II

107TH CONGRESS

1ST SESSION S. 1055

To require the consent of an individual prior to the sale and marketing

of such individual’s personally identifiable information, and for other purposes.

IN THE SENATE OF THE UNITED STATES

JUNE 14, 2001

Mrs. FEINSTEIN introduced the following bill; which was read twice and

referred to the Committee on the Judiciary

A BILL

To require the consent of an individual prior to the sale

and marketing of such individual’s personally identifiable

information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Privacy Act of 2001’’.

6 (b) TABLE OF CONTENTS.—The table of contents of

7 this Act is as follows:

Sec. 1. Short title; table of contents.

TITLE I—COMMERCIAL SALE AND MARKETING OF PERSONALLY

IDENTIFIABLE INFORMATION

Sec. 101. Collection and distribution of personally identifiable information.
2

•S 1055 IS

Sec. 102. Enforcement.

Sec. 103. Safe harbor.

Sec. 104. Definitions.

Sec. 105. Preemption.

Sec. 106. Effective Date.

TITLE II—LIMITATIONS ON USE OF SOCIAL SECURITY NUMBERS

Sec. 201. Findings.

Sec. 202. Prohibition of the display, sale, or purchase of social security numbers.

Sec. 203. No prohibition with respect to public records.

Sec. 204. Rulemaking authority of the Attorney General.

Sec. 205. Treatment of social security numbers on government documents.

Sec. 206. Limits on personal disclosure of a social security number for consumer transactions.

Sec. 207. Extension of civil monetary penalties for misuse of a social security

number.

TITLE III—LIMITATIONS ON SALE AND SHARING OF NONPUBLIC

PERSONAL FINANCIAL INFORMATION

Sec. 301. Definition of sale.

Sec. 302. Rules applicable to sale of nonpublic personal information.

Sec. 303. Exceptions to sale prohibition.

Sec. 304. Effective date.

TITLE IV—LIMITATIONS ON THE PROVISION OF PROTECTED

HEALTH INFORMATION

Sec. 401. Definitions.

Sec. 402. Prohibition against selling protected health information.

Sec. 403. Authorization for sale of protected health information.

Sec. 404. Prohibition against retaliation.

Sec. 405. Prohibition against marketing protected health information.

Sec. 406. Rule of construction.

Sec. 407. Regulations.

Sec. 408. Enforcement.

TITLE V—DRIVER’S LICENSE PRIVACY

Sec. 501. Driver’s license privacy.

TITLE VI—MISCELLANEOUS

Sec. 601. Enforcement by State Attorneys General.

Sec. 602. Federal injunctive authority.
3

•S 1055 IS

1 TITLE I—COMMERCIAL SALE

2 AND MARKETING OF PERSON3 ALLY IDENTIFIABLE INFOR4 MATION

5 SEC. 101. COLLECTION AND DISTRIBUTION OF PERSON6 ALLY IDENTIFIABLE INFORMATION.

7 (a) PROHIBITION.—

8 (1) IN GENERAL.—It is unlawful for a commer9 cial entity to collect personally identifiable informa10 tion and disclose such information to any non11 affiliated third party for marketing purposes or sell

12 such information to any nonaffiliated third party,

13 unless the commercial entity provides—

14 (A) notice to the individual to whom the

15 information relates in accordance with the re16 quirements of subsection (b); and

17 (B) an opportunity for such individual to

18 restrict the disclosure or sale of such informa19 tion.

20 (2) EXCEPTION.—A commercial entity may col21 lect personally identifiable information and use such

22 information to market to potential customers such

23 entity’s product.

24 (b) NOTICE.—
4

•S 1055 IS

1 (1) IN GENERAL.—A notice under subsection

2 (a) shall contain statements describing the following:

3 (A) The identity of the commercial entity

4 collecting the personally identifiable informa5 tion.

6 (B) The types of personally identifiable in7 formation that are being collected on the indi8 vidual.

9 (C) How the commercial entity may use

10 such information.

11 (D) A description of the categories of po12 tential recipients of such personally identifiable

13 information.

14 (E) Whether the individual is required to

15 provide personally identifiable information in

16 order to do business with the commercial entity.

17 (F) How an individual may decline to have

18 such personally identifiable information used or

19 sold as described in subsection (a).

20 (2) TIME OF NOTICE.—Notice shall be conveyed

21 prior to the sale or use of the personally identifiable

22 information as described in subsection (a) in such a

23 manner as to allow the individual a reasonable pe24 riod of time to consider the notice and limit such

25 sale or use.
5

•S 1055 IS

1 (3) MEDIUM OF NOTICE.—The medium for pro2 viding notice must be—

3 (A) the same medium in which the person4 ally identifiable information is or will be col5 lected, or a medium approved by the individual;

6 or

7 (B) in the case of oral communication, no8 tice may be conveyed orally or in writing.

9 (4) FORM OF NOTICE.—The notice shall be

10 clear and conspicuous.

11 (c) OPT-OUT.—

12 (1) OPPORTUNITY TO OPT-OUT OF SALE OR

13 MARKETING.—The opportunity provided to limit the

14 sale of personally identifiable information to non15 affiliated third parties or the disclosure of such in16 formation for marketing purposes, shall be easy to

17 use, accessible and available in the medium the in18 formation is collected, or in a medium approved by

19 the individual.

20 (2) DURATION OF LIMITATION.—An individ21 ual’s limitation on the sale or marketing of person22 ally identifiable information shall be considered per23 manent, unless otherwise specified by the individual.

24 (3) REVOCATION OF CONSENT.—After an indi25 vidual grants consent to the use of that individual’s
6

•S 1055 IS

1 personally identifiable information, the individual

2 may revoke the consent at any time, except to the

3 extent that the commercial entity has taken action

4 in reliance thereon. The commercial entity shall pro5 vide the individual an opportunity to revoke consent

6 that is easy to use, accessible, and available in the

7 medium the information was or is collected.

8 (4) NOT APPLICABLE.—This section shall not

9 apply to disclosure of personally identifiable

10 information—

11 (A) that is necessary to facilitate a trans12 action specifically requested by the consumer;

13 (B) is used for the sole purpose of facili14 tating this transaction; and

15 (C) in which the entity receiving or obtain16 ing such information is limited, by contract, to

17 use such formation for the purpose of com18 pleting the transaction.

19 SEC. 102. ENFORCEMENT.

20 (a) IN GENERAL.—In accordance with the provisions

21 of this section, the Federal Trade Commission shall have

22 the authority to enforce any violation of section 101 of

23 this Act.

24 (b) VIOLATIONS.—The Federal Trade Commission

25 shall treat a violation of section 101 as a violation of a
7

•S 1055 IS

1 rule under section 18a(a)(1)(B) of the Federal Trade

2 Commission Act (15 U.S.C. 57a(a)(1)(B)).

3 (c) TRANSFER OF ENFORCEMENT AUTHORITY.—The

4 Federal Trade Commission shall promulgate rules in ac5 cordance with section 553 of title 5, United States Code,

6 allowing for the transfer of enforcement authority from

7 the Federal Trade Commission to a Federal agency re8 garding section 101 of this Act. The Federal Trade Com9 mission may permit a Federal agency to enforce any viola10 tion of section 101 if such agency submits a written re11 quest to the Commission to enforce such violations and

12 includes in such request—

13 (1) a description of the entities regulated by

14 such agency that will be subject to the provisions of

15 section 101;

16 (2) an assurance that such agency has suffi17 cient authority over the entities to enforce violations

18 of section 101; and

19 (3) a list of proposed rules that such agency

20 shall use in regulating such entities and enforcing

21 section 101.

22 (d) ACTIONS BY THE COMMISSION.—Absent transfer

23 of enforcement authority to a Federal agency under sub24 section (c), the Federal Trade Commission shall prevent

25 any person from violating section 101 in the same manner,
8

•S 1055 IS

1 by the same means, and with the same jurisdiction, pow2 ers, and duties as provided to such Commission under the

3 Federal Trade Commission Act (15 U.S.C. 41 et seq.).

4 Any entity that violates section 101 is subject to the pen5 alties and entitled to the privileges and immunities pro6 vided in such Act in the same manner, by the same means,

7 and with the same jurisdiction, power, and duties under

8 such Act.

9 (e) RELATIONSHIP TO OTHER LAWS.—

10 (1) COMMISSION AUTHORITY.—Nothing con11 tained in this title shall be construed to limit author12 ity provided to the Commission under any other law.

13 (2) COMMUNICATIONS ACT.—Nothing in section

14 101 requires an operator of a website to take any

15 action that is inconsistent with the requirements of

16 section 222 or 631 of the Communications Act of

17 1934 (47 U.S.C. 222 and 5551).

18 (3) OTHER ACTS.—Nothing in this title is in19 tended to affect the applicability or the enforce20 ability of any provision of, or any amendment made

21 by—

22 (A) the Children’s Online Privacy Protec23 tion Act of 1998 (15 U.S.C. 6501 et seq.);

24 (B) title V of the Gramm-Leach-Bliley Act;
9

•S 1055 IS

1 (C) the Health Insurance Portability and

2 Accountability Act of 1996; or

3 (D) the Fair Credit Reporting Act.

4 (f) PUBLIC RECORDS.—Nothing in this title shall be

5 construed to restrict commercial entities from obtaining

6 or disclosing personally identifying information from pub7 lic records.

8 (g) CIVIL PENALTIES.—In addition to any other pen9 alty applicable to a violation of section 101(a), a penalty

10 of up to $25,000 may be issued for each violation.

11 (h) ENFORCEMENT REGARDING PROGRAMS.—

12 (1) IN GENERAL.—A Federal agency or depart13 ment providing financial assistance to any entity re14 quired to comply with section 101 of this Act shall

15 issue regulations requiring that such entity comply

16 with such section or forfeit some or all of such as17 sistance. Such regulations shall prescribe sanctions

18 for noncompliance, require that such department or

19 agency provide notice of failure to comply with such

20 section prior to any action being taken against such

21 recipient, and require that a determination be made

22 prior to any action being taken against such recipi23 ent that compliance cannot be secured by voluntary

24 means.
10

•S 1055 IS

1 (2) FEDERAL FINANCIAL ASSISTANCE.—The

2 term ‘‘Federal financial assistance’’ means assist3 ance through a grant, cooperative agreement, loan,

4 or contract other than a contract of insurance or

5 guaranty.

6 SEC. 103. SAFE HARBOR.

7 A commercial entity may not be held to have violated

8 any provision of this title if such entity complies with self9 regulatory guidelines that—

10 ‘‘(1) are issued by seal programs or representa11 tives of the marketing or online industries or by any

12 other person; and

13 ‘‘(2) are approved by the Federal Trade Com14 mission, after public comment has been received on

15 such guidelines by the Commission, as meeting the

16 requirements of this title.

17 SEC. 104. DEFINITIONS.

18 In this title:

19 (1) COMMERCIAL ENTITY.—The term ‘‘commer20 cial entity’’—

21 (A) means any person offering products or

22 services involving commerce—

23 (i) among the several States or with 1

24 or more foreign nations;
11

•S 1055 IS

1 (ii) in any territory of the United

2 States or in the District of Columbia, or

3 between any such territory and—

4 (I) another such territory; or

5 (II) any State or foreign nation;

6 or

7 (iii) between the District of Columbia

8 and any State, territory, or foreign nation;

9 and

10 (B) does not include—

11 (i) any nonprofit entity that would

12 otherwise be exempt from coverage under

13 section 5 of the Federal Trade Commission

14 Act (15 U.S.C. 45);

15 (ii) any financial institution that is

16 subject to title V of the Gramm-Leach-Bli17 ley Act (15 U.S.C. 6801 et seq.); or

18 (iii) any group health plan, health in19 surance issuer, or other entity that is sub20 ject to the Health Insurance Portability

21 and Accountability Act of 1996 (42 U.S.C.

22 201 note).

23 (2) COMMISSION.—The term ‘‘Commission’’

24 means the Federal Trade Commission.
12

•S 1055 IS

1 (3) INDIVIDUAL.—The term ‘‘individual’’ means

2 a person whose personally identifying information

3 has been, is, or will be collected by a commercial en4 tity.

5 (4) MARKETING.—The term ‘‘marketing’’

6 means to make a communication about a product or

7 service a purpose of which is to encourage recipients

8 of the communication to purchase or use the product

9 or service.

10 (5) MEDIUM.—The term ‘‘medium’’ means any

11 channel or system of communication including oral,

12 written, and online communication.

13 (6) NONAFFILIATED THIRD PARTY.—The term

14 ‘‘nonaffiliated third party’’ means any entity that is

15 not related by common ownership or affiliated by

16 corporate control with, the commercial entity, but

17 does not include a joint employee of such institution.

18 (7) PERSONALLY IDENTIFIABLE INFORMA19 TION.—The term ‘‘personally identifiable informa20 tion’’ means individually identifiable information

21 about the individual that is collected including—

22 (A) a first, middle, or last name, whether

23 given at birth or adoption, assumed, or legally

24 changed;
13

•S 1055 IS

1 (B) a home or other physical address, in2 cluding the street name, zip code, and name of

3 a city or town;

4 (C) an e-mail address;

5 (D) a telephone number;

6 (E) a photograph or other form of visual

7 identification;

8 (F) a birth date, birth certificate number,

9 or place of birth for that person; or

10 (G) information concerning the individual

11 that is combined with any other identifier in

12 this paragraph.

13 (8) SALE; SELL; SOLD.—The terms ‘‘sale’’,

14 ‘‘sell’’, and ‘‘sold’’, with respect to personally identi15 fiable information, mean the exchanging of such in16 formation for any thing of value, directly or indi17 rectly, including the licensing, bartering, or renting

18 of such information.

19 (9) WRITING.—The term ‘‘writing’’ means writ20 ing in either a paper-based or computer-based form,

21 including electronic and digital signatures.

22 SEC. 105. PREEMPTION.

23 The provisions of this title shall supersede any statu24 tory and common law of States and their political subdivi-
14

•S 1055 IS

1 sions insofar as that law may now or hereafter relate to

2 the—

3 (1) collection and disclosure of personally iden4 tifiable information for marketing purposes; and

5 (2) collection and sale of personally identifiable

6 information.

7 SEC. 106. EFFECTIVE DATE.

8 This title and the amendments made by this title

9 shall take effect 1 year after the date of enactment of this

10 Act.

11 TITLE II—LIMITATIONS ON USE

12 OF SOCIAL SECURITY NUMBERS

13 SEC. 201. FINDINGS.

14 Congress makes the following findings:

15 (1) The inappropriate display, sale, or purchase

16 of social security numbers has contributed to a

17 growing range of illegal activities, including fraud,

18 identity theft, and, in some cases, stalking and other

19 violent crimes.

20 (2) While financial institutions, health care pro21 viders, and other entities have often used social se22 curity numbers to confirm the identity of an indi23 vidual, the general display to the public, sale, or pur24 chase of these numbers has been used to commit
15

•S 1055 IS

1 crimes, and also can result in serious invasions of in2 dividual privacy.

3 (3) The Federal Government requires virtually

4 every individual in the United States to obtain and

5 maintain a social security number in order to pay

6 taxes, to qualify for social security benefits, or to

7 seek employment. An unintended consequence of

8 these requirements is that social security numbers

9 have become tools that can be used to facilitate

10 crime, fraud, and invasions of the privacy of the in11 dividuals to whom the numbers are assigned. Be12 cause the Federal Government created and main13 tains this system, and because the Federal Govern14 ment does not permit individuals to exempt them15 selves from those requirements, it is appropriate for

16 the Federal Government to take steps to stem the

17 abuse of this system.

18 (4) A social security number does not contain,

19 reflect, or convey any publicly significant informa20 tion or concern any public issue. The display, sale,

21 or purchase of such numbers in no way facilitates

22 uninhibited, robust, and wide-open public debate,

23 and restrictions on such display, sale, or purchase

24 would not affect public debate.
16

•S 1055 IS

1 (5) No one should seek to profit from the dis2 play, sale, or purchase of social security numbers in

3 circumstances that create a substantial risk of phys4 ical, emotional, or financial harm to the individuals

5 to whom those numbers are assigned.

6 (6) Consequently, this Act offers each indi7 vidual that has been assigned a social security num8 ber necessary protection from the display, sale, and

9 purchase of that number in any circumstance that

10 might facilitate unlawful conduct.

11 SEC. 202. PROHIBITION OF THE DISPLAY, SALE, OR PUR12 CHASE OF SOCIAL SECURITY NUMBERS.

13 (a) PROHIBITION.—

14 (1) IN GENERAL.—Chapter 47 of title 18,

15 United States Code, is amended by inserting after

16 section 1028 the following:

17 ‘‘§ 1028A. Prohibition of the display, sale, or purchase

18 of social security numbers

19 ‘‘(a) DEFINITIONS.—In this section:

20 ‘‘(1) DISPLAY.—The term ‘display’ means to in21 tentionally communicate or otherwise make available

22 (on the Internet or in any other manner) to the gen23 eral public an individual’s social security number.
17

•S 1055 IS

1 ‘‘(2) PERSON.—The term ‘person’ means any

2 individual, partnership, corporation, trust, estate, co3 operative, association, or any other entity.

4 ‘‘(3) PURCHASE.—The term ‘purchase’ means

5 providing directly or indirectly, anything of value in

6 exchange for a social security number.

7 ‘‘(4) SALE.—The term ‘sale’ means obtaining,

8 directly or indirectly, anything of value in exchange

9 for a social security number.

10 ‘‘(5) STATE.—The term ‘State’ means any

11 State of the United States, the District of Columbia,

12 Puerto Rico, the Northern Mariana Islands, the

13 United States Virgin Islands, Guam, American

14 Samoa, and any territory or possession of the

15 United States.

16 ‘‘(b) LIMITATION ON DISPLAY.—Except as provided

17 in section 1028B, no person may display any individual’s

18 social security number to the general public without the

19 affirmatively expressed consent of the individual.

20 ‘‘(c) LIMITATION ON SALE OR PURCHASE.—Except

21 as otherwise provided in this section, no person may sell

22 or purchase any individual’s social security number with23 out the affirmatively expressed consent of the individual.

24 ‘‘(d) PROHIBITION OF WRONGFUL USE AS PER25 SONAL IDENTIFICATION NUMBER.—No person may obtain
18

•S 1055 IS

1 any individual’s social security number for purposes of lo2 cating or identifying an individual with the intent to phys3 ically injure, harm, or use the identity of the individual

4 for any illegal purpose.

5 ‘‘(e) PREREQUISITES FOR CONSENT.—In order for

6 consent to exist under subsection (b) or (c), the person

7 displaying or seeking to display, selling or attempting to

8 sell, or purchasing or attempting to purchase, an individ9 ual’s social security number shall—

10 ‘‘(1) inform the individual of the general pur11 pose for which the number will be used, the types of

12 persons to whom the number may be available, and

13 the scope of transactions permitted by the consent;

14 and

15 ‘‘(2) obtain the affirmatively expressed consent

16 (electronically or in writing) of the individual.

17 ‘‘(f) EXCEPTIONS.—

18 ‘‘(1) IN GENERAL.—Except as provided in sub19 section (d), nothing in this section shall be construed

20 to prohibit or limit the display, sale, or purchase of

21 a social security number—

22 ‘‘(A) permitted, required, or excepted, ex23 pressly or by implication, under section

24 205(c)(2), 1124A(a)(3), or 1141(c) of the So25 cial Security Act (42 U.S.C. 405(c)(2), 1320a–
19

•S 1055 IS

1 3a(a)(3), and 1320b–11(c)), section 7(a)(2) of

2 the Privacy Act of 1974 (5 U.S.C. 552a note),

3 section 6109(d) of the Internal Revenue Code

4 of 1986, or section 6(b)(1) of the Professional

5 Boxing Safety Act of 1996 (15 U.S.C.

6 6305(b)(1));

7 ‘‘(B) for a public health purpose, including

8 the protection of the health or safety of an indi9 vidual in an emergency situation;

10 ‘‘(C) for a national security purpose;

11 ‘‘(D) for a law enforcement purpose, in12 cluding the investigation of fraud, as required

13 under subchapter II of chapter 53 of title 31,

14 United States Code, and chapter 2 of title I of

15 Public Law 91–508 (12 U.S.C. 1951–1959),

16 and the enforcement of a child support obliga17 tion;

18 ‘‘(E) if the display, sale, or purchase of the

19 number is for a business-to-business use, in20 cluding, but not limited to—

21 ‘‘(i) the prevention of fraud (including

22 fraud in protecting an employee’s right to

23 employment benefits);

24 ‘‘(ii) the facilitation of credit checks

25 or the facilitation of background checks of
20

•S 1055 IS

1 employees, prospective employees, and vol2 unteers;

3 ‘‘(iii) compliance with any require4 ment related to the social security program

5 established under title II of the Social Se6 curity Act (42 U.S.C. 401 et seq.); or

7 ‘‘(iv) the retrieval of other information

8 from, or by, other businesses, commercial

9 enterprises, or private nonprofit organiza10 tions,

11 except that, nothing in this subparagraph shall

12 be construed as permitting a professional or

13 commercial user to display or sell a social secu14 rity number to the general public;

15 ‘‘(F) if the transfer of such a number is

16 part of a data matching program under the

17 Computer Matching and Privacy Protection Act

18 of 1988 (5 U.S.C. 552a note) or any similar

19 computer data matching program involving a

20 Federal, State, or local agency; or

21 ‘‘(G) if such number is required to be sub22 mitted as part of the process for applying for

23 any type of Federal, State, or local government

24 benefit or program.
21

•S 1055 IS

1 ‘‘(g) CIVIL ACTION IN UNITED STATES DISTRICT

2 COURT; DAMAGES; ATTORNEY’S FEES AND COSTS.—

3 ‘‘(1) IN GENERAL.—Any individual aggrieved

4 by any act of any person in violation of this section

5 may bring a civil action in a United States district

6 court to recover—

7 ‘‘(A) such preliminary and equitable relief

8 as the court determines to be appropriate; and

9 ‘‘(B) the greater of—

10 ‘‘(i) actual damages;

11 ‘‘(ii) liquidated damages of $2,500; or

12 ‘‘(iii) in the case of a violation that

13 was willful and resulted in profit or mone14 tary gain, liquidated damages of $10,000.

15 ‘‘(2) STATUTE OF LIMITATIONS.—No action

16 may be commenced under this subsection more than

17 3 years after the date on which the violation was or

18 should reasonably have been discovered by the ag19 grieved individual.

20 ‘‘(3) NONEXCLUSIVE REMEDY.—The remedy

21 provided under this subsection shall be in addition to

22 any other remedy available to the individual.

23 ‘‘(h) CIVIL PENALTIES.—

24 ‘‘(1) IN GENERAL.—Any person who the Attor25 ney General determines has violated this section
22

•S 1055 IS

1 shall be subject, in addition to any other penalties

2 that may be prescribed by law—

3 ‘‘(A) to a civil penalty of not more than

4 $5,000 for each such violation; and

5 ‘‘(B) to a civil penalty of not more than

6 $50,000, if the violations have occurred with

7 such frequency as to constitute a general busi8 ness practice.

9 ‘‘(2) DETERMINATION OF VIOLATIONS.—Any

10 willful violation committed contemporaneously with

11 respect to the social security numbers of 2 or more

12 individuals by means of mail, telecommunication, or

13 otherwise, shall be treated as a separate violation

14 with respect to each such individual.

15 ‘‘(3) ENFORCEMENT PROCEDURES.—The provi16 sions of section 1128A of the Social Security Act

17 (42 U.S.C. 1320a–7a), other than subsections (a),

18 (b), (f), (h), (i), (j), (m), and (n) and the first sen19 tence of subsection (c) of such section, and the pro20 visions of subsections (d) and (e) of section 205 of

21 such Act (42 U.S.C. 405) shall apply to a civil pen22 alty under this subsection in the same manner as

23 such provisions apply to a penalty or proceeding

24 under section 1128A(a) of such Act (42 U.S.C.

25 1320a–7a(a)), except that, for purposes of this para-
23

•S 1055 IS

1 graph, any reference in section 1128A of such Act

2 (42 U.S.C. 1320a–7a) to the Secretary shall be

3 deemed to be a reference to the Attorney General.’’.

4 (2) CONFORMING AMENDMENT.—The chapter

5 analysis for chapter 47 of title 18, United States

6 Code, is amended by inserting after the item relating

7 to section 1028 the following:

‘‘1028A. Prohibition of the display, sale, or purchase of social security numbers.’’.

8 (b) CRIMINAL SANCTIONS.—Section 208(a) of the

9 Social Security Act (42 U.S.C. 408(a)) is amended—

10 (1) in paragraph (8), by inserting ‘‘or’’ after

11 the semicolon; and

12 (2) by inserting after paragraph (8) the fol13 lowing new paragraphs:

14 ‘‘(9) except as provided in paragraph (5) of sec15 tion 1028A(a) of title 18, United States Code, know16 ingly and willfully displays, sells, or purchases (as

17 those terms are defined in paragraph (1) of such

18 section) any individual’s social security number (as

19 defined in such paragraph) without the affirmatively

20 expressed consent of that individual after having met

21 the prerequisites for consent under paragraph (4) of

22 such section, electronically or in writing, with re23 spect to that individual; or
24

•S 1055 IS

1 ‘‘(10) obtains any individual’s social security

2 number for the purpose of locating or identifying the

3 individual with the intent to injure or to harm that

4 individual, or to use the identity of that individual

5 for an illegal purpose;’’.

6 (c) EFFECTIVE DATE.—Section 1028A of title 18,

7 United States Code (as added by subsection (a)), and sec8 tion 208 of the Social Security Act (42 U.S.C. 408) (as

9 amended by subsection (b)) shall take effect 30 days after

10 the date on which the final regulations promulgated under

11 section 204(b) are published in the Federal Register.

12 SEC. 203. NO PROHIBITION WITH RESPECT TO PUBLIC

13 RECORDS.

14 (a) PUBLIC RECORDS EXCEPTION.—

15 (1) IN GENERAL.—Chapter 47 of title 18,

16 United States Code (as amended by section

17 202(a)(1)), is amended by inserting after section

18 1028A the following:

19 ‘‘§ 1028B. No prohibition of the display, sale, or pur20 chase of social security numbers included

21 in public records

22 ‘‘(a) IN GENERAL.—Nothing in section 1028A shall

23 be construed to prohibit or limit the display, sale, or pur24 chase of any public record which includes a social security

25 number that—
25

•S 1055 IS

1 ‘‘(1) is incidentally included in a public record,

2 as defined in subsection (d);

3 ‘‘(2) is intended to be purchased, sold, or dis4 played pursuant to an exception contained in section

5 1028A(f);

6 ‘‘(3) is intended to be purchased, sold, or dis7 played pursuant to the consent provisions of sub8 sections (b), (c), and (e) of section 1028A; or

9 ‘‘(4) includes a redaction of the nonincidental

10 occurrences of the social security numbers when sold

11 or displayed to members of the general public.

12 ‘‘(b) AGENCY REQUIREMENTS.—Each agency in pos13 session of documents that contain social security numbers

14 which are nonincidental, shall, with respect to such

15 documents—

16 ‘‘(1) ensure that access to such numbers is re17 stricted to persons who may obtain them in accord18 ance with applicable law;

19 ‘‘(2) require an individual who is not exempt

20 under section 1028A(f) to provide the social security

21 number of the person who is the subject of the docu22 ment before making such document available; or

23 ‘‘(3) redact the social security number from the

24 document prior to providing a copy of the requested

25 document to an individual who is not exempt under
26

•S 1055 IS

1 section 1028A(f) and who is unable to provide the

2 social security number of the person who is the sub3 ject of the document.

4 ‘‘(c) RULE OF CONSTRUCTION.—Nothing in this sec5 tion shall be used as a basis for permitting or requiring

6 a State or local government entity or other repository of

7 public documents to expand or to limit access to docu8 ments containing social security numbers to entities cov9 ered by the exception in section 1028A(f).

10 ‘‘(d) DEFINITIONS.—In this section:

11 ‘‘(1) INCIDENTAL.—The term ‘incidental’

12 means that the social security number is not rou13 tinely displayed in a consistent and predictable man14 ner on the public record by a government entity,

15 such as on the face of a document.

16 ‘‘(2) PUBLIC RECORD.—The term ‘public

17 record’ means any item, collection, or grouping of in18 formation about an individual that is maintained by

19 a Federal, State, or local government entity and that

20 is made available to the public.’’.

21 (2) CONFORMING AMENDMENT.—The chapter

22 analysis for chapter 47 of title 18, United States

23 Code (as amended by section 202(a)(2)), is amended

24 by inserting after the item relating to section 1028A

25 the following:
27

•S 1055 IS

‘‘1028B. No prohibition of the display, sale, or purchase of social security numbers included in public records.’’.

1 SEC. 204. RULEMAKING AUTHORITY OF THE ATTORNEY

2 GENERAL.

3 (a) IN GENERAL.—Except as provided in subsection

4 (b), the Attorney General may prescribe such rules and

5 regulations as the Attorney General deems necessary to

6 carry out the provisions of section 202.

7 (b) BUSINESS-TO-BUSINESS COMMERCIAL DISPLAY,

8 SALE, OR PURCHASE RULEMAKING.—

9 (1) IN GENERAL.—Not later than 1 year after

10 the date of enactment of this Act, the Attorney Gen11 eral, in consultation with the Commissioner of Social

12 Security, the Federal Trade Commission, and such

13 other Federal agencies as the Attorney General de14 termines appropriate, may conduct such rulemaking

15 procedures in accordance with subchapter II of

16 chapter 5 of title 5, United States Code, as are nec17 essary to promulgate regulations to implement and

18 clarify the business-to-business provisions pertaining

19 to section 1028A(f)(1)(E) of title 18, United States

20 Code (as added by section 202(a)(1)). The Attorney

21 General shall consult with other agencies to ensure,

22 where possible, that these provisions are consistent

23 with other privacy laws, including title V of the

24 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.).
28

•S 1055 IS

1 (2) FACTORS TO BE CONSIDERED.—In promul2 gating the regulations required under paragraph (1),

3 the Attorney General shall, at a minimum, consider

4 the following factors:

5 (A) The benefit to a particular business

6 practice and to the general public of the sale or

7 purchase of an individual’s social security num8 ber.

9 (B) The risk that a particular business

10 practice will promote the use of the social secu11 rity number to commit fraud, deception, or

12 crime.

13 (C) The presence of adequate safeguards

14 to prevent the misappropriation of social secu15 rity numbers by the general public, while per16 mitting internal business uses of such numbers.

17 (D) The implementation of procedures to

18 prevent identity thieves, stalkers, and others

19 with ill intent from posing as legitimate busi20 nesses to obtain social security numbers.

21 SEC. 205. TREATMENT OF SOCIAL SECURITY NUMBERS ON

22 GOVERNMENT DOCUMENTS.

23 (a) PROHIBITION OF USE OF SOCIAL SECURITY AC24 COUNT NUMBERS ON CHECKS ISSUED FOR PAYMENT BY

25 GOVERNMENTAL AGENCIES.—
29

•S 1055 IS

1 (1) IN GENERAL.—Section 205(c)(2)(C) of the

2 Social Security Act (42 U.S.C. 405(c)(2)(C)) is

3 amended by adding at the end the following new

4 clause:

5 ‘‘(x) No Federal, State, or local agency may display

6 the social security account number of any individual, or

7 any derivative of such number, on any check issued for

8 any payment by the Federal, State, or local agency.’’.

9 (2) EFFECTIVE DATE.—The amendment made

10 by this subsection shall apply with respect to viola11 tions of section 205(c)(2)(C)(x) of the Social Secu12 rity Act (42 U.S.C. 405(c)(2)(C)(x)), as added by

13 paragraph (1), occurring after the date that is 3

14 years after the date of enactment of this Act.

15 (b) PROHIBITION OF APPEARANCE OF SOCIAL SECU16 RITY ACCOUNT NUMBERS ON DRIVER’S LICENSES OR

17 MOTOR VEHICLE REGISTRATION.—

18 (1) IN GENERAL.—Section 205(c)(2)(C)(vi) of

19 the Social Security Act (42 U.S.C. 405(c)(2)(C)(vi))

20 is amended—

21 (A) by inserting ‘‘(I)’’ after ‘‘(vi)’’; and

22 (B) by adding at the end the following new

23 subclause:

24 ‘‘(II)(aa) An agency of a State (or political subdivi25 sion thereof), in the administration of any driver’s license
30

•S 1055 IS

1 or motor vehicle registration law within its jurisdiction,

2 may not disclose the social security account numbers

3 issued by the Commissioner of Social Security, or any de4 rivative of such numbers, on any driver’s license or motor

5 vehicle registration or any other document issued by such

6 State (or political subdivision thereof) to an individual for

7 purposes of identification of such individual.

8 ‘‘(bb) Nothing in this subclause shall be construed

9 as precluding an agency of a State (or political subdivision

10 thereof), in the administration of any driver’s license or

11 motor vehicle registration law within its jurisdiction, from

12 using a social security account number for an internal use

13 or to link with the database of an agency of another State

14 that is responsible for the administration of any driver’s

15 license or motor vehicle registration law.’’.

16 (2) EFFECTIVE DATE.—The amendment made

17 by this subsection shall apply with respect to li18 censes, registrations, and other documents issued or

19 reissued after the date that is 1 year after the date

20 of enactment of this Act.

21 (c) PROHIBITION OF INMATE ACCESS TO SOCIAL SE22 CURITY ACCOUNT NUMBERS.—

23 (1) IN GENERAL.—Section 205(c)(2)(C) of the

24 Social Security Act (42 U.S.C. 405(c)(2)(C)) (as
31

•S 1055 IS

1 amended by subsection (b)) is amended by adding

2 at the end the following new clause:

3 ‘‘(xi) No Federal, State, or local agency may employ,

4 or enter into a contract for the use or employment of, pris5 oners in any capacity that would allow such prisoners ac6 cess to the social security account numbers of other indi7 viduals. For purposes of this clause, the term ‘prisoner’

8 means an individual confined in a jail, prison, or other

9 penal institution or correctional facility pursuant to such

10 individual’s conviction of a criminal offense.’’.

11 (2) EFFECTIVE DATE.—The amendment made

12 by this subsection shall apply with respect to em13 ployment of prisoners, or entry into contract with

14 prisoners, after the date that is 1 year after the date

15 of enactment of this Act.

16 SEC. 206. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL

17 SECURITY NUMBER FOR CONSUMER TRANS18 ACTIONS.

19 (a) IN GENERAL.—Part A of title XI of the Social

20 Security Act (42 U.S.C. 1301 et seq.) is amended by add21 ing at the end the following new section:
32

•S 1055 IS

1 ‘‘SEC. 1150A. LIMITS ON PERSONAL DISCLOSURE OF A SO2 CIAL SECURITY NUMBER FOR CONSUMER

3 TRANSACTIONS.

4 ‘‘(a) IN GENERAL.—A commercial entity may not re5 quire an individual to provide the individual’s social secu6 rity number when purchasing a commercial good or service

7 or deny an individual the good or service for refusing to

8 provide that number except—

9 ‘‘(1) for any purpose relating to—

10 ‘‘(A) obtaining a consumer report for any

11 purpose permitted under the Fair Credit Re12 porting Act;

13 ‘‘(B) a background check of the individual

14 conducted by a landlord, lessor, employer, vol15 untary service agency, or other entity as deter16 mined by the Attorney General;

17 ‘‘(C) law enforcement; or

18 ‘‘(D) a Federal or State law requirement;

19 or

20 ‘‘(2) if the social security number is necessary

21 to verify identity and to prevent fraud with respect

22 to the specific transaction requested by the con23 sumer and no other form of identification can

24 produce comparable information.
33

•S 1055 IS

1 ‘‘(b) OTHER FORMS OF IDENTIFICATION.—Nothing

2 in this section shall be construed to prohibit a commercial

3 entity from—

4 ‘‘(1) requiring an individual to provide 2 forms

5 of identification that do not contain the social secu6 rity number of the individual; or

7 ‘‘(2) denying an individual a good or service for

8 refusing to provide 2 forms of identification that do

9 not contain such number.

10 ‘‘(c) APPLICATION OF CIVIL MONEY PENALTIES.—

11 A violation of this section shall be deemed to be a violation

12 of section 1129(a)(3)(F).

13 ‘‘(d) APPLICATION OF CRIMINAL PENALTIES.—A vio14 lation of this section shall be deemed to be a violation of

15 section 208(a)(8).’’.

16 (b) EFFECTIVE DATE.—The amendment made by

17 subsection (a) shall apply to requests to provide a social

18 security number made on or after the date of enactment

19 of this Act.

20 SEC. 207. EXTENSION OF CIVIL MONETARY PENALTIES FOR

21 MISUSE OF A SOCIAL SECURITY NUMBER.

22 (a) TREATMENT OF WITHHOLDING OF MATERIAL

23 FACTS.—
34

•S 1055 IS

1 (1) CIVIL PENALTIES.—The first sentence of

2 section 1129(a)(1) of the Social Security Act (42

3 U.S.C. 1320a–8(a)(1)) is amended—

4 (A) by striking ‘‘who’’ and inserting

5 ‘‘who—’’;

6 (B) by striking ‘‘makes’’ and all that fol7 lows through ‘‘shall be subject to’’ and inserting

8 the following:

9 ‘‘(A) makes, or causes to be made, a statement

10 or representation of a material fact, for use in deter11 mining any initial or continuing right to or the

12 amount of monthly insurance benefits under title II

13 or benefits or payments under title VIII or XVI,

14 that the person knows or should know is false or

15 misleading;

16 ‘‘(B) makes such a statement or representation

17 for such use with knowing disregard for the truth;

18 or

19 ‘‘(C) omits from a statement or representation

20 for such use, or otherwise withholds disclosure of, a

21 fact which the individual knows or should know is

22 material to the determination of any initial or con23 tinuing right to or the amount of monthly insurance

24 benefits under title II or benefits or payments under

25 title VIII or XVI and the individual knows, or
35

•S 1055 IS

1 should know, that the statement or representation

2 with such omission is false or misleading or that the

3 withholding of such disclosure is misleading,

4 shall be subject to’’;

5 (C) by inserting ‘‘or each receipt of such

6 benefits while withholding disclosure of such

7 fact’’ after ‘‘each such statement or representa8 tion’’;

9 (D) by inserting ‘‘or because of such with10 holding of disclosure of a material fact’’ after

11 ‘‘because of such statement or representation’’;

12 and

13 (E) by inserting ‘‘or such a withholding of

14 disclosure’’ after ‘‘such a statement or rep15 resentation’’.

16 (2) ADMINISTRATIVE PROCEDURE FOR IMPOS17 ING PENALTIES.—The first sentence of section

18 1129A(a) of the Social Security Act (42 U.S.C.

19 1320a–8a(a)) is amended—

20 (A) by striking ‘‘who’’ and inserting

21 ‘‘who—’’; and

22 (B) by striking ‘‘makes’’ and all that fol23 lows through ‘‘shall be subject to’’ and inserting

24 the following new paragraphs:
36

•S 1055 IS

1 ‘‘(1) makes, or causes to be made, a statement

2 or representation of a material fact, for use in deter3 mining any initial or continuing right to or the

4 amount of monthly insurance benefits under title II

5 or benefits or payments under title VIII or XVI,

6 that the person knows or should know is false or

7 misleading;

8 ‘‘(2) makes such a statement or representation

9 for such use with knowing disregard for the truth;

10 or

11 ‘‘(3) omits from a statement or representation

12 for such use, or otherwise withholds disclosure of, a

13 fact which the individual knows or should know is

14 material to the determination of any initial or con15 tinuing right to or the amount of monthly insurance

16 benefits under title II or benefits or payments under

17 title VIII or XVI and the individual knows, or

18 should know, that the statement or representation

19 with such omission is false or misleading or that the

20 withholding of such disclosure is misleading,

21 shall be subject to’’.

22 (b) APPLICATION OF CIVIL MONEY PENALTIES TO

23 ELEMENTS OF CRIMINAL VIOLATIONS.—Section 1129(a)

24 of the Social Security Act (42 U.S.C. 1320a–8(a)), as

25 amended by subsection (a)(1), is amended—
37

•S 1055 IS

1 (1) by redesignating paragraph (2) as para2 graph (4);

3 (2) by redesignating the last sentence of para4 graph (1) as paragraph (2) and inserting such para5 graph after paragraph (1); and

6 (3) by inserting after paragraph (2) (as so re7 designated) the following new paragraph:

8 ‘‘(3) Any person (including an organization, agency,

9 or other entity) who—

10 ‘‘(A) uses a social security account number that

11 such person knows or should know has been as12 signed by the Commissioner of Social Security (in an

13 exercise of authority under section 205(c)(2) to es14 tablish and maintain records) on the basis of false

15 information furnished to the Commissioner by any

16 person;

17 ‘‘(B) falsely represents a number to be the so18 cial security account number assigned by the Com19 missioner of Social Security to any individual, when

20 such person knows or should know that such number

21 is not the social security account number assigned

22 by the Commissioner to such individual;

23 ‘‘(C) knowingly alters a social security card

24 issued by the Commissioner of Social Security, or

25 possesses such a card with intent to alter it;
38

•S 1055 IS

1 ‘‘(D) knowingly displays, sells, or purchases a

2 card that is, or purports to be, a card issued by the

3 Commissioner of Social Security, or possesses such

4 a card with intent to display, purchase, or sell it;

5 ‘‘(E) counterfeits a social security card, or pos6 sesses a counterfeit social security card with intent

7 to display, sell, or purchase it;

8 ‘‘(F) discloses, uses, compels the disclosure of,

9 or knowingly displays, sells, or purchases the social

10 security account number of any person in violation

11 of the laws of the United States;

12 ‘‘(G) with intent to deceive the Commissioner of

13 Social Security as to such person’s true identity (or

14 the true identity of any other person) furnishes or

15 causes to be furnished false information to the Com16 missioner with respect to any information required

17 by the Commissioner in connection with the estab18 lishment and maintenance of the records provided

19 for in section 205(c)(2);

20 ‘‘(H) offers, for a fee, to acquire for any indi21 vidual, or to assist in acquiring for any individual,

22 an additional social security account number or a

23 number which purports to be a social security ac24 count number; or
39

•S 1055 IS

1 ‘‘(I) being an officer or employee of a Federal,

2 State, or local agency in possession of any individ3 ual’s social security account number, willfully acts or

4 fails to act so as to cause a violation by such agency

5 of clause (vi)(II) or (x) of section 205(c)(2)(C),

6 shall be subject to, in addition to any other penalties that

7 may be prescribed by law, a civil money penalty of not

8 more than $5,000 for each violation. Such person shall

9 also be subject to an assessment, in lieu of damages sus10 tained by the United States resulting from such violation,

11 of not more than twice the amount of any benefits or pay12 ments paid as a result of such violation.’’.

13 (c) CLARIFICATION OF TREATMENT OF RECOVERED

14 AMOUNTS.—Section 1129(e)(2)(B) of the Social Security

15 Act (42 U.S.C. 1320a–8(e)(2)(B)) is amended by striking

16 ‘‘In the case of amounts recovered arising out of a deter17 mination relating to title VIII or XVI,’’ and inserting ‘‘In

18 the case of any other amounts recovered under this sec19 tion,’’.

20 (d) CONFORMING AMENDMENTS.—

21 (1) Section 1129(b)(3)(A) of the Social Secu22 rity Act (42 U.S.C. 1320a–8(b)(3)(A)) is amended

23 by striking ‘‘charging fraud or false statements’’.

24 (2) Section 1129(c)(1) of the Social Security

25 Act (42 U.S.C. 1320a–8(c)(1)) is amended by strik-
40

•S 1055 IS

1 ing ‘‘and representations’’ and inserting ‘‘, represen2 tations, or actions’’.

3 (3) Section 1129(e)(1)(A) of the Social Security

4 Act (42 U.S.C. 1320a–8(e)(1)(A)) is amended by

5 striking ‘‘statement or representation referred to in

6 subsection (a) was made’’ and inserting ‘‘violation

7 occurred’’.

8 (e) EFFECTIVE DATES.—

9 (1) IN GENERAL.—Except as provided in para10 graph (2), the amendments made by this section

11 shall apply with respect to violations of sections

12 1129 and 1129A of the Social Security Act (42

13 U.S.C. 1320–8 and 1320a–8a), as amended by this

14 section, committed after the date of enactment of

15 this Act.

16 (2) VIOLATIONS BY GOVERNMENT AGENTS IN

17 POSSESSION OF SOCIAL SECURITY NUMBERS.—Sec18 tion 1129(a)(3)(I) of the Social Security Act (42

19 U.S.C. 1320a–8(a)(3)(I)), as added by subsection

20 (b), shall apply with respect to violations of that sec21 tion occurring on or after the effective date under

22 section 202(c).
41

•S 1055 IS

1 TITLE III—LIMITATIONS ON

2 SALE AND SHARING OF NON3 PUBLIC PERSONAL FINAN4 CIAL INFORMATION

5 SEC. 301. DEFINITION OF SALE.

6 Section 509 of the Gramm-Leach-Bliley Act (15

7 U.S.C. 6809) is amended by adding at the end the fol8 lowing:

9 ‘‘(12) SALE.—The terms ‘sale’, ‘sell’, and ‘sold’,

10 with respect to nonpublic personal information,

11 mean the exchange of such information for any

12 thing of value, directly or indirectly, including the li13 censing, bartering, or renting of such information.’’.

14 SEC. 302. RULES APPLICABLE TO SALE OF NONPUBLIC

15 PERSONAL INFORMATION.

16 Section 502 of the Gramm-Leach-Bliley Act (15

17 U.S.C. 6802) is amended—

18 (1) in the section heading, by inserting ‘‘AND

19 SALES’’ after ‘‘DISCLOSURES’’;

20 (2) in subsection (a), by inserting ‘‘or sell’’

21 after ‘‘disclose’’;

22 (3) in subsection (b)—

23 (A) in the heading, by inserting ‘‘FOR CER24 TAIN DISCLOSURES’’ before the period; and

25 (B) by adding at the end the following:
42

•S 1055 IS

1 ‘‘(3) LIMITATION.—Paragraphs (1) and (2) do

2 not apply to the sale of nonpublic personal informa3 tion.’’;

4 (4) by striking subsection (e);

5 (5) by redesignating subsections (c) and (d) as

6 subsections (d) and (e), respectively; and

7 (6) by inserting after subsection (b) the fol8 lowing:

9 ‘‘(c) OPT-IN FOR SALE OF INFORMATION.—

10 ‘‘(1) AFFIRMATIVE CONSENT REQUIRED.—Each

11 agency or authority described in section 504(a)

12 shall, by rule prescribed under that section, prohibit

13 a financial institution that is subject to its jurisdic14 tion from selling any nonpublic personal information

15 to any nonaffiliated third party, unless the consumer

16 to whom the information pertains—

17 ‘‘(A) has affirmatively consented in accord18 ance with such rule to the sale of such informa19 tion; and

20 ‘‘(B) has not withdrawn the consent.

21 ‘‘(2) DENIAL OF SERVICE PROHIBITED.—The

22 rule prescribed pursuant to paragraph (1) shall pro23 hibit a financial institution from denying any con24 sumer a financial product or a financial service for
43

•S 1055 IS

1 the refusal by the consumer to grant the consent re2 quired by such rule.’’.

3 SEC. 303. EXCEPTIONS TO SALE PROHIBITION.

4 Section 502 of the Gramm-Leach-Bliley Act (15

5 U.S.C. 6802), as amended by this title, is amended by

6 adding at the end the following:

7 ‘‘(f) GENERAL EXCEPTIONS.—This section does not

8 prohibit—

9 ‘‘(1) the sale or other disclosure of nonpublic

10 personal information to a nonaffiliated third party—

11 ‘‘(A) as necessary to effect, administer, or

12 enforce a transaction requested or authorized

13 by the consumer to whom the information per14 tains, or in connection with—

15 ‘‘(i) servicing or processing a financial

16 product or service requested or authorized

17 by the consumer;

18 ‘‘(ii) maintaining or servicing the ac19 count of the consumer with the financial

20 institution, or with another entity as part

21 of a private label credit card program or

22 other extension of credit on behalf of such

23 entity; or

24 ‘‘(iii) a proposed or actual

25 securitization, secondary market sale (in-
44

•S 1055 IS

1 cluding sales of servicing rights), or similar

2 transaction related to a transaction of the

3 consumer;

4 ‘‘(B) with the consent or at the direction

5 of the consumer, in accordance with applicable

6 rules prescribed under this subtitle;

7 ‘‘(C) to the extent specifically permitted or

8 required under other provisions of law and in

9 accordance with the Right to Financial Privacy

10 Act of 1978; or

11 ‘‘(D) to law enforcement agencies (includ12 ing a Federal functional regulator, the Sec13 retary of the Treasury, with respect to sub14 chapter II of chapter 53 of title 31, United

15 States Code, and chapter 2 of title I of Public

16 Law 91–508 (12 U.S.C. 1951–1959), a State

17 insurance authority, or the Federal Trade Com18 mission), self-regulatory organizations, or for

19 an investigation on a matter related to public

20 safety; or

21 ‘‘(2) the disclosure, other than the sale, of non22 public personal information—

23 ‘‘(A) to protect the confidentiality or secu24 rity of the records of the financial institution
45

•S 1055 IS

1 pertaining to the consumer, the service or prod2 uct, or the transaction therein;

3 ‘‘(B) to protect against or prevent actual

4 or potential fraud, unauthorized transactions,

5 claims, or other liability;

6 ‘‘(C) for required institutional risk control,

7 or for resolving customer disputes or inquiries;

8 ‘‘(D) to persons holding a legal or bene9 ficial interest relating to the consumer;

10 ‘‘(E) to persons acting in a fiduciary or

11 representative capacity on behalf of the con12 sumer;

13 ‘‘(F) to provide information to insurance

14 rate advisory organizations, guaranty funds or

15 agencies, applicable rating agencies of the fi16 nancial institution, persons assessing the com17 pliance of the institution with industry stand18 ards, or the attorneys, accountants, or auditors

19 of the institution;

20 ‘‘(G) to a consumer reporting agency, in

21 accordance with the Fair Credit Reporting Act

22 or from a consumer report reported by a con23 sumer reporting agency, as those terms are de24 fined in that Act;
46

•S 1055 IS

1 ‘‘(H) in connection with a proposed or ac2 tual sale, merger, transfer, or exchange of all or

3 a portion of a business or operating unit if the

4 disclosure of nonpublic personal information

5 concerns solely consumers of such business or

6 unit;

7 ‘‘(I) to comply with Federal, State, or local

8 laws, rules, or other applicable legal require9 ments, or with a properly authorized civil,

10 criminal, or regulatory investigation or sub11 poena or summons by Federal, State, or local

12 authorities; or

13 ‘‘(J) to respond to judicial process or gov14 ernment regulatory authorities having jurisdic15 tion over the financial institution for examina16 tion, compliance, or other purposes, as author17 ized by law.’’.

18 SEC. 304. EFFECTIVE DATE.

19 This title shall take effect 6 months after the date

20 on which the rules are required to be prescribed under

21 section 504(a)(3).
47

•S 1055 IS

1 TITLE IV—LIMITATIONS ON THE

2 PROVISION OF PROTECTED

3 HEALTH INFORMATION

4 SEC. 401. DEFINITIONS.

5 In this title:

6 (1) BUSINESS ASSOCIATE.—

7 (A) IN GENERAL.—Except as provided in

8 subparagraph (B), the term ‘‘business asso9 ciate’’ means, with respect to a covered entity,

10 a person who—

11 (i) on behalf of such covered entity or

12 of an organized health care arrangement in

13 which the covered entity participates, but

14 other than in the capacity of a member of

15 the workforce of such covered entity or ar16 rangement, performs, or assists in the per17 formance of—

18 (I) a function or activity involv19 ing the use or disclosure of individ20 ually identifiable health information,

21 including claims processing or admin22 istration, data analysis, processing or

23 administration, utilization review,

24 quality assurance, billing, benefit
48

•S 1055 IS

1 management, practice management,

2 and repricing; or

3 (II) any other function or activity

4 regulated under parts 160 through

5 164 of title 45, Code of Federal Regu6 lations; or

7 (ii) provides, other than in the capac8 ity of a member of the workforce of such

9 covered entity, legal, actuarial, accounting,

10 consulting, data aggregation, management,

11 administrative, accreditation, or financial

12 services to or for such covered entity, or to

13 or for an organized health care arrange14 ment in which the covered entity partici15 pates, where the provision of the service in16 volves the disclosure of individually identi17 fiable health information from such cov18 ered entity or arrangement, or from an19 other business associate of such covered

20 entity or arrangement, to the person.

21 (B) LIMITATIONS.—

22 (i) IN GENERAL.—A covered entity

23 participating in an organized health care

24 arrangement that performs a function or

25 activity as described by subparagraph
49

•S 1055 IS

1 (A)(i) for or on behalf of such organized

2 health care arrangement, or that provides

3 a service as described in subparagraph

4 (A)(ii) to or for such organized health care

5 arrangement, does not, simply through the

6 performance of such function or activity or

7 the provision of such service, become a

8 business associate of other covered entities

9 participating in such organized health care

10 arrangement.

11 (ii) LIMITATION.—A covered entity

12 may be a business associate of another cov13 ered entity.

14 (2) COVERED ENTITY.—The term ‘‘covered en15 tity’’ means—

16 (A) a health plan;

17 (B) a health care clearinghouse; and

18 (C) a health care provider who transmits

19 any health information in electronic form in

20 connection with a transaction covered by parts

21 160 through 164 of title 45, Code of Federal

22 Regulations.

23 (3) DISCLOSURE.—The term ‘‘disclosure’’

24 means the release, transfer, provision of access to, or
50

•S 1055 IS

1 divulging in any other manner of information out2 side the entity holding the information.

3 (4) EMPLOYER.—The term ‘‘employer’’ means

4 a person or organization for whom an individual per5 forms or has performed any service, of whatever na6 ture, as the employee of that person or organization,

7 except that—

8 (A) if the person for whom the individual

9 performs or has performed the service does not

10 have control of the payment of wages for such

11 service, the term ‘‘employer’’ means the person

12 having control of the payment of those wages;

13 and

14 (B) in the case of a person paying wages

15 on behalf of a nonresident alien individual, for16 eign partnership, or foreign corporation, not en17 gaged in trade or business within the United

18 States, the term ‘‘employer’’ means that person.

19 (5) GROUP HEALTH PLAN.—The term ‘‘group

20 health plan’’ means an employee welfare benefit plan

21 (as defined in section 3(1) of the Employee Retire22 ment Income and Security Act of 1974 (29 U.S.C.

23 1002(1)), including insured and self-insured plans,

24 to the extent that the plan provides medical care (as

25 defined in section 2791(a)(2) of the Public Health
51

•S 1055 IS

1 Service Act, 42 U.S.C. 300gg–91(a)(2)), including

2 items and services paid for as medical care, to em3 ployees or their dependents directly or through in4 surance, reimbursement, or otherwise, that—

5 (A) has 50 or more participants (as de6 fined in section 3(7) of Employee Retirement

7 Income and Security Act of 1974, 29 U.S.C.

8 1002(7)); or

9 (B) is administered by an entity other than

10 the employer that established and maintains the

11 plan.

12 (6) HEALTH CARE.—The term ‘‘health care’’

13 means care, services, or supplies related to the

14 health of an individual, including—

15 (A) preventive, diagnostic, therapeutic, re16 habilitative, maintenance, or palliative care and

17 counseling services, assessment, or procedure

18 with respect to the physical or mental condition,

19 or functional status, of an individual or that af20 fects the structure or function of the body; and

21 (B) a sale or dispensing of a drug, device,

22 equipment, or other item in accordance with a

23 prescription.

24 (7) HEALTH CARE CLEARINGHOUSE.—The term

25 ‘‘health care clearinghouse’’ means a public or pri-
52

•S 1055 IS

1 vate entity, including a billing service, repricing com2 pany, community health management information

3 system or community health information system,

4 and value-added networks and switches, that—

5 (A) processes or facilitates the processing

6 of health information received from another en7 tity in a nonstandard format or containing non8 standard data content into standard data ele9 ments or a standard transaction; or

10 (B) receives a standard transaction from

11 another entity and processes or facilitates the

12 processing of health information into non13 standard format or nonstandard data content

14 for the receiving entity.

15 (8) HEALTH CARE PROVIDER.—The term

16 ‘‘health care provider’’ has the same meaning given

17 the terms ‘‘provider of services’’ and ‘‘provider of

18 medical or health services’’ in subsections (u) and

19 (s) of section 1861 of the Social Security Act (42

20 U.S.C. 1395x), and includes any other person or or21 ganization who furnishes, bills, or is paid for health

22 care in the normal course of business.

23 (9) HEALTH INFORMATION.—The term ‘‘health

24 information’’ means any information, whether oral

25 or recorded in any form or medium, that—
53

•S 1055 IS

1 (A) is created or received by a health care

2 provider, health plan, public health authority,

3 employer, life insurer, school or university, or

4 health care clearinghouse; and

5 (B) relates to the past, present, or future

6 physical or mental health or condition of an in7 dividual; the provision of health care to an indi8 vidual; or the past, present, or future payment

9 for the provision of health care to an individual.

10 (10) HEALTH INSURANCE ISSUER.—The term

11 ‘‘health insurance issuer’’ means a health insurance

12 issuer (as defined in section 2791(b)(2) of the Pub13 lic Health Service Act, 42 U.S.C. 300gg–91(b)(2))

14 and used in the definition of health plan in this sec15 tion and includes an insurance company, insurance

16 service, or insurance organization (including an

17 HMO) that is licensed to engage in the business of

18 insurance in a State and is subject to State law that

19 regulates insurance. Such term does not include a

20 group health plan.

21 (11) HEALTH MAINTENANCE ORGANIZATION.—

22 The term ‘‘health maintenance organization’’

23 (HMO) (as defined in section 2791(b)(3) of the

24 Public Health Service Act, 42 U.S.C. 300gg–91

25 (b)(3)) and used in the definition of health plan in
54

•S 1055 IS

1 this section, means a federally qualified HMO, an

2 organization recognized as an HMO under State

3 law, or a similar organization regulated for solvency

4 under State law in the same manner and to the

5 same extent as such an HMO.

6 (12) HEALTH OVERSIGHT AGENCY.—The term

7 ‘‘health oversight agency’’ means an agency or au8 thority of the United States, a State, a territory, a

9 political subdivision of a State or territory, or an In10 dian tribe, or a person or entity acting under a

11 grant of authority from or contract with such public

12 agency, including the employees or agents of such

13 public agency or its contractors or persons or enti14 ties to whom it has granted authority, that is au15 thorized by law to oversee the health care system

16 (whether public or private) or government programs

17 in which health information is necessary to deter18 mine eligibility or compliance, or to enforce civil

19 rights laws for which health information is relevant.

20 (13) HEALTH PLAN.—The term ‘‘health plan’’

21 means an individual or group plan that provides, or

22 pays the cost of, medical care, as defined in section

23 2791(a)(2) of the Public Health Service Act (42

24 U.S.C. 300gg–91(a)(2))—

25 (A) including, singly or in combination—
55

•S 1055 IS

1 (i) a group health plan;

2 (ii) a health insurance issuer;

3 (iii) an HMO;

4 (iv) part A or B of the medicare pro5 gram under title XVIII of the Social Secu6 rity Act (42 U.S.C. 1395 et seq.);

7 (v) the medicaid program under title

8 XIX of the Social Security Act (42 U.S.C.

9 1396 et seq.);

10 (vi) an issuer of a medicare supple11 mental policy (as defined in section

12 1882(g)(1) of the Social Security Act, 42

13 U.S.C. 1395ss(g)(1));

14 (vii) an issuer of a long-term care pol15 icy, excluding a nursing home fixed-indem16 nity policy;

17 (viii) an employee welfare benefit plan

18 or any other arrangement that is estab19 lished or maintained for the purpose of of20 fering or providing health benefits to the

21 employees of 2 or more employers;

22 (ix) the health care program for active

23 military personnel under title 10, United

24 States Code;
56

•S 1055 IS

1 (x) the veterans health care program

2 under chapter 17 of title 38, United States

3 Code;

4 (xi) the Civilian Health and Medical

5 Program of the Uniformed Services

6 (CHAMPUS) (as defined in section

7 1072(4) of title 10, United States Code);

8 (xii) the Indian Health Service pro9 gram under the Indian Health Care Im10 provement Act (25 U.S.C. 1601 et seq.);

11 (xiii) the Federal Employees Health

12 Benefits Program under chapter 89 of title

13 5, United States Code;

14 (xiv) an approved State child health

15 plan under title XXI of the Social Security

16 Act (42 U.S.C. 1397aa et seq.), providing

17 benefits for child health assistance that

18 meet the requirements of section 2103 of

19 such Act (42 U.S.C. 1397cc);

20 (xv) the Medicare+Choice program

21 under part C of title XVIII of the Social

22 Security Act (42 U.S.C. 1395w–21 et

23 seq.);

24 (xvi) a high risk pool that is a mecha25 nism established under State law to pro-
57

•S 1055 IS

1 vide health insurance coverage or com2 parable coverage to eligible individuals; and

3 (xvii) any other individual or group

4 plan, or combination of individual or group

5 plans, that provides or pays for the cost of

6 medical care (as defined in section

7 2791(a)(2) of the Public Health Service

8 Act (42 U.S.C. 300gg–91(a)(2)); and

9 (B) excluding—

10 (i) any policy, plan, or program to the

11 extent that it provides, or pays for the cost

12 of, excepted benefits that are listed in sec13 tion 2791(c)(1) of the Public Health Serv14 ice Act (42 U.S.C. 300gg–91(c)(1)); and

15 (ii) a government-funded program

16 (other than 1 listed in clause (i) through

17 (xvi) of paragraph (1)), whose principal

18 purpose is other than providing, or paying

19 the cost of, health care, or whose principal

20 activity is the direct provision of health

21 care to persons, or the making of grants to

22 fund the direct provision of health care to

23 persons.

24 (14) INDIVIDUALLY IDENTIFIABLE HEALTH IN25 FORMATION.—The term ‘‘individually identifiable
58

•S 1055 IS

1 health information’’ means information that is a

2 subset of health information, including demographic

3 information collected from an individual, that—

4 (A) is created or received by a covered en5 tity or employer; and

6 (B)(i) relates to the past, present, or fu7 ture physical or mental health or condition of

8 an individual, the provision of health care to an

9 individual, or the past, present, or future pay10 ment for the provision of health care to an indi11 vidual; and

12 (ii)(I) identifies an individual; or

13 (II) with respect to which there is a rea14 sonable basis to believe that the information

15 can be used to identify an individual.

16 (15) LAW ENFORCEMENT OFFICIAL.—The term

17 ‘‘law enforcement official’’ means an officer or em18 ployee of any agency or authority of the United

19 States, a State, a territory, a political subdivision of

20 a State or territory, or an Indian tribe, who is em21 powered by law to—

22 (A) investigate or conduct an official in23 quiry into a potential violation of law; or
59

•S 1055 IS

1 (B) prosecute or otherwise conduct a

2 criminal, civil, or administrative proceeding

3 arising from an alleged violation of law.

4 (16) LIFE INSURER.—The term ‘‘life insurer’’

5 means a life insurance company (as defined in sec6 tion 816 of the Internal Revenue Code of 1986), in7 cluding the employees and agents of such company.

8 (17) MARKETING.—

9 (A) IN GENERAL.—The term ‘‘marketing’’

10 means to make a communication about a prod11 uct or service a purpose of which is to encour12 age recipients of the communication to pur13 chase or use the product or service.

14 (B) LIMITATION.—Such term does not in15 clude communications that meet the require16 ments of subparagraph (C) and that are made

17 by a covered entity—

18 (i) for the purpose of describing the

19 entities participating in a health care pro20 vider network or health plan network, or

21 for the purpose of describing if and the ex22 tent to which a product or service (or pay23 ment for such product or service) is pro24 vided by a covered entity or included in a

25 plan of benefits; or
60

•S 1055 IS

1 (ii) that are tailored to the cir2 cumstances of a particular individual and

3 the communications are—

4 (I) made by a health care pro5 vider to an individual as part of the

6 treatment of the individual, and for

7 the purpose of furthering the treat8 ment of that individual; or

9 (II) made by a health care pro10 vider to an individual in the course of

11 managing the treatment of that indi12 vidual, or for the purpose of directing

13 or recommending to that individual al14 ternative treatments, therapies, health

15 care providers, or settings of care.

16 (C) NOT INCLUDED.—A communication

17 described in subparagraph (B) is not included

18 in marketing if—

19 (i) the communication is made orally;

20 or

21 (ii) the communication is in writing

22 and the covered entity does not receive di23 rect or indirect remuneration from a third

24 party for making the communication.

25 (18) NONCOVERED ENTITY.—
61

•S 1055 IS

1 (A) IN GENERAL.—The term ‘‘noncovered

2 entity’’ means any person or public or private

3 entity, including but not limited to a health re4 searcher, school or university, life insurer, em5 ployer, public health authority, health oversight

6 agency, or law enforcement official, or any per7 son acting as an agent of such entities or per8 sons, that is not a covered entity.

9 (B) LIMITATION.—The term ‘‘noncovered

10 entity’’ includes a covered entity if such covered

11 entity is acting as a business associate.

12 (19) ORGANIZED HEALTH CARE ARRANGE13 MENT.—The term ‘‘organized health care arrange14 ment’’ means—

15 (A) a clinically integrated care setting in

16 which individuals typically receive health care

17 from more than 1 health care provider;

18 (B) an organized system of health care in

19 which more than 1 covered entity participates,

20 and in which the participating covered

21 entities—

22 (i) hold themselves out to the public

23 as participating in a joint arrangement;

24 and
62

•S 1055 IS

1 (ii) participate in joint activities in2 cluding at least—

3 (I) utilization review, in which

4 health care decisions by participating

5 covered entities are reviewed by other

6 participating covered entities or by a

7 third party on their behalf;

8 (II) quality assessment and im9 provement activities, in which treat10 ment provided by participating cov11 ered entities is assessed by other par12 ticipating covered entities or by a

13 third party on their behalf; or

14 (III) payment activities, if the fi15 nancial risk for delivering health care

16 is shared, in part or in whole, by par17 ticipating covered entities through the

18 joint arrangement and if protected

19 health information created or received

20 by a covered entity is reviewed by

21 other participating covered entities or

22 by a third party on their behalf for

23 the purpose of administering the shar24 ing of financial risk;
63

•S 1055 IS

1 (C) a group health plan and a health in2 surance issuer or HMO with respect to such

3 group health plan, but only with respect to pro4 tected health information created or received by

5 such health insurance issuer or HMO that re6 lates to individuals who are or who have been

7 participants or beneficiaries in such group

8 health plan;

9 (D) a group health plan and 1 or more

10 other group health plans each of which are

11 maintained by the same plan sponsor; or

12 (E) the group health plans described in

13 subparagraph (D) and health insurance issuers

14 or HMOs with respect to such group health

15 plans, but only with respect to protected health

16 information created or received by such health

17 insurance issuers or HMOs that relates to indi18 viduals who are or have been participants or

19 beneficiaries in any of such group health plans.

20 (20) PROTECTED HEALTH INFORMATION.—The

21 term ‘‘protected health information’’ means individ22 ually identifiable health information that is in any

23 form or medium. The term does not include individ24 ually identifiable health information in education
64

•S 1055 IS

1 records covered by section 444 of the General Edu2 cation Provisions Act (20 U.S.C. 1232g).

3 (21) PUBLIC HEALTH AUTHORITY.—The term

4 ‘‘public health authority’’ means an agency or au5 thority of the United States, a State, a territory, a

6 political subdivision of a State or territory, or an In7 dian tribe, or a person or entity acting under a

8 grant of authority from or contract with such public

9 agency, including employees or agents of such public

10 agency or its contractors or persons or entities to

11 whom it has granted authority, that is responsible

12 for public health matters as part of its official man13 date.

14 (22) SCHOOL OR UNIVERSITY.—The term

15 ‘‘school or university’’ means an institution or place

16 for instruction or education, including an elementary

17 school, secondary school, or institution of higher

18 learning, a college, or an assemblage of colleges

19 united under 1 corporate organization or govern20 ment.

21 (23) SECRETARY.—The term ‘‘Secretary’’

22 means the Secretary of Health and Human Services.

23 (24) SALE; SELL; SOLD.—The terms ‘‘sale’’,

24 ‘‘sell’’, and ‘‘sold’’, with respect to protected health

25 information, mean the exchange of such information
65

•S 1055 IS

1 for anything of value, directly or indirectly, including

2 the licensing, bartering, or renting of such informa3 tion.

4 (25) USE.—The term ‘‘use’’ means, with re5 spect to individually identifiable health information,

6 the sharing, employment, application, utilization, ex7 amination, or analysis of such information within an

8 entity that maintains such information.

9 (26) WRITING.—The term ‘‘writing’’ means

10 writing in either a paper-based or computer-based

11 form, including electronic and digital signatures.

12 SEC. 402. PROHIBITION AGAINST SELLING PROTECTED

13 HEALTH INFORMATION.

14 (a) IN GENERAL.—A noncovered entity shall not sell

15 the protected health information of an individual without

16 an authorization that is valid under section 403. When

17 a noncovered entity obtains or receives authorization to

18 sell such information, such sale must be consistent with

19 such authorization.

20 (b) SCOPE.—A sale of protected health information

21 as described under subsection (a) shall be limited to the

22 minimum amount of information necessary to accomplish

23 the purpose for which the sale is made.

24 (c) PURPOSE.—A recipient of information sold pursu25 ant to this title may use or disclose such information solely
66

•S 1055 IS

1 to carry out the purpose for which the information was

2 sold.

3 (d) NOT REQUIRED.—Nothing in this title permitting

4 the sale of protected health information shall be construed

5 to require such sale.

6 (e) IDENTIFICATION OF INFORMATION AS PRO7 TECTED HEALTH INFORMATION.—Information sold pur8 suant to this title shall be clearly identified as protected

9 health information.

10 (f) NO WAIVER.—Except as provided in this title, an

11 individual’s authorization to sell protected health informa12 tion shall not be construed as a waiver of any rights that

13 the individual has under other Federal or State laws, the

14 rules of evidence, or common law.

15 SEC. 403. AUTHORIZATION FOR SALE OF PROTECTED

16 HEALTH INFORMATION.

17 (a) VALID AUTHORIZATION.—A valid authorization is

18 a document that complies with all requirements of this

19 section. Such authorization may include additional infor20 mation not required under this section, provided that such

21 information is not inconsistent with the requirements of

22 this section.

23 (b) DEFECTIVE AUTHORIZATION.—An authorization

24 is not valid, if the document submitted has any of the fol25 lowing defects:
67

•S 1055 IS

1 (1) The expiration date has passed or the expi2 ration event is known by the noncovered entity to

3 have occurred.

4 (2) The authorization has not been filled out

5 completely, with respect to an element described in

6 subsections (e) and (f).

7 (3) The authorization is known by the non8 covered entity to have been revoked.

9 (4) The authorization lacks an element required

10 by subsections (e) and (f).

11 (5) Any material information in the authoriza12 tion is known by the noncovered entity to be false.

13 (c) REVOCATION OF AUTHORIZATION.—An individual

14 may revoke an authorization provided under this section

15 at any time provided that the revocation is in writing, ex16 cept to the extent that the noncovered entity has taken

17 action in reliance thereon.

18 (d) DOCUMENTATION.—

19 (1) IN GENERAL.—A noncovered entity must

20 document and retain any signed authorization under

21 this section as required under paragraph (2).

22 (2) STANDARD.—A noncovered entity shall, if a

23 communication is required by this title to be in writ24 ing, maintain such writing, or an electronic copy, as

25 documentation.
68

•S 1055 IS

1 (3) RETENTION PERIOD.—A noncovered entity

2 shall retain the documentation required by this sec3 tion for 6 years from the date of its creation or the

4 date when it last was in effect, whichever is later.

5 (e) CONTENT OF AUTHORIZATION.—

6 (1) CONTENT.—An authorization described in

7 subsection (a) shall—

8 (A) contain a description of the informa9 tion to be sold that identifies such information

10 in a specific and meaningful manner;

11 (B) contain the name or other specific

12 identification of the person, or class of persons,

13 authorized to sell the information;

14 (C) contain the name or other specific

15 identification of the person, or class of persons,

16 to whom the information is to be sold;

17 (D) include an expiration date or an expi18 ration event relating to the selling of such infor19 mation that signifies that the authorization is

20 valid until such date or event;

21 (E) include a statement that the individual

22 has a right to revoke the authorization in writ23 ing and the exceptions to the right to revoke,

24 and a description of the procedure involved in

25 such revocation;
69

•S 1055 IS

1 (F) be in writing and include the signature

2 of the individual and the date, or if the author3 ization is signed by a personal representative of

4 the individual, a description of such representa5 tive’s authority to act for the individual; and

6 (G) include a statement explaining the

7 purpose for which such information is sold.

8 (2) PLAIN LANGUAGE.—The authorization shall

9 be written in plain language.

10 (f) NOTICE.—

11 (1) IN GENERAL.—The authorization shall in12 clude a statement that the individual may—

13 (A) inspect or copy the protected health in14 formation to be sold; and

15 (B) refuse to sign the authorization.

16 (2) COPY TO THE INDIVIDUAL.—A noncovered

17 entity shall provide the individual with a copy of the

18 signed authorization.

19 (g) MODEL AUTHORIZATIONS.—The Secretary, after

20 notice and opportunity for public comment, shall develop

21 and disseminate model written authorizations of the type

22 described in this section and model statements of the limi23 tations on such authorizations. Any authorization obtained

24 on a model authorization form developed by the Secretary
70

•S 1055 IS

1 pursuant to the preceding sentence shall be deemed to sat2 isfy the requirements of this section.

3 (h) NONCOERCION.—A covered entity or noncovered

4 entity shall not condition the purchase of a product or the

5 provision of a service to an individual based on whether

6 such individual provides an authorization to such entity

7 as described in this section.

8 SEC. 404. PROHIBITION AGAINST RETALIATION.

9 A noncovered entity that collects protected health in10 formation, may not adversely affect another person, di11 rectly or indirectly, because such person has exercised a

12 right under this title, disclosed information relating to a

13 possible violation of this title, or associated with, or as14 sisted, a person in the exercise of a right under this title.

15 SEC. 405. PROHIBITION AGAINST MARKETING PROTECTED

16 HEALTH INFORMATION.

17 (a) IN GENERAL.—Notwithstanding any other provi18 sion of law, a covered entity or noncovered entity shall

19 not use, disclose, or sell protected health information for

20 marketing without an authorization that is valid under

21 subsection (c), except as provided in subsection (b).

22 (b) EXCEPTION.—A health care provider may use or

23 disclose protected health information for marketing with24 out an authorization when it uses or discloses such infor25 mation to make a marketing communication to an indi-
71

•S 1055 IS

1 vidual if the communication occurs in a face-to-face en2 counter between the health care provider and the indi3 vidual.

4 (c) AUTHORIZATION.—

5 (1) IN GENERAL.—An authorization under sub6 section (a) shall—

7 (A) contain a description of the informa8 tion to be used, disclosed, or sold that identifies

9 such information in a specific and meaningful

10 manner;

11 (B) contain the name or other specific

12 identification of the person, or class of persons,

13 authorized to use, disclose, or sell the informa14 tion;

15 (C) identify persons to whom the informa16 tion is to be provided or sold;

17 (D) include an expiration date or an expi18 ration event relating to the use, disclosure, or

19 sale of such information that signifies that the

20 authorization is valid until such date or event;

21 (E) include a statement that the individual

22 has a right to revoke the authorization in writ23 ing and that there are exceptions to the right

24 to revoke, and a description of the procedure in25 volved in such revocation;
72

•S 1055 IS

1 (F) be in writing and include the signature

2 of the individual and the date, or if the author3 ization is signed by a personal representative of

4 the individual, a description of such representa5 tive’s authority to act for the individual; and

6 (G) include a statement explaining the

7 purpose for which such information is used, dis8 closed, or sold.

9 (2) PLAIN LANGUAGE.—The authorization must

10 be written in plain language.

11 (d) NOTICE.—The authorization shall include a state12 ment that the individual may—

13 (1) inspect or copy the protected health infor14 mation to be marketed as provided under section

15 164.524 of title 45, Code of Federal Regulations (or

16 a successor regulation); and

17 (2) refuse to sign the authorization.

18 (e) DOCUMENTATION.—A covered entity shall retain

19 such documentation as required for any use, disclosure,

20 or sale, as described under section 403(d).

21 (f) RESCISSION OF INDIVIDUALLY IDENTIFIABLE

22 HEALTH INFORMATION REGULATION.—Effective as of

23 December 28, 2000—

24 (1) section 164.514(e) of title 45, Code of Fed25 eral Regulations (relating to standards for uses and
73

•S 1055 IS

1 disclosures of protected health information for mar2 keting), promulgated by the Secretary of Health and

3 Human Services in the final rule entitled ‘‘Stand4 ards for Privacy of Individually Identifiable Health

5 Information’’ (65 Fed. Reg. 82462 (December 28,

6 2000)) is void; and

7 (2) section 164.514 shall take effect as if sub8 section (e) of such section had not been included in

9 the promulgation of the final regulation.

10 (g) NONCOERCION.—A covered entity or noncovered

11 entity shall not condition the purchase of a product or the

12 provision of a service to an individual based on whether

13 such individual provides an authorization to such entity

14 as described in this section.

15 SEC. 406. RULE OF CONSTRUCTION.

16 Except for the provisions of section 405, all require17 ments of this title shall not be construed to impose any

18 additional requirements or in any way alter the require19 ments imposed upon covered entities under parts 160

20 through 164 of title 45, Code of Federal Regulations.

21 SEC. 407. REGULATIONS.

22 (a) IN GENERAL.—The Secretary shall promulgate

23 regulations implementing the provisions of this title.

24 (b) TIMEFRAME.—Not later than 1 year after the

25 date of enactment of this Act, the Secretary shall publish
74

•S 1055 IS

1 proposed regulations in the Federal Register. With regard

2 to such proposed regulations, the Secretary shall provide

3 an opportunity for submission of comments by interested

4 persons during a period of not less than 90 days. Not later

5 than 2 years after the date of enactment of this Act, the

6 Secretary shall publish final regulations in the Federal

7 Register.

8 SEC. 408. ENFORCEMENT.

9 (a) IN GENERAL.—A covered entity or noncovered

10 entity that knowingly violates section 402 or 405 shall be

11 subject to a civil money penalty under this section.

12 (b) AMOUNT.—The civil money penalty described in

13 subsection (a) shall not exceed $100,000. In determining

14 the amount of any penalty to be assessed, the Secretary

15 shall take into account the previous record of compliance

16 of the entity being assessed with the applicable provisions

17 of this title and the gravity of the violation.

18 (c) ADMINISTRATIVE REVIEW.—

19 (1) OPPORTUNITY FOR HEARING.—The entity

20 assessed shall be afforded an opportunity for a hear21 ing by the Secretary upon request made within 30

22 days after the date of the issuance of a notice of as23 sessment. In such hearing the decision shall be made

24 on the record pursuant to section 554 of title 5,

25 United States Code. If no hearing is requested, the
75

•S 1055 IS

1 assessment shall constitute a final and unappealable

2 order.

3 (2) HEARING PROCEDURE.—If a hearing is re4 quested, the initial agency decision shall be made by

5 an administrative law judge, and such decision shall

6 become the final order unless the Secretary modifies

7 or vacates the decision. Notice of intent to modify or

8 vacate the decision of the administrative law judge

9 shall be issued to the parties within 30 days after

10 the date of the decision of the judge. A final order

11 which takes effect under this paragraph shall be

12 subject to review only as provided under subsection

13 (d).

14 (d) JUDICIAL REVIEW.—

15 (1) FILING OF ACTION FOR REVIEW.—Any enti16 ty against whom an order imposing a civil money

17 penalty has been entered after an agency hearing

18 under this section may obtain review by the United

19 States district court for any district in which such

20 entity is located or the United States District Court

21 for the District of Columbia by filing a notice of ap22 peal in such court within 30 days from the date of

23 such order, and simultaneously sending a copy of

24 such notice by registered mail to the Secretary.
76

•S 1055 IS

1 (2) CERTIFICATION OF ADMINISTRATIVE

2 RECORD.—The Secretary shall promptly certify and

3 file in such court the record upon which the penalty

4 was imposed.

5 (3) STANDARD FOR REVIEW.—The findings of

6 the Secretary shall be set aside only if found to be

7 unsupported by substantial evidence as provided by

8 section 706(2)(E) of title 5, United States Code.

9 (4) APPEAL.—Any final decision, order, or

10 judgment of the district court concerning such re11 view shall be subject to appeal as provided in chap12 ter 83 of title 28 of such Code.

13 (e) FAILURE TO PAY ASSESSMENT; MAINTENANCE

14 OF ACTION.—

15 (1) FAILURE TO PAY ASSESSMENT.—If any en16 tity fails to pay an assessment after it has become

17 a final and unappealable order, or after the court

18 has entered final judgment in favor of the Secretary,

19 the Secretary shall refer the matter to the Attorney

20 General who shall recover the amount assessed by

21 action in the appropriate United States district

22 court.

23 (2) NONREVIEWABILITY.—In such action the

24 validity and appropriateness of the final order im25 posing the penalty shall not be subject to review.
77

•S 1055 IS

1 (f) PAYMENT OF PENALTIES.—Except as otherwise

2 provided, penalties collected under this section shall be

3 paid to the Secretary (or other officer) imposing the pen4 alty and shall be available without appropriation and until

5 expended for the purpose of enforcing the provisions with

6 respect to which the penalty was imposed.

7 TITLE V—DRIVER’S LICENSE

8 PRIVACY

9 SEC. 501. DRIVER’S LICENSE PRIVACY.

10 Section 2725 of title 18, United States Code, is

11 amended by striking paragraphs (2) and (3) and adding

12 the following:

13 ‘‘(2) ‘person’ means an individual, organization,

14 or entity, but does not include a State or agency

15 thereof;

16 ‘‘(3) ‘personal information’ means information

17 that identifies an individual, including an individ18 ual’s photograph, social security number, driver

19 identification number, name, address (but not the 5-

20 digit zip code), telephone number, medical or dis21 ability information, any physical copy of a driver’s li22 cense, birth date, information on physical character23 istics, including height, weight, sex or eye color, or

24 any biometric identifiers on a license, including a
78

•S 1055 IS

1 finger print, but not information on vehicular acci2 dents, driving violations, and driver’s status; and

3 ‘‘(4) ‘highly restricted personal information’

4 means an individual’s photograph or image, social

5 security number, medical or disability information,

6 any physical copy of a driver’s license, driver identi7 fication number, birth date, information on physical

8 characteristics, including height, weight, sex, or eye

9 color, or any biometric identifiers on a license, in10 cluding a finger print.’’.

11 TITLE VI—MISCELLANEOUS

12 SEC. 601. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

13 (a) IN GENERAL.—

14 (1) CIVIL ACTIONS.—In any case in which the

15 attorney general of a State has reason to believe

16 that an interest of the residents of that State has

17 been or is threatened or adversely affected by the

18 engagement of any person in a practice that is pro19 hibited under title I, II, or IV of this Act or under

20 any amendment made by such a title, the State, as

21 parens patriae, may bring a civil action on behalf of

22 the residents of the State in a district court of the

23 United States of appropriate jurisdiction to—

24 (A) enjoin that practice;
79

•S 1055 IS

1 (B) enforce compliance with such titles or

2 such amendments;

3 (C) obtain damage, restitution, or other

4 compensation on behalf of residents of the

5 State; or

6 (D) obtain such other relief as the court

7 may consider to be appropriate.

8 (2) NOTICE.—

9 (A) IN GENERAL.—Before filing an action

10 under paragraph (1), the attorney general of

11 the State involved shall provide to the Attorney

12 General—

13 (i) written notice of the action; and

14 (ii) a copy of the complaint for the ac15 tion.

16 (B) EXEMPTION.—

17 (i) IN GENERAL.—Subparagraph (A)

18 shall not apply with respect to the filing of

19 an action by an attorney general of a State

20 under this subsection, if the State attorney

21 general determines that it is not feasible to

22 provide the notice described in such sub23 paragraph before the filing of the action.

24 (ii) NOTIFICATION.—In an action de25 scribed in clause (i), the attorney general
80

•S 1055 IS

1 of a State shall provide notice and a copy

2 of the complaint to the Attorney General

3 at the same time as the State attorney

4 general files the action.

5 (b) INTERVENTION.—

6 (1) IN GENERAL.—On receiving notice under

7 subsection (a)(2), the Attorney General shall have

8 the right to intervene in the action that is the sub9 ject of the notice.

10 (2) EFFECT OF INTERVENTION.—If the Attor11 ney General intervenes in an action under subsection

12 (a), the Attorney General shall have the right to be

13 heard with respect to any matter that arises in that

14 action.

15 (c) CONSTRUCTION.—For purposes of bringing any

16 civil action under subsection (a), nothing in this Act shall

17 be construed to prevent an attorney general of a State

18 from exercising the powers conferred on such attorney

19 general by the laws of that State to—

20 (1) conduct investigations;

21 (2) administer oaths or affirmations; or

22 (3) compel the attendance of witnesses or the

23 production of documentary and other evidence.

24 (d) ACTIONS BY THE ATTORNEY GENERAL OF THE

25 UNITED STATES.—In any case in which an action is insti-
81

•S 1055 IS

1 tuted by or on behalf of the Attorney General for violation

2 of a practice that is prohibited under title I, II, IV, or

3 V of this Act or under any amendment made by such a

4 title, no State may, during the pendency of that action,

5 institute an action under subsection (a) against any de6 fendant named in the complaint in that action for violation

7 of that practice.

8 (e) VENUE; SERVICE OF PROCESS.—

9 (1) VENUE.—Any action brought under sub10 section (a) may be brought in the district court of

11 the United States that meets applicable require12 ments relating to venue under section 1391 of title

13 28, United States Code.

14 (2) SERVICE OF PROCESS.—In an action

15 brought under subsection (a), process may be served

16 in any district in which the defendant—

17 (A) is an inhabitant; or

18 (B) may be found.

19 SEC. 602. FEDERAL INJUNCTIVE AUTHORITY.

20 In addition to any other enforcement authority con21 ferred under this Act or under an amendment made by

22 this Act, the Federal Government shall have injunctive au23 thority with respect to any violation of any provision of

24 title I, II, or IV of this Act or of any amendment made
82

•S 1055 IS

1 by such a title, without regard to whether a public or pri2 vate entity violates such provision.

Æ