II

105TH CONGRESS

2D SESSION S. 1921

To ensure confidentiality with respect to medical records and health carerelated information, and for other purposes.

IN THE SENATE OF THE UNITED STATES

APRIL 2, 1998

Mr. JEFFORDS (for himself and Mr. DODD) introduced the following bill;

which was read twice and referred to the Committee on Labor and

Human Resources

A BILL

To ensure confidentiality with respect to medical records

and health care-related information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Health Care Personal Information Nondisclosure Act of

6 1998’’ or the ‘‘Health Care PIN Act’’.

7 (b) TABLE OF CONTENTS.—The table of contents for

8 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings.

Sec. 3. Purposes.

Sec. 4. Definitions.
2

•S 1921 IS

TITLE I—INDIVIDUAL’S RIGHTS

Subtitle A—Review of Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Amendment of protected health information.

Sec. 103. Notice of confidentiality practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Sec. 201. General rules regarding use and disclosure.

Sec. 202. Procurement of authorizations for disclosure of protected health information for treatment, payment, or health care operations.

Sec. 203. Authorizations for disclosure of protected health information other

than for treatment, payment, or health care operations.

Sec. 204. Next of kin and directory information.

Sec. 205. Emergency circumstances.

Sec. 206. Oversight.

Sec. 207. Public health.

Sec. 208. Health research.

Sec. 209. Disclosure in civil, judicial, and administrative procedures.

Sec. 210. Disclosure for law enforcement purposes.

Sec. 211. Disclosures for postmarketing adverse experience reporting for

human drug and licensed biological products.

Sec. 212. Payment card and electronic payment transaction.

Sec. 213. Standards for electronic disclosures.

Sec. 214. Individual representatives.

Sec. 215. Limited liability for law enforcement officers.

Sec. 216. No liability for permissible disclosures.

TITLE III—SANCTIONS

Subtitle A—Criminal Provisions

Sec. 301. Wrongful disclosure of protected health information.

Sec. 302. Debarment for crimes.

Subtitle B—Civil Sanctions

Sec. 311. Civil penalty.

Sec. 312. Procedures for imposition of penalties.

Sec. 313. Report on use of existing enforcement mechanisms.

Sec. 314. Civil action by individuals.

TITLE IV—MISCELLANEOUS

Sec. 401. Relationship to other laws.

Sec. 402. Study by GAO.

Sec. 403. Effective date.
3

•S 1921 IS

1 SEC. 2. FINDINGS.

2 The Congress finds that—

3 (1) individuals have a right of confidentiality

4 with respect to their personal health information and

5 records;

6 (2) with respect to information about medical

7 care and health status, the traditional right of con8 fidentiality is at risk;

9 (3) an erosion of the right of confidentiality

10 may reduce the willingness of patients to confide in

11 physicians and other practitioners, thus jeopardizing

12 quality health care;

13 (4) an individual’s confidentiality right means

14 that an individual’s consent is needed to disclose his

15 or her protected health information, except in rare

16 and limited circumstances required by the public in17 terest;

18 (5) any disclosure of protected health informa19 tion should be limited to that information or portion

20 of the medical record necessary to fulfill the purpose

21 of the disclosure;

22 (6) incentives need to be created to use non23 identifiable health information where appropriate;

24 (7) the availability of timely and accurate per25 sonal health data for the delivery of health care serv26 ices throughout the Nation is needed;
4

•S 1921 IS

1 (8) personal health care data may be essential

2 for selected types of medical research;

3 (9) public health uses of personal health data

4 are critical to both personal health as well as public

5 health; and

6 (10) confidentiality of an individual’s health in7 formation must be assured without jeopardizing the

8 pursuit of clinical and epidemiological research un9 dertaken to improve health care and health outcomes

10 and to assure the quality and efficiency of health

11 care.

12 SEC. 3. PURPOSES.

13 The purpose of this Act is to—

14 (1) establish strong and effective mechanisms

15 to protect against the unauthorized and inappropri16 ate use of protected health information that is cre17 ated or maintained as part of health care treatment,

18 diagnosis, enrollment, payment, plan administration,

19 testing, or research processes;

20 (2) promote the efficiency and security of the

21 health information infrastructure so that members

22 of the health care community may more effectively

23 exchange and transfer health information in a man24 ner that will ensure the confidentiality of protected
5

•S 1921 IS

1 health information without impeding the delivery of

2 high quality health care;

3 (3) create incentives to turn personal health in4 formation into nonidentifiable health information for

5 oversight, health research, public health, law en6 forcement, judicial, and administrative purposes,

7 where appropriate; and

8 (4) establish strong and effective remedies for

9 violations of this Act.

10 SEC. 4. DEFINITIONS.

11 As used in this Act:

12 (1) ACCREDITING BODY.—The term ‘‘accredit13 ing body’’ means a national body, committee, organi14 zation, or institution (such as the Joint Commission

15 on Accreditation of Health Care Organizations or

16 the National Committee for Quality Assurance) that

17 has been authorized by law or is recognized by a

18 health care regulating authority as an accrediting

19 entity or any other entity that has been similarly au20 thorized or recognized by law to perform specific ac21 creditation, licensing or credentialing activities.

22 (2) AGENT.—The term ‘‘agent’’ means a person

23 who represents and acts for another under the con24 tract or relation of agency, or whose function is to

25 bring about, modify, affect, accept performance of,
6

•S 1921 IS

1 or terminate contractual obligations between the

2 principal and a third person, including a contractor.

3 (3) ANONYMOUS LINK.—

4 (A) IN GENERAL.—The term ‘‘anonymous

5 link’’ means a number assigned to nonidentifi6 able health information which, by itself, con7 tains no information about an individual, but

8 which, under specific, controlled conditions, can

9 be used to link to additional health information

10 about the same individual which may be used to

11 identify that individual.

12 (B) DISCLOSURE.—Any subsequent disclo13 sure of an anonymous link with any information

14 which, together with information previously dis15 closed with the same link might reasonably be

16 used to identify an individual, shall be consid17 ered to be a disclosure of protected health infor18 mation. Such a disclosure shall convert any pre19 viously disclosed, nonidentifiable information

20 with the same link into protected health infor21 mation.

22 (4) COMMON RULE.—The term ‘‘common rule’’

23 means the Federal policy for the protection of

24 human subjects from research risks originally pub25 lished as 56 Federal Register 28.012 (et seq) (June
7

•S 1921 IS

1 18, 1991) as adopted and implemented by a Federal

2 department or agency.

3 (5) DISCLOSE.—The term ‘‘disclose’’ means to

4 release, transfer, provide access to, or otherwise di5 vulge protected health information to any person

6 other than the individual who is the subject of such

7 information. Such term includes the initial disclosure

8 and any subsequent redisclosures of protected health

9 information.

10 (6) EMPLOYER.—The term ‘‘employer’’ has the

11 meaning given such term under section 3(5) of the

12 Employee Retirement Income Security Act of 1974

13 (29 U.S.C. 1002(5)), except that such term shall in14 clude only employers of two or more employees.

15 (7) HEALTH CARE.—The term ‘‘health care’’

16 means—

17 (A) preventive, diagnostic, therapeutic, re18 habilitative, maintenance, or palliative care, in19 cluding appropriate assistance with disease or

20 symptom management and maintenance, coun21 seling, service, or procedure—

22 (i) with respect to the physical or

23 mental condition of an individual; or

24 (ii) affecting the structure or function

25 of the human body or any part of the
8

•S 1921 IS

1 human body, including the banking of

2 blood, sperm, organs, or any other tissue;

3 or

4 (B) pursuant to a prescription or medical

5 order any sale or dispensing of a drug, device,

6 equipment, or other health care related item to

7 an individual, or for the use of an individual.

8 (8) HEALTH CARE OPERATIONS.—The term

9 ‘‘health care operations’’ means services provided by

10 or on behalf of a health plan or health care provider

11 for the purpose of carrying out the management

12 functions of a health care provider or health plan, or

13 implementing the terms of a contract for health plan

14 benefits, including—

15 (A) conducting quality assurance activities

16 or outcomes assessments;

17 (B) reviewing the competence or qualifica18 tions of health care professionals;

19 (C) performing accreditation, licensing, or

20 credentialing activities;

21 (D) analysis of health plan claims or

22 health care records data;

23 (E) evaluating health plan and provider

24 performance;
9

•S 1921 IS

1 (F) carrying out utilization review,

2 precertification or preauthorization of services;

3 (G) underwriting or experience rating of

4 health plans; or

5 (H) conducting or arranging for auditing

6 services.

7 (9) HEALTH CARE PROVIDER.—The term

8 ‘‘health care provider’’ means a person, who with re9 spect to a specific item of protected health informa10 tion, receives, creates, uses, maintains, or discloses

11 the information while acting in whole or in part in

12 the capacity of—

13 (A) a person who is licensed, certified, reg14 istered, or otherwise authorized by Federal or

15 State law to provide an item or service that

16 constitutes health care in the ordinary course of

17 business, or practice of a profession;

18 (B) a Federal, State, or employer spon19 sored program that directly provides items or

20 services that constitute health care to bene21 ficiaries; or

22 (C) an officer, employee, or agent of a per23 son described in subparagraph (A) or (B).

24 (10) HEALTH OR LIFE INSURER.—The term

25 ‘‘health or life insurer’’ means a health insurance
10

•S 1921 IS

1 issuer as defined in section 9805(b)(2) of the Inter2 nal Revenue Code of 1986 or a life insurance com3 pany as defined in section 816 of such Code.

4 (11) HEALTH OVERSIGHT AGENCY.—The term

5 ‘‘health oversight agency’’ means a person who, with

6 respect to a specific item of protected health infor7 mation, receives, creates, uses, maintains, or dis8 closes the information while acting in whole or in

9 part in the capacity of—

10 (A) a person who performs or oversees the

11 performance of an assessment, evaluation, de12 termination, or investigation, relating to the li13 censing, accreditation, or credentialing of health

14 care providers; or

15 (B) a person who—

16 (i) performs or oversees the perform17 ance of an audit, assessment, evaluation,

18 determination, or investigation relating to

19 the effectiveness of, compliance with, or

20 applicability of, legal, fiscal, medical, or

21 scientific standards or aspects of perform22 ance related to the delivery of, or payment

23 for, health care; and

24 (ii) is a public agency, acting on be25 half of a public agency, acting pursuant to
11

•S 1921 IS

1 a requirement of a public agency, or carry2 ing out activities under a Federal or State

3 law governing the assessment, evaluation,

4 determination, investigation, or prosecution

5 described in subparagraph (A).

6 (12) HEALTH PLAN.—The term ‘‘health plan’’

7 means any health insurance plan, including any hos8 pital or medical service plan, dental or other health

9 service plan or health maintenance organization

10 plan, provider sponsored organization, or other pro11 gram providing or arranging for the provision of

12 health benefits, whether or not funded through the

13 purchase of insurance.

14 (13) HEALTH RESEARCHER.—The term ‘‘health

15 researcher’’ means a person, or an officer, employee

16 or independent contractor of a person, who receives

17 protected health information as part of a systematic

18 investigation, testing or evaluation designed to de19 velop or contribute to generalized scientific and clini20 cal knowledge.

21 (14) INDIVIDUAL REPRESENTATIVE.—The term

22 ‘‘individual representative’’ means a person who is

23 authorized by law (based on grounds other than the

24 individual being a minor), or by an instrument rec25 ognized under law, to act as an agent, attorney,
12

•S 1921 IS

1 proxy, or other legal representative of a protected

2 individual. Such term includes a health care power

3 of attorney.

4 (15) INSTITUTIONAL REVIEW BOARD.—The

5 term ‘‘institutional review board’’ means a review

6 panel, that is generally associated with a particular

7 university or other research institution, that is re8 sponsible for implementing Federal human subject

9 protection requirements for research conducted at or

10 supported by the university or institution involved.

11 (16) LAW ENFORCEMENT INQUIRY.—The term

12 ‘‘law enforcement inquiry’’ means a lawful investiga13 tion conducted by an appropriate government agency

14 or official inquiring into a violation of, or failure to

15 comply with, any criminal or civil statute or any reg16 ulation, rule, or order issued pursuant to such a

17 statute.

18 (17) NETWORK PLAN.—The term ‘‘network

19 plan’’ means health care coverage provided under a

20 health plan under which the financing and delivery

21 of health care are provided, in whole or in part,

22 through a defined set of health care providers under

23 contract with the health plan.

24 (18) NONIDENTIFIABLE HEALTH INFORMA25 TION.—The term ‘‘nonidentifiable health informa-
13

•S 1921 IS

1 tion’’ means any information that would otherwise

2 be protected health information except that such in3 formation does not reveal the identity of the individ4 ual whose health or health care is the subject of the

5 information and there is no reasonable basis to be6 lieve that such information could be used, either

7 alone or with other information that is, or should

8 reasonably be known to be, available to predictable

9 recipients of such information, to reveal the identity

10 of that individual.

11 (19) ORIGINATING PROVIDER.—The term ‘‘orig12 inating provider’’ means a health care provider who

13 creates or originates medical information that is or

14 that becomes protected health information.

15 (20) PAYMENT.—The term ‘‘payment’’

16 means—

17 (A) the activities undertaken by—

18 (i) or on behalf of a health plan to de19 termine its responsibility for coverage

20 under the plan and the actual payment

21 under such plan; and

22 (ii) a health care provider to obtain

23 payment for items or services provided

24 under a health plan or provided based on

25 a determination by the health plan of re-
14

•S 1921 IS

1 sponsibility for coverage under the plan;

2 and

3 (B) activities undertaken as described in

4 subparagraph (A) including—

5 (i) billing, claims management, medi6 cal data processing or other administrative

7 services;

8 (ii) determinations of coverage or ad9 judication of health benefit claims; and

10 (iii) review of health care services with

11 respect to medical necessity, coverage

12 under a health plan, appropriateness of

13 care, or justification of charges.

14 (21) PERSON.—The term ‘‘person’’ means a

15 government, governmental subdivision, agency or au16 thority; corporation; company; association; firm;

17 partnership; society; estate; trust; joint venture; indi18 vidual; individual representative; tribal government;

19 and any other legal entity.

20 (22) PROTECTED HEALTH INFORMATION.—The

21 term ‘‘protected health information’’ means any in22 formation (including demographic information)

23 whether or not recorded in any form or medium—

24 (A) that relates to the past, present or fu25 ture—
15

•S 1921 IS

1 (i) physical or mental health or condi2 tion of an individual (including the condi3 tion or other attributes of individual cells

4 or their components);

5 (ii) provision of health care to an indi6 vidual; or

7 (iii) payment for the provision of

8 health care to an individual;

9 (B) that is created by a health care pro10 vider, health plan, health researcher, health

11 oversight agency, public health authority, em12 ployer, law enforcement official, health or life

13 insurer, school or university; and

14 (C) that is not nonidentifiable health infor15 mation.

16 (23) PUBLIC HEALTH AUTHORITY.—The term

17 ‘‘public health authority’’ means an authority or in18 strumentality of the United States, a tribal govern19 ment, a State, or a political subdivision of a State

20 that is—

21 (A) primarily responsible for public health

22 matters; and

23 (B) primarily engaged in activities such as

24 injury reporting, public health surveillance, and

25 public health investigation or intervention.
16

•S 1921 IS

1 (24) SCHOOL OR UNIVERSITY.—The term

2 ‘‘school or university’’ means an institution or place

3 for instruction or education, including an elementary

4 school, secondary school, or institution of higher

5 learning, a college, or an assemblage of colleges

6 united under one corporate organization or govern7 ment.

8 (25) SECRETARY.—The term ‘‘Secretary’’

9 means the Secretary of Health and Human Services.

10 (26) STATE.—The term ‘‘State’’ includes the

11 District of Columbia, Puerto Rico, the Virgin Is12 lands, Guam, American Samoa, and the Northern

13 Mariana Islands.

14 (27) TREATMENT.—The term ‘‘treatment’’

15 means the provision of health care by, or the coordi16 nation of health care among, health care providers,

17 or the referral of a patient from one provider to an18 other, or coordination of health care or other serv19 ices among health care providers and third parties

20 authorized by the health plan or the plan member.

21 (28) WRITING.—The term ‘‘writing’’ means

22 writing in either a paper-based or computer-based

23 form, including electronic signatures.
17

•S 1921 IS

1 TITLE I—INDIVIDUAL’S RIGHTS

2 Subtitle A—Review of Protected

3 Health Information by Subjects

4 of the Information

5 SEC. 101. INSPECTION AND COPYING OF PROTECTED

6 HEALTH INFORMATION.

7 (a) IN GENERAL.—At the request of an individual

8 and except as provided in subsection (b), a health care

9 provider, health plan, employer, health or life insurer,

10 school, or university shall permit an individual who is the

11 subject of protected health information or the individual’s

12 designee, to inspect and copy protected health information

13 concerning the individual, including records created under

14 section 102, that such entity maintains. The entity may

15 set forth appropriate procedures to be followed for such

16 inspection or copying and may require an individual to pay

17 reasonable costs associated with such inspection or copy18 ing.

19 (b) EXCEPTIONS.—Unless ordered by a court of com20 petent jurisdiction, an entity described in subsection (a)

21 is not required to permit the inspection or copying of pro22 tected health information if any of the following conditions

23 are met:

24 (1) ENDANGERMENT TO LIFE OR SAFETY.—

25 The entity determines that the disclosure of the in-
18

•S 1921 IS

1 formation could reasonably be expected to endanger

2 the life or physical safety of, or cause substantial

3 mental harm to, the individual who is the subject of

4 the record.

5 (2) CONFIDENTIAL SOURCE.—The information

6 identifies, or could reasonably lead to the identifica7 tion of, a person who provided information under a

8 promise of confidentiality concerning the individual

9 who is the subject of the information.

10 (3) INFORMATION COMPILED IN ANTICIPATION

11 OF LITIGATION.—The information is compiled prin12 cipally—

13 (A) in the reasonable anticipation of a

14 civil, criminal, or administrative action or pro15 ceeding; or

16 (B) for use in such action or proceeding.

17 (4) RESEARCH PURPOSES.—The information

18 was collected for or during a clinical trial monitored

19 by an institutional review board, such trial is not

20 complete, and the researcher reasonably believes that

21 access would harm the conduct of the trial.

22 (c) DENIAL OF A REQUEST FOR INSPECTION OR

23 COPYING.—If an entity described in subsection (a) denies

24 a request for inspection or copying pursuant to subsection

25 (b), the entity shall inform the individual in writing of—
19

•S 1921 IS

1 (1) the reasons for the denial of the request for

2 inspection or copying;

3 (2) any procedures for further review of the de4 nial; and

5 (3) the individual’s right to file with the entity

6 a concise statement setting forth the request for in7 spection or copying.

8 (d) STATEMENT REGARDING REQUEST.—If an indi9 vidual has filed a statement under subsection (c)(3), the

10 entity in any subsequent disclosure of the portion of the

11 information requested under subsection (a) shall include—

12 (1) a copy of the individual’s statement; and

13 (2) a concise statement of the reasons for deny14 ing the request for inspection or copying.

15 (e) INSPECTION AND COPYING OF SEGREGABLE POR16 TION.—An entity described in subsection (a) shall permit

17 the inspection and copying under subsection (a) of any

18 reasonably segregable portion of a record after deletion of

19 any portion that is exempt under subsection (b).

20 (f) DEADLINE.—An entity described in subsection (a)

21 shall comply with or deny, in accordance with subsection

22 (c), a request for inspection or copying of protected health

23 information under this section not later than 30 days after

24 the date on which the entity receives the request.
20

•S 1921 IS

1 (g) RULES GOVERNING AGENTS.—An agent of an en2 tity described in subsection (a) shall not be required to

3 provide for the inspection and copying of protected health

4 information, except where—

5 (1) the protected health information is retained

6 by the agent; and

7 (2) the agent has received in writing a request

8 from the entity involved to fulfill the requirements of

9 this section;

10 at which time such information shall be provided to the

11 requesting entity. Such requesting entity shall comply with

12 subsection (f) with respect to any such information.

13 (h) RULE OF CONSTRUCTION.—This section shall not

14 be construed to require an entity described in subsection

15 (a) to conduct a formal, informal, or other hearing or pro16 ceeding concerning a request for inspection or copying of

17 protected health information.

18 SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA19 TION.

20 (a) IN GENERAL.—Except as provided in subsection

21 (b), not later than 45 days after the date on which a

22 health care provider, health plan, employer, health or life

23 insurer, school, or university receives from an individual

24 a request in writing to amend information, and the record

25 involved is in fact inaccurate, such entity shall—
21

•S 1921 IS

1 (1) make the amendment requested;

2 (2) inform the individual of the amendment

3 that has been made; and

4 (3) make reasonable efforts to inform any per5 son to whom the unamended portion of the informa6 tion was previously disclosed, of any nontechnical

7 amendment that has been made.

8 (b) REFUSAL TO AMEND.—If an entity described in

9 subsection (a) refuses to make the amendment requested

10 under such subsection, the entity shall inform the individ11 ual in writing of—

12 (1) the reasons for the refusal to make the

13 amendment;

14 (2) any procedures for further review of the re15 fusal; and

16 (3) the individual’s right to file with the entity

17 a concise statement setting forth the requested

18 amendment and the individual’s reasons for dis19 agreeing with the refusal.

20 (c) STATEMENT OF DISAGREEMENT.—If an individ21 ual has filed a statement of disagreement under subsection

22 (b)(3), the entity involved, in any subsequent disclosure

23 of the disputed portion of the information—

24 (1) shall include a copy of the individual’s

25 statement; and
22

•S 1921 IS

1 (2) may include a concise statement of the rea2 sons for not making the requested amendment.

3 (d) RULES GOVERNING AGENTS.—The agent of an

4 entity described in subsection (a) shall not be required to

5 make amendments to protected health information, except

6 where—

7 (1) the protected health information is retained

8 by the agent; and

9 (2) the agent has been asked by such entity to

10 fulfill the requirements of this section.

11 If the agent is required to comply with this section as pro12 vided for in paragraph (2), such agent shall be subject

13 to the 45-day deadline described in subsection (a).

14 (e) REPEATED REQUESTS FOR AMENDMENTS.—If an

15 entity described in subsection (a) receives a request for

16 an amendment of information as provided for in such sub17 section and a statement of disagreement has been filed

18 pursuant to subsection (c), the entity shall inform the indi19 vidual of such filing and shall not be required to carry

20 out the procedures required under this section.

21 (f) RULES OF CONSTRUCTION.—This section shall

22 not be construed to—

23 (1) require that an entity described in sub24 section (a) conduct a formal, informal, or other
23

•S 1921 IS

1 hearing or proceeding concerning a request for an

2 amendment to protected health information; or

3 (2) require a provider to amend an individual’s

4 record as to the type, duration, or quality of treat5 ment the individual believes he or she should have

6 been provided.

7 SEC. 103. NOTICE OF CONFIDENTIALITY PRACTICES.

8 (a) PREPARATION OF WRITTEN NOTICE.—A health

9 care provider, health plan, health oversight agency, public

10 health authority, employer, health or life insurer, health

11 researcher, school, or university shall post or provide, in

12 writing and in a clear and conspicuous manner, notice of

13 the entity’s confidentiality practices, that shall include—

14 (1) a description of an individual’s rights with

15 respect to protected health information;

16 (2) the uses and disclosures of protected health

17 information authorized under this Act;

18 (3) the procedures for authorizing disclosures of

19 protected health information and for revoking such

20 authorizations;

21 (4) the procedures established by the entity for

22 the exercise of the individual’s rights; and

23 (5) the right to obtain a copy of the notice of

24 the confidentiality practices required under this Act.
24

•S 1921 IS

1 (b) MODEL NOTICE.—The Secretary, after notice

2 and opportunity for public comment, shall develop and dis3 seminate model notices of confidentiality practices. Use of

4 the model notice shall serve as an absolute defense against

5 claims of receiving inappropriate notice.

6 Subtitle B—Establishment of

7 Safeguards

8 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

9 (a) IN GENERAL.—A health care provider, health

10 plan, health oversight agency, public health authority, em11 ployer, health or life insurer, health researcher, law en12 forcement official, school, or university shall establish and

13 maintain appropriate administrative, technical, and phys14 ical safeguards to protect the confidentiality, security, ac15 curacy, and integrity of protected health information cre16 ated, received, obtained, maintained, used, transmitted, or

17 disposed of by such entity.

18 (b) REGULATIONS.—The Secretary shall have the au19 thority to promulgate regulations for the implementation

20 of subsection (a).

21 (c) RULE OF CONSTRUCTION.—Safeguards to protect

22 the security of protected health information under sub23 section (a) shall include the implementation of policies or

24 procedures to consider whether protected health informa-
25

•S 1921 IS

1 tion is essential for a use or disclosure undertaken by an

2 entity described in such subsection.

3 SEC. 112. ACCOUNTING FOR DISCLOSURES.

4 (a) IN GENERAL.—

5 (1) HEALTH RELATED ENTITIES.—Except as

6 provided in paragraph (3), a health care provider,

7 health plan, health oversight agency, public health

8 authority, employer, health or life insurer, health re9 searcher, law enforcement official, school, or univer10 sity shall establish and maintain, with respect to any

11 protected health information disclosure, a record of

12 such disclosure in accordance with regulations issued

13 by the Secretary.

14 (2) AGENT.—Except as provided in paragraph

15 (3), an agent shall maintain a record of its disclo16 sures made pursuant to sections 205 through 212.

17 (3) EXCEPTION.—A record of disclosures under

18 this subsection is not required with respect to disclo19 sures made to officers or employees of the entity

20 that maintains the record involved who, in the per21 formance of their duties, have a need for the pro22 tected health information.

23 (b) RECORD OF DISCLOSURE.—A record established

24 under subsection (a) shall be maintained for not less than

25 7 years.
26

•S 1921 IS

1 TITLE II—RESTRICTIONS ON

2 USE AND DISCLOSURE

3 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO4 SURE.

5 (a) PROHIBITION.—

6 (1) GENERAL RULE.—A health care provider,

7 health plan, health oversight agency, public health

8 authority, employer, health or life insurer, health re9 searcher, law enforcement official, school, or univer10 sity may not disclose protected health information

11 except as authorized under this title.

12 (2) RULE OF CONSTRUCTION.—Disclosure of

13 health information in the form of nonidentifiable

14 health information shall not be construed as a dis15 closure of protected health information.

16 (b) USE OR DISCLOSURE OF PROTECTED HEALTH

17 INFORMATION WITHIN AN ENTITY.—

18 (1) IN GENERAL.—An entity described in sub19 section (a) may use protected health information or

20 disclose such information within the entity if such

21 use or disclosure is made pursuant to an authoriza22 tion under section 202 or 203 and consistent with

23 the limitations under subsection (d) on the scope of

24 disclosure.
27

•S 1921 IS

1 (2) AGENTS.—Disclosure to agents of an entity

2 described in subsection (a) shall be considered as a

3 disclosure within an entity.

4 (c) DISCLOSURE BY AGENTS.—An agent who receives

5 protected health information from an entity described in

6 subsection (a) shall be subject to all rules of disclosure

7 and safeguard requirements under this title.

8 (d) SCOPE OF DISCLOSURE.—Every disclosure of

9 protected health information by an entity under this title

10 shall be limited to the information necessary to accomplish

11 the purpose for which the information is disclosed.

12 (e) NO GENERAL REQUIREMENT TO DISCLOSE.—

13 Nothing in this title permitting the disclosure of protected

14 health information shall be construed to require such dis15 closure.

16 (f) IDENTIFICATION OF DISCLOSED INFORMATION AS

17 PROTECTED INFORMATION.—Except as otherwise pro18 vided in this title, protected health information may not

19 be disclosed unless such information is clearly identified

20 as protected health information that is subject to this Act.

21 (g) CREATION OF NONIDENTIFIABLE INFORMA22 TION.—An entity described in subsection (a) may disclose

23 protected health information to an employee or agent of

24 the entity for purposes of creating nonidentifiable infor25 mation, if the entity prohibits the employee or agent of
28

•S 1921 IS

1 the entity from using or disclosing the protected health

2 information for purposes other than the sole purpose of

3 creating nonidentifiable information as specified by the en4 tity.

5 (h) DEEMED DISCLOSURES OF PROTECTED HEALTH

6 INFORMATION.—

7 (1) IN GENERAL.—Any individual or entity who

8 manipulates a nonidentifiable database in order to

9 identify an individual shall be deemed to have dis10 closed protected health information.

11 (2) DISCLOSURE OR TRANSMISSION OF AN

12 ANONYMOUS LINK.—The disclosure or transmission

13 of an anonymous link with any information which,

14 together with information previously disclosed with

15 the same link, might reasonably be used to identify

16 an individual, shall be deemed to be a disclosure of

17 protected health information. Such a disclosure shall

18 have the effect of converting any previously dis19 closed, nonidentifiable information with the same

20 link into the protected health information.
29

•S 1921 IS

1 SEC. 202. PROCUREMENT OF AUTHORIZATIONS FOR DIS2 CLOSURE OF PROTECTED HEALTH INFORMA3 TION FOR TREATMENT, PAYMENT, OR

4 HEALTH CARE OPERATIONS.

5 (a) REQUIREMENTS RELATING TO EMPLOYERS,

6 HEALTH PLANS, UNINSURED INDIVIDUALS, AND PROVID7 ERS.—

8 (1) IN GENERAL.—To meet the requirements

9 relating to the authorized disclosure of protected

10 health information under section 201, a single au11 thorization form must be secured for each individual

12 in connection with treatment, payment and health

13 care operations.

14 (2) EMPLOYERS.—Every employer offering a

15 health plan to its employees shall, at the time of,

16 and as a condition of enrollment in the health plan,

17 obtain a signed, written authorization that is a legal,

18 informed authorization concerning the use and dis19 closure of protected health information for treat20 ment, payment, or health care operations with re21 spect to each individual who is eligible to receive

22 care under the health plan.

23 (3) HEALTH PLANS.—Every health plan offer24 ing enrollment to individual or non-employer groups

25 shall, at the time of, and as a condition of enroll26 ment in the health plan, obtain a signed, written au-
30

•S 1921 IS

1 thorization that is a legal, informed authorization

2 concerning the use and disclosure of protected health

3 information with respect to each individual who is el4 igible to receive care under the plan.

5 (4) UNINSURED.—An originating provider pro6 viding health care in other than a network plan set7 ting, or providing health care to an uninsured indi8 vidual, shall obtain a signed, written authorization to

9 use protected health information in providing health

10 care or arranging for health care from other provid11 ers or seeking payment for the provision of health

12 care services.

13 (5) PROVIDERS.—Every health care provider

14 providing health care to an individual who has not

15 given the appropriate authorization under this sec16 tion shall, at the time of providing such care, obtain

17 a signed, written authorization that is a legal, in18 formed authorization concerning the use and disclo19 sure of protected health information with respect to

20 such individual.

21 (b) REQUIREMENTS FOR INDIVIDUAL AUTHORIZA22 TION.—To be valid, an authorization to disclose protected

23 health information shall—

24 (1) identify the individual involved;
31

•S 1921 IS

1 (2) describe the nature of the health care infor2 mation to be disclosed;

3 (3) identify the type of person to whom the in4 formation is to be disclosed;

5 (4) describe the purpose of the disclosure;

6 (5) be subject to revocation by the individual

7 and indicate that the authorization is valid until rev8 ocation by the individual; and

9 (6)(A) be either—

10 (i) in writing, dated, and signed by the in11 dividual; or

12 (ii) in electronic form, dated and authenti13 cated by the individual using a unique identi14 fier; and

15 (B) not have been revoked under paragraph (c).

16 (c) REVOCATION OF AUTHORIZATION.—

17 (1) IN GENERAL.—An individual may revoke in

18 writing an authorization under this section at any

19 time, unless the disclosure that is the subject of the

20 authorization is required to effectuate payment for

21 health care that has been provided to the individual

22 for which the individual has not agreed to assume fi23 nancial responsibility.

24 (2) HEALTH PLANS.—With respect to a health

25 plan, the authorization of an individual is deemed to
32

•S 1921 IS

1 be revoked at the time of the cancellation or non-re2 newal of enrollment in the health plan, except as

3 may be necessary to complete health care operations

4 and payment requirements related to the individual’s

5 period of enrollment.

6 (3) ACTIONS.—An individual may not maintain

7 an action against a person for disclosure of pro8 tected health information made in good faith reli9 ance on the individual’s authorization at the time

10 disclosure was made.

11 (d) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND

12 REVOCATIONS.—Each person collecting or storing pro13 tected health information shall maintain a record for a pe14 riod of 7 years of each authorization of an individual and

15 revocation thereof.

16 (e) NO WAIVER.— Except as provided for in this Act,

17 an authorization to disclose protected health information

18 by an individual shall not be construed as a waiver of any

19 rights that the individual has under other Federal or State

20 laws, the rules of evidence, or common law.

21 (f) RULE OF CONSTRUCTION.—Authorizations for

22 the disclosure of protected health information for treat23 ment, payment, and health care operations shall not au24 thorize the disclosure of such information by an individual

25 with the intent to sell, transfer, or use protected health
33

•S 1921 IS

1 information for commercial advantage. For such disclo2 sures a separate authorization is required under section

3 203.

4 SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO5 TECTED HEALTH INFORMATION OTHER THAN

6 FOR TREATMENT, PAYMENT, OR HEALTH

7 CARE OPERATIONS.

8 (a) WRITTEN AUTHORIZATIONS.—A health care pro9 vider, health plan, health oversight, health researcher,

10 public health authority, law enforcement official agency,

11 public health authority, employer, health or life insurer,

12 health researcher, law enforcement official, school, or uni13 versity may disclose protected health information, for pur14 poses other than those authorized under section 202, pur15 suant to an authorization executed by the individual who

16 is the subject of the information that meets the require17 ments of section 202(b). Such an authorization shall be

18 separate from an authorization provided under section

19 202.

20 (b) LIMITATION ON AUTHORIZATIONS.—An entity

21 described in section 202 may not condition the delivery

22 of treatment or payment for services on the receipt of an

23 authorization described in this section.

24 (c) REVOCATION OR AMENDMENT OF AUTHORIZA25 TION.—
34

•S 1921 IS

1 (1) IN GENERAL.—An individual may in writing

2 revoke or amend an authorization described in sub3 section (a).

4 (2) NOTICE OF REVOCATION.—An entity de5 scribed in subsection (a) that discloses protected

6 health information pursuant to an authorization that

7 has been revoked under paragraph (1) shall not be

8 subject to any liability or penalty under this title if

9 that entity had no actual or constructive notice of

10 the revocation.

11 (d) REQUIREMENT TO RELEASE PROTECTED

12 HEALTH INFORMATION TO CORONERS AND MEDICAL EX13 AMINERS.—

14 (1) IN GENERAL.—When a Coroner or Medical

15 Examiner or their duly appointed deputies seek pro16 tected health information for the purpose of inquiry

17 into and determination of, the cause, manner, and

18 circumstances of a death, the health care provider,

19 health plan, health oversight agency, public health

20 authority, employer, health or life insurer, health re21 searcher, law enforcement official, school, or univer22 sity involved shall provide the protected health infor23 mation to the Coroner or Medical Examiner or to

24 the duly appointed deputies without undue delay.
35

•S 1921 IS

1 (2) PRODUCTION OF ADDITIONAL INFORMA2 TION.—If a Coroner or Medical Examiner or their

3 duly appointed deputies receives health information

4 from an entity referred to in paragraph (1), such

5 health information shall remain as protected health

6 information unless the health information is at7 tached to or otherwise made a part of a Coroner’s

8 or Medical Examiner’s official report, in which case

9 it shall no longer be protected.

10 (3) EXEMPTION.—Health information attached

11 to or otherwise made a part of a Coroner’s or Medi12 cal Examiner’s official report, shall be exempt from

13 the provisions of this Act except as provided for in

14 this subsection.

15 (4) REIMBURSEMENT.—A Coroner or Medical

16 Examiner may require a person to reimburse their

17 Office for the reasonable costs associated with such

18 inspection or copying.

19 (e) DISCLOSURE FOR PURPOSE ONLY.—A recipient

20 of information pursuant to an authorization under this

21 section may use or disclose such information solely to

22 carry out the purpose for which the information was au23 thorized for release.

24 (f) MODEL AUTHORIZATIONS.—The Secretary, after

25 notice and opportunity for public comment, shall develop
36

•S 1921 IS

1 and disseminate model written authorizations of the type

2 described in subsection (a). Any authorization obtained on

3 a model authorization form developed by the Secretary

4 shall be deemed to meet the authorization requirements

5 of this section.

6 SEC. 204. NEXT OF KIN AND DIRECTORY INFORMATION.

7 (a) NEXT OF KIN.—A health care provider, or a per8 son who receives protected health information under sec9 tion 205, may disclose protected health information re10 garding an individual to the individual’s next of kin, an

11 individual’s representative, or to another person whom the

12 individual has identified, if—

13 (1) the individual who is the subject of the in14 formation—

15 (A) has been notified of the individual’s

16 right to object to such disclosure and the indi17 vidual has not objected to the disclosure; or

18 (B) is in a physical or mental condition

19 such that the individual is not capable of object20 ing, and there are no prior indications that the

21 individual would object;

22 (2) the information disclosed relates to health

23 care currently being provided to that individual; or
37

•S 1921 IS

1 (3) the disclosure of the protected health infor2 mation is consistent with good medical or profes3 sional practice.

4 (b) DIRECTORY INFORMATION.—

5 (1) DISCLOSURE.—

6 (A) IN GENERAL.—Except as provided in

7 paragraph (2), an entity described in subsection

8 (a) may disclose the information described in

9 subparagraph (B) to any person if the individ10 ual who is the subject of the information—

11 (i) has been notified of the individ12 ual’s right to object and the individual has

13 not objected to the disclosure; or

14 (ii) is in a physical or mental condi15 tion such that the individual is not capable

16 of objecting, the individual’s next of kin

17 has not objected, and there are no prior in18 dications that the individual would object.

19 (B) INFORMATION.—Information described

20 in this subparagraph is information that con21 sists only of 1 or more of the following items:

22 (i) The name of the individual who is

23 the subject of the information.

24 (ii) The general health status of the

25 individual, described as critical, poor, fair,
38

•S 1921 IS

1 stable, or satisfactory or in terms denoting

2 similar conditions.

3 (iii) The location of the individual on

4 premises controlled by a provider.

5 (2) EXCEPTION.—

6 (A) LOCATION.—Paragraph (1)(B)(iii)

7 shall not apply if disclosure of the location of

8 the individual would reveal specific information

9 about the physical or mental condition of the

10 individual, unless the individual expressly au11 thorizes such disclosure.

12 (B) DIRECTORY OR NEXT OF KIN INFOR13 MATION.—A disclosure may not be made under

14 this section if the health care provider involved

15 has reason to believe that the disclosure of di16 rectory or next of kin information could lead to

17 the physical or mental harm of the individual,

18 unless the individual expressly authorizes such

19 disclosure.

20 (c) IDENTIFICATION OF DECEASED INDIVIDUAL.—

21 An entity described in subsection (a) may disclose pro22 tected health information if such disclosure is necessary

23 to assist in the identification or safe handling of a de24 ceased individual.

25 (d) RIGHTS OF MINORS.—
39

•S 1921 IS

1 (1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA2 PABLE.—In the case of an individual—

3 (A) who is 18 years of age or older, all

4 rights of the individual under this title shall be

5 exercised by the individual; or

6 (B) who, acting alone, can obtain a type of

7 health care without violating any applicable

8 Federal or State law, and who has sought such

9 care, the individual shall exercise all rights of

10 the individual under this title with respect to

11 protected health information relating to such

12 health care.

13 (2) INDIVIDUALS UNDER 18.—Except as pro14 vided in paragraph (1)(B), in the case of an individ15 ual who is—

16 (A) under 14 years of age, all of the indi17 vidual’s rights under this title shall be exercised

18 through the parent or legal guardian; or

19 (B) at least 14 but under 18 years of age,

20 the rights of inspection and amendment, and

21 the right to authorize use and disclosure of pro22 tected health information of the individual shall

23 be exercised by the individual, or by the parent

24 or legal guardian of the individual.
40

•S 1921 IS

1 SEC. 205. EMERGENCY CIRCUMSTANCES.

2 Any person who creates or receives protected health

3 information under this title may disclose protected health

4 information in emergency circumstances when necessary

5 to protect the health or safety of the individual who is

6 the subject of such information from serious, imminent

7 harm. No disclosure made in the good faith belief that

8 the disclosure was necessary to protect the health or safety

9 or an individual from serious, imminent harm shall be in

10 violation of, or punishable under, this Act.

11 SEC. 206. OVERSIGHT.

12 (a) IN GENERAL.—A health care provider, health

13 plan, employer, health or life insurer, law enforcement of14 ficial, school, or university may disclose protected health

15 information to a health oversight agency for purposes of

16 an oversight function authorized by law.

17 (b) PUBLIC HEALTH AND HEALTH RESEARCH.—A

18 public health authority or health researcher may disclose

19 protected health information to a health oversight agency

20 for purposes of an oversight function of the public health

21 authority or health researcher authorized by law.

22 (c) AUTHORIZATION BY A SUPERVISOR.—For pur23 poses of this section, the individual with authority to au24 thorize the oversight function involved shall provide to the

25 entity described in subsection (a) or (b) a statement that
41

•S 1921 IS

1 the protected health information is being sought for a le2 gally authorized oversight function.

3 (d) USE IN ACTION AGAINST INDIVIDUALS.—Pro4 tected health information about an individual that is dis5 closed under this section may not be used in, or disclosed

6 to any person for use in, an administrative, civil, or crimi7 nal action or investigation directed against the individual

8 unless the action or investigation arises out of and is di9 rectly related to—

10 (1) the receipt of health care or payment for

11 health care;

12 (2) an action involving a fraudulent claim relat13 ed to health; or

14 (3) an action involving oversight of a public

15 health authority or a health researcher.

16 SEC. 207. PUBLIC HEALTH.

17 A health care provider, health plan, public health au18 thority, employer, health or life insurer, law enforcement

19 official, school, or university may disclose protected health

20 information to a public health authority or other person

21 authorized by law for use in a legally authorized—

22 (1) disease or injury report;

23 (2) public health surveillance; or

24 (3) public health investigation or intervention.
42

•S 1921 IS

1 SEC. 208. HEALTH RESEARCH.

2 (a) IN GENERAL.—A health care provider, health

3 plan, public health authority, employer, health or life in4 surer, school, or university may disclose protected health

5 information to a health researcher if—

6 (1) the research involves human subjects con7 ducted or supported by any Federal department or

8 agency and the researcher complies with the com9 mon rule;

10 (2) the research is a clinical investigation in11 volving human subjects and the researcher follows

12 the regulations of the Food and Drug Administra13 tion governing confidentiality procedures; or

14 (3) the research is not subject to the Federal

15 Policy for the Protection of Human Subjects.

16 (b) OBLIGATIONS OF THE RECIPIENT.—A person

17 who receives protected health information pursuant to this

18 section—

19 (1) shall remove or destroy, at the earliest op20 portunity consistent with the purposes of the project

21 involved, information that would enable an individual

22 to be identified, unless—

23 (A) an institutional review board has de24 termined that there is a health or research jus25 tification for the retention of such identifiers;

26 and
43

•S 1921 IS

1 (B) there is an adequate plan to protect

2 the identifiers from disclosure consistent with

3 this section; and

4 (2) may disclose or use the protected health in5 formation solely for the purposes of the health re6 search project for which such information was ob7 tained, except that the health researcher may also

8 disclose such information pursuant to sections 205

9 and 206(b).

10 (c) PERIODIC REVIEW AND TECHNICAL ASSIST11 ANCE.—

12 (1) INSTITUTIONAL REVIEW BOARD.—Any in13 stitutional review board that authorizes research

14 under this section shall keep records of the names

15 and addresses of all members who participate in

16 such authorizations for possible review or audit.

17 (2) TECHNICAL ASSISTANCE.—The Secretary

18 may provide technical assistance to institutional re19 view boards described in this section.

20 (3) MONITORING.—The Secretary shall periodi21 cally monitor institutional review boards described in

22 this section.

23 (4) REPORTS.—Not later than 3 years after the

24 date of enactment of this Act, the Secretary shall re-
44

•S 1921 IS

1 port to Congress regarding the activities of institu2 tional review boards described in this section.

3 (d) RECOMMENDATIONS WITH RESPECT TO PRI4 VACY.—

5 (1) IN GENERAL.—Not later than the date that

6 is 12 months after the date of the enactment of this

7 Act, the Secretary shall submit to the Committee on

8 Labor and Human Resources of the Senate detailed

9 recommendations on standards with respect to the

10 privacy of individually identifiable health information

11 in research described in subsection (a)(3).

12 (2) RULE OF CONSTRUCTION.—In formulating

13 the recommendations under paragraph (1), the Sec14 retary shall consider the findings of the National

15 Bioethics Advisory Commission and the results of

16 the General Accounting Office report authorized by

17 section 402.

18 (3) REGULATIONS.—If legislation governing

19 standards with respect to the privacy of individually

20 identifiable health information transmitted in con21 nection with research described in subsection (a)(3)

22 is not enacted by the date that is 24 months after

23 the date of the enactment of this Act, the Secretary

24 shall promulgate final regulations containing such
45

•S 1921 IS

1 standards not later than the date that is 30 months

2 after the date of the enactment of this Act.

3 (e) PERIODIC REVIEW AND TECHNICAL ASSIST4 ANCE.—

5 (1) INSTITUTIONAL REVIEW BOARD.—Any in6 stitutional review board that authorizes research

7 under this section shall keep records of the names

8 and addresses of all members who participate in

9 such authorizations for possible review or audit.

10 (2) TECHNICAL ASSISTANCE.—The Secretary

11 may provide technical assistance to institutional re12 view boards described in this section.

13 (3) MONITORING.—The Secretary shall periodi14 cally monitor institutional review boards described in

15 this section.

16 (4) REPORTS.—Not later than 3 years after the

17 date of enactment of this Act, the Secretary shall re18 port to Congress regarding the activities of institu19 tional review boards described in this section.

20 SEC. 209. DISCLOSURE IN CIVIL, JUDICIAL, AND ADMINIS21 TRATIVE PROCEDURES.

22 (a) IN GENERAL.—A health care provider, health

23 plan, public health authority, employer, health or life in24 surer, law enforcement official, school, or university may

25 disclose protected health information pursuant to a discov-
46

•S 1921 IS

1 ery request or subpoena in a civil action brought in a Fed2 eral or State court or a request or subpoena related to

3 a Federal or State administrative proceeding, but only if

4 the disclosure is made pursuant to a court order as pro5 vided for in subsection (b).

6 (b) COURT ORDERS.—

7 (1) STANDARD FOR ISSUANCE.—In considering

8 a request for a court order regarding the disclosure

9 of protected health information under subsection (a),

10 the court shall issue such order if the court deter11 mines that without the disclosure of such informa12 tion, the person requesting the order would be im13 paired from establishing a claim or defense.

14 (2) REQUIREMENTS.—An order issued under

15 paragraph (1) shall—

16 (A) provide that the protected health infor17 mation involved is subject to court protection;

18 (B) specify to whom the information may

19 be disclosed;

20 (C) specify that such information may not

21 otherwise be disclosed or used; and

22 (D) meet any other requirements that the

23 court determines are needed to protect the con24 fidentiality of the information.
47

•S 1921 IS

1 (c) APPLICABILITY.—This section shall not apply in

2 a case in which the protected health information sought

3 under such discovery request or subpoena—

4 (1) is nonidentifiable health information;

5 (2) is related to a party to the litigation whose

6 medical condition is at issue; or

7 (3) could be disclosed under any of sections 202

8 through 208, 210, and 212.

9 (d) EFFECT OF SECTION.—This section shall not be

10 construed to supersede any grounds that may apply under

11 Federal or State law for objecting to turning over the pro12 tected health information.

13 SEC. 210. DISCLOSURE FOR LAW ENFORCEMENT PUR14 POSES.

15 (a) IN GENERAL.—A health care provider, health

16 plan, health oversight agency, employer, health or life in17 surer, school, university, or person who receives protected

18 health information pursuant to sections 203 through 208,

19 may disclose protected health information under this sec20 tion, except to a health oversight agency governed by sec21 tion 206, if the disclosure is pursuant to—

22 (1) a subpoena issued under the authority of a

23 grand jury;

24 (2) an administrative subpoena or summons or

25 judicial subpoena or warrant; or
48

•S 1921 IS

1 (3) a request otherwise authorized by State or

2 Federal law.

3 (b) PROBABLE CAUSE.—A subpoena or summons for

4 a disclosure under paragraph (1) or (2) of subsection (a)

5 shall only be issued if the law enforcement agency involved

6 shows that there is probable cause to believe that the in7 formation is relevant to a legitimate law enforcement in8 quiry.

9 (c) DESTRUCTION OR RETURN OF INFORMATION.—

10 When the matter or need for which protected health infor11 mation was disclosed to a law enforcement agency or

12 grand jury under subsection (a) has concluded, including

13 any derivative matters arising from such matter or need,

14 the law enforcement agency or grand jury shall either de15 stroy the protected health information, or return it to the

16 person from whom it was obtained.

17 (d) REDACTIONS.—To the extent practicable, and

18 consistent with the requirements of due process, a law en19 forcement agency shall redact personally identifying infor20 mation from protected health information prior to the

21 public disclosure of such protected information in a judi22 cial or administrative proceeding.

23 (e) USE OF INFORMATION.—Protected health infor24 mation obtained by a law enforcement agency pursuant
49

•S 1921 IS

1 to this section may only be used for purposes of a legiti2 mate law enforcement activity.

3 (f) EXCLUSION OF EVIDENCE.—If protected health

4 information is obtained without meeting the requirements

5 of paragraphs (1), (2), and (3) of subsection (a), any such

6 information that is unlawfully obtained shall be excluded

7 from court proceedings unless the defendant requests oth8 erwise.

9 SEC. 211. DISCLOSURES FOR POSTMARKETING ADVERSE

10 EXPERIENCE REPORTING FOR HUMAN DRUG

11 AND LICENSED BIOLOGICAL PRODUCTS.

12 (a) ADVERSE EXPERIENCE REPORTS.—

13 (1) IN GENERAL.—Pursuant to the regulations

14 of the Food and Drug Administration at sections

15 310.305, 314.80, and 600.80 of title 21, Code of

16 Federal Regulations, manufacturers, packers, and

17 distributors of approved new drug applications, ab18 breviated new drug applications, antibiotic applica19 tions, marketed prescription of drugs for human use,

20 and approved biologic product license applications

21 shall report adverse experiences in accordance with

22 such section.

23 (2) NO IDENTIFICATION OF PATIENTS.—In ac24 cordance with the August 1997 Guidance for Indus25 try of the Food and Drug Administration, patients
50

•S 1921 IS

1 shall not be identified by name or address in any re2 port described in paragraph (1). The manufacturer,

3 packer, or distributor involved shall assign a code

4 for a patient in each such report.

5 (3) NON LIABILITY UNDER ACT.—A manufac6 turer, packer, or distributor who submits an adverse

7 report in accordance with this subsection and the

8 regulations described in paragraph (1) shall not be

9 liable under this Act.

10 (b) RULE OF CONSTRUCTION.—An adverse experi11 ence report written in accordance with the regulations de12 scribed in subsection (a)(1) shall be deemed to be a disclo13 sure of non-identifiable information under this Act.

14 SEC. 212. PAYMENT CARD AND ELECTRONIC PAYMENT

15 TRANSACTION.

16 (a) PAYMENT FOR HEALTH CARE THROUGH CARD

17 OR ELECTRONIC MEANS.—If an individual pays for health

18 care by presenting a debit, credit, or other payment card

19 or account number, or by any other electronic payment

20 means, the entity receiving payment may disclose to a per21 son described in subsection (b) only such protected health

22 information about the individual as is necessary for the

23 processing of the payment transaction or the billing or col24 lection of amounts charged to, debited from, or otherwise
51

•S 1921 IS

1 paid by, the individual using the card, number, or other

2 electronic means.

3 (b) TRANSACTION PROCESSING.—A person who is a

4 debit, credit, or other payment card issuer, or is otherwise

5 directly involved in the processing of payment transactions

6 involving such cards or other electronic payment trans7 actions, or is otherwise directly involved in the billing or

8 collection of amounts paid through such means, may use

9 or disclose protected health information about an individ10 ual that has been disclosed in accordance with subsection

11 (a) only when necessary for—

12 (1) the authorization, settlement, billing or col13 lection of amounts charged to, debited from, or oth14 erwise paid the individual using a debit, credit, or

15 other payment card or account number, or by other

16 electronic payment means;

17 (2) the transfer of receivables, accounts, or in18 terest therein;

19 (3) the audit of the debit, credit, or other pay20 ment card account information;

21 (4) compliance with Federal, State, or local law,

22 or

23 (5) compliance with a properly authorized civil,

24 criminal, or regulatory investigation by Federal,
52

•S 1921 IS

1 State, or local authorities as governed by the re2 quirements of this section.

3 SEC. 213. STANDARDS FOR ELECTRONIC DISCLOSURES.

4 The Secretary shall promulgate standards for disclos5 ing, authorizing, and authenticating, protected health in6 formation in electronic form consistent with this title.

7 SEC. 214. INDIVIDUAL REPRESENTATIVES.

8 (a) IN GENERAL.—Except as provided in subsections

9 (b) and (c), a person who is authorized by law (based on

10 grounds other than the individual being a minor), or by

11 an instrument recognized under law, to act as an agent,

12 attorney, proxy, or other legal representative of a pro13 tected individual, may, to the extent so authorized, exer14 cise and discharge the rights of the individual under this

15 Act.

16 (b) HEALTH CARE POWER OF ATTORNEY.—A person

17 who is authorized by law (based on grounds other than

18 being a minor), or by an instrument recognized under law,

19 to make decisions about the provision of health care to

20 an individual who is incapacitated, may exercise and dis21 charge the rights of the individual under this Act to the

22 extent necessary to effectuate the terms or purposes of

23 the grant of authority.

24 (c) NO COURT DECLARATION.—If a health care pro25 vider determines that an individual, who has not been de-
53

•S 1921 IS

1 clared to be legally incompetent, suffers from a medical

2 condition that prevents the individual from acting know3 ingly or effectively on the individual’s own behalf, the right

4 of the individual to authorize disclosure under this Act

5 may be exercised and discharged in the best interest of

6 the individual by—

7 (1) a person described in subsection (b) with re8 spect to the individual;

9 (2) a person described in subsection (a) with re10 spect to the individual, but only if a person de11 scribed in paragraph (1) cannot be contacted after

12 a reasonable effort;

13 (3) the next of kin of the individual, but only

14 if a person described in paragraph (1) or (2) cannot

15 be contacted after a reasonable effort; or

16 (4) the health care provider, but only if a per17 son described in paragraph (1), (2), or (3) cannot be

18 contacted after a reasonable effort.

19 (d) APPLICATION TO DECEASED INDIVIDUALS.—The

20 provisions of this Act shall continue to apply to protected

21 health information concerning a deceased individual for a

22 period of 2-years following the death of that individual.

23 (e) EXERCISE OF RIGHTS ON BEHALF OF A DE24 CEASED INDIVIDUAL.—A person who is authorized by law

25 or by an instrument recognized under law, to act as an
54

•S 1921 IS

1 executor of the estate of a deceased individual, or other2 wise to exercise the rights of the deceased individual, may,

3 to the extent so authorized, exercise and discharge the

4 rights of such deceased individual under this Act for a pe5 riod of 2-years following the death of that individual. If

6 no such designee has been authorized, the rights of the

7 deceased individual may be exercised as provided for in

8 subsection (c).

9 SEC. 215. LIMITED LIABILITY FOR LAW ENFORCEMENT OF10 FICERS.

11 Federal and State law enforcement officers shall not

12 be personally liable for violations of this Act unless it is

13 shown that the violation was a result of intentional con14 duct committed with the intent to sell, transfer, or use

15 protected health information for commercial advantage,

16 personal gain, or malicious harm.

17 SEC. 216. NO LIABILITY FOR PERMISSIBLE DISCLOSURES.

18 A health care provider, health plan, health oversight

19 agency, health researcher, public health authority, law en20 forcement official, employer, health or life insurer, school,

21 or university who makes a disclosure of protected health

22 information about an individual that is permitted by this

23 Act shall not be liable to the individual for such disclosure

24 under common law.
55

•S 1921 IS

1 TITLE III—SANCTIONS

2 Subtitle A—Criminal Provisions

3 SEC. 301. WRONGFUL DISCLOSURE OF PROTECTED

4 HEALTH INFORMATION.

5 (a) IN GENERAL.—Part I of title 18, United States

6 Code, is amended by adding at the end the following:

7 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE

8 OF PROTECTED HEALTH INFORMATION

‘‘Sec.

‘‘2801. Wrongful disclosure of protected health information.

9 ‘‘§ 2801. Wrongful disclosure of protected health in10 formation

11 ‘‘(a) OFFENSE.—The penalties described in sub12 section (b) shall apply to a person that knowingly and in13 tentionally—

14 ‘‘(1) obtains protected health information relat15 ing to an individual in violation of title II of the

16 Health Care PIN Act; or

17 ‘‘(2) discloses protected health information to

18 another person in violation of title II of the Health

19 Care PIN Act.

20 ‘‘(b) PENALTIES.—A person described in subsection

21 (a) shall—

22 ‘‘(1) be fined not more than $50,000, impris23 oned not more than 1 year, or both;
56

•S 1921 IS

1 ‘‘(2) if the offense is committed under false pre2 tenses, be fined not more than $250,000, imprisoned

3 not more than 5 years, or any combination of such

4 penalties;

5 ‘‘(3) if the offense is committed with the intent

6 to sell, transfer, or use protected health information

7 for commercial advantage, personal gain, or mali8 cious harm, be fined not more than $500,000, im9 prisoned not more than 10 years, excluded from par10 ticipation in any federally funded health care pro11 grams, or any combination of such penalties.

12 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per13 son described in subsection (a), the maximum penalties

14 described in subsection (b) shall be doubled for every sub15 sequent conviction for an offense arising out of a violation

16 or violations related to a set of circumstances that are dif17 ferent from those involved in the previous violation or set

18 of related violations described in such subsection (a).’’.

19 (b) CLERICAL AMENDMENT.—The table of chapters

20 for part I of title 18, United States Code, is amended by

21 inserting after the item relating to chapter 123 the follow22 ing new item:

‘‘124. Wrongful disclosure of protected health information ..................... 2801’’.

23 SEC. 302. DEBARMENT FOR CRIMES.

24 (a) PURPOSE.—The purpose of this section is to pro25 mote the prevention and deterrence of instances of inten-
57

•S 1921 IS

1 tional criminal actions which violate criminal laws which

2 are designed to safeguard the protected health information

3 in a manner consistent with this Act.

4 (b) DEBARMENT.—Not later than 270 days after the

5 effective date of this Act, the Attorney General, in con6 sultation with the Secretary, shall promulgate regulations

7 and establish procedures to permit the debarment of

8 health care providers, health researchers, health or life in9 surers, or schools or universities from receiving benefits

10 under any Federal health programs if the managers or

11 officers of such entities are found guilty of violating sec12 tion 2801 of title 18, United States Code, have civil pen13 alties imposed against such officers or managers under

14 section 311 in connection with the illegal disclosure of pro15 tected health information, or are found guilty of making

16 a false statement or obstructing justice related to attempt17 ing to conceal or concealing such illegal disclosure. Such

18 regulations shall take into account the need for continuity

19 of medical care and may provide for a delay of any debar20 ment imposed under this section to take into account the

21 medical needs of patients.

22 (c) CONSULTATION.—Before publishing a proposed

23 rule to implement subsection (b), the Attorney General

24 shall consult with State law enforcement officials, health

25 care providers, patient privacy rights’ advocates, and other
58

•S 1921 IS

1 appropriate individuals and entities, to gain additional in2 formation regarding the debarment of entities under sub3 section (b) and the best methods to ensure the continuity

4 of medical care.

5 (d) REPORT.—The Attorney General shall annually

6 prepare and submit to the Committee on the Judiciary of

7 the House of Representatives and the Committee on the

8 Judiciary of the Senate a report concerning the activities

9 and debarment actions taken by the Attorney General

10 under this section.

11 (e) ASSISTANCE TO PREVENT CRIMINAL VIOLA12 TIONS.—The Attorney General, in cooperation with any

13 other appropriate individual, organization, or agency, may

14 provide advice, training, technical assistance, and guid15 ance regarding ways to reduce the incidence of improper

16 disclosure of protected health information.

17 (f) RELATIONSHIP TO OTHER AUTHORITIES.—A de18 barment imposed under this section shall not reduce or

19 diminish the authority of a Federal, State, or local govern20 mental agency or court to penalize, imprison, fine, sus21 pend, debar, or take other adverse action against a person,

22 in a civil, criminal, or administrative proceeding.
59

•S 1921 IS

1 Subtitle B—Civil Sanctions

2 SEC. 311. CIVIL PENALTY.

3 (a) VIOLATION.—A health care provider, health re4 searcher, health plan, health oversight agency, public

5 health agency, law enforcement agency, employer, health

6 or life insurer, school, or university, or the agent of any

7 such individual or entity, who the Secretary, in consulta8 tion with the Attorney General, determines has substan9 tially and materially failed to comply with this Act shall

10 be subject, in addition to any other penalties that may

11 be prescribed by law—

12 (1) in a case in which the violation relates to

13 title I, to a civil penalty of not more than $500 for

14 each such violation, but not to exceed $5,000 in the

15 aggregate for multiple violations;

16 (2) in a case in which the violation relates to

17 title II, to a civil penalty of not more than $10,000

18 for each such violation, but not to exceed $50,000

19 in the aggregate for multiple violations; or

20 (3) in a case in which the Secretary finds that

21 such violations have occurred with such frequency as

22 to constitute a general business practice, to a civil

23 penalty of not more than $100,000.

24 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

25 Section 1128A of the Social Security Act, other than sub-
60

•S 1921 IS

1 sections (a) and (b) and the second sentence of subsection

2 (f) of that section, shall apply to the imposition of a civil,

3 monetary, or exclusionary penalty under this section in the

4 same manner as such provisions apply with respect to the

5 imposition of a penalty under section 1128A of such Act.

6 SEC. 312. PROCEDURES FOR IMPOSITION OF PENALTIES.

7 (a) INITIATION OF PROCEEDINGS.—

8 (1) IN GENERAL.—The Secretary, in consulta9 tion with the Attorney General, may initiate a pro10 ceeding to determine whether to impose a civil

11 money penalty under section 311. The Secretary

12 may not initiate an action under this section with re13 spect to any violation described in section 311 after

14 the expiration of the 6-year period beginning on the

15 date on which such violation was alleged to have oc16 curred. The Secretary may initiate an action under

17 this section by serving notice of the action in any

18 manner authorized by Rule 4 of the Federal Rules

19 of Civil Procedure.

20 (2) NOTICE AND OPPORTUNITY FOR HEAR21 ING.—The Secretary shall not make a determination

22 adverse to any person under paragraph (1) until the

23 person has been given written notice and an oppor24 tunity for the determination to be made on the

25 record after a hearing at which the person is entitled
61

•S 1921 IS

1 to be represented by counsel, to present witnesses,

2 and to cross-examine witnesses against the person.

3 (3) ESTOPPEL.—In a proceeding under para4 graph (1) that—

5 (A) is against a person who has been con6 victed (whether upon a verdict after trial or

7 upon a plea of guilty or nolo contendere) of a

8 crime under section 2801 of title 18, United

9 States Code; and

10 (B) involves the same conduct as in the

11 criminal action;

12 the person is estopped from denying the essential

13 elements of the criminal offense.

14 (4) SANCTIONS FOR FAILURE TO COMPLY.—

15 The official conducting a hearing under this section

16 may sanction a person, including any party or attor17 ney, for failing to comply with an order or proce18 dure, failing to defend an action, or other mis19 conduct as would interfere with the speedy, orderly,

20 or fair conduct of the hearing. Such sanction shall

21 reasonably relate to the severity and nature of the

22 failure or misconduct. Such sanction may include—

23 (A) in the case of refusal to provide or per24 mit discovery, drawing negative factual infer25 ences or treating such refusal as an admission
62

•S 1921 IS

1 by deeming the matter, or certain facts, to be

2 established;

3 (B) prohibiting a party from introducing

4 certain evidence or otherwise supporting a par5 ticular claim or defense;

6 (C) striking pleadings, in whole or in part;

7 (D) staying the proceedings;

8 (E) dismissal of the action;

9 (F) entering a default judgment;

10 (G) ordering the party or attorney to pay

11 attorneys’ fees and other costs caused by the

12 failure or misconduct; and

13 (H) refusing to consider any motion or

14 other action which is not filed in a timely man15 ner.

16 (b) SCOPE OF PENALTY.—In determining the

17 amount or scope of any penalty imposed pursuant to sec18 tion 311, the Secretary shall take into account—

19 (1) the nature of claims and the circumstances

20 under which they were presented;

21 (2) the degree of culpability, history of prior of22 fenses, and financial condition of the person present23 ing the claims; and

24 (3) such other matters as justice may require.

25 (c) REVIEW OF DETERMINATION.—
63

•S 1921 IS

1 (1) IN GENERAL.—Any person adversely af2 fected by a determination of the Secretary under

3 this section may obtain a review of such determina4 tion in the United States Court of Appeals for the

5 circuit in which the person resides, or in which the

6 claim was presented, by filing in such court (within

7 60 days following the date the person is notified of

8 the determination of the Secretary) a written peti9 tion requesting that the determination be modified

10 or set aside.

11 (2) FILING OF RECORD.—A copy of the petition

12 filed under paragraph (1) shall be forthwith trans13 mitted by the clerk of the court to the Secretary,

14 and thereupon the Secretary shall file in the Court

15 the record in the proceeding as provided in section

16 2112 of title 28, United States Code. Upon such fil17 ing, the court shall have jurisdiction of the proceed18 ing and of the question determined therein, and

19 shall have the power to make and enter upon the

20 pleadings, testimony, and proceedings set forth in

21 such record a decree affirming, modifying, remand22 ing for further consideration, or setting aside, in

23 whole or in part, the determination of the Secretary

24 and enforcing the same to the extent that such order

25 is affirmed or modified.
64

•S 1921 IS

1 (3) CONSIDERATION OF OBJECTIONS.—No ob2 jection that has not been raised before the Secretary

3 with respect to a determination described in para4 graph (1) shall be considered by the court, unless

5 the failure or neglect to raise such objection shall be

6 excused because of extraordinary circumstances.

7 (4) FINDINGS.—The findings of the Secretary

8 with respect to questions of fact in an action under

9 this subsection, if supported by substantial evidence

10 on the record considered as a whole, shall be conclu11 sive. If any party shall apply to the court for leave

12 to adduce additional evidence and shall show to the

13 satisfaction of the court that such additional evi14 dence is material and that there were reasonable

15 grounds for the failure to adduce such evidence in

16 the hearing before the Secretary, the court may

17 order such additional evidence to be taken before the

18 Secretary and to be made a part of the record. The

19 Secretary may modify findings as to the facts, or

20 make new findings, by reason of additional evidence

21 so taken and filed, and shall file with the court such

22 modified or new findings, and such findings with re23 spect to questions of fact, if supported by substan24 tial evidence on the record considered as a whole,

25 and the recommendations of the Secretary, if any,
65

•S 1921 IS

1 for the modification or setting aside of the original

2 order, shall be conclusive.

3 (5) EXCLUSIVE JURISDICTION.—Upon the filing

4 of the record with the court under paragraph (2),

5 the jurisdiction of the court shall be exclusive and its

6 judgment and decree shall be final, except that the

7 same shall be subject to review by the Supreme

8 Court of the United States, as provided for in sec9 tion 1254 of title 28, United States Code.

10 (d) RECOVERY OF PENALTIES.—

11 (1) IN GENERAL.—Civil money penalties im12 posed under this subtitle may be compromised by

13 the Secretary and may be recovered in a civil action

14 in the name of the United States brought in United

15 States district court for the district where the claim

16 was presented, or where the claimant resides, as de17 termined by the Secretary. Amounts recovered under

18 this section shall be paid to the Secretary and depos19 ited as miscellaneous receipts of the Treasury of the

20 United States.

21 (2) DEDUCTION FROM AMOUNTS OWING.—The

22 amount of any penalty, when finally determined

23 under this section, or the amount agreed upon in

24 compromise under paragraph (1), may be deducted

25 from any sum then or later owing by the United
66

•S 1921 IS

1 States or a State to the person against whom the

2 penalty has been assessed.

3 (e) DETERMINATION FINAL.—A determination by

4 the Secretary to impose a penalty under section 321 shall

5 be final upon the expiration of the 60-day period referred

6 to in subsection (c)(1). Matters that were raised or that

7 could have been raised in a hearing before the Secretary

8 or in an appeal pursuant to subsection (c) may not be

9 raised as a defense to a civil action by the United States

10 to collect a penalty under section 321.

11 (f) SUBPOENA AUTHORITY.—

12 (1) IN GENERAL.—For the purpose of any

13 hearing, investigation, or other proceeding author14 ized or directed under this section, or relative to any

15 other matter within the jurisdiction of the Attorney

16 General hereunder, the Attorney General, acting

17 through the Secretary shall have the power to issue

18 subpoenas requiring the attendance and testimony of

19 witnesses and the production of any evidence that

20 relates to any matter under investigation or in ques21 tion before the Secretary. Such attendance of wit22 nesses and production of evidence at the designated

23 place of such hearing, investigation, or other pro24 ceeding may be required from any place in the
67

•S 1921 IS

1 United States or in any Territory or possession

2 thereof.

3 (2) SERVICE.—Subpoenas of the Secretary

4 under paragraph (1) shall be served by anyone au5 thorized by the Secretary by delivering a copy there6 of to the individual named therein.

7 (3) PROOF OF SERVICE.—A verified return by

8 the individual serving the subpoena under this sub9 section setting forth the manner of service shall be

10 proof of service.

11 (4) FEES.—Witnesses subpoenaed under this

12 subsection shall be paid the same fees and mileage

13 as are paid witnesses in the district court of the

14 United States.

15 (5) REFUSAL TO OBEY.—In case of contumacy

16 by, or refusal to obey a duly served upon, any per17 son, any district court of the United States for the

18 judicial district in which such person charged with

19 contumacy or refusal to obey is found or resides or

20 transacts business, upon application by the Sec21 retary, shall have jurisdiction to issue an order re22 quiring such person to appear and give testimony, or

23 to appear and produce evidence, or both. Any failure

24 to obey such order of the court may be punished by

25 the court as contempt thereof.
68

•S 1921 IS

1 (g) INJUNCTIVE RELIEF.—Whenever the Secretary

2 has reason to believe that any person has engaged, is en3 gaging, or is about to engage in any activity which makes

4 the person subject to a civil monetary penalty under sec5 tion 311, the Secretary may bring an action in an appro6 priate district court of the United States (or, if applicable,

7 a United States court of any territory) to enjoin such ac8 tivity, or to enjoin the person from concealing, removing,

9 encumbering, or disposing of assets which may be required

10 in order to pay a civil monetary penalty if any such pen11 alty were to be imposed or to seek other appropriate relief.

12 (h) AGENCY.—A principal is liable for penalties

13 under section 311 for the actions of the principal’s agent

14 acting within the scope of the agency.

15 SEC. 313. REPORT ON USE OF EXISTING ENFORCEMENT

16 MECHANISMS.

17 In addition to the criminal and civil penalties that

18 may be applied under this title, the Secretary shall prepare

19 and submit to Congress a report regarding the use of ex20 isting Federal, State and other licensure, certification and

21 regulatory mechanisms, including State insurance regula22 tions, for the imposition of sanctions or penalties for the

23 wrongful disclosure of protected health information.
69

•S 1921 IS

1 SEC. 314. CIVIL ACTION BY INDIVIDUALS.

2 (a) IN GENERAL.—Any individual whose rights under

3 this Act have been knowingly or negligently violated may

4 bring a civil action to recover—

5 (1) such preliminary and equitable relief as the

6 court determines to be appropriate; and

7 (2) the greater of compensatory damages or liq8 uidated damages of $5,000.

9 (b) PUNITIVE DAMAGES.—In any action brought

10 under this section in which the individual has prevailed

11 because of a knowing violation of a provision of this Act,

12 the court may, in addition to any relief awarded under

13 subsection (a), award such punitive damages as may be

14 appropriate.

15 (c) ATTORNEY’S FEES.—In the case of a civil action

16 brought under subsection (a) in which the individual has

17 substantially prevailed, the court may assess against the

18 respondent a reasonable attorney’s fee and other litigation

19 costs and expenses (including expert fees) reasonably in20 curred.

21 (d) LIMITATION.—No action may be commenced

22 under this section more than 3 years after the date on

23 which the violation was or should reasonably have been

24 discovered.
70

•S 1921 IS

1 TITLE IV—MISCELLANEOUS

2 SEC. 401. RELATIONSHIP TO OTHER LAWS.

3 (a) STATE LAW.—Except as provided in subsections

4 (b) and (c), the provision of this Act shall preempt any

5 State law that directly relates to matters covered by this

6 Act. This Act shall not be construed as repealing, explicitly

7 or implicitly, other Federal laws or regulations relating to

8 protected health information or relating to an individual’s

9 access to protected health information or health care serv10 ices.

11 (b) PRIVILEGES.—Nothing in this title shall be con12 strued to preempt or modify any provisions of State statu13 tory or common law to the extent that such law concerns

14 a privilege of a witness or person in a court of that State.

15 This title shall not be construed to supersede or modify

16 any provision of Federal statutory or common law to the

17 extent such law concerns a privilege of a witness or person

18 in a court of the United States. Authorizations pursuant

19 to sections 202 and 203 shall not be construed as a waiver

20 of any such privilege.

21 (c) CERTAIN DUTIES UNDER LAW.—Nothing in this

22 title shall be construed to preempt, supersede, or modify

23 the operation of any State law that—

24 (1) provides for the reporting of vital statistics

25 such as birth or death information;
71

•S 1921 IS

1 (2) requires the reporting of abuse or neglect

2 information about any individual;

3 (3) relates to public or mental health and that

4 prevents or otherwise restricts disclosure of informa5 tion otherwise permissible under this Act;

6 (4) governs a minor’s right to access protected

7 health information or health care services; or

8 (5) authorizes the collecting, analysis, or dis9 semination of information from an entity described

10 in section 201(a) for the purpose of developing use,

11 cost effectiveness, performance, or quality data.

12 (d) FEDERAL PRIVACY ACT.—

13 (1) MEDICAL EXEMPTIONS.—Sections 552a of

14 title 5, United States Code, is amended by adding

15 at the end thereof the following: ‘‘The head of an

16 agency that is an entity described in section 311(a)

17 of the Health Care PIN Act shall promulgate rules,

18 in accordance with the requirements (including gen19 eral notice) of subsections (b)(1), (b)(2), (b)(3), (c),

20 and (e) of section 553 of this title, to exempt a sys21 tem of records within an agency, to the extent that

22 the system of records contains protected health in23 formation (as defined in section 4(20) of such Act),

24 from all provisions of this section except subsections

25 (b)(6), (d), (e)(1), (e)(2), subparagraphs (A) and
72

•S 1921 IS

1 (C) and (E) through (I) of subsection (e)(4), and

2 subsections (e)(5), (e)(6), (e)(9), (e)(12), (l), (n),

3 (o), (p), (r), and (u).’’.

4 (2) TECHNICAL AMENDMENT.—Section

5 552a(f)(3) of title 5, United States Code, is amend6 ed by striking ‘‘pertaining to him,’’ and all that fol7 lows through the semicolon and inserting ‘‘pertain8 ing to the individual.’’

9 (e) APPLICATION TO CERTAIN FEDERAL AGEN10 CIES.—

11 (1) DEPARTMENT OF DEFENSE.—

12 (A) EXCEPTIONS.—The Secretary of De13 fense may, by regulation, establish exceptions to

14 the disclosure requirements of this Act to the

15 extent such Secretary determines that disclo16 sure of protected health information relating to

17 members of the armed forces from systems of

18 records operated by the Department of Defense

19 is necessary under circumstances different from

20 those permitted under this Act for the proper

21 conduct of national defense functions by mem22 bers of the armed forces.

23 (B) APPLICATION TO CIVILIAN EMPLOY24 EES.—The Secretary of Defense may, by regu25 lation, establish for civilian employees of the
73

•S 1921 IS

1 Department of Defense and employees of De2 partment of Defense contractors, limitations on

3 the right of such persons to revoke or amend

4 authorizations for disclosures under section 203

5 when such authorizations were provided by such

6 employees as a condition of employment and

7 the disclosure is determined necessary by the

8 Secretary of Defense to the proper conduct of

9 national defense functions by such employees.

10 (2) DEPARTMENT OF TRANSPORTATION.—

11 (A) EXCEPTIONS.—The Secretary of

12 Transportation may, with respect to members

13 of the Coast Guard, exercise the same powers

14 as the Secretary of Defense may exercise under

15 paragraph (1)(A).

16 (B) APPLICATION TO CIVILIAN EMPLOY17 EES.—The Secretary of Transportation may,

18 with respect to civilian employees of the Coast

19 Guard and Coast Guard contractors, exercise

20 the same powers as the Secretary of Defense

21 may exercise under paragraph (1)(B).

22 (3) DEPARTMENT OF VETERANS AFFAIRS.—

23 The limitations on use and disclosure of protected

24 health information under this Act shall not be con25 strued to prevent any exchange of such information
74

•S 1921 IS

1 within and among components of the Department of

2 Veterans Affairs that determine eligibility for or en3 titlement to, or that provide, benefits under laws ad4 ministered by the Secretary of Veteran Affairs.

5 SEC. 402. STUDY BY GAO.

6 Not later than 6 months after the date of enactment

7 of the Act, the General Accounting Office shall report the

8 results of a study examining research issues relating to

9 protected health information, including the quality and

10 uniformity of institutional review boards with respect to

11 the confidentiality of such information, the extent to which

12 health research is research described in section 208(a)(3),

13 the extent to which health researchers conducting research

14 described in section 208(a)(3) have established and main15 tained safeguards described in section 111, and the need

16 for personally identifiable information in various research

17 settings.

18 SEC. 403. EFFECTIVE DATE.

19 (a) EFFECTIVE DATE.—Except as provided in sub20 section (b), this Act shall take effect on the date that is

21 18 months after the date of enactment of this Act.

22 (b) REGULATIONS.—The Secretary shall promulgate

23 regulations implementing this Act not later than 12

24 months after the date of enactment of this Act.

Æ