II

Calendar No. 454

103D CONGRESS

2D SESSION S. 2129

To amend title 18, United States Code, to preserve personal privacy with

respect to medical records and health care-related information, and for

other purposes.

IN THE SENATE OF THE UNITED STATES

MAY 18 (legislative day, MAY 16), 1994

Mr. LEAHY (for himself, Mr. RIEGLE, and Mr. WOFFORD) introduced the

following bill; which was read the first time

JUNE 7, 1994

Read the second time and placed on the calendar

A BILL

To amend title 18, United States Code, to preserve personal

privacy with respect to medical records and health carerelated information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Health Care Privacy

5 Protection Act’’.
2

S 2129 PCS

1 SEC. 2. FINDINGS AND PURPOSES.

2 (a) FINDINGS.—The Congress finds as follows:

3 (1) The right to privacy is a personal and fun4 damental right protected by the Constitution of the

5 United States.

6 (2) The improper disclosure of personally iden7 tifiable health care information may cause signifi8 cant harm to a person’s interest in privacy, health

9 care, and reputation and may unfairly affect the

10 ability of a person to obtain employment, education,

11 insurance, and credit.

12 (3) The movement of people and health care-re13 lated information across State lines, availability of

14 access to and exchange of health care-related infor15 mation from automated data banks and networks,

16 and emergence of multistate health care providers

17 and payors create a need for uniform Federal law

18 governing the disclosure of health care information.

19 (b) PURPOSE.—The purpose of this Act is to estab20 lish effective mechanisms to protect the privacy of persons

21 with respect to personally identifiable health care informa22 tion that is created or maintained as part of health treat23 ment, enrollment, payment, or testing processes.
3

S 2129 PCS

1 TITLE I—JUDICIAL

2 PROCEEDINGS

3 SEC. 101. PRIVACY OF PERSONALLY IDENTIFIABLE HEALTH

4 CARE INFORMATION.

5 (a) OFFENSE.—Part I of title 18, United States

6 Code, is amended by inserting after chapter 84, the follow7 ing new chapter:

8 ‘‘CHAPTER 84A—PRIVACY OF PERSON9 ALLY IDENTIFIABLE HEALTH CARE IN10 FORMATION

‘‘Sec.

‘‘1755. Wrongful disclosure of personally identifiable health care information.

‘‘1756. Misuse of health security card or unique identifier.

11 ‘‘§ 1755. Wrongful disclosure of protected health in12 formation

13 ‘‘(a) DEFINITIONS.—

14 ‘‘(1) PROTECTED HEALTH INFORMATION.—The

15 term ‘‘protected health information’’ means any in16 formation, whether oral or recorded in any form or

17 medium, that—

18 ‘‘(A)(i) is created or received by a health

19 care provider, health benefit plan, health over20 sight agency, public health authority, or re21 gional data center; or
4

S 2129 PCS

1 ‘‘(ii) is created or received by an employer

2 through the process of testing or screening ap3 plicants or employees; and

4 ‘‘(B) relates to the past, present, or future

5 physical or mental health or condition of an in6 dividual, the provision of health care to an indi7 vidual or payment for the provision of health to

8 an individual and—

9 ‘‘(i) identifies the individual; or

10 ‘‘(ii) with respect to which there is a

11 reasonable basis to believe that the infor12 mation can be used to identify the individ13 ual.

14 ‘‘(2) HEALTH CARE.—The term ‘health care’—

15 ‘‘(A) means—

16 ‘‘(i) a preventative, diagnostic, thera17 peutic rehabilitative, maintenance, or pal18 liative care, counseling, service, or proce19 dure—

20 ‘‘(I) with respect to the physical

21 or mental condition of an individual;

22 or

23 ‘‘(II) affecting the structure of

24 function of the human body or any

25 part of the human body; or
5

S 2129 PCS

1 ‘‘(ii) any sale or dispensing of a drug,

2 device, equipment, or other item to an indi3 vidual, or for the use of an individual, pur4 suant to a prescription; and

5 ‘‘(B) does not include any item or service

6 that is not furnished for the purpose of examin7 ing, maintaining or improving the health of an

8 individual.

9 ‘‘(b) OFFENSE.—A person who knowingly—

10 ‘‘(1) obtains protected health information relat11 ing to an individual in violation of title II of the

12 Health Care Privacy Protection Act; or

13 ‘‘(2) discloses protected health information to

14 another person in violation of title II of the Health

15 Care Privacy Protection Act,

16 shall be punished as provided in subsection (c).

17 ‘‘(c) PENALTIES.—A person who violates subsection

18 (b) shall—

19 ‘‘(1) be fined not more than $50,000, impris20 oned not more than 1 year, or both;

21 ‘‘(2) if the offense is committed under false pre22 tenses, be fined not more than $100,000, imprisoned

23 not more than 5 years, or both; and

24 ‘‘(3) if the offense is committed with intent to

25 sell, transfer, or use protected health information for
6

S 2129 PCS

1 commercial advantage, personal gain, or malicious

2 harm, fined not more than $250,000, imprisoned not

3 more than 10 years, or both.

4 ‘‘§ 1756. Misuse of health security card or unique

5 identifier

6 ‘‘A person who—

7 ‘‘(1) requires the display of, requires the use of,

8 or uses a health security card that is issued under

9 section 1001(b) of the Health Security Act for any

10 purpose other than a purpose described in section

11 5105(a) of that Act; or

12 ‘‘(2) requires the disclosure of, requires the use

13 of, or uses a unique identifier number provided

14 under section 5104 of that Act for any purpose that

15 is not authorized by the National Health Board pur16 suant to that section,

17 shall be fined not more than $25,000, imprisoned not

18 more than 2 years, or both.’’.

19 (b) TECHNICAL AMENDMENT.—The part analysis for

20 part I of title 18, United States Code, is amended by in21 serting after the item related to chapter 84, the following

22 new item:

‘‘84A. Privacy of personally identifiable health care information ............. 1755.’’.
7

S 2129 PCS

1 TITLE II—LIMITATIONS ON DIS2 CLOSURE OF PROTECTED

3 HEALTH INFORMATION

4 SEC. 201. DEFINITIONS.

5 In this title:

6 (1) HEALTH BENEFIT PLAN.—The term

7 ‘‘health benefit plan’’ means a public or private en8 tity or program that provides payments for health

9 care or that provides life insurance—

10 (A) including—

11 (i) a group health plan (as defined in

12 section 607 of the Employee Retirement

13 Income Security Act of 1974 (29 U.S.C.

14 1167)), employer self-insurance plan, or a

15 multiple employer welfare arrangement (as

16 defined in section 3 of that Act (29 U.S.C.

17 1002)) providing health benefits;

18 (ii) any other health insurance ar19 rangement, including any arrangement

20 consisting of a hospital or medical expense

21 incurred policy or certificate, hospital or

22 medical service plan contract, health main23 tenance organization subscriber contract;

24 and

25 (iii) a life insurance plan;
8

S 2129 PCS

1 (B) but not including—

2 (i) an individual who makes a pay3 ment on the individual’s own behalf (or on

4 behalf of any other individual) for health

5 care or for deductibles, coinsurance,

6 copayments, items, or services not covered

7 under a health insurance arrangement;

8 (ii) a plan sponsor (as defined in sec9 tion 3 of the Employee Retirement Income

10 Security Act of 1974 (29 U.S.C. 1002));

11 (iii) an employer of an employee cov12 ered under a multiple employer welfare ar13 rangement;

14 (iv) an employee organization that

15 sponsors a multiple employer welfare ar16 rangement; or

17 (v) an organization, association, com18 mittee, joint board of trustees, or similar

19 group of representatives of 2 or more em20 ployers described in clause (iii) or 2 or

21 more employee organizations described in

22 clause (iv).

23 (2) HEALTH CARE.—The term ‘‘health care’’—

24 (A) means—
9

S 2129 PCS

1 (i) a preventative, diagnostic, thera2 peutic, rehabilitative, maintenance, or pal3 liative care, counseling, service, or proce4 dure—

5 (I) with respect to the physical or

6 mental condition of an individual; or

7 (II) affecting the structure or

8 function of the human body or any

9 part of the human body; or

10 (ii) any sale or dispensing of a drug,

11 device, equipment, or other item to an indi12 vidual, or for the use of an individual, pur13 suant to a prescription; but

14 (B) does not include any item or service

15 that is not furnished for the purpose of examin16 ing, maintaining, or improving the health of an

17 individual.

18 (3) HEALTH CARE PROVIDER.—The term

19 ‘‘health care provider’’ means a person who is li20 censed, certified, registered, or otherwise authorized

21 by law to provide an item or service that constitutes

22 health care in the ordinary course of business or

23 practice of a profession.

24 (4) HEALTH INFORMATION TRUSTEE.—The

25 term ‘‘health information trustee’’ means—
10

S 2129 PCS

1 (A) a health care provider, health benefit

2 plan, health oversight agency, regional data

3 center, or employer, insofar as it creates, re4 ceives, maintains, uses, or transmits protected

5 health information; and

6 (B) any person who obtains protected

7 health information under section 207, 208, 209,

8 210, 211, 212, or 215.

9 (5) HEALTH OVERSIGHT AGENCY.—The term

10 ‘‘health oversight agency’’ means a person that—

11 (A) performs or oversees the performance

12 of an assessment, evaluation, determination, or

13 investigation relating to the licensing, accredita14 tion, or certification of health care providers; or

15 (B)(i) performs or oversees the perform16 ance of an assessment, evaluation, determina17 tion, or investigation relating to the effective18 ness of, compliance with, or applicability of

19 legal, fiscal, medical, or scientific standards or

20 aspects of performance related to the delivery

21 of, or payment for, health care or relating to

22 health care fraud or fraudulent claims for pay23 ment regarding health; and

24 (ii) is a public agency, acting on behalf of

25 a public agency, acting pursuant to a require-
11

S 2129 PCS

1 ment of a public agency, or carrying out activi2 ties under a Federal or State statute governing

3 the assessment, evaluation, determination, or

4 investigation.

5 (6) HEALTH RESEARCHER.—The term ‘‘health

6 researcher’’ means a person who conducts a bio7 medical, epidemiological, or health services research

8 project or a health statistics project that has been

9 approved by—

10 (A) an institutional review board for the

11 organization sponsoring the project;

12 (B) an institutional review board for each

13 health information trustee that maintains pro14 tected health information intended to be used in

15 the project; or

16 (C) an institutional review board estab17 lished or designated by the Secretary.

18 (7) INSTITUTIONAL REVIEW BOARD.—The term

19 ‘‘institutional review board’’ means—

20 (A) a board established in accordance with

21 regulations of the Secretary under section

22 491(a) of the Public Health Service Act (42

23 U.S.C. 289);
12

S 2129 PCS

1 (B) a similar board established by the Sec2 retary for the protection of human subjects in

3 research conducted by the Secretary; or

4 (C) a similar board established under regu5 lations of a Federal Government authority other

6 than the Secretary.

7 (8) LAW ENFORCEMENT INQUIRY.—The term

8 ‘‘law enforcement inquiry’’ means an investigation or

9 official proceeding inquiring into whether there is a

10 violation of, or failure to comply with, any criminal

11 or civil statute or any regulation, rule, or order is12 sued pursuant to such a statute.

13 (9) PERSON.—The term ‘‘person’’ includes an

14 authority of the United States, a State, or a political

15 subdivision of a State.

16 (10) PROTECTED HEALTH INFORMATION.—The

17 term ‘‘protected health information’’ means any in18 formation, whether oral or recorded in any form or

19 medium, that—

20 (A)(i) is created or received by a health

21 care provider, health benefit plan, health over22 sight agency, public health authority, or re23 gional data center; or
13

S 2129 PCS

1 (ii) is created or received by an employer

2 through the process of testing or screening ap3 plicants or employees; and

4 (B) relates to the past, present, or future

5 physical or mental health or condition of a per6 son, the provision of health care to a person, or

7 payment for the provision of health care to an

8 individual and—

9 (i) identifies the individual; or

10 (ii) with respect to which there is a

11 reasonable basis to believe that the infor12 mation can be used to identify the individ13 ual.

14 (11) PUBLIC HEALTH AUTHORITY.—The term

15 ‘‘public health authority’’ means an authority or in16 strumentality of the United States, a State, or a po17 litical subdivision of a State that is (A) responsible

18 for public health matters; and (B) engaged in such

19 activities as injury reporting, public health surveil20 lance, and public health investigation or interven21 tion.

22 (12) REGIONAL DATE CENTER.—The term ‘‘re23 gional data center’’ means—
14

S 2129 PCS

1 (A) an entity established in accordance

2 with the Health Security Act and designated as

3 such by the Secretary;

4 (B) an entity that receives, maintains,

5 uses, or transmits information regarding health

6 for payment, statistical, or research purposes.

7 (13) SECRETARY.—The term ‘‘Secretary’’

8 means the Secretary of Health and Human Services.

9 (14) STATE.—The term ‘‘State’’ includes the

10 District of Columbia, Puerto Rico, the Virgin Is11 lands, Guam, American Samoa, and the Northern

12 Mariana Islands.

13 SEC. 202. GENERAL LIMITATIONS ON DISCLOSURE.

14 (a) IN GENERAL.—

15 (1) DISCLOSURE WITHIN A TRUSTEE.—A

16 health information trustee may disclose protected

17 health information to an officer, employee, or agent

18 of the trustee only for a purpose that is compatible

19 with and related to the purpose for which the infor20 mation—

21 (A) was collected; or

22 (B) was received by that trustee.

23 (2) DISCLOSURE OUTSIDE A TRUSTEE.—A

24 health information trustee may disclose protected

25 health information to a person other than an officer,
15

S 2129 PCS

1 employee, or agent of the trustee only for a purpose

2 that is authorized under this Act.

3 (3) SCOPE OF DISCLOSURE.—

4 (A) IN GENERAL.—Every disclosure of pro5 tected health information by a health informa6 tion trustee shall be limited to the minimum

7 amount of information necessary to accomplish

8 the purpose for which the information is dis9 closed.

10 (B) GUIDELINES.—Not later than July 1,

11 1996, the Attorney General, in consultation

12 with the Secretary, after notice and opportunity

13 for public comment, shall issue guidelines to im14 plement subparagraph (A), which shall take

15 into account the technical capabilities of the

16 record systems used to maintain protected

17 health information and the costs of limiting dis18 closure.

19 (4) IDENTIFICATION OF DISCLOSED INFORMA20 TION AS PROTECTED INFORMATION.—Except with

21 respect to protected health information that is dis22 closed under section 217, and except as provided in

23 paragraph (5), a health information trustee may not

24 disclose protected health information unless such in-
16

S 2129 PCS

1 formation is clearly identified as protected health in2 formation that is subject to this section.

3 (5) ROUTINE DISCLOSURES SUBJECT TO WRIT4 TEN AGREEMENT.—A health information trustee

5 who routinely discloses protected health information

6 to a person may satisfy the identification require7 ment in paragraph (4) through a written agreement

8 between the trustee and the person with respect to

9 the protected health information.

10 (6) AGREEMENT TO LIMIT DISCLOSURE.—A

11 health information trustee who receives protected

12 health information from any person pursuant to a

13 written agreement to restrict disclosure of the infor14 mation to a greater extent than would otherwise be

15 required under this section shall comply with the

16 terms of the agreement, except in circumstances in

17 which disclosure of the information is required by

18 law notwithstanding the agreement.

19 (7) NO GENERAL REQUIREMENT TO DIS20 CLOSE.—Except as provided in the section 217 re21 lating to inspection, nothing in this section shall be

22 construed to require a health information trustee to

23 disclose protected health information not otherwise

24 required to be disclosed by law.
17

S 2129 PCS

1 (b) DISCLOSURE BY OFFICER, EMPLOYEE, OR

2 AGENT.—No officer, employee, or agent of a health infor3 mation trustee may disclose protected health information,

4 except insofar as the health information trustee is per5 mitted to disclose such information for a purpose that is

6 authorized under this Act.

7 SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO8 TECTED HEALTH INFORMATION.

9 (a) WRITTEN AUTHORIZATIONS.—A health informa10 tion trustee may disclose protected health information

11 pursuant to an authorization executed by the individual

12 who is the subject of the information, if each of the follow13 ing requirements is met:

14 (1) WRITING.—The authorization is in writing,

15 signed by the individual who is the subject of the in16 formation, and dated on the date of such signature.

17 (2) SEPARATE FORM.—The authorization is not

18 on a form used to authorize or facilitate the provi19 sion of, or payment for, health care.

20 (3) TRUSTEE DESCRIBED.—The trustee is spe21 cifically named or generically described in the au22 thorization as authorized to disclose such informa23 tion.

24 (4) RECIPIENT DESCRIBED.—The person to

25 whom the information is to be disclosed is specifi-
18

S 2129 PCS

1 cally named or generically described in the author2 ization as a person to whom such information may

3 be disclosed.

4 (5) STATEMENT OF INTENDED DISCLOSURES.—

5 The authorization contains an acknowledgment that

6 the individual who is the subject of the information

7 has received a statement of the disclosures that the

8 person to receive the protected health information

9 intends to make, which statement shall be in writ10 ing, on a form that is distinct from the authorization

11 for disclosure, and which statement must be received

12 by the individual authorizing the disclosure on or be13 fore such authorization is executed.

14 (6) INFORMATION DESCRIBED.—The informa15 tion to be disclosed is described in the authorization.

16 (7) AUTHORIZATION TIMELY RECEIVED.—The

17 authorization is received by the trustee during a pe18 riod described in subsection (c)(1).

19 (8) DISCLOSURE TIMELY MADE.—The disclo20 sure occurs during a period described in subsection

21 (c)(2).

22 (b) AUTHORIZATIONS REQUESTED IN CONNECTION

23 WITH PROVISION OF HEALTH CARE.—

24 (1) IN GENERAL.—A health information trustee

25 may not request that an individual person provide to
19

S 2129 PCS

1 any other person an authorization described in sub2 section (a) on a day on which—

3 (A) the trustee provides health care to the

4 individual requested to provide the authoriza5 tion; or

6 (B) in the case of a trustee that is a health

7 facility, the individual is admitted into the facil8 ity as a resident or inpatient in order to receive

9 health care.

10 (2) EXCEPTION.—Paragraph (1) does not apply

11 if a health information trustee requests that an indi12 vidual provide an authorization described in sub13 section (a) for the purpose of assisting the individual

14 in obtaining counseling or social services from a per15 son other than the trustee.

16 (c) TIME LIMITATIONS ON AUTHORIZATIONS.—

17 (1) RECEIPT BY TRUSTEE.—For purposes of

18 subsection (a)(7), an authorization is timely received

19 if it is received by the trustee during—

20 (A) the 1-year period beginning on the

21 date on which the authorization is signed under

22 subsection (a)(1), if the authorization permits

23 the disclosure of protected health information to

24 a person who provides health counseling or so25 cial services to individuals; or
20

S 2129 PCS

1 (B) the 30-day period beginning on the

2 date on which the authorization is signed under

3 subsection (a)(1), if the authorization permits

4 the disclosure of protected health information to

5 a person other than a person described in sub6 paragraph (A).

7 (2) DISCLOSURE BY TRUSTEE.—For purposes

8 of subsection (a)(8), a disclosure is timely made if

9 it occurs before—

10 (A) the date or event (if any) specified in

11 the authorization upon which the authorization

12 expires; and

13 (B) the expiration of the 6-month period

14 beginning on the date on which the trustee re15 ceives the authorization.

16 (d) REVOCATION OR AMENDMENT OF AUTHORIZA17 TION.—

18 (1) IN GENERAL.—An individual may in writing

19 revoke or amend an authorization described in sub20 section (a), in whole or in part, at any time, except

21 when—

22 (A) disclosure of protected health informa23 tion has been authorized to permit validation of

24 expenditures for health care; or
21

S 2129 PCS

1 (B) action has been taken in reliance on

2 the authorization.

3 (2) NOTICE OF REVOCATION.—A health infor4 mation trustee who discloses protected health infor5 mation pursuant to an authorization that has been

6 revoked shall not be subject to any liability or pen7 alty under this title if—

8 (A) the reliance was in good faith;

9 (B) the trustee had no notice of the rev10 ocation; and

11 (C) the disclosure was otherwise in accord12 ance with the requirements of this title.

13 (e) MODEL AUTHORIZATIONS.—Not later than July

14 1, 1996, the Attorney General, in consultation with the

15 Secretary, after notice and opportunity for public com16 ment, shall develop and disseminate model written author17 izations of the type described in subsection (a) and model

18 statements of intended disclosures of the type described

19 in paragraph (a)(5).

20 (f) EFFECT OF AUTHORIZATION ON PRIVILEGES.—

21 The execution by an individual of an authorization that

22 meets the requirements of this section for the purpose of

23 receiving health care or providing for the payment for

24 health care shall not be construed to affect any privilege
22

S 2129 PCS

1 that the individual may have under common or statutory

2 law in a court of a State or the United States.

3 (g) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A

4 health information trustee may impose requirements for

5 an authorization that are in addition to the requirements

6 in this subsection.

7 (h) COPY.—A health information trustee who dis8 closes protected health information pursuant to an author9 ization under this section shall maintain a copy of the au10 thorization as part of the information.

11 (i) RULE OF CONSTRUCTION.—This section shall not

12 be construed—

13 (1) to require a health information trustee to

14 disclose protected health information; or

15 (2) to limit the right of a health information

16 trustee to charge a fee for the disclosure or repro17 duction of protected health information.

18 (j) SUBPOENAS.—If a health information trustee dis19 closes protected health information pursuant to an author20 ization in order to comply with a subpoena, the authoriza21 tion—

22 (1) shall specifically authorize the disclosure for

23 the purpose of permitting the trustee to comply with

24 the subpoena; and
23

S 2129 PCS

1 (2) shall otherwise meet the requirements in

2 this subsection.

3 SEC. 204. TREATMENT AND PAYMENT.

4 (a) IN GENERAL.—(1) A health care provider, health

5 benefit plan, employer, or person that receives protected

6 health information under section 208 may disclose pro7 tected health information to a health care provider for the

8 purpose of providing health care to an individual and the

9 individual who is the subject of the information has not

10 previously objected to the disclosure in writing.

11 (2) A health care provider, health benefit plan, em12 ployer, regional data center or person that receives pro13 tected health information under section 208 may disclose

14 protected health information to a health benefit plan for

15 the purpose of providing for the payment for health care

16 furnished to an individual.

17 (3) A health care provider, or health benefit plan or

18 person that receives protected health information under

19 section 208 may disclose protected health information to

20 a regional data center for the purpose of carrying out its

21 functions.

22 (b) SCOPE OF DISCLOSURE.—The disclosure of pro23 tected health information under this section shall be lim24 ited to the minimum amount necessary to accomplish the

25 purpose for which the disclosure is authorized.
24

S 2129 PCS

1 SEC. 205. OVERSIGHT.

2 (a) IN GENERAL.—A health information trustee may

3 disclose protected health information to a health oversight

4 agency for a purpose authorized by law.

5 (b) SCOPE OF DISCLOSURE.—The disclosure of pro6 tected health information under this section shall be lim7 ited to the minimum amount necessary to accomplish the

8 purpose for which the disclosure is authorized.

9 (c) USE IN ACTION AGAINST INDIVIDUALS.—Pro10 tected health information about an individual that is dis11 closed under this section may not be used in, or disclosed

12 to any person for use in, any administrative, civil, or crimi13 nal action or investigation directed against the individual

14 who is the subject of the information, except in an action

15 or investigation arising out of and directly related to re16 ceipt of health care or payment for health care or an ac17 tion involving a fraudulent claim related to health.

18 SEC. 206. NEXT OF KIN AND DIRECTORY INFORMATION.

19 (a) NEXT OF KIN.—A health care provider or person

20 that receives protected health information under section

21 208 may disclose protected health information to the next

22 of kin or legal representative (as defined under State law)

23 of the individual who is the subject of the information or

24 to an individual with whom that individual has a personal

25 relationship if—
25

S 2129 PCS

1 (1) the individual who is the subject of the in2 formation has not previously objected to the disclo3 sure after being notified of the right to object; and

4 (2) the information disclosed relates to health

5 care currently being provided to that individual.

6 (b) DIRECTORY INFORMATION.—A health care pro7 vider and a person receiving protected health information

8 under section 208 may disclose information to any person

9 if—

10 (1) the information does not reveal specific in11 formation about the physical or mental condition of

12 the individual who is the subject of the information

13 or health care provided to that person;

14 (2) the individual who is the subject of the in15 formation has not objected in writing to the disclo16 sure after being notified of the right to object; and

17 (3) the information consists only of 1 or more

18 of the following items:

19 (A) The name of the individual who is the

20 subject of the information.

21 (B) If the individual who is the subject of

22 the information is receiving health care from a

23 health care provider on a premises controlled by

24 the provider—
26

S 2129 PCS

1 (i) the location of the individual on

2 the premises; and

3 (ii) the general health status of the in4 dividual, described as critical, poor, fair,

5 stable, or satisfactory or in terms denoting

6 similar conditions.

7 (c) IDENTIFICATION OF DEAD PERSON.—A health

8 information trustee may disclose protected health informa9 tion if necessary to assist in the identification of a dead

10 person.

11 SEC. 207. PUBLIC HEALTH.

12 (a) IN GENERAL.—A health care provider, health

13 benefit plan, public health authority, employer, or person

14 that receives protected health information under section

15 208 may disclose protected health information to a public

16 health authority or other person authorized by law for use

17 in legally authorized—

18 (1) disease or injury reporting;

19 (2) public health surveillance; or

20 (3) public health investigation or intervention.

21 (b) SCOPE OF DISCLOSURE.—The disclosure of pro22 tected health information under this section shall be lim23 ited to the minimum amount necessary to accomplish the

24 purpose for which the disclosure is authorized.
27

S 2129 PCS

1 SEC. 208. EMERGENCY CIRCUMSTANCES.

2 (a) IN GENERAL.—A health care provider, health

3 benefit plan, employer, or person that receives protected

4 health information under section 208 may disclose pro5 tected health information in emergency circumstances

6 when necessary to protect the health or safety of an indi7 vidual from imminent harm.

8 (b) SCOPE OF DISCLOSURE.—The disclosure of pro9 tected health information under this section shall be lim10 ited to the minimum amount necessary to accomplish the

11 purpose for which the disclosure is authorized and shall

12 be limited to persons who need the information to protect

13 the health or safety of the individual.

14 (c) USE IN ACTION AGAINST INDIVIDUAL.—Pro15 tected health information about an individual that is dis16 closed under this section may not be used in, or disclosed

17 to any person for use in, any administrative, civil, or crimi18 nal action or investigation directed against the individual

19 except when the use or disclosure is authorized by law for

20 protection of the public health.

21 SEC. 209. JUDICIAL AND ADMINISTRATIVE PURPOSES.

22 (a) IN GENERAL.—A health care provider, health

23 benefit plan, health oversight agency, employer, and per24 son that receives protected health information under sec25 tion 208 may disclose protected health information—
28

S 2129 PCS

1 (1) pursuant to the Federal Rules of Civil Pro2 cedure, the Federal Rules of Criminal Procedure, or

3 comparable rules of other courts or administrative

4 agencies in connection with litigation or proceedings

5 to which the individual who is the subject of the in6 formation is a party and in which the individual has

7 placed the individual’s physical or mental condition

8 in issue;

9 (2) if ordered by a court in connection with an

10 examination of an individual; or

11 (3) pursuant to a law requiring the reporting of

12 specific medical information to law enforcement au13 thorities.

14 (b) SCOPE OF DISCLOSURE.—The disclosure of pro15 tected health information under this section shall be lim16 ited to the minimum amount necessary to accomplish the

17 purpose for which the disclosure is authorized.

18 (c) LIMIT ON ADDITIONAL DISCLOSURE.—A person

19 that receives protected health information under this sec20 tion may use the information and disclose such informa21 tion only for the purpose for which it was received.

22 SEC. 210. HEALTH RESEARCH.

23 (a) IN GENERAL.—A health information trustee may

24 disclose protected health information to a health re25 searcher if the disclosure is for use in a health research
29

S 2129 PCS

1 project that has been determined by an institutional re2 view board to be—

3 (1) of sufficient importance to outweigh the in4 trusion into the privacy of the individual who is the

5 subject of the information that would result from the

6 disclosure; and

7 (2) necessary for the effectiveness of the

8 project.

9 (b) OBLIGATIONS OF RECIPIENT.—A person who re10 ceives protected health information pursuant to subsection

11 (a)—

12 (1) shall remove or destroy, at the earliest op13 portunity consistent with the purposes of the project,

14 information that would enable an individual to be

15 identified, unless—

16 (A) an institutional review board has de17 termined that there is a health or research jus18 tification for retention of such identifiers; and

19 (B) there is an adequate plan to protect

20 the identifiers from disclosure that is inconsist21 ent with this section.

22 (2) shall use protected health information solely

23 for purposes of the health research project for which

24 disclosure was authorized under this section.
30

S 2129 PCS

1 (c) SCOPE OF DISCLOSURE.—The disclosure of pro2 tected health information under this section shall be lim3 ited to the minimum amount necessary to accomplish the

4 research purpose for which the disclosure is authorized.

5 (d) RESEARCH REQUIRING DIRECT CONTACT.—Pro6 tected health information may not be disclosed to a health

7 researcher for a research project that includes direct con8 tact with an individual who is the subject of protected

9 health information unless the individual who is the subject

10 of the protected health information has been given notice

11 by the health information trustee that such contact is pos12 sible and been given the opportunity to object to the dis13 closure and the individual has not objected.

14 SEC. 211. LAW ENFORCEMENT.

15 (a) IN GENERAL.—A health care provider, health

16 benefit plan, health oversight agency, health researcher,

17 employer, or other person that receives protected health

18 information under section 208 may disclose protected

19 health information to a law enforcement agency (other

20 than a health oversight agency governed by section 205)

21 if the information is requested for use—

22 (1) in an investigation or prosecution of a

23 health information trustee;
31

S 2129 PCS

1 (2) in the identification or location of a victim,

2 suspect, fugitive, or witness in a law enforcement in3 quiry; or

4 (3) in connection with the investigation of

5 criminal activity committed against the trustee or on

6 premises controlled by the trustee.

7 (b) CERTIFICATION.—When a law enforcement agen8 cy (other than a health oversight agency) requests a health

9 information trustee disclose protected health information

10 under this subsection, the law enforcement agency shall

11 provide the trustee with a written certification that—

12 (1) specifies the information requested;

13 (2) states that the information is needed for a

14 lawful purpose under this section; and

15 (3) is signed by a supervisory official of a rank

16 designated by the head of the agency.

17 (c) SCOPE OF DISCLOSURE.—The disclosure of pro18 tected health information under this section shall be lim19 ited to the minimum amount necessary to accomplish the

20 purpose for which the disclosure is authorized.

21 (d) RESTRICTIONS ON ADDITIONAL DISCLOSURE.—

22 Protected health information about an individual that is

23 disclosed to a law enforcement agency under this section—

24 (1) may not be disclosed for, or used in, any

25 administrative, civil, or criminal action or investiga-
32

S 2129 PCS

1 tion against the individual, except in an action or in2 vestigation arising out of and directly related to the

3 action or investigation for which the information was

4 obtained; and

5 (2) may not be otherwise used or disclosed by

6 the law enforcement agency, unless the use or disclo7 sure is necessary to fulfill the purpose for which the

8 information was obtained and is not otherwise pro9 hibited by law.

10 SEC. 212. SUBPOENAS AND WARRANTS.

11 (a) IN GENERAL.—A health care provider, health

12 benefit plan, health oversight agency, employer, or person

13 that receives protected health information under section

14 208 may disclose protected health information under this

15 section if the disclosure is pursuant to—

16 (1) a subpoena issued under the authority of a

17 grand jury, and the trustee is provided a written cer18 tification by the grand jury seeking the information

19 that the grand jury has complied with the applicable

20 access provisions of section 213;

21 (2) an administrative subpoena or a judicial

22 subpoena or warrant, and the trustee is provided a

23 written certification by the person seeking the infor24 mation that the person has complied with the appli25 cable access provisions of section 213 or 214; or
33

S 2129 PCS

1 (3) an administrative subpoena or a judicial

2 subpoena or warrant, and the disclosure otherwise

3 meets the conditions of section 205, 207, 208, 209,

4 or 211.

5 (b) RESTRICTIONS ON ADDITIONAL DISCLOSURE.—

6 Protected health information about an individual that is

7 received under—

8 (1) subsection (a) may not be disclosed for, or

9 used in, any administrative, civil, or criminal action

10 or investigation against the individual, except in an

11 action or investigation arising out of and directly re12 lated to the inquiry for which the information was

13 obtained;

14 (2) subsection (a)(2) may not be otherwise dis15 closed by the recipient unless the disclosure is nec16 essary to fulfill the purpose for which the informa17 tion was obtained; and

18 (3) subsection (a)(3) may not be disclosed by

19 the recipient unless the recipient complies with the

20 conditions and restrictions on disclosure with which

21 the recipient would have been required to comply if

22 the disclosure had been made under section 205,

23 207, 208, 209, or 211.
34

S 2129 PCS

1 SEC. 213. ACCESS PROCEDURES FOR LAW ENFORCEMENT

2 SUBPOENAS AND WARRANTS.

3 (a) PROBABLE CAUSE REQUIREMENT.—A govern4 ment authority may not obtain protected health informa5 tion about a person under section 212(a) (1) or (2) for

6 use in a law enforcement inquiry unless there is probable

7 cause to believe that the information is relevant to a legiti8 mate law enforcement inquiry being conducted by the gov9 ernment authority.

10 (b) WARRANTS.—A government authority that ob11 tains protected health information about an individual

12 under circumstances described in subsection (a) and pur13 suant to a warrant shall, not later than 30 days after the

14 date the warrant was executed, serve the individual with,

15 or mail to the last known address of the individual, a no16 tice that protected health information about the individual

17 was so obtained.

18 (c) SUBPOENAS.—Except as provided in subsection

19 (d), a government authority may not obtain protected

20 health information about an individual under cir21 cumstances described in subsection (a) and pursuant to

22 a subpoena unless a copy of the subpoena has been served

23 on the individual on or before the date of return of the

24 subpoena, together with a notice of the individual’s right

25 to challenge the subpoena in accordance with section 214,

26 and—
35

S 2129 PCS

1 (1) 30 days have passed from the date of serv2 ice on the individual and within that time period the

3 individual has not initiated a challenge in accordance

4 with section 214; or

5 (2) disclosure is ordered by a court after chal6 lenge under section 214.

7 (d) APPLICATION FOR DELAY.—

8 (1) IN GENERAL.—A government authority may

9 apply ex parte and under seal to an appropriate

10 court to delay (for an initial period of not longer

11 than 90 days) serving a copy of a subpoena or notice

12 required under subsection (b) or (c) with respect to

13 a law enforcement inquiry. The government author14 ity may apply to the court for extensions of the

15 delay.

16 (2) REASONS FOR DELAY.—An application for

17 a delay, or extension of a delay, under this sub18 section shall state, with reasonable specificity, the

19 reasons why the delay or extension is being sought.

20 (3) EX PARTE ORDER.—The court shall enter

21 an ex parte order delaying, or extending the delay

22 of, notice and an order prohibiting the disclosure of

23 the request for or disclosure of the protected health

24 information and an order requiring the disclosure of
36

S 2129 PCS

1 the protected health information if the court finds

2 that—

3 (A) the inquiry being conducted is within

4 the lawful jurisdiction of the government au5 thority seeking the protected health informa6 tion;

7 (B) there is probable cause to believe that

8 the protected health information being sought is

9 relevant to a legitimate law enforcement in10 quiry;

11 (C) the government authority’s need for

12 the information outweighs the privacy interest

13 of the individual who is the subject of the infor14 mation; and

15 (D) there is reasonable ground to believe

16 that receipt of notice by the individual will re17 sult in—

18 (i) endangering the life or physical

19 safety of any individual;

20 (ii) flight from prosecution;

21 (iii) destruction of or tampering with

22 evidence or the information being sought;

23 or

24 (iv) intimidation of potential wit25 nesses.
37

S 2129 PCS

1 SEC. 214. CHALLENGE PROCEDURES FOR LAW ENFORCE2 MENT SUBPOENAS.

3 (a) MOTION TO QUASH SUBPOENA.—Within 30 days

4 after the date of service of a subpoena of a government

5 authority seeking protected health information about an

6 individual under section 212(a) (1) or (2), or notice that

7 protected health information has been obtained by a gov8 ernment authority, the individual may file a motion to

9 quash the subpoena—

10 (1) in the case of a State judicial subpoena, in

11 the court which issued the subpoena;

12 (2) in the case of a subpoena issued under the

13 authority of a State that is not a State judicial sub14 poena, in a court of competent jurisdiction;

15 (3) in the case of a subpoena issued under the

16 authority of a Federal court, in the United States

17 district court for the district in which the movant re18 sides or in which the subpoena was issued; or

19 (4) in the case of any other subpoena issued

20 under the authority of the United States, in the

21 United States district court for the district in which

22 the movant resides or in which the subpoena was is23 sued.

24 (b) COPY.—A copy of the motion shall be served by

25 the movant upon the government authority by registered

26 or certified mail.
38

S 2129 PCS

1 (c) PROCEEDINGS.—The government authority may

2 file with the court such papers, including affidavits and

3 other sworn documents, as sustain the validity of the sub4 poena. The movant may file with the court reply papers

5 in response to the authority’s filing. The court, upon the

6 request of the movant or the government authority or

7 both, may proceed in camera. The court may conduct such

8 proceedings as it deems appropriate to rule on the motion,

9 but shall endeavor to expedite its determination.

10 (d) STANDARD FOR DECISION.—A court may deny

11 a motion under subsection (a) if it finds there is probable

12 cause to believe the protected health information being

13 sought is relevant to a legitimate law enforcement inquiry

14 being conducted by the government authority, unless the

15 court finds the movant’s privacy interest outweighs the

16 government authority’s need for the information. The

17 movant shall have the burden of demonstrating that the

18 individual’s privacy interest outweighs the need estab19 lished by the government authority for the information.

20 (e) SPECIFIC CONSIDERATIONS WITH RESPECT TO

21 PRIVACY INTEREST.—In reaching its determination, the

22 court shall consider—

23 (1) the particular purpose for which the infor24 mation was collected;
39

S 2129 PCS

1 (2) the degree to which disclosure of the infor2 mation will embarrass, injure, or invade the privacy

3 of the movant;

4 (3) the effect of the disclosure on the movant’s

5 future health care;

6 (4) the importance of the inquiry being con7 ducted by the government authority, and the impor8 tance of the information to that inquiry; and

9 (5) any other factor deemed relevant by the

10 court.

11 (f) ATTORNEY’S FEES.—In the case of a motion

12 brought under subsection (a) in which the movant sub13 stantially prevails, the court may assess against the gov14 ernment authority a reasonable attorney’s fee and other

15 litigation costs (including expert fees) reasonably incurred.

16 (g) NO INTERLOCUTORY APPEAL.—A ruling denying

17 a motion to quash under this section shall not be deemed

18 to be a final order, and no interlocutory appeal may be

19 taken therefrom by the movant. An appeal of such a ruling

20 may be taken by the movant within such period of time

21 as is provided by law as part of any appeal from a final

22 order in any legal proceeding initiated against the movant

23 arising out of or based upon the protected health informa24 tion disclosed.
40

S 2129 PCS

1 SEC. 215. ACCESS AND CHALLENGE PROCEDURES FOR SUB2 POENAS OTHER THAN LAW ENFORCEMENT

3 SUBPOENAS.

4 (a) IN GENERAL.—A private party may not obtain

5 protected health information from a health care provider,

6 health benefit plan, employer, or person that receives pro7 tected health information under section 208 pursuant to

8 a subpoena unless—

9 (1) a copy of the subpoena together with a no10 tice of the individual’s right to challenge the sub11 poena by filing a motion to quash under subsection

12 (b), has been served upon the individual identified

13 by the information on or before the date on which

14 the subpoena was served; and

15 (2)(A) 30 days have passed since the date of

16 service, and within that time period the individual

17 has not filed a motion under subsection (b); or

18 (B) disclosure is ordered by a court under that

19 subsection.

20 (b) MOTION TO QUASH.—Within 30 days after serv21 ice of a subpoena seeking protected health information

22 under subsection (a), the individual identified by the infor23 mation may file in any court of competent jurisdiction a

24 motion to quash the subpoena, with a copy served on the

25 person seeking the information. The individual may op26 pose or seek to limit the subpoena on any ground that
41

S 2129 PCS

1 would be available if the individual were in sole possession

2 of the information, including privacy and relevance.

3 (c) STANDARD FOR DECISION.—The court shall

4 grant a motion under subsection (b) unless the respondent

5 demonstrates that—

6 (1) there is reasonable ground to believe the in7 formation is relevant to a lawsuit or other judicial

8 or administrative proceeding; and

9 (2) the need of the respondent for the informa10 tion outweighs the privacy interest of the movant.

11 (d) SPECIFIC CONSIDERATIONS WITH RESPECT TO

12 PRIVACY INTEREST.—In determining under subsection (c)

13 whether the need of the respondent for the information

14 outweighs the privacy of the movant, the court shall con15 sider—

16 (1) the particular purpose for which the infor17 mation was collected;

18 (2) the degree to which disclosure of the infor19 mation would embarrass, injure, or invade the pri20 vacy of the movant;

21 (3) the effect of the disclosure on the movant’s

22 future health care;

23 (4) the importance of the information to the

24 lawsuit or proceeding; and

25 (5) any other relevant factor.
42

S 2129 PCS

1 (e) ATTORNEY’S FEES.—In the case of a motion

2 brought under subsection (b) in which the movant has

3 substantially prevailed, the court may assess against the

4 respondent a reasonable attorney’s fee and other litigation

5 costs and expenses (including expert’s fees) reasonably in6 curred.

7 SEC. 216. SECURITY.

8 (a) IN GENERAL.—A health information trustee shall

9 maintain reasonable and appropriate administrative, tech10 nical, and physical safeguards—

11 (1) to ensure the integrity and confidentiality of

12 protected health information created or received by

13 the trustee; and

14 (2) to protect against any anticipated threats or

15 hazards to the security or integrity of such informa16 tion.

17 (b) SPECIFIC SECURITY MEASURES.—The security

18 measures adopted by a health information trustee shall in19 clude the following:

20 (1) Officers, employees, and agents of the trust21 ee who have access to protected health information

22 created by the trustee shall be regularly trained in

23 the requirements governing such information.

24 (2) Complete, accurate, and readily available

25 records shall be maintained, if the maintenance of
43

S 2129 PCS

1 such records is practicable, taking into account the

2 technical capabilities of the system used to maintain

3 protected health information and the costs of such

4 maintenance.

5 (3) Appropriate signs and warnings shall be

6 posted to advise of the need to secure protected

7 health information.

8 (c) REGULATIONS.—The Secretary, in consultation

9 with the Attorney General, shall promulgate regulations

10 regarding security measures for protected health informa11 tion.

12 SEC. 217. INSPECTION OF PROTECTED HEALTH INFORMA13 TION.

14 (a) INSPECTION OF PROTECTED HEALTH INFORMA15 TION.—

16 (1) IN GENERAL.—Except as provided in para17 graph (2), a health care provider or health benefit

18 plan—

19 (A) shall permit an individual who is the

20 subject of protected health information to in21 spect any such information that the provider or

22 plan maintains;

23 (B) shall permit the individual to have a

24 copy of the information;
44

S 2129 PCS

1 (C) shall permit a person who has been

2 designated in writing by the individual who is

3 the subject of the information to inspect, or to

4 have a copy of, the information on behalf of the

5 individual or to accompany the individual dur6 ing the inspection; and

7 (D) may offer to explain or interpret infor8 mation that is inspected or copied under this

9 subsection.

10 (2) EXCEPTIONS.—A health care provider or

11 health benefit plan is not required by this section to

12 permit inspection or copying of protected health in13 formation if any of the following conditions apply:

14 (A) MENTAL HEALTH TREATMENT

15 NOTES.—The information consists of psy16 chiatric, psychological, or mental health treat17 ment notes, and the provider or plan deter18 mines, based on reasonable medical judgment,

19 that inspection or copying of the notes would

20 cause sufficient harm to the individual who is

21 the subject of the notes so as to outweigh the

22 desirability of permitting access, and the pro23 vider or plan has not disclosed the notes to any

24 person not directly engaged in treating the indi-
45

S 2129 PCS

1 vidual, except with the authorization of the in2 dividual or under compulsion of law.

3 (B) INFORMATION ABOUT OTHERS.—The

4 information relates to an individual other than

5 the individual seeking to inspect or have a copy

6 of the information and the provider or plan de7 termines, based on reasonable medical judg8 ment, that inspection or copying of the informa9 tion would cause sufficient harm to 1 or both

10 of the individuals so as to outweigh the desir11 ability of permitting access.

12 (C) ENDANGERMENT TO LIFE OR SAFE13 TY.—The provider or plan determines that dis14 closure of the information could reasonably be

15 expected to endanger the life or physical safety

16 of any individual.

17 (D) CONFIDENTIAL SOURCE.—The infor18 mation identifies or could reasonably lead to the

19 identification of a person (other than a health

20 care provider) who provided information under

21 a promise of confidentiality to a health care

22 provider concerning the individual who is the

23 subject of the information.

24 (E) ADMINISTRATIVE PURPOSES.—The in25 formation—
46

S 2129 PCS

1 (i) is used by the provider or plan

2 solely for administrative purposes and not

3 in the provision of health care to the indi4 vidual who is the subject of the informa5 tion; and

6 (ii) has not been disclosed by the pro7 vider or plan to any other person.

8 (3) INSPECTION AND COPYING OF SEGREGABLE

9 PORTION.—A health care provider or health benefit

10 plan shall permit inspection and copying under para11 graph (1) of any reasonably segregable portion of a

12 record after deletion of any portion that is exempt

13 under paragraph (2).

14 (4) CONDITIONS.—A health care provider or

15 health benefit plan may—

16 (A) require a written request for the in17 spection and copying of protected health infor18 mation under this subsection; and

19 (B) charge a reasonable fee (not greater

20 than the actual cost) for—

21 (i) permitting inspection of informa22 tion under this subsection; and

23 (ii) providing a copy of protected

24 health information under this subsection.
47

S 2129 PCS

1 (5) STATEMENT OF REASONS FOR DENIAL.—If

2 a health care provider or health benefit plan denies

3 a request for inspection or copying under this sub4 section, the provider or plan shall provide the indi5 vidual who made the request (or the individual’s des6 ignated representative) with a written statement of

7 the reasons for the denial.

8 (6) DEADLINE.—A health care provider or

9 health benefit plan shall comply with or deny a re10 quest for inspection or copying of protected health

11 information under this subsection within the 30-day

12 period beginning on the date on which the provider

13 or plan receives the request.

14 SEC. 218. AMENDMENT OF PROTECTED HEALTH INFORMA15 TION.

16 (a) IN GENERAL.—A health care provider or health

17 benefit plan that is required to comply with this subsection

18 shall, within the 45-day period beginning on the date on

19 which the provider or plan receives from an individual a

20 written request that the provider or plan correct or amend

21 the information—

22 (1) make the correction or amendment re23 quested;

24 (2) inform the individual of the correction or

25 amendment that has been made;
48

S 2129 PCS

1 (3) inform any regional data center to which

2 the uncorrected or unamended portion of the infor3 mation was previously disclosed, of the correction or

4 amendment;

5 (4) inform any person who is identified by the

6 individual, who is not an officer, employee or agent,

7 of the provider or plan, and to whom the uncor8 rected or unamended portion of the information was

9 previously disclosed, of the correction or amendment

10 that has been made.

11 (b) REFUSAL TO CORRECT.—If the provider or plan

12 refuses to make the corrections, the provider or plan shall

13 inform the individual of—

14 (1) the reasons for the refusal of the provider

15 or plan to make the correction or amendment;

16 (2) any procedures for further review of the re17 fusal; and

18 (3) the individual’s right to file with the pro19 vider or plan a concise statement setting forth the

20 requested correction or amendment and the individ21 ual’s reasons for disagreeing with the refusal of the

22 provider or plan.

23 (c) BASES FOR REQUEST TO CORRECT OR AMEND.—

24 An individual may request correction or amendment of

25 protected health information about the individual under
49

S 2129 PCS

1 paragraph (d) if the information is not timely, accurate,

2 relevant to the system of records, or complete.

3 (d) STATEMENT OF DISAGREEMENT.—After an indi4 vidual has filed a statement of disagreement under para5 graph (b)(3), the provider or plan, in any subsequent dis6 closure of the disputed portion of the information—

7 (1) shall include a copy of the individual’s

8 statement; and

9 (2) may include a concise statement of the rea10 sons of the provider or plan for not making the re11 quested correction or amendment.

12 (e) RULE OF CONSTRUCTION.—This subsection shall

13 not be construed to require a health care provider or

14 health benefit plan to conduct a formal, informal, or other

15 hearing or proceeding concerning a request for a correc16 tion or amendment to protected health information the

17 provider or plan maintains.

18 (f) CORRECTION.—For purposes of paragraph (2), a

19 correction is deemed to have been made to protected

20 health information when information that is not timely,

21 accurate, relevant to the system of records, or complete

22 is clearly marked as incorrect or when supplementary cor23 rect information is made part of the information.

24 (g) NOTICE OF INFORMATION PRACTICES.—
50

S 2129 PCS

1 (1) PREPARATION OF WRITTEN NOTICE.—A

2 health care provider or health benefit plan shall pre3 pare a written notice of information practices de4 scribing the following:

5 (A) PERSONAL RIGHTS OF AN INDIVID6 UAL.—The rights under this section of an indi7 vidual who is the subject of protected health in8 formation, including the right to inspect and

9 copy such information and the right to seek

10 amendments to such information, and the pro11 cedures for authorizing disclosures of protected

12 health information and for revoking such au13 thorizations.

14 (B) PROCEDURES OF PROVIDER OR

15 PLAN.—The procedures established by the pro16 vider or plan for the exercise of the rights of in17 dividuals about whom protected health informa18 tion is maintained.

19 (C) AUTHORIZED DISCLOSURES.—The dis20 closures of protected health information that

21 are authorized.

22 (2) DISSEMINATION OF NOTICE.—A health care

23 provider or health benefit plan—
51

S 2129 PCS

1 (A) shall, upon request, provide any indi2 vidual with a copy of the notice of information

3 practices described in paragraph (1); and

4 (B) shall make reasonable efforts to inform

5 individuals in a clear and conspicuous manner

6 of the existence and availability of the notice.

7 (3) MODEL NOTICE.—Not later than July 1,

8 1996, the Secretary, after consultation with the At9 torney General and after notice and opportunity for

10 public comment, shall develop and disseminate a

11 model notice of information practices for use by

12 health care providers and health benefit plans under

13 this section.

14 SEC. 219. ACCOUNTING FOR DISCLOSURES.

15 (a) IN GENERAL.—A health care provider or health

16 benefit plan that is required to comply with this subsection

17 shall create and maintain, with respect to any protected

18 health information disclosed, a record of—

19 (1) the date and purpose of the disclosure;

20 (2) the name of the person to whom the disclo21 sure was made;

22 (3) the address of the person to whom the dis23 closure was made or the location to which the disclo24 sure was made; and
52

S 2129 PCS

1 (4) the information disclosed, if the recording of

2 the information disclosed is practicable, taking into

3 account the technical capabilities of the system used

4 to maintain the record and the costs of such mainte5 nance.

6 (b) DISCLOSURE RECORD PART OF INFORMATION.—

7 A record created and maintained under paragraph (a)

8 shall be maintained as part of the protected health infor9 mation to which the record pertains, except for requests

10 from and disclosures to health oversight agencies.

11 SEC. 220. STANDARDS FOR ELECTRONIC DOCUMENTS AND

12 COMMUNICATIONS.

13 Not later than July 1, 1996, the Attorney General,

14 in consultation with the Secretary and after notice and

15 opportunity for public comment, shall promulgate stand16 ards with respect to the creation, transmission, receipt,

17 and maintenance, in electronic form, of each written docu18 ment required or authorized under this title. When a sig19 nature is required with respect to a written document

20 under any other provision of this title, such standards

21 shall provide for an electronic substitute that serves the

22 functional equivalent of a signature.

23 SEC. 221. RIGHTS OF INCOMPETENTS.

24 (a) EFFECT OF DECLARATION OF INCOMPETENCE.—

25 Except as provided in section 222, if an individual has
53

S 2129 PCS

1 been declared to be incompetent by a court of competent

2 jurisdiction, the rights of the individual under this section

3 shall be exercised and discharged in the best interests of

4 the individual through an authorized legal representative.

5 (b) NO COURT DECLARATION.—Except as provided

6 in section 222, if a health care provider determines that

7 an individual, who has not been declared to be incom8 petent by a court of competent jurisdiction, suffers from

9 a medical condition that prevents the individual from act10 ing knowingly or effectively on the individual’s own behalf,

11 the right of the individual to authorize disclosure may be

12 exercised and discharged in the best interest of the individ13 ual by the individual’s next of kin.

14 SEC. 222. RIGHTS OF MINORS.

15 (a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA16 BLE.—In the case of an individual—

17 (1) who is 18 years of age or older, all rights

18 of the individual shall be exercised by the individual;

19 or

20 (2) who, acting alone, has the legal right, as de21 termined by State law, to apply for and obtain a

22 type of medical examination, care, or treatment and

23 who has sought such examination, care, or treat24 ment, the individual shall exercise all rights of an in25 dividual under this title with respect to protected
54

S 2129 PCS

1 health information relating to such examination,

2 care, or treatment.

3 (b) INDIVIDUALS UNDER 18.—Except as provided in

4 subsection (a)(2), in the case of an individual who is—

5 (1) under 14 years of age, all the individual’s

6 rights under this title shall be exercised through the

7 parent or legal guardian of the individual; or

8 (2) 14, 15, 16, or 17 years of age, the rights

9 of inspection and amendment, and the right to au10 thorize disclosure of protected health information of

11 the individual may be exercised either by the individ12 ual or by the parent or legal guardian of the individ13 ual.

14 SEC. 223. NO LIABILITY FOR PERMISSIBLE DISCLOSURES.

15 A health information trustee who makes a disclosure

16 of protected health information about an individual that

17 is permitted by this title shall not be liable to the individ18 ual for the disclosure under common law.

19 SEC. 224. NO LIABILITY FOR INSTITUTIONAL REVIEW

20 BOARD DETERMINATIONS.

21 If the members of an institutional review board make

22 a determination in good faith that—

23 (1) a health research project is of sufficient im24 portance to outweigh the intrusion into the privacy

25 of an individual; and
55

S 2129 PCS

1 (2) the effectiveness of the project requires use

2 of protected health information,

3 the members, the board, and the parent institution of the

4 board shall not be liable to the individual as a result of

5 the determination.

6 SEC. 225. GOOD FAITH RELIANCE ON CERTIFICATION.

7 A health information trustee who relies in good faith

8 on a certification by a government authority or other per9 son and discloses protected health information about an

10 individual in accordance with this title shall not be liable

11 to the individual for such disclosure.

12 SEC. 226. CIVIL PENALTY.

13 (a) VIOLATION.—Any health information trustee who

14 the Secretary determines has substantially failed to com15 ply with this title shall be subject, in addition to any other

16 penalties that may be prescribed by law, to a civil penalty

17 of not more than $10,000 for each such violation.

18 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

19 Section 1128A of the Social Security Act (42 U.S.C.

20 1320a–7a), other than subsections (a) and (b) and the

21 second sentence of subsection (f) of that section, shall

22 apply to the imposition of a civil monetary penalty under

23 this section in the same manner as such provisions apply

24 with respect to the imposition of a penalty under section

25 1128A of that Act.
56

S 2129 PCS

1 SEC. 227. CIVIL ACTION.

2 (a) IN GENERAL.—An individual who is aggrieved by

3 conduct in violation of this title may bring a civil action

4 to recover—

5 (1) the greater of actual damages or liquidated

6 damages of $5,000;

7 (2) punitive damages;

8 (3) a reasonable attorney’s fee and expenses of

9 litigation;

10 (4) costs of litigation; and

11 (5) such preliminary and equitable relief as the

12 court determines to be appropriate.

13 (b) LIMITATION.—No action may be commenced

14 under this section more than 3 years after the date on

15 which the violation was or should reasonably have been

16 discovered.

17 SEC. 228. RELATIONSHIP TO OTHER LAWS.

18 (a) STATE LAW.—Except as provided in subsections

19 (b), (c), and (d), this title preempts any State law to the

20 extent that such law is inconsistent with this title.

21 (b) LAWS RELATING TO PUBLIC HEALTH.—Nothing

22 in this title is intended to preempt or operate to the exclu23 sion of any State public health law that prevents or regu24 lates disclosure of protected health information otherwise

25 allowed under this Act.
57

S 2129 PCS

1 (c) PRIVILEGES.—Nothing in this title is intended to

2 preempt or modify State common or statutory law to the

3 extent such law concerns a privilege of a witness or person

4 in a court of the State. This title does not supersede or

5 modify Federal common or statutory law to the extent

6 such law concerns a privilege of a witness or person in

7 a court of the United States.

8 (d) CERTAIN DUTIES UNDER STATE OR FEDERAL

9 LAW.—This title shall not be construed to preempt, super10 sede, or modify the operation of—

11 (1) any law that provides for the reporting of

12 vital statistics such as birth or death information;

13 (2) any law requiring the reporting of abuse or

14 neglect information about any individual;

15 (3) subpart II of part E of title XXVI of the

16 Public Health Service Act (relating to notifications

17 of emergency response employees of possible expo18 sure to infectious diseases); or

19 (4) any Federal law that prevents or regulates

20 disclosure of protected health information.

21 S 2129 PCS——2

22 S 2129 PCS——3

23 S 2129 PCS——4

24 S 2129 PCS——5
Calendar No. 454

103D CONGRESS

2D SESSION S. 2129

A BILL

To amend title 18, United States Code, to preserve

other purposes.and health care-related information, and forpersonal privacy with respect to medical records

JUNE 7, 1994

Read the second time and placed on the calendar