II

106TH CONGRESS

2D SESSION S. 2863

To prohibit use or sharing of medical health records or information by

financial institutions and their affiliates, and for other purposes.

IN THE SENATE OF THE UNITED STATES

JULY 13, 2000

Mr. SMITH of New Hampshire introduced the following bill; which was read

twice and referred to the Committee on Banking, Housing, and Urban Affairs

A BILL

To prohibit use or sharing of medical health records or

information by financial institutions and their affiliates,

and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Health Information

5 Protection Act of 2000’’.

6 SEC. 2. PROHIBITIONS ON SHARING OF HEALTH INFORMA7 TION.

8 (a) IN GENERAL.—Section 502 of the Gramm-Leach9 Bliley Act (15 U.S.C. 6802) is amended by adding at the

10 end the following:
2

•S 2863 IS

1 ‘‘(f) SHARING OF HEALTH INFORMATION PROHIB2 ITED.—

3 ‘‘(1) IN GENERAL.—Notwithstanding subsection

4 (a) or (b), and except as provided in paragraph

5 (2)—

6 ‘‘(A) no financial institution or affiliate

7 thereof may receive from, provide to, or other8 wise share with any nonaffiliated third party

9 any individually identifiable health information

10 with respect to a consumer to perform services

11 for or functions on behalf of the financial insti12 tution or affiliate, including marketing of its

13 own products or services or of financial prod14 ucts or services offered under a joint agreement

15 between 2 or more financial institutions; and

16 ‘‘(B) no financial institution or affiliate

17 thereof may receive from, provide to, or other18 wise share with any other affiliate any individ19 ually identifiable health information with re20 spect to a consumer.

21 ‘‘(2) EXCEPTIONS.—

22 ‘‘(A) PAYMENTS.—Paragraph (1) does not

23 preclude the sharing of information in connec24 tion with the collection of or payment of a

25 medically related debt or insurance claim, lim-
3

•S 2863 IS

1 ited to information about the specific item,

2 service, procedure, or condition that is the sub3 ject of the debt or claim.

4 ‘‘(B) CONSENT.—

5 ‘‘(i) IN GENERAL.—Paragraph (1)

6 does not apply if the financial institution

7 or affiliate thereof that intends to share in8 dividually identifiable health information

9 relating to a consumer—

10 ‘‘(I) has clearly and conspicu11 ously requested in writing, in accord12 ance with clause (ii), that the con13 sumer consent to such sharing;

14 ‘‘(II) has obtained affirmative

15 written consent from the consumer for

16 such sharing, and such consent has

17 not been withdrawn; and

18 ‘‘(III) requires the same health

19 information about all consumers for

20 the intended use of the information.

21 ‘‘(ii) FORMAT OF WRITTEN RE22 QUEST.—A request for consent under

23 clause (i)(I)—
4

•S 2863 IS

1 ‘‘(I) shall be contained in a sepa2 rate form, intended only for that pur3 pose;

4 ‘‘(II) shall specify that the con5 sent is being sought to provide indi6 vidually identifiable health informa7 tion to an affiliate or a nonafilliated

8 party, as the case may be; and

9 ‘‘(III) shall specify with whom

10 and for what purpose the information

11 will be shared.

12 ‘‘(iii) WITHDRAWAL OF CONSENT.—A

13 consumer that has given written consent to

14 the sharing of individually identifiable

15 health information under this subpara16 graph to any person may withdraw such

17 consent in writing at any time. No person

18 shall be in violation of this subsection for

19 the lawful sharing of individually identifi20 able health information under this sub21 paragraph before the date of receipt of a

22 written withdrawal of consent under this

23 clause.

24 ‘‘(C) VOLUNTARY INFORMATION.—Nothing

25 in this subsection precludes a consumer from
5

•S 2863 IS

1 voluntarily providing individually identifiable

2 health information to a life, health, or disability

3 insurer that is an entity described in paragraph

4 (1).

5 ‘‘(3) LIMITATION ON ADVERSE ACTION.—A fi6 nancial institution or affiliate thereof, that is not or7 ganized for the purpose of underwriting insurance

8 products, subject to other applicable law, may not

9 establish the terms of a financial transaction, make

10 a decision to offer, provide, or continue to provide a

11 product or service to a consumer, or otherwise take

12 any adverse action with respect to the consumer—

13 ‘‘(A) based on individually identifiable

14 health information; or

15 ‘‘(B) based on whether or not the con16 sumer consents to the sharing of such informa17 tion in response to a consent request under

18 paragraph (2)(B).

19 ‘‘(4) LIMITS ON REDISCLOSURE AND REUSE OF

20 INFORMATION.—

21 ‘‘(A) IN GENERAL.—A financial institu22 tion, affiliate, or nonaffiliated third party that

23 receives individually identifiable health informa24 tion from a financial institution or affiliate in

25 accordance with any exception in paragraph (2)
6

•S 2863 IS

1 shall not disclose such information to any other

2 person unless such disclosure would be lawful if

3 made directly to such other person by the finan4 cial institution or affiliate that provided the in5 formation.

6 ‘‘(B) DISCLOSURE UNDER EXCEPTION.—

7 Notwithstanding subparagraph (A), any person

8 that receives individually identifiable health in9 formation from a financial institution or affil10 iate in accordance with any exception in para11 graph (2) may also use or disclose such infor12 mation only as permitted under that exception

13 and this subsection.

14 ‘‘(5) EXISTING PROTECTIONS FOR HEALTH IN15 FORMATION NOT AFFECTED.—Nothing in this sub16 section shall be construed as—

17 ‘‘(A) modifying, limiting, or superseding

18 standards governing the privacy and security of

19 individually identifiable health information pro20 mulgated by the Secretary of Health and

21 Human Services under section 264 of the

22 Health Insurance Portability and Accountability

23 Act of 1996, or the amendments made by sec24 tion 262(a) of that Act; or
7

•S 2863 IS

1 ‘‘(B) authorizing the use or disclosure of

2 individually identifiable health information in a

3 manner other than as permitted by other appli4 cable law.

5 ‘‘(6) RELATION TO STATE LAWS.—

6 ‘‘(A) IN GENERAL.—This subsection shall

7 not be construed as superseding, altering, or af8 fecting the statutes, regulations, orders, or in9 terpretations in effect in any State, except to

10 the extent that such statutes, regulations, or11 ders, or interpretations are inconsistent with

12 the provisions of this subsection, and then only

13 to the extent of the inconsistency.

14 ‘‘(B) GREATER PROTECTION UNDER STATE

15 LAW.—For purposes of this paragraph, a State

16 statute, regulation, order, or interpretation is

17 not inconsistent with the provisions of this sub18 section if the protection that such statute, regu19 lation, order, or interpretation affords any per20 son is greater than the protection provided

21 under this subsection, as determined by the ap22 propriate enforcement authority referred to in

23 section 505, on its own motion or upon the pe24 tition of any interested party.
8

•S 2863 IS

1 ‘‘(7) FEDERAL AND STATE ACTION.—The At2 torney General of the United States or the Attorney

3 General of a State, or the State bank supervisor, as

4 defined in section 3 of the Federal Deposit Insur5 ance Act, as appropriate, may impose a fine of not

6 more than $25,000 per record, per person, affiliate,

7 or nonaffiliated person to which the record was dis8 tributed in violation of this subsection.’’.

9 SEC. 3. DEFINITION OF INDIVIDUALLY IDENTIFIABLE

10 HEALTH INFORMATION.

11 Section 509 of the Gramm-Leach-Bliley Act (15

12 U.S.C. 6809) is amended by adding at the end the fol13 lowing new paragraph:

14 ‘‘(12) INDIVIDUALLY IDENTIFIABLE HEALTH

15 INFORMATION.—The term ‘individually identifiable

16 health information’ means any information, includ17 ing demographic information obtained from or about

18 an individual, that is described in section

19 1171(6)(B) of the Social Security Act.’’.

20 SEC. 4. EFFECTIVE DATE.

21 This Act and the amendments made by this Act shall

22 become effective 90 days after the date of enactment of

23 this Act.

Æ