II

105TH CONGRESS

1ST SESSION S. 1368

To provide individuals with access to health information of which they are

the subject, ensure personal privacy with respect to personal medical

records and health care-related information, impose criminal and civil

penalties for unauthorized use of personal health information, and to

provide for the strong enforcement of these rights.

IN THE SENATE OF THE UNITED STATES

NOVEMBER 4, 1997

Mr. LEAHY (for himself and Mr. KENNEDY) introduced the following bill;

which was read twice and referred to the Committee on Labor and

Human Resources

A BILL

To provide individuals with access to health information of

which they are the subject, ensure personal privacy with

respect to personal medical records and health care-related information, impose criminal and civil penalties for

unauthorized use of personal health information, and

to provide for the strong enforcement of these rights.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Medical Information Privacy and Security Act’’.
2

•S 1368 IS

1 (b) TABLE OF CONTENTS.—The table of contents for

2 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings.

Sec. 3. Purposes.

Sec. 4. Definitions.

TITLE I—INDIVIDUAL’S RIGHTS

Subtitle A—Access to Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Supplements to protected health information.

Sec. 103. Notice of privacy practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Subtitle A—General Restriction

Sec. 201. General rule regarding use and disclosure.

Sec. 202. Authorizations for disclosure of protected health information.

Subtitle B—Limited Circumstances Providing for Disclosure Without

Authorization

Sec. 211. Emergency circumstances.

Sec. 212. Public health.

Sec. 213. Protection and advocacy agencies.

Sec. 214. Oversight.

Sec. 215. Disclosure for law enforcement purposes.

Subtitle C—Special Rules Governing Disclosure

Sec. 221. Next of kin and directory information.

Sec. 222. Health research.

Sec. 223. Judicial and administrative purposes.

Sec. 224. Individual representatives.

Sec. 225. Prohibition against retaliation.

TITLE III—OFFICE OF HEALTH INFORMATION PRIVACY OF THE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Subtitle A—Establishment

Sec. 301. Establishment.

Subtitle B—Enforcement

CHAPTER 1—CRIMINAL PROVISIONS

Sec. 311. Wrongful disclosure of protected health information.
3

•S 1368 IS

Sec. 312. Debarment for crimes.

CHAPTER 2—CIVIL SANCTIONS

Sec. 321. Civil penalty.

Sec. 322. Procedures for imposition of penalties.

Sec. 323. Civil action by individuals.

TITLE IV—MISCELLANEOUS

Sec. 401. Relationship to other laws.

Sec. 402. Effective date.

1 SEC. 2. FINDINGS.

2 Congress finds that—

3 (1) individuals have a right of privacy with re4 spect to their personal medical information and

5 records;

6 (2) with respect to information about medical

7 care and health status, the traditional right of con8 fidentiality (between a health care provider and a

9 patient) is at risk;

10 (3) an erosion of the right of privacy may re11 duce the willingness of patients to confide in physi12 cians and other practitioners and may inhibit such

13 patients from seeking care;

14 (4) the use of electronic medical records offers

15 many potential advantages compared to traditional

16 paper-based systems if encompassed with strong pri17 vacy safeguards, through the sharing and linking of

18 medical records electronically which can reduce

19 costs, improve efficiencies and enhance medical care

20 while helping to avoid duplicate tests, prevent fraud
4

•S 1368 IS

1 and protect against unintended dangerous drug

2 interactions;

3 (5) the European Union has adopted a directive

4 that provides that electronic medical records can not

5 be sent from Union member nations to other na6 tions, such as the United States, unless the non7 member country assures the security and confiden8 tiality of medical records under its national laws and

9 practices;

10 (6) an individual’s privacy right means that the

11 individual’s consent is needed to disclose his or her

12 personally identifiable health information and that

13 the individual has a right of access to that health in14 formation;

15 (7) any disclosure of personally identifiable

16 health information should be limited to that infor17 mation or portion of the medical record necessary to

18 fulfill the immediate and specific purpose of the dis19 closure;

20 (8) an individual’s health information is cur21 rently accessible to many people who do not need the

22 information to provide health care to the individual,

23 often without the individual’s knowledge or consent;
5

•S 1368 IS

1 (9) in the report of the National Research

2 Council of March, 1997, the Council concluded

3 that—

4 (A) with respect to the protection of elec5 tronic medical records, ‘‘few penalties exist for

6 lax security’’ and that ‘‘few controls exist to

7 prevent such information from being used in

8 ways that could harm patients or invade their

9 privacy’’;

10 (B) ‘‘patients have little control over the

11 ways in which information about their health is

12 collected, used, or disseminated’’;

13 (C) ‘‘[t]he greatest concerns regarding pa14 tient privacy stem from the widespread dissemi15 nation of information throughout the health

16 care industry and related industries, often with17 out the knowledge or consent of the patients

18 . . . [i]n many cases, this information can be

19 used in ways that are perceived as detrimental

20 to patient privacy and contrary to the interests

21 of patients. . . .’’;

22 (D) consent to release medical information

23 should be for specified information and pur24 poses and for limited amounts of time after
6

•S 1368 IS

1 which the medical provider ‘‘must obtain new

2 authorization from the patient’’;

3 (E) ‘‘health care providers should give pa4 tients the right to request audits of all access

5 to their electronic medical records and to review

6 such logs’’;

7 (F) with respect to the use of the social se8 curity number as a universal patient identifier,

9 the ‘‘use of the social security number raises

10 many legitimate privacy concerns’’; and

11 (G) a national office of privacy should be

12 established since ‘‘consumers need a mechanism

13 for learning about their rights and how they

14 may seek recourse for violations of fair informa15 tion practices, and they need to be protected

16 from the possibility that their access to care

17 may be jeopardized by exercising their estab18 lished privacy rights’’;

19 (10) medical research often depends on access

20 to both identifiable and nonidentifiable patient medi21 cal records and medical research is critically impor22 tant to the health and well-being of all Americans;

23 (11) currently, there is technology available

24 which can ease the process by which identifiable

25 data can be stripped of all patient identifiers to sup-
7

•S 1368 IS

1 port the necessary balance between medical research

2 and privacy protections for individuals;

3 (12) the American Medical Association Council

4 on Ethical Affairs has concluded that—

5 (A) a patient and a physician ‘‘should be

6 advised about the existence of computerized

7 data bases in which medical information con8 cerning the patient is stored’’;

9 (B) information regarding the existence of

10 computerized data bases ‘‘should be commu11 nicated to the physician and patient prior to the

12 physician’s release of the medical information to

13 the entity or entities maintaining the computer

14 data bases’’;

15 (C) a physician and patient ‘‘should be no16 tified of the distribution of all reports reflecting

17 identifiable patient data prior to distribution of

18 the reports by the computer facility’’; and

19 (D) there should be ‘‘approval by the pa20 tient and notification of the physician prior to

21 the release of patient-identifiable clinical and

22 administrative data to individuals or organiza23 tions external to the medical care environment’’;

24 (13)(A) genetic information contains the

25 uniquely private and personal genetic information of
8

•S 1368 IS

1 an individual which is rapidly being deciphered and

2 understood; and

3 (B) research in genetics continues to provide

4 immense health benefits to individuals and their

5 families, however, the improper use and unauthor6 ized disclosure of genetic information may cause sig7 nificant social and psychological harm to individuals,

8 including stigmatization and discrimination;

9 (14) the Supreme Court found in Jaffee v.

10 Redmond (116 S.Ct. 1923 (1996)) that—

11 (A) there is an imperative need for con12 fidence and trust between a psychotherapist

13 and a patient;

14 (B) this trust can only be established by

15 an assurance of confidentiality; and

16 (C) preservation of such trust and con17 fidentiality serves the public interest by facili18 tating the provision of appropriate treatment

19 for individuals; and

20 (15) section 264 of the Health Insurance Port21 ability and Accountability Act of 1996 (42 U.S.C.

22 1320d–2 note) establishes a deadline that Congress

23 enact legislation, within 36 months after the date of

24 enactment of such Act, to protect the privacy of per25 sonal health information.
9

•S 1368 IS

1 SEC. 3. PURPOSES.

2 It is the purpose of this Act to—

3 (1) recognize that there is a right to privacy

4 with respect to health information, including genetic

5 information, and that this right must be protected;

6 (2) establish an Office of Health Information

7 Privacy within the Department of Health and

8 Human Services to protect that right of privacy;

9 (3) provide individuals with—

10 (A) access to health information of which

11 they are the subject; and

12 (B) the opportunity to challenge the accu13 racy and completeness of such information by

14 being able to file supplements of such records;

15 (4) provide individuals with the right to limit

16 the use and disclosure of personally identifiable

17 health information;

18 (5) create incentives to turn personal health in19 formation into nonidentifiable health information for

20 oversight, health research, public health, law en21 forcement, judicial, and administrative purposes;

22 (6) establish strong and effective mechanisms

23 to protect against the unauthorized and inappropri24 ate use of personally identifiable health information

25 that is created or maintained as part of health care
10

•S 1368 IS

1 treatment, diagnosis, enrollment, payment, plan ad2 ministration, testing, or research processes;

3 (7) invoke the sweep of congressional powers,

4 including the power to enforce the 14th amendment,

5 to regulate commerce, and to abrogate the immunity

6 of the States under the 11th amendment, in order

7 to address violations of the rights of individuals to

8 privacy, to provide access to their medical records,

9 and to prevent unauthorized use of personal genetic

10 information; and

11 (8) establish strong and effective remedies for

12 violations of this Act.

13 SEC. 4. DEFINITIONS.

14 In this Act:

15 (1) ADMINISTRATIVE BILLING INFORMATION.—

16 The term ‘‘administrative billing information’’

17 means any of the following forms of protected health

18 information:

19 (A) Date of service, policy, patient and

20 practitioner or facility identifiers.

21 (B) Diagnostic codes, in accordance with

22 medicare billing codes, for which treatment is

23 being rendered or requested.

24 (C) Complexity of service codes, indicating

25 duration of treatment.
11

•S 1368 IS

1 (D) Total billed charges.

2 (2) AGENT.—The term ‘‘agent’’ means a person

3 who represents and acts for another under the con4 tract or relation of agency, or whose function is to

5 bring about, modify, affect, accept performance of,

6 or terminate contractual obligations between the

7 principal and a third person, and includes the em8 ployees of such persons.

9 (3) DISCLOSE.—The term ‘‘disclose’’ means to

10 release, transfer, permit access to, or otherwise di11 vulge protected health information to any person

12 other than the individual who is the subject of such

13 information. Such term includes the initial disclosure

14 and any subsequent redisclosures of individually

15 identifiable health care information.

16 (4) EMPLOYER.—The term ‘‘employer’’ means

17 a person engaged in business affecting commerce

18 who has employees.

19 (5) HEALTH CARE.—The term ‘‘health care’’

20 means—

21 (A) preventive, diagnostic, therapeutic, re22 habilitative, maintenance, or palliative care, in23 cluding appropriate assistance with disease or

24 symptom management and maintenance, coun25 seling, service, or procedure—
12

•S 1368 IS

1 (i) with respect to the physical or

2 mental condition of an individual; or

3 (ii) affecting the structure or function

4 of the human body or any part of the

5 human body, including the banking of

6 blood, sperm, organs, or any other tissue;

7 and

8 (B) any sale or dispensing of a drug, de9 vice, equipment, or other health care related

10 item to an individual, or for the use of an indi11 vidual, pursuant to a prescription.

12 (6) HEALTH CARE PROVIDER.—The term

13 ‘‘health care provider’’ means a person, who with re14 spect to a specific item of protected health informa15 tion, receives, creates, uses, maintains, or discloses

16 the information while acting in whole or in part in

17 the capacity of—

18 (A) a person who is licensed, certified, reg19 istered, or otherwise authorized by Federal or

20 State law to provide an item or service that

21 constitutes health care in the ordinary course of

22 business, or practice of a profession;

23 (B) a Federal or State program that di24 rectly provides items or services that constitute

25 health care to beneficiaries; or
13

•S 1368 IS

1 (C) an officer or employee of a person de2 scribed in subparagraph (A) or (B) that is en3 gaged in the provision of health care.

4 (7) HEALTH OR LIFE INSURER.—The term

5 ‘‘health or life insurer’’ means a health insurance is6 suer as defined in section 9805(b)(2) of the Internal

7 Revenue Code of 1986 or a life insurance company

8 as defined in section 816 of such Code and includes

9 the employees of such person.

10 (8) HEALTH OVERSIGHT AGENCY.—The term

11 ‘‘health oversight agency’’ means a person who—

12 (A) performs or oversees the performance

13 of an assessment, investigation, or prosecution

14 relating to compliance with legal or fiscal stand15 ards relating to health care fraud or fraudulent

16 claims regarding health care, health services or

17 equipment, or related activities and items; and

18 (B) is a public executive branch agency,

19 acting on behalf of a public executive branch

20 agency, acting pursuant to a requirement of a

21 public executive branch agency, or carrying out

22 activities under a Federal or State law govern23 ing the assessment, evaluation, determination,

24 investigation, or prosecution described in sub-
14

•S 1368 IS

1 paragraph (A) and includes the employees of

2 such person.

3 (9) HEALTH PLAN.—The term ‘‘health plan’’

4 means any health insurance plan, including any hos5 pital or medical service plan, dental or other health

6 service plan or health maintenance organization

7 plan, or other program providing or arranging for

8 the provision of health benefits, whether or not fund9 ed through the purchase of insurance. Such term in10 cludes employee welfare benefit plans and group

11 plans as such plans are defined in sections 3 and

12 607 of the Employee Retirement Income Security

13 Act of 1974 (29 U.S.C. 1002 and 1167).

14 (10) HEALTH RESEARCHER.—The term ‘‘health

15 researcher’’ means a person who, with respect to a

16 specific item of protected health information, re17 ceives the information—

18 (A) pursuant to section 222 (relating to

19 health research); or

20 (B) while acting in whole or in part in the

21 capacity of an officer or employee or agent of

22 a person who receives the information described

23 in subparagraph (A).

24 (11) LAW ENFORCEMENT INQUIRY.—The term

25 ‘‘law enforcement inquiry’’ means a lawful executive
15

•S 1368 IS

1 branch investigation or official proceeding inquiring

2 into a violation of, or failure to comply with, any

3 criminal or civil statute or any regulation, rule, or

4 order issued pursuant to such a statute.

5 (12) NONIDENTIFIABLE HEALTH INFORMA6 TION.—The term ‘‘nonidentifiable health informa7 tion’’ means any information that would otherwise

8 be protected health information except that is does

9 not reveal the identity of the individual whose health

10 or health care is the subject of the information and

11 there is no reasonable basis to believe that the infor12 mation could be used to identify that individual.

13 (13) OFFICE OF HEALTH INFORMATION PRI14 VACY.—The term ‘‘Office of Health Information Pri15 vacy’’ means the Office of Health Information Pri16 vacy established under section 301.

17 (14) PERSON.—The term ‘‘person’’ means a

18 government, governmental subdivision of an execu19 tive branch agency or authority; corporation; com20 pany; association; firm; partnership; society; estate;

21 trust; joint venture; individual; individual represent22 ative; tribal government; and any other legal entity.

23 (15) PROTECTED HEALTH INFORMATION.—The

24 term ‘‘protected health information’’ means any in25 formation, including genetic information, demo-
16

•S 1368 IS

1 graphic information, and tissue samples collected

2 from an individual, whether oral or recorded in any

3 form or medium, that—

4 (A) is created or received by a health care

5 provider, health researcher, health plan, health

6 oversight agency, public health authority, em7 ployer, health or life insurer, school or univer8 sity; and

9 (B)(i) relates to the past, present, or fu10 ture physical or mental health or condition of

11 an individual (including individual cells and

12 their components), the provision of health care

13 to an individual, or the past, present, or future

14 payment for the provision of health care to an

15 individual; and

16 (ii)(I) identifies an individual; or

17 (II) with respect to which there is a rea18 sonable basis to believe that the information

19 can be used to identify an individual.

20 (16) PUBLIC HEALTH AUTHORITY.—The term

21 ‘‘public health authority’’ means an authority or in22 strumentality of the United States, a tribal govern23 ment, a State, or a political subdivision of a State

24 that is—
17

•S 1368 IS

1 (A) primarily responsible for public health

2 matters; and

3 (B) primarily engaged in activities such as

4 injury reporting, public health surveillance, and

5 public health investigation or intervention.

6 (17) SCHOOL OR UNIVERSITY.—The term

7 ‘‘school or university’’ means an institution or place

8 for instruction or education, including an elementary

9 school, secondary school, or institution of higher

10 learning, a college, or an assemblage of colleges unit11 ed under one corporate organization or government.

12 (18) SECRETARY.—The term ‘‘Secretary’’

13 means the Secretary of Health and Human Services.

14 (19) STATE.—The term ‘‘State’’ includes the

15 District of Columbia, Puerto Rico, the Virgin Is16 lands, Guam, American Samoa, and the Northern

17 Mariana Islands.

18 (20) WRITING.—The term ‘‘writing’’ means

19 writing in either a paper-based or computer-based

20 form, including electronic signatures.
18

•S 1368 IS

1 TITLE I—INDIVIDUAL’S RIGHTS

2 Subtitle A—Access to Protected

3 Health Information by Subjects

4 of the Information

5 SEC. 101. INSPECTION AND COPYING OF PROTECTED

6 HEALTH INFORMATION.

7 (a) RIGHT OF INDIVIDUAL.—

8 (1) IN GENERAL.—A health care provider,

9 health researcher, health plan, employer, health or

10 life insurer, school, or university, or the agent of any

11 such individual or entity, shall permit an individual

12 who is the subject of protected health information,

13 or the individual’s designee, to inspect and copy pro14 tected health information concerning the individual,

15 including records created under sections 102 and

16 112, that such entity maintains.

17 (2) PROCEDURES AND FEES.—An entity de18 scribed in paragraph (1) may set forth appropriate

19 procedures to be followed for inspection and copying

20 under such paragraph and may require an individual

21 to pay fees associated with such inspection and copy22 ing in an amount that is not in excess of the actual

23 costs of providing such copying. Such fees may not

24 be assessed where such an assessment would have
19

•S 1368 IS

1 the effect of prohibiting an individual from gaining

2 access to the information involved.

3 (b) DEADLINE.—An entity described in subsection

4 (a) shall comply with a request for inspection or copying

5 of protected health information under this section not

6 later than 15 business days after the date on which the

7 entity receives the request.

8 (c) RULES GOVERNING AGENTS.—An agent of an en9 tity described in subsection (a) shall provide for the in10 spection and copying of protected health information if—

11 (1) the protected health information is retained

12 by the agent; and

13 (2) the agent has been asked by the entity in14 volved to fulfill the requirements of this section.

15 SEC. 102. SUPPLEMENTS TO PROTECTED HEALTH INFOR16 MATION.

17 (a) IN GENERAL.—Not later than 45 days after the

18 date on which a health care provider, health researcher,

19 health plan, employer, health or life insurer, school, or uni20 versity, or the agent of any such individual or entity, re21 ceives from an individual a request in writing to supple22 ment information, such entity shall—

23 (1) add the supplement requested to the

24 records;
20

•S 1368 IS

1 (2) inform the individual of the supplement that

2 has been added; and

3 (3) make reasonable efforts to inform any per4 son to whom the portion of the unsupplemented in5 formation was previously disclosed, of any nontech6 nical supplement that has been made.

7 (b) REFUSAL TO SUPPLEMENT.—If an entity de8 scribed in subsection (a) declines to make the supplement

9 requested under such subsection, the entity shall inform

10 the individual in writing of—

11 (1) the reasons for declining to make the sup12 plement;

13 (2) any procedures for further review of the de14 clining of such supplement; and

15 (3) the individual’s right to file with the entity

16 a concise statement setting forth the requested sup17 plement and the individual’s reasons for disagreeing

18 with the declining entity and the individual’s right to

19 include a copy of this refusal in his or her health

20 record.

21 (c) STATEMENT OF DISAGREEMENT.—If an individ22 ual has filed a statement of disagreement under subsection

23 (b)(3), the entity involved, in any subsequent disclosure

24 of the disputed portion of the information—
21

•S 1368 IS

1 (1) shall include, at the individual’s request, a

2 copy of the individual’s statement; and

3 (2) may include a concise statement of the rea4 sons for not making the requested supplement.

5 (d) RULES GOVERNING AGENTS.—The agent of an

6 entity described in subsection (a) shall not be required to

7 make supplements to protected health information, except

8 where—

9 (1) the protected health information is retained

10 by the agent; and

11 (2) the agent has been asked by such entity to

12 fulfill the requirements of this section.

13 SEC. 103. NOTICE OF PRIVACY PRACTICES.

14 (a) PREPARATION OF WRITTEN NOTICE.—A health

15 care provider, health plan, health oversight agency, public

16 health authority, employer, health researcher, health or

17 life insurer, school, or university, or the agent of any such

18 individual or entity, shall prepare a written notice of the

19 privacy practices of the entity that shall include—

20 (1) the procedures for an individual to author21 ize disclosures of protected health information, and

22 to object to, modify, and revoke such authorizations;

23 (2) the right of an individual to inspect, copy,

24 and supplement the protected health information;
22

•S 1368 IS

1 (3) the right of an individual not to have em2 ployment or the receipt of services conditioned upon

3 the execution by the individual of an authorization

4 for disclosure;

5 (4) a description of the categories or types of

6 employees, by general category or by general job de7 scription, who have access to or use of protected

8 health information within the entity;

9 (5) a simple, concise description of any infor10 mation systems used to store or transmit protected

11 health information, including a description of any

12 linkages made with other electronic systems or

13 databases outside the entity;

14 (6) the right of the individual to request seg15 regation of protected health information, and to re16 strict the use of such information by employees,

17 agents, and contractors of an entity;

18 (7) the circumstances under which the informa19 tion may be used or disclosed without an authoriza20 tion executed by the individual; and

21 (8) a statement that an individual may self pay

22 for health care in order that no identifying informa23 tion be disclosed to anyone other than the health

24 care provider unless such disclosure is related to the

25 medical treatment or is authorized by mandatory re-
23

•S 1368 IS

1 porting requirements or other similar information

2 collection duties as required by law.

3 (b) PROVISION AND POSTING OF WRITTEN NO4 TICE.—

5 (1) PROVISION.—An entity described in sub6 section (a) shall provide a copy of the written notice

7 of privacy practices required under such sub8 section—

9 (A) at the time an authorization is sought

10 for disclosure of protected health information;

11 and

12 (B) upon the request of an individual.

13 (2) POSTING.—An entity described in sub14 section (a) shall post, in a clear and conspicuous

15 manner, a brief summary of the privacy practices of

16 the entity.

17 (c) MODEL NOTICE.—The director of the Office of

18 Health Information Privacy, after notice and opportunity

19 for public comment, shall develop and disseminate model

20 notices of privacy practices, and model summary notices

21 for posting, for use under this section.
24

•S 1368 IS

1 Subtitle B—Establishment of

2 Safeguards

3 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

4 (a) IN GENERAL.—A health care provider, health

5 plan, health oversight agency, public health authority, em6 ployer, health researcher, law enforcement official, health

7 or life insurer, school, or university, or the agent of any

8 such individual or entity, shall establish and maintain ap9 propriate administrative, organizational, technical, and

10 physical safeguards and procedures to ensure the con11 fidentiality, security, accuracy, and integrity of protected

12 health information created, received, obtained, main13 tained, used, transmitted, or disposed of by such entity.

14 (b) MODEL GUIDELINES.—The director of the Office

15 of Health Information Privacy, after notice and oppor16 tunity for public comment, shall develop and disseminate

17 model guidelines for the establishment of safeguards for

18 use under this section such as, where appropriate, individ19 ual authentication of uses of computer systems, access

20 controls, audit trials, physical security, protection of re21 mote access points and protection of external electronic

22 communications, periodic security assessments, incident

23 internal reports in sanctions, and such other systems as

24 new technologies and problems develop. The director shall
25

•S 1368 IS

1 update and disseminate such new guidelines, as appro2 priate to take advantage of new technologies.

3 SEC. 112. ACCOUNTING FOR DISCLOSURES.

4 (a) IN GENERAL.—

5 (1) RECORD OF DISCLOSURE.—A health care

6 provider, health plan, health oversight agency, public

7 health authority, employer, health researcher, law

8 enforcement official, health or life insurer, school, or

9 university, or the agent of any such individual or en10 tity, shall establish and maintain, with respect to

11 any protected health information disclosure that is

12 not related to payment or treatment, a record of the

13 disclosure in accordance with regulations issued by

14 the director of the Office of Health Information Pri15 vacy.

16 (2) AGENT.—An agent shall maintain a record

17 of disclosures made pursuant to subtitles B and C

18 of title III.

19 (b) MAINTENANCE OF RECORD.—A record estab20 lished under subsection (a) shall be maintained for not less

21 than 7 years.

22 (c) ELECTRONIC RECORDS.—A health care provider,

23 health plan, health oversight agency, public health author24 ity, employer, health researcher, law enforcement official,

25 health or life insurer, school, or university, or the agent
26

•S 1368 IS

1 of any such individual or entity, shall, to the extent prac2 ticable, maintain an electronic record, or the ability to gen3 erate such a record, concerning each attempt that is made

4 by such an entity, or by any other person, whether author5 ized or unauthorized, successful or unsuccessful, to access

6 protected health information maintained by such entity in

7 electronic form. The record shall include the identity of

8 the specific individual attempting to gain such access, or

9 a way to identify that individual, and other appropriate

10 information, and information sufficient to identify the in11 formation sought.

12 TITLE II—RESTRICTIONS ON

13 USE AND DISCLOSURE

14 Subtitle A—General Restriction

15 SEC. 201. GENERAL RULE REGARDING USE AND DISCLO16 SURE.

17 A health care provider, health plan, health oversight

18 agency, public health authority, employer, health re19 searcher, law enforcement official, health or life insurer,

20 school, or university, or the agent of any such individual

21 or entity, may not disclose protected health information

22 except as authorized under this title.
27

•S 1368 IS

1 SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO2 TECTED HEALTH INFORMATION.

3 (a) WRITTEN AUTHORIZATIONS.—A health care pro4 vider, health plan, health oversight agency, public health

5 authority, employer, health researcher, health or life in6 surer, school, or university, or the agent of any such indi7 vidual or entity, may disclose protected health information

8 pursuant to an authorization executed by the individual

9 who is the subject of the information that meets the re10 quirements of subsection (b).

11 (b) REQUIREMENTS FOR INDIVIDUAL AUTHORIZA12 TION.—To be valid, an authorization to disclose individ13 ually identifiable health care information shall—

14 (1) identify the type of person (by title, general

15 job description, or other functional description) or

16 entity authorized to disclose protected health infor17 mation;

18 (2) describe the nature of the health care infor19 mation to be disclosed;

20 (3) identify the type of person or entity (includ21 ing identification made with respect to employees

22 through use of a job description, title, or other func23 tional description) to whom the information is to be

24 disclosed, including individuals employed by or oper25 ating within the entity;

26 (4) describe the purpose of the disclosure;
28

•S 1368 IS

1 (5) permit an individual to indicate that a par2 ticular person or entity listed on the authorization is

3 not authorized to receive protected health informa4 tion concerning the individual, except that a physi5 cian directly responsible for providing necessary

6 medical care, and those directly assisting such physi7 cian, shall be permitted access to files related to pro8 viding that medical care;

9 (6) provide the means by which an individual

10 may indicate that some of the individual’s protected

11 health information should be segregated;

12 (7) permit an individual to indicate that pro13 tected health information, other than administrative

14 billing information, shall not be transmitted outside

15 the entity in a computerized, digital, optical, or

16 other electronic format;

17 (8) be subject to revocation by the individual

18 and indicate that the authorization is valid until rev19 ocation by the individual or until an event or date

20 specified; and

21 (9)(A) be either—

22 (i) in writing, dated, and signed by the in23 dividual; or
29

•S 1368 IS

1 (ii) in electronic form, dated and authenti2 cated by the individual using a unique identi3 fier; and

4 (B) not have been revoked under paragraph (8).

5 (c) LIMITATION ON AUTHORIZATIONS.—

6 (1) IN GENERAL.—Subject to paragraphs (3)

7 and (4), an entity described in subsection (a) that

8 seeks an authorization under such subsection may

9 not condition the delivery of treatment or payment

10 for services on the receipt of an authorization.

11 (2) AUTHORIZATION FOR PAYMENT PUR12 POSES.—An entity described in subsection (a) that

13 seeks an authorization under such subsection may

14 not condition delivery of health care or payment for

15 services upon receipt of an authorization to link, ag16 gregate, match, index or associate protected health

17 information contained within a computerized, digital,

18 optical or other electronic format with other such in19 formation held by another entity.

20 (3) RIGHT TO REQUIRE SELF PAYMENT.—If an

21 individual has refused to provide an authorization of

22 disclosure of administrative billing information to a

23 person or entity and such authorization is necessary

24 for a health care provider to receive payment for

25 services delivered, the person or entity seeking the
30

•S 1368 IS

1 authorization may require the individual to self-pay

2 for the services.

3 (4) AUTHORIZATION FOR TREATMENT PUR4 POSES.—If a health care provider that is seeking an

5 authorization for disclosure of an individual’s pro6 tected health information believes that the disclosure

7 of such information is necessary so as not to endan8 ger the health or treatment of the individual, the

9 health care provider may condition the provision of

10 services upon the execution of the authorization by

11 the individual.

12 (d) MODEL AUTHORIZATIONS.—The Secretary, after

13 notice and opportunity for public comment, shall develop

14 and disseminate model written authorizations of the type

15 described in subsection (a) and model statements of the

16 limitations on authorizations. Any authorization obtained

17 on a model authorization form developed by the Secretary

18 pursuant to the preceding sentence shall be deemed to

19 meet the authorization requirements of this section.

20 (e) GENERAL RULES APPLYING TO AUTHORIZATIONS

21 FOR DISCLOSURE.—

22 (1) SCOPE OF DISCLOSURE.—The disclosure of

23 protected health information under an authorization

24 provided under this section shall be limited to the

25 minimum amount of information necessary to ac-
31

•S 1368 IS

1 complish the purpose for which the authorization

2 was executed.

3 (2) USE OF DISCLOSURE FOR PURPOSE

4 ONLY.—A recipient of information pursuant to an

5 authorization under this section may use or disclose

6 such information solely to carry out the purpose for

7 which the information was authorized for release.

8 (3) NO GENERAL REQUIREMENT TO DIS9 CLOSE.—Nothing in this section permitting the dis10 closure of protected health information shall be con11 strued to require such disclosure.

12 (4) IDENTIFICATION OF DISCLOSED INFORMA13 TION AS PROTECTED HEALTH INFORMATION.—Pro14 tected health information disclosed pursuant to an

15 authorization under this section shall be clearly iden16 tified as protected health information that is subject

17 to this Act.

18 (f) SEGREGATION OF FILES.—An entity described in

19 subsection (a) shall comply with the request of an individ20 ual who is the subject of protected health information to—

21 (1) segregate any type or amount of protected

22 health information, other than administrative billing

23 information, held by the entity;

24 (2) limit the use or disclosure of the segregated

25 health information within the entity to those persons
32

•S 1368 IS

1 specifically designated by the subject of the pro2 tected health information; and

3 (3) maintain such information outside any

4 networked computerized, digital, optical or other

5 electronic system.

6 (g) REVOCATION OF AUTHORIZATION.—

7 (1) IN GENERAL.—An individual may in writing

8 revoke or amend an authorization under this section

9 at any time, unless the disclosure that is the subject

10 of the authorization is required to effectuate pay11 ment for health care that has been provided to the

12 individual.

13 (2) HEALTH PLANS.—With respect to a health

14 plan, the authorization of an individual is deemed to

15 be revoked at the time of the cancellation or non-re16 newal of enrollment in the health plan, except as

17 may be necessary to complete plan administration

18 and payment requirements related to the individual’s

19 period of enrollment.

20 (3) ACTIONS.—An individual may not maintain

21 an action against a person for disclosure of person22 ally identifiable health information—

23 (A) if the disclosure was made based on a

24 good faith reliance on the individual’s author25 ization at the time disclosure was made;
33

•S 1368 IS

1 (B) in a case in which the authorization is

2 revoked, if the disclosing entity had no actual

3 or constructive notice of the revocation; or

4 (C) if the disclosure was for the purpose of

5 protecting another individual from imminent

6 physical harm, if authorized under section 211.

7 (h) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND

8 REVOCATIONS.—Each person collecting or storing person9 ally identifiable health information shall maintain a record

10 for a period of 7 years of each authorization of an individ11 ual and any revocation thereof, and such record shall be12 come part of the personally identifiable health information

13 concerning such individual.

14 (i) NO WAIVER.— Except as provided for in this Act,

15 an authorization to disclose personally identifiable health

16 information by an individual shall not be construed as a

17 waiver of any rights that the individual has under other

18 Federal or State laws, the rules of evidence, or common

19 law.

20 (j) RULE OF CONSTRUCTION.—Except as provided in

21 subsection (a), nothing in this section shall be construed

22 to prevent the electronic or computerized exchange of ad23 ministrative billing information for the purpose of a claims

24 payment.

25 (k) DEFINITION.—For purposes of this section—
34

•S 1368 IS

1 (1) the term ‘‘segregate’’ means to place a des2 ignated subset of protected health information in a

3 location or computer file that is separate from the

4 location or computer file used to store general pro5 tected health information and where access to or use

6 of any information so segregated may be effectively

7 limited to those individuals who are authorized to

8 access or use such information; and

9 (2) the terms ‘‘signed’’ refers to both signatures

10 in ink and electronic signatures, and ‘‘written’’ re11 fers to both paper and computerized formats.

12 Subtitle B—Limited Circumstances

13 Providing for Disclosure With14 out Authorization

15 SEC. 211. EMERGENCY CIRCUMSTANCES.

16 (a) GENERAL RULE.—In the event of a threat of im17 minent physical or mental harm to the subject of protected

18 health information, any person may, in order to allay or

19 remedy such threat, disclose protected health information

20 about such subject to a health care practitioner, health

21 care facility, law enforcement authority, or emergency

22 medical personnel to protect the health or safety of such

23 subject.

24 (b) HARM TO OTHERS.—In the event of a threat of

25 harm to an individual other than the subject of protected
35

•S 1368 IS

1 health information, any person may disclose protected

2 health information about such subject where—

3 (1) there is an identifiable threat of serious in4 jury or death to an identifiable individual or group

5 of individuals;

6 (2) the subject of the protected health informa7 tion has the ability to carry out such threat; and

8 (3) the release of such information is necessary

9 to prevent or significantly reduce the possibility of

10 such threat.

11 (c) LIMITATIONS.—

12 (1) SCOPE OF DISCLOSURE.—Every disclosure

13 of protected health information under this section

14 shall be limited to the minimum amount of informa15 tion necessary to achieve the purposes of this sec16 tion.

17 (2) USE OR DISCLOSURE FOR PURPOSE

18 ONLY.—A recipient of information pursuant to this

19 section may use or disclose such information solely

20 to carry out the purposes of this section.

21 (3) IDENTIFICATION OF DISCLOSED INFORMA22 TION AS PROTECTED HEALTH INFORMATION.—Pro23 tected health information disclosed under this sec24 tion must be clearly identified as protected health in25 formation that is subject to this Act.
36

•S 1368 IS

1 SEC. 212. PUBLIC HEALTH.

2 (a) GENERAL RULE.—A health care provider, health

3 plan, public health authority, health researcher, employer,

4 law enforcement official, health or life insurer, school or

5 university, or the agent of any such individual or entity,

6 may disclose protected health information concerning an

7 individual to a public health authority where—

8 (1) there is a specific nexus between the indi9 vidual’s identity and a threat of a specific disease,

10 death, or injury to any individual or to the public

11 health; and

12 (2) the individual’s identity would allow such

13 public health authority to prevent or significantly re14 duce the possibility of injury or death to any individ15 ual or the public health, such as the creation and

16 use of disease registries established under Federal or

17 State law.

18 (b) EXCEPTION.—An entity described in subsection

19 (a) shall not be liable for the disclosure of protected health

20 information—

21 (1) to a public health authority based upon a

22 good faith belief and credible representation made by

23 such authority that such information was required to

24 protect an individual or the public health from a

25 threat of a specific disease, injury, or death; or
37

•S 1368 IS

1 (2) if such disclosure is made pursuant to Fed2 eral or state laws which are designed to protect the

3 public health or safety.

4 SEC. 213. PROTECTION AND ADVOCACY AGENCIES.

5 (a) GENERAL RULE.—Any person who creates or re6 ceives protected health information under this title may

7 disclose protected health information to an agency charged

8 by law to protect the health and safety of individuals when

9 such agency can establish that there is probable cause to

10 believe that an individual who is the subject of the pro11 tected health information is vulnerable to abuse or neglect

12 by an entity providing health or social services to such in13 dividual.

14 (b) LIMITATIONS.—

15 (1) SCOPE OF DISCLOSURE.—Every disclosure

16 of protected health information under this section

17 shall be limited to the minimum amount of informa18 tion necessary to achieve the purposes of this sec19 tion.

20 (2) USE OR DISCLOSURE FOR PURPOSE

21 ONLY.—A recipient of information pursuant to this

22 section may use or disclose such information solely

23 to achieve the purposes of this section.

24 (3) IDENTIFICATION OF DISCLOSED INFORMA25 TION AS PROTECTED HEALTH INFORMATION.—Pro-
38

•S 1368 IS

1 tected health information disclosed under this sec2 tion must be clearly identified as protected health in3 formation that is subject to this Act.

4 SEC. 214. OVERSIGHT.

5 (a) GENERAL RULE.—A health care provider, health

6 plan, public health authority, health researcher, employer,

7 law enforcement official, health or life insurer, school or

8 university, or the agent of any such individual or entity,

9 may disclose protected health information concerning an

10 individual to a health oversight agency to enable the agen11 cy to perform a health oversight function authorized by

12 law only if the agency—

13 (1) does not record the name, social security

14 number, or other identifying information of the indi15 vidual from patient or client files;

16 (2) identifies the individual in all workpapers

17 and electronic records by either relying upon a unit

18 record number contained in the file or by using an19 other formula to scramble or otherwise safeguard

20 the identifying information; and

21 (3) does not remove protected health informa22 tion from the premises, custody or control of such

23 entity.

24 (b) NONIDENTIFIABLE INFORMATION.—An entity de25 scribed in subsection (a) may disclose health information
39

•S 1368 IS

1 concerning an individual to a health oversight agency to

2 perform a health oversight function authorized by law

3 when any information that could reasonably be expected

4 to identify the individual has been removed or concealed.

5 (c) PROHIBITION IN USE IN ACTION AGAINST INDI6 VIDUALS.—Protected health information about an individ7 ual that is disclosed under this section may not be used

8 in, or disclosed to any person for use in, an administrative,

9 civil, or criminal action or investigation directed against

10 the individual.

11 (d) AUTHORIZATION BY A SUPERVISOR.—For pur12 poses of this section, the individual with authority to au13 thorize the oversight function involved shall provide to the

14 entity described in subsections (a) or (b) a statement that

15 the protected health information is being sought for a le16 gally authorized oversight function.

17 (e) LIMITATIONS.—

18 (1) SCOPE OF DISCLOSURE.—Every disclosure

19 of protected health information under this section

20 shall be limited to the minimum amount of informa21 tion necessary to achieve the purposes of this sec22 tion.

23 (2) USE OF DISCLOSURE FOR PURPOSE

24 ONLY.—A recipient of information pursuant to this
40

•S 1368 IS

1 section may use or disclose such information solely

2 to achieve the purposes of this section.

3 (3) NO GENERAL REQUIREMENT TO DIS4 CLOSE.—Nothing in this section permitting the dis5 closure of protected health information shall be con6 strued to require such disclosure.

7 (4) IDENTIFICATION OF DISCLOSED INFORMA8 TION AS PROTECTED HEALTH INFORMATION.—Pro9 tected health information disclosed under this sec10 tion must be clearly identified as protected health in11 formation that is subject to this Act.

12 SEC. 215. DISCLOSURE FOR LAW ENFORCEMENT PUR13 POSES.

14 (a) LAW ENFORCEMENT ACCESS TO PROTECTED

15 HEALTH INFORMATION.—A health care provider, health

16 researcher, health plan, health oversight agency, employer,

17 health or life insurer, school, university, or the agent of

18 any such individual or entity, or person who receives pro19 tected health information pursuant to section 211, may

20 disclose protected health information to a law enforcement

21 authority only if the disclosure is made pursuant to a

22 court order issued by a court of competent jurisdiction in

23 accordance with subsections (b) and (c) or otherwise or24 dered by a Court of competent jurisdiction.
41

•S 1368 IS

1 (b) COURT ORDERS FOR ACCESS TO PROTECTED

2 HEALTH INFORMATION.—A court order for the disclosure

3 of protected health information under subsection (a) may

4 be issued only if the law enforcement authority involved

5 submits a written application upon oath or affirmation

6 and demonstrates by clear and convincing evidence that—

7 (1) the protected health information sought is

8 necessary to a legitimate law enforcement inquiry

9 into a particular violation of criminal law being con10 ducted by the authority;

11 (2) the investigative or evidentiary needs of the

12 law enforcement authority cannot be satisfied by

13 nonidentifiable health information or by any other

14 information; and

15 (3) the law enforcement need for the informa16 tion outweighs the privacy interest of the individual

17 to whom the information pertains.

18 (c) NOTICE.—

19 (1) IN GENERAL.—Except as provided in para20 graph (2), no order for the disclosure of protected

21 health information about an individual may be is22 sued by a court under this section unless notice of

23 the application for the order has been served on the

24 individual who is the subject of the information in-
42

•S 1368 IS

1 volved and the individual has been afforded an op2 portunity to oppose the issuance of the order.

3 (2) NOTICE NOT REQUIRED.—An order for the

4 disclosure of protected health information about an

5 individual may be issued without notice to the indi6 vidual if the court finds, by clear and convincing evi7 dence, that notice would be impractical because—

8 (A) the name and address of the individual

9 are unknown; or

10 (B) notice would risk destruction or un11 availability of the evidence.

12 (d) CONDITIONS.—Upon the granting of an order for

13 disclosure of protected health information under this sec14 tion, the court shall impose appropriate safeguards to en15 sure the confidentiality of such information and to protect

16 against unauthorized or improper use or disclosure.

17 (e) LIMITATION ON USE AND DISCLOSURE FOR

18 OTHER LAW ENFORCEMENT INQUIRIES.—Protected

19 health information about an individual that is disclosed

20 under this section may not be used in, or disclosed to any

21 person for use in, any administrative, civil, or criminal ac22 tion or investigation directed against the individual, unless

23 the action or investigation arises out of, or is directly re24 lated to, the law enforcement inquiry for which the infor25 mation was obtained.
43

•S 1368 IS

1 (f) DESTRUCTION OR RETURN OF INFORMATION.—

2 When the matter or need for which protected health infor3 mation was disclosed to a law enforcement agency or

4 grand jury has concluded, including any derivative matters

5 arising from such matter or need, the law enforcement

6 agency or grand jury shall either destroy the protected

7 health information, or return it to the person from whom

8 it was obtained.

9 (g) REDACTIONS.—To the extent practicable, and

10 consistent with the requirements of due process, a law en11 forcement agency shall redact personally identifying infor12 mation from protected health information prior to the

13 public disclosure of such protected information in a judi14 cial or administrative proceeding.

15 (h) LIMITATIONS.—

16 (1) SCOPE OF DISCLOSURE.—Every disclosure

17 of protected health information under this section

18 shall be limited to the minimum amount of informa19 tion necessary to fulfill the purposes of this section.

20 (2) USE OR DISCLOSURE FOR PURPOSE

21 ONLY.—A recipient of information pursuant to this

22 section may use or disclose such information solely

23 to fulfill the purposes of this section.

24 (3) IDENTIFICATION OF DISCLOSED INFORMA25 TION AS PROTECTED HEALTH INFORMATION.—Pro-
44

•S 1368 IS

1 tected health information disclosed under this sec2 tion must be clearly identified as protected health in3 formation that is subject to this Act.

4 (i) EXCEPTION.—This section shall not be construed

5 to limit or restrict the ability of law enforcement authori6 ties to gain information while in hot pursuit of a suspect

7 or if other exigent circumstances exist.

8 Subtitle C—Special Rules

9 Governing Disclosure

10 SEC. 221. NEXT OF KIN AND DIRECTORY INFORMATION.

11 (a) NEXT OF KIN.—A health care provider, or a per12 son who receives protected health information under sec13 tion 211, may not disclose protected health information

14 regarding an individual to the individual’s next of kin, or

15 to another person whom the individual has identified, un16 less at the time of the treatment of the individual—

17 (1) the individual who is the subject of the in18 formation—

19 (A) has been notified of the individual’s

20 right to object to such disclosure and the indi21 vidual has not objected to the disclosure; or

22 (B) is in a physical or mental condition

23 such that the individual is not capable of object24 ing, and there are no prior indications that the

25 individual would object; and
45

•S 1368 IS

1 (2) the information disclosed relates to health

2 care currently being provided to that individual.

3 (b) DIRECTORY INFORMATION.—

4 (1) DISCLOSURE.—

5 (A) IN GENERAL.—Except as provided in

6 paragraph (2), an entity described in subsection

7 (a) may not disclose the information described

8 in subparagraph (B) to any person unless, at

9 the time of the admission of the individual who

10 is the subject of the information to a facility,

11 the individual—

12 (i) has been notified of the individ13 ual’s right to object and the individual has

14 not objected to the disclosure; or

15 (ii) is in a physical or mental condi16 tion such that the individual is not capable

17 of objecting and there are no prior indica18 tions that the individual would object.

19 (B) INFORMATION.—Information described

20 in this subparagraph is information that con21 sists only of 1 or more of the following items:

22 (i) The name of the individual who is

23 the subject of the information.

24 (ii) The general health status of the

25 individual, described as critical, poor, fair,
46

•S 1368 IS

1 stable, or satisfactory or in terms denoting

2 similar conditions.

3 (iii) The location of the individual on

4 premises controlled by a provider.

5 (2) EXCEPTION.—

6 (A) LOCATION.—Paragraph (1)(B)(iii)

7 shall not apply if disclosure of the location of

8 the individual would reveal specific information

9 about the physical or mental condition of the

10 individual, unless the individual expressly au11 thorizes such disclosure.

12 (B) DIRECTORY OR NEXT OF KIN INFOR13 MATION.—A disclosure may not be made under

14 this section if the health care provider involved

15 has reason to believe that the disclosure of di16 rectory or next of kin information could lead to

17 the physical or mental harm of the individual,

18 unless the individual expressly authorizes such

19 disclosure.

20 (c) IDENTIFICATION OF DECEASED INDIVIDUAL.—

21 An entity described in subsection (a) may disclose pro22 tected health information if such disclosure is necessary

23 to assist in the identification of a deceased individual.

24 (d) RIGHTS OF MINORS.—
47

•S 1368 IS

1 (1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA2 PABLE.—In the case of an individual—

3 (A) who is 18 years of age or older, all

4 rights of the individual shall be exercised by the

5 individual; or

6 (B) who, acting alone, can obtain a type of

7 health care without violating any applicable law,

8 and who has sought such care, the individual

9 shall exercise all rights of an individual under

10 this title with respect to protected health infor11 mation relating to such health care.

12 (2) INDIVIDUALS UNDER 18.—Except as pro13 vided in subparagraph (1)(B) of this subsection, in

14 the case of an individual who is—

15 (A) under 14 years of age, all of the indi16 vidual’s rights under this title shall be exercised

17 through the parent or legal guardian; or

18 (B) 14 through 17 years of age, the rights

19 of inspection and supplementation, and the

20 right to authorize use and disclosure of pro21 tected health information of the individual shall

22 be exercised by the individual, or by the parent

23 or legal guardian of the individual.
48

•S 1368 IS

1 (e) GENERAL RULES APPLYING TO DISCLOSURES OF

2 PROTECTED HEALTH INFORMATION WITH RESPECT TO

3 NEXT OF KIN AND DIRECTORY INFORMATION.—

4 (1) SCOPE OF DISCLOSURE.—Every disclosure

5 of protected health information under this section

6 shall be limited to the minimum amount of informa7 tion necessary to achieve the purposes of this sec8 tion.

9 (2) NO GENERAL REQUIREMENT TO DIS10 CLOSE.—Nothing in this section permitting the dis11 closure of protected health information shall be con12 strued to require such disclosure.

13 SEC. 222. HEALTH RESEARCH.

14 (a) IN GENERAL.—The requirements and protections

15 provided for under part 46 of title 45, Code of Federal

16 Regulations (as in effect on the date of enactment of this

17 Act), shall apply to research conducted by all research fa18 cilities using personally identifiable health information.

19 The Secretary shall promulgate regulations to implement

20 this subsection through notice and comment rulemaking.

21 (b) EVALUATION.—Not later than 1 year after the

22 date of enactment of this Act, the Secretary shall prepare

23 and submit to Congress detailed recommendations on

24 whether written informed consent should be required, and
49

•S 1368 IS

1 if so, under what circumstances, before personally identifi2 able data can be used for medical research.

3 (c) RECOMMENDATIONS.—The recommendations re4 quired to be submitted under subsection (b) shall in5 clude—

6 (1) a detailed explanation of current institu7 tional review board practices, including under what

8 circumstances informed consent is being waived and

9 the extent to which the privacy of individuals is

10 taken into account as a factor before allowing waiv11 ers;

12 (2) a summary of how technology could be used

13 to strip identifying data for the purposes of re14 search;

15 (3) an analysis of the risks and benefits of re16 quiring informed consent versus the waiving in17 formed consent; and

18 (4) an analysis of the risks and benefits of

19 using protected health information for research pur20 poses other than the health research project for

21 which such information was obtained.

22 (d) COMPLIANCE WITH DEADLINE.—Notwithstand23 ing any other provision of law, if the Secretary does not

24 submit the recommendations to Congress by the date de25 scribed in subsection (b), the authority of the Secretary
50

•S 1368 IS

1 to permit the conduct of medical research using personally

2 identifiable data without written informed consent shall be

3 terminated.

4 (e) CONSULTATION.—In carrying out this section, the

5 Secretary shall consult with individuals who have distin6 guished themselves in the fields of health research, pri7 vacy, related technology, consumer interests in health in8 formation, health data standards, and the provision of

9 health services.

10 (f) CONGRESSIONAL NOTICE.—Not later than 6

11 months after the date on which the Secretary submits to

12 Congress the recommendations required under subsection

13 (b), the Secretary shall propose to implement such rec14 ommendations through notice and comment rulemaking

15 and shall advise Congress of such proposal.

16 (g) TERMINATION OF INCONSISTENT AUTHORITY.—

17 Notwithstanding any other provision of law, if the Sec18 retary determines that prior written informed consent is

19 appropriate for some or all research using personally iden20 tifiable health information, the authority of the Secretary

21 to promulgate regulations inconsistent with that deter22 mination shall be terminated 6 months after the date on

23 which such determination is made pursuant to this Act.

24 (h) OTHER REQUIREMENTS.—
51

•S 1368 IS

1 (1) OBLIGATIONS OF THE RECIPIENT.—A per2 son who receives protected health information pursu3 ant to this section—

4 (A) shall remove or destroy, at the earliest

5 opportunity consistent with the purposes of the

6 project involved, information that would enable

7 an individual to be identified, unless—

8 (i) an institutional review board has

9 determined that there is a health or re10 search justification for the retention of

11 such identifiers; and

12 (ii) there is an adequate plan to pro13 tect the identifiers from disclosure consist14 ent with this section; and

15 (2) PERIODIC REVIEW AND TECHNICAL ASSIST16 ANCE.—

17 (A) INSTITUTIONAL REVIEW BOARD.—Any

18 institutional review board that authorizes re19 search under this section shall provide the Sec20 retary with the names and addresses of the in21 stitutional review board members.

22 (B) TECHNICAL ASSISTANCE.—The Sec23 retary may provide technical assistance to insti24 tutional review boards described in this sub25 section.
52

•S 1368 IS

1 (C) MONITORING.—The Secretary shall pe2 riodically monitor institutional review boards

3 described in this subsection.

4 (D) REPORTS.—Not later than 3 years

5 after the date of enactment of this Act, the Sec6 retary shall report to Congress regarding the

7 activities of institutional review boards de8 scribed in this subsection.

9 (i) LIMITATION.—Nothing in this section shall be

10 construed to permit personally identifiable health informa11 tion that is received by a researcher under this section

12 to be accessed for purposes other than research or as au13 thorized by the individual.

14 SEC. 223. JUDICIAL AND ADMINISTRATIVE PURPOSES.

15 (a) IN GENERAL.—A health care provider, health

16 plan, health oversight agency, employer, insurer, health or

17 life insurer, school or university, or the agent of any such

18 individual or entity, or person who receives protected

19 health information under section 211, may disclose pro20 tected health information—

21 (1) pursuant to the standards and procedures

22 established in the Federal Rules of Civil Procedure,

23 the Federal Rules of Criminal Procedure, or com24 parable rules of other courts or administrative agen25 cies, in connection with litigation or proceedings to
53

•S 1368 IS

1 which the individual who is the subject of the infor2 mation is a party and in which the individual has

3 placed his or her physical or mental condition at

4 issue;

5 (2) to a court, and to others ordered by the

6 court, if in response to a court order issued by a

7 court of competent jurisdiction in accordance with

8 subsections (b) and (c); or

9 (3) if necessary to present to a court an appli10 cation regarding the provision of treatment of an in11 dividual or the appointment of a guardian pursuant

12 to a law requiring the reporting of specific medical

13 information to law enforcement authorities.

14 (b) COURT ORDERS FOR ACCESS TO PROTECTED

15 HEALTH INFORMATION.—A court order for the disclosure

16 of protected health information under subsection (a) may

17 be issued only if the person seeking disclosure submits a

18 written application upon oath or affirmation and dem19 onstrates by clear and convincing evidence that—

20 (1) the protected health information sought is

21 necessary for the adjudication of a material fact in

22 dispute in a civil or criminal proceeding;

23 (2) the adjudicative need cannot be satisfied by

24 nonidentifiable health information or by any other

25 information; and
54

•S 1368 IS

1 (3) the need for the information outweighs the

2 privacy interest of the individual to whom the infor3 mation pertains.

4 (c) NOTICE.—

5 (1) IN GENERAL.—Except as provided in para6 graph (2), no order for the disclosure of protected

7 health information about an individual may be is8 sued by a court unless notice of the application for

9 the order has been served on the individual and the

10 individual has been afforded an opportunity to op11 pose the issuance of the order.

12 (2) NOTICE NOT REQUIRED.—An order for the

13 disclosure of protected health information about an

14 individual may be issued without notice to the indi15 vidual if the court finds, by clear and convincing evi16 dence, that notice would be impractical because—

17 (A) the name and address of the individual

18 are unknown; or

19 (B) notice would risk destruction or un20 availability of the evidence.

21 (d) OBLIGATIONS OF RECIPIENT.—

22 (1) IN GENERAL.—A person seeking protected

23 health information pursuant to paragraph (1) of

24 subsection (a)—
55

•S 1368 IS

1 (A) shall notify the individual or the indi2 vidual’s attorney of the request for the informa3 tion;

4 (B) shall provide the health care provider,

5 health plan, health oversight agency, employer,

6 insurer, health or life insurer, school or univer7 sity, or agent, or person involved with a signed

8 document attesting—

9 (i) that the individual has placed his

10 or her physical or mental condition at issue

11 in litigation or proceedings in which the in12 dividual is a party; and

13 (ii) the date on which the individual

14 or the individual’s attorney was notified

15 under subparagraph (A); and

16 (C) shall not accept any requested pro17 tected health information from the health care

18 provider, health plan, health oversight agency,

19 employer, insurer, health or life insurer, school

20 or university, or agent, or person until the ter21 mination of the 10-day period beginning on the

22 date notice was given under subparagraph (A).

23 (2) DISCLOSURE FOR PURPOSE ONLY.—A per24 son who receives protected health information pursu25 ant to subsection (a) may disclose the information
56

•S 1368 IS

1 only to accomplish the purpose for which the pro2 tected health information was obtained.

3 (e) LIMITATIONS.—

4 (1) SCOPE OF DISCLOSURE.—Every disclosure

5 of protected health information under this section

6 shall be limited to the minimum amount of informa7 tion necessary to achieve the purposes of this sec8 tion.

9 (2) NO GENERAL REQUIREMENT TO DIS10 CLOSE.—Nothing in this section permitting the dis11 closure of protected health information shall be con12 strued to require such disclosure.

13 (3) IDENTIFICATION OF DISCLOSED INFORMA14 TION AS PROTECTED HEALTH INFORMATION.—Pro15 tected health information disclosed under this sec16 tion must be clearly identified as protected health in17 formation that is subject to this Act.

18 SEC. 224. INDIVIDUAL REPRESENTATIVES.

19 (a) IN GENERAL.—Except as provided in subsections

20 (b) and (c), a person who is authorized by law (based on

21 grounds other than the individual being a minor), or by

22 an instrument recognized under law, to act as an agent,

23 attorney, proxy, or other legal representative of a pro24 tected individual, may, to the extent so authorized, exer-
57

•S 1368 IS

1 cise and discharge the rights of the individual under this

2 Act.

3 (b) HEALTH CARE POWER OF ATTORNEY.—A person

4 who is authorized by law (based on grounds other than

5 being a minor), or by an instrument recognized under law,

6 to make decisions about the provision of health care to

7 an individual who is incapacitated, may exercise and dis8 charge the rights of the individual under this Act to the

9 extent necessary to effectuate the terms or purposes of

10 the grant of authority.

11 (c) NO COURT DECLARATION.—If a physician or

12 other health care provider determines that an individual,

13 who has not been declared to be legally incompetent, suf14 fers from a medical condition that prevents the individual

15 from acting knowingly or effectively on the individual’s

16 own behalf, the right of the individual to authorize disclo17 sure under this Act may be exercised and discharged in

18 the best interest of the individual by—

19 (1) a person described in subsection (b) with re20 spect to the individual;

21 (2) a person described in subsection (a) with re22 spect to the individual, but only if a person de23 scribed in paragraph (1) cannot be contacted after

24 a reasonable effort;
58

•S 1368 IS

1 (3) the next of kin of the individual, but only

2 if a person described in paragraph (1) or (2) cannot

3 be contacted after a reasonable effort; or

4 (4) the health care provider, but only if a per5 son described in paragraph (1), (2), or (3) cannot be

6 contacted after a reasonable effort.

7 (d) APPLICATION TO DECEASED INDIVIDUALS.—The

8 provisions of this Act shall continue to apply to protected

9 health information concerning a deceased individual for a

10 period of 2 years following the death of that individual.

11 (e) EXERCISE OF RIGHTS ON BEHALF OF A DE12 CEASED INDIVIDUAL.—A person who is authorized by law

13 or by an instrument recognized under law, to act as an

14 executor of the estate of a deceased individual, or other15 wise to exercise the rights of the deceased individual, may,

16 to the extent so authorized, exercise and discharge the

17 rights of such deceased individual under this Act for a pe18 riod of 2 years following the death of that individual. If

19 no such designee has been authorized, the rights of the

20 deceased individual may be exercised as provided for in

21 subsection (c).

22 SEC. 325. PROHIBITION AGAINST RETALIATION.

23 A health care provider, health researcher, health

24 plan, health oversight agency, employer, health or life in25 surer, school or university, or the agent of any such indi-
59

•S 1368 IS

1 vidual or entity, or person who receives protected health

2 information under section 211 may not adversely affect

3 another person, directly or indirectly, because such person

4 has exercised a right under this Act, disclosed information

5 relating to a possible violation of this Act, or associated

6 with, or assisted a person in the exercise of a right under

7 this Act.

8 TITLE III—OFFICE OF HEALTH

9 INFORMATION PRIVACY OF

10 THE DEPARTMENT OF

11 HEALTH AND HUMAN SERV12 ICES

13 Subtitle A—Establishment

14 SEC. 301. ESTABLISHMENT.

15 (a) IN GENERAL.—There is established within the

16 Department of Health and Human Services an office to

17 be known as the Office of Health Information Privacy.

18 The Office shall be headed by a director, who shall be ap19 pointed by the Secretary.

20 (b) DUTIES.—The Director of the Office of Health

21 Information Privacy shall—

22 (1) receive and investigate complaints of alleged

23 violations of this Act;

24 (2) provide for the conduct of audits where ap25 propriate;
60

•S 1368 IS

1 (3) provide guidance to the Secretary in the im2 plementation of this Act;

3 (4) prepare and submit the report described in

4 subsection (c);

5 (5) consult with, and provide recommendation

6 to, the Secretary concerning improvements in the

7 privacy and security of protected health information

8 and concerning medical privacy research needs; and

9 (6) carry out any other activities determined

10 appropriate by the Secretary.

11 (c) REPORT ON COMPLIANCE.—Not later than Janu12 ary 1, 1999, and every January 1 thereafter, the Director

13 of the Office of Health Information Privacy shall prepare

14 and submit to Congress a report concerning the number

15 of complaints of alleged violations of this Act that are re16 ceived during the year for which the report is being pre17 pared. Such report shall describe the complaints and any

18 remedial action taken concerning such complaints.

19 Subtitle B—Enforcement

20 CHAPTER 1—CRIMINAL PROVISIONS

21 SEC. 311. WRONGFUL DISCLOSURE OF PROTECTED

22 HEALTH INFORMATION.

23 (a) IN GENERAL.—Part I of title 18, United States

24 Code, is amended by adding at the end the following:
61

•S 1368 IS

1 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE

2 OF PROTECTED HEALTH INFORMATION

‘‘Sec.

‘‘2801. Wrongful disclosure of protected health information.

3 ‘‘§ 2801. Wrongful disclosure of protected health in4 formation

5 ‘‘(a) OFFENSE.—The penalties described in sub6 section (b) shall apply to a person that knowingly and in7 tentionally—

8 ‘‘(1) obtains protected health information relat9 ing to an individual in violation of title II of the

10 Medical Information Privacy and Security Act; or

11 ‘‘(2) discloses protected health information to

12 another person in violation of title II of the Medical

13 Information Privacy and Security Act.

14 ‘‘(b) PENALTIES.—A person described in subsection

15 (a) shall—

16 ‘‘(1) be fined not more than $50,000, impris17 oned not more than 1 year, or both;

18 ‘‘(2) if the offense is committed under false pre19 tenses, be fined not more than $250,000, imprisoned

20 not more than 5 years, or any combination of such

21 penalties;

22 ‘‘(3) if the offense is committed with the intent

23 to sell, transfer, or use protected health information

24 for commercial advantage, personal gain, or mali-
62

•S 1368 IS

1 cious harm, be fined not more than $500,000, im2 prisoned not more than 10 years, excluded from par3 ticipation in any Federally funded health care pro4 grams, or any combination of such penalties.

5 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per6 son described in subsection (a), the maximum penalties

7 described in subsection (b) shall be doubled for every sub8 sequent conviction for an offense arising out of a violation

9 or violations related to a set of circumstances that are dif10 ferent from those involved in the previous violation or set

11 of related violations described in such subsection (a).’’.

12 (b) CLERICAL AMENDMENT.—The table of chapters

13 for part I of title 18, United States Code, is amended by

14 inserting after the item relating to chapter 123 the follow15 ing new item:

‘‘124. Wrongful disclosure of protected health information ..................... 2801’’.

16 SEC. 312. DEBARMENT FOR CRIMES.

17 (a) PURPOSE.—The purpose of this section is to pro18 mote the prevention and deterrence of instances of inten19 tional criminal actions which violate criminal laws which

20 are designed to protect the privacy of protected health in21 formation in a manner consistent with this Act.

22 (b) DEBARMENT.—Not later than 270 days after the

23 date of enactment of this Act, the Attorney General, in

24 consultation with the Secretary, shall promulgate regula25 tions and establish procedures to permit the debarment
63

•S 1368 IS

1 of health care providers, health researchers, health or life

2 insurers, or schools or universities from receiving benefits

3 under any Federal health programs if the managers or

4 officers of such entities are found guilty of violating sec5 tion 2801 of title 18, United States Code, have civil pen6 alties imposed against such officers or managers under

7 section 321 in connection with the illegal disclosure of pro8 tected health information, or are found guilty of making

9 a false statement or obstructing justice related to attempt10 ing to conceal or concealing such illegal disclosure. Such

11 regulations shall take into account the need for continuity

12 of medical care and may provide for a delay of any debar13 ment imposed under this section to take into account the

14 medical needs of patients.

15 (c) CONSULTATION.—Before publishing a proposed

16 rule to implement subsection (b), the Attorney General

17 shall consult with State law enforcement officials, health

18 care providers, patient privacy rights’ advocates, and other

19 appropriate individuals and entities, to gain additional in20 formation regarding the debarment of entities under sub21 section (b) and the best methods to ensure the continuity

22 of medical care.

23 (d) REPORT.—The Attorney General shall annually

24 prepare and submit to the Committee on the Judiciary of

25 the House of Representatives and the Committee on the
64

•S 1368 IS

1 Judiciary of the Senate a report concerning the activities

2 and debarment actions taken by the Attorney General

3 under this section.

4 (e) ASSISTANCE TO PREVENT CRIMINAL VIOLA5 TIONS.—The Attorney General, in cooperation with any

6 other appropriate individual, organization, or agency, may

7 provide advice, training, technical assistance, and guid8 ance regarding ways to reduce the incidence of improper

9 disclosure of protected health information.

10 (f) RELATIONSHIP TO OTHER AUTHORITIES.—A de11 barment imposed under this section shall not reduce or

12 diminish the authority of a Federal, State, or local govern13 mental agency or court to penalize, imprison, fine, sus14 pend, debar, or take other adverse action against a person,

15 in a civil, criminal, or administrative proceeding.

16 CHAPTER 2—CIVIL SANCTIONS

17 SEC. 321. CIVIL PENALTY.

18 (a) VIOLATION.—A health care provider, health re19 searcher, health plan, health oversight agency, public

20 health agency, law enforcement agency, employer, health

21 or life insurer, school, or university, or the agent of any

22 such individual or entity, who the Office of Health Infor23 mation Privacy, in consultation with the Attorney General,

24 determines has substantially and materially failed to com-
65

•S 1368 IS

1 ply with this Act shall be subject, in addition to any other

2 penalties that may be prescribed by law—

3 (1) in a case in which the violation relates to

4 title I, to a civil penalty of not more than $500 for

5 each such violation, but not to exceed $5000 in the

6 aggregate for multiple violations;

7 (2) in a case in which the violation relates to

8 title II, to a civil penalty of not more than $10,000

9 for each such violation, but not to exceed $50,000

10 in the aggregate for multiple violations; or

11 (3) in a case in which the Office finds that such

12 violations have occurred with such frequency as to

13 constitute a general business practice, to a civil pen14 alty of not more than $100,000.

15 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

16 Section 1128A of the Social Security Act, other than sub17 sections (a) and (b) and the second sentence of subsection

18 (f) of that section, shall apply to the imposition of a civil,

19 monetary, or exclusionary penalty under this section in the

20 same manner as such provisions apply with respect to the

21 imposition of a penalty under section 1128A of such Act.

22 SEC. 322. PROCEDURES FOR IMPOSITION OF PENALTIES.

23 (a) INITIATION OF PROCEEDINGS.—

24 (1) IN GENERAL.—The director of the Office of

25 Health Information Privacy, in consultation with the
66

•S 1368 IS

1 Attorney General, may initiate a proceeding to de2 termine whether to impose a civil money penalty

3 under section 321. The director may not initiate an

4 action under this section with respect to any viola5 tion described in section 321 after the expiration of

6 the 6-year period beginning on the date on which

7 such violation was alleged to have occurred. The di8 rector may initiate an action under this section by

9 serving notice of the action in any manner author10 ized by Rule 4 of the Federal Rules of Civil Proce11 dure.

12 (2) NOTICE AND OPPORTUNITY FOR HEAR13 ING.—The director of the Office of Health Informa14 tion Privacy shall not make a determination adverse

15 to any person under paragraph (1) until the person

16 has been given written notice and an opportunity for

17 the determination to be made on the record after a

18 hearing at which the person is entitled to be rep19 resented by counsel, to present witnesses, and to

20 cross-examine witnesses against the person.

21 (3) ESTOPPEL.—In a proceeding under para22 graph (1) that—

23 (A) is against a person who has been con24 victed (whether upon a verdict after trial or

25 upon a plea of guilty or nolo contendere) of a
67

•S 1368 IS

1 crime under section 2801 of title 18, United

2 States Code; and

3 (B) involves the same conduct as in the

4 criminal action;

5 the person is estopped from denying the essential

6 elements of the criminal offense.

7 (4) SANCTIONS FOR FAILURE TO COMPLY.—

8 The official conducting a hearing under this section

9 may sanction a person, including any party or attor10 ney, for failing to comply with an order or proce11 dure, failing to defend an action, or other mis12 conduct as would interfere with the speedy, orderly,

13 or fair conduct of the hearing. Such sanction shall

14 reasonably relate to the severity and nature of the

15 failure or misconduct. Such sanction may include—

16 (A) in the case of refusal to provide or per17 mit discovery, drawing negative factual infer18 ences or treating such refusal as an admission

19 by deeming the matter, or certain facts, to be

20 established;

21 (B) prohibiting a party from introducing

22 certain evidence or otherwise supporting a par23 ticular claim or defense;

24 (C) striking pleadings, in whole or in part;

25 (D) staying the proceedings;
68

•S 1368 IS

1 (E) dismissal of the action;

2 (F) entering a default judgment;

3 (G) ordering the party or attorney to pay

4 attorneys’ fees and other costs caused by the

5 failure or misconduct; and

6 (H) refusing to consider any motion or

7 other action which is not filed in a timely man8 ner.

9 (b) SCOPE OF PENALTY.—In determining the

10 amount or scope of any penalty imposed pursuant to sec11 tion 321, the director of the Office of Health Information

12 Privacy shall take into account—

13 (1) the nature of claims and the circumstances

14 under which they were presented;

15 (2) the degree of culpability, history of prior of16 fenses, and financial condition of the person present17 ing the claims; and

18 (3) such other matters as justice may require.

19 (c) REVIEW OF DETERMINATION.—

20 (1) IN GENERAL.—Any person adversely af21 fected by a determination of the director of the Of22 fice of Health Information Privacy under this sec23 tion may obtain a review of such determination in

24 the United States Court of Appeals for the circuit

25 in which the person resides, or in which the claim
69

•S 1368 IS

1 was presented, by filing in such court (within 60

2 days following the date the person is notified of the

3 determination of the director) a written petition re4 questing that the determination be modified or set

5 aside.

6 (2) FILING OF RECORD.—A copy of the petition

7 filed under paragraph (1) shall be forthwith trans8 mitted by the clerk of the court to the director of

9 the Office of Health Information Privacy, and there10 upon the director shall file in the Court the record

11 in the proceeding as provided in section 2112 of title

12 28, United States Code. Upon such filing, the court

13 shall have jurisdiction of the proceeding and of the

14 question determined therein, and shall have the

15 power to make and enter upon the pleadings, testi16 mony, and proceedings set forth in such record a de17 cree affirming, modifying, remanding for further

18 consideration, or setting aside, in whole or in part,

19 the determination of the director and enforcing the

20 same to the extent that such order is affirmed or

21 modified.

22 (3) CONSIDERATION OF OBJECTIONS.—No ob23 jection that has not been raised before the director

24 of the Office of Health Information Privacy with re25 spect to a determination described in paragraph (1)
70

•S 1368 IS

1 shall be considered by the court, unless the failure

2 or neglect to raise such objection shall be excused

3 because of extraordinary circumstances.

4 (4) FINDINGS.—The findings of the director of

5 the Office of Health Information Privacy with re6 spect to questions of fact in an action under this

7 subsection, if supported by substantial evidence on

8 the record considered as a whole, shall be conclusive.

9 If any party shall apply to the court for leave to ad10 duce additional evidence and shall show to the satis11 faction of the court that such additional evidence is

12 material and that there were reasonable grounds for

13 the failure to adduce such evidence in the hearing

14 before the director, the court may order such addi15 tional evidence to be taken before the director and

16 to be made a part of the record. The director may

17 modify findings as to the facts, or make new find18 ings, by reason of additional evidence so taken and

19 filed, and shall file with the court such modified or

20 new findings, and such findings with respect to

21 questions of fact, if supported by substantial evi22 dence on the record considered as a whole, and the

23 recommendations of the director, if any, for the

24 modification or setting aside of the original order,

25 shall be conclusive.
71

•S 1368 IS

1 (5) EXCLUSIVE JURISDICTION.—Upon the filing

2 of the record with the court under paragraph (2),

3 the jurisdiction of the court shall be exclusive and its

4 judgment and decree shall be final, except that the

5 same shall be subject to review by the Supreme

6 Court of the United States, as provided for in sec7 tion 1254 of title 28, United States Code.

8 (d) RECOVERY OF PENALTIES.—

9 (1) IN GENERAL.—Civil money penalties im10 posed under this chapter may be compromised by

11 the director of the Office of Health Information Pri12 vacy and may be recovered in a civil action in the

13 name of the United States brought in United States

14 district court for the district where the claim was

15 presented, or where the claimant resides, as deter16 mined by the director. Amounts recovered under this

17 section shall be paid to the director and deposited as

18 miscellaneous receipts of the Treasury of the United

19 States.

20 (2) DEDUCTION FROM AMOUNTS OWING.—The

21 amount of any penalty, when finally determined

22 under this section, or the amount agreed upon in

23 compromise under paragraph (1), may be deducted

24 from any sum then or later owing by the United
72

•S 1368 IS

1 States or a State to the person against whom the

2 penalty has been assessed.

3 (e) DETERMINATION FINAL.—A determination by

4 the director of the Office of Health Information Privacy

5 to impose a penalty under section 321 shall be final upon

6 the expiration of the 60-day period referred to in sub7 section (c)(1). Matters that were raised or that could have

8 been raised in a hearing before the director or in an appeal

9 pursuant to subsection (c) may not be raised as a defense

10 to a civil action by the United States to collect a penalty

11 under section 321.

12 (f) SUBPOENA AUTHORITY.—

13 (1) IN GENERAL.—For the purpose of any

14 hearing, investigation, or other proceeding author15 ized or directed under this section, or relative to any

16 other matter within the jurisdiction of the Attorney

17 General hereunder, the Attorney General, acting

18 through the director of the Office of Health Infor19 mation Privacy shall have the power to issue subpoe20 nas requiring the attendance and testimony of wit21 nesses and the production of any evidence that re22 lates to any matter under investigation or in ques23 tion before the director. Such attendance of wit24 nesses and production of evidence at the designated

25 place of such hearing, investigation, or other pro-
73

•S 1368 IS

1 ceeding may be required from any place in the Unit2 ed States or in any Territory or possession thereof.

3 (2) SERVICE.—Subpoenas of the director under

4 paragraph (1) shall be served by anyone authorized

5 by the director by delivering a copy thereof to the

6 individual named therein.

7 (3) PROOF OF SERVICE.—A verified return by

8 the individual serving the subpoena under this sub9 section setting forth the manner of service shall be

10 proof of service.

11 (4) FEES.—Witnesses subpoenaed under this

12 subsection shall be paid the same fees and mileage

13 as are paid witnesses in the district court of the

14 United States.

15 (5) REFUSAL TO OBEY.—In case of contumacy

16 by, or refusal to obey a subpoena duly served upon,

17 any person, any district court of the United States

18 for the judicial district in which such person charged

19 with contumacy or refusal to obey is found or re20 sides or transacts business, upon application by the

21 director of the Office of Health Information Privacy,

22 shall have jurisdiction to issue an order requiring

23 such person to appear and give testimony, or to ap24 pear and produce evidence, or both. Any failure to
74

•S 1368 IS

1 obey such order of the court may be punished by the

2 court as contempt thereof.

3 (g) INJUNCTIVE RELIEF.—Whenever the director of

4 the Office of Health Information Privacy has reason to

5 believe that any person has engaged, is engaging, or is

6 about to engage in any activity which makes the person

7 subject to a civil monetary penalty under section 321, the

8 director may bring an action in an appropriate district

9 court of the United States (or, if applicable, a United

10 States court of any territory) to enjoin such activity, or

11 to enjoin the person from concealing, removing, encumber12 ing, or disposing of assets which may be required in order

13 to pay a civil monetary penalty if any such penalty were

14 to be imposed or to seek other appropriate relief.

15 (h) AGENCY.—A principal is liable for penalties

16 under section 321 for the actions of the principal’s agent

17 acting within the scope of the agency.

18 SEC. 323. CIVIL ACTION BY INDIVIDUALS.

19 (a) IN GENERAL.—Any individual whose rights under

20 this Act have been knowingly or negligently violated may

21 bring a civil action to recover—

22 (1) such preliminary and equitable relief as the

23 court determines to be appropriate; and

24 (2) the greater of compensatory damages or liq25 uidated damages of $5,000.
75

•S 1368 IS

1 (b) PUNITIVE DAMAGES.—In any action brought

2 under this section in which the individual has prevailed

3 because of a knowing violation of a provision of this Act,

4 the court may, in addition to any relief awarded under

5 subsection (a), award such punitive damages as may be

6 warranted.

7 (c) ATTORNEY’S FEES.—In the case of a civil action

8 brought under subsection (a) in which the individual has

9 substantially prevailed, the court may assess against the

10 respondent a reasonable attorney’s fee and other litigation

11 costs and expenses (including expert fees) reasonably in12 curred.

13 (d) LIMITATION.—No action may be commenced

14 under this section more than 3 years after the date on

15 which the violation was or should reasonably have been

16 discovered.

17 TITLE IV—MISCELLANEOUS

18 SEC. 401. RELATIONSHIP TO OTHER LAWS.

19 (a) FEDERAL AND STATE LAWS.—Nothing in this

20 Act shall be construed as preempting, superseding or re21 pealing, explicitly or implicitly, other Federal or State laws

22 or regulations relating to protected health information or

23 relating to an individual’s access to protected health infor24 mation or health care services if such laws or regulations

25 provide protections for the rights of individuals to the pri-
76

•S 1368 IS

1 vacy of, and access to, their health information that are

2 greater than those provided for in this Act.

3 (b) PRIVILEGES.—Nothing in this Act shall be con4 strued to preempt or modify any provisions of State statu5 tory or common law to the extent that such law concerns

6 a privilege of a witness or person in a court of that State.

7 This Act shall not be construed to supersede or modify

8 any provision of Federal statutory or common law to the

9 extent such law concerns a privilege of a witness or person

10 in a court of the United States. Authorizations pursuant

11 to section 202 shall not be construed as a waiver of any

12 such privilege.

13 (c) CERTAIN DUTIES UNDER LAW.—Nothing in this

14 Act shall be construed to preempt, supersede, or modify

15 the operation of any State law that—

16 (1) provides for the reporting of vital statistics

17 such as birth or death information;

18 (2) requires the reporting of abuse or neglect

19 information about any individual;

20 (3) regulates the disclosure or reporting of in21 formation concerning an individual’s mental health

22 or communicable disease status otherwise permis23 sible under this Act; or

24 (4) governs a minor’s rights to access protected

25 health information or health care services.
77

•S 1368 IS

1 (d) FEDERAL PRIVACY ACT.—

2 (1) MEDICAL EXEMPTIONS.—Section 552a of

3 title 5, United States Code, is amended by adding

4 at the end thereof the following: ‘‘The head of an

5 agency that is a health care provider, health plan,

6 health oversight agency, employer, insurer, health or

7 life insurer, school or university, or person who re8 ceives protected health information under section

9 211 of the Medical Information Privacy and Security

10 Act shall promulgate rules, in accordance with the

11 requirements (including general notice) of sub12 sections (b)(1), (b)(2), (b)(3), (c), (e) of section 553

13 of this title, to exempt a system of records within

14 the agency, to the extent that the system of records

15 contains protected health information (as defined in

16 section 4(19) of such Act), from all provisions of

17 this section except subsections (b)(6), (d), (e)(1),

18 (e)(2), subparagraphs (A) through (C) and (E)

19 through (I) of subsection (e)(4), and subsections

20 (e)(5), (e)(6), (e)(9), (e)(12), (l), (n), (o), (p), , (r),

21 and (u).’’.

22 (2) TECHNICAL AMENDMENT.—Section

23 552a(f)(3) of title 5, United States Code, is amend24 ed by striking ‘‘pertaining to him,’’ and all that fol-
78

•S 1368 IS

1 lows through the semicolon and inserting ‘‘pertain2 ing to the individual.’’

3 (e) CONSTITUTION.—Nothing in this Act shall be

4 construed to alter, diminish, or otherwise weaken existing

5 legal standards under the Constitution regarding the con6 fidentiality of protected health information.

7 SEC. 402. EFFECTIVE DATE.

8 (a) EFFECTIVE DATE.—Unless specifically provided

9 for otherwise, this Act shall take effect on the date that

10 is 12 months after the promulgation of the regulations re11 quired under subsection (b) but in no event later than the

12 date that is 30 months after the date of enactment of this

13 Act or 6 months after the promulgation of such regula14 tions, whichever is earlier.

15 (b) REGULATIONS.—Not later than 12 months after

16 the date of enactment of this Act, or as specifically pro17 vided for otherwise, the director of the Office of Health

18 Information Privacy shall promulgate regulations imple19 menting this Act.

Æ