II

106TH CONGRESS

1ST SESSION S. 881

To ensure confidentiality with respect to medical records and health carerelated information, and for other purposes.

IN THE SENATE OF THE UNITED STATES

APRIL 27, 1999

Mr. BENNETT (for himself, Mr. MACK, Mr. MURKOWSKI, and Mr. SANTORUM)

introduced the following bill; which was read twice and referred to the

Committee on Health, Education, Labor, and Pensions

A BILL

To ensure confidentiality with respect to medical records

and health care-related information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Medical Information Protection Act of 1999’’.

6 (b) TABLE OF CONTENTS.—The table of contents for

7 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings.

Sec. 3. Purposes.

Sec. 4. Definitions.

TITLE I—INDIVIDUAL’S RIGHTS
2

•S 881 IS

Subtitle A—Review of Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Amendment of protected health information.

Sec. 103. Notice of confidentiality practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Sec. 201. General rules regarding use and disclosure.

Sec. 202. Procurement of authorizations for use and disclosure of protected

health information for treatment, payment, and health care operations.

Sec. 203. Authorizations for use or disclosure of protected health information

other than for treatment, payment, and health care operations.

Sec. 204. Next of kin and directory information.

Sec. 205. Emergency circumstances.

Sec. 206. Oversight.

Sec. 207. Public health.

Sec. 208. Health research.

Sec. 209. Disclosure in civil, judicial, and administrative procedures.

Sec. 210. Disclosure for law enforcement purposes.

Sec. 211. Payment card and electronic payment transaction.

Sec. 212. Individual representatives.

Sec. 213. No liability for permissible disclosures.

Sec. 214. Sale of business, mergers, etc.

TITLE III—SANCTIONS

Subtitle A—Criminal Provisions

Sec. 301. Wrongful disclosure of protected health information.

Subtitle B—Civil Sanctions

Sec. 311. Civil penalty violation.

Sec. 312. Procedures for imposition of penalties.

Sec. 313. Enforcement by State insurance commissioners.

TITLE IV—MISCELLANEOUS

Sec. 401. Relationship to other laws.

Sec. 402. Conforming amendment.

Sec. 403. Study by Institute of Medicine.

Sec. 405. Effective date.

1 SEC. 2. FINDINGS.

2 The Congress finds that—
3

•S 881 IS

1 (1) individuals have a right of confidentiality

2 with respect to their personal health information and

3 records;

4 (2) with respect to information about medical

5 care and health status, the traditional right of con6 fidentiality is at risk;

7 (3) an erosion of the right of confidentiality

8 may reduce the willingness of patients to confide in

9 physicians and other practitioners, thus jeopardizing

10 quality health care;

11 (4) an individual’s confidentiality right means

12 that an individual’s consent is needed to disclose his

13 or her protected health information, except in lim14 ited circumstances required by the public interest;

15 (5) any disclosure of protected health informa16 tion should be limited to that information or portion

17 of the medical record necessary to fulfill the purpose

18 of the disclosure;

19 (6) the availability of timely and accurate per20 sonal health data for the delivery of health care serv21 ices throughout the Nation is needed;

22 (7) personal health care data is essential for

23 medical research;
4

•S 881 IS

1 (8) public health uses of personal health data

2 are critical to both personal health as well as public

3 health; and

4 (9) confidentiality of an individual’s health in5 formation must be assured without jeopardizing the

6 pursuit of clinical and epidemiological research un7 dertaken to improve health care and health outcomes

8 and to assure the quality and efficiency of health

9 care.

10 SEC. 3. PURPOSES.

11 The purpose of this Act is to—

12 (1) establish strong and effective mechanisms

13 to protect against the unauthorized and inappro14 priate disclosure of protected health information that

15 is created or maintained as part of health care treat16 ment, diagnosis, enrollment, payment, plan adminis17 tration, testing, or research processes;

18 (2) promote the efficiency and security of the

19 health information infrastructure so that members

20 of the health care community may more effectively

21 exchange and transfer health information in a man22 ner that will ensure the confidentiality of protected

23 health information without impeding the delivery of

24 high quality health care; and
5

•S 881 IS

1 (3) establish strong and effective remedies for

2 violations of this Act.

3 SEC. 4. DEFINITIONS.

4 As used in this Act:

5 (1) ACCREDITING BODY.—The term ‘‘accred6 iting body’’ means a national body, committee, orga7 nization, or institution (such as the Joint Commis8 sion on Accreditation of Health Care Organizations

9 or the National Committee for Quality Assurance)

10 that has been authorized by law or is recognized by

11 a health care regulating authority as an accrediting

12 entity or any other entity that has been similarly au13 thorized or recognized by law to perform specific ac14 creditation, licensing or credentialing activities.

15 (2) AGENT.—The term ‘‘agent’’ means a per16 son, including a contractor, who represents and acts

17 for another under the contract or relation of agency,

18 or whose function is to bring about, modify, effect,

19 accept performance of, or terminate contractual obli20 gations between the principal and a third person.

21 (3) COMMON RULE.—The term ‘‘common rule’’

22 means the Federal policy for protection of human

23 subjects from research risks originally published as

24 56 Federal Register 28.025 (1991) as adopted and

25 implemented by a Federal department or agency.
6

•S 881 IS

1 (4) DISCLOSE AND DISCLOSURE.—

2 (A) DISCLOSE.—The term ‘‘disclose’’

3 means to release, transfer, provide access to, or

4 otherwise divulge protected health information

5 to any person other than the individual who is

6 the subject of such information.

7 (B) DISCLOSURE.—

8 (i) IN GENERAL.—The term ‘‘disclo9 sure’’ refers to a release, transfer, provi10 sion for access to, or communication of in11 formation as described in subparagraph

12 (A).

13 (ii) USE.—The use of protected health

14 information by an authorized person and

15 its agents shall not be considered a disclo16 sure for purposes of this Act if the use is

17 consistent with the purposes for which the

18 information was lawfully obtained. Using

19 or providing access to health information

20 in the form of nonidentifiable health infor21 mation shall not be construed as a disclo22 sure of protected health information.

23 (5) EMPLOYER.—The term ‘‘employer’’ has the

24 meaning given such term under section 3(5) of the

25 Employee Retirement Income Security Act of 1974
7

•S 881 IS

1 (29 U.S.C. 1002(5)), except that such term shall in2 clude only employers of two or more employees.

3 (6) HEALTH CARE.—The term ‘‘health care’’

4 means—

5 (A) preventive, diagnostic, therapeutic, re6 habilitative, maintenance, or palliative care, in7 cluding appropriate assistance with disease or

8 symptom management and maintenance, coun9 seling, assessment, service, or procedure—

10 (i) with respect to the physical or

11 mental condition of an individual; or

12 (ii) affecting the structure or function

13 of the human body or any part of the

14 human body, including the banking of

15 blood, sperm, organs, or any other tissue;

16 or

17 (B) pursuant to a prescription or medical

18 order any sale or dispensing of a drug, device,

19 equipment, or other health care related item to

20 an individual, or for the use of an individual.

21 (7) HEALTH CARE OPERATIONS.—The term

22 ‘‘health care operations’’ means services provided by

23 or on behalf of a health plan or health care provider

24 for the purpose of carrying out the management

25 functions of a health care provider or health plan, or
8

•S 881 IS

1 implementing the terms of a contract for health plan

2 benefits, including—

3 (A) coordinating health care, including

4 health care management of the individual

5 through risk assessment and case management;

6 (B) conducting quality assessment and im7 provement activities, including outcomes evalua8 tion, clinical guideline development, and im9 provement;

10 (C) reviewing the competence or qualifica11 tions of health care professionals, evaluating

12 provider performance, and conducting health

13 care education, accreditation, certification, li14 censing, or credentialing activities;

15 (D) carrying out utilization review activi16 ties, including precertification and

17 preauthorization of services, and health plan

18 rating and insurance activities, including under19 writing, experience rating and reinsurance; and

20 (E) conducting or arranging for auditing

21 services, including fraud detection and compli22 ance programs.

23 (8) HEALTH CARE PROVIDER.—The term

24 ‘‘health care provider’’ means a person, who with re25 spect to a specific item of protected health informa-
9

•S 881 IS

1 tion, receives, creates, uses, maintains, or discloses

2 the information while acting in whole or in part in

3 the capacity of—

4 (A) a person who is licensed, certified, reg5 istered, or otherwise authorized by Federal or

6 State law to provide an item or service that

7 constitutes health care in the ordinary course of

8 business, or practice of a profession;

9 (B) a Federal, State, employer sponsored

10 or other privately sponsored program that di11 rectly provides items or services that constitute

12 health care to beneficiaries; or

13 (C) an officer or employee of a person de14 scribed in subparagraph (A) or (B).

15 (9) HEALTH OVERSIGHT AGENCY.—The term

16 ‘‘health oversight agency’’ means a person who, with

17 respect to a specific item of protected health infor18 mation, receives, creates, uses, maintains, or dis19 closes the information while acting in whole or in

20 part in the capacity of—

21 (A) a person who performs or oversees the

22 performance of an assessment, evaluation, de23 termination, or investigation, relating to the li24 censing, accreditation, certification, or

25 credentialing of health care providers; or
10

•S 881 IS

1 (B) a person who—

2 (i) performs or oversees the perform3 ance of an audit, assessment, evaluation,

4 determination, or investigation relating to

5 the effectiveness of, compliance with, or

6 applicability of, legal, fiscal, medical, or

7 scientific standards or aspects of perform8 ance related to the delivery of health care;

9 and

10 (ii) is a public agency, acting on be11 half of a public agency, acting pursuant to

12 a requirement of a public agency, or car13 rying out activities under a Federal or

14 State law governing the assessment, eval15 uation, determination, investigation, or

16 prosecution described in subparagraph (A).

17 (10) HEALTH PLAN.—The term ‘‘health plan’’

18 means any health insurance issuer, health insurance

19 plan, including any hospital or medical service plan,

20 dental or other health service plan or health mainte21 nance organization plan, provider sponsored organi22 zation, or other program providing or arranging for

23 the provision of health benefits. Such term does not

24 include any policy, plan or program to the extent

25 that it provides, arranges or administers health ben-
11

•S 881 IS

1 efits pursuant to a program of workers compensa2 tion or automobile insurance.

3 (11) HEALTH RESEARCH AND HEALTH RE4 SEARCHER.—

5 (A) HEALTH RESEARCH.—The term

6 ‘‘health research’’ means a systematic investiga7 tion of health (including basic biological proc8 esses and structures), health care, or its deliv9 ery and financing, including research develop10 ment, testing and evaluation, designed to de11 velop or contribute to generalizable knowledge

12 concerning human health, health care, or health

13 care delivery.

14 (B) HEALTH RESEARCHER.—The term

15 ‘‘health researcher’’ means a person involved in

16 health research, or an officer, employee, or

17 agent of such person.

18 (12) KEY.—The term ‘‘key’’ means a method

19 or procedure used to transform nonidentifiable

20 health information that is in a coded or encrypted

21 form into protected health information.

22 (13) LAW ENFORCEMENT INQUIRY.—The term

23 ‘‘law enforcement inquiry’’ means a lawful investiga24 tion or official proceeding inquiring into a violation

25 of, or failure to comply with, any criminal or civil
12

•S 881 IS

1 statute or any regulation, rule, or order issued pur2 suant to such a statute.

3 (14) LIFE INSURER.—The term ‘‘life insurer’’

4 means life insurance company as defined in section

5 816 of the Internal Revenue Code of 1986.

6 (15) NONIDENTIFIABLE HEALTH INFORMA7 TION.—The term ‘‘nonidentifiable health informa8 tion’’ means protected health information from

9 which personal identifiers, that directly reveal the

10 identity of the individual who is the subject of such

11 information or provide a direct means of identifying

12 the individual (such as name, address, and social se13 curity number), have been removed, encrypted, or

14 replaced with a code, such that the identity of the

15 individual is not evident without (in the case of

16 encrypted or coded information) use of key.

17 (16) ORIGINATING PROVIDER.—The term ‘‘orig18 inating provider’’ means a health care provider who

19 initiates a treatment episode, such as prescribing a

20 drug, ordering a diagnostic test, or admitting an in21 dividual to a health care facility. A hospital or nurs22 ing facility is the originating provider with respect to

23 protected health information created or received as

24 part of inpatient or outpatient treatment provided in

25 such settings.
13

•S 881 IS

1 (17) PAYMENT.—The term ‘‘payment’’

2 means—

3 (A) the activities undertaken by—

4 (i) or on behalf of a health plan to de5 termine its responsibility for coverage

6 under the plan; or

7 (ii) a health care provider to obtain

8 payment for items or services provided to

9 an individual, provided under a health

10 plan, or provided based on a determination

11 by the health plan of responsibility for cov12 erage under the plan; and

13 (B) activities undertaken as described in

14 subparagraph (A) including—

15 (i) billing, claims management, med16 ical data processing, other administrative

17 services, and actual payment;

18 (ii) determinations of coverage or ad19 judication of health benefit or subrogation

20 claims; and

21 (iii) review of health care services with

22 respect to coverage under a health plan or

23 justification of charges.

24 (18) PERSON.—The term ‘‘person’’ means a

25 government, governmental subdivision, agency or au-
14

•S 881 IS

1 thority; corporation; company; association; firm;

2 partnership; society; estate; trust; joint venture; indi3 vidual; individual representative; tribal government;

4 and any other legal entity.

5 (19) PROTECTED HEALTH INFORMATION.—The

6 term ‘‘protected health information’’ with respect to

7 the individual who is the subject of such information

8 means any information which identifies such indi9 vidual, whether oral or recorded in any form or me10 dium, that—

11 (A) is created or received by a health care

12 provider, health plan, health oversight agency,

13 public health authority, employer, life insurer,

14 school or university;

15 (B) relates to the past, present, or future

16 physical or mental health or condition of an in17 dividual (including individual cells and their

18 components);

19 (C) is derived from—

20 (i) the provision of health care to the

21 individual; or

22 (ii) payment for the provision of

23 health care to the individual; and

24 (D) is not nonidentifiable health informa25 tion.
15

•S 881 IS

1 (20) PUBLIC HEALTH AUTHORITY.—The term

2 ‘‘public health authority’’ means an authority or in3 strumentality of the United States, a tribal govern4 ment, a State, or a political subdivision of a State

5 that is—

6 (A) primarily responsible for health or wel7 fare matters; and

8 (B) primarily engaged in activities such as

9 incidence reporting, public health surveillance,

10 and investigation or intervention.

11 (21) SCHOOL OR UNIVERSITY.—The term

12 ‘‘school or university’’ means an institution or place

13 accredited or licensed for purposes of providing for

14 instruction or education, including an elementary

15 school, secondary school, or institution of higher

16 learning, a college, or an assemblage of colleges

17 united under one corporate organization or govern18 ment.

19 (22) SECRETARY.—The term ‘‘Secretary’’

20 means the Secretary of Health and Human Services.

21 (23) SIGNED.—The term ‘‘signed’’ refers to

22 documentation of assent in any medium, whether

23 ink, digital or biometric signatures, or recorded oral

24 authorizations.
16

•S 881 IS

1 (24) STATE.—The term ‘‘State’’ includes the

2 District of Columbia, Puerto Rico, the Virgin Is3 lands, Guam, American Samoa, and the Northern

4 Mariana Islands.

5 (25) TREATMENT.—The term ‘‘treatment’’

6 means the provision of health care by a health care

7 provider.

8 (26) WRITING AND WRITTEN.—

9 (A) WRITING.—The term ‘‘writing’’ means

10 any form of documentation, whether paper,

11 electronic, digital, biometric or tape recorded.

12 (B) WRITTEN.—The term ‘‘written’’ in13 cludes paper, electronic, digital, biometric and

14 tape-recorded formats.

15 TITLE I—INDIVIDUAL’S RIGHTS

16 Subtitle A—Review of Protected

17 Health Information by Subjects

18 of the Information

19 SEC. 101. INSPECTION AND COPYING OF PROTECTED

20 HEALTH INFORMATION.

21 (a) GENERAL RULES.—

22 (1) COMPLIANCE WITH SECTION.—At the re23 quest of an individual who is the subject of protected

24 health information and except as provided in sub25 section (c), a health care provider, a health plan,
17

•S 881 IS

1 employer, life insurer, school, or university shall ar2 range for inspection or copying of protected health

3 information concerning the individual, including

4 records created under section 102, as provided for in

5 this section.

6 (2) AVAILABILITY OF INFORMATION THROUGH

7 ORIGINATING PROVIDER.—Protected health informa8 tion that is created or received by a health plan or

9 health care provider as part of treatment or pay10 ment shall be made available for inspection or copy11 ing as provided for in this title through the origi12 nating provider.

13 (3) OTHER ENTITIES.—An employer, life in14 surer, school, or university that creates or receives

15 protected health information in performing any func16 tion other than providing treatment, payment, or

17 health care operations with respect to the individual

18 who is the subject of such information, shall make

19 such information available for inspection or copying

20 as provided for in this title, or through any provider

21 designated by the individual.

22 (4) PROCEDURES.—The person providing ac23 cess to information under this title may set forth ap24 propriate procedures to be followed for such inspec25 tion or copying and may require an individual to pay
18

•S 881 IS

1 reasonable costs associated with such inspection or

2 copying.

3 (b) SPECIAL CIRCUMSTANCES.—If an originating

4 provider, its agent, or contractor no longer maintains the

5 protected health information sought by an individual pur6 suant to subsection (a), a health plan or another health

7 care provider that maintains such information shall ar8 range for inspection or copying.

9 (c) EXCEPTIONS.—Unless ordered by a court of com10 petent jurisdiction, a person acting pursuant to subsection

11 (a) or (b) is not required to permit the inspection or copy12 ing of protected health information if any of the following

13 conditions are met:

14 (1) ENDANGERMENT TO LIFE OR SAFETY.—

15 The person determines that the disclosure of the in16 formation could reasonably be expected to endanger

17 the life or physical safety of any individual.

18 (2) CONFIDENTIAL SOURCE.—The information

19 identifies, or could reasonably lead to the identifica20 tion of, a person who provided information under a

21 promise of confidentiality to a health care provider

22 concerning the individual who is the subject of the

23 information.

24 (3) INFORMATION COMPILED IN ANTICIPATION

25 OF OR IN CONNECTION WITH A FRAUD INVESTIGA-
19

•S 881 IS

1 TION OR LITIGATION.—The information is compiled

2 principally—

3 (A) in anticipation of or in connection with

4 a fraud investigation, an investigation of mate5 rial misrepresentation in connection with an in6 surance policy, a civil, criminal, or administra7 tive action or proceeding; or

8 (B) for use in such action or proceeding.

9 (4) INVESTIGATIONAL INFORMATION.—The pro10 tected health information was created, received or

11 maintained by a health researcher as provided in

12 section 208.

13 (d) DENIAL OF A REQUEST FOR INSPECTION OR

14 COPYING.—If a person described in subsection (a) or (b)

15 denies a request for inspection or copying pursuant to sub16 section (c), the person shall inform the individual in writ17 ing of—

18 (1) the reasons for the denial of the request for

19 inspection or copying;

20 (2) the availability of procedures for further re21 view of the denial; and

22 (3) the individual’s right to file with the person

23 a concise statement setting forth the request for in24 spection or copying.
20

•S 881 IS

1 (e) STATEMENT REGARDING REQUEST.—If an indi2 vidual has filed a statement under subsection (d)(3), the

3 person in any subsequent disclosure of the portion of the

4 information requested under subsection (a) or (b)—

5 (1) shall include a notation concerning the indi6 vidual’s statement; and

7 (2) may include a concise statement of the rea8 sons for denying the request for inspection or copy9 ing.

10 (f) INSPECTION AND COPYING OF SEGREGABLE POR11 TION.—A person described in subsection (a) or (b) shall

12 permit the inspection and copying of any reasonably seg13 regable portion of a record after deletion of any portion

14 that is exempt under subsection (c).

15 (g) DEADLINE.—A person described in subsection (a)

16 or (b) shall comply with or deny, in accordance with sub17 section (d), a request for inspection or copying of pro18 tected health information under this section not later than

19 60 days after the date on which the person receives the

20 request.

21 (h) RULES OF CONSTRUCTION.—

22 (1) AGENTS.—An agent of a person described

23 in subsection (a) or (b) shall not be required to pro24 vide for the inspection and copying of protected

25 health information, except where—
21

•S 881 IS

1 (A) the protected health information is re2 tained by the agent; and

3 (B) the agent has been asked in writing by

4 the person involved to fulfill the requirements of

5 this section.

6 (2) NO REQUIREMENT FOR HEARING.—This

7 section shall not be construed to require a person

8 described in subsection (a) or (b) to conduct a for9 mal, informal, or other hearing or proceeding con10 cerning a request for inspection or copying of pro11 tected health information.

12 SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA13 TION.

14 (a) RIGHT TO AMEND.—

15 (1) IN GENERAL.—Protected health information

16 shall be subject to amendment as provided for in

17 this section.

18 (2) COMPLIANCE WITH REQUEST.—Except as

19 provided in subsection (c), not later than 45 days

20 after the date on which an originating provider, em21 ployer, life insurer, school, or university receives

22 from an individual a request in writing to amend

23 protected health information, such person shall—

24 (A) make the amendment requested;
22

•S 881 IS

1 (B) inform the individual of the amend2 ment that has been made; and

3 (C) inform any person identified by the in4 dividual in the request for amendment and—

5 (i) who is not an officer, employee, or

6 agent of the person; and

7 (ii) to whom the unamended portion

8 of the information was disclosed within the

9 previous year by sending a notice to the in10 dividual’s last known address that there

11 has been a substantive amendment to the

12 protected health information of such indi13 vidual.

14 (b) REQUEST OF ORIGINATING PROVIDERS.—

15 (1) IN GENERAL.—Protected health information

16 that is created or received by a health plan or health

17 care provider as part of treatment or payment shall

18 be subject to amendment as provided for in this sec19 tion upon a written request made to the originating

20 provider.

21 (2) SPECIAL CIRCUMSTANCES.—If an origi22 nating provider, its agent, or contractor no longer

23 maintains the protected health information sought to

24 be amended by an individual pursuant to paragraph

25 (1), a health plan or another health care provider
23

•S 881 IS

1 that maintains such information may arrange for

2 amendment consistent with this section.

3 (c) REFUSAL TO AMEND.—If a person described in

4 subsection (a)(2) refuses to make the amendment re5 quested under such subsection, the person shall inform the

6 individual in writing of—

7 (1) the reasons for the refusal to make the

8 amendment;

9 (2) the availability of procedures for further re10 view of the refusal; and

11 (3) the procedures by which the individual may

12 file with the person a concise statement setting forth

13 the requested amendment and the individual’s rea14 sons for disagreeing with the refusal.

15 (d) STATEMENT OF DISAGREEMENT.—If an indi16 vidual has filed a statement of disagreement under sub17 section (c)(3), the person involved, in any subsequent dis18 closure of the disputed portion of the information—

19 (1) shall include a notation concerning the indi20 vidual’s statement; and

21 (2) may include a concise statement of the rea22 sons for not making the requested amendment.

23 (e) RULES GOVERNING AGENTS.—The agent of a

24 person described in subsection (a)(2) shall not be required
24

•S 881 IS

1 to make amendments to protected health information, ex2 cept where—

3 (1) the protected health information is retained

4 by the agent; and

5 (2) the agent has been asked in writing by such

6 person to fulfill the requirements of this section.

7 (f) REPEATED REQUESTS FOR AMENDMENTS.—If a

8 person described in subsection (a)(2) receives a request

9 for an amendment of information as provided for in such

10 subsection and a statement of disagreement has been filed

11 pursuant to subsection (d), the person shall inform the

12 individual of such filing and shall not be required to carry

13 out the procedures required under this section.

14 (g) RULES OF CONSTRUCTION.—This section shall

15 not be construed to—

16 (1) require that a person described in sub17 section (a)(2) conduct a formal, informal, or other

18 hearing or proceeding concerning a request for an

19 amendment to protected health information;

20 (2) require a provider to amend an individual’s

21 protected health information as to the type, dura22 tion, or quality of treatment the individual believes

23 he or she should have been provided; or

24 (3) permit any deletions or alterations of the

25 original information.
25

•S 881 IS

1 SEC. 103. NOTICE OF CONFIDENTIALITY PRACTICES.

2 (a) PREPARATION OF WRITTEN NOTICE.—A health

3 care provider, health plan, health oversight agency, public

4 health authority, employer, life insurer, health researcher,

5 school, or university shall post or provide, in writing and

6 in a clear and conspicuous manner, notice of the person’s

7 confidentiality practices, that shall include—

8 (1) a description of an individual’s rights with

9 respect to protected health information;

10 (2) the uses and disclosures of protected health

11 information authorized under this Act;

12 (3) the procedures for authorizing disclosures of

13 protected health information and for revoking such

14 authorizations;

15 (4) the procedures established by the person for

16 the exercise of the individual’s rights; and

17 (5) the right to obtain a copy of the notice of

18 the confidentiality practices required under this Act.

19 (b) MODEL NOTICE.—The Secretary, after notice

20 and opportunity for public comment, shall develop and dis21 seminate model notices of confidentiality practices, using

22 the advice of the National Committee on Vital Health Sta23 tistics, for use under this section. Use of the model notice

24 shall serve as an absolute defense against claims of receiv25 ing inappropriate notice.
26

•S 881 IS

1 Subtitle B—Establishment of

2 Safeguards

3 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

4 (a) IN GENERAL.—A health care provider, health

5 plan, health oversight agency, public health authority, em6 ployer, life insurer, health researcher, law enforcement of7 ficial, school, or university shall establish and maintain ap8 propriate administrative, technical, and physical safe9 guards to protect the confidentiality, security, accuracy,

10 and integrity of protected health information created, re11 ceived, obtained, maintained, used, transmitted, or dis12 posed of by such person.

13 (b) FUNDAMENTAL SAFEGUARDS.—The safeguards

14 established pursuant to subsection (a) shall address the

15 following factors:

16 (1) The purpose for which protected health in17 formation is needed and whether that purpose can

18 be accomplished with nonidentifiable health informa19 tion.

20 (2) Appropriate procedures for maintaining the

21 security of protected health information and assur22 ing the appropriate use of any key used in creating

23 nonidentifiable health information.

24 (3) The categories of personnel who will have

25 access to protected health information and appro-
27

•S 881 IS

1 priate training, supervision and sanctioning of such

2 personnel with respect to their use of protected

3 health information and adherence to established

4 safeguards.

5 (4) Appropriate limitations on access to indi6 vidual identifiers.

7 (5) Appropriate mechanisms for limiting disclo8 sures of protected information to the information

9 necessary to respond to the request for disclosure.

10 (6) Procedures for handling requests for pro11 tected health information by persons other than the

12 individual who is the subject of such information, in13 cluding relatives and affiliates of such individual,

14 law enforcement officials, parties in civil litigation,

15 health care providers, and health plans.

16 SEC. 112. ACCOUNTING FOR DISCLOSURES.

17 (a) IN GENERAL.—A health care provider, health

18 plan, health oversight agency, public health authority, em19 ployer, life insurer, health researcher, law enforcement of20 ficial, school, or university shall establish and maintain a

21 process for documenting the disclosure of protected health

22 information by any such person through the recording of

23 the name and address of the recipient of the information,

24 or through the recording of another mean of contacting

25 the recipient, and the purpose of the disclosure.
28

•S 881 IS

1 (b) RECORD OF DISCLOSURE.—A record (or other

2 means of documentation) established under subsection (a)

3 shall be maintained for not less than 7 years.

4 (c) IDENTIFICATION OF DISCLOSED INFORMATION AS

5 PROTECTED HEALTH INFORMATION.—Except as other6 wise provided in this title, protected health information

7 shall be clearly identified as protected health information

8 that is subject to this Act.

9 TITLE II—RESTRICTIONS ON

10 USE AND DISCLOSURE

11 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO12 SURE.

13 (a) DISCLOSURE PROHIBITED.—A health care pro14 vider, health plan, health oversight agency, public health

15 authority, employer, life insurer, health researcher, law en16 forcement official, school, or university, or any agents of

17 such a person, may not disclose protected health informa18 tion except as authorized under this Act or as authorized

19 by the individual who is the subject of such information.

20 (b) APPLICABILITY TO AGENTS.—

21 (1) IN GENERAL.—A person described in sub22 section (a) may use an agent, including a contractor,

23 to carry out an otherwise lawful activity using pro24 tected health information maintained by such person

25 if the person specifies the activities for which the
29

•S 881 IS

1 agent is authorized to use such protected health in2 formation and prohibits the agent from using or dis3 closing protected health information for purposes

4 other than carrying out the specified activities.

5 (2) LIMITATION ON LIABILITY.—Notwith6 standing any other provision of this Act, a person

7 who has limited the activities of an agent as pro8 vided for in paragraph (1), shall not be liable for the

9 actions or disclosures of the agent that are not in

10 fulfillment of those activities.

11 (3) LIMITATIONS ON AGENTS.—An agent who

12 receives protected health information from a person

13 described in subsection (a) shall, in its own right, be

14 subject to the applicable provisions of this Act.

15 (c) APPLICABILITY TO EMPLOYERS.—

16 (1) IN GENERAL.—An employer may use an

17 employee or agent to create, receive, or maintain

18 protected health information in order to carry out an

19 otherwise lawful activity so long as—

20 (A) the disclosure of the protected em21 ployee health information within the entity is

22 compatible with the purpose for which the in23 formation was obtained and limited to informa24 tion necessary to accomplish the purpose of the

25 disclosure; and
30

•S 881 IS

1 (B) the employer prohibits the release,

2 transfer or communication of the protected

3 health information to officers, employees, or

4 agents responsible for hiring, promotion, and

5 making work assignment decisions with respect

6 to the subject of the information.

7 (2) DETERMINATION.—For purposes of para8 graph (1)(A), the determination of what constitutes

9 information necessary to accomplish the purpose for

10 which the information is obtained shall be made by

11 a health care provider, except in situations involving

12 payment for health plan operations undertaken by

13 the employer.

14 (d) CREATION OF NONIDENTIFIABLE HEALTH IN15 FORMATION.—A person described in subsection (a) may

16 use protected health information for the purpose of cre17 ating nonidentifiable health information.

18 (e) INDIVIDUAL AUTHORIZATION.—To be valid, an

19 authorization to disclose protected health information

20 under this title shall—

21 (1) identify the individual who is the subject of

22 the protected health information;

23 (2) describe the nature of the information to be

24 disclosed;
31

•S 881 IS

1 (3) identify the type of person to whom the in2 formation is to be disclosed;

3 (4) describe the purpose of the disclosure;

4 (5) be subject to revocation by the individual

5 and indicate that the authorization is valid until rev6 ocation by the individual; and

7 (6) be in writing, dated, and signed by the indi8 vidual, a family member or other authorized rep9 resentative.

10 (f) MANIPULATION OF NONIDENTIFIABLE HEALTH

11 INFORMATION.—Any person who manipulates nonidentifi12 able health information in order to identify an individual,

13 or uses a key to identify an individual without authoriza14 tion, is deemed to have disclosed protected health informa15 tion.

16 SEC. 202. PROCUREMENT OF AUTHORIZATIONS FOR USE

17 AND DISCLOSURE OF PROTECTED HEALTH

18 INFORMATION FOR TREATMENT, PAYMENT,

19 AND HEALTH CARE OPERATIONS.

20 (a) AUTHORIZATIONS.—

21 (1) IN GENERAL.—With respect to each indi22 vidual, a single authorization that substantially com23 plies with section 201(e) must be secured to permit

24 the use and disclosure of protected health informa25 tion concerning such individual for treatment, pay-
32

•S 881 IS

1 ment, and health care operations, as provided for in

2 this subsection.

3 (2) EMPLOYERS.—Every employer offering a

4 health plan to its employees shall, at the time of,

5 and as a condition of enrollment in the health plan,

6 obtain a signed, written authorization that is a legal,

7 informed authorization concerning the use and dis8 closure of protected health information for treat9 ment, payment, and health care operations with re10 spect to each individual who is eligible to receive

11 care under the health plan.

12 (3) HEALTH PLANS.—Every health plan offer13 ing enrollment to individuals or non-employer groups

14 shall, at the time of, and as a condition of enroll15 ment in the health plan, obtain a signed, written au16 thorization that is a legal, informed authorization

17 concerning the use and disclosure of protected health

18 information for treatment, payment, and health care

19 operations, with respect to each individual who is eli20 gible to receive care under the plan.

21 (4) UNINSURED.—An originating provider pro22 viding health care to an uninsured individual, shall

23 obtain a signed, written authorization to use and

24 disclose protected health information with respect to

25 such individual for treatment, payment, and health
33

•S 881 IS

1 care operations of such provider, and in arranging

2 for treatment and payment from other providers.

3 (5) PROVIDERS.—Any health care provider pro4 viding health care to an individual may, in connec5 tion with providing such care, obtain a signed, writ6 ten authorization that is a legal, informed authoriza7 tion concerning the use and disclosure of protected

8 health information with respect to such individual

9 for treatment, payment, and health care operations

10 of such provider.

11 (b) REVOCATION OF AUTHORIZATION.—

12 (1) IN GENERAL.—An individual may revoke an

13 authorization under this section at any time, by

14 sending written notice to the person who obtained

15 such authorization, unless the disclosure that is the

16 subject of the authorization is required to complete

17 a course of treatment, effectuate payment, or con18 duct health care operations for health care that has

19 been provided to the individual.

20 (2) HEALTH PLANS.—With respect to a health

21 plan, the authorization of an individual is deemed to

22 be revoked at the time of the cancellation or non-re23 newal of enrollment in the health plan, except as

24 may be necessary to conduct health care operations
34

•S 881 IS

1 and complete payment requirements related to the

2 individual’s period of enrollment.

3 (3) TERMINATION OF PLAN.—With respect to

4 the revocation of an authorization under this section

5 by an enrollee in a health plan, the health plan may

6 terminate the coverage of such enrollee under such

7 plan if the health plan determines that the revoca8 tion has resulted in the inability of the plan to pro9 vide care for the enrollee or conduct health care op10 erations.

11 (c) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND

12 REVOCATIONS.—Each person who obtains or is required

13 to obtain an authorization under this section shall main14 tain a record for a period of 7 years of each such author15 ization of an individual and revocation thereof.

16 (d) MODEL AUTHORIZATIONS.—The Secretary, after

17 notice and opportunity for public comment, shall develop

18 and disseminate model written authorizations of the type

19 described in subsection (a). The Secretary shall consult

20 with the National Committee on Vital and Health Statis21 tics in developing such authorizations. An authorization

22 obtained on a model authorization form developed by the

23 Secretary pursuant to the preceding sentence shall be

24 deemed to meet the authorization requirements of this sec25 tion.
35

•S 881 IS

1 (e) RULES OF CONSTRUCTION.—

2 (1) SINGLE AUTHORIZATIONS.—An employer or

3 health plan shall be deemed to meet the require4 ments of subsection (a) with respect to a spouse,

5 child, or other eligible dependent if, at the time of

6 enrollment, a single authorization under subsection

7 (a) is obtained from the employee or other individual

8 who accepts responsibility for health plan enroll9 ment.

10 (2) REQUIREMENT FOR SEPARATE AUTHORIZA11 TION.—An authorization for the disclosure of pro12 tected health information for treatment, payment,

13 and health care operations shall not directly or indi14 rectly authorize the disclosure of such information

15 for any other purpose. Any other such disclosures

16 shall require a separate authorization under section

17 203.

18 SEC. 203. AUTHORIZATIONS FOR USE OR DISCLOSURE OF

19 PROTECTED HEALTH INFORMATION OTHER

20 THAN FOR TREATMENT, PAYMENT, AND

21 HEALTH CARE OPERATIONS.

22 (a) IN GENERAL.—An individual who is the subject

23 of protected health information may authorize any person

24 to disclose or use such information for any purpose. An

25 authorization under this section shall not be valid if the
36

•S 881 IS

1 signing of such authorization by the individual is a pre2 requisite for the signing of an authorization under section

3 202.

4 (b) WRITTEN AUTHORIZATIONS.—A person may dis5 close and use protected health information, for purposes

6 other than those authorized under section 202, pursuant

7 to a written authorization signed by the individual who

8 is the subject of the information that meets the require9 ments of section 201(e). An authorization under this sec10 tion shall be separate from any authorization provided

11 under section 202.

12 (c) LIMITATION ON AUTHORIZATIONS.—

13 (1) IN GENERAL.—Notwithstanding any other

14 provision of Federal law, life insurers, and any other

15 entity that offers disability income or long term care

16 insurance under the laws of any State, shall meet

17 the requirements of section 201(a) with respect to

18 an individual for purposes of life, disability income

19 or long term care insurance, by obtaining the au20 thorization of the individual under this section.

21 (2) DURING PERIOD OF COVERAGE.—Notwith22 standing paragraph (1), an authorization obtained in

23 the ordinary course of business in connection with

24 life, disability income or long-term care insurance

25 under this section shall remain in effect during the
37

•S 881 IS

1 term of the individual’s insurance coverage and as

2 may be necessary to enable the issuer to meet its

3 obligations with respect to such individual under the

4 terms of the policy, plan or program.

5 (3) OTHER AUTHORIZATIONS.—An authoriza6 tion obtained from an individual in connection with

7 an application that does not result in coverage with

8 respect to such individual shall expire the earlier of

9 the date specified in the individual’s authorization or

10 the effective date of any revocation under subsection

11 (d).

12 (d) REVOCATION OR AMENDMENT OF AUTHORIZA13 TION.—

14 (1) IN GENERAL.—Except as otherwise pro15 vided for in this section, an individual may revoke or

16 amend an authorization described in this section by

17 providing written notice to the person who obtained

18 such authorization unless the disclosure that is the

19 subject of the authorization is related to the evalua20 tion of an application for life, disability income or

21 long-term care insurance coverage or a claim for life,

22 disability income or long-term care insurance bene23 fits.

24 (2) NOTICE OF REVOCATION.—A person that

25 discloses protected health information pursuant to
38

•S 881 IS

1 an authorization that has been revoked under para2 graph (1) shall not be subject to any liability or pen3 alty under this title if that person had no actual no4 tice of the revocation.

5 (e) DISCLOSURE FOR PURPOSE ONLY.—A recipient

6 of protected health information pursuant to an authoriza7 tion under subsection (b) may disclose such information

8 only to carry out the purposes for which the information

9 was authorized to be disclosed.

10 (f) MODEL AUTHORIZATIONS.—

11 (1) IN GENERAL.—The Secretary, after notice

12 and opportunity for public comment, shall develop

13 and disseminate model written authorizations of the

14 type described in subsection (b). The Secretary shall

15 consult with the National Committee on Vital and

16 Health Statistics in developing such authorizations.

17 (2) AUTHORITY OF INSURANCE COMMIS18 SIONER.—Notwithstanding paragraph (1), the insur19 ance commissioner of the State of domicile of a life

20 insurer may exercise exclusive authority in devel21 oping and disseminating model written authoriza22 tions for purposes of subsection (c).

23 (3) COMPLIANCE WITH REQUIREMENTS.—An

24 authorization obtained using a model authorization

25 promulgated under this subsection shall be deemed
39

•S 881 IS

1 to meet the authorization requirements of this sec2 tion.

3 (g) AUTHORIZATIONS FOR RESEARCH.—This section

4 applies to health research only where such research is not

5 governed by section 208.

6 SEC. 204. NEXT OF KIN AND DIRECTORY INFORMATION.

7 (a) NEXT OF KIN.—A health care provider, or a per8 son who receives protected health information under sec9 tion 205, may disclose protected health information re10 garding an individual to the individual’s spouse, parent,

11 child, sister, brother, next of kin, or to another person

12 whom the individual has identified, if—

13 (1) the individual who is the subject of the

14 information—

15 (A) has been notified of the individual’s

16 right to object to such disclosure and the indi17 vidual has not objected to the disclosure; or

18 (B) is in a physical or mental condition

19 such that the individual is not capable of object20 ing, and there are no prior indications that the

21 individual would object;

22 (2) the information disclosed relates to health

23 care currently being provided to that individual; and
40

•S 881 IS

1 (3) the disclosure of the protected health infor2 mation is consistent with good medical or profes3 sional practice.

4 (b) DIRECTORY INFORMATION.—

5 (1) DISCLOSURE.—

6 (A) IN GENERAL.—Except as provided in

7 paragraph (2), a person described in subsection

8 (a) may disclose the information described in

9 subparagraph (B) to any person if the indi10 vidual who is the subject of the information—

11 (i) has been notified of the individ12 ual’s right to object and the individual has

13 not objected to the disclosure; or

14 (ii) is in a physical or mental condi15 tion such that the individual is not capable

16 of objecting, the individual’s next of kin

17 has not objected, and there are no prior in18 dications that the individual would object.

19 (B) INFORMATION.—Information described

20 in this subparagraph is information that con21 sists only of 1 or more of the following items:

22 (i) The name of the individual who is

23 the subject of the information.

24 (ii) The general health status of the

25 individual, described as critical, poor, fair,
41

•S 881 IS

1 stable, or satisfactory or in terms denoting

2 similar conditions.

3 (iii) The location of the individual on

4 premises controlled by a provider.

5 (2) EXCEPTION.—

6 (A) LOCATION.—Paragraph (1)(B)(iii)

7 shall not apply if disclosure of the location of

8 the individual would reveal specific information

9 about the physical or mental condition of the

10 individual, unless the individual expressly au11 thorizes such disclosure.

12 (B) DIRECTORY OR NEXT OF KIN INFOR13 MATION.—A disclosure may not be made under

14 this section if the health care provider involved

15 has reason to believe that the disclosure of di16 rectory or next of kin information could lead to

17 the physical or mental harm of the individual,

18 unless the individual expressly authorizes such

19 disclosure.

20 SEC. 205. EMERGENCY CIRCUMSTANCES.

21 Any person who creates or receives protected health

22 information under this title may disclose protected health

23 information in emergency circumstances when necessary

24 to protect the health or safety of the individual who is

25 the subject of such information from serious, imminent
42

•S 881 IS

1 harm. No disclosure made in the good faith belief that

2 the disclosure was necessary to protect the health or safety

3 of an individual from serious, imminent harm shall be in

4 violation of, or punishable under, this Act.

5 SEC. 206. OVERSIGHT.

6 (a) IN GENERAL.—Any person may disclose pro7 tected health information to an accrediting body or public

8 health authority, a health oversight agency, or a State in9 surance department, for purposes of an oversight function

10 authorized by law.

11 (b) PROTECTION FROM FURTHER DISCLOSURE.—

12 Protected health information this is disclosed under this

13 section shall not be further disclosed by an accrediting

14 body or public health authority, a health oversight agency,

15 a State insurance department, or their agents for any pur16 pose unrelated to the authorized oversight function. Not17 withstanding any other provision of law, protected health

18 information disclosed under this section shall be protected

19 from further disclosure by an accrediting body or public

20 health authority, a health oversight agency, a State insur21 ance department, or their agents pursuant to a subpoena,

22 discovery request, introduction as evidence, testimony, or

23 otherwise.

24 (c) AUTHORIZATION BY A SUPERVISOR.—For pur25 poses of this section, the individual with authority to au-
43

•S 881 IS

1 thorize the oversight function involved shall provide to the

2 person described in subsection (a) a statement that the

3 protected health information is being sought for a legally

4 authorized oversight function.

5 (d) USE IN ACTION AGAINST INDIVIDUALS.—Pro6 tected health information about an individual that is dis7 closed under this section may not be used by the recipient

8 in, or disclosed by the recipient to any person for use in,

9 an administrative, civil, or criminal action or investigation

10 directed against the individual who is the subject of the

11 protected health information unless the action or inves12 tigation arises out of and is directly related to—

13 (1) the receipt of health care or payment for

14 health care; or

15 (2) a fraudulent claim related to health care, or

16 a fraudulent or material misrepresentation of the

17 health of the individual.

18 SEC. 207. PUBLIC HEALTH.

19 (a) IN GENERAL.—A health care provider, health

20 plan, public health authority, health researcher, employer,

21 life insurer, law enforcement official, school, or university

22 may disclose protected health information to a public

23 health authority or other person authorized by law for use

24 in a legally authorized—

25 (1) disease or injury report;
44

•S 881 IS

1 (2) public health surveillance;

2 (3) public health investigation or intervention;

3 (4) vital statistics report, such as birth or death

4 information;

5 (5) report of abuse or neglect information about

6 any individual; or

7 (6) report of information concerning a commu8 nicable disease status.

9 (b) IDENTIFICATION OF DECEASED INDIVIDUAL.—

10 Any person may disclose protected health information if

11 such disclosure is necessary to assist in the identification

12 or safe handling of a deceased individual.

13 (c) REQUIREMENT TO RELEASE PROTECTED

14 HEALTH INFORMATION TO CORONERS AND MEDICAL EX15 AMINERS.—

16 (1) IN GENERAL.—When a Coroner or a Med17 ical Examiner, or the duly appointed deputy of a

18 Coroner or Medical Examiner, seeks protected health

19 information for the purpose of inquiry into and de20 termination of, the cause, manner, and cir21 cumstances of a death, the health care provider,

22 health plan, health oversight agency, public health

23 authority, employer, life insurer, health researcher,

24 law enforcement official, school, or university in25 volved shall provide the protected health information
45

•S 881 IS

1 to the Coroner or Medical Examiner or to the duly

2 appointed deputy without undue delay.

3 (2) PRODUCTION OF ADDITIONAL INFORMA4 TION.—If a Coroner or Medical Examiner, or the

5 duly appointed deputy of a Coroner or Medical Ex6 aminer, receives health information from a person

7 referred to in paragraph (1), such health informa8 tion shall remain as protected health information

9 unless the health information is attached to or oth10 erwise made a part of a Coroner’s or Medical Exam11 iner’s official report, in which case it shall no longer

12 be protected.

13 (3) EXEMPTION.—Health information attached

14 to or otherwise made a part of a Coroner’s or Med15 ical Examiner’s official report, shall be exempt from

16 the provisions of this Act.

17 SEC. 208. HEALTH RESEARCH.

18 (a) IN GENERAL.—A person lawfully in possession of

19 protected health information may disclose such informa20 tion to a health researcher under any of the following ar21 rangements:

22 (1) RESEARCH GOVERNED BY THE COMMON

23 RULE.—A person identified in subsection (a) may

24 disclose protected health information to a health re25 searcher if the research project has been approved
46

•S 881 IS

1 by an institutional review board pursuant to the re2 quirements of the common rule as implemented by

3 a Federal agency.

4 (2) ANALYSES OF HEALTH CARE RECORDS AND

5 MEDICAL ARCHIVES.—A person identified in sub6 section (a) may disclose protected health information

7 to a health researcher if—

8 (A) consistent with the safeguards estab9 lished pursuant to section 111 and the person’s

10 policies and procedures established under this

11 section, the health research has been reviewed

12 by a board, committee, or other group formally

13 designated by such person to review research

14 programs;

15 (B) the health research involves analysis of

16 protected health information previously created

17 or collected by the person;

18 (C) the person that maintains the pro19 tected health information to be used in the

20 analyses has in place a written policy and pro21 cedure to assure the security and confidentiality

22 of protected health information and to specify

23 permissible and impermissible uses of such in24 formation for health research;
47

•S 881 IS

1 (D) the person that maintains the pro2 tected health information to be used in the

3 analyses enters into a written agreement with

4 the recipient health researcher that specifies the

5 permissible and impermissible uses of the pro6 tected health information and provides notice to

7 the researcher that any misuse or further dis8 closure of the information to other persons is

9 prohibited and may provide a basis for action

10 against the health researcher under this Act;

11 and

12 (E) the person keeps a record of health re13 searchers to whom protected health information

14 has been disclosed.

15 (3) SAFETY AND EFFICACY REPORTS.—A per16 son may disclose protected health information to a

17 manufacturer of a drug, biologic or medical device,

18 in connection with any monitoring activity or reports

19 made to such manufacturer for use in verifying the

20 safety or efficacy of such manufacturer’s approved

21 product in special populations or for long term use.

22 (b) OVERSIGHT.—On the advice of the National Com23 mittee on Vital and Health Statistics, the Secretary shall

24 report to the Congress not later than 18 months after the

25 effective date of this section concerning the adequacy of
48

•S 881 IS

1 the policies and procedures implemented pursuant to sub2 section (a)(2) for protecting the confidentiality of pro3 tected health information while promoting its use in re4 search concerning health care outcomes, the epidemiology

5 and etiology of diseases and conditions and the safety, effi6 cacy and cost effectiveness of health care interventions.

7 Based on the conclusions of such report, the Secretary

8 may promulgate model language for written agreements

9 deemed to comply with subsection (a)(2)(C).

10 (c) STATUTORY ASSURANCE OF CONFIDEN11 TIALITY.—

12 (1) IN GENERAL.—Protected health information

13 obtained by a health researcher pursuant to this sec14 tion shall be used and maintained in confidence, con15 sistent with the confidentiality practices established

16 by the health researcher pursuant to section 111.

17 (2) LIMITATION ON COMPELLED DISCLO18 SURE.—A health researcher may not be compelled in

19 any Federal, State, or local civil, criminal, adminis20 trative, legislative, or other proceeding to disclose

21 protected health information created, maintained or

22 received under this section. Nothing in this para23 graph shall be construed to prevent an audit or law24 ful investigation pursuant to the authority of a Fed25 eral department or agency, of a research project con-
49

•S 881 IS

1 ducted, supported or subject to regulation by such

2 department or agency.

3 (3) LIMITATION ON FURTHER USE OR DISCLO4 SURE.—Notwithstanding any other provision of law,

5 information disclosed by a health researcher to a

6 Federal department or agency under this subsection

7 may not be further used or disclosed by the depart8 ment or agency for a purpose unrelated to the de9 partment’s or agency’s oversight or investigation.

10 SEC. 209. DISCLOSURE IN CIVIL, JUDICIAL, AND ADMINIS11 TRATIVE PROCEDURES.

12 (a) IN GENERAL.—A health care provider, health

13 plan, public health authority, employer, life insurer, law

14 enforcement official, school, or university may disclose

15 protected health information pursuant to a discovery re16 quest or subpoena in a civil action brought in a Federal

17 or State court or a request or subpoena related to a Fed18 eral or State administrative proceeding if such discovery

19 request or subpoena is made through or pursuant to a

20 court order as provided for in subsection (b).

21 (b) COURT ORDERS.—

22 (1) STANDARD FOR ISSUANCE.—In considering

23 a request for a court order regarding the disclosure

24 of protected health information under subsection (a),

25 the court shall issue such order if the court deter-
50

•S 881 IS

1 mines that without the disclosure of such informa2 tion, the person requesting the order would be im3 paired from establishing a claim or defense.

4 (2) REQUIREMENTS.—An order issued under

5 paragraph (1) shall—

6 (A) provide that the protected health infor7 mation involved is subject to court protection;

8 (B) specify to whom the information may

9 be disclosed;

10 (C) specify that such information may not

11 otherwise be disclosed or used; and

12 (D) meet any other requirements that the

13 court determines are needed to protect the con14 fidentiality of the information.

15 (c) APPLICABILITY.—This section shall not apply in

16 a case in which the protected health information sought

17 under such discovery request or subpoena relates to a

18 party to the litigation or an individual whose medical con19 dition is at issue.

20 (d) EFFECT OF SECTION.—This section shall not be

21 construed to supersede any grounds that may apply under

22 Federal or State law for objecting to turning over the pro23 tected health information.
51

•S 881 IS

1 SEC. 210. DISCLOSURE FOR LAW ENFORCEMENT PUR2 POSES.

3 A person who receives protected health information

4 pursuant to sections 202 through 207, may disclose such

5 information to a State or Federal law enforcement agency

6 if such disclosure is pursuant to—

7 (1) a subpoena issued under the authority of a

8 grand jury;

9 (2) an administrative or judicial subpoena or

10 summons;

11 (3) a warrant issued upon a showing of prob12 able cause;

13 (4) a Federal or State law requiring the report14 ing of specific medical information to law enforce15 ment authorities;

16 (5) a written consent or waiver of privilege by

17 an individual allowing access to the individual’s pro18 tected health information; or

19 (6) by other court order.

20 SEC. 211. PAYMENT CARD AND ELECTRONIC PAYMENT

21 TRANSACTION.

22 (a) PAYMENT FOR HEALTH CARE THROUGH CARD

23 OR ELECTRONIC MEANS.—If an individual pays for health

24 care by presenting a debit, credit, or other payment card

25 or account number, or by any other payment means, the

26 person receiving the payment may disclose to a person de-
52

•S 881 IS

1 scribed in subsection (b) only such protected health infor2 mation about the individual as is necessary in connection

3 with activities described in subsection (b), including the

4 processing of the payment transaction or the billing or col5 lection of amounts charged to, debited from, or otherwise

6 paid by, the individual using the card, number, or other

7 means.

8 (b) TRANSACTION PROCESSING.—A person who is a

9 debit, credit, or other payment card issuer, a payment sys10 tem operator, a financial institution participant in a pay11 ment system or is an entity assisting such an issuer, oper12 ator, or participant in connection with activities described

13 in this subsection, may use or disclose protected health

14 information about an individual in connection with—

15 (1) the authorization, settlement, billing, proc16 essing, clearing, transferring, reconciling, or collec17 tion of amounts charged, debited or otherwise paid

18 using a debit, credit, or other payment card or ac19 count number, or by other payment means;

20 (2) the transfer of receivables, accounts, or in21 terest therein;

22 (3) the audit of the debit, credit, or other pay23 ment information;

24 (4) compliance with Federal, State, or local law;
53

•S 881 IS

1 (5) compliance with a properly authorized civil,

2 criminal, or regulatory investigation by Federal,

3 State, or local authorities as governed by the re4 quirements of this section; or

5 (6) fraud protection, risk control, resolving cus6 tomer disputes or inquiries, communicating with the

7 person to whom the information relates, or reporting

8 to consumer reporting agencies.

9 (c) SPECIFIC PROHIBITIONS.—A person described in

10 subsection (b) may not disclose protected health informa11 tion for any purpose that is not described in subsection

12 (b). Notwithstanding any other provision of law, any

13 health care provider, health plan, health oversight agency,

14 health researcher, employer, life insurer, school or univer15 sity who makes a good faith disclosure of protected health

16 information to an entity and for the purposes described

17 in subsection (b) shall not be liable for subsequent disclo18 sures by such entity.

19 (d) SCOPE.—

20 (1) IN GENERAL.—The use of protected health

21 information by a person described in subsection (b)

22 and its agents shall not be considered a disclosure

23 for purposes of this Act, so long as the use involved

24 is consistent with the activities authorized in sub-
54

•S 881 IS

1 section (b) or other purposes for which the informa2 tion was lawfully obtained.

3 (2) REGULATED INSTITUTIONS.—A person who

4 is subject to enforcement pursuant to section 8 of

5 the Federal Deposit Insurance Act or who is a Fed6 eral credit union or State credit union as defined in

7 the Federal Credit Union Act or who is registered

8 pursuant to the Securities and Exchange Act, or

9 who is an entity assisting such a person—

10 (A) shall not be subject to this Act to the

11 extent that such person or entity is described in

12 subsection (b) and to the extent that such per13 son or entity is engaged in activities authorized

14 in that subsection; and

15 (B) shall be subject to enforcement exclu16 sively under section 8 of the Federal Deposit

17 Insurance Act, the Federal Credit Union Act,

18 or the Securities and Exchange Act, as applica19 ble, to the extent that such person or entity is

20 engaged in activities other than those permitted

21 under subsection (b).

22 (3) RULE OF CONSTRUCTION.—Nothing in this

23 subsection shall be construed to exempt entities de24 scribed in paragraph (2) from the prohibition set

25 forth in subsection (c).
55

•S 881 IS

1 SEC. 212. INDIVIDUAL REPRESENTATIVES.

2 (a) IN GENERAL.—Except as provided in subsections

3 (b) and (c), a person who is authorized by law (based on

4 grounds other than the individual being a minor), or by

5 an instrument recognized under law, to act as an agent,

6 attorney, proxy, or other legal representative of a pro7 tected individual, may, to the extent so authorized, exer8 cise and discharge the rights of the individual under this

9 Act.

10 (b) HEALTH CARE POWER OF ATTORNEY.—A person

11 who is authorized by law (based on grounds other than

12 being a minor), or by an instrument recognized under law,

13 to make decisions about the provision of health care to

14 an individual who is incapacitated, may exercise and dis15 charge the rights of the individual under this Act to the

16 extent necessary to effectuate the terms or purposes of

17 the grant of authority.

18 (c) NO COURT DECLARATION.—If a health care pro19 vider determines that an individual, who has not been de20 clared to be legally incompetent, suffers from a medical

21 condition that prevents the individual from acting know22 ingly or effectively on the individual’s own behalf, the right

23 of the individual to authorize disclosure under this Act

24 may be exercised and discharged in the best interest of

25 the individual by—
56

•S 881 IS

1 (1) a person described in subsection (b) with re2 spect to the individual;

3 (2) a person described in subsection (a) with re4 spect to the individual, but only if a person de5 scribed in paragraph (1) cannot be contacted after

6 a reasonable effort;

7 (3) the next of kin of the individual, but only

8 if a person described in paragraph (1) or (2) cannot

9 be contacted after a reasonable effort; or

10 (4) the health care provider, but only if a per11 son described in paragraph (1), (2), or (3) cannot be

12 contacted after a reasonable effort.

13 (d) APPLICATION TO DECEASED INDIVIDUALS.—The

14 provisions of this Act shall continue to prevent disclosure

15 of protected health information concerning a deceased in16 dividual.

17 (e) EXERCISE OF RIGHTS ON BEHALF OF A DE18 CEASED INDIVIDUAL.—

19 (1) IN GENERAL.—A person who is authorized

20 by law or by an instrument recognized under law, to

21 act as an executor of the estate of a deceased indi22 vidual, or otherwise to exercise the rights of the de23 ceased individual, may, to the extent so authorized,

24 exercise and discharge the rights of such deceased

25 individual under this Act for a period of 2 years fol-
57

•S 881 IS

1 lowing the death of such individual. If no such des2 ignee has been authorized, the rights of the deceased

3 individual may be exercised as provided for in sub4 section (c).

5 (2) INSURED INDIVIDUALS.—In the case of an

6 individual who is deceased and who was the insured

7 under an insurance policy or policies, the right to

8 authorize disclosure of protected health information

9 may be exercised by the beneficiary or beneficiaries

10 of such insurance policy or policies.

11 (f) RIGHTS OF MINORS.—The rights of minors under

12 this Act shall be exercised by a parent, the minor or other

13 person as provided under applicable state law.

14 SEC. 213. NO LIABILITY FOR PERMISSIBLE DISCLOSURES.

15 A health care provider, health plan, health oversight

16 agency, health researcher, employer, life insurer, school,

17 or university, or an agent of any such person, that makes

18 a disclosure of protected health information about an indi19 vidual that is permitted by this Act shall not be liable to

20 the individual for such disclosure under common law.

21 SEC. 214. SALE OF BUSINESS, MERGERS, ETC.

22 (a) IN GENERAL.—A health care provider, health

23 plan, health oversight agency, employer, life insurer,

24 school, or university may disclose protected health infor25 mation to a person or persons for purposes of enabling
58

•S 881 IS

1 business decisions to be made about or in connection with

2 the purchase, transfer, merger, or sale of a business or

3 businesses.

4 (b) NO FURTHER USE OR DISCLOSURE.—A person

5 or persons who receive protected health information under

6 this section shall make no further use or disclosure of such

7 information unless otherwise authorized under this Act.

8 TITLE III—SANCTIONS

9 Subtitle A—Criminal Provisions

10 SEC. 301. WRONGFUL DISCLOSURE OF PROTECTED

11 HEALTH INFORMATION.

12 (a) IN GENERAL.—Part I of title 18, United States

13 Code, is amended by adding at the end the following:

14 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE

15 OF PROTECTED HEALTH INFORMATION

16 ‘‘SEC. 2801. Wrongful disclosure of protected health informa17 tion.

18 ‘‘(a) OFFENSE.—The penalties described in sub19 section (b) shall apply to a person that knowingly and

20 intentionally—

21 ‘‘(1) obtains protected health information relat22 ing to an individual from a health care provider,

23 health plan, health oversight agency, public health

24 authority, employer, life insurer, health researcher,

25 law enforcement official, school, or university except
59

•S 881 IS

1 as provided in title II of the Medical Information

2 Protection Act of 1999; or

3 ‘‘(2) discloses protected health information to

4 another person in a manner other than that which

5 is permitted under title II of the Medical Informa6 tion Protection Act of 1999.

7 ‘‘(b) PENALTIES.—A person described in subsection

8 (a) shall—

9 ‘‘(1) be fined not more than $50,000, impris10 oned not more than 1 year, or both;

11 ‘‘(2) if the offense is committed under false pre12 tenses, be fined not more than $100,000, imprisoned

13 not more than 5 years, or both; or

14 ‘‘(3) if the offense is committed with the intent

15 to sell, transfer, or use protected health information

16 for monetary gain or malicious harm, be fined not

17 more than $250,000, imprisoned not more than 10

18 years, or both.

19 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per20 son described in subsection (a), the maximum penalties

21 described in subsection (b) shall be doubled for every sub22 sequent conviction for an offense arising out of a violation

23 or violations related to a set of circumstances that are dif24 ferent from those involved in the previous violation or set

25 of related violations described in such subsection (a).’’.
60

•S 881 IS

1 (b) CLERICAL AMENDMENT.—The table of chapters

2 for part I of title 18, United States Code, is amended by

3 inserting after the item relating to chapter 123 the fol4 lowing new item:

‘‘124. Wrongful disclosure of protected health information ..................... 2801’’.

5 Subtitle B—Civil Sanctions

6 SEC. 311. CIVIL PENALTY VIOLATION.

7 A person who the Secretary, in consultation with the

8 Attorney General, determines has substantially and mate9 rially failed to comply with this Act shall be subject, in

10 addition to any other penalties that may be prescribed by

11 law—

12 (1) in a case in which the violation relates to

13 title I, to a civil penalty of not more than $500 for

14 each such violation, but not to exceed $5,000 in the

15 aggregate for multiple violations arising from the

16 same failure to comply with the Act;

17 (2) in a case in which the violation relates to

18 title II, to a civil penalty of not more than $10,000

19 for each such violation, but not to exceed $50,000

20 in the aggregate for multiple violations arising from

21 the same failure to comply with the Act; or

22 (3) in a case in which the Secretary finds that

23 such violations have occurred with such frequency as

24 to constitute a general business practice, to a civil

25 penalty of not more than $100,000.
61

•S 881 IS

1 SEC. 312. PROCEDURES FOR IMPOSITION OF PENALTIES.

2 (a) INITIATION OF PROCEEDINGS.—

3 (1) IN GENERAL.—The Secretary, in consulta4 tion with the Attorney General, may initiate a pro5 ceeding to determine whether to impose a civil

6 money penalty under section 311. The Secretary

7 may not initiate an action under this section with re8 spect to any violation described in section 311 after

9 the expiration of the 6-year period beginning on the

10 date on which such violation was alleged to have oc11 curred. The Secretary may initiate an action under

12 this section by serving notice of the action in any

13 manner authorized by Rule 4 of the Federal Rules

14 of Civil Procedure.

15 (2) NOTICE AND OPPORTUNITY FOR HEAR16 ING.—The Secretary shall not make a determination

17 adverse to any person under paragraph (1) until the

18 person has been given written notice and an oppor19 tunity for the determination to be made on the

20 record after a hearing at which the person is entitled

21 to be represented by counsel, to present witnesses,

22 and to cross-examine witnesses against the person.

23 (3) SANCTIONS FOR FAILURE TO COMPLY.—

24 The official conducting a hearing under this section

25 may sanction a person, including any party or attor26 ney, for failing to comply with an order or proce-
62

•S 881 IS

1 dure, failing to defend an action, or other mis2 conduct as would interfere with the speedy, orderly,

3 or fair conduct of the hearing. Such sanction shall

4 reasonably relate to the severity and nature of the

5 failure or misconduct. Such sanction may include—

6 (A) in the case of refusal to provide or per7 mit discovery, drawing negative factual infer8 ences or treating such refusal as an admission

9 by deeming the matter, or certain facts, to be

10 established;

11 (B) prohibiting a party from introducing

12 certain evidence or otherwise supporting a par13 ticular claim or defense;

14 (C) striking pleadings, in whole or in part;

15 (D) staying the proceedings;

16 (E) dismissal of the action;

17 (F) entering a default judgment;

18 (G) ordering the party or attorney to pay

19 attorneys’ fees and other costs caused by the

20 failure or misconduct; and

21 (H) refusing to consider any motion or

22 other action which is not filed in a timely man23 ner.
63

•S 881 IS

1 (b) SCOPE OF PENALTY.—In determining the

2 amount or scope of any penalty imposed pursuant to sec3 tion 311, the Secretary shall take into account—

4 (1) the nature of claims and the circumstances

5 under which they were presented;

6 (2) the degree of culpability, history of prior of7 fenses, and financial condition of the person pre8 senting the claims;

9 (3) evidence of good faith endeavor to protect

10 the confidentiality of protected health information;

11 and

12 (4) such other matters as justice may require.

13 (c) REVIEW OF DETERMINATION.—

14 (1) IN GENERAL.—Any person adversely af15 fected by a determination of the Secretary under

16 this section may obtain a review of such determina17 tion in the United States Court of Appeals for the

18 circuit in which the person resides, or in which the

19 claim was presented, by filing in such court (within

20 60 days following the date the person is notified of

21 the determination of the Secretary) a written peti22 tion requesting that the determination be modified

23 or set aside.

24 (2) FILING OF RECORD.—A copy of the petition

25 filed under paragraph (1) shall be forthwith trans-
64

•S 881 IS

1 mitted by the clerk of the court to the Secretary,

2 and thereupon the Secretary shall file in the Court

3 the record in the proceeding as provided in section

4 2112 of title 28, United States Code. Upon such fil5 ing, the court shall have jurisdiction of the pro6 ceeding and of the question determined therein, and

7 shall have the power to make and enter upon the

8 pleadings, testimony, and proceedings set forth in

9 such record a decree affirming, modifying, remand10 ing for further consideration, or setting aside, in

11 whole or in part, the determination of the Secretary

12 and enforcing the same to the extent that such order

13 is affirmed or modified.

14 (3) CONSIDERATION OF OBJECTIONS.—No ob15 jection that has not been raised before the Secretary

16 with respect to a determination described in para17 graph (1) shall be considered by the court, unless

18 the failure or neglect to raise such objection shall be

19 excused because of extraordinary circumstances.

20 (4) FINDINGS.—The findings of the Secretary

21 with respect to questions of fact in an action under

22 this subsection, if supported by substantial evidence

23 on the record considered as a whole, shall be conclu24 sive. If any party shall apply to the court for leave

25 to adduce additional evidence and shall show to the
65

•S 881 IS

1 satisfaction of the court that such additional evi2 dence is material and that there were reasonable

3 grounds for the failure to adduce such evidence in

4 the hearing before the Secretary, the court may

5 order such additional evidence to be taken before the

6 Secretary and to be made a part of the record. The

7 Secretary may modify findings as to the facts, or

8 make new findings, by reason of additional evidence

9 so taken and filed, and shall file with the court such

10 modified or new findings, and such findings with re11 spect to questions of fact, if supported by substan12 tial evidence on the record considered as a whole,

13 and the recommendations of the Secretary, if any,

14 for the modification or setting aside of the original

15 order, shall be conclusive.

16 (5) EXCLUSIVE JURISDICTION.—Upon the filing

17 of the record with the court under paragraph (2),

18 the jurisdiction of the court shall be exclusive and its

19 judgment and decree shall be final, except that the

20 same shall be subject to review by the Supreme

21 Court of the United States, as provided for in sec22 tion 1254 of title 28, United States Code.

23 (d) RECOVERY OF PENALTIES.—

24 (1) IN GENERAL.—Civil money penalties im25 posed under this subtitle may be compromised by
66

•S 881 IS

1 the Secretary and may be recovered in a civil action

2 in the name of the United States brought in United

3 States district court for the district where the claim

4 was presented, or where the claimant resides, as de5 termined by the Secretary. Amounts recovered under

6 this section shall be paid to the Secretary and depos7 ited as miscellaneous receipts of the Treasury of the

8 United States.

9 (2) DEDUCTION FROM AMOUNTS OWING.—The

10 amount of any penalty, when finally determined

11 under this section, or the amount agreed upon in

12 compromise under paragraph (1), may be deducted

13 from any sum then or later owing by the United

14 States or a State to the person against whom the

15 penalty has been assessed.

16 (e) DETERMINATION FINAL.—A determination by

17 the Secretary to impose a penalty under section 311 shall

18 be final upon the expiration of the 60-day period referred

19 to in subsection (c)(1). Matters that were raised or that

20 could have been raised in a hearing before the Secretary

21 or in an appeal pursuant to subsection (c) may not be

22 raised as a defense to a civil action by the United States

23 to collect a penalty under section 311.

24 (f) SUBPOENA AUTHORITY.—
67

•S 881 IS

1 (1) IN GENERAL.—For the purpose of any

2 hearing, investigation, or other proceeding author3 ized or directed under this section, or relative to any

4 other matter within the jurisdiction of the Attorney

5 General hereunder, the Attorney General, acting

6 through the Secretary shall have the power to issue

7 subpoenas requiring the attendance and testimony of

8 witnesses and the production of any evidence that

9 relates to any matter under investigation or in ques10 tion before the Secretary. Such attendance of wit11 nesses and production of evidence at the designated

12 place of such hearing, investigation, or other pro13 ceeding may be required from any place in the

14 United States or in any Territory or possession

15 thereof.

16 (2) SERVICE.—Subpoenas of the Secretary

17 under paragraph (1) shall be served by anyone au18 thorized by the Secretary by delivering a copy there19 of to the individual named therein.

20 (3) PROOF OF SERVICE.—A verified return by

21 the individual serving the subpoena under this sub22 section setting forth the manner of service shall be

23 proof of service.

24 (4) FEES.—Witnesses subpoenaed under this

25 subsection shall be paid the same fees and mileage
68

•S 881 IS

1 as are paid witnesses in the district court of the

2 United States.

3 (5) REFUSAL TO OBEY.—In case of contumacy

4 by, or refusal to obey a subpoenaed duly served

5 upon, any person, any district court of the United

6 States for the judicial district in which such person

7 charged with contumacy or refusal to obey is found

8 or resides or transacts business, upon application by

9 the Secretary, shall have jurisdiction to issue an

10 order requiring such person to appear and give testi11 mony, or to appear and produce evidence, or both.

12 Any failure to obey such order of the court may be

13 punished by the court as contempt thereof.

14 (g) INJUNCTIVE RELIEF.—Whenever the Secretary

15 has reason to believe that any person has engaged, is en16 gaging, or is about to engage in any activity which makes

17 the person subject to a civil monetary penalty under sec18 tion 311, the Secretary may bring an action in an appro19 priate district court of the United States (or, if applicable,

20 a United States court of any territory) to enjoin such ac21 tivity, or to enjoin the person from concealing, removing,

22 encumbering, or disposing of assets which may be required

23 in order to pay a civil monetary penalty if any such pen24 alty were to be imposed or to seek other appropriate relief.
69

•S 881 IS

1 (h) AGENCY.—A principal is liable for penalties

2 under section 311 for the actions of the principal’s agent

3 acting within the scope of the agency.

4 SEC. 313. ENFORCEMENT BY STATE INSURANCE COMMIS5 SIONERS.

6 (a) STATE PENALTIES.—Subject to section 401, and

7 notwithstanding any other provision of this title, the insur8 ance commissioner of the State of residence of an insured

9 under a life, disability income or long-term care insurance

10 policy may exercise exclusive authority to impose any pen11 alties on a life insurer for violations of this Act in connec12 tion with life, disability income or long-term care insur13 ance pursuant to the administrative procedures provided

14 under that State’s insurance laws.

15 (b) FAIL-SAFE FEDERAL AUTHORITY.—In the case

16 of a State that fails to substantially enforce the require17 ments of title I or title II of this Act with respect to life

18 insurers regulated by such State, the provisions of this

19 title shall apply with respect to a life insurer in the same

20 way that they apply to other persons subject to the Act.

21 TITLE IV—MISCELLANEOUS

22 SEC. 401. RELATIONSHIP TO OTHER LAWS.

23 (a) STATE AND FEDERAL LAW.—Except as provided

24 in this section, the provisions of this Act shall preempt

25 any State law that relates to matters covered by this Act.
70

•S 881 IS

1 Nothing in this Act shall be construed to preempt, modify,

2 repeal or affect the interpretation of a provision of Federal

3 or State law that relates to the disclosure of protected

4 health information or any other information about a minor

5 to a parent or guardian of such minor. This Act shall not

6 be construed as repealing, explicitly or implicitly, other

7 Federal laws or regulations relating to protected health

8 information or relating to an individual’s access to pro9 tected health information or health care services.

10 (b) PRIVILEGES.—Nothing in this title shall be con11 strued to preempt or modify any provisions of State statu12 tory or common law to the extent that such law concerns

13 a privilege of a witness or person in a court of that State.

14 This title shall not be construed to supersede or modify

15 any provision of Federal statutory or common law to the

16 extent such law concerns a privilege of a witness or person

17 in a court of the United States. Authorizations pursuant

18 to sections 202 and 203 shall not be construed as a waiver

19 of any such privilege.

20 (c) REPORTS CONCERNING FEDERAL PRIVACY

21 ACT.—Not later than 1 year after the date of enactment

22 of this Act, the head of each Federal agency shall prepare

23 and submit to Congress a report concerning the effect of

24 this Act on each such agency. Such reports shall include
71

•S 881 IS

1 recommendations for legislation to address concerns relat2 ing to the Federal Privacy Act.

3 (d) APPLICATION TO CERTAIN FEDERAL AGEN4 CIES.—

5 (1) DEPARTMENT OF DEFENSE.—

6 (A) EXCEPTIONS.—The Secretary of De7 fense may, by regulation, establish exceptions to

8 the disclosure requirements of this Act to the

9 extent such Secretary determines that disclo10 sure of protected health information relating to

11 members of the armed forces from systems of

12 records operated by the Department of Defense

13 is necessary under circumstances different from

14 those permitted under this Act for the proper

15 conduct of national defense functions by mem16 bers of the armed forces.

17 (B) APPLICATION TO CIVILIAN EMPLOY18 EES.—The Secretary of Defense may, by regu19 lation, establish for civilian employees of the

20 Department of Defense and employees of De21 partment of Defense contractors, limitations on

22 the right of such persons to revoke or amend

23 authorizations for disclosures under section 203

24 when such authorizations were provided by such

25 employees as a condition of employment and
72

•S 881 IS

1 the disclosure is determined necessary by the

2 Secretary of Defense to the proper conduct of

3 national defense functions by such employees.

4 (2) DEPARTMENT OF TRANSPORTATION.—

5 (A) EXCEPTIONS.—The Secretary of

6 Transportation may, with respect to members

7 of the Coast Guard, exercise the same powers

8 as the Secretary of Defense may exercise under

9 paragraph (1)(A).

10 (B) APPLICATION TO CIVILIAN EMPLOY11 EES.—The Secretary of Transportation may,

12 with respect to civilian employees of the Coast

13 Guard and Coast Guard contractors, exercise

14 the same powers as the Secretary of Defense

15 may exercise under paragraph (1)(B).

16 (3) DEPARTMENT OF VETERANS AFFAIRS.—

17 The limitations on use and disclosure of protected

18 health information under this Act shall not be con19 strued to prevent any exchange of such information

20 within and among components of the Department of

21 Veterans Affairs that determine eligibility for or en22 titlement to, or that provide, benefits under laws ad23 ministered by the Secretary of Veteran Affairs.
73

•S 881 IS

1 SEC. 402. CONFORMING AMENDMENT.

2 Section 1171(6) of the Social Security Act (42 U.S.C.

3 1320d(6)) is amended to read as follows:

4 ‘‘(6) INDIVIDUALLY IDENTIFIABLE HEALTH IN5 FORMATION.—The term ‘individually identifiable

6 health information’ has the same meaning given the

7 term ‘protected health information’ by section 4 of

8 the Medical Information Protection Act of 1999.’’.

9 SEC. 403. STUDY BY INSTITUTE OF MEDICINE.

10 Not later than 2 years after the date of enactment

11 of this Act, the National Research Council in conjunction

12 with the Institute of Medicine of the National Academy

13 of Sciences shall conduct a study to examine research

14 issues relating to protected health information, such as the

15 quality and uniformity of institutional review boards and

16 their practices with respect to data management for both

17 researchers and institutional review boards, as well as cur18 rent and proposed protection of health information in rela19 tion to the legitimate needs of law enforcement. The Coun20 cil shall prepare and submit to Congress a report con21 cerning the results of such study.

22 SEC. 405. EFFECTIVE DATE.

23 (a) EFFECTIVE DATE.—Except as provided in sub24 section (b), this Act shall take effect on the date that is

25 12 months after the date on which regulations are promul26 gated as required under subsection (c).
74

•S 881 IS

1 (b) APPLICABILITY.—The provisions of this Act shall

2 only apply to protected health information collected and

3 disclosed 12 months after the date on which regulations

4 are promulgated as required under subsection (c).

5 (c) REGULATIONS.—Not later than 12 months after

6 the date of enactment of this Act, the Secretary shall, in

7 consultation with the National Committee on Vital and

8 Health Statistics, promulgate regulations implementing

9 this Act.

10 (d) EXCEPTION.—If, not later than 18 months after

11 the date of enactment of this Act, the Secretary has not

12 promulgated the regulations required under subsection (c),

13 the effective date for purposes of subsections (a) and (b)

14 shall be the date that is 30 months after the date of enact15 ment of this Act or 12 months after the promulgation of

16 such regulations, whichever is earlier.

Æ