I

103D CONGRESS

2D SESSION H. R. 4077

To establish a code of fair information practices for health information,

to amend section 552a of title 5, United States Code, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

MARCH 17, 1994

Mr. CONDIT (for himself, Mr. CONYERS, and Ms. VELA ́ZQUEZ) introduced the

following bill; which was referred jointly to the Committees on Government Operations, the Judiciary, and Energy and Commerce

A BILL

To establish a code of fair information practices for health

information, to amend section 552a of title 5, United

States Code, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Fair Health Information Practices Act of 1994’’.

6 (b) TABLE OF CONTENTS.—The table of contents for

7 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings and purposes.

Sec. 3. Definitions.
2

•HR 4077 IH

TITLE I—FAIR INFORMATION PRACTICES FOR PROTECTED

HEALTH INFORMATION

Subtitle A—Treatment of Protected Health Information

Sec. 101. Duties and authorities of health use trustees.

Sec. 102. Duties and authorities of public health trustees.

Sec. 103. Duties and authorities of special purpose trustees.

Sec. 104. Duties and authorities of affiliated persons.

Subtitle B—Duties and Authorities of Health Information Trustees

PART 1—DUTIES OF HEALTH INFORMATION TRUSTEES

Sec. 111. Inspection of protected health information.

Sec. 112. Amendment of protected health information.

Sec. 113. Notice of information practices.

Sec. 114. Accounting for disclosures.

Sec. 115. Security.

PART 2—USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION

Sec. 121. General limitations on use and disclosure.

Sec. 122. Authorizations for disclosure of protected health information.

Sec. 123. Treatment, payment, and oversight.

Sec. 124. Next of kin and directory information.

Sec. 125. Public health.

Sec. 126. Emergency circumstances.

Sec. 127. Judicial, administrative, and other legal purposes.

Sec. 128. Health research.

Sec. 129. Law enforcement.

Sec. 130. Subpoenas, warrants, and search warrants.

Subtitle C—Access Procedures and Challenge Rights

Sec. 141. Access procedures for law enforcement subpoenas, warrants, and

search warrants.

Sec. 142. Challenge procedures for law enforcement subpoenas.

Sec. 143. Access and challenge procedures for other subpoenas.

Sec. 144. Construction of subtitle; suspension of statute of limitations.

Sec. 145. Responsibilities of Secretary.

Subtitle D—Miscellaneous Provisions

Sec. 151. Debit and credit card transactions.

Sec. 152. Access to protected health information outside of the United States.

Sec. 153. Standards for electronic documents and communications.

Sec. 154. Powers of attorney.

Sec. 155. Rights of incompetents.

Sec. 156. Rights of minors.

Subtitle E—Enforcement

Sec. 161. Civil actions.

Sec. 162. Civil money penalties.

Sec. 163. Alternative dispute resolution.

Sec. 164. Amendments to criminal law.
3

•HR 4077 IH

TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE

Sec. 201. Amendments to title 5, United States Code.

TITLE III—REGULATIONS; EFFECTIVE DATES; APPLICABILITY;

AND RELATIONSHIP TO OTHER LAWS

Sec. 301. Regulations.

Sec. 302. Effective dates.

Sec. 303. Applicability.

Sec. 304. Relationship to other laws.

1 SEC. 2. FINDINGS AND PURPOSES.

2 (a) FINDINGS.—The Congress finds as follows:

3 (1) The right to privacy is a personal and fun4 damental right protected by the Constitution of the

5 United States.

6 (2) The improper use or disclosure of personally

7 identifiable health information about an individual

8 may cause significant harm to the interests of the

9 individual in privacy and health care, and may un10 fairly affect the ability of the individual to obtain

11 employment, education, insurance, credit, and other

12 necessities.

13 (3) Current legal protections for health infor14 mation vary from State to State and are inadequate

15 to meet the need for fair information practices

16 standards.

17 (4) The movement of individuals and health in18 formation across State lines, access to and exchange

19 of health information from automated data banks

20 and networks, and the emergence of multistate
4

•HR 4077 IH

1 health care providers and payors create a compelling

2 need for uniform Federal law, rules, and procedures

3 governing the use, maintenance, and disclosure of

4 health information.

5 (5) Uniform rules governing the use, mainte6 nance, and disclosure of health information are an

7 essential part of health care reform, are necessary to

8 support the computerization of health information,

9 and can reduce the cost of providing health services

10 by making the necessary transfer of health informa11 tion more efficient.

12 (6) An individual needs access to health infor13 mation about the individual as a matter of fairness,

14 to enable the individual to make informed decisions

15 about health care, and to correct inaccurate or in16 complete information.

17 (b) PURPOSES.—The purposes of this Act are as

18 follows:

19 (1) To define the rights of an individual with

20 respect to health information about the individual

21 that is created or maintained as part of the health

22 treatment and payment process.

23 (2) To define the rights and responsibilities of

24 a person who creates or maintains individually iden-
5

•HR 4077 IH

1 tifiable health information that originates or is used

2 in the health treatment or payment process.

3 (3) To establish effective mechanisms to enforce

4 the rights and responsibilities defined in this Act.

5 SEC. 3. DEFINITIONS.

6 (a) DEFINITIONS RELATING TO PROTECTED

7 HEALTH INFORMATION.—For purposes of this Act:

8 (1) DISCLOSE.—The term ‘‘disclose’’, when

9 used with respect to protected health information,

10 means to provide access to the information, but only

11 if such access is provided by a health information

12 trustee to a person other than—

13 (A) the trustee or an officer or employee of

14 the trustee;

15 (B) an affiliated person of the trustee; or

16 (C) the individual who is the subject of the

17 information.

18 (2) DISCLOSURE.—The term ‘‘disclosure’’

19 means the act or an instance of disclosing.

20 (3) PROTECTED HEALTH INFORMATION.—The

21 term ‘‘protected health information’’ means any in22 formation, whether oral or recorded in any form or

23 medium, that—
6

•HR 4077 IH

1 (A) is created or received by a health use

2 trustee or a public health trustee in a State;

3 and

4 (B) relates to the past, present, or future

5 physical or mental health of an individual, the

6 provision of health care to an individual, or

7 payment for the provision of health care to an

8 individual and—

9 (i) identifies the individual; or

10 (ii) with respect to which there is a

11 reasonable basis to believe that the infor12 mation can be used readily to identify the

13 individual.

14 (b) DEFINITIONS RELATING TO HEALTH INFORMA15 TION TRUSTEES.—For purposes of this Act:

16 (1) HEALTH BENEFIT PLAN.—The term

17 ‘‘health benefit plan’’ means any public or private

18 entity or program that provides payments for health

19 care—

20 (A) including—

21 (i) a group health plan (as defined in

22 section 607 of the Employee Retirement

23 Income Security Act of 1974) or a multiple

24 employer welfare arrangement (as defined
7

•HR 4077 IH

1 in section 3(40) of such Act) providing

2 health benefits; and

3 (ii) any other health insurance ar4 rangement, including any arrangement

5 consisting of a hospital or medical expense

6 incurred policy or certificate, hospital or

7 medical service plan contract, or health

8 maintenance organization subscriber con9 tract;

10 (B) but not including—

11 (i) an individual making payment on

12 the individual’s own behalf (or on behalf of

13 a relative or other individual) for health

14 care or for deductibles, coinsurance,

15 copayments, items, or services not covered

16 under a health insurance arrangement;

17 (ii) a plan sponsor (as defined in sec18 tion 3(16) of the Employee Retirement In19 come Security Act of 1974);

20 (iii) an employer of an employee cov21 ered under a multiple employer welfare

22 arrangement;

23 (iv) an employee organization that

24 sponsors a multiple employer welfare

25 arrangement; or
8

•HR 4077 IH

1 (v) an organization, association, com2 mittee, joint board of trustees, or similar

3 group of representatives of 2 or more em4 ployers described in clause (iii) or 2 or

5 more employee organizations described in

6 clause (iv).

7 (2) HEALTH CARE PROVIDER.—The term

8 ‘‘health care provider’’ means a person who is li9 censed, certified, registered, or otherwise authorized

10 by law to provide an item or service that constitutes

11 health care in the ordinary course of business or

12 practice of a profession.

13 (3) HEALTH INFORMATION TRUSTEE.—The

14 term ‘‘health information trustee’’ means a person

15 who—

16 (A) creates or receives protected health in17 formation that affects interstate commerce; and

18 (B) is a health use trustee, public health

19 trustee, or special purpose trustee.

20 (4) HEALTH OVERSIGHT AGENCY.—The term

21 ‘‘health oversight agency’’ means a person—

22 (A) who performs or oversees the perform23 ance of an assessment, evaluation, determina24 tion, or investigation relating to the licensing,
9

•HR 4077 IH

1 accreditation, or certification of health care

2 providers;

3 (B) who—

4 (i) enters into agreements with health

5 benefit plans that are offered to individuals

6 residing in a specific geographic region in

7 order to facilitate the enrollment of such

8 individuals in such plans; and

9 (ii) is a public agency, acting on be10 half of a public agency, acting pursuant to

11 a requirement of a public agency, or carry12 ing out activities under a State or Federal

13 statute regulating the agreements; or

14 (C) who—

15 (i) performs or oversees the perform16 ance of an assessment, evaluation, deter17 mination, or investigation relating to the

18 effectiveness of, compliance with, or appli19 cability of, legal, fiscal, medical, or sci20 entific standards or aspects of performance

21 related to the delivery of, or payment for,

22 health care; and

23 (ii) is a public agency, acting on be24 half of a public agency, acting pursuant to

25 a requirement of a public agency, or carry-
10

•HR 4077 IH

1 ing out activities under a State or Federal

2 statute regulating the assessment, evalua3 tion, determination, or investigation.

4 (5) HEALTH RESEARCHER.—The term ‘‘health

5 researcher’’ means a person who conducts a health

6 research project.

7 (6) HEALTH USE TRUSTEE.—The term ‘‘health

8 use trustee’’ means a person who, with respect to

9 protected health information, receives, creates, uses,

10 maintains, or transmits such information while act11 ing in whole or in part in the capacity of—

12 (A) a health care provider, health benefit

13 plan, or health oversight agency; or

14 (B) an officer or employee of a person de15 scribed in subparagraph (A).

16 (7) PUBLIC HEALTH AUTHORITY.—The term

17 ‘‘public health authority’’ means an authority of the

18 United States, a State, or a political subdivision of

19 a State that—

20 (A) is responsible for public health mat21 ters; and

22 (B) is conducting—

23 (i) a disease or injury reporting pro24 gram;

25 (ii) public health surveillance; or
11

•HR 4077 IH

1 (iii) a public health investigation.

2 (8) PUBLIC HEALTH TRUSTEE.—The term

3 ‘‘public health trustee’’ means a person who, with

4 respect to protected health information, receives,

5 creates, uses, maintains, or transmits such informa6 tion while acting in whole or in part in the capacity

7 of—

8 (A) a health researcher;

9 (B) a public health authority; or

10 (C) an officer or employee of a person de11 scribed in subparagraph (A) or (B).

12 (9) SPECIAL PURPOSE TRUSTEE.—The term

13 ‘‘special purpose trustee’’ means a person who, with

14 respect to protected health information—

15 (A) receives such information under sec16 tion 126 (relating to emergency circumstances),

17 127 (relating to judicial, administrative, and

18 other legal purposes), 129 (relating to law en19 forcement), or 130 (relating to subpoenas, war20 rants, and search warrants); or

21 (B) is acting in whole or in part in the ca22 pacity of an officer or employee of a person de23 scribed in subparagraph (A) with respect to

24 such information.

25 (c) OTHER DEFINITIONS.—For purposes of this Act:
12

•HR 4077 IH

1 (1) AFFILIATED PERSON.—The term ‘‘affiliated

2 person’’ means a person who—

3 (A) is not a health information trustee;

4 (B) is a contractor, subcontractor, affiliate,

5 or subsidiary of a person who is a health infor6 mation trustee; and

7 (C) pursuant to an agreement or other re8 lationship with such trustee, receives, creates,

9 uses, maintains, or transmits protected health

10 information in order to conduct a legitimate

11 business activity of the trustee.

12 (2) HEALTH CARE.—The term ‘‘health care’’—

13 (A) means—

14 (i) any preventive, diagnostic, thera15 peutic, rehabilitative, maintenance, or pal16 liative care, counseling, service, or proce17 dure—

18 (I) with respect to the physical or

19 mental condition of an individual; or

20 (II) affecting the structure or

21 function of the human body or any

22 part of the human body, including

23 banking of blood, sperm, organs, or

24 any other tissue; or
13

•HR 4077 IH

1 (ii) any sale or dispensing of a drug,

2 device, equipment, or other item to an indi3 vidual, or for the use of an individual, pur4 suant to a prescription; but

5 (B) does not include any item or service

6 that is not furnished for the purpose of main7 taining or improving the health of an individual.

8 (3) HEALTH RESEARCH PROJECT.—The term

9 ‘‘health research project’’ means a biomedical, epide10 miological, or health services research project, or a

11 health statistics project, that has been approved

12 by—

13 (A) an institutional review board for the

14 organization sponsoring the project;

15 (B) an institutional review board for each

16 health information trustee that maintains pro17 tected health information intended to be used in

18 the project; or

19 (C) an institutional review board estab20 lished or designated by the Secretary.

21 (4) INSTITUTIONAL REVIEW BOARD.—The term

22 ‘‘institutional review board’’ means—

23 (A) a board established in accordance with

24 regulations of the Secretary under section

25 491(a) of the Public Health Service Act;
14

•HR 4077 IH

1 (B) a similar board established by the Sec2 retary for the protection of human subjects in

3 research conducted by the Secretary;

4 (C) a similar board established under regu5 lations of a Federal Government authority other

6 than the Secretary; or

7 (D) a similar board which meets such re8 quirements as the Secretary may specify.

9 (5) LAW ENFORCEMENT INQUIRY.—The term

10 ‘‘law enforcement inquiry’’ means a lawful investiga11 tion or official proceeding inquiring into a specific

12 violation of, or failure to comply with, any criminal

13 or civil statute or any regulation, rule, or order is14 sued pursuant to such a statute.

15 (6) PERSON.—The term ‘‘person’’ includes an

16 authority of the United States, a State, or a political

17 subdivision of a State.

18 (7) SECRETARY.—The term ‘‘Secretary’’ means

19 the Secretary of Health and Human Services.

20 (8) STATE.—The term ‘‘State’’ includes the

21 District of Columbia, Puerto Rico, the Virgin Is22 lands, Guam, American Samoa, and the Northern

23 Mariana Islands.
15

•HR 4077 IH

1 TITLE I—FAIR INFORMATION

2 PRACTICES FOR PROTECTED

3 HEALTH INFORMATION

4 Subtitle A—Treatment of Protected

5 Health Information

6 SEC. 101. DUTIES AND AUTHORITIES OF HEALTH USE

7 TRUSTEES.

8 A health use trustee—

9 (1) shall comply with sections 111 (relating to

10 inspection), 112 (relating to amendment), 113 (re11 lating to notice of information practices), 114 (relat12 ing to accounting for disclosures), and 115 (relating

13 to security);

14 (2) may use protected health information if

15 such use is in accordance with section 121; and

16 (3) may disclose such information if such dis17 closure is in accordance with section 121 and 1 or

18 more of the following sections:

19 (A) Section 122 (relating to authoriza20 tions).

21 (B) Section 123 (relating to treatment,

22 payment, and oversight).

23 (C) Section 124 (relating to next of kin

24 and directory information).

25 (D) Section 125 (relating to public health).
16

•HR 4077 IH

1 (E) Section 126 (relating to emergency cir2 cumstances).

3 (F) Section 127 (relating to judicial, ad4 ministrative, and other legal purposes).

5 (G) Section 128 (relating to health re6 search).

7 (H) Section 129 (relating to law enforce8 ment).

9 (I) Section 130 (relating to subpoenas,

10 warrants, and search warrants).

11 SEC. 102. DUTIES AND AUTHORITIES OF PUBLIC HEALTH

12 TRUSTEES.

13 (a) IN GENERAL.—Except as provided in subsections

14 (b) and (c), a public health trustee—

15 (1) shall comply with sections 111 (relating to

16 inspection), 114 (relating to accounting for disclo17 sures), and 115 (relating to security);

18 (2) may use protected health information if

19 such use is in accordance with section 121; and

20 (3) may disclose such information if—

21 (A) such disclosure is essential to fulfill a

22 public health purpose; or

23 (B) such disclosure is in accordance with

24 section 121 and 1 or more of the following

25 sections:
17

•HR 4077 IH

1 (i) Section 122 (relating to authoriza2 tions).

3 (ii) Section 125 (relating to public

4 health).

5 (iii) Section 126 (relating to emer6 gency circumstances).

7 (iv) Section 128 (relating to health re8 search).

9 (v) Section 129 (relating to law en10 forcement) (except section 129(a)(2)).

11 (b) DETERMINATIONS BY PUBLIC HEALTH TRUST12 EES SPECIFIC TO AN INDIVIDUAL.—A public health trust13 ee who makes a decision concerning a right, benefit, or

14 privilege of a individual using protected health information

15 about the individual shall be considered to be a health use

16 trustee with respect to such information and is subject to

17 section 101 (and not this section) with respect to such

18 information.

19 (c) OVERLAP WITH HEALTH USE TRUSTEE.—A per20 son who is a public health trustee and a health use trustee

21 with respect to the same protected health information is

22 subject to section 101 and is not subject to this section

23 with respect to such information.
18

•HR 4077 IH

1 SEC. 103. DUTIES AND AUTHORITIES OF SPECIAL PURPOSE

2 TRUSTEES.

3 (a) IN GENERAL.—A special purpose trustee—

4 (1) shall comply with sections 114 (relating

5 to accounting for disclosures) and 115 (relating to

6 security);

7 (2) may use protected health information if

8 such use is in accordance with section 121; and

9 (3) may disclose such information if such dis10 closure is in accordance with section 121 and one or

11 more of the following sections:

12 (A) Section 122 (relating to authoriza13 tions).

14 (B) Section 126 (relating to emergency cir15 cumstances).

16 (C) Section 128 (relating to health re17 search).

18 (D) Section 129 (relating to law enforce19 ment).

20 (E) Section 130 (relating to subpoenas,

21 warrants, and search warrants).

22 (b) OVERLAP WITH HEALTH USE AND PUBLIC

23 HEALTH TRUSTEES.—A person who is a health use trust24 ee and a special purpose trustee with respect to the same

25 protected health information is subject to section 101 and

26 is not subject to this section with respect to such informa-
19

•HR 4077 IH

1 tion. A person who is a public health trustee and a special

2 purpose trustee with respect to the same protected health

3 information is subject to section 102 and is not subject

4 to this section with respect to such information.

5 SEC. 104. DUTIES AND AUTHORITIES OF AFFILIATED PER6 SONS.

7 (a) DUTIES OF AFFILIATED PERSONS.—

8 (1) IN GENERAL.—An affiliated person is re9 quired to fulfill any duty under this Act that—

10 (A) the health information trustee with

11 whom the person has an agreement or relation12 ship described in section 3(c)(1)(C) is required

13 to fulfill; and

14 (B) the person has undertaken to fulfill

15 pursuant to such agreement or relationship.

16 (2) CONSTRUCTION OF OTHER SUBTITLES.—

17 With respect to a duty described in paragraph (1)

18 that an affiliated person is required to fulfill, the

19 person shall be considered a health information

20 trustee for purposes of this Act. The person shall be

21 subject to subtitle E (relating to enforcement) with

22 respect to any such duty that the person fails to ful23 fill.

24 (3) EFFECT ON TRUSTEE.—An agreement or

25 relationship described in section 3(c)(1)(C) does not
20

•HR 4077 IH

1 relieve a health information trustee of any duty or

2 liability under this Act.

3 (b) AUTHORITIES.—

4 (1) IN GENERAL.—An affiliated person may ex5 ercise any authority under this Act that the health

6 information trustee with whom the person has an

7 agreement or relationship described in section

8 3(c)(1)(C) may exercise and that the person has

9 been given pursuant to such agreement. With re10 spect to any such authority, the person shall be con11 sidered a health information trustee for purposes of

12 this Act. The person shall be subject to subtitle E

13 (relating to enforcement) with respect to any act

14 that exceeds such authority.

15 (2) EFFECT ON TRUSTEE.—An agreement or

16 relationship described in section 3(c)(1)(C) does not

17 affect the authority of a health information trustee

18 under this Act.
21

•HR 4077 IH

1 Subtitle B—Duties and Authorities

2 of Health Information Trustees

3 PART 1—DUTIES OF HEALTH INFORMATION

4 TRUSTEES

5 SEC. 111. INSPECTION OF PROTECTED HEALTH INFORMA6 TION.

7 (a) IN GENERAL.—Except as provided in subsection

8 (b), a health information trustee who is required by sub9 title A to comply with this section—

10 (1) shall permit an individual to inspect any

11 protected health information about the individual

12 that the trustee maintains;

13 (2) shall permit the individual to have a copy

14 of the information;

15 (3) shall permit a person who has been des16 ignated in writing by the individual to inspect, or to

17 have a copy of, the information on behalf of the indi18 vidual or to accompany the individual during the in19 spection; and

20 (4) may offer to explain or interpret informa21 tion that is inspected or copied under this sub22 section.

23 (b) EXCEPTIONS.—A health information trustee is

24 not required by this section to permit inspection or copy-
22

•HR 4077 IH

1 ing of protected health information if any of the following

2 conditions apply:

3 (1) MENTAL HEALTH TREATMENT NOTES.—

4 The information consists of psychiatric, psycho5 logical, or mental health treatment notes, the trustee

6 determines in the exercise of reasonable medical

7 judgment that inspection or copying of the notes

8 would cause sufficient harm to the individual who is

9 the subject of the notes so as to outweigh the desir10 ability of permitting access, and the trustee does not

11 disclose the notes to any person not directly engaged

12 in treating the individual, except with the authoriza13 tion of the individual or under compulsion of law.

14 (2) INFORMATION ABOUT OTHERS.—The infor15 mation relates to an individual other than the indi16 vidual seeking to inspect or have a copy of the infor17 mation and the trustee determines in the exercise of

18 reasonable medical judgment that inspection or

19 copying of the information would cause sufficient

20 harm to one or both of the individuals so as to out21 weigh the desirability of permitting access.

22 (3) ENDANGERMENT TO LIFE OR SAFETY.—

23 Disclosure of the information could reasonably be

24 expected to endanger the life or physical safety of an

25 individual.
23

•HR 4077 IH

1 (4) CONFIDENTIAL SOURCE.—The information

2 identifies or could reasonably lead to the identifica3 tion of an individual (other than a health care pro4 vider) who provided information under a promise of

5 confidentiality to a health care provider concerning

6 the individual who is the subject of the information.

7 (5) ADMINISTRATIVE PURPOSES.—The informa8 tion—

9 (A) is used by the trustee solely for admin10 istrative purposes and not in the provision of

11 health care to the individual who is the subject

12 of the information; and

13 (B) is not disclosed by the trustee to any

14 person.

15 (6) DUPLICATIVE INFORMATION.—The informa16 tion duplicates information available for inspection

17 under subsection (a).

18 (7) INFORMATION COMPILED IN ANTICIPATION

19 OF LITIGATION.—The information is compiled prin20 cipally—

21 (A) in reasonable anticipation of a civil ac22 tion or proceeding; or

23 (B) for use in such an action or proceed24 ing.
24

•HR 4077 IH

1 (c) INSPECTION AND COPYING OF SEGREGABLE POR2 TION.—A health information trustee who is required by

3 subtitle A to comply with this section shall permit inspec4 tion and copying under subsection (a) of any reasonably

5 segregable portion of a record after deletion of any portion

6 that is exempt under subsection (b).

7 (d) CONDITIONS.—A health information trustee

8 may—

9 (1) require a written request for the inspection

10 and copying of protected health information under

11 this section; and

12 (2) charge a reasonable fee (not greater than

13 the actual cost) for—

14 (A) permitting inspection of information

15 under this section; and

16 (B) providing a copy of protected health

17 information under this section.

18 (e) STATEMENT OF REASONS FOR DENIAL.—If a

19 health information trustee denies a request for inspection

20 or copying under this section, the trustee shall provide the

21 individual who made the request (or the individual’s des22 ignated representative) with a written statement of the

23 reasons for the denial.

24 (f) DEADLINE.—A health information trustee shall

25 comply with or deny a request for inspection or copying
25

•HR 4077 IH

1 of protected health information under this section within

2 the 30-day period beginning on the date the trustee re3 ceives the request.

4 SEC. 112. AMENDMENT OF PROTECTED HEALTH INFORMA5 TION.

6 (a) IN GENERAL.—A health information trustee who

7 is required by subtitle A to comply with this section shall,

8 within the 45-day period beginning on the date the trustee

9 receives from an individual about whom the trustee main10 tains protected health information a written request that

11 the trustee correct or amend the information, either—

12 (1) make the correction or amendment re13 quested, inform the individual of the correction or

14 amendment that has been made, and inform any

15 person who is identified by the individual, who is not

16 an employee of the trustee, and to whom the uncor17 rected or unamended portion of the information was

18 previously disclosed of the correction or amendment

19 that has been made; or

20 (2) inform the individual of—

21 (A) the reasons for the refusal of the trust22 ee to make the correction or amendment;

23 (B) any procedures for further review of

24 the refusal; and
26

•HR 4077 IH

1 (C) the individual’s right to file with the

2 trustee a concise statement setting forth the re3 quested correction or amendment and the indi4 vidual’s reasons for disagreeing with the refusal

5 of the trustee.

6 (b) BASES FOR REQUEST TO CORRECT OR AMEND.—

7 An individual may request correction or amendment of

8 protected health information about the individual under

9 subsection (a) if the information is not timely, accurate,

10 relevant, or complete.

11 (c) STATEMENT OF DISAGREEMENT.—After an indi12 vidual has filed a statement of disagreement under sub13 section (a)(2)(C), the trustee, in any subsequent disclosure

14 of the disputed portion of the information, shall include

15 a copy of the individual’s statement and may include a

16 concise statement of the trustee’s reasons for not making

17 the requested correction or amendment.

18 (d) CONSTRUCTION.—This section shall not be con19 strued to require a health information trustee to conduct

20 a formal, informal, or other hearing or proceeding con21 cerning a request for a correction or amendment to pro22 tected health information the trustee maintains.

23 (e) CORRECTION.—For purposes of subsection (a), a

24 correction is deemed to have been made to protected

25 health information where information that is not timely,
27

•HR 4077 IH

1 accurate, relevant, or complete is clearly marked as incor2 rect or where supplementary correct information is made

3 part of the information.

4 SEC. 113. NOTICE OF INFORMATION PRACTICES.

5 (a) PREPARATION OF WRITTEN NOTICE.—A health

6 information trustee who is required by subtitle A of this

7 title to comply with this section shall prepare a written

8 notice of information practices describing the following:

9 (1) RIGHTS OF INDIVIDUALS.—The rights

10 under this title of an individual who is the subject

11 of protected health information, including the right

12 to inspect and copy such information and the right

13 to seek amendments to such information, and the

14 procedures for authorizing disclosures of protected

15 health information and for revoking such authoriza16 tions.

17 (2) PROCEDURES OF TRUSTEE.—The proce18 dures established by the trustee for the exercise of

19 such rights.

20 (3) AUTHORIZED DISCLOSURES.—The disclo21 sures of protected health information that are au22 thorized under this Act.

23 (b) DISSEMINATION OF NOTICE.—A health informa24 tion trustee who is required by subtitle A to comply with

25 this section—
28

•HR 4077 IH

1 (1) shall, upon request, provide any person with

2 a copy of the trustee’s notice of information prac3 tices (described in subsection (a)); and

4 (2) shall make reasonable efforts to inform per5 sons in a clear and conspicuous manner of the exist6 ence and availability of such notice.

7 (c) MODEL NOTICE.—Not later than July 1, 1996,

8 the Secretary, after notice and opportunity for public com9 ment, shall develop and disseminate a model notice of in10 formation practices for use by health information trustees

11 under this section.

12 SEC. 114. ACCOUNTING FOR DISCLOSURES.

13 (a) IN GENERAL.—A health information trustee who

14 is required by subtitle A to comply with this section shall

15 create and maintain, with respect to any protected health

16 information the trustee discloses, a record of—

17 (1) the date and purpose of the disclosure;

18 (2) the name of the person to whom the disclo19 sure was made;

20 (3) the address of the person to whom the dis21 closure was made or the location to which the disclo22 sure was made; and

23 (4) the information disclosed, but only where

24 the recording of the information disclosed is prac25 ticable, taking into account the technical capabilities
29

•HR 4077 IH

1 of the system used to maintain the record and the

2 costs of such maintenance.

3 (b) DISCLOSURE RECORD PART OF INFORMATION.—

4 A record created and maintained under subsection (a)

5 shall be maintained as part of the protected health infor6 mation to which the record pertains.

7 SEC. 115. SECURITY.

8 (a) IN GENERAL.—A health information trustee who

9 is required by subtitle A to comply with this section shall

10 maintain reasonable and appropriate administrative, tech11 nical, and physical safeguards—

12 (1) to ensure the integrity and confidentiality of

13 protected health information created or received by

14 the trustee;

15 (2) to protect against any anticipated threats or

16 hazards to the security or integrity of, improper dis17 closures of, or unauthorized uses of, such informa18 tion; and

19 (3) otherwise ensure compliance with this Act

20 by the trustee and the officers and employees of the

21 trustee.

22 (b) SPECIFIC SECURITY MEASURES.—A health infor23 mation trustee who is required by subtitle A to comply

24 with this section shall ensure that—
30

•HR 4077 IH

1 (1) officers, employees, and affiliated persons of

2 the trustee who have access to protected health in3 formation created or received by the trustee are reg4 ularly trained in the requirements governing such

5 information;

6 (2) audit trails are maintained, but only where

7 the maintenance of such trails is practicable, taking

8 into account the technical capabilities of the system

9 used to maintain protected health information and

10 the costs of such maintenance; and

11 (3) appropriate signs and warnings are posted

12 to advise persons described in paragraph (1) regard13 ing the need to secure protected health information.

14 PART 2—USE AND DISCLOSURE OF PROTECTED

15 HEALTH INFORMATION

16 SEC. 121. GENERAL LIMITATIONS ON USE AND DISCLO17 SURE.

18 (a) USE.—A health information trustee may use pro19 tected health information only for a purpose that is com20 patible with and related to the purpose for which the infor21 mation—

22 (1) was collected; or

23 (2) was received by the trustee.
31

•HR 4077 IH

1 (b) DISCLOSURE.—A health information trustee may

2 disclose protected health information only for a purpose

3 that is authorized under this Act.

4 (c) SCOPE OF USES AND DISCLOSURES.—

5 (1) IN GENERAL.—A use or disclosure of pro6 tected health information by a health information

7 trustee shall be limited, when practicable, to the

8 minimum amount of information necessary to ac9 complish the purpose for which the information is

10 used or disclosed.

11 (2) GUIDELINES.—Not later than July 1, 1996,

12 the Secretary, after notice and opportunity for pub13 lic comment, shall issue guidelines to implement

14 paragraph (1), which shall take into account the

15 technical capabilities of the record systems used to

16 maintain protected health information and the costs

17 of limiting use and disclosure.

18 (d) IDENTIFICATION OF DISCLOSED INFORMATION

19 AS PROTECTED INFORMATION.—Except with respect to

20 protected health information that is disclosed under sec21 tion 111 (relating to inspection) or 124 (relating to next

22 of kin and directory information), and except as provided

23 in subsection (e), a health information trustee may dis24 close protected health information only if such information
32

•HR 4077 IH

1 is clearly identified as protected health information that

2 is subject to this Act.

3 (e) ROUTINE DISCLOSURES SUBJECT TO WRITTEN

4 AGREEMENT.—A health information trustee who routinely

5 discloses protected health information to a person may

6 satisfy the identification requirement in subsection (d)

7 through the conclusion of a written agreement between the

8 trustee and the person with respect to the identification

9 of protected health information.

10 (f) AGREEMENT TO LIMIT USE OR DISCLOSURE.—

11 A health information trustee who receives protected health

12 information from any person pursuant to a written agree13 ment to restrict use or disclosure of the information to

14 a greater extent than would otherwise be required under

15 this Act shall comply with the terms of the agreement,

16 except where use or disclosure of the information in viola17 tion of the agreement is required by law. A trustee who

18 fails to comply with the preceding sentence shall be subject

19 to section 161 (relating to civil actions) with respect to

20 such failure.

21 (f) NO GENERAL REQUIREMENT TO DISCLOSE.—Ex22 cept as provided in section 111, nothing in this Act shall

23 be construed to require a health information trustee to dis24 close protected health information not otherwise required

25 to be disclosed by law.
33

•HR 4077 IH

1 SEC. 122. AUTHORIZATIONS FOR DISCLOSURE OF PRO2 TECTED HEALTH INFORMATION.

3 (a) STATEMENT OF INTENDED USES AND DISCLO4 SURES.—

5 (1) IN GENERAL.—A person who wishes to re6 ceive from a health information trustee protected

7 health information about an individual pursuant to

8 an authorization executed by the individual shall

9 supply the individual, in writing and on a form that

10 is distinct from the authorization, with a statement

11 of the uses for which the person intends the infor12 mation and the disclosures the person intends to

13 make of the information. Such statement shall be

14 supplied on or before the date on which the author15 ization is executed.

16 (2) ENFORCEMENT.—If the person uses or dis17 closes the information in a manner that is inconsist18 ent with such statement, the person shall be subject

19 to section 161 (relating to civil actions) with respect

20 to such failure, except where such use or disclosure

21 is required by law.

22 (3) MODEL STATEMENTS.—Not later than July

23 1, 1996, the Secretary, after notice and opportunity

24 for public comment, shall develop and disseminate

25 model statements of intended uses and disclosures of

26 the type described in paragraph (1).
34

•HR 4077 IH

1 (b) WRITTEN AUTHORIZATIONS.—A health informa2 tion trustee who is authorized by subtitle A to disclose

3 protected health information under this section may dis4 close such information pursuant to an authorization exe5 cuted by the individual who is the subject of the informa6 tion, if each of the following requirements is met:

7 (1) WRITING.—The authorization is in writing,

8 signed by the individual, and dated on the date of

9 such signature.

10 (2) SEPARATE FORM.—The authorization is not

11 on a form used to authorize or facilitate the provi12 sion of, or payment for, health care.

13 (3) TRUSTEE DESCRIBED.—The trustee is spe14 cifically named or generically described in the au15 thorization as authorized to disclose such informa16 tion.

17 (4) RECIPIENT DESCRIBED.—The person to

18 whom the information is to be disclosed is specifi19 cally named or generically described in the author20 ization as a person to whom such information may

21 be disclosed.

22 (5) STATEMENT OF INTENDED USES AND DIS23 CLOSURES RECEIVED.—The authorization contains

24 an acknowledgment that the individual has received
35

•HR 4077 IH

1 a statement described in subsection (a) from such

2 person.

3 (6) INFORMATION DESCRIBED.—The informa4 tion to be disclosed is described in the authorization.

5 (7) AUTHORIZATION TIMELY RECEIVED.—The

6 authorization is received by the trustee during a pe7 riod described in subsection (d)(1).

8 (8) DISCLOSURE TIMELY MADE.—The disclo9 sure occurs during a period described in subsection

10 (d)(2).

11 (c) AUTHORIZATIONS REQUESTED IN CONNECTION

12 WITH PROVISION OF HEALTH CARE.—

13 (1) IN GENERAL.—A health use trustee or a

14 public health trustee may not request that an indi15 vidual provide to any person an authorization de16 scribed in subsection (b) on a day on which—

17 (A) the trustee provides health care to the

18 individual; or

19 (B) in the case of a trustee that is a health

20 facility, the individual is admitted into the facil21 ity as a resident or inpatient in order to receive

22 health care.

23 (2) EXCEPTION.—Paragraph (1) does not apply

24 if a health use trustee or a public health trustee re25 quests that an individual provide an authorization
36

•HR 4077 IH

1 described in subsection (b) for the purpose of assist2 ing the individual in obtaining counseling or social

3 services from a person other than the trustee.

4 (d) TIME LIMITATIONS ON AUTHORIZATIONS.—

5 (1) RECEIPT BY TRUSTEE.—For purposes of

6 subsection (b)(7), an authorization is timely received

7 if it is received by the trustee during—

8 (A) the 1-year period beginning on the

9 date that the authorization is signed under sub10 section (b)(1), if the authorization permits the

11 disclosure of protected health information to a

12 health use trustee, public health trustee, or per13 son who provides counseling or social services to

14 individuals; or

15 (B) the 30-day period beginning on the

16 date that the authorization is signed under sub17 section (b)(1), if the authorization permits the

18 disclosure of protected health information to a

19 person other than a person described in sub20 paragraph (A).

21 (2) DISCLOSURE BY TRUSTEE.—For purposes

22 of subsection (b)(8), a disclosure is timely made if

23 it occurs before—
37

•HR 4077 IH

1 (A) the date or event (if any) specified in

2 the authorization upon which the authorization

3 expires; and

4 (B) the expiration of the 6-month period

5 beginning on the date the trustee receives the

6 authorization.

7 (e) REVOCATION OR AMENDMENT OF AUTHORIZA8 TION.—

9 (1) IN GENERAL.—An individual in writing may

10 revoke or amend an authorization described in sub11 section (b), in whole or in part, at any time, except

12 when—

13 (A) disclosure of protected health informa14 tion has been authorized to permit validation of

15 expenditures for health care, or based on health

16 condition, by a government authority; or

17 (B) action has been taken in reliance on

18 the authorization.

19 (2) NOTICE OF REVOCATION.—A health infor20 mation trustee who discloses protected health infor21 mation pursuant to an authorization that has been

22 revoked shall not be subject to any liability or pen23 alty under this Act if—

24 (A) the reliance was in good faith;
38

•HR 4077 IH

1 (B) the trustee had no notice of the rev2 ocation; and

3 (C) the disclosure was otherwise in accord4 ance with the requirements of this Act.

5 (f) EFFECT OF AUTHORIZATION ON PRIVILEGES.—

6 The execution by an individual of an authorization that

7 meets the requirements of this section for the purpose of

8 receiving health care or providing for the payment for

9 health care shall not be construed as affecting any privi10 lege that the individual may have under common or statu11 tory law in a court of a State or the United States.

12 (g) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A

13 health information trustee may impose requirements for

14 an authorization that are in addition to the requirements

15 in this section.

16 (h) COPY.—A health information trustee who dis17 closes protected health information pursuant to an author18 ization under this section shall maintain a copy of the au19 thorization as part of the information.

20 (i) CONSTRUCTION.—This section shall not be con21 strued—

22 (1) to require a health information trustee to

23 disclose protected health information; or
39

•HR 4077 IH

1 (2) to limit the right of a health information

2 trustee to charge a fee for the disclosure or repro3 duction of protected health information.

4 (j) SUBPOENAS, WARRANTS, AND SEARCH WAR5 RANTS.—If a health information trustee discloses pro6 tected health information pursuant to an authorization in

7 order to comply with an administrative subpoena or war8 rant or a judicial subpoena or search warrant, the author9 ization—

10 (1) shall specifically authorize the disclosure for

11 the purpose of permitting the trustee to comply with

12 the subpoena, warrant, or search warrant; and

13 (2) shall otherwise meet the requirements in

14 this section.

15 SEC. 123. TREATMENT, PAYMENT, AND OVERSIGHT.

16 (a) IN GENERAL.—A health information trustee who

17 is authorized by subtitle A to disclose protected health in18 formation under this section may disclose such informa19 tion to a health use trustee if the disclosure is—

20 (1) for the purpose of providing health care to

21 an individual and the individual who is the subject

22 of the information has not previously objected to the

23 disclosure in writing;

24 (2) for the purpose of providing for the pay25 ment for health care furnished to an individual; or
40

•HR 4077 IH

1 (3) for use by a health oversight agency for a

2 purpose authorized by law.

3 (b) USE IN ACTION AGAINST INDIVIDUAL.—Pro4 tected health information about an individual that is dis5 closed under this section may not be used in, or disclosed

6 to any person for use in, any administrative, civil, or crimi7 nal action or investigation directed against the individual,

8 except an action or investigation arising out of and di9 rectly related to receipt of health care or payment for

10 health care.

11 SEC. 124. NEXT OF KIN AND DIRECTORY INFORMATION.

12 (a) NEXT OF KIN.—A health information trustee who

13 is authorized by subtitle A to disclose protected health in14 formation under this section may disclose such informa15 tion to the next of kin or legal representative (as defined

16 under State law) of the individual who is the subject of

17 the information, or to a person with whom the individual

18 has a personal relationship, if—

19 (1) the individual has not previously objected to

20 the disclosure;

21 (2) the disclosure is consistent with accepted

22 medical practice; and

23 (3) the information disclosed relates to the on24 going provision of health care to the individual.
41

•HR 4077 IH

1 (b) DIRECTORY INFORMATION.—A health informa2 tion trustee who is authorized by subtitle A to disclose

3 protected health information under this section may dis4 close such information to any person, if—

5 (1) the information does not reveal specific in6 formation about the physical or mental condition of

7 the individual or health care provided to the individ8 ual;

9 (2) the individual who is the subject of the in10 formation has not objected in writing to the disclo11 sure;

12 (3) the disclosure is consistent with accepted

13 medical practice; and

14 (4) the information consists only of 1 or more

15 of the following items:

16 (A) The name of the individual.

17 (B) If the individual is receiving health

18 care from a health care provider on a premises

19 controlled by the provider, the location of the

20 individual on such premises.

21 (C) If the individual is receiving health

22 care from a health care provider on a premises

23 controlled by the provider, the general health

24 status of the individual, described in terms of
42

•HR 4077 IH

1 critical, poor, fair, stable, satisfactory, or terms

2 denoting similar conditions.

3 (c) RECIPIENTS.—A person to whom protected health

4 information is disclosed under this section shall not, by

5 reason of such disclosure, be subject to any requirement

6 under this Act.

7 SEC. 125. PUBLIC HEALTH.

8 (a) IN GENERAL.—A health information trustee who

9 is authorized by subtitle A to disclose protected health in10 formation under this section may disclose such informa11 tion to a public health trustee for use in legally author12 ized—

13 (1) disease or injury reporting;

14 (2) public health surveillance; or

15 (3) public health investigation.

16 (b) USE IN ACTION AGAINST INDIVIDUAL.—Pro17 tected health information about an individual that is dis18 closed under this section may not be used in, or disclosed

19 to any person for use in, any administrative, civil, or crimi20 nal action or investigation directed against the individual,

21 except where the use or disclosure is authorized by law

22 for protection of the public health.

23 SEC. 126. EMERGENCY CIRCUMSTANCES.

24 A health information trustee who is authorized by

25 subtitle A to disclose protected health information under
43

•HR 4077 IH

1 this section may disclose such information to alleviate

2 emergency circumstances affecting the health or safety of

3 an individual.

4 SEC. 127. JUDICIAL, ADMINISTRATIVE, AND OTHER LEGAL

5 PURPOSES.

6 (a) IN GENERAL.—A health information trustee who

7 is authorized by subtitle A to disclose protected health in8 formation under this section may disclose such informa9 tion—

10 (1) pursuant to the Federal Rules of Civil Pro11 cedure, the Federal Rules of Criminal Procedure, or

12 comparable rules of other courts or administrative

13 agencies in connection with litigation or proceedings

14 to which the individual who is the subject of the in15 formation is a party and in which the individual has

16 placed the individual’s physical or mental condition

17 in issue;

18 (2) pursuant to a law requiring the reporting of

19 specific medical information to law enforcement au20 thorities;

21 (3) if the disclosure is of information described

22 in paragraph (2) and the trustee is operated by a

23 Federal agency;

24 (4) if directed by a court in connection with a

25 court-ordered examination of an individual; or
44

•HR 4077 IH

1 (5) to assist in the identification of a dead indi2 vidual.

3 (b) WRITTEN STATEMENT.—A person seeking pro4 tected health information about an individual maintained

5 by health information trustee under—

6 (1) subsection (a)(1) shall provide the trustee

7 with a written statement that the individual is a

8 party to the litigation or proceedings for which the

9 information is sought; or

10 (2) subsection (a)(5) shall provide the trustee

11 with a written statement that the information is

12 sought to assist in the identification of a dead indi13 vidual.

14 (c) USE AND DISCLOSURE.—A person to whom pro15 tected health information is disclosed under this section

16 may use and disclose the information only under a condi17 tion described in subsection (a).

18 SEC. 128. HEALTH RESEARCH.

19 (a) IN GENERAL.—A health information trustee who

20 is authorized by subtitle A to disclose protected health in21 formation under this section may disclose such informa22 tion to a public health trustee if the disclosure is for use

23 in a health research project that has been determined by

24 an institutional review board to be—
45

•HR 4077 IH

1 (1) of sufficient importance so as to outweigh

2 the intrusion into the privacy of the individual who

3 is the subject of the information that would result

4 from the disclosure; and

5 (2) reasonably impracticable to conduct without

6 such information.

7 (b) OBLIGATIONS OF RECIPIENT.—A person who re8 ceives protected health information pursuant to subsection

9 (a) shall remove or destroy, at the earliest opportunity

10 consistent with the purposes of the project, information

11 that would enable 1 or more individuals to be identified,

12 unless an institutional review board has determined that

13 there is a health or research justification for retention of

14 such identifiers and there is an adequate plan to protect

15 the identifiers from use and disclosure that is inconsistent

16 with this Act.

17 SEC. 129. LAW ENFORCEMENT.

18 (a) IN GENERAL.—A health information trustee who

19 is authorized by subtitle A to disclose protected health in20 formation under this section may disclose such informa21 tion to a law enforcement agency (other than a health

22 oversight agency) if the information is—

23 (1) for use in an investigation or prosecution of

24 a health information trustee;
46

•HR 4077 IH

1 (2) to assist in the identification or location of

2 a suspect, fugitive, or witness in a law enforcement

3 inquiry;

4 (3) in connection with criminal activity commit5 ted against the trustee or an affiliated person of the

6 trustee or on premises controlled by the trustee; or

7 (4) needed to determine whether a crime has

8 been committed and the nature of any crime that

9 may have been committed (other than a crime that

10 may have been committed by the individual who is

11 the subject of the information).

12 (b) CERTIFICATION.—Where a law enforcement

13 agency requests a health information trustee to disclose

14 protected health information under this section, the agen15 cy shall provide the trustee with a written certification

16 that—

17 (1) is signed by a supervisory official of a rank

18 designated by the head of the agency;

19 (2) specifies the information requested; and

20 (3) states that the information is needed for a

21 lawful purpose under this section.

22 (c) RESTRICTIONS ON DISCLOSURE AND USE.—Pro23 tected health information about an individual that is dis24 closed by a health information trustee to a law enforce25 ment agency under this section—
47

•HR 4077 IH

1 (1) may not be disclosed for, or used in, any

2 administrative, civil, or criminal action or investiga3 tion against the individual, except in an action or in4 vestigation arising out of and directly related to the

5 action or investigation for which the information was

6 obtained; and

7 (2) may not be otherwise used or disclosed by

8 the agency, unless the use or disclosure is necessary

9 to fulfill the purpose for which the information was

10 obtained and is not otherwise prohibited by law.

11 SEC. 130. SUBPOENAS, WARRANTS, AND SEARCH WAR12 RANTS.

13 (a) IN GENERAL.—A health information trustee who

14 is authorized by subtitle A to disclose protected health in15 formation under this section may disclose such informa16 tion if the disclosure is pursuant to any of the following:

17 (1) A subpoena issued under the authority of a

18 grand jury and the trustee is provided a written cer19 tification by the grand jury seeking the information

20 that the grand jury has complied with the applicable

21 access provisions of section 141 or 143(a).

22 (2) An administrative subpoena or warrant or

23 a judicial subpoena or search warrant and the trust24 ee is provided a written certification by the person

25 seeking the information that the person has com-
48

•HR 4077 IH

1 plied with the applicable access provisions of section

2 141 or 143(a).

3 (3) An administrative subpoena or warrant or

4 a judicial subpoena or search warrant and the dis5 closure otherwise meets the conditions of one of sec6 tions 123 through 129.

7 (b) RESTRICTIONS ON USE AND DISCLOSURE.—Pro8 tected health information about an individual that is dis9 closed by a health information trustee under—

10 (1) subsection (a) may not be disclosed for, or

11 used in, any administrative, civil, or criminal action

12 or investigation against the individual, except in an

13 action or investigation arising out of and directly re14 lated to the inquiry for which the information was

15 obtained;

16 (2) subsection (a)(2) may not be otherwise used

17 or disclosed by the recipient unless the use or disclo18 sure is necessary to fulfill the purpose for which the

19 information was obtained; and

20 (3) subsection (a)(3) may not be used or dis21 closed by the recipient unless the recipient complies

22 with the conditions and restrictions on use and dis23 closure with which the recipient would have been re24 quired to comply if the disclosure by the trustee had

25 been made under the section referred to in sub-
49

•HR 4077 IH

1 section (a)(3) the conditions of which were met by

2 the disclosure.

3 (c) RESTRICTIONS ON GRAND JURIES.—Protected

4 health information that is disclosed by a health informa5 tion trustee under subsection (a)(1)—

6 (1) shall be returnable on a date when the

7 grand jury is in session and actually presented to

8 the grand jury;

9 (2) shall be used only for the purpose of consid10 ering whether to issue an indictment or report by

11 that grand jury, or for the purpose of prosecuting a

12 crime for which that indictment or report is issued,

13 or for a purpose authorized by rule 6(e) of the Fed14 eral Rules of Criminal Procedure or a comparable

15 State rule;

16 (3) shall be destroyed or returned to the trustee

17 if not used for one of the purposes specified in para18 graph (2); and

19 (4) shall not be maintained, or a description of

20 the contents of such information shall not be main21 tained, by any government authority other than in

22 the sealed records of the grand jury, unless such in23 formation has been used in the prosecution of a

24 crime for which the grand jury issued an indictment

25 or presentment or for a purpose authorized by rule
50

•HR 4077 IH

1 6(e) of the Federal Rules of Criminal Procedure or

2 a comparable State rule.

3 (d) COPY AS PART OF PROTECTED INFORMATION.—

4 A health information trustee who discloses protected

5 health information under this section shall maintain a

6 copy of the applicable subpoena, warrant, or search war7 rant as part of the information.

8 (e) CONSTRUCTION.—Nothing in this section shall be

9 construed as authority for a health information trustee to

10 refuse to comply with an administrative subpoena or war11 rant or a judicial subpoena or search warrant that meets

12 the requirements of this Act.

13 Subtitle C—Access Procedures and

14 Challenge Rights

15 SEC. 141. ACCESS PROCEDURES FOR LAW ENFORCEMENT

16 SUBPOENAS, WARRANTS, AND SEARCH WAR17 RANTS.

18 (a) PROBABLE CAUSE REQUIREMENT.—A govern19 ment authority may not obtain protected health informa20 tion about an individual from a health information trustee

21 under paragraph (1) or (2) of section 130(a) for use in

22 a law enforcement inquiry unless there is probable cause

23 to believe that the information is relevant to a legitimate

24 law enforcement inquiry being conducted by the govern25 ment authority.
51

•HR 4077 IH

1 (b) WARRANTS AND SEARCH WARRANTS.—A govern2 ment authority that obtains protected health information

3 about an individual from a health information trustee

4 under circumstances described in subsection (a) and pur5 suant to a warrant or search warrant shall, not later than

6 30 days after the date the warrant was served on the

7 trustee, serve the individual with, or mail to the last

8 known address of the individual, a copy of the warrant.

9 (c) SUBPOENAS.—Except as provided in subsection

10 (d), a government authority may not obtain protected

11 health information about an individual from a health in12 formation trustee under circumstances described in sub13 section (a) and pursuant to a subpoena unless a copy of

14 the subpoena has been served by hand delivery upon the

15 individual, or mailed to the last known address of the indi16 vidual, on or before the date on which the subpoena was

17 served on the trustee, together with a notice (published

18 by the Secretary under section 145(1)) of the individual’s

19 right to challenge the subpoena in accordance with section

20 142, and—

21 (1) 30 days have passed from the date of serv22 ice, or 30 days have passed from the date of mailing,

23 and within such time period the individual has not

24 initiated a challenge in accordance with section 142;

25 or
52

•HR 4077 IH

1 (2) disclosure is ordered by a court under sec2 tion 142.

3 (d) APPLICATION FOR DELAY.—

4 (1) IN GENERAL.—A government authority may

5 apply to an appropriate court to delay (for an initial

6 period of not longer than 90 days) serving a copy of

7 a subpoena and a notice otherwise required under

8 subsection (c) with respect to a law enforcement in9 quiry. The government authority may apply to the

10 court for extensions of the delay.

11 (2) REASONS FOR DELAY.—An application for

12 a delay, or extension of a delay, under this sub13 section shall state, with reasonable specificity, the

14 reasons why the delay or extension is being sought.

15 (3) EX PARTE ORDER.—The court shall enter

16 an ex parte order delaying, or extending the delay

17 of, the notice and an order prohibiting the trustee

18 from revealing the request for, or the disclosure of,

19 the protected health information being sought if the

20 court finds that—

21 (A) the inquiry being conducted is within

22 the lawful jurisdiction of the government au23 thority seeking the protected health informa24 tion;
53

•HR 4077 IH

1 (B) there is probable cause to believe that

2 the protected health information being sought is

3 relevant to a legitimate law enforcement inquiry

4 being conducted by the government authority;

5 (C) the government authority’s need for

6 the information outweighs the privacy interest

7 of the individual who is the subject of the infor8 mation; and

9 (D) there are reasonable grounds to believe

10 that receipt of a notice by the individual will re11 sult in—

12 (i) endangering the life or physical

13 safety of any individual;

14 (ii) flight from prosecution;

15 (iii) destruction of or tampering with

16 evidence or the information being sought;

17 or

18 (iv) intimidation of potential wit19 nesses.

20 (4) SERVICE OF APPLICATION ON INDIVID21 UAL.—Upon the expiration of a period of delay of

22 notice under this subsection, the government author23 ity shall serve upon the individual, with the service

24 of the subpoena and the notice, a copy of any appli25 cations filed and approved under this subsection.
54

•HR 4077 IH

1 SEC. 142. CHALLENGE PROCEDURES FOR LAW ENFORCE2 MENT SUBPOENAS.

3 (a) MOTION TO QUASH SUBPOENA.—Within 30 days

4 of the date of service, or 30 days of the date of mailing,

5 of a subpoena of a government authority seeking protected

6 health information about an individual from a health in7 formation trustee under paragraph (1) or (2) of section

8 130(a) (except a subpoena issued in compliance with the

9 provisions of section 143(a)), the individual may file (with10 out filing fee) a motion to quash the subpoena—

11 (1) in the case of a State judicial subpoena, in

12 the court which issued the subpoena;

13 (2) in the case of a subpoena issued under the

14 authority of a State that is not a State judicial sub15 poena, in a court of competent jurisdiction;

16 (3) in the case of a subpoena issued under the

17 authority of a Federal court, in any court of the

18 United States of competent jurisdiction; or

19 (4) in the case of any other subpoena issued

20 under the authority of the United States, in—

21 (A) the United States district court for the

22 district in which the individual resides or in

23 which the subpoena was issued; or

24 (B) another United States district court of

25 competent jurisdiction.
55

•HR 4077 IH

1 (b) COPY.—A copy of the motion shall be served by

2 the individual upon the government authority by delivery

3 of registered or certified mail.

4 (c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov5 ernment authority may file with the court such affidavits

6 and other sworn documents as sustain the validity of the

7 subpoena. The individual may file with the court, within

8 5 days of the date of the authority’s filing, affidavits and

9 sworn documents in response to the authority’s filing. The

10 court, upon the request of the individual, the government

11 authority, or both, may proceed in camera.

12 (d) PROCEEDINGS AND DECISION ON MOTION.—The

13 court may conduct such proceedings as it deems appro14 priate to rule on the motion. All such proceedings shall

15 be completed, and the motion ruled on, within 10 calendar

16 days of the date of the government authority’s filing.

17 (e) EXTENSION OF TIME LIMITS FOR GOOD

18 CAUSE.—The court, for good cause shown, may at any

19 time in its discretion enlarge the time limits established

20 by subsections (c) and (d).

21 (f) STANDARD FOR DECISION.—A court may deny an

22 individual’s timely motion under subsection (a) if it finds

23 that there is probable cause to believe that the protected

24 health information being sought is relevant to a legitimate

25 law enforcement inquiry being conducted by the govern-
56

•HR 4077 IH

1 ment authority, unless the court finds that the individual’s

2 privacy interest outweighs the government authority’s

3 need for the information. The individual shall have the

4 burden of demonstrating that the individual’s privacy in5 terest outweighs the need established by the government

6 authority for the information.

7 (g) SPECIFIC CONSIDERATIONS WITH RESPECT TO

8 PRIVACY INTEREST.—In determining under subsection (f)

9 whether an individual’s privacy interest outweighs the gov10 ernment authority’s need for the information, the court

11 shall consider—

12 (1) the particular purpose for which the infor13 mation was collected by the trustee;

14 (2) the degree to which disclosure of the infor15 mation will embarrass, injure, or invade the privacy

16 of the individual;

17 (3) the effect of the disclosure on the individ18 ual’s future health care;

19 (4) the importance of the inquiry being con20 ducted by the government authority, and the impor21 tance of the information to that inquiry; and

22 (5) any other factor deemed relevant by the

23 court.

24 (h) ATTORNEY’S FEES.—In the case of any motion

25 brought under subsection (a) in which the individual has
57

•HR 4077 IH

1 substantially prevailed, the court, in its discretion, may as2 sess against a government authority a reasonable attor3 ney’s fee and other litigation costs (including expert fees)

4 reasonably incurred.

5 (i) NO INTERLOCUTORY APPEAL.—A court ruling de6 nying a motion to quash under this section shall not be

7 deemed a final order and no interlocutory appeal may be

8 taken therefrom by the individual. An appeal of such a

9 ruling may be taken by the individual within such period

10 of time as is provided by law as part of any appeal from

11 a final order in any legal proceeding initiated against the

12 individual arising out of or based upon the protect health

13 information disclosed.

14 SEC. 143. ACCESS AND CHALLENGE PROCEDURES FOR

15 OTHER SUBPOENAS.

16 (a) IN GENERAL.—A person (other than a govern17 ment authority under section 141) may not obtain pro18 tected health information about an individual from a

19 health information trustee pursuant to a subpoena under

20 section 130(a)(2) unless—

21 (1) a copy of the subpoena has been served

22 upon the individual or mailed to the last known ad23 dress of the individual on or before the date on

24 which the subpoena was served on the trustee, to25 gether with a notice (published by the Secretary
58

•HR 4077 IH

1 under section 145(2)) of the individual’s right to

2 challenge the subpoena, in accordance with sub3 section (b); and

4 (2) either—

5 (A) 30 days have passed from the date of

6 service or 30 days have passed from the date of

7 the mailing and within such time period the in8 dividual has not initiated a challenge in accord9 ance with subsection (b); or

10 (B) disclosure is ordered by a court under

11 such subsection.

12 (b) MOTION TO QUASH.—Within 30 days of the date

13 of service or 30 days of the date of mailing of a subpoena

14 seeking protected health information about an individual

15 from a health information trustee under subsection (a),

16 the individual may file (without filing fee) in any court

17 of competent jurisdiction, a motion to quash the subpoena,

18 with a copy served on the person seeking the information.

19 The individual may oppose, or seek to limit, the subpoena

20 on any grounds that would otherwise be available if the

21 individual were in possession of the information.

22 (c) STANDARD FOR DECISION.—The court shall

23 grant an individual’s timely motion under subsection (b)

24 if the person seeking the information has not sustained

25 the burden of demonstrating that—
59

•HR 4077 IH

1 (1) there are reasonable grounds to believe that

2 the information will be relevant to a lawsuit or other

3 judicial or administrative proceeding; and

4 (2) the need of the person for the information

5 outweighs the privacy interest of the individual.

6 (d) SPECIFIC CONSIDERATIONS WITH RESPECT TO

7 PRIVACY INTEREST.—In determining under subsection (c)

8 whether the need of the person for the information out9 weighs the privacy interest of the individual, the court

10 shall consider—

11 (1) the particular purpose for which the infor12 mation was collected by the trustee;

13 (2) the degree to which disclosure of the infor14 mation will embarrass, injure, or invade the privacy

15 of the individual;

16 (3) the effect of the disclosure on the individ17 ual’s future health care;

18 (4) the importance of the information to the

19 lawsuit or proceeding; and

20 (5) any other factor deemed relevant by the

21 court.

22 (e) ATTORNEY’S FEES.—In the case of any motion

23 brought under subsection (b) by an individual against a

24 person in which the individual has substantially prevailed,

25 the court, in its discretion, may assess against the person
60

•HR 4077 IH

1 a reasonable attorney’s fee and other litigation costs (in2 cluding expert fees) reasonably incurred.

3 SEC. 144. CONSTRUCTION OF SUBTITLE; SUSPENSION OF

4 STATUTE OF LIMITATIONS.

5 (a) IN GENERAL.—Nothing in this subtitle shall af6 fect the right of a health information trustee to challenge

7 requests for protected health information. Nothing in this

8 subtitle shall entitle an individual who is the subject of

9 such information to assert the rights of a health informa10 tion trustee.

11 (b) EFFECT OF MOTION ON STATUTE OF LIMITA12 TIONS.—If an individual who is the subject of protected

13 health information files a motion under this Act which has

14 the effect of delaying the access of a government authority

15 to such information, any applicable statute of limitations

16 is deemed to be tolled for the period beginning on the date

17 such motion was filed and ending on the date on which

18 the motion is decided.

19 SEC. 145. RESPONSIBILITIES OF SECRETARY.

20 Not later than July 1, 1996, the Secretary, after no21 tice and opportunity for public comment, shall develop and

22 disseminate a brief, clear, and easily understood notice—

23 (1) for use under subsection (c) of section 141,

24 detailing the rights of an individual who wishes to

25 challenge, under section 142, the disclosure of pro-
61

•HR 4077 IH

1 tected health information about the individual under

2 such subsection; and

3 (2) for use under subsection (a) of section 143,

4 detailing the rights of an individual who wishes to

5 challenge, under subsection (b) of such section, the

6 disclosure of protected health information about the

7 individual under such section.

8 Subtitle D—Miscellaneous

9 Provisions

10 SEC. 151. DEBIT AND CREDIT CARD TRANSACTIONS.

11 (a) PAYMENT FOR HEALTH CARE THROUGH DEBIT

12 OR CREDIT CARD.—If an individual pays a health infor13 mation trustee for health care by presenting a debit or

14 credit card or card number, the trustee may use or dis15 close such protected health information about the individ16 ual as is necessary for the processing of the debit or credit

17 card transaction or the billing or collection of amounts

18 charged or debited to the individual using the card or

19 number.

20 (b) TRANSACTION PROCESSING BY CARD ISSUERS.—

21 A person who is a debit or credit card issuer or is other22 wise directly involved in the processing of credit or debit

23 transactions or the billing or collection of amounts charged

24 or debited thereto may only use or disclose protected

25 health information about an individual—
62

•HR 4077 IH

1 (1) that has been disclosed in accordance with

2 subsection (a); and

3 (2) when necessary for—

4 (A) the billing or collection of amounts

5 charged or debited to the individual using a

6 debit or credit card;

7 (B) the transfer of receivables, accounts,

8 or interest therein;

9 (C) the audit of the credit or debit card ac10 count information;

11 (D) compliance with Federal, State, or

12 local law; and

13 (E) a properly authorized civil, criminal, or

14 regulatory investigation by Federal, State, or

15 local authorities.

16 SEC. 152. ACCESS TO PROTECTED HEALTH INFORMATION

17 OUTSIDE OF THE UNITED STATES.

18 (a) IN GENERAL.—Except as provided in subsection

19 (b), notwithstanding the provisions of subtitle A and part

20 2 of subtitle B, a health information trustee may not per21 mit any person who is not in a State to have access to

22 protected health information about an individual unless

23 one or more of the following conditions exist:

24 (1) SPECIFIC AUTHORIZATION.—The individual

25 has specifically consented to the provision of such
63

•HR 4077 IH

1 access outside of the United States in an authoriza2 tion that meets the requirements of section 122.

3 (2) EQUIVALENT INFORMATION PRACTICES.—

4 The provision of such access is authorized under this

5 Act and the Secretary has determined that there are

6 fair information practices for protected health infor7 mation in the country where the access will be pro8 vided that are equivalent to the fair information

9 practices provided for by this Act.

10 (3) ACCESS REQUIRED BY LAW.—The provision

11 of such access is required under—

12 (A) a Federal statute; or

13 (B) a treaty or other international agree14 ment applicable to the United States.

15 (b) EXCEPTIONS.—Subsection (a) does not apply

16 where the provision of access to protected health informa17 tion—

18 (1) is to a foreign public health authority;

19 (2) is authorized under section 126; or

20 (3) is necessary for the purpose of providing for

21 payment for health care that has been provided to

22 an individual.
64

•HR 4077 IH

1 SEC. 153. STANDARDS FOR ELECTRONIC DOCUMENTS AND

2 COMMUNICATIONS.

3 (a) STANDARDS.—Not later than July 1, 1996, the

4 Secretary, after notice and opportunity for public com5 ment, shall promulgate standards with respect to the cre6 ation, transmission, receipt, and maintenance, in elec7 tronic form, of each written document required or author8 ized under this Act. Where a signature is required with

9 respect to a written document under any other provision

10 of this Act, such standards shall provide for an electronic

11 substitute that serves the functional equivalent of a

12 signature.

13 (b) TREATMENT OF COMPLYING DOCUMENTS AND

14 COMMUNICATIONS.—An electronic document or commu15 nication that satisfies the standards promulgated under

16 subsection (a) with respect to such document or commu17 nication shall be treated as satisfying the requirements of

18 this Act that apply to an equivalent written document.

19 SEC. 154. POWERS OF ATTORNEY.

20 In the case of an individual who has executed a power

21 of attorney, recognized under State law, authorizing a per22 son to act as agent or attorney for the individual for one

23 or more purposes, the person may exercise any right of

24 the individual under this title that the person is authorized

25 to exercise by the power of attorney, if—
65

•HR 4077 IH

1 (1) any condition precedent to the exercise of

2 such right that is set forth in the power of attorney

3 has been satisfied; and

4 (2) the power of attorney specifically references

5 or describes the rights under this title that may be

6 exercised by the person.

7 SEC. 155. RIGHTS OF INCOMPETENTS.

8 (a) EFFECT OF DECLARATION OF INCOMPETENCE.—

9 Except as provided in section 154, if an individual has

10 been declared to be incompetent by a court of competent

11 jurisdiction, the rights of the individual under this title

12 shall be exercised and discharged in the best interests of

13 the individual through an authorized legal representative

14 of the individual.

15 (b) NO COURT DECLARATION.—Except as provided

16 in section 154, if a health care provider determines that

17 an individual, who has not been declared to be incom18 petent by a court of competent jurisdiction, suffers from

19 a medical condition that prevents the individual from act20 ing knowingly or effectively on the individual’s own behalf,

21 the right of the individual to authorize disclosure under

22 section 122 may be exercised and discharged in the best

23 interest of the individual by the individual’s next of kin.
66

•HR 4077 IH

1 SEC. 156. RIGHTS OF MINORS.

2 (a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA3 BLE.—In the case of an individual—

4 (1) who is 18 years of age or older, all rights

5 of the individual shall be exercised by the individual,

6 except as provided in sections 154 and 155; or

7 (2) who, acting alone, has the legal capacity to

8 apply for and obtain a type of medical examination,

9 care, or treatment and who has sought such exam10 ination, care, or treatment, the individual shall exer11 cise all rights of an individual under this title with

12 respect to protected health information relating to

13 such examination, care, or treatment.

14 (b) INDIVIDUALS UNDER 18.—Except as provided in

15 subsection (a)(2), in the case of an individual who is—

16 (1) under 14 years of age, all the individual’s

17 rights under this title shall be exercised through the

18 parent or legal guardian of the individual; or

19 (2) 14, 15, 16, or 17 years of age, the right of

20 inspection (under section 111), the right of amend21 ment (under section 112), and the right to authorize

22 disclosure of protected health information (under

23 section 122) of the individual may be exercised ei24 ther by the individual or by the parent or legal

25 guardian of the individual.
67

•HR 4077 IH

1 Subtitle E—Enforcement

2 SEC. 161. CIVIL ACTIONS.

3 (a) IN GENERAL.—Any individual whose rights under

4 this title have been knowingly or negligently violated—

5 (1) by a health information trustee, or any

6 other person, who is not described in paragraph (2),

7 (3), (4), or (5) may maintain a civil action for actual

8 damages and for equitable relief against the health

9 information trustee or other person;

10 (2) by an officer or employee of the United

11 States while the officer or employee was acting with12 in the scope of the office or employment may main13 tain a civil action for actual damages and for equi14 table relief against the United States;

15 (3) by an officer or employee of any government

16 authority of a State that has waived its sovereign

17 immunity to a claim for damages resulting from a

18 violation of this title while the officer or employee

19 was acting within the scope of the office or employ20 ment may maintain a civil action for actual damages

21 and for equitable relief against the State govern22 ment;

23 (4) by an officer or employee of a government

24 of a State that is not described in paragraph (3)

25 may maintain a civil action for actual damages and
68

•HR 4077 IH

1 for equitable relief against the officer or employee;

2 or

3 (5) by an officer or employee of a government

4 authority while the officer or employee was not act5 ing within the scope of the office or employment

6 may maintain a civil action for actual damages and

7 for equitable relief against the officer or employee.

8 (b) KNOWING VIOLATIONS.—Any individual entitled

9 to recover actual damages under this section because of

10 a knowing violation of a provision of this title (other than

11 subsection (c) or (d) of section 121) shall be entitled to

12 recover the amount of the actual damages demonstrated

13 or $5000, whichever is greater.

14 (c) ACTUAL DAMAGES.—For purposes of this section,

15 the term ‘‘actual damages’’ includes damages paid to com16 pensate an individual for nonpecuniary losses such as

17 physical and mental injury as well as damages paid to

18 compensate for pecuniary losses.

19 (d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In

20 any action brought under this section in which the com21 plainant has prevailed because of a knowing violation of

22 a provision of this title (other than subsection (c) or (d)

23 of section 121), the court may, in addition to any relief

24 awarded under subsections (a) and (b), award such puni25 tive damages as may be warranted. In such an action, the
69

•HR 4077 IH

1 court, in its discretion, may allow the prevailing party a

2 reasonable attorney’s fee (including expert fees) as part

3 of the costs, and the United States shall be liable for costs

4 the same as a private person.

5 (e) INSPECTION AND AMENDMENT.—If a health in6 formation trustee has established a written internal proce7 dure that allows an individual who has been denied inspec8 tion or amendment of protected health information to ap9 peal the denial, the individual may not maintain a civil

10 action in connection with the denial until the earlier of—

11 (1) the date the appeal procedure has been ex12 hausted; or

13 (2) 3 months after the date the original request

14 for inspection or amendment was made.

15 (f) NO LIABILITY FOR PERMISSIBLE DISCLO16 SURES.—A health information trustee who makes a disclo17 sure of protected health information about an individual

18 that is permitted by this title and not otherwise prohibited

19 by State or Federal statute shall not be liable to the indi20 vidual for the disclosure under common law.

21 (g) NO LIABILITY FOR INSTITUTIONAL REVIEW

22 BOARD DETERMINATIONS.—If the members of an institu23 tional review board have in good faith determined that a

24 health research project is of sufficient importance so as

25 to outweigh the intrusion into the privacy of an individual
70

•HR 4077 IH

1 pursuant to section 128(a)(1), the members, the board,

2 and the parent institution of the board shall not be liable

3 to the individual as a result of such determination.

4 (h) GOOD FAITH RELIANCE ON CERTIFICATION.—A

5 health information trustee who relies in good faith on a

6 certification by a government authority or other person

7 and discloses protected health information about an indi8 vidual in accordance with this title shall not be liable to

9 the individual for such disclosure.

10 SEC. 162. CIVIL MONEY PENALTIES.

11 (a) VIOLATION.—Any health information trustee who

12 the Secretary determines has substantially failed to com13 ply with the provisions of this Act shall be subject, in addi14 tion to any other penalties that may be prescribed by law,

15 to a civil money penalty of not more than $10,000 for

16 each such violation.

17 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

18 The provisions of section 1128A of the Social Security Act

19 (other than subsections (a) and (b) and the second sen20 tence of subsection (f)) shall apply to the imposition of

21 a civil monetary penalty under this section in the same

22 manner as such provisions apply with respect to the impo23 sition of a penalty under section 1128A of such Act.
71

•HR 4077 IH

1 SEC. 163. ALTERNATIVE DISPUTE RESOLUTION.

2 (a) IN GENERAL.—The Secretary shall, by regula3 tion, develop alternative dispute resolution methods for

4 use by individuals, health information trustees, and other

5 persons in resolving claims under section 161.

6 (b) METHODS.—The methods under subsection (a)

7 shall include at least the following:

8 (1) ARBITRATION.—The use of arbitration.

9 (2) MEDIATION.—The use of mediation.

10 (3) EARLY OFFERS OF SETTLEMENT.—The use

11 of a process under which parties make early offers

12 of settlement.

13 (c) STANDARDS FOR ESTABLISHING METHODS.—In

14 developing alternative dispute resolution methods under

15 subsection (a), the Secretary shall ensure that the meth16 ods promote the resolution of claims in a manner that—

17 (1) is affordable for the parties involved;

18 (2) provides for timely resolution of claims;

19 (3) provides for the consistent and fair resolu20 tion of claims; and

21 (4) provides for reasonably convenient access to

22 dispute resolution for individuals.

23 SEC. 164. AMENDMENTS TO CRIMINAL LAW.

24 (a) IN GENERAL.—Title 18, United States Code, is

25 amended by inserting after chapter 89 the following:
72

•HR 4077 IH

1 ‘‘CHAPTER 90—PROTECTED HEALTH

2 INFORMATION

‘‘Sec.

‘‘1831. Definitions.

‘‘1832. Obtaining protected health information under false pretenses.

‘‘1833. Monetary gain from obtaining protected health information under false

pretenses.

‘‘1834. Knowing and unlawful obtaining of protected health information.

‘‘1835. Monetary gain from knowing and unlawful obtaining of protected health

information.

‘‘1836. Knowing and unlawful use or disclosure of protected health information.

‘‘1837. Monetary gain from knowing and unlawful sale, transfer, or use of protected health information.

3 ‘‘§ 1831. Definitions

4 ‘‘As used in this chapter—

5 ‘‘(1) the term ‘health information trustee’ has

6 the meaning given such term in section 3(b)(3) of

7 the Fair Health Information Practices Act of 1994;

8 and

9 ‘‘(2) the term ‘protected health information has

10 the meaning given such term in section 3(a)(3) of

11 such Act.

12 ‘‘§ 1832. Obtaining protected health information

13 under false pretenses

14 ‘‘Whoever under false pretenses—

15 ‘‘(1) requests or obtains protected health infor16 mation from a health information trustee; or

17 ‘‘(2) obtains from an individual an authoriza18 tion for the disclosure of protected health informa19 tion about the individual maintained by a health in20 formation trustee;
73

•HR 4077 IH

1 shall be fined under this title or imprisoned not more than

2 5 years, or both.

3 ‘‘§ 1833. Monetary gain from obtaining protected

4 health information under false pretenses

5 ‘‘Whoever under false pretenses—

6 ‘‘(1) requests or obtains protected health infor7 mation from a health information trustee with the

8 intent to sell, transfer, or use such information for

9 profit or monetary gain; or

10 ‘‘(2) obtains from an individual an authoriza11 tion for the disclosure of protected health informa12 tion about the individual maintained by a health in13 formation trustee with the intent to sell, transfer, or

14 use such authorization for profit or monetary gain;

15 and knowingly sells, transfers, or uses such information

16 or authorization for profit or monetary gain shall be fined

17 under this title or imprisoned not more than 10 years, or

18 both.

19 ‘‘§ 1834. Knowing and unlawful obtaining of pro20 tected health information

21 ‘‘Whoever knowingly obtains protected health infor22 mation from a health information trustee in violation of

23 the Fair Health Information Practices Act of 1994, know24 ing that such obtaining is unlawful, shall be fined under

25 this title or imprisoned not more than 5 years, or both.
74

•HR 4077 IH

1 ‘‘§ 1835. Monetary gain from knowing and unlawful

2 obtaining of protected health information

3 ‘‘Whoever knowingly—

4 ‘‘(1) obtains protected health information from

5 a health information trustee in violation of the Fair

6 Health Information Practices Act of 1994, knowing

7 that such obtaining is unlawful and with the intent

8 to sell, transfer, or use such information for profit

9 or monetary gain; and

10 ‘‘(2) knowingly sells, transfers, or uses such in11 formation for profit or monetary gain;

12 shall be fined under this title or imprisoned not more than

13 10 years, or both.

14 ‘‘§ 1836. Knowing and unlawful use or disclosure of

15 protected health information

16 ‘‘Whoever knowingly uses or discloses protected

17 health information in violation of the Fair Health Infor18 mation Practices Act of 1994, knowing that such use or

19 disclosure is unlawful, shall be fined under this title or

20 imprisoned not more than 5 years, or both.

21 ‘‘§ 1837. Monetary gain from knowing and unlawful

22 sale, transfer, or use of protected health

23 information

24 ‘‘Whoever knowingly sells, transfers, or uses pro25 tected health information in violation of the Fair Health

26 Information Practices Act of 1994, knowing that such
75

•HR 4077 IH

1 sale, transfer, or use is unlawful, shall be fined under this

2 title or imprisoned not more than 10 years, or both.’’.

3 (b) CLERICAL AMENDMENT.—The table of chapters

4 for part I of title 18, United States Code, is amended by

5 inserting after the item relating to chapter 89 the

6 following:

‘‘90. Protected health information .............................................. 1831’’.

7 TITLE II—AMENDMENTS TO

8 TITLE 5, UNITED STATES CODE

9 SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.

10 (a) NEW SUBSECTION.—Section 552a of title 5,

11 United States Code, is amended by adding at the end the

12 following:

13 ‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen14 cy that is a health information trustee (as defined in sec15 tion 3(b)(3) of the Fair Health Information Practices Act

16 of 1994) shall promulgate rules, in accordance with the

17 requirements (including general notice) of subsections

18 (b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this

19 title, to exempt a system of records within the agency, to

20 the extent that the system of records contains protected

21 health information (as defined in section 3(a)(3) of such

22 Act), from all provisions of this section except subsections

23 (e)(1), (e)(2), subparagraphs (A) through (C) and (E)

24 through (I) of subsection (e)(4), and subsections (e)(5),
76

•HR 4077 IH

1 (e)(6), (e)(9), (e)(12), (l), (m), (n), (o), (p), (q), (r),

2 and (u).’’.

3 (b) REPEAL.—Section 552a(f)(3) of title 5, United

4 States Code, is amended by striking ‘‘pertaining to him,’’

5 and all that follows through the semicolon and inserting

6 ‘‘pertaining to the individual;’’.

7 TITLE III—REGULATIONS; EF8 FECTIVE DATES; APPLICABIL9 ITY; AND RELATIONSHIP TO

10 OTHER LAWS

11 SEC. 301. REGULATIONS.

12 Not later than July 1, 1996, the Secretary shall pre13 scribe regulations to carry out this Act.

14 SEC. 302. EFFECTIVE DATES.

15 (a) IN GENERAL.—Except as provided in subsection

16 (b), this Act, and the amendments made by this Act, shall

17 take effect on January 1, 1997.

18 (b) PROVISIONS EFFECTIVE IMMEDIATELY.—Any

19 provision of this Act that imposes a duty on the Secretary

20 shall take effect on the date of the enactment of this Act.

21 SEC. 303. APPLICABILITY.

22 (a) PROTECTED HEALTH INFORMATION.—Except as

23 provided in subsections (b) and (c), the provisions of this

24 Act shall apply to any protected health information that

25 exists in a State on or after January 1, 1997, regardless
77

•HR 4077 IH

1 of whether the information existed or was disclosed prior

2 to such date.

3 (b) SPECIAL PURPOSE TRUSTEES.—The provisions

4 of this Act shall not apply to any special purpose trustee,

5 except with respect to protected health information that

6 is received by such a trustee on or after January 1, 1997.

7 (c) AUTHORIZATIONS FOR DISCLOSURES.—An au8 thorization for the disclosure of protected health informa9 tion about an individual that is executed by the individual

10 before January 1, 1997, and is recognized and valid under

11 State law on December 31, 1996, shall remain valid and

12 shall not be subject to the requirements of section 122

13 until July 1, 1998, or the occurrence of the date or event

14 (if any) specified in the authorization upon which the au15 thorization expires, whichever occurs earlier.

16 SEC. 304. RELATIONSHIP TO OTHER LAWS.

17 (a) STATE LAW.—Except as provided in subsections

18 (b) and (c), this Act shall prevent the establishment, con19 tinuing in effect, or enforcement of State law to the extent

20 such law is inconsistent with a provision of this Act, but

21 nothing in this Act shall be construed to indicate an intent

22 on the part of Congress to occupy the field in which its

23 provisions operate to the exclusion of the laws of any State

24 on the same subject matter.
78

•HR 4077 IH

1 (b) PRIVILEGES.—This Act does not preempt or mod2 ify State common or statutory law to the extent such law

3 concerns a privilege of a witness or person in a court of

4 the State. This Act does not supersede or modify Federal

5 common or statutory law to the extent such law concerns

6 a privilege of a witness or person in a court of the United

7 States.

8 (c) CERTAIN DUTIES UNDER STATE OR FEDERAL

9 LAW.—This Act shall not be construed to preempt, super10 sede, or modify the operation of—

11 (1) any law that provides for the reporting of

12 vital statistics such as birth or death information;

13 (2) any law requiring the reporting of abuse or

14 neglect information about any individual; or

15 (3) subpart II of part E of title XXVI of the

16 Public Health Service Act (relating to notifications

17 of emergency response employees of possible expo18 sure to infectious diseases).

Æ

HR 4077 IH—2

HR 4077 IH—3

HR 4077 IH—4

HR 4077 IH—5