request for inspection or copying.
17

•HR 3482 IH

1 (d) STATEMENT REGARDING REQUEST.—If an indi2 vidual has filed a statement under subsection (c)(3) set3 ting forth the request, the health information trustee in

4 any subsequent disclosure of the portion of the informa5 tion requested shall include—

6 (1) a copy of the individual’s statement; and

7 (2) a concise statement of the reasons for deny8 ing the request for inspection or copying.

9 (e) RULE OF CONSTRUCTION.—This section shall not

10 be construed to require a health information trustee to

11 conduct a formal, informal, or other hearing or proceeding

12 concerning a request for inspection or copying of protected

13 health information.

14 (f) INSPECTION AND COPYING OF SEGREGABLE POR15 TION.—A health information trustee shall permit inspec16 tion and copying under subsection (a) of any reasonably

17 segregable portion of a record after deletion of any portion

18 that is exempt under subsection (b).

19 (g) DEADLINE.—A health information trustee shall

20 comply with or deny, in accordance with subsection (c),

21 a request for inspection or copying of protected health in22 formation under this section within the 30-day period be23 ginning on the date on which the trustee receives the re24 quest.
18

•HR 3482 IH

1 (h) RULES GOVERNING AGENTS AND CONTRAC2 TORS.—

3 (1) IN GENERAL.—A person acting in the ca4 pacity of an agent or contractor of a health care

5 provider, health plan, health oversight agency, public

6 health authority, health researcher, employer, in7 surer, school, institution of higher education, or in8 surance support organization is not responsible for

9 providing for the inspection or copying of protected

10 health information under this section, except when

11 the agent or contractor has been notified by their

12 principal that a request for inspection or copying

13 has been made to the principal under section (a) and

14 has not been denied under section (b).

15 (2) CODED HEALTH INFORMATION.—In any

16 case where a person acting in the capacity of an

17 agent or contractor of a health care provider, health

18 plan, health oversight agency, public health author19 ity, health researcher, employer, insurer, school, in20 stitution of higher education, or insurance support

21 organization is requested to provide for the inspec22 tion or copying of coded health information under

23 this section, the person shall inform the individual

24 making the request that the individual should con25 tact a person authorized under section 204 to link
19

•HR 3482 IH

1 or match the coded health information to reveal the

2 identity of the individual who is the subject of the

3 information.

4 SEC. 102. CORRECTION OR AMENDMENT OF PROTECTED

5 HEALTH INFORMATION.

6 (a) IN GENERAL.—Unless proceeding under sub7 section (b), and except as provided in subsection (f), a

8 health information trustee, within the 45-day period be9 ginning on the date on which the trustee receives from

10 an individual a written request to correct or amend pro11 tected health information about the individual—

12 (1) shall make the correction or amendment re13 quested;

14 (2) shall inform the individual of the correction

15 or amendment that has been made; and

16 (3) shall make reasonable efforts to inform any

17 person who is identified by the individual, and to

18 whom the uncorrected or unamended portion of the

19 information was previously disclosed, of the correc20 tion or amendment that has been made.

21 (b) REFUSAL TO CORRECT OR AMEND.—If the

22 health information trustee refuses to make the correction

23 or amendment, the trustee shall inform the individual,

24 within the 45-day period beginning on the date on which

25 the trustee receives the individual’s request, of—
20

•HR 3482 IH

1 (1) the reasons for the refusal to make the cor2 rection or amendment;

3 (2) any procedures for further review of the re4 fusal; and

5 (3) the individual’s right to file with the trust6 ee, if the individual so wishes, a concise statement

7 setting forth the requested correction or amendment

8 and the individual’s reasons for disagreeing with the

9 refusal.

10 (c) STATEMENT OF DISAGREEMENT.—If an individ11 ual has filed a statement of disagreement under subsection

12 (b)(3), the health information trustee in any subsequent

13 disclosure of the disputed portion of the information—

14 (1) shall include a copy of the individual’s

15 statement; and

16 (2) shall include a concise statement of the rea17 sons for not making the requested correction or

18 amendment.

19 (d) RULE OF CONSTRUCTION.—This section shall not

20 be construed to require a health information trustee to

21 conduct a formal, informal, or other hearing or proceeding

22 concerning a request for a correction or amendment to

23 protected health information.

24 (e) CORRECTION.—For purposes of subsection (a), a

25 correction is deemed to have been made to protected
21

•HR 3482 IH

1 health information when information that has been dis2 puted by an individual has been corrected, clearly marked

3 as incorrect, or supplemented by correct information.

4 (f) RULES GOVERNING AGENTS AND CONTRAC5 TORS.—A person acting in the capacity of an agent or con6 tractor of a health care provider, health plan, health over7 sight agency, public health authority, health researcher,

8 employer, insurer, school, institution of higher education,

9 or insurance support organization is not authorized to

10 make corrections or amendments to protected health infor11 mation received from their principal, except when the

12 agent or contractor has been asked by the principal to ful13 fill the principal’s obligations under this section.

14 SEC. 103. NOTICE OF INFORMATION PRACTICES.

15 (a) PREPARATION OF WRITTEN NOTICE.—A health

16 information trustee shall prepare and provide, in accord17 ance with subsection (b), a written notice containing the

18 following:

19 (1) INDIVIDUALS’ RIGHTS.—A description of

20 the following rights of an individual who is a subject

21 of protected health information maintained by the

22 trustee:

23 (A) The right of the individual to request

24 segregation of protected health information, and

25 to restrict the use of such information by em-
22

•HR 3482 IH

1 ployees, agents, and contractors of the trustee,

2 under section 201(c).

3 (B) The right of the individual to inspect,

4 copy, amend, and correct the protected health

5 information under sections 101 and 102.

6 (C) The right of the individual to object to

7 the disclosure of the information to next of kin

8 or in directory information under section 205.

9 (D) The circumstances under which the in10 formation may be used or disclosed without an

11 authorization executed by the individual.

12 (E) The right of the individual not to have

13 employment or the receipt of services condi14 tioned upon the execution by the individual of

15 an authorization for disclosure or use for any

16 purpose other than treatment or payment.

17 (F) The procedures the individual must

18 follow in order to exercise the foregoing rights.

19 (2) TRUSTEE INFORMATION PRACTICES.—A de20 scription of the trustee’s health information prac21 tices, including the safeguards and practices used to

22 protect such information.

23 (b) AVAILABILITY OF NOTICE TO SUBJECTS.—A

24 health information trustee shall provide a copy of a notice
23

•HR 3482 IH

1 prepared under this section to an individual who is a sub2 ject of protected health information—

3 (1) along with any request for authorization to

4 use or disclose the information created pursuant to

5 section 202 or 203 and presented by the trustee to

6 the individual for execution;

7 (2) at the first practicable opportunity after the

8 trustee uses or discloses the information without an

9 authorization executed by the individual;

10 (3) at the first practicable opportunity after a

11 health information trustee commences the collection

12 of the information; or

13 (4) when the individual requests to inspect,

14 copy, correct, or amend their protected health infor15 mation pursuant to section 101 or 102.

16 Subtitle B—Establishment of

17 Safeguards

18 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

19 (a) IN GENERAL.—A health information trustee shall

20 establish and maintain appropriate administrative, tech21 nical, and physical safeguards to ensure the confidential22 ity, security, accuracy, and integrity of protected health

23 information created, received, obtained, maintained, used

24 or transmitted by the trustee.

25 (b) SAFEGUARDS FOR ELECTRONIC INFORMATION.—
24

•HR 3482 IH

1 (1) APPLICATION AND CONSTRUCTION.—

2 (A) APPLICATION.—This subsection ap3 plies only with respect to protected health infor4 mation that is electronic.

5 (B) CONSTRUCTION.—Nothing in this Act

6 shall be construed to require that protected

7 health information be created, received, main8 tained, used, or disclosed in electronic form.

9 (2) REQUIREMENTS FOR ELECTRONIC MAINTE10 NANCE, USE, AND DISCLOSURE.—The Secretary

11 shall develop, and by regulation impose on health in12 formation trustees, requirements for the electronic

13 maintenance, use, and disclosure of protected health

14 information. Such requirements shall include the fol15 lowing:

16 (A) CONTROL OF ACCESS TO PROTECTED

17 HEALTH INFORMATION.—

18 (i) IN GENERAL.—A health informa19 tion trustee shall implement controls with

20 respect to access to electronic protected

21 health information. The trustee may grant

22 a request by any person for access to such

23 information for use by the health informa24 tion trustee, or for disclosure to another
25

•HR 3482 IH

1 health information trustee, only after veri2 fying that—

3 (I) the person making the re4 quest can prove their identity; and

5 (II) the proposed use of the pro6 tected health information, or the re7 quested disclosure, is authorized

8 under this Act.

9 (ii) AUTHENTICATION OF IDENTITY

10 OF REQUESTERS.—A health information

11 trustee shall use a method of verification

12 to verify the identity of persons requesting

13 access to electronic protected health infor14 mation. A health information trustee who

15 issues a device that verifies the identity of

16 a person making a request for information

17 for purposes of this clause shall instruct

18 the person in the proper care and use of

19 the device and shall require the person to

20 protect the device from misuse. Any system

21 used by a health information trustee to

22 maintain verification information collected

23 under this clause shall prevent the disclo24 sure of such verification information to any

25 person other than a person who is specifi-
26

•HR 3482 IH

1 cally authorized to receive such informa2 tion.

3 (B) ACCESS FOR USE BY HEALTH INFOR4 MATION TRUSTEE.—A health information trust5 ee shall limit the persons who may use pro6 tected health information created or maintained

7 by the trustee in electronic form to persons spe8 cifically authorized by the trustee to use such

9 information consistent with this Act.

10 (C) DISCLOSURE TO OTHERS.—

11 (i) PROTECTION OF REQUESTS FOR

12 DISCLOSURE AND RESPONSES.—A health

13 information trustee who requests, using

14 electronic means, to receive protected

15 health information, or who responds, using

16 electronic means, to such a request, shall

17 implement procedures to prevent the inter18 ception of such request or response by per19 sons who are not authorized to intercept it.

20 (ii) IDENTIFICATION OF SUBJECT.—A

21 health information trustee who receives,

22 using electronic means, a request for pro23 tected health information from another

24 health information trustee may not provide

25 such information in response to the request
27

•HR 3482 IH

1 unless the request contains sufficient de2 tails to uniquely identify one individual

3 who is the subject of the request.

4 (D) AUDIT TRAIL.—

5 (i) ACCESS TO INFORMATION MAIN6 TAINED BY OTHERS.—A health informa7 tion trustee shall maintain an electronic

8 record concerning each attempt that is

9 made by the trustee, whether authorized or

10 unauthorized, successful or unsuccessful,

11 to access protected health information that

12 is maintained by any other health informa13 tion trustee in electronic form. The record

14 shall include the identity of the specific in15 dividual attempting to gain such access

16 and information sufficient to identify the

17 information sought.

18 (ii) ACCESS TO INFORMATION MAIN19 TAINED BY THE TRUSTEE.—A health in20 formation trustee shall maintain an elec21 tronic record concerning each attempt that

22 is made by the trustee, or by any other

23 person, whether authorized or unauthor24 ized, successful or unsuccessful, to access

25 protected health information maintained by
28

•HR 3482 IH

1 the trustee in electronic form. The record

2 shall include the identity of the specific in3 dividual attempting to gain such access

4 and information sufficient to identify the

5 information sought.

6 (3) REVIEW OF REQUIREMENTS.—The Sec7 retary from time to time shall review the require8 ments developed and imposed under paragraph (2),

9 to determine whether technological advances or other

10 factors make necessary changes to the requirements.

11 If the Secretary determines that such changes are

12 necessary, the Secretary shall make them.

13 SEC. 112. ACCOUNTING FOR DISCLOSURES.

14 (a) IN GENERAL.—

15 (1) PERSONS NOT ACTING AS AGENTS OR CON16 TRACTORS.—Except as provided in paragraph (2), a

17 health information trustee shall create and maintain,

18 with respect to any protected health information dis19 closure made by the trustee that is not related to

20 treatment, a record of the disclosure in accordance

21 with regulations promulgated by the Secretary.

22 (2) AGENTS AND CONTRACTORS.—A person

23 acting in the capacity of an agent or contractor of

24 a health care provider, health plan, health oversight

25 agency, public health authority, health researcher,
29

•HR 3482 IH

1 employer, insurer, school, institution of higher edu2 cation, or insurance support organization shall cre3 ate and maintain, with respect to any protected

4 health information disclosure made by the person

5 that is authorized under one of section 202, 203,

6 204, or 206 through 213, a record of the disclosure

7 in accordance with regulations promulgated by the

8 Secretary.

9 (b) RECORD OF DISCLOSURE PART OF PROTECTED

10 HEALTH INFORMATION.—A record created and main11 tained under subsection (a) shall be maintained as pro12 tected health information for not less than 7 years.

13 SEC. 113. PROHIBITION AGAINST RETALIATION.

14 A health information trustee may not adversely affect

15 another person, directly or indirectly, because such person

16 has exercised a right under this Act, disclosed information

17 relating to a possible violation of this Act, or associated

18 with, or assisted a person in the exercise of a right under

19 this Act.
30

•HR 3482 IH

1 TITLE II—RESTRICTIONS ON

2 USE AND DISCLOSURE

3 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO4 SURE.

5 (a) GENERAL RULE.—A health information trustee

6 may not use or disclose protected health information ex7 cept as authorized under this title.

8 (b) SCOPE OF USE AND DISCLOSURE.—

9 (1) COMPATIBILITY WITH PURPOSE FOR OB10 TAINING INFORMATION.—A health information

11 trustee may not use, or disclose to any person, pro12 tected health information unless the use or disclo13 sure is compatible with and directly related to—

14 (A) the purposes for which the information

15 was obtained by the health information trustee;

16 and

17 (B) in the case where an individual has ex18 ecuted an authorization, for the specific purpose

19 authorized by the individual.

20 (2) LIMITATION ON AMOUNT OF INFORMA21 TION.—

22 (A) USE AND DISCLOSURE.—

23 (i) IN GENERAL.—Every use and dis24 closure of protected health information by

25 a health information trustee shall be lim-
31

•HR 3482 IH

1 ited to the minimum amount of informa2 tion necessary to accomplish the purpose

3 for which the information is used or dis4 closed.

5 (ii) NONIDENTIFIABLE INFORMA6 TION.—A health information trustee shall

7 use and disclose nonidentifiable health in8 formation, in lieu of protected health infor9 mation, to maximum extent possible, con10 sistent with the purpose for the use or dis11 closure.

12 (iii) CODED HEALTH INFORMATION.—

13 A health information trustee shall use and

14 disclose coded health information, in lieu of

15 any other kind of protected health informa16 tion, to maximum extent possible, consist17 ent with the purpose for the use or disclo18 sure.

19 (B) COLLECTION, CREATION, AND RE20 QUESTS.—A health information trustee may not

21 collect, create, or request the disclosure of,

22 more protected health information than is nec23 essary to accomplish the purpose for which the

24 information is collected, created, or requested.
32

•HR 3482 IH

1 (c) SPECIAL RULES FOR PROTECTED HEALTH IN2 FORMATION SUBFILES.—

3 (1) SEGREGATION.—A health information trust4 ee shall, upon creating or obtaining protected health

5 information, comply with the request of a subject of

6 such information—

7 (A) to segregate any amount or type of

8 protected health information; and

9 (B) to maintain such protected health in10 formation as one or more protected health in11 formation subfiles.

12 (2) DISCLOSURE AND USE.—

13 (A) IN GENERAL.—Subject to subpara14 graph (B), a person, other than a health care

15 provider who is otherwise authorized to access

16 or use protected health information about an

17 individual contained in a protected health infor18 mation subfile for purposes of delivering health

19 care to the individual, may not use or disclose

20 any information that is in the subfile, except as

21 authorized under section 202, 203, or 206.

22 (B) EMPLOYEES, AGENTS, CONTRAC23 TORS.—A health information trustee, with re24 spect to a protected health information subfile

25 created pursuant to paragraph (1), shall limit
33

•HR 3482 IH

1 use of the subfile to those employees, contrac2 tors, or agents of the trustee, described by

3 name or job title, who, with respect to the

4 subfile are authorized, pursuant to section 202

5 or 203, to use or obtain such information.

6 (C) INFORMATION ON EXISTENCE OF

7 SUBFILES.—A health information trustee may

8 not disclose information about the existence of

9 a health information subfile to any person who

10 is not authorized to obtain, access, or use the

11 subfile.

12 (d) NO GENERAL REQUIREMENT TO DISCLOSE.—

13 Nothing in this title that permits a disclosure of protected

14 health information shall be construed to require such dis15 closure.

16 (e) LIMITATIONS ON DISCLOSURE AND USE WITHIN

17 A TRUSTEE.—

18 (1) CONDITION OF TREATMENT OR PAYMENT.—

19 A health information trustee may not condition de20 livery of health care, or payment for services, on the

21 receipt of an authorization described in section 202

22 or 203 that authorizes the disclosure of protected

23 health information to any employee, agent, or con24 tractor who does not perform a legitimate and nec-
34

•HR 3482 IH

1 essary function with respect to the purpose for

2 which the information was obtained or created.

3 (2) EMPLOYMENT.—A health information trust4 ee may not condition employment on the receipt of

5 an authorization described in section 202 or 203

6 that authorizes the disclosure of protected health in7 formation to any employee, agent, or contractor who

8 does not perform a legitimate and necessary function

9 with respect to the purpose for which the informa10 tion was obtained or created.

11 (f) IDENTIFICATION OF DISCLOSED INFORMATION AS

12 PROTECTED INFORMATION.—Except as provided in this

13 title, a health information trustee may not disclose pro14 tected health information unless such information is clear15 ly identified as protected health information that is subject

16 to this title.

17 (g) INFORMATION IDENTIFYING PROVIDERS.—The

18 Secretary shall issue regulations protecting information

19 identifying health care providers in order to promote the

20 availability of health care services.

21 (h) USE OF SOCIAL SECURITY NUMBER.—A Social

22 Security account number, or a derivative of a Social Secu23 rity account number, may not be used by a health informa24 tion trustee for any purpose relating to protected health

25 information or the use or disclosure of such information.
35

•HR 3482 IH

1 (i) MULTIPLE RECORDS.—No person may aggregate,

2 compile, link, or match protected health information held

3 by two or more different health information trustees, or

4 two or more protected health information subfiles pertain5 ing to an individual, without obtaining specific authoriza6 tion under section 202 or 203 for such use.

7 (j) NO EFFECT OF AGENCY ON DUTY OR LIABILITY

8 OF PRINCIPAL.—An agreement or relationship between a

9 trustee and an agent or contractor does not relieve a

10 health information trustee of any duty or liability under

11 this Act.

12 SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO13 TECTED HEALTH INFORMATION FOR TREAT14 MENT OR PAYMENT.

15 (a) WRITTEN AUTHORIZATIONS.—A health informa16 tion trustee may disclose protected health information for

17 purposes of treatment or payment pursuant to an author18 ization executed by an individual who is the subject of the

19 information (or a person acting for the individual pursu20 ant to State law) if each of the following requirements is

21 met:

22 (1) WRITING.—The authorization is in written

23 or electronic form, signed or electronically authenti24 cated by the individual, and dated.
36

•HR 3482 IH

1 (2) SEPARATE FORMS.—Separate forms author2 izing disclosures for treatment and separate forms

3 authorizing disclosures for payment processes are

4 provided to the individual.

5 (3) INFORMATION DESCRIBED.—The informa6 tion to be disclosed is specified, or is described, in

7 the authorization.

8 (4) TRUSTEE DESCRIBED.—The trustee who is

9 authorized to disclose such information is specifically

10 identified, or is described, in the authorization.

11 (5) RECIPIENT DESCRIBED.—The person to

12 whom the information is to be disclosed is specifi13 cally identified, or is described, in the authorization.

14 (6) RIGHT TO REVOKE OR AMEND.—The au15 thorization contains an acknowledgement that the

16 individual who is executing the authorization has the

17 right to revoke or amend the authorization, subject

18 to subsection (b).

19 (7) PURPOSE DESCRIBED.—The authorization

20 describes in detail the purpose for which the infor21 mation will be used.

22 (8) STATEMENT OF INTENDED DISCLOSURES.—

23 The authorization contains an acknowledgment that

24 the individual who is executing the authorization has

25 read a statement of any disclosures of the protected
37

•HR 3482 IH

1 health information that the recipient intends to

2 make.

3 (9) USE AND DISCLOSURE RESTRICTED.—The

4 authorization includes a statement that the informa5 tion will be used and disclosed solely for one or more

6 purposes specified in the authorization.

7 (10) EXPIRATION DATE SPECIFIED.—The au8 thorization specifies a date on which, or event upon

9 which, the authorization expires, which shall be no

10 later than one year after the date on which the au11 thorization is executed.

12 (b) REVOCATION OR AMENDMENT OF AUTHORIZA13 TION.—

14 (1) IN GENERAL.—An authorization under sub15 section (a) shall be subject to revocation and amend16 ment at any time by the individual who executed the

17 authorization, except that—

18 (A) the revocation or amendment shall be

19 in writing; and

20 (B) an authorization executed for the pur21 pose of validation of expenditures for health

22 care that the individual has authorized to be

23 rendered may not be revoked.

24 (2) NOTICE OF REVOCATION.—A health infor25 mation trustee who discloses protected health infor-
38

•HR 3482 IH

1 mation pursuant to an authorization described in

2 subsection (a) that has been revoked shall not be

3 subject to any liability or penalty under this Act if

4 the trustee has no actual or constructive notice of

5 the revocation at the time the trustee makes the dis6 closure.

7 (c) MODEL AUTHORIZATIONS.—The Secretary, after

8 providing notice and opportunity for public comment, shall

9 develop and disseminate model written authorizations of

10 the type described in subsection (a) and model statements

11 of intended disclosures of the type described in subsection

12 (a)(7).

13 (d) COPY.—A health information trustee who dis14 closes protected health information pursuant to an author15 ization under this section shall maintain a copy of the au16 thorization for not less than 7 years.

17 SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO18 TECTED HEALTH INFORMATION FOR PUR19 POSES OTHER THAN TREATMENT OR PAY20 MENT.

21 (a) WRITTEN AUTHORIZATIONS.—A health informa22 tion trustee may disclose protected health information for

23 a purpose other than treatment or payment pursuant to

24 an authorization executed by an individual who is the sub25 ject of the information (or a person acting for the individ-
39

•HR 3482 IH

1 ual pursuant to State law) if each of the following require2 ments is met:

3 (1) GENERAL REQUIREMENTS.—The require4 ments of paragraphs (1) through (7) of section

5 202(a).

6 (2) STATEMENT OF INTENDED DISCLOSURES.—

7 The statement of intended disclosure shall be in

8 writing, and shall be received by the individual au9 thorizing the disclosure on or before the date the au10 thorization is executed.

11 (3) EXPIRATION DATE SPECIFIED.—The au12 thorization specifies a date on which, or an event

13 upon which, the authorization expires, which shall

14 not occur more than 1 year from the date of the exe15 cution of the authorization.

16 (b) LIMITATION ON REQUESTS FOR AUTHORIZA17 TIONS.—

18 (1) CONDITION OF TREATMENT OR PAYMENT.—

19 A health information trustee may not condition de20 livery of treatment, or payment for services, on the

21 receipt of an authorization described in subsection

22 (a).

23 (2) EMPLOYMENT.—A health information trust24 ee may not adversely affect, or condition, the em25 ployment of any person based on the agreement or
40

•HR 3482 IH

1 refusal of the person to execute or provide an au2 thorization described in subsection (a).

3 (c) REVOCATION OR AMENDMENT OF AUTHORIZA4 TION.—

5 (1) IN GENERAL.—An individual may in writing

6 revoke or amend an authorization described in sub7 section (a).

8 (2) NOTICE OF REVOCATION.—A health infor9 mation trustee who discloses protected health infor10 mation pursuant to an authorization described in

11 subsection (a) that has been revoked shall not be

12 subject to any liability or penalty under this Act if

13 the trustee has no actual or constructive notice of

14 the revocation at the time the trustee makes the dis15 closure.

16 (d) MODEL AUTHORIZATIONS.—The Secretary, after

17 notice and opportunity for public comment, shall develop

18 and disseminate model written authorizations of the type

19 described in subsection (a) and model statements of the

20 intended disclosures of the type described in subsection

21 (a)(2).

22 SEC. 204. CREATION OF NONIDENTIFIABLE AND CODED IN23 FORMATION.

24 (a) CREATION OF NONIDENTIFIABLE INFORMA25 TION.—A health information trustee may disclose pro-
41

•HR 3482 IH

1 tected health information about an individual to an em2 ployee, agent, or contractor for the purpose of creating

3 nonidentifiable health information if—

4 (1) the individual is informed of the purpose for

5 the creation of the nonidentifiable information;

6 (2) the individual is given the option to prohibit

7 any specific uses of the nonidentifiable information,

8 such as use of the information for marketing pur9 poses; and

10 (3) the health information trustee does not con11 dition the delivery of health care, payment for serv12 ices, or employment, on the granting by the individ13 ual of permission to create the nonidentifiable infor14 mation.

15 (b) CREATION OF CODED HEALTH INFORMATION.—

16 A health care provider may create coded health informa17 tion, or disclose protected health information about an in18 dividual to an employee, agent, or contractor for the pur19 pose of creating coded health information, if—

20 (1) the individual is informed of the purpose for

21 the creation of the coded information;

22 (2) the individual is informed of which persons

23 will have the authority to link or match the coded

24 health information to reveal the identity of the indi25 vidual;
42

•HR 3482 IH

1 (3) the individual gives written authorization

2 for a disclosure for this purpose in accordance with

3 subsections (a)(1) through (a)(3), (c), and (d) of

4 section 203;

5 (4) the health care provider does not condition

6 the delivery of health care, payment for services, em7 ployment, or the terms of employment on the grant8 ing by the individual of permission to create the

9 coded health information; and

10 (5) agents and contractors who receive pro11 tected health information for the purpose of creating

12 coded health information use the information exclu13 sively for such purpose.

14 SEC. 205. NEXT OF KIN AND DIRECTORY INFORMATION.

15 (a) NEXT OF KIN.—Except as provided in subsection

16 (c), a health care provider, or a person who receives pro17 tected health information under section 206, may disclose

18 protected health information regarding an individual who

19 is an inpatient in a health care facility to the individual’s

20 next of kin, to an individual representative of the individ21 ual, or to an individual with whom the individual has a

22 significant personal relationship if—

23 (1) the individual who is the subject of the in24 formation—
43

•HR 3482 IH

1 (A) has been notified of the individual’s

2 right to object at the time of admission to the

3 facility and has not objected to the disclosure;

4 or

5 (B) is in a physical or mental condition

6 such that it would not be possible to notify the

7 individual of the right to object and there are

8 no prior indications that the individual would

9 object; and

10 (2) the information relates to health care cur11 rently being provided to the individual at the time

12 of the disclosure.

13 (b) DIRECTORY INFORMATION.—

14 (1) DISCLOSURE.—Except as provided in sub15 section (c), a health information trustee may disclose

16 to any person protected health information concern17 ing an individual if the information is described in

18 paragraph (2) and the individual who is the subject

19 of the information—

20 (A) has been notified of the individual’s

21 right to object and has not objected to the dis22 closure; or

23 (B) is in a physical or mental condition

24 such that it would not be possible to notify the

25 individual of the right to object and there are
44

•HR 3482 IH

1 no prior indications that the individual would

2 object.

3 (2) INFORMATION DESCRIBED.—The informa4 tion referred to in paragraph (1) is any one or more

5 of the following:

6 (A) The name of the individual who is the

7 subject of the information.

8 (B) The general health status of the indi9 vidual, described as critical, poor, fair, stable,

10 or satisfactory, or in terms denoting similar

11 conditions.

12 (C) The location of the individual, if on a

13 premises controlled by a health care provider.

14 (c) EXCEPTION.—A health care provider may not dis15 close protected health information without specific author16 ization pursuant to section 203—

17 (1) in the case of a disclosure under subsection

18 (b), if disclosure of the location of the individual

19 would reveal specific information about the physical

20 or mental condition of the individual; or

21 (2) in the case of a disclosure under subsection

22 (a) or (b), if the provider has reason to believe that

23 the disclosure could lead to physical, mental, or emo24 tional harm to the individual.

25 (d) DECEASED INDIVIDUAL.—
45

•HR 3482 IH

1 (1) IDENTIFICATION.—A health information

2 trustee may disclose protected health information if

3 necessary to assist in the identification of a deceased

4 individual.

5 (2) REGULATIONS.—The Secretary shall de6 velop and establish through regulation a procedure

7 for obtaining protected health information relating

8 to a deceased individual when there is no individual

9 representative for such individual.

10 SEC. 206. EMERGENCY CIRCUMSTANCES.

11 (a) DISCLOSURE WHEN SUBJECT OF INFORMATION

12 IS IN DANGER.—A health information trustee who receives

13 protected health information under this title may disclose

14 such protected health information to a health care pro15 vider or emergency medical personnel, or use such infor16 mation in emergency medical circumstances, to the extent

17 necessary to protect the health or safety of an individual

18 who is a subject of such information from serious immi19 nent harm.

20 (b) DISCLOSURE WHEN ANOTHER INDIVIDUAL IS IN

21 DANGER.—A health information trustee may disclose pro22 tected health information, to the extent necessary, where

23 such trustee determines that—
46

•HR 3482 IH

1 (1) there is an identifiable threat of serious in2 jury or death to an identifiable individual or group

3 of individuals; and

4 (2) the disclosure of the information to the per5 son is necessary to prevent or significantly reduce

6 the possibility of such threat.

7 SEC. 207. OVERSIGHT.

8 (a) IN GENERAL.—A health information trustee,

9 other than a public health authority or a health re10 searcher, may disclose protected health information to—

11 (1) a health oversight agency for any function

12 of the agency authorized by law, if—

13 (A) there is probable cause to believe fraud

14 has been committed;

15 (B) the oversight agency is investigating

16 the fraud;

17 (C) the oversight agency has obtained a

18 subpoena for purposes of obtaining the informa19 tion; and

20 (D)(i) a subject of the information is be21 lieved to have committed the fraud; or

22 (ii) the information is necessary to permit

23 the agency to investigate the fraud; or

24 (2) a health oversight agency charged by law to

25 protect individuals from harm, abuse, neglect, or ex-
47

•HR 3482 IH

1 ploitation, if the information is necessary to inves2 tigate whether abuse, neglect, or exploitation of an

3 individual has occurred.

4 (b) USE OF CODED HEALTH INFORMATION.—The

5 health oversight agency shall receive exclusively coded

6 health information under subsection (a) whenever the pur7 pose of the agency may be accomplished using only such

8 information.

9 (c) NOTICE TO SUBJECTS.—In any case where an in10 dividual who is a subject of protected health information

11 disclosed under subsection (a) is not believed to have com12 mitted fraud, the individual shall be notified, at the first

13 practical opportunity—

14 (1) that an investigation described in such sub15 section is being conducted;

16 (2) of the reason why disclosure of the informa17 tion is necessary; and

18 (3) of all intended subsequent disclosures of the

19 information that the agency intends to make.

20 (d) USE IN ACTION AGAINST INDIVIDUALS.—

21 (1) IN GENERAL.—Subject to paragraph (2),

22 protected health information about an individual

23 that is disclosed under this section may not be used

24 in, or disclosed to any person for use in, an adminis25 trative, civil, or criminal action or investigation di-
48

•HR 3482 IH

1 rected against the individual, unless the action or in2 vestigation arises out of and is directly related to the

3 purpose for which the disclosure was authorized

4 under subsection (a).

5 (2) SPECIAL RULE.—A health oversight agency

6 may not disclose protected health information re7 ceived by the agency under subsection (a)(2) for any

8 purpose other than protecting individuals from

9 harm, abuse, neglect, or exploitation.

10 (e) PUBLIC HEALTH AND HEALTH RESEARCH.—A

11 public health authority may disclose protected health in12 formation to a health oversight agency only if such infor13 mation is necessary for use in an investigation of whether

14 the authority has committed fraud. A health researcher

15 may disclose protected health information to a health over16 sight agency only if such information is necessary for use

17 in an investigation of whether the researcher has commit18 ted fraud.

19 SEC. 208. ACCREDITATION.

20 (a) IN GENERAL.—A health information trustee may

21 disclose protected health information to an accrediting

22 body for the exclusive purpose of permitting the accredit23 ing body to carry out accreditation, licensing, or

24 credentialing activities.
49

•HR 3482 IH

1 (b) USE OF CODED HEALTH INFORMATION.—The

2 accrediting body shall receive exclusively coded health in3 formation under subsection (a) whenever the purpose of

4 the body may be accomplished using only such informa5 tion.

6 (c) RESTRICTION ON USE AND DISCLOSURE.—A

7 person to whom protected health information is disclosed

8 under subsection (a) may not use or disclose the informa9 tion for any purpose other than the purpose for which the

10 information was disclosed to the person.

11 SEC. 209. PUBLIC HEALTH.

12 (a) DISCLOSURES BY PROVIDERS.—A health care

13 provider may disclose protected health information about

14 an individual to a public health authority where—

15 (1) the information is disclosed for the purpose

16 of permitting the authority to ascertain the identity

17 of such individual;

18 (2) there is a specific nexus between such indi19 vidual’s identity and a threat of death or injury to

20 any person; and

21 (3) knowledge of such individual’s identity

22 would allow the public health authority to prevent or

23 significantly reduce the possibility of injury or death

24 to any person.
50

•HR 3482 IH

1 (b) LIMITATION ON LIABILITY.—A health informa2 tion trustee shall not be liable to any person for a disclo3 sure of protected health information under this section

4 that is made based upon a good faith belief by the trustee

5 of a representation made by a public health authority that

6 such disclosure satisfies the requirements of subsection

7 (a).

8 (c) LIMITATION ON USE AND DISCLOSURE BY PUB9 LIC HEALTH AUTHORITIES.—A public health authority

10 may not use or disclose protected health information for

11 any purpose other than for public health reporting, sur12 veillance, protection, investigation, or intervention.

13 SEC. 210. HEALTH RESEARCH.

14 (a) IN GENERAL.—A health information trustee may

15 disclose protected health information, other than coded

16 health information, to a health researcher for use in a re17 search project engaged in by the health researcher, if an

18 institutional review board, using standards and procedures

19 that are generally consistent with the official written pol20 icy of the Secretary with respect to research involving

21 human subjects conducted, supported, or otherwise subject

22 to regulation by Federal departments and agencies, and

23 this Act, determines that the research project—

24 (1) requires use of the protected health infor25 mation for the effectiveness of the project and could
51

•HR 3482 IH

1 not be carried out with either coded or nonidentifi2 able health information; and

3 (2) has obtained an authorization for the disclo4 sure executed by an individual who is a subject of

5 the information that—

6 (A) is consistent with the requirements of

7 section 203; and

8 (B) in a case where the researcher foresees

9 using or disclosing the information for any pur10 pose subsequent to the conclusion of the

11 project, specifically states—

12 (i) such intent; and

13 (ii) that the individual has the right

14 to limit such subsequent uses or disclo15 sures consistent with this Act.

16 (b) USE OF CODED OR NONIDENTIFIABLE HEALTH

17 INFORMATION.—A health information trustee may dis18 close coded health information that is not contained in a

19 protected health information subfile, or nonidentifiable

20 health information, to a health researcher for use in a re21 search project engaged in by the health researcher upon

22 approval of the proposed research by an institutional re23 view board, regardless of whether the researcher has ob24 tained an authorization for the disclosure consistent with

25 the requirements of section 203.
52

•HR 3482 IH

1 (c) ANONYMIZATION OF PREVIOUSLY STORED BIO2 LOGICAL SAMPLES.—The Secretary may develop interim

3 guidelines for the use by a health researcher of biological

4 samples derived from a human body collected before the

5 effective date of this Act. Such guidelines shall address

6 the requirements pertinent to a health researcher who

7 wishes to use stored biological samples derived from a

8 human body in nonidentifiable or coded form. Such guide9 lines shall authorize a health researcher, for the purpose

10 of facilitating future health research—

11 (1) to convert protected health information into

12 nonidentifiable information or coded health informa13 tion, if such conversion is permitted in a written au14 thorization; or

15 (2) if no such authorization exists, to make

16 such conversion after publishing notice of the re17 searcher’s intent and providing individuals the op18 portunity to prohibit the use of their biological sam19 ples for such purpose.

20 (d) OBLIGATIONS OF RECIPIENT.—A person who re21 ceives protected health information pursuant to subsection

22 (a)—

23 (1) shall remove or destroy, at the earliest op24 portunity consistent with the purposes of the project,
53

•HR 3482 IH

1 information that would enable an individual to be

2 identified, unless—

3 (A) an institutional review board has de4 termined that there is a health or research jus5 tification for retention of such identifiers; and

6 (B) there is an adequate plan to protect

7 the identifiers from disclosure that is inconsist8 ent with this section; and

9 (2) shall use the information solely for purposes

10 of the health research project for which disclosure

11 was authorized by an institutional review board

12 under subsection (a).

13 SEC. 211. JUDICIAL AND ADMINISTRATIVE PURPOSES.

14 A health care provider, health plan, health oversight

15 agency, employer, school, institution of higher education,

16 insurer, court, or a person who receives protected health

17 information pursuant to section 206 may disclose pro18 tected health information about an individual—

19 (1) pursuant to the requirements governing

20 subpoenas, warrants, and court orders under sec21 tions 212 and 213, where such information has been

22 determined to be discoverable by a court under any

23 applicable rules of civil or criminal procedure;
54

•HR 3482 IH

1 (2) to a court, and to others as ordered by the

2 court, if the information is developed in response to

3 a court-ordered physical or mental examination;

4 (3) where the subject of such information has

5 brought a claim for medical malpractice against a

6 health care provider and the information is nec7 essary for the defense of the claim; and

8 (4) to legal counsel for the person making the

9 disclosure, where the disclosure is necessary to en10 sure compliance with this Act or any other legal re11 quirement.

12 SEC. 212. GENERAL REQUIREMENTS GOVERNING SUBPOE13 NAS.

14 (a) IN GENERAL.—A health care provider, health

15 plan, health oversight agency, employer, school, institution

16 of higher education, insurer, court, or a person who re17 ceives protected health information pursuant to section

18 206 may disclose protected health information to any per19 son, other than a law enforcement authority, under section

20 211(1), if the disclosure is pursuant to a subpoena issued

21 on behalf of a party to a lawsuit or other judicial or ad22 ministrative proceeding who has complied with subsection

23 (b) or (c), and subsection (d).

24 (b) REQUEST FOR ACCESS BY COUNSEL TO REVIEW

25 PROTECTED HEALTH INFORMATION.—A person may have
55

•HR 3482 IH

1 access to protected health information under subsection

2 (a), by means solely of a review of the information by the

3 person’s counsel, acting in the capacity of an officer of

4 the court, and on premises of, and under the control of,

5 the court, if—

6 (1) the person has included in a subpoena a

7 proffer of evidence specifying with reasonable speci8 ficity the information to which access is sought and

9 the precise grounds for seeking such access for re10 view;

11 (2) a copy of such subpoena for access to re12 view, together with a notice of the individual’s right

13 to challenge the subpoena under subsection (d), has

14 been served upon the individual on or before the

15 date of return of the subpoena;

16 (3)(A) 15 days have passed since the date of

17 service on the individual, and within that period the

18 individual has not initiated a challenge in accordance

19 with subsection (d)(1); or

20 (B) such access is ordered by the court; and

21 (4) such counsel agrees not to copy such infor22 mation, remove such information from the court

23 premises, or disclose the information to any person

24 other than the person permitted access under this

25 subsection.
56

•HR 3482 IH

1 (c) REQUEST TO OBTAIN PROTECTED HEALTH IN2 FORMATION FOR INTRODUCTION IN COURT.—

3 (1) REQUIREMENTS FOR OBTAINING INFORMA4 TION.—A person may obtain protected health infor5 mation about an individual pursuant to a subpoena,

6 for purposes of introducing such information as evi7 dence in a court, only if—

8 (A) counsel for the person has obtained ac9 cess to the information under subsection (b);

10 (B) a copy of the subpoena to obtain the

11 information for introduction in court, specifying

12 the precise information sought and the precise

13 grounds for seeking introduction of the infor14 mation as evidence in court, together with a no15 tice of the individual’s right to challenge the

16 subpoena under subsection (d), has been served

17 upon the individual on or before the date of re18 turn of such subpoena; and

19 (C)(i) 15 days have passed since the date

20 of service on the individual, and within that

21 time period the individual has not indicated a

22 challenge in accordance with subsection (d)(1);

23 or

24 (ii) the information is ordered to be pro25 vided to the court.
57

•HR 3482 IH

1 (2) USE AND DISCLOSURE.—A person who ob2 tains protected health information under paragraph

3 (1) may use and disclose such information only for

4 the purpose of prosecuting or defending the lawsuit

5 or other judicial or administrative proceeding de6 scribed in subsection (a).

7 (d) CHALLENGE PROCEDURES.—

8 (1) MOTION TO QUASH SUBPOENA.—After

9 being served of a copy of a subpoena seeking access

10 for review by counsel of, or access to, protected

11 health information under subsection (b), or a sub12 poena seeking to obtain protected health information

13 for introduction as evidence in court, under sub14 section (c), an individual who is a subject of such in15 formation may file in any court of competent juris16 diction a motion to quash the subpoena.

17 (2) STANDARD FOR DECISION.—

18 (A) IN GENERAL.—The court shall grant a

19 motion under paragraph (1) unless the respond20 ent demonstrates—

21 (i) by clear and convincing evidence

22 that the information is necessary in rela23 tion to the lawsuit or other judicial or ad24 ministrative proceeding with respect to
58

•HR 3482 IH

1 which the information is sought, includ2 ing—

3 (I) a demonstration that use or

4 disclosure of solely nonidentifiable

5 health information would be insuffi6 cient to accomplish the purpose for

7 which the information is sought; and

8 (II) if protected health informa9 tion that is not coded health informa10 tion is sought, a demonstration that

11 use or disclosure of coded health in12 formation would be insufficient to ac13 complish the purpose for which the in14 formation is sought; and

15 (ii) that the need of the respondent

16 for the information outweighs the privacy

17 interest of the individual.

18 (B) CRITERIA FOR DECISION.—In deter19 mining whether the need of the respondent for

20 the information outweighs the privacy interest

21 of the individual, the court shall consider—

22 (i) the particular purpose for which

23 the information was collected;

24 (ii) the invasion of the individual’s

25 privacy caused by the disclosure;
59

•HR 3482 IH

1 (iii) the degree to which disclosure of

2 the information would embarrass, injure,

3 or further invade, the privacy of the indi4 vidual;

5 (iv) the effect of the disclosure on the

6 individual’s future health care;

7 (v) the importance of the information

8 to the lawsuit or proceeding; and

9 (vi) any other relevant factor.

10 (3) ATTORNEY’S FEES.—In the case of a mo11 tion brought under paragraph (1) in which the indi12 vidual who brought the motion has prevailed in

13 whole or in part, the court may assess against the

14 respondent a reasonable attorney’s fee and other liti15 gation costs and expenses (including expert fees)

16 reasonably incurred.

17 (e) SEALING OF INFORMATION.—Any portion of a

18 record of a court that contains protected health informa19 tion disclosed under this section shall be kept by the court

20 under seal and used or disclosed only pursuant to an order

21 of the court consistent with this section.

22 SEC. 213. ADDITIONAL REQUIREMENTS FOR LAW ENFORCE23 MENT ACCESS.

24 (a) LAW ENFORCEMENT SUBPOENAS AND WAR25 RANTS IN GENERAL.—A health care provider, health plan,
60

•HR 3482 IH

1 health oversight agency, employer, school, institution of

2 higher education, insurer, court, or a person who receives

3 protected health information pursuant to section 206 may

4 disclose protected health information to a law enforcement

5 authority under section 211(1), if—

6 (1)(A) the disclosure is made pursuant to a

7 subpoena for review under section 212(b), a sub8 poena for purposes of introducing evidence in a

9 court under section 212(c), or both, issued under the

10 authority of a grand jury or a court; and

11 (B) the requirements of subsections (b) through

12 (e) of section 212, and subsections (b) and (c) of

13 this section, are satisfied;

14 (2) the disclosure is made pursuant to a judicial

15 warrant for search and seizure and the requirements

16 of subsection (d) are satisfied; or

17 (3)(A) the disclosure is made pursuant to a

18 subpoena for purposes of introducing evidence in a

19 court under section 212(c), issued under the author20 ity of a grand jury or a court, and obtained pursu21 ant to subsection (d)(5) following the execution of a

22 judicial warrant for search and seizure under sub23 section (d); and

24 (B) the requirements of subsections (c) through

25 (e) (other than subsection (c)(1)(A)) of section 212,
61

•HR 3482 IH

1 and subsections (b) and (c) of this section, are satis2 fied.

3 (b) CLEAR AND CONVINCING REQUIREMENT.—A law

4 enforcement authority may not obtain protected health in5 formation about an individual under subsection (a) unless

6 the authority demonstrates by clear and convincing evi7 dence that the information is necessary to a legitimate law

8 enforcement inquiry into a particular violation of criminal

9 law being conducted by the authority.

10 (c) LIMITATION ON USE AND DISCLOSURE FOR

11 OTHER LAW ENFORCEMENT INQUIRIES.—Protected

12 health information about an individual that is disclosed

13 under this section may not be used in, or disclosed to any

14 person for use in, any administrative, civil, or criminal ac15 tion or investigation directed against the individual, unless

16 the action or investigation arises out of, or is directly re17 lated to, the law enforcement inquiry for which the infor18 mation was obtained.

19 (d) REQUIREMENTS FOR WARRANTS FOR SEARCH

20 AND SEIZURE.—

21 (1) LIMITED PURPOSE.—A health care pro22 vider, health plan, health oversight agency, em23 ployer, school, institution of higher education, in24 surer, or a person who receives protected health in25 formation pursuant to section 206 may disclose pro-
62

•HR 3482 IH

1 tected health information to a law enforcement au2 thority pursuant to a warrant for search and sei3 zure, issued under the authority of a court, for the

4 exclusive purpose of permitting the authority to se5 cure the information described in the warrant for de6 livery to the court.

7 (2) LIMITATION ON EXECUTION OF WAR8 RANTS.—In executing a warrant under paragraph

9 (1), a law enforcement authority shall engage in the

10 most minimal examination of protected health infor11 mation that is necessary in order to determine

12 whether the information is or is not within the scope

13 of the warrant. The authority immediately shall

14 place any such information that the authority deter15 mines is within the scope of the warrant under seal,

16 and shall deliver such sealed information, without

17 any further examination or other use or disclosure,

18 to the court. The authority may not use or disclose

19 for any purpose protected health information that

20 the authority determines is not within the scope of

21 the warrant, but that is obtained or discovered by

22 the authority directly or indirectly through execution

23 of the warrant.

24 (3) NOTICE OF WARRANT.—A law enforcement

25 authority that obtains protected health information
63

•HR 3482 IH

1 about an individual pursuant to the execution of a

2 warrant under paragraph (2) shall, not later than

3 30 days after the date of such execution, serve the

4 individual with, or mail to the last known address

5 of the individual, a notice that protected health in6 formation about the individual was obtained, to7 gether with a notice of the individual’s right to chal8 lenge the warrant under paragraph (4).

9 (4) CHALLENGE PROCEDURES FOR WAR10 RANTS.—

11 (A) MOTION TO QUASH.—Within 15 days

12 after the date of service of a notice of execution

13 of a warrant of a law enforcement authority

14 seeking protected health information about an

15 individual under paragraph (3), the individual

16 (or any other person who was in possession of

17 the information and against whom the warrant

18 was executed) may file in any court of com19 petent jurisdiction a motion to quash the war20 rant.

21 (B) STANDARD FOR DECISION.—The court

22 shall grant a motion under subparagraph (A)

23 unless the law enforcement authority dem24 onstrates by clear and convincing evidence that

25 the protected health information is necessary to
64

•HR 3482 IH

1 a legitimate law enforcement inquiry being con2 ducted by the law enforcement authority and

3 the government authority’s need for the infor4 mation outweighs the privacy interest of the in5 dividual.

6 (C) ATTORNEY’S FEES.—In the case of a

7 motion brought under subparagraph (A) in

8 which the individual has prevailed, in whole or

9 in part, the court may assess against the law

10 enforcement authority reasonable attorney’s

11 fees and other litigation costs (including expert

12 fees) reasonably incurred.

13 (5) ACTION IN COURT ON INFORMATION DELIV14 ERED.—Upon termination of the period described in

15 paragraph (4)(A) (in a case where a motion to

16 quash is not filed under such paragraph), or upon

17 the denial of a motion to quash under such para18 graph, the law enforcement authority may obtain

19 protected health information delivered to the court

20 under this subsection solely through a disclosure

21 under subsection (a)(3).

22 (6) SEALING OF INFORMATION.—Any protected

23 health information that is delivered to a court under

24 this section shall be kept by the court under seal and
65

•HR 3482 IH

1 used or disclosed only pursuant to an order of the

2 court consistent with this section.

3 TITLE III—SANCTIONS

4 Subtitle A—Civil Sanctions

5 SEC. 301. CIVIL PENALTY.

6 (a) VIOLATION.—Any person who the Secretary de7 termines has materially failed to comply with this Act shall

8 be subject, in addition to any other penalties that may

9 be prescribed by law, to—

10 (1) a civil penalty of not more than $25,000 for

11 each such violation, but not to exceed $150,000 in

12 the aggregate for multiple violations in any one year;

13 and

14 (2) a civil penalty of not more than $500,000

15 and exclusion from participation in the program

16 under title XVIII of the Social Security Act, the pro17 gram under title XIX of such Act, and any other

18 federally funded health care program, if the Sec19 retary finds that such violations have occurred with

20 such frequency as to constitute a general business

21 practice.

22 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

23 Section 1128A of the Social Security Act, other than sub24 sections (a) and (b) and the second sentence of subsection

25 (f) of that section, shall apply to the imposition of a civil,
66

•HR 3482 IH

1 monetary, or exclusionary penalty under this section in the

2 same manner as such provisions apply with respect to the

3 imposition of a penalty under section 1128A of such Act.

4 SEC. 302. CIVIL ACTION.

5 (a) IN GENERAL.—An individual who is aggrieved by

6 conduct in violation of this Act may bring a civil action

7 to recover—

8 (1) such preliminary and equitable relief as the

9 court determines to be appropriate;

10 (2) the greater of—

11 (A) actual damages; and

12 (B) liquidated damages of—

13 (i) $25,000, in the case of a material

14 violation; or

15 (ii)$50,000, in the case of a violation

16 that was willful or resulted in profit or

17 monetary gain; and

18 (3) punitive damages.

19 (b) ATTORNEY’S FEES.—In the case of a civil action

20 brought under subsection (a) in which the individual has

21 substantially prevailed, the court may assess against the

22 respondent a reasonable attorney’s fee and other litigation

23 costs and expenses (including expert fees) reasonably in24 curred.
67

•HR 3482 IH

1 (c) LIMITATION.—No action may be commenced

2 under this section by an individual more than 3 years after

3 the date on which the violation was or should reasonably

4 have been discovered by the individual.

5 Subtitle B—Criminal Sanctions

6 SEC. 311. WRONGFUL DISCLOSURE OF PROTECTED

7 HEALTH INFORMATION.

8 (a) OFFENSE.—Whoever knowingly—

9 (1) obtains protected health information relat10 ing to an individual in violation of this Act;

11 (2) discloses protected health information to an12 other person in violation of this Act;

13 (3) coerces or attempts to coerce a health infor14 mation trustee to disclose protected health informa15 tion in violation of this title; or

16 (4) without authorization pursuant to this Act,

17 identifies or attempts to identify an individual who

18 is the subject of protected health information that a

19 health information trustee has converted into coded

20 health information,

21 shall be punished as provided in subsection (b).

22 (b) PENALTIES.—A person referred to in subsection

23 (a) shall be fined under title 18, United States Code, im24 prisoned not more than 1 year, or both, except that—
68

•HR 3482 IH

1 (1) if the offense is committed under false pre2 tenses, the person shall be fined under title 18,

3 United States Code, imprisoned not more than 5

4 years, or excluded from participation in the program

5 under title XVIII of the Social Security Act, the pro6 gram under title XIX of such Act, or any other fed7 erally funded health care program, or any combina8 tion of such penalties; and

9 (2) if the offense is committed with intent to

10 sell, transfer, or use protected health information for

11 commercial advantage, personal gain, or malicious

12 harm, the person shall be fined under title 18, Unit13 ed States Code, or imprisoned not more than 10

14 years, or excluded from participation in the program

15 under title XVIII of the Social Security Act, the pro16 gram under title XIX of such Act, or any other fed17 erally funded health care program, or any combina18 tion of such penalties.

19 TITLE IV—MISCELLANEOUS

20 SEC. 401. REGULATIONS.

21 (a) PROMULGATION.—

22 (1) CONSULTATION WITH ADVISORY GROUP.—

23 In promulgating regulations under this Act, the Sec24 retary shall appoint and consult an advisory group

25 of knowledgeable individuals.
69

•HR 3482 IH

1 (2) MEMBERSHIP.—The advisory group shall

2 consist of at least 7 but no more than 12 individ3 uals, including representatives of—

4 (A) health care providers;

5 (B) health care consumers;

6 (C) health plans;

7 (D) privacy advocates; and

8 (E) electronic security experts.

9 (3) RESPONSIBILITIES.—The advisory group

10 shall review all proposed rules and regulations and

11 submit recommendations to the Secretary. The advi12 sory group shall also assist the Secretary in estab13 lishing the standards for compliance with rules and

14 regulations, in developing an annual report to the

15 Congress on the status of the requirements set forth

16 in this Act, their cost impact, and any recommenda17 tions for modifications to this Act in order to ensure

18 efficient and confidential electronic interchange of

19 protected health information.

20 (b) CONSULTATION WITH OTHERS.—In promulgat21 ing regulations under this Act, the Secretary may con22 sult—

23 (1) privacy, industry, health care professional,

24 and consumer groups;

25 (2) medical societies; and
70

•HR 3482 IH

1 (3) academic computer security and privacy ex2 perts.

3 SEC. 402. RELATIONSHIP TO OTHER LAWS.

4 (a) IN GENERAL.—Nothing in this Act shall be con5 strued to preempt any provision of State law or any privi6 lege, whether derived from statute or common law, that—

7 (1) more completely protects the confidentiality

8 or privacy of an individual with respect to protected

9 health information about the individual than does

10 this Act; or

11 (2) provides a greater right of access to pro12 tected health information to a subject of the infor13 mation than does this Act.

14 (b) CRIMINAL PENALTIES.—A State may establish

15 and enforce criminal penalties with respect to a failure to

16 comply with a provision of this Act.

17 (c) PRIVILEGES.—This Act does not preempt or mod18 ify State common or statutory law to the extent such law

19 concerns a privilege of a witness or person in a court of

20 the State. This Act does not supersede or modify Federal

21 common or statutory law to the extent such law concerns

22 a privilege of a witness or person in a court of the United

23 States and more completely protects the confidentiality or

24 privacy of an individual with respect to protected health

25 information about the individual than does this Act. The
71

•HR 3482 IH

1 execution of an authorization pursuant to section 202 or

2 203 may not be construed as a waiver of any such privi3 lege.

4 (d) CERTAIN DUTIES UNDER STATE OR FEDERAL

5 LAW.—This Act does not preempt, supersede, or modify

6 the operation of any of the following:

7 (1) Any law that provides for the reporting of

8 vital statistics such as birth or death information.

9 (2) Any law requiring the reporting of abuse or

10 neglect information about any individual.

11 (3) Any State law relating to public or mental

12 health that prevents or otherwise restricts disclosure

13 of protected health information otherwise permitted

14 under this Act.

15 (4) Subpart II of part E of title XXVI of the

16 Public Health Service Act (relating to notifications

17 of emergency response employees of possible expo18 sure to infectious diseases).

19 (5) Any Federal law or regulation governing

20 confidentiality of alcohol and drug patient records.

21 (6) The Americans With Disabilities Act of

22 1990.

23 (7) Any Federal or State statute that estab24 lishes a privilege for records used in health profes25 sional peer review activities.
72

•HR 3482 IH

1 SEC. 403. EFFECTIVE DATES.

2 (a) IN GENERAL.—Except as provided in subsection

3 (b), this Act shall take effect on the date that is 18 months

4 after the date of the enactment of this Act.

5 (b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro6 vision of this Act shall take effect on the date of the enact7 ment of this Act if the provision imposes on the Secretary

8 a duty to develop, establish, or promulgate regulations,

9 guidelines, or model forms.

10 (c) DEADLINE FOR REGULATIONS.—The Secretary

11 shall promulgate regulations implementing this Act not

12 later than the date that is 12 months after the date of

13 the enactment of this Act.

14 SEC. 404. APPLICABILITY.

15 (a) PROTECTED HEALTH INFORMATION.—Except as

16 provided in subsection (b), the provisions of this Act shall

17 apply to any protected health information that is received,

18 created, used, maintained, or disclosed by a health infor19 mation trustee on or after the date that is 18 months after

20 the date of the enactment of this Act, regardless of wheth21 er the information existed or was disclosed prior to such

22 date.

23 (b) AUTHORIZATIONS FOR DISCLOSURES.—An au24 thorization for the disclosure of protected health informa25 tion about a protected individual that is executed by the

26 individual before the date that is 18 months after the date
73

•HR 3482 IH

1 of the enactment of this Act, and is recognized and valid

2 under State law on the day before such date, shall remain

3 valid and shall not be subject to the requirements of title

4 II until the date that is 30 months after the date of the

5 enactment of this Act, or the occurrence of the date or

6 event in the authorization upon which the authorization

7 expires, whichever occurs earlier.

Æ