I

106TH CONGRESS

1ST SESSION H. R. 1057

To provide individuals with access to health information of which they are

a subject, ensure personal privacy with respect to health-care-related

information, impose criminal and civil penalties for unauthorized use

of protected health information, to provide for the strong enforcement

of these rights, and to protect States’ rights.

IN THE HOUSE OF REPRESENTATIVES

MARCH 10, 1999

Mr. MARKEY (for himself, Mr. MCDERMOTT, Mr. FROST, Ms. KAPTUR, Mr.

MOAKLEY, Ms. ROYBAL-ALLARD, Mr. NADLER, Mr. FRANK of Massachusetts, Mr. CROWLEY, Mr. GREEN of Texas, Mr. MCGOVERN, Mr. LUTHER, Mr. SANDERS, Mr. MASCARA, Mr. BROWN of California, Mr. ROMERO-BARCELO ́, Mr. DELAHUNT, Mr. DEFAZIO, Mr. CAPUANO, Mr.

STARK, Mr. STRICKLAND, and Ms. LOFGREN) introduced the following

bill; which was referred to the Committee on Commerce, and in addition

to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions

as fall within the jurisdiction of the committee concerned

A BILL

To provide individuals with access to health information of

which they are a subject, ensure personal privacy with

respect to health-care-related information, impose criminal and civil penalties for unauthorized use of protected

health information, to provide for the strong enforcement

of these rights, and to protect States’ rights.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2

•HR 1057 IH

1 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

2 (a) SHORT TITLE.—This Act may be cited as the

3 ‘‘Medical Information Privacy and Security Act’’.

4 (b) TABLE OF CONTENTS.—The table of contents for

5 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings.

Sec. 3. Purposes.

Sec. 4. Definitions.

TITLE I—INDIVIDUALS’ RIGHTS

Subtitle A—Access to Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Supplements to protected health information.

Sec. 103. Notice of privacy practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Sec. 201. General rules regarding use and disclosure.

Sec. 202. Authorizations for disclosure of protected health information for

treatment and payment.

Sec. 203. Authorizations for disclosure of protected health information other

than for treatment or payment.

Sec. 204. Emergency circumstances.

Sec. 205. Public health.

Sec. 206. Protection and advocacy agencies.

Sec. 207. Oversight.

Sec. 208. Disclosure for law enforcement purposes.

Sec. 209. Next of kin and directory information.

Sec. 210. Health research.

Sec. 211. Judicial and administrative purposes.

Sec. 212. Individual representatives.

Sec. 213. Prohibition against retaliation.

TITLE III—OFFICE OF HEALTH INFORMATION PRIVACY OF THE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Subtitle A—Designation

Sec. 301. Designation.

Subtitle B—Enforcement

CHAPTER 1—CRIMINAL PROVISIONS
3

•HR 1057 IH

Sec. 311. Wrongful disclosure of protected health information.

Sec. 312. Debarment for crimes.

CHAPTER 2—CIVIL SANCTIONS

Sec. 321. Civil penalty.

Sec. 322. Procedures for imposition of penalties.

Sec. 323. Civil action by individuals.

TITLE IV—MISCELLANEOUS

Sec. 401. Relationship to other laws.

Sec. 402. Effective date.

1 SEC. 2. FINDINGS.

2 The Congress finds as follows:

3 (1) Individuals have a right of privacy with re4 spect to their protected health information and

5 records.

6 (2) With respect to information about medical

7 care and health status, the traditional right of con8 fidentiality (between a health care provider and a

9 patient) is at risk.

10 (3) An erosion of the right of privacy may re11 duce the willingness of patients to confide in physi12 cians and other practitioners and may inhibit pa13 tients from seeking care.

14 (4) An individual’s privacy right means that the

15 individual’s consent is needed to disclose his or her

16 protected health information and that the individual

17 has a right of access to that health information.

18 (5) Any disclosure of protected health informa19 tion should be limited to that information or portion
4

•HR 1057 IH

1 of the medical record necessary to fulfill the imme2 diate and specific purpose of the disclosure.

3 (6) Health research often depends on access to

4 both identifiable and de-identified patient health in5 formation and health research is critically important

6 to the health and well-being of all people in the

7 United States.

8 (7) The Supreme Court found in Jaffee v.

9 Redmond (116 S.Ct. 1923 (1996)) that there is an

10 imperative need for confidence and trust between a

11 psychotherapist and a patient and that such trust

12 can only be established by an assurance of confiden13 tiality. This assurance serves the public interest by

14 facilitating the provision of appropriate treatment

15 for individuals.

16 (8) Section 264 of the Health Insurance Port17 ability and Accountability Act of 1996 (42 U.S.C.

18 1320d–2 note) establishes a deadline that Congress

19 enact legislation, before August 21, 1999, to protect

20 the privacy of protected health information.

21 SEC. 3. PURPOSES.

22 The purposes of this Act are as follows:

23 (1) To recognize that there is a right to privacy

24 with respect to health information, including genetic

25 information, and that this right must be protected.
5

•HR 1057 IH

1 (2) To create incentives to turn protected

2 health information into de-identified health informa3 tion, where appropriate.

4 (3) To designate an Office of Health Informa5 tion Privacy within the Department of Health and

6 Human Services to protect that right of privacy.

7 (4) To provide individuals with—

8 (A) access to health information of which

9 they are the subject; and

10 (B) the opportunity to challenge the accu11 racy and completeness of such information by

12 being able to file supplements to such informa13 tion.

14 (5) To provide individuals with the right to

15 limit the use and disclosure of protected health in16 formation.

17 (6) To establish strong and effective mecha18 nisms to protect against the unauthorized and inap19 propriate use of protected health information.

20 (7) To invoke the sweep of congressional pow21 ers, including the power to enforce the 14th amend22 ment, to regulate commerce, and to abrogate the im23 munity of the States under the 11th amendment, in

24 order to address violations of the rights of individ25 uals to privacy, to provide individuals with access to
6

•HR 1057 IH

1 their health information, and to prevent unauthor2 ized use of protected health information that is ge3 netic information.

4 (8) To establish strong and effective remedies

5 for violations of this Act.

6 (9) To protect the rights of States.

7 SEC. 4. DEFINITIONS.

8 In this Act:

9 (1) ADMINISTRATIVE BILLING INFORMATION.—

10 The term ‘‘administrative billing information’’

11 means any of the following forms of protected health

12 information:

13 (A) Date of service, policy, patient identifi14 ers, and practitioner or facility identifiers.

15 (B) Diagnostic codes, in accordance with

16 medicare billing codes, for which treatment is

17 being rendered or requested.

18 (C) Complexity of service codes, indicating

19 duration of treatment.

20 (D) Total billed charges.

21 (2) AGENT.—The term ‘‘agent’’ means a person

22 who represents and acts for another person (a prin23 cipal) under a contract or relationship of agency, or

24 whose function is to bring about, modify, affect, ac25 cept performance of, or terminate, contractual obli-
7

•HR 1057 IH

1 gations between the principal and a third person.

2 With respect to an employer, the term includes the

3 employees of the employer.

4 (3) DE-IDENTIFIED HEALTH INFORMATION.—

5 (A) IN GENERAL.—The term ‘‘de-identified

6 health information’’ means any protected health

7 information, with respect to which—

8 (i) all personal identifiers, or other in9 formation that may be used by itself or in

10 combination with other information which

11 may be available to re-identify the subject

12 of the information, have been removed; and

13 (ii) a good faith effort to evaluate the

14 risks of re-identification of the subject of

15 such information in the context in which it

16 will be used or disclosed, has been made.

17 (B) EXAMPLES.—The term includes aggre18 gate statistics, redacted health information, in19 formation in which random or fictitious alter20 natives have been substituted for personally

21 identifiable information, and information in

22 which personally identifiable information has

23 been encrypted and the decryption key is main24 tained by a person otherwise authorized to have
8

•HR 1057 IH

1 access to such protected health information in

2 an identifiable format.

3 (4) DISCLOSE.—The term ‘‘disclose’’ means to

4 release, publish, share, transfer, transmit, dissemi5 nate, show, permit access to, re-identify, or other6 wise divulge protected health information to any per7 son other than the individual who is the subject of

8 such information. The term includes the initial dis9 closure and any subsequent redisclosure of protected

10 health information.

11 (5) DECRYPTION KEY.—The term ‘‘decryption

12 key’’ means the variable information used in or pro13 duced by a mathematical formula, code, or algo14 rithm, or any component thereof, used to encrypt or

15 decrypt wire or electronic communications or elec16 tronically stored information.

17 (6) EMPLOYER.—The term ‘‘employer’’ means

18 a person engaged in business affecting commerce

19 who has employees.

20 (7) ENCRYPTION.—The term ‘‘encryption’’

21 means the scrambling of electronic or wire commu22 nications or electronically stored information using

23 mathematical formulas or algorithms sufficient to

24 preserve the confidentiality, integrity, and authentic25 ity of such communications or information.
9

•HR 1057 IH

1 (8) HEALTH CARE.—The term ‘‘health care’’

2 means—

3 (A) preventive, diagnostic, therapeutic, re4 habilitative, maintenance, or palliative care, in5 cluding appropriate assistance with disease or

6 symptom management and maintenance, coun7 seling, service, or procedure—

8 (i) with respect to the physical or

9 mental condition of an individual; or

10 (ii) affecting the structure or function

11 of the human body or any part of the

12 human body, including the banking of

13 blood, sperm, organs, or any other tissue;

14 and

15 (B) any sale or dispensing of a drug, de16 vice, equipment, or other health care related

17 item to an individual, or for the use of an indi18 vidual, pursuant to a prescription.

19 (9) HEALTH CARE PROVIDER.—The term

20 ‘‘health care provider’’ means a person who, with re21 spect to a specific item of protected health informa22 tion, receives, creates, uses, maintains, or discloses

23 the information while acting in whole or in part in

24 the capacity of—
10

•HR 1057 IH

1 (A) a person who is licensed, certified, reg2 istered, or otherwise authorized by Federal or

3 State law to provide an item or service that

4 constitutes health care in the ordinary course of

5 business, or practice of a profession;

6 (B) a Federal or State program that di7 rectly provides items or services that constitute

8 health care to beneficiaries; or

9 (C) an officer or employee or agent of a

10 person described in subparagraph (A) or (B)

11 who is engaged in the provision of health care

12 or who uses health information.

13 (10) HEALTH OR LIFE INSURER.—The term

14 ‘‘health or life insurer’’ means a health insurance

15 issuer (as defined in section 9805(b)(2) of the Inter16 nal Revenue Code of 1986) or a life insurance com17 pany (as defined in section 816 of such Code) and

18 includes the employees and agents of such a person.

19 (11) HEALTH OVERSIGHT AGENCY.—The term

20 ‘‘health oversight agency’’—

21 (A) means a person who—

22 (i) performs or oversees the perform23 ance of an assessment, investigation, or

24 prosecution relating to compliance with

25 legal or fiscal standards relating to health
11

•HR 1057 IH

1 care fraud or fraudulent claims regarding

2 health care, health services or equipment,

3 or related activities and items; and

4 (ii) is a public executive branch agen5 cy, acting on behalf of a public executive

6 branch agency, acting pursuant to a re7 quirement of a public executive branch

8 agency, or carrying out activities under a

9 Federal or State law governing an assess10 ment, evaluation, determination, investiga11 tion, or prosecution described in clause (i);

12 and

13 (B) includes the employees and agents of

14 such a person.

15 (12) HEALTH PLAN.—The term ‘‘health plan’’

16 means any health insurance plan, including any hos17 pital or medical service plan, dental or other health

18 service plan or health maintenance organization

19 plan, or other program providing or arranging for

20 the provision of health benefits, whether or not fund21 ed through the purchase of insurance. The term in22 cludes employee welfare benefit plans and group

23 plans (as defined in sections 3 and 607 of the Em24 ployee Retirement Income Security Act of 1974 (29

25 U.S.C. 1002 and 1167)).
12

•HR 1057 IH

1 (13) HEALTH RESEARCHER.—The term ‘‘health

2 researcher’’ means a person who, with respect to a

3 specific item of protected health information, re4 ceives the information—

5 (A) pursuant to section 210 (relating to

6 health research); or

7 (B) while acting in whole or in part in the

8 capacity of an officer, employee, or agent of a

9 person who receives the information pursuant

10 to such section.

11 (14) LAW ENFORCEMENT INQUIRY.—The term

12 ‘‘law enforcement inquiry’’ means a lawful executive

13 branch investigation or official proceeding inquiring

14 into a violation of, or failure to comply with, any

15 criminal or civil statute or any regulation, rule, or

16 order issued pursuant to such a statute.

17 (15) OFFICE OF HEALTH INFORMATION PRI18 VACY.—The term ‘‘Office of Health Information Pri19 vacy’’ means the Office of Health Information Pri20 vacy designated under section 301.

21 (16) PERSON.—The term ‘‘person’’ means a

22 government, governmental subdivision of an execu23 tive branch agency or authority; corporation; com24 pany; association; firm; partnership; society; estate;
13

•HR 1057 IH

1 trust; joint venture; individual; individual represent2 ative; tribal government; and any other legal entity.

3 (17) PROTECTED HEALTH INFORMATION.—

4 (A) IN GENERAL.—The term ‘‘protected

5 health information’’ means any information, in6 cluding genetic information, demographic infor7 mation, and tissue samples collected from an

8 individual, whether oral or recorded in any form

9 or medium, that—

10 (i) is created or received by a health

11 care provider, health researcher, health

12 plan, health oversight agency, public health

13 authority, employer, health or life insurer,

14 school or university; and

15 (ii)(I) relates to the past, present, or

16 future physical or mental health or condi17 tion of an individual (including individual

18 cells and their components), the provision

19 of health care to an individual, or the past,

20 present, or future payment for the provi21 sion of health care to an individual; and

22 (II)(aa) identifies an individual; or

23 (bb) with respect to which there is a

24 reasonable basis to believe that the infor-
14

•HR 1057 IH

1 mation can be used to identify an individ2 ual; and

3 (B) DECRYPTION KEY.—The term ‘‘pro4 tected health information’’ includes any infor5 mation described in paragraph (5).

6 (18) PUBLIC HEALTH AUTHORITY.—The term

7 ‘‘public health authority’’ means an authority or in8 strumentality of the United States, a tribal govern9 ment, a State, or a political subdivision of a State

10 that is—

11 (A) primarily responsible for public health

12 matters; and

13 (B) primarily engaged in activities such as

14 injury reporting, public health surveillance, and

15 public health investigation or intervention.

16 (19) RE-IDENTIFY.—The term ‘‘re-identify’’,

17 when used with respect to de-identified health infor18 mation, means an attempt, successful or otherwise,

19 to ascertain—

20 (A) the identity of the individual who is

21 the subject of such information; or

22 (B) the decryption key with respect to the

23 information (when undertaken with knowledge

24 that such key would allow for the identification
15

•HR 1057 IH

1 of the individual who is the subject of such in2 formation).

3 (20) SCHOOL OR UNIVERSITY.—The term

4 ‘‘school or university’’ means an institution or place

5 for instruction or education, including an elementary

6 school, secondary school, or institution of higher

7 learning, a college, or an assemblage of colleges

8 united under one corporate organization or govern9 ment.

10 (21) SECRETARY.—The term ‘‘Secretary’’

11 means the Secretary of Health and Human Services.

12 (22) STATE.—The term ‘‘State’’ includes the

13 District of Columbia, Puerto Rico, the Virgin Is14 lands, Guam, American Samoa, and the Northern

15 Mariana Islands.

16 (23) TO THE MAXIMUM EXTENT PRAC17 TICABLE.—The term ‘‘to the maximum extent prac18 ticable’’ means the level of compliance that a reason19 able person would deem technologically feasible so

20 long as such feasibility is periodically evaluated in

21 light of scientific advances.

22 (24) WRITING.—The term ‘‘writing’’ means

23 writing in either a paper-based or computer-based

24 form, including electronic and digital signatures.
16

•HR 1057 IH

1 TITLE I—INDIVIDUALS’ RIGHTS

2 Subtitle A—Access to Protected

3 Health Information by Subjects

4 of the Information

5 SEC. 101. INSPECTION AND COPYING OF PROTECTED

6 HEALTH INFORMATION.

7 (a) RIGHT OF INDIVIDUAL.—

8 (1) IN GENERAL.—A health care provider,

9 health plan, employer, health or life insurer, school,

10 or university, or a person acting as the agent of any

11 such person, shall permit an individual who is the

12 subject of protected health information, or the indi13 vidual’s designee, to inspect and copy protected

14 health information concerning the individual, includ15 ing records created under sections 102, 112, 202,

16 203, 208, and 211, that such person maintains.

17 (2) PROCEDURES AND FEES.—A person de18 scribed in paragraph (1) may set forth appropriate

19 procedures to be followed for inspection and copying

20 under such paragraph and may require an individual

21 to pay fees associated with such inspection and copy22 ing in an amount that is not in excess of the actual

23 costs of providing such copying. Such fees may not

24 be assessed where such an assessment would have

25 the effect of inhibiting an individual from gaining
17

•HR 1057 IH

1 access to the information described in paragraph

2 (1).

3 (b) DEADLINE.—A person described in subsection

4 (a)(1) shall comply with a request for inspection or copy5 ing of protected health information under this section not

6 later than 15 business days after the date on which the

7 person receives the request.

8 (c) RULES GOVERNING AGENTS.—A person acting as

9 the agent of a person described in subsection (a) shall pro10 vide for the inspection and copying of protected health in11 formation if—

12 (1) the protected health information is retained

13 by the agent; and

14 (2) the agent has been asked by the person in15 volved to fulfill the requirements of this section.

16 (d) SPECIAL RULE RELATING TO ONGOING CLINICAL

17 TRIALS.—With respect to protected health information

18 that is created as part of an individual’s participation in

19 an ongoing clinical trial, access to the information shall

20 be provided consistent with the individual’s agreement to

21 participate in the clinical trial.

22 SEC. 102. SUPPLEMENTS TO PROTECTED HEALTH INFOR23 MATION.

24 (a) IN GENERAL.—Not later than 45 days after the

25 date on which a health care provider, health plan, em-
18

•HR 1057 IH

1 ployer, health or life insurer, school, or university, or a

2 person acting as the agent of any such person, receives

3 from an individual a request in writing to supplement pro4 tected health information concerning the individual, such

5 person—

6 (1) shall add the supplement requested to the

7 information;

8 (2) shall inform the individual that the supple9 ment has been made; and

10 (3) shall make reasonable efforts to inform any

11 person to whom the portion of the unsupplemented

12 information was previously disclosed, of any sub13 stantive supplement that has been made.

14 (b) REFUSAL TO SUPPLEMENT.—If a person de15 scribed in subsection (a) declines to make the supplement

16 requested under such subsection, the person shall inform

17 the individual in writing of—

18 (1) the reasons for declining to make the sup19 plement;

20 (2) any procedures for further review of the de21 clining of such supplement; and

22 (3) the individual’s right to file with the person

23 a concise statement setting forth the requested sup24 plement and the individual’s reasons for disagreeing

25 with the declining person and the individual’s right
19

•HR 1057 IH

1 to include a copy of this refusal in his or her health

2 record.

3 (c) STATEMENT OF DISAGREEMENT.—If an individ4 ual has filed with a person a statement of disagreement

5 under subsection (b)(3), the person, in any subsequent dis6 closure of the disputed portion of the information—

7 (1) shall include, at the individual’s request, a

8 copy of the individual’s statement; and

9 (2) may include a concise statement of the rea10 sons for not making the requested supplement.

11 (d) RULES GOVERNING AGENTS.—A person acting as

12 the agent of a person described in subsection (a) shall not

13 be required to make a supplement to protected health in14 formation, except where—

15 (1) the protected health information is retained

16 by the agent; and

17 (2) the agent has been asked by such person to

18 fulfill the requirements of this section.

19 SEC. 103. NOTICE OF PRIVACY PRACTICES.

20 (a) PREPARATION OF WRITTEN NOTICE.—A health

21 care provider, health plan, health oversight agency, public

22 health authority, employer, health or life insurer, school,

23 or university, or a person acting as the agent of any such

24 person, shall prepare a written notice of the privacy prac-
20

•HR 1057 IH

1 tices of the person that provides information with respect

2 to the following:

3 (1) The procedures for an individual to author4 ize disclosures of protected health information, and

5 to object to, modify, and revoke such authorizations.

6 (2) The right of an individual to inspect, copy,

7 and supplement the protected health information.

8 (3) The right of an individual not to have em9 ployment or the receipt of services conditioned upon

10 the execution by the individual of an authorization

11 for disclosure.

12 (4) A description of the categories or types of

13 employees, by general category or by general job de14 scription, who have access to or use of protected

15 health information within the person.

16 (5) A simple, concise description of any infor17 mation systems used to store or transmit protected

18 health information, including a description of any

19 linkages made with other electronic systems or data20 bases outside the person.

21 (6) The right of the individual to request seg22 regation of protected health information, and to re23 strict the use of such information by employees,

24 agents, and contractors of a person.
21

•HR 1057 IH

1 (7) The circumstances under which the infor2 mation may be used or disclosed without an author3 ization executed by the individual.

4 (8) A statement that an individual may elect to

5 pay for health care from the individual’s own funds

6 and information on the right of such an individual

7 to elect for identifying information not to be dis8 closed to anyone other than health care providers,

9 unless such disclosure is required by mandatory re10 porting requirements or other similar information

11 collection duties required by law.

12 (b) PROVISION AND POSTING OF WRITTEN NO13 TICE.—

14 (1) PROVISION.—A person described in sub15 section (a) shall provide a copy of the written notice

16 of privacy practices required under such

17 subsection—

18 (A) at the time an authorization is sought

19 for disclosure of protected health information;

20 and

21 (B) upon the request of an individual.

22 (2) POSTING.—A person described in subsection

23 (a) shall post, in a clear and conspicuous manner, a

24 brief summary of the privacy practices of the person.
22

•HR 1057 IH

1 (c) MODEL NOTICE.—The director of the Office of

2 Health Information Privacy, after notice and opportunity

3 for public comment, shall develop and disseminate model

4 notices of privacy practices, and model summary notices

5 for posting, for use under this section. Use of such a model

6 notice shall be deemed to satisfy the requirements of this

7 section.

8 Subtitle B—Establishment of

9 Safeguards

10 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

11 (a) IN GENERAL.—A health care provider, health

12 plan, health oversight agency, public health authority, em13 ployer, health researcher, law enforcement official, health

14 or life insurer, school, or university, or a person acting

15 as the agent of any such person, shall establish and main16 tain appropriate administrative, organizational, technical,

17 and physical safeguards and procedures to ensure the con18 fidentiality, security, accuracy, and integrity of protected

19 health information created, received, obtained, main20 tained, used, transmitted, or disposed of by such person.

21 (b) FACTORS TO BE CONSIDERED.—The policies and

22 safeguards under subsection (a) shall ensure that—

23 (1) protected health information is used or dis24 closed only when necessary;
23

•HR 1057 IH

1 (2) the categories of personnel who will have ac2 cess to protected health information are identified;

3 and

4 (3) the feasibility of limiting access to protected

5 health information is considered.

6 (c) MODEL GUIDELINES.—The Secretary, in con7 sultation with the Director of the Office of Health Infor8 mation Privacy appointed under section 301, after notice

9 and opportunity for public comment, shall develop and dis10 seminate model guidelines for the establishment of safe11 guards and procedures for use under this section, such

12 as, where appropriate, individual authentication of uses of

13 computer systems, access controls, audit trails, encryption,

14 physical security, protection of remote access points and

15 protection of external electronic communications, periodic

16 security assessments, incident reports, and sanctions. The

17 director shall update and disseminate the guidelines, as

18 appropriate, to take advantage of new technologies.

19 SEC. 112. ACCOUNTING FOR DISCLOSURES.

20 (a) IN GENERAL.—A health care provider, health

21 plan, health oversight agency, public health authority, em22 ployer, health researcher, law enforcement official, health

23 or life insurer, school, or university, or a person acting

24 as the agent of any such person, shall establish and main25 tain, with respect to any protected health information dis-
24

•HR 1057 IH

1 closure that is not related to payment or treatment, a

2 record of the disclosure in accordance with regulations

3 issued by the Secretary in consultation with the director

4 of the Office of Health Information Privacy.

5 (b) MAINTENANCE OF RECORD.—A record estab6 lished under subsection (a) shall be maintained for not less

7 than 7 years.

8 (c) ELECTRONIC RECORDS.—A health care provider,

9 health plan, health oversight agency, public health author10 ity, employer, health researcher, law enforcement official,

11 health or life insurer, school, or university, or a person

12 acting as the agent of any such person, shall, to the maxi13 mum extent practicable, maintain an accessible electronic

14 record concerning each access, or attempt to access,

15 whether authorized or unauthorized, successful or unsuc16 cessful, protected health information maintained by such

17 person in electronic form. The record shall include the

18 identity of the specific individual accessing or attempting

19 to gain such access (or a way to identify that individual

20 or information helpful in determining the identity of such

21 individual), information sufficient to identify the protected

22 health information sought or accessed, and other appro23 priate information.
25

•HR 1057 IH

1 TITLE II—RESTRICTIONS ON

2 USE AND DISCLOSURE

3 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO4 SURE.

5 (a) PROHIBITION.—

6 (1) GENERAL RULE.—A health care provider,

7 health plan, health oversight agency, public health

8 authority, employer, health researcher, law enforce9 ment official, health or life insurer, school, or univer10 sity may not disclose or use protected health infor11 mation except as authorized under this Act.

12 (2) RULE OF CONSTRUCTION.—Disclosure of

13 de-identified health information shall not be con14 strued as a disclosure of protected health informa15 tion.

16 (b) SCOPE OF DISCLOSURE.—

17 (1) IN GENERAL.—A disclosure of protected

18 health information under this title shall be limited to

19 the minimum amount of information necessary to

20 accomplish the purpose for which the disclosure is

21 made.

22 (2) DETERMINATION.—The determination as to

23 what constitutes the minimum disclosure possible for

24 purposes of paragraph (1) shall be made by a health

25 care provider.
26

•HR 1057 IH

1 (c) USE OR DISCLOSURE FOR PURPOSE ONLY.—A

2 recipient of information pursuant to this title may use or

3 disclose such information solely to carry out the purpose

4 for which the information was disclosed.

5 (d) NO GENERAL REQUIREMENT TO DISCLOSE.—

6 Nothing in this title permitting the disclosure of protected

7 health information shall be construed to require such dis8 closure.

9 (e) IDENTIFICATION OF DISCLOSED INFORMATION AS

10 PROTECTED HEALTH INFORMATION.—Protected health

11 information disclosed pursuant to this title shall be clearly

12 identified as protected health information that is subject

13 to this Act.

14 (f) DISCLOSURE BY AGENTS.—An agent of a person

15 described in subsection (a)(1), who receives protected

16 health information from the person while acting within the

17 scope of the agency, shall be subject to this title to the

18 same extent as the person and for the duration of the pe19 riod in which the agent holds the information.

20 (g) CREATION OF DE-IDENTIFIED INFORMATION.—

21 Notwithstanding subsection (c), but subject to the other

22 provisions of this section, a person described in subsection

23 (a)(1) may disclose protected health information to an em24 ployee or other agent of the person for purposes of creat25 ing de-identified information.
27

•HR 1057 IH

1 (h) UNAUTHORIZED USE OR DISCLOSURE OF THE

2 DECRYPTION KEY.—The unauthorized disclosure of a

3 decryption key shall be deemed to be a disclosure of pro4 tected health information. The unauthorized use of a

5 decryption key or de-identified health information in order

6 to identify an individual is deemed to be disclosure of pro7 tected health information.

8 (i) NO WAIVER.—Except as provided in this Act, an

9 authorization to disclose personally identifiable health in10 formation executed by an individual pursuant to section

11 202 or 203 shall not be construed as a waiver of any rights

12 that the individual has under other Federal or State laws,

13 the rules of evidence, or common law.

14 (j) DEFINITIONS.—For purposes of this title:

15 (1) INVESTIGATIVE OR LAW ENFORCEMENT OF16 FICER.—The term ‘‘investigative or law enforcement

17 officer’’ means any officer of the United States or of

18 a State or political subdivision thereof, who is em19 powered by law to conduct investigations of, or to

20 make arrests for, criminal offenses, and any attor21 ney authorized by law to prosecute or participate in

22 the prosecution of such offenses.

23 (2) SEGREGATE.—The term ‘‘segregate’’ means

24 to place a designated subset of an individuals pro25 tected health information in a location or computer
28

•HR 1057 IH

1 file that is separate from the location or computer

2 file used to store protected health information and

3 where access to or use of any information so seg4 regated may be effectively limited to those persons

5 who are authorized by the individual to access or use

6 such information.

7 (3) SIGNED.—The term ‘‘signed’’ refers to both

8 signatures in ink and electronic signatures, and the

9 term ‘‘written’’ refers to both paper and computer10 ized formats.

11 SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO12 TECTED HEALTH INFORMATION FOR TREAT13 MENT AND PAYMENT.

14 (a) REQUIREMENTS RELATING TO EMPLOYERS,

15 HEALTH PLANS, HEALTH OR LIFE INSURERS, UNIN16 SURED INDIVIDUALS, AND PROVIDERS.—

17 (1) IN GENERAL.—To satisfy the requirement

18 under section 201(a)(1), an employer, health plan,

19 health or life insurer, or health care provider that

20 seeks to disclose protected health information in con21 nection with treatment or payment shall obtain an

22 authorization that satisfies the requirements of this

23 section. The authorization may be a single author24 ization.
29

•HR 1057 IH

1 (2) EMPLOYERS.—Every employer offering a

2 health plan to its employees shall, at the time of an

3 employee’s enrollment in the health plan, obtain a

4 signed, written authorization that is a legal, in5 formed authorization that satisfies the requirements

6 of subsection (b) concerning the use and disclosure

7 of protected health information for treatment or

8 payment with respect to each individual who is eligi9 ble to receive care under the health plan.

10 (3) HEALTH PLANS, HEALTH OR LIFE INSUR11 ERS.—Every health plan or health or life insurer of12 fering enrollment to individual or nonemployer

13 groups shall, at the time of enrollment in the plan

14 or insurance, obtain a signed, written authorization

15 that is a legal, informed authorization that satisfies

16 the requirements of subsection (b) concerning the

17 use and disclosure of protected health information

18 with respect to each individual who is eligible to re19 ceive care under the plan or insurance.

20 (4) UNINSURED.—An originating provider pro21 viding health care in other than a network plan set22 ting, or providing health care to an uninsured indi23 vidual, shall obtain a signed, written authorization

24 that satisfies the requirements of subsection (b) to

25 use protected health information in providing health
30

•HR 1057 IH

1 care or arranging for health care from other provid2 ers or seeking payment for the provision of health

3 care services.

4 (5) PROVIDERS.—

5 (A) IN GENERAL.—Every health care pro6 vider providing health care to an individual who

7 has not given the appropriate authorization

8 under this section shall, at the time of provid9 ing such care, obtain a signed, written author10 ization that is a legal, informed authorization,

11 that satisfies the requirements of subsection

12 (b), concerning the use and disclosure of pro13 tected health information with respect to such

14 individual.

15 (B) RULE OF CONSTRUCTION.—Subpara16 graph (A) shall not be construed to preclude

17 the provision of health care to an individual

18 who has not given appropriate authorization

19 prior to receipt of such care if—

20 (i) the health care provider involved

21 determines that such care is essential; and

22 (ii) the individual can reasonably be

23 expected to sign an authorization for such

24 care when appropriate.
31

•HR 1057 IH

1 (b) REQUIREMENTS FOR INDIVIDUAL AUTHORIZA2 TION.—To satisfy the requirements of this subsection, an

3 authorization to disclose protected health information—

4 (1) shall identify, by general job description or

5 other functional description, persons authorized to

6 disclose the information;

7 (2) shall describe the nature of the information

8 to be disclosed;

9 (3) shall identify, by general job description or

10 other functional description, persons to whom the in11 formation is to be disclosed, including individuals

12 employed by, or operating within, an entity to which

13 information is authorized to be disclosed;

14 (4) shall describe the purpose of the disclosures;

15 (5) shall permit the executing individual to indi16 cate that a particular individual listed on the author17 ization is not authorized to receive protected health

18 information concerning the individual, except as pro19 vided for in subsection (c)(3);

20 (6) shall provide the means by which an individ21 ual may indicate that some of the individual’s pro22 tected health information should be segregated and

23 to what persons such segregated information may be

24 disclosed;
32

•HR 1057 IH

1 (7) shall be subject to revocation by the individ2 ual and indicate that the authorization is valid until

3 revocation by the individual or until an event or date

4 specified; and

5 (8)(A) shall be—

6 (i) in writing, dated, and signed by the in7 dividual; or

8 (ii) in electronic form, dated and authenti9 cated by the individual using an authentication

10 method approved by the Secretary; and

11 (B) shall not have been revoked under subpara12 graph (A).

13 (c) LIMITATION ON AUTHORIZATIONS.—

14 (1) IN GENERAL.—Subject to paragraphs (2)

15 and (3), a person described in subsection (a) who

16 seeks an authorization under such subsection may

17 not condition the delivery of treatment or payment

18 for services on the receipt of such an authorization.

19 (2) RIGHT TO REQUIRE SELF PAYMENT.—If an

20 individual has refused to provide an authorization

21 for disclosure of administrative billing information to

22 a person and such authorization is necessary for a

23 health care provider to receive payment for services

24 delivered, the health care provider may require the
33

•HR 1057 IH

1 individual to pay from their own funds for the serv2 ices.

3 (3) RIGHT OF HEALTH CARE PROVIDER TO RE4 QUIRE AUTHORIZATION FOR TREATMENT PUR5 POSES.—If a health care provider that is seeking an

6 authorization for disclosure of an individual’s pro7 tected health information believes that the disclosure

8 of such information is necessary so as not to endan9 ger the health or treatment of the individual, the

10 health care provider may condition the provision of

11 services upon the execution of the authorization by

12 the individual.

13 (d) MODEL AUTHORIZATIONS.—The Secretary, after

14 notice and opportunity for public comment, shall develop

15 and disseminate model written authorizations of the type

16 described in this section and model statements of the limi17 tations on authorizations. Any authorization obtained on

18 a model authorization form under section 202 developed

19 by the Secretary pursuant to the preceding sentence shall

20 be deemed to satisfy the requirements of this section.

21 (e) SEGREGATION OF FILES.—A person described in

22 subsection (a)(1) shall comply, to the maximum extent

23 practicable, with the request of an individual who is the

24 subject of protected health information—
34

•HR 1057 IH

1 (1) to segregate any type or amount of pro2 tected health information, other than administrative

3 billing information, held by the entity; and

4 (2) to limit the use or disclosure of the seg5 regated health information within the entity to those

6 persons specifically designated by the subject of the

7 protected health information.

8 (f) REVOCATION OF AUTHORIZATION.—

9 (1) IN GENERAL.—An individual may in writing

10 revoke or amend an authorization under this section

11 at any time, unless the disclosure that is the subject

12 of the authorization is required to effectuate pay13 ment for health care that has been provided to the

14 individual.

15 (2) HEALTH PLANS.—With respect to a health

16 plan, the authorization of an individual is deemed to

17 be revoked at the time of the cancellation or non-re18 newal of enrollment in the health plan, except as

19 may be necessary to complete plan administration

20 and payment requirements related to the individual’s

21 period of enrollment.

22 (3) ACTIONS.—An individual may not maintain

23 an action against a person for disclosure of person24 ally identifiable health information—
35

•HR 1057 IH

1 (A) if the disclosure was made based on a

2 good faith reliance on the individual’s author3 ization under this section at the time disclosure

4 was made;

5 (B) in a case in which the authorization is

6 revoked, if the disclosing person had no actual

7 or constructive notice of the revocation; or

8 (C) if the disclosure was for the purpose of

9 protecting another individual from imminent

10 physical harm, and is authorized under section

11 204.

12 (g) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND

13 REVOCATIONS.—Each person collecting or storing person14 ally identifiable health information shall maintain a record

15 for a period of 7 years of each authorization of an individ16 ual and any revocation thereof, and such record shall be17 come part of the personally identifiable health information

18 concerning such individual.

19 (h) RULE OF CONSTRUCTION.—Authorizations for

20 the disclosure of protected health information for treat21 ment or payment shall not authorize the disclosure of such

22 information by an individual with the intent to sell, trans23 fer, or use protected health information for commercial ad24 vantage other than the revenues directly derived from the

25 provision of health care to that individual. For such disclo-
36

•HR 1057 IH

1 sures, a separate authorization that satisfies the require2 ments of section 203 is required.

3 SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO4 TECTED HEALTH INFORMATION OTHER THAN

5 FOR TREATMENT OR PAYMENT.

6 (a) IN GENERAL.—To satisfy the requirement under

7 section 201(a)(1), a health care provider, health plan,

8 health oversight agency, public health authority, employer,

9 health researcher, law enforcement official, health or life

10 insurer, school, or university that seeks to disclose pro11 tected health information for a purpose other than treat12 ment or payment may obtain an authorization that satis13 fies the requirements of subsections (b) and (g) of section

14 202. Such an authorization under this section shall be sep15 arate from an authorization provided under section 202.

16 (b) LIMITATION ON AUTHORIZATIONS.—

17 (1) IN GENERAL.—A person subject to section

18 202 may not condition the delivery of treatment, or

19 payment for services, on the receipt of an authoriza20 tion described in this section.

21 (2) REQUIREMENT FOR SEPARATE AUTHORIZA22 TION.—A person subject to section 202 may not dis23 close protected health information to any employees

24 or agents who are responsible for making employ25 ment, work assignment, or other personnel decisions
37

•HR 1057 IH

1 with respect to the subject of the information with2 out a separate authorization permitting such a dis3 closure.

4 (c) MODEL AUTHORIZATIONS.—The Secretary, after

5 notice and opportunity for public comment, shall develop

6 and disseminate model written authorizations of the type

7 described in subsection (a). Any authorization obtained on

8 a model authorization form under this section developed

9 by the Secretary shall be deemed to meet the authorization

10 requirements of this section.

11 (d) REQUIREMENT TO RELEASE PROTECTED

12 HEALTH INFORMATION TO CORONERS AND MEDICAL EX13 AMINERS.—

14 (1) IN GENERAL.—When a Coroner or Medical

15 Examiner or their duly appointed deputies seek pro16 tected health information for the purpose of inquiry

17 into and determination of, the cause, manner, and

18 circumstances of an individual’s death, the health

19 care provider, health plan, health oversight agency,

20 public health authority, employer, health researcher,

21 law enforcement officer, health or life insurer, school

22 or university involved shall provide that individual’s

23 protected health information to the Coroner or Medi24 cal Examiner or to the duly appointed deputies with25 out undue delay.
38

•HR 1057 IH

1 (2) PRODUCTION OF ADDITIONAL INFORMA2 TION.—If a Coroner or Medical Examiner or their

3 duly appointed deputies receives health information

4 from an entity referred to in paragraph (1), such

5 health information shall remain as protected health

6 information unless the health information is at7 tached to or otherwise made a part of a Coroner’s

8 or Medical Examiner’s official report, in which case

9 it shall no longer be protected.

10 (3) EXEMPTION.—Health information attached

11 to or otherwise made a part of a Coroner’s or Medi12 cal Examiner’s official report, shall be exempt from

13 the provisions of this Act except as provided for in

14 this subsection.

15 (4) REIMBURSEMENT.—A Coroner or Medical

16 Examiner may require a person to reimburse their

17 Office for the reasonable costs associated with such

18 inspection or copying.

19 (e) REVOCATION OR AMENDMENT OF AUTHORIZA20 TION.—An individual may, in writing, revoke or amend an

21 authorization under this section at any time.

22 (f) ACTIONS.—An individual may not maintain an ac23 tion against a person for disclosure of protected health

24 information—
39

•HR 1057 IH

1 (1) if the disclosure was made based on a good

2 faith reliance on the individual’s authorization under

3 this section at the time disclosure was made;

4 (2) in a case in which the authorization is re5 voked, if the disclosing person had no actual or con6 structive notice of the revocation; or

7 (3) if the disclosure was for the purpose of pro8 tecting another individual from imminent physical

9 harm, and is authorized under section 204.

10 SEC. 204. EMERGENCY CIRCUMSTANCES.

11 (a) GENERAL RULE.—In the event of a threat of im12 minent physical or mental harm to the subject of protected

13 health information, any person may, in order to allay or

14 remedy such threat, disclose protected health information

15 about such subject to a health care practitioner, health

16 care facility, law enforcement authority, or emergency

17 medical personnel.

18 (b) HARM TO OTHERS.—Any person may disclose

19 protected health information about the subject of the in20 formation where—

21 (1) such subject has made an identifiable threat

22 of serious injury or death with respect to an identifi23 able individual or group of individuals;

24 (2) the subject has the ability to carry out such

25 threat; and
40

•HR 1057 IH

1 (3) the release of such information is necessary

2 to prevent or significantly reduce the possibility of

3 such threat being carried out.

4 SEC. 205. PUBLIC HEALTH.

5 (a) IN GENERAL.—A health care provider, health

6 plan, public health authority, employer, health or life in7 surer, law enforcement official, school, or university may

8 disclose protected health information to a public health au9 thority or other person authorized by public health law

10 when receipt of such information by the authority or other

11 person—

12 (1) relates directly to a specified public health

13 purpose;

14 (2) is reasonably likely to achieve such purpose;

15 and

16 (3) is intended for a purpose that cannot be

17 achieved through the receipt or use of de-identified

18 health information.

19 (b) PUBLIC HEALTH PURPOSE DEFINED.—For pur20 poses of subsection (a), the term ‘‘public health purpose’’

21 means a population-based activity or individual effort, au22 thorized by law, aimed at the prevention of injury, disease,

23 or premature mortality, or the promotion of health, in a

24 community, including—
41

•HR 1057 IH

1 (1) assessing the health needs and status of the

2 community through public health surveillance and

3 epidemiological research;

4 (2) developing public health policy;

5 (3) responding to public health needs and emer6 gencies; and

7 (4) any other activities or efforts authorized by

8 law.

9 SEC. 206. PROTECTION AND ADVOCACY AGENCIES.

10 Any person who creates protected health information

11 or receives protected health information under this title

12 may disclose that information to a protection and advo13 cacy agency established under part C of title I of the De14 velopmental Disabilities Assistance and Bill of Rights Act

15 (42 U.S.C. 6041 et seq.) or under the Protection and Ad16 vocacy for Mentally Ill Individuals Act of 1986 (42 U.S.C.

17 10801 et seq.) when such agency can establish that there

18 is probable cause to believe that an individual who is the

19 subject of the protected health information is vulnerable

20 to abuse and neglect by an entity providing health or social

21 services to the individual.

22 SEC. 207. OVERSIGHT.

23 (a) IN GENERAL.—A health care provider, health

24 plan, employer, law enforcement official, health or life in25 surer, public health authority, health researcher, school or
42

•HR 1057 IH

1 university may disclose protected health information to a

2 health oversight agency to enable the agency to perform

3 a health oversight function authorized by law, if—

4 (1) the purpose for which the disclosure is to be

5 made cannot reasonably be accomplished without

6 protected health information;

7 (2) the purpose for which the disclosure is to be

8 made is of sufficient importance to warrant the ef9 fect on, or the risk to, the privacy of the individuals

10 that additional exposure of the information might

11 bring; and

12 (3) there is a reasonable probability that the

13 purpose of the disclosure will be accomplished.

14 (b) USE AND MAINTENANCE OF PROTECTED

15 HEALTH INFORMATION.—A health oversight agency that

16 receives protected health information under this section—

17 (1) shall rely upon a method to scramble or

18 otherwise safeguard, to the maximum extent prac19 ticable, the identity of the subject of the protected

20 health information in all work papers and all docu21 ments summarizing the health oversight activity;

22 (2) shall maintain in its records only such infor23 mation about an individual as is relevant and nec24 essary to accomplish the purpose for which the pro25 tected health information was obtained;
43

•HR 1057 IH

1 (3) shall maintain such information securely

2 and limit access to such information to those per3 sons with a legitimate need for access to carry out

4 the purpose for which the records were obtained;

5 and

6 (4) shall remove or destroy the information that

7 allows subjects of protected health information to be

8 identified at the earliest time at which removal or

9 destruction can be accomplished, consistent with the

10 purpose of the health oversight activity.

11 (c) USE OF PROTECTED HEALTH INFORMATION IN

12 JUDICIAL PROCEEDINGS.—

13 (1) IN GENERAL.— The disclosure and use of

14 protected health information in any judicial, admin15 istrative, court, or other public, proceeding or inves16 tigation relating to a health oversight activity shall

17 be undertaken in such a manner as to preserve the

18 confidentiality and privacy of individuals who are the

19 subject of the information, unless disclosure is re20 quired by the nature of the proceedings.

21 (2) LIMITING DISCLOSURE.—Whenever disclo22 sure of the identity of the subject of protected health

23 information is required by the nature of the proceed24 ings, or it is impracticable to redact the identity of

25 such individual, the agency shall request that the
44

•HR 1057 IH

1 presiding judicial or administrative officer enter an

2 order limiting the disclosure of the identity of the

3 subject to the extent possible, including the redact4 ing of the protected health information from publicly

5 disclosed or filed pleadings or records.

6 (d) AUTHORIZATION BY A SUPERVISOR.—For pur7 poses of this section, the individual with authority to au8 thorize the oversight function involved shall provide to the

9 disclosing person described in subsection (a) a statement

10 that the protected health information is being sought for

11 a legally authorized oversight function.

12 (e) USE IN ACTION AGAINST INDIVIDUALS.—Pro13 tected health information about an individual that is dis14 closed under this section may not be used in, or disclosed

15 to any person for use in, an administrative, civil, or crimi16 nal action or investigation directed against the individual,

17 unless the action or investigation arises out of and is di18 rectly related to—

19 (1) the receipt of health care or payment for

20 health care;

21 (2) a fraudulent claim related to health; or

22 (3) oversight of a public health authority or a

23 health researcher.
45

•HR 1057 IH

1 SEC. 208. DISCLOSURE FOR LAW ENFORCEMENT PUR2 POSES.

3 (a) LAW ENFORCEMENT ACCESS TO PROTECTED

4 HEALTH INFORMATION.—A health care provider, health

5 researcher, health plan, health oversight agency, employer,

6 health or life insurer, school, university, a person acting

7 as the agent of any such person, or a person who receives

8 protected health information pursuant to section 204, may

9 disclose protected health information to an investigative

10 or law enforcement officer pursuant to a warrant issued

11 under the Federal Rules of Criminal Procedure, an equiva12 lent State warrant, a grand jury subpoena, or a court

13 order under limitations set forth in subsection (b).

14 (b) REQUIREMENTS FOR COURT ORDERS FOR AC15 CESS TO PROTECTED HEALTH INFORMATION.—A court

16 order for the disclosure of protected health information

17 under subsection (a) may be issued by any court that is

18 a court of competent jurisdiction and shall issue only if

19 the investigative or law enforcement officer submits a writ20 ten application upon oath or equivalent affirmation dem21 onstrating that there is probable cause to believe that—

22 (1) the protected health information sought is

23 relevant and material to an ongoing criminal inves24 tigation, except in the case of a State government

25 authority, such a court order shall not issue if pro26 hibited by the law of such State;
46

•HR 1057 IH

1 (2) the investigative or evidentiary needs of the

2 investigative or law enforcement officer cannot rea3 sonably be satisfied by de-identified health informa4 tion or by any other information; and

5 (3) the law enforcement need for the informa6 tion outweighs the privacy interest of the individual

7 to whom the information pertains.

8 (c) MOTIONS TO QUASH OR MODIFY.—A court

9 issuing an order pursuant to this section, on a motion

10 made promptly by the health care provider, health re11 searcher, health plan, health oversight agency, employer,

12 health or life insurer, school, university, a person acting

13 as the agent of any such person, or a person who receives

14 protected health information pursuant to section 204, may

15 quash or modify such order if the court finds that informa16 tion or records requested are unreasonably voluminous or

17 if compliance with such order otherwise would cause an

18 unreasonable burden on such persons.

19 (d) NOTICE.—

20 (1) IN GENERAL.—Except as provided in para21 graph (2), no order for the disclosure of protected

22 health information about an individual may be

23 issued by a court under this section unless prior no24 tice of the application for the order has been served

25 on the individual and the individual has been af-
47

•HR 1057 IH

1 forded an opportunity to oppose the issuance of the

2 order.

3 (2) NOTICE NOT REQUIRED.—An order for the

4 disclosure of protected health information about an

5 individual may be issued without prior notice to the

6 individual if the court finds that notice would be im7 practical because—

8 (A) the name and address of the individual

9 are unknown; or

10 (B) notice would risk destruction or un11 availability of the evidence.

12 (e) CONDITIONS.—Upon the granting of an order for

13 disclosure of protected health information under this sec14 tion, the court shall impose appropriate safeguards to en15 sure the confidentiality of such information and to protect

16 against unauthorized or improper use or disclosure.

17 (f) LIMITATION ON USE AND DISCLOSURE FOR

18 OTHER LAW ENFORCEMENT INQUIRIES.—Protected

19 health information about an individual that is disclosed

20 under this section may not be used in, or disclosed to any

21 person for use in, any administrative, civil, or criminal ac22 tion or investigation directed against the individual, unless

23 the action or investigation arises out of, or is directly re24 lated to, the law enforcement inquiry for which the infor25 mation was obtained.
48

•HR 1057 IH

1 (g) DESTRUCTION OR RETURN OF INFORMATION.—

2 When the matter or need for which protected health infor3 mation was disclosed to an investigative or law enforce4 ment officer or grand jury has concluded, including any

5 derivative matters arising from such matter or need, the

6 law enforcement agency or grand jury shall either destroy

7 the protected health information, or return it to the person

8 from whom it was obtained.

9 (h) REDACTIONS.—To the extent practicable, and

10 consistent with the requirements of due process, a law en11 forcement agency shall redact personally identifying infor12 mation from protected health information prior to the

13 public disclosure of such protected information in a judi14 cial or administrative proceeding.

15 (i) EXCEPTION.—This section shall not be construed

16 to limit or restrict the ability of law enforcement authori17 ties to gain information while in hot pursuit of a suspect

18 or if other exigent circumstances exist.

19 SEC. 209. NEXT OF KIN AND DIRECTORY INFORMATION.

20 (a) NEXT OF KIN.—A health care provider, or a per21 son who receives protected health information under sec22 tion 204, may disclose protected health information about

23 health care services provided to an individual to the indi24 vidual’s next of kin, or to another person whom the indi-
49

•HR 1057 IH

1 vidual has identified, if at the time of the treatment of

2 the individual—

3 (1) the individual—

4 (A) has been notified of the individual’s

5 right to object to such disclosure and the indi6 vidual has not objected to the disclosure; or

7 (B) is in a physical or mental condition

8 such that the individual is not capable of object9 ing, and there are no prior indications that the

10 individual would object; and

11 (2) the information disclosed relates to health

12 care services currently being provided to that indi13 vidual.

14 (b) DIRECTORY INFORMATION.—

15 (1) DISCLOSURE.—

16 (A) IN GENERAL.—Except as provided in

17 paragraph (2), with respect to an individual

18 who is admitted as an inpatient to a health care

19 facility, a person described in subsection (a)

20 may disclose information described in subpara21 graph (B) about the individual to any person if,

22 at the time of the admission, the individual—

23 (i) has been notified of the individ24 ual’s right to object and has not objected

25 to the disclosure; or
50

•HR 1057 IH

1 (ii) is in a physical or mental condi2 tion such that the individual is not capable

3 of objecting and there are no prior indica4 tions that the individual would object.

5 (B) INFORMATION.—Information described

6 in this subparagraph is information that con7 sists only of 1 or more of the following items:

8 (i) The name of the individual who is

9 the subject of the information.

10 (ii) The general health status of the

11 individual, described as critical, poor, fair,

12 stable, or satisfactory or in terms denoting

13 similar conditions.

14 (iii) The location of the individual

15 within the health care facility to which the

16 individual is admitted.

17 (2) EXCEPTION.—Paragraph (1)(B)(iii) shall

18 not apply if disclosure of the location of the individ19 ual would reveal specific information about the phys20 ical or mental condition of the individual, unless the

21 individual expressly authorizes such disclosure.

22 (c) DIRECTORY OR NEXT-OF-KIN INFORMATION.—A

23 disclosure may not be made under this section if the dis24 closing person described in subsection (a) has reason to

25 believe that the disclosure of directory or next-of-kin infor-
51

•HR 1057 IH

1 mation could lead to the physical or mental harm of the

2 individual, unless the individual expressly authorizes such

3 disclosure.

4 SEC. 210. HEALTH RESEARCH.

5 (a) REGULATIONS.—

6 (1) IN GENERAL.—The requirements and pro7 tections provided for under part 46 of title 45, Code

8 of Federal Regulations (as in effect on the date of

9 enactment of this Act), shall apply to all health re10 search.

11 (2) EFFECTIVE DATE.—Paragraph (1) shall not

12 take effect until the Secretary has promulgated final

13 regulations to implement such paragraph.

14 (b) EVALUATION.—Not later than 24 months after

15 the date of enactment of this Act, the Secretary shall pre16 pare and submit to Congress detailed recommendations on

17 whether written informed consent should be required, and

18 if so, under what circumstances, before protected health

19 information can be used for health research.

20 (c) RECOMMENDATIONS.—The recommendations re21 quired to be submitted under subsection (b) shall

22 include—

23 (1) a detailed explanation of current institu24 tional review board practices, including the extent to

25 which the privacy of individuals is taken into ac-
52

•HR 1057 IH

1 count as a factor before allowing waivers and under

2 what circumstances informed consent is being

3 waived;

4 (2) a summary of how technology could be used

5 to strip identifying data for the purposes of re6 search;

7 (3) an analysis of the risks and benefits of re8 quiring informed consent versus the waiver of in9 formed consent;

10 (4) an analysis of the risks and benefits of

11 using protected health information for research pur12 poses other than the health research project for

13 which such information was obtained; and

14 (5) an analysis of the risks and benefits of al15 lowing individuals to consent or to use consent, at

16 the time of receiving medical treatment, to the pos17 sible future use of records of medical treatments for

18 research studies.

19 (d) CONSULTATION.—In carrying out this section,

20 the Secretary shall consult with individuals who have dis21 tinguished themselves in the fields of health research, pri22 vacy, related technology, consumer interests in health in23 formation, health data standards, and the provision of

24 health services.
53

•HR 1057 IH

1 (e) CONGRESSIONAL NOTICE.—Not later than 6

2 months after the date on which the Secretary submits to

3 Congress the recommendations required under subsection

4 (b), the Secretary shall propose to implement such rec5 ommendations through regulations promulgated on the

6 record after opportunity for a hearing, and shall advise

7 the Congress of such proposal.

8 (f) OTHER REQUIREMENTS.—

9 (1) OBLIGATIONS OF THE RECIPIENT.—A per10 son who receives protected health information pursu11 ant to this section shall remove or destroy, at the

12 earliest opportunity consistent with the purposes of

13 the project involved, information that would enable

14 an individual to be identified, unless—

15 (A) an institutional review board has de16 termined that there is a health or research jus17 tification for the retention of such identifiers;

18 and

19 (B) there is an adequate plan to protect

20 the identifiers from disclosure consistent with

21 this section; and

22 (2) PERIODIC REVIEW AND TECHNICAL ASSIST23 ANCE.—

24 (A) INSTITUTIONAL REVIEW BOARD.—Any

25 institutional review board that authorizes re-
54

•HR 1057 IH

1 search under this section shall provide the Sec2 retary with the names and addresses of the in3 stitutional review board members.

4 (B) TECHNICAL ASSISTANCE.—The Sec5 retary may provide technical assistance to insti6 tutional review boards described in this sub7 section.

8 (C) MONITORING.—The Secretary shall pe9 riodically monitor institutional review boards

10 described in this subsection.

11 (D) REPORTS.—Not later than 3 years

12 after the date of enactment of this Act, the Sec13 retary shall report to Congress regarding the

14 activities of institutional review boards de15 scribed in this subsection.

16 (g) LIMITATION.—Nothing in this section shall be

17 construed to permit protected health information that is

18 received by a researcher under this section to be accessed

19 for purposes other than research or as authorized by the

20 individual.

21 SEC. 211. JUDICIAL AND ADMINISTRATIVE PURPOSES.

22 (a) IN GENERAL.—A health care provider, health

23 plan, health oversight agency, employer, insurer, health or

24 life insurer, school or university, a person acting as the

25 agent of any such person, or a person who receives pro-
55

•HR 1057 IH

1 tected health information under section 204, may disclose

2 protected health information—

3 (1) pursuant to the standards and procedures

4 established in the Federal Rules of Civil Procedure

5 or comparable rules of other courts or administrative

6 agencies, in connection with litigation or proceedings

7 to which an individual who is the subject of the in8 formation is a party and in which the individual has

9 placed his or her physical or mental condition at

10 issue;

11 (2) to a court, and to others ordered by the

12 court, if in response to a court order issued by a

13 court of competent jurisdiction in accordance with

14 subsections (b) and (c); or

15 (3) if necessary to present to a court an appli16 cation regarding the provision of treatment of an in17 dividual or the appointment of a guardian.

18 (b) COURT ORDERS FOR ACCESS TO PROTECTED

19 HEALTH INFORMATION.—A court order for the disclosure

20 of protected health information under subsection (a) may

21 be issued only if the person seeking disclosure submits a

22 written application upon oath or equivalent affirmation

23 demonstrating by clear and convincing evidence that—
56

•HR 1057 IH

1 (1) the protected health information sought is

2 necessary for the adjudication of a material fact in

3 dispute in a civil proceeding;

4 (2) the adjudicative need cannot be reasonably

5 satisfied by de-identified health information or by

6 any other information; and

7 (3) the need for the information outweighs the

8 privacy interest of the individual to whom the infor9 mation pertains.

10 (c) NOTICE.—

11 (1) IN GENERAL.—Except as provided in para12 graph (2), no order for the disclosure of protected

13 health information about an individual may be

14 issued by a court unless notice of the application for

15 the order has been served on the individual and the

16 individual has been afforded an opportunity to op17 pose the issuance of the order.

18 (2) NOTICE NOT REQUIRED.—An order for the

19 disclosure of protected health information about an

20 individual may be issued without notice to the indi21 vidual if the court finds, by clear and convincing evi22 dence, that notice would be impractical because—

23 (A) the name and address of the individual

24 are unknown; or
57

•HR 1057 IH

1 (B) notice would risk destruction or un2 availability of the evidence.

3 (d) OBLIGATIONS OF RECIPIENT.—A person seeking

4 protected health information pursuant to subsection

5 (a)(1)—

6 (1) shall notify the individual or the individual’s

7 attorney of the request for the information;

8 (2) shall provide the health care provider,

9 health plan, health oversight agency, employer, in10 surer, health or life insurer, school or university,

11 agent, or other person involved with a signed docu12 ment attesting—

13 (A) that the individual has placed his or

14 her physical or mental condition at issue in liti15 gation or proceedings in which the individual is

16 a party; and

17 (B) the date on which the individual or the

18 individual’s attorney was notified under para19 graph (1); and

20 (3) shall not accept any requested protected

21 health information from the health care provider,

22 health plan, health oversight agency, employer, in23 surer, health or life insurer, school or university,

24 agent, or person until the termination of the 10-day
58

•HR 1057 IH

1 period beginning on the date notice was given under

2 paragraph (1).

3 SEC. 212. INDIVIDUAL REPRESENTATIVES.

4 (a) IN GENERAL.—Except as provided in subsections

5 (b) and (c), a person who is authorized by law (based on

6 grounds other than an individual’s status as a minor), or

7 by an instrument recognized under law, to act as an agent,

8 attorney, proxy, or other legal representative of a individ9 ual, may, to the extent so authorized, exercise and dis10 charge the rights of the individual under this Act.

11 (b) HEALTH CARE POWER OF ATTORNEY.—A person

12 who is authorized by law (based on grounds other than

13 being a minor), or by an instrument recognized under law,

14 to make decisions about the provision of health care to

15 an individual who is incapacitated, may exercise and dis16 charge the rights of the individual under this Act to the

17 extent necessary to effectuate the terms or purposes of

18 the grant of authority.

19 (c) NO COURT DECLARATION.—If a physician or

20 other health care provider determines that an individual,

21 who has not been declared to be legally incompetent, suf22 fers from a medical condition that prevents the individual

23 from acting knowingly or effectively on the individual’s

24 own behalf, the right of the individual to authorize disclo-
59

•HR 1057 IH

1 sure under this Act may be exercised and discharged in

2 the best interest of the individual by—

3 (1) a person described in subsection (b) with re4 spect to the individual;

5 (2) a person described in subsection (a) with re6 spect to the individual, but only if a person de7 scribed in paragraph (1) cannot be contacted after

8 a reasonable effort;

9 (3) the next of kin of the individual, but only

10 if a person described in paragraph (1) or (2) cannot

11 be contacted after a reasonable effort; or

12 (4) the health care provider, but only if a per13 son described in paragraph (1), (2), or (3) cannot be

14 contacted after a reasonable effort.

15 (d) RIGHTS OF MINORS.—

16 (1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA17 PABLE.—In the case of an individual—

18 (A) who is 18 years of age or older, all

19 rights of the individual under this Act shall be

20 exercised by the individual; or

21 (B) who, acting alone, can obtain a type of

22 health care without violating any applicable law,

23 and who has sought such care, the individual

24 shall exercise all rights of an individual under
60

•HR 1057 IH

1 this Act with respect to protected health infor2 mation relating to such health care.

3 (2) INDIVIDUALS UNDER 18.—Except as pro4 vided in paragraph (1)(B), in the case of an individ5 ual who is—

6 (A) under 14 years of age, all of the indi7 vidual’s rights under this Act shall be exercised

8 through the parent or legal guardian; or

9 (B) 14 through 17 years of age, the rights

10 of inspection and supplementation, and the

11 right to authorize use and disclosure of pro12 tected health information of the individual shall

13 be exercised by the individual, or by the parent

14 or legal guardian of the individual.

15 (e) DECEASED INDIVIDUALS.—

16 (1) APPLICATION OF ACT.—The provisions of

17 this Act shall continue to apply to protected health

18 information concerning a deceased individual.

19 (2) EXERCISE OF RIGHTS ON BEHALF OF A DE20 CEASED INDIVIDUAL.—A person who is authorized

21 by law or by an instrument recognized under law, to

22 act as an executor of the estate of a deceased indi23 vidual, or otherwise to exercise the rights of the de24 ceased individual, may, to the extent so authorized,

25 exercise and discharge the rights of such deceased
61

•HR 1057 IH

1 individual under this Act. If no such designee has

2 been authorized, the rights of the deceased individ3 ual may be exercised as provided for in subsection

4 (c).

5 (3) IDENTIFICATION OF DECEASED INDIVID6 UAL.—A person described in section 209(a) may dis7 close protected health information if such disclosure

8 is necessary to assist in the identification of a de9 ceased individual.

10 SEC. 213. PROHIBITION AGAINST RETALIATION.

11 A health care provider, health researcher, health

12 plan, health oversight agency, employer, health or life in13 surer, school or university, person acting as an agent of

14 any such person, or person who receives protected health

15 information under section 204 may not adversely affect

16 another person, directly or indirectly, because such person

17 has exercised a right under this Act, disclosed information

18 relating to a possible violation of this Act, or associated

19 with, or assisted, a person in the exercise of a right under

20 this Act.
62

•HR 1057 IH

1 TITLE III—OFFICE OF HEALTH

2 INFORMATION PRIVACY OF

3 THE DEPARTMENT OF

4 HEALTH AND HUMAN SERV5 ICES

6 Subtitle A—Designation

7 SEC. 301. DESIGNATION.

8 (a) IN GENERAL.—The Secretary shall designate an

9 office within the Department of Health and Human Serv10 ices to be known as the Office of Health Information Pri11 vacy. The Office shall be headed by a Director, who shall

12 be appointed by the Secretary.

13 (b) DUTIES.—The Director of the Office of Health

14 Information Privacy shall—

15 (1) receive and investigate complaints of alleged

16 violations of this Act;

17 (2) provide for the conduct of audits where ap18 propriate;

19 (3) provide guidance to the Secretary in the im20 plementation of this Act;

21 (4) prepare and submit the report described in

22 subsection (c);

23 (5) consult with, and provide recommendation

24 to, the Secretary concerning improvements in the
63

•HR 1057 IH

1 privacy and security of protected health information

2 and concerning medical privacy research needs; and

3 (6) carry out any other activities determined

4 appropriate by the Secretary.

5 (c) REPORT ON COMPLIANCE.—Not later than Janu6 ary 1 of the first calendar year beginning more than 1

7 year after the establishment of the Office under subsection

8 (a), and every January 1 thereafter, the Director of the

9 Office of Health Information Privacy shall prepare and

10 submit to Congress a report concerning the number of

11 complaints of alleged violations of this Act that are re12 ceived during the year for which the report is being pre13 pared. Such report shall describe the complaints and any

14 remedial action taken concerning such complaints.

15 Subtitle B—Enforcement

16 CHAPTER 1—CRIMINAL PROVISIONS

17 SEC. 311. WRONGFUL DISCLOSURE OF PROTECTED

18 HEALTH INFORMATION.

19 (a) IN GENERAL.—Part I of title 18, United States

20 Code, is amended by adding at the end the following:

21 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE

22 OF PROTECTED HEALTH INFORMATION

‘‘Sec.

‘‘2801. Wrongful disclosure of protected health information.
64

•HR 1057 IH

1 ‘‘§ 2801. Wrongful disclosure of protected health in2 formation

3 ‘‘(a) OFFENSE.—The penalties described in sub4 section (b) shall apply to a person that knowingly and

5 intentionally—

6 ‘‘(1) obtains or attempts to obtain protected

7 health information relating to an individual in viola8 tion of title II of the Medical Information Privacy

9 and Security Act; or

10 ‘‘(2) discloses or attempts to disclose protected

11 health information to another person in violation of

12 title II of the Medical Information Privacy and Se13 curity Act.

14 ‘‘(b) PENALTIES.—A person described in subsection

15 (a) shall—

16 ‘‘(1) be fined not more than $50,000, impris17 oned not more than 1 year, or both;

18 ‘‘(2) if the offense is committed under false pre19 tenses, be fined not more than $250,000, imprisoned

20 not more than 5 years, or any combination of such

21 penalties; or

22 ‘‘(3) if the offense is committed with the intent

23 to sell, transfer, or use protected health information

24 for commercial advantage, personal gain, or mali25 cious harm, be fined not more than $500,000, im26 prisoned not more than 10 years, excluded from par-
65

•HR 1057 IH

1 ticipation in any Federally funded health care pro2 grams, or any combination of such penalties.

3 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per4 son described in subsection (a), the maximum penalties

5 described in subsection (b) shall be doubled for every sub6 sequent conviction for an offense arising out of a violation

7 or violations related to a set of circumstances that are dif8 ferent from those involved in the previous violation or set

9 of related violations described in such subsection (a).’’.

10 (b) CLERICAL AMENDMENT.—The table of chapters

11 for part I of title 18, United States Code, is amended by

12 inserting after the item relating to chapter 123 the follow13 ing new item:

‘‘124. Wrongful disclosure of protected health information ..................... 2801’’.

14 SEC. 312. DEBARMENT FOR CRIMES.

15 (a) PURPOSE.—The purpose of this section is to pro16 mote the prevention and deterrence of instances of inten17 tional criminal actions which violate criminal laws which

18 are designed to protect the privacy of protected health in19 formation in a manner consistent with this Act.

20 (b) DEBARMENT.—Not later than 270 days after the

21 date of enactment of this Act, the Attorney General, in

22 consultation with the Secretary, shall promulgate regula23 tions and establish procedures to permit the debarment

24 of health care providers, health researchers, health or life

25 insurers, employers, or schools or universities from receiv-
66

•HR 1057 IH

1 ing benefits under any Federal health programs or other

2 Federal procurement program if the managers or officers

3 of such persons are found guilty of violating section 2801

4 of title 18, United States Code, have civil penalties im5 posed against such officers or managers under section 321

6 in connection with the illegal disclosure of protected health

7 information, or are found guilty of making a false state8 ment or obstructing justice related to attempting to con9 ceal or concealing such illegal disclosure. Such regulations

10 shall take into account the need for continuity of medical

11 care and may provide for a delay of any debarment im12 posed under this section to take into account the medical

13 needs of patients.

14 (c) CONSULTATION.—Before publishing a proposed

15 rule to implement subsection (b), the Attorney General

16 shall consult with State law enforcement officials, health

17 care providers, patient privacy rights’ advocates, and other

18 appropriate persons, to gain additional information re19 garding the debarment of entities under subsection (b)

20 and the best methods to ensure the continuity of medical

21 care.

22 (d) REPORT.—The Attorney General shall annually

23 prepare and submit to the Committee on the Judiciary of

24 the House of Representatives and the Committee on the

25 Judiciary of the Senate a report concerning the activities
67

•HR 1057 IH

1 and debarment actions taken by the Attorney General

2 under this section.

3 (e) ASSISTANCE TO PREVENT CRIMINAL VIOLA4 TIONS.—The Attorney General, in cooperation with any

5 other appropriate individual, organization, or agency, may

6 provide advice, training, technical assistance, and guid7 ance regarding ways to reduce the incidence of improper

8 disclosure of protected health information.

9 (f) RELATIONSHIP TO OTHER AUTHORITIES.—A de10 barment imposed under this section shall not reduce or

11 diminish the authority of a Federal, State, or local govern12 mental agency or court to penalize, imprison, fine, sus13 pend, debar, or take other adverse action against a person,

14 in a civil, criminal, or administrative proceeding.

15 CHAPTER 2—CIVIL SANCTIONS

16 SEC. 321. CIVIL PENALTY.

17 (a) VIOLATION.—A health care provider, health re18 searcher, health plan, health oversight agency, public

19 health agency, law enforcement agency, employer, health

20 or life insurer, school, or university, or a person acting

21 as the agent of any such person, who the Secretary, in

22 consultation with the Attorney General, determines has

23 substantially and materially failed to comply with this Act

24 shall be subject, in addition to any other penalties that

25 may be prescribed by law—
68

•HR 1057 IH

1 (1) in a case in which the violation relates to

2 title I, to a civil penalty of not more than $500 for

3 each such violation, but not to exceed $5000 in the

4 aggregate for multiple violations;

5 (2) in a case in which the violation relates to

6 title II, to a civil penalty of not more than $10,000

7 for each such violation, but not to exceed $50,000

8 in the aggregate for multiple violations; or

9 (3) in a case in which the Secretary finds that

10 such violations have occurred with such frequency as

11 to constitute a general business practice, to a civil

12 penalty of not more than $100,000.

13 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

14 Section 1128A of the Social Security Act (42 U.S.C.

15 1320a–7a), other than subsections (a) and (b) and the

16 second sentence of subsection (f) of that section, shall

17 apply to the imposition of a civil, monetary, or exclusion18 ary penalty under this section in the same manner as such

19 provisions apply with respect to the imposition of a penalty

20 under section 1128A of such Act.

21 SEC. 322. PROCEDURES FOR IMPOSITION OF PENALTIES.

22 (a) INITIATION OF PROCEEDINGS.—

23 (1) IN GENERAL.—The Secretary, in consulta24 tion with the Attorney General, may initiate a pro25 ceeding to determine whether to impose a civil
69

•HR 1057 IH

1 money penalty under section 321. The Secretary

2 may not initiate an action under this section with re3 spect to any violation described in section 321 after

4 the expiration of the 6-year period beginning on the

5 date on which such violation was alleged to have oc6 curred. The Secretary may initiate an action under

7 this section by serving notice of the action in any

8 manner authorized by Rule 4 of the Federal Rules

9 of Civil Procedure.

10 (2) NOTICE AND OPPORTUNITY FOR HEAR11 ING.—The Secretary shall not make a determination

12 adverse to any person under paragraph (1) until the

13 person has been given written notice and an oppor14 tunity for the determination to be made on the

15 record after a hearing at which the person is entitled

16 to be represented by counsel, to present witnesses,

17 and to cross-examine witnesses against the person.

18 (3) ESTOPPEL.—In a proceeding under para19 graph (1) that—

20 (A) is against a person who has been con21 victed (whether upon a verdict after trial or

22 upon a plea of guilty or nolo contendere) of a

23 crime under section 2801 of title 18, United

24 States Code; and
70

•HR 1057 IH

1 (B) involves the same conduct as in the

2 criminal action;

3 the person is estopped from denying the essential

4 elements of the criminal offense.

5 (4) SANCTIONS FOR FAILURE TO COMPLY.—

6 The official conducting a hearing under this section

7 may sanction a person, including any party or attor8 ney, for failing to comply with an order or proce9 dure, failing to defend an action, or other mis10 conduct as would interfere with the speedy, orderly,

11 or fair conduct of the hearing. Such sanction shall

12 reasonably relate to the severity and nature of the

13 failure or misconduct. Such sanction may include—

14 (A) in the case of refusal to provide or per15 mit discovery, drawing negative factual infer16 ences or treating such refusal as an admission

17 by deeming the matter, or certain facts, to be

18 established;

19 (B) prohibiting a party from introducing

20 certain evidence or otherwise supporting a par21 ticular claim or defense;

22 (C) striking pleadings, in whole or in part;

23 (D) staying the proceedings;

24 (E) dismissal of the action;

25 (F) entering a default judgment;
71

•HR 1057 IH

1 (G) ordering the party or attorney to pay

2 attorneys’ fees and other costs caused by the

3 failure or misconduct; and

4 (H) refusing to consider any motion or

5 other action which is not filed in a timely man6 ner.

7 (b) SCOPE OF PENALTY.—In determining the

8 amount or scope of any penalty imposed pursuant to sec9 tion 321, the Secretary shall take into account—

10 (1) the nature of claims and the circumstances

11 under which they were presented;

12 (2) the degree of culpability, history of prior of13 fenses, and financial condition of the person against

14 whom the claim is brought; and

15 (3) such other matters as justice may require.

16 (c) REVIEW OF DETERMINATION.—

17 (1) IN GENERAL.—Any person adversely af18 fected by a determination of the Secretary under

19 this section may obtain a review of such determina20 tion in the United States Court of Appeals for the

21 circuit in which the person resides, or in which the

22 claim was presented, by filing in such court (within

23 60 days following the date the person is notified of

24 the determination of the Secretary a written petition
72

•HR 1057 IH

1 requesting that the determination be modified or set

2 aside.

3 (2) FILING OF RECORD.—A copy of the petition

4 filed under paragraph (1) shall be forthwith trans5 mitted by the clerk of the court to the Secretary,

6 and thereupon the Secretary shall file in the Court

7 the record in the proceeding as provided in section

8 2112 of title 28, United States Code. Upon such fil9 ing, the court shall have jurisdiction of the proceed10 ing and of the question determined therein, and

11 shall have the power to make and enter upon the

12 pleadings, testimony, and proceedings set forth in

13 such record a decree affirming, modifying, remand14 ing for further consideration, or setting aside, in

15 whole or in part, the determination of the Secretary

16 and enforcing the same to the extent that such order

17 is affirmed or modified.

18 (3) CONSIDERATION OF OBJECTIONS.—No ob19 jection that has not been raised before the Secretary

20 with respect to a determination described in para21 graph (1) shall be considered by the court, unless

22 the failure or neglect to raise such objection shall be

23 excused because of extraordinary circumstances.

24 (4) FINDINGS.—The findings of the Secretary

25 with respect to questions of fact in an action under
73

•HR 1057 IH

1 this subsection, if supported by substantial evidence

2 on the record considered as a whole, shall be conclu3 sive. If any party shall apply to the court for leave

4 to adduce additional evidence and shall show to the

5 satisfaction of the court that such additional evi6 dence is material and that there were reasonable

7 grounds for the failure to adduce such evidence in

8 the hearing before the Secretary, the court may

9 order such additional evidence to be taken before the

10 Secretary and to be made a part of the record. The

11 Secretary may modify findings as to the facts, or

12 make new findings, by reason of additional evidence

13 so taken and filed, and shall file with the court such

14 modified or new findings, and such findings with re15 spect to questions of fact, if supported by substan16 tial evidence on the record considered as a whole,

17 and the recommendations of the Secretary, if any,

18 for the modification or setting aside of the original

19 order, shall be conclusive.

20 (5) EXCLUSIVE JURISDICTION.—Upon the filing

21 of the record with the court under paragraph (2),

22 the jurisdiction of the court shall be exclusive and its

23 judgment and decree shall be final, except that the

24 same shall be subject to review by the Supreme
74

•HR 1057 IH

1 Court of the United States, as provided for in sec2 tion 1254 of title 28, United States Code.

3 (d) RECOVERY OF PENALTIES.—

4 (1) IN GENERAL.—Civil money penalties im5 posed under this chapter may be compromised by

6 the Secretary and may be recovered in a civil action

7 in the name of the United States brought in United

8 States district court for the district where the claim

9 was presented, or where the claimant resides, as de10 termined by the Secretary. Amounts recovered under

11 this section shall be paid to the Secretary and depos12 ited as miscellaneous receipts of the Treasury of the

13 United States.

14 (2) DEDUCTION FROM AMOUNTS OWING.—The

15 amount of any penalty, when finally determined

16 under this section, or the amount agreed upon in

17 compromise under paragraph (1), may be deducted

18 from any sum then or later owing by the United

19 States or a State to the person against whom the

20 penalty has been assessed.

21 (e) DETERMINATION FINAL.—A determination by

22 the Secretary to impose a penalty under section 321 shall

23 be final upon the expiration of the 60-day period referred

24 to in subsection (c)(1). Matters that were raised or that

25 could have been raised in a hearing before the Secretary
75

•HR 1057 IH

1 or in an appeal pursuant to subsection (c) may not be

2 raised as a defense to a civil action by the United States

3 to collect a penalty under section 321.

4 (f) SUBPOENA AUTHORITY.—

5 (1) IN GENERAL.—For the purpose of any

6 hearing, investigation, or other proceeding author7 ized or directed under this section, or relative to any

8 other matter within the jurisdiction of the Secretary

9 hereunder, the Secretary shall have the power to

10 issue subpoenas requiring the attendance and testi11 mony of witnesses and the production of any evi12 dence that relates to any matter under investigation

13 or in question. Such attendance of witnesses and

14 production of evidence at the designated place of

15 such hearing, investigation, or other proceeding may

16 be required from any place in the United States or

17 in any Territory or possession thereof.

18 (2) SERVICE.—Subpoenas of the Secretary

19 under paragraph (1) shall be served by anyone au20 thorized by the Secretary by delivering a copy there21 of to the individual named therein.

22 (3) PROOF OF SERVICE.—A verified return by

23 the individual serving the subpoena under this sub24 section setting forth the manner of service shall be

25 proof of service.
76

•HR 1057 IH

1 (4) FEES.—Witnesses subpoenaed under this

2 subsection shall be paid the same fees and mileage

3 as are paid witnesses in the district court of the

4 United States.

5 (5) REFUSAL TO OBEY.—In case of contumacy

6 by, or refusal to obey a subpoena duly served upon,

7 any person, any district court of the United States

8 for the judicial district in which such person charged

9 with contumacy or refusal to obey is found or re10 sides or transacts business, upon application by the

11 Secretary, shall have jurisdiction to issue an order

12 requiring such person to appear and give testimony,

13 or to appear and produce evidence, or both. Any fail14 ure to obey such order of the court may be punished

15 by the court as contempt thereof.

16 (g) INJUNCTIVE RELIEF.—Whenever the Secretary

17 has reason to believe that any person has engaged, is en18 gaging, or is about to engage in any activity which makes

19 the person subject to a civil monetary penalty under sec20 tion 321, the Secretary may bring an action in an appro21 priate district court of the United States (or, if applicable,

22 a United States court of any territory) to enjoin such ac23 tivity, or to enjoin the person from concealing, removing,

24 encumbering, or disposing of assets which may be required
77

•HR 1057 IH

1 in order to pay a civil monetary penalty if any such pen2 alty were to be imposed or to seek other appropriate relief.

3 (h) AGENCY.—A principal is jointly and severally lia4 ble with the principal’s agent for penalties under section

5 321 for the actions of the principal’s agent acting within

6 the scope of the agency.

7 SEC. 323. CIVIL ACTION BY INDIVIDUALS.

8 (a) IN GENERAL.—Any individual whose rights under

9 this Act have been knowingly or negligently violated may

10 bring a civil action to recover—

11 (1) such preliminary and equitable relief as the

12 court determines to be appropriate; and

13 (2) the greater of compensatory damages or liq14 uidated damages of $5,000.

15 (b) PUNITIVE DAMAGES.—In any action brought

16 under this section in which the individual has prevailed

17 because of a knowing violation of a provision of this Act,

18 the court may, in addition to any relief awarded under

19 subsection (a), award such punitive damages as may be

20 warranted.

21 (c) ATTORNEY’S FEES.—In the case of a civil action

22 brought under subsection (a) in which the individual has

23 substantially prevailed, the court may assess against the

24 respondent a reasonable attorney’s fee and other litigation
78

•HR 1057 IH

1 costs and expenses (including expert fees) reasonably in2 curred.

3 (d) LIMITATION.—No action may be commenced

4 under this section more than 3 years after the date on

5 which the violation was or should reasonably have been

6 discovered.

7 (e) AGENCY.—A principal is jointly and severally lia8 ble with the principal’s agent for damages under this sec9 tion for the actions of the principal’s agent acting within

10 the scope of the agency.

11 (f) ADDITIONAL REMEDIES.—The equitable relief or

12 damages that may be available under this section shall be

13 in additional to any other lawful remedy or award avail14 able.

15 TITLE IV—MISCELLANEOUS

16 SEC. 401. RELATIONSHIP TO OTHER LAWS.

17 (a) FEDERAL AND STATE LAWS.—Nothing in this

18 Act shall be construed as preempting, superseding, or re19 pealing, explicitly or implicitly, other Federal or State laws

20 or regulations relating to protected health information or

21 relating to an individual’s access to protected health infor22 mation or health care services, if such laws or regulations

23 provide protections for the rights of individuals to the pri24 vacy of, and access to, their health information that are

25 greater than those provided for in this Act.
79

•HR 1057 IH

1 (b) PRIVILEGES.—Nothing in this Act shall be con2 strued to preempt or modify any provisions of State statu3 tory or common law to the extent that such law concerns

4 a privilege of a witness or person in a court of that State.

5 This Act shall not be construed to supersede or modify

6 any provision of Federal statutory or common law to the

7 extent such law concerns a privilege of a witness or person

8 in a court of the United States. Authorizations pursuant

9 to section 202 shall not be construed as a waiver of any

10 such privilege.

11 (c) CERTAIN DUTIES UNDER LAW.—Nothing in this

12 Act shall be construed to preempt, supersede, or modify

13 the operation of any State law that—

14 (1) provides for the reporting of vital statistics

15 such as birth or death information;

16 (2) requires the reporting of abuse or neglect

17 information about any individual;

18 (3) regulates the disclosure or reporting of in19 formation concerning an individual’s mental health;

20 or

21 (4) governs a minor’s rights to access protected

22 health information or health care services.

23 (d) FEDERAL PRIVACY ACT.—
80

•HR 1057 IH

1 (1) MEDICAL EXEMPTIONS.—Section 552a of

2 title 5, United States Code, is amended by adding

3 at the end the following:

4 ‘‘(w) CERTAIN PROTECTED HEALTH INFORMA5 TION.—The head of an agency that is a health care pro6 vider, health plan, health oversight agency, employer, in7 surer, health or life insurer, school or university, or person

8 who receives protected health information under section

9 204 of the Medical Information Privacy and Security Act

10 shall promulgate rules, in accordance with the require11 ments (including general notice) of subsections (b)(1),

12 (b)(2), (b)(3), (c), (e) of section 553 of this title, to ex13 empt a system of records within the agency, to the extent

14 that the system of records contains protected health infor15 mation (as defined in section 4 of such Act), from all pro16 visions of this section except subsections (b)(6), (d),

17 (e)(1), (e)(2), subparagraphs (A) through (C) and (E)

18 through (I) of subsection (e)(4), and subsections (e)(5),

19 (e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (r), and (u).’’.

20 (2) TECHNICAL AMENDMENT.—Section

21 552a(f)(3) of title 5, United States Code, is amend22 ed by striking ‘‘pertaining to him,’’ and all that fol23 lows through the semicolon and inserting ‘‘pertain24 ing to the individual.’’
81

•HR 1057 IH

1 (e) CONSTITUTION.—Nothing in this Act shall be

2 construed to alter, diminish, or otherwise weaken existing

3 legal standards under the Constitution regarding the con4 fidentiality of protected health information.

5 SEC. 402. EFFECTIVE DATE.

6 (a) EFFECTIVE DATE.—Unless specifically provided

7 for otherwise, this Act shall take effect on the date that

8 is 12 months after the date of the promulgation of the

9 regulations required under subsection (b), or 30 months

10 after the date of enactment of this Act, whichever is ear11 lier.

12 (b) REGULATIONS.—Not later than 12 months after

13 the date of enactment of this Act, or as specifically pro14 vided for otherwise, the Secretary shall promulgate regula15 tions implementing this Act.

Æ