I

106TH CONGRESS

1ST SESSION H. R. 1941

To protect the privacy of personally identifiable health information.

IN THE HOUSE OF REPRESENTATIVES

MAY 25, 1999

Mr. CONDIT (for himself, Mr. WAXMAN, Mr. MARKEY, Mr. DINGELL, Mr.

BROWN of Ohio, Mr. TURNER, Mr. LANTOS, Mr. CRAMER, Mr. WISE, Mr.

OWENS, Mrs. TAUSCHER, Mr. TOWNS, Mr. SHOWS, Mr. KANJORSKI, Mrs.

MINK of Hawaii, Mr. SANDERS, Mrs. MALONEY of New York, Ms. NORTON, Mr. FATTAH, Mr. CUMMINGS, Mr. KUCINICH, Mr. BLAGOJEVICH,

Mr. DAVIS of Illinois, Mr. TIERNEY, Mr. ALLEN, Mr. FORD, Ms.

SCHAKOWSKI, Mr. ROMERO-BARCELO ́, and Mr. STUPAK) introduced the

following bill; which was referred to the Committee on Commerce, and

in addition to the Committee on Government Reform, for a period to be

subsequently determined by the Speaker, in each case for consideration

of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To protect the privacy of personally identifiable health

information.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Health Information Privacy Act’’.
2

•HR 1941 IH

1 (b) TABLE OF CONTENTS.—The table of contents for

2 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings and purposes.

TITLE I—PROTECTION OF HEALTH INFORMATION

Sec. 101. Restrictions on uses.

Sec. 102. Restrictions on disclosure.

Sec. 103. Standards for authorizations for use and disclosure.

Sec. 104. Safeguards against misuse and prohibited disclosures.

TITLE II—RIGHTS OF PROTECTED INDIVIDUALS

Sec. 201. Right of access.

Sec. 202. Right of correction and amendment.

Sec. 203. Right to review disclosure history.

Sec. 204. Right to notice of information practices and opportunity to seek additional protections.

TITLE III—PERMISSIBLE DISCLOSURES OF PROTECTED HEALTH

INFORMATION

Sec. 301. Provision of and payment for health care.

Sec. 302. Health oversight.

Sec. 303. Public health.

Sec. 304. Health research.

Sec. 305. Law enforcement.

Sec. 306. Judicial or administrative proceedings.

Sec. 307. Other disclosures.

Sec. 308. Redisclosures.

TITLE IV—MISCELLANEOUS PROVISIONS

Sec. 401. Specific classes of individuals.

Sec. 402. False pretenses.

Sec. 403. Obligations of affiliated persons.

Sec. 404. Prohibition of retaliation with respect to employment.

Sec. 405. Mental health and other especially sensitive information.

Sec. 406. Cessation of operations.

Sec. 407. Conforming amendments to Federal Privacy Act.

TITLE V—GENERAL PROVISIONS

Sec. 501. Authority of the Secretary.

Sec. 502. Enforcement.

Sec. 503. Relationship to other laws.

Sec. 504. Definitions.

Sec. 505. Effective date.

3 SEC. 2. FINDINGS AND PURPOSES.

4 (a) FINDINGS.—The Congress finds as follows:
3

•HR 1941 IH

1 (1) The right to privacy is a personal and fun2 damental right protected by the Constitution of the

3 United States.

4 (2) Individuals have a right to privacy regard5 ing their individually identifiable health information.

6 (3) The improper use or disclosure of individ7 ually identifiable health information about an indi8 vidual may cause significant harm to the interests of

9 the individual in privacy and health care, and may

10 unfairly affect the ability of the individual to obtain

11 employment, education, insurance, credit, and other

12 necessities.

13 (4) Current legal protections for health infor14 mation vary from State to State and are inadequate

15 to protect the privacy of an individual’s health infor16 mation and ensure fair information practices stand17 ards.

18 (5) The movement of individuals and health in19 formation across State lines, access to and exchange

20 of health information from automated data banks

21 and networks, and the emergence of multistate

22 health care providers and payers create a compelling

23 need for Federal law, rules, and procedures gov24 erning the use, maintenance, and disclosure of

25 health information.
4

•HR 1941 IH

1 (6) Federal rules governing the use, mainte2 nance, and disclosure of health information are an

3 essential part of health care reform, are necessary to

4 support the computerization of health information,

5 and can reduce the cost of providing health services

6 by making the necessary transfer of health informa7 tion more efficient.

8 (7) An individual needs access to health infor9 mation about the individual as a matter of fairness,

10 to enable the individual to make informed decisions

11 about health care, and to correct inaccurate or in12 complete information.

13 (b) PURPOSES.—The purposes of this Act are as fol14 lows:

15 (1) To protect the privacy of health information

16 that reveals the identity of an individual.

17 (2) To define the rights and responsibilities of

18 a person who creates or maintains individually iden19 tifiable health information that originates or is used

20 in the health treatment or payment process.

21 (3) To define the rights of an individual with

22 respect to health information about the individual

23 that is created or maintained as part of the health

24 treatment and payment process.
5

•HR 1941 IH

1 TITLE I—PROTECTION OF

2 HEALTH INFORMATION

3 SEC. 101. RESTRICTIONS ON USES.

4 (a) IN GENERAL.—Use of protected health informa5 tion by health information custodians—

6 (1) shall protect the reasonable expectation of

7 privacy of protected individuals; and

8 (2) shall be in accordance with fair information

9 practices.

10 (b) MINIMUM REQUIREMENTS.—

11 (1) LIMITATION ON USES.—Unless otherwise

12 authorized by a protected individual under section

13 103, a health information custodian may use pro14 tected health information only for the uses for which

15 disclosure is authorized under title III.

16 (2) MINIMUM AMOUNT OF INFORMATION.—A

17 health information custodian shall limit use of pro18 tected health information to the minimum amount

19 and duration necessary to accomplish the use.

20 SEC. 102. RESTRICTIONS ON DISCLOSURE.

21 (a) IN GENERAL.—Disclosure of protected health in22 formation by a health information custodian shall protect

23 the reasonable expectations of privacy of protected individ24 uals.

25 (b) MINIMUM REQUIREMENTS.—
6

•HR 1941 IH

1 (1) LIMITATION ON DISCLOSURES.—A health

2 information custodian may not disclose protected

3 health information unless—

4 (A) the disclosure is authorized by the pro5 tected individual under section 103; or

6 (B) the disclosure is authorized under title

7 III.

8 (2) MINIMUM AMOUNT OF INFORMATION.—A

9 health information custodian shall limit a disclosure

10 of protected health information to the minimum

11 amount of information necessary to accomplish the

12 purpose for which the information is disclosed.

13 (c) NO REQUIREMENT TO DISCLOSE.—Nothing in

14 this Act shall be construed as requiring disclosure of pro15 tected health information that is not otherwise required

16 to be disclosed by law.

17 SEC. 103. STANDARDS FOR AUTHORIZATIONS FOR USE AND

18 DISCLOSURE.

19 (a) IN GENERAL.—A health information custodian

20 may use or disclose protected information pursuant to an

21 authorization by a protected individual only if that author22 ization is based on informed consent by the protected indi23 vidual.

24 (b) MINIMUM REQUIREMENTS.—
7

•HR 1941 IH

1 (1) PROHIBITION ON CONDITIONING.—A health

2 information custodian may not, as a condition of

3 providing or paying for health care, require a pro4 tected individual to execute an authorization for use

5 or disclosure of protected health information.

6 (2) INFORMED CONSENT.—For the purposes of

7 subsection (a), an authorization shall not be consid8 ered to be based on informed consent unless, at a

9 minimum, it satisfies the conditions in part II.D.1 of

10 the Secretary’s HIPAA recommendations (relating

11 to ‘‘Disclosure with Patient Authorization: Author12 ization Content’’).

13 SEC. 104. SAFEGUARDS AGAINST MISUSE AND PROHIBITED

14 DISCLOSURES.

15 (a) IN GENERAL.—Health information custodians

16 shall establish and implement safeguards against misuse

17 and prohibited disclosure of protected health information.

18 (b) MINIMUM REQUIREMENTS.—The safeguards

19 under subsection (a) shall include reasonable and appro20 priate administrative, technical, and physical safeguards—

21 (1) to ensure that protected health information

22 is used or disclosed only when necessary;

23 (2) to ensure the integrity and confidentiality of

24 protected health information;
8

•HR 1941 IH

1 (3) to protect against any reasonably antici2 pated threats or hazards to the security or integrity

3 of the information or unauthorized use or disclosure

4 of the information; and

5 (4) otherwise to ensure compliance with this

6 Act.

7 (c) MENTAL HEALTH AND OTHER ESPECIALLY SEN8 SITIVE INFORMATION.—In establishing and implementing

9 the safeguards under subsection (a), a health information

10 custodian shall consider providing additional protections

11 for mental health and other especially sensitive protected

12 health information, as appropriate.

13 (d) RELATIONSHIP TO SOCIAL SECURITY ACT AD14 MINISTRATIVE SIMPLIFICATION REQUIREMENTS.—Any

15 safeguard established under this section shall be con16 sistent with the standards adopted by the Secretary under

17 paragraph (1) of section 1173(d) of the Social Security

18 Act (42 U.S.C. 1320d–2(d)) and the requirement in para19 graph (2) of such section.

20 TITLE II—RIGHTS OF

21 PROTECTED INDIVIDUALS

22 SEC. 201. RIGHT OF ACCESS.

23 (a) IN GENERAL.—Protected individuals shall have

24 the right to a reasonable opportunity to inspect and copy
9

•HR 1941 IH

1 protected health information maintained by a health infor2 mation custodian.

3 (b) MINIMUM REQUIREMENTS.—Subject to section

4 405(b), a health information custodian, at a minimum,

5 shall provide a protected individual at least as much op6 portunity to inspect and copy protected health information

7 as was recommended by the Secretary in part II.C.2 of

8 the Secretary’s HIPAA recommendations (relating to

9 ‘‘Patient Inspection and Copying of Records’’).

10 SEC. 202. RIGHT OF CORRECTION AND AMENDMENT.

11 (a) IN GENERAL.—Protected individuals shall have

12 the right to a reasonable opportunity to correct or amend

13 protected health information maintained by a health infor14 mation custodian.

15 (b) MINIMUM REQUIREMENTS.—A health informa16 tion custodian, at a minimum, shall provide a protected

17 individual correction and amendment protections that are

18 at least equivalent to those recommended by the Secretary

19 in part II.C.3 of the Secretary’s HIPAA recommendations

20 (relating to ‘‘Patient Correction of Records’’).

21 SEC. 203. RIGHT TO REVIEW DISCLOSURE HISTORY.

22 (a) IN GENERAL.—Protected individuals shall have

23 the right to a reasonable opportunity to review a history

24 of the disclosures of protected health information about

25 the individual made by a health information custodian.
10

•HR 1941 IH

1 (b) MINIMUM REQUIREMENTS.—A health informa2 tion custodian, at a minimum, shall implement procedures

3 that ensure a protected individual at least as much oppor4 tunity to review the individual’s disclosure histories as was

5 recommended by the Secretary in part II.C.4 of the Sec6 retary’s HIPAA recommendations (relating to ‘‘Disclosure

7 History’’).

8 SEC. 204. RIGHT TO NOTICE OF INFORMATION PRACTICES

9 AND OPPORTUNITY TO SEEK ADDITIONAL

10 PROTECTIONS.

11 (a) IN GENERAL.—Protected individuals shall have—

12 (1) the right to notice of the information prac13 tices of health information custodians; and

14 (2) a reasonable opportunity to seek limitations

15 on the use and disclosure of protected health infor16 mation in addition to the limitations provided in

17 such practices.

18 (b) MINIMUM REQUIREMENTS.—

19 (1) NOTICE AND OPPORTUNITY TO SEEK ADDI20 TIONAL PROTECTIONS.—To the maximum extent

21 practicable, before obtaining protected health infor22 mation from a protected individual, a health infor23 mation custodian—

24 (A) shall provide the protected individual

25 with a clear and conspicuous notice of the
11

•HR 1941 IH

1 custodian’s health information practices, which

2 notice shall include, at a minimum, the expla3 nation recommended in part II.C.1 of the Sec4 retary’s HIPAA recommendations (relating to

5 ‘‘Explanation of Information Practices’’);

6 (B) shall provide the protected individual a

7 reasonable opportunity to seek limitations on

8 the use or disclosure of protected health infor9 mation in addition to the limitations provided in

10 such practices; and

11 (C) shall obtain a signed acknowledgment

12 from the protected individual acknowledging

13 that the notice required under subparagraph

14 (A) has been provided to the protected indi15 vidual and the individual has been informed of

16 the opportunity to seek additional limitations

17 required to be provided under subparagraph

18 (B).

19 (2) OTHER HEALTH INFORMATION

20 CUSTODIANS.—A health information custodian who

21 receives protected health information about a pro22 tected individual from a source other than the indi23 vidual shall provide a notice of the custodian’s

24 health information practices that is consistent with

25 paragraph (1)(A) to the individual upon request.
12

•HR 1941 IH

1 (c) COMPLIANCE.—If a protected individual seeks

2 limitations on the use or disclosure of protected health in3 formation in addition to the limitations described in a

4 health information custodian’s notice of health informa5 tion practices, and the custodian agrees to provide such

6 additional limitations, the custodian shall comply with

7 such additional limitations, unless such compliance would

8 violate another provision of law.

9 TITLE III—PERMISSIBLE DIS10 CLOSURES OF PROTECTED

11 HEALTH INFORMATION

12 SEC. 301. PROVISION OF AND PAYMENT FOR HEALTH CARE.

13 (a) IN GENERAL.—A health information custodian,

14 to the extent the Secretary determines appropriate, may

15 disclose protected health information, without obtaining

16 an authorization under section 103, for the purpose of

17 providing health care to an individual or paying for health

18 care provided to an individual, except as provided in sub19 section (c).

20 (b) CONSTRUCTION.—For purposes of subsection (a),

21 a disclosure of protected health information by a health

22 information custodian for the purpose of rendering an em23 ployment decision, conducting a marketing activity, or

24 conducting an insurance underwriting activity, shall not

25 be considered a disclosure for the purpose of providing
13

•HR 1941 IH

1 health care to an individual or paying for health care pro2 vided to an individual.

3 (c) SPECIAL RULE FOR PATIENTS PAYING FOR

4 CARE.—In the case of health care provided to an indi5 vidual who pays for the care himself or herself, a health

6 information custodian may not disclose to a health care

7 payer, without obtaining an authorization under section

8 103, protected health information created or received in

9 the course of providing such care.

10 SEC. 302. HEALTH OVERSIGHT.

11 (a) IN GENERAL.—A health information custodian,

12 to the extent the Secretary determines appropriate, may

13 disclose protected health information for the purpose of

14 health oversight, without obtaining an authorization under

15 section 103.

16 (b) MINIMUM REQUIREMENTS.—The Secretary—

17 (1) shall permit a health information custodian

18 to disclose protected health information to Federal,

19 State, and local agencies (or affiliated persons of

20 such agencies) that are authorized by law to inves21 tigate, regulate, enforce laws relating to, or license,

22 certify, or accredit persons engaged in, the provision

23 of, or payment for, health care; and

24 (2) may permit a health information custodian

25 to disclose protected health information to appro-
14

•HR 1941 IH

1 priate private organizations engaged in licensing,

2 certification, or accreditation of health care pro3 viders.

4 SEC. 303. PUBLIC HEALTH.

5 A health information custodian, to the extent the Sec6 retary determines appropriate, may disclose protected

7 health information, without obtaining an authorization

8 under section 103—

9 (1) to a public health authority for use in le10 gally authorized disease or injury reporting, public

11 health surveillance, or a public health investigation

12 or intervention; or

13 (2) to a person who is otherwise authorized by

14 law or a public health authority to receive the infor15 mation for public health purposes.

16 SEC. 304. HEALTH RESEARCH.

17 (a) IN GENERAL.—A health information custodian,

18 to the extent the Secretary determines appropriate, may

19 disclose protected health information for health research,

20 without obtaining an authorization under section 103.

21 (b) MINIMUM REQUIREMENTS.—A health informa22 tion custodian may disclose protected health information

23 without such an authorization only for uses that have been

24 approved by an entity certified by the Secretary.
15

•HR 1941 IH

1 (c) REGULATIONS.—The Secretary shall promulgate

2 regulations that, at a minimum—

3 (1) require that, before approving a use of pro4 tected health information for purposes of subsection

5 (b), a certified entity shall determine that—

6 (A) the importance of the health research

7 outweighs the intrusion into the privacy of the

8 protected individuals who are the subjects of

9 the protected health information; and

10 (B) it would be impracticable to conduct

11 the health research without using the protected

12 health information;

13 (2) establish requirements for certifying entities

14 that ensure that such entities—

15 (A) meet the requirements for institutional

16 review boards established under section 491(a)

17 of the Public Health Service Act with respect to

18 information protection, use, and disclosure; and

19 (B) are qualified to assess and protect the

20 confidentiality of protected health information;

21 and

22 (3) require a person conducting health research

23 to remove or destroy personal identifiers at the ear24 liest opportunity consistent with the purpose of the

25 research, unless a certified entity has determined
16

•HR 1941 IH

1 that there is a health or research justification for re2 tention of identifiers and the person has an adequate

3 plan to protect the identifiers from improper use and

4 disclosure.

5 SEC. 305. LAW ENFORCEMENT.

6 (a) IN GENERAL.—A health information custodian

7 may disclose protected health information to a law en8 forcement official for a law enforcement inquiry if the law

9 enforcement official complies with the fourth amendment

10 to the Constitution.

11 (b) CONSTRUCTION.—For purposes of subsection (a),

12 all protected health information shall be treated as if it

13 were held in a home over which the protected individual

14 has exclusive authority.

15 (c) RELATIONSHIP TO HEALTH OVERSIGHT ACTIVI16 TIES.—This section shall not apply to a disclosure of pro17 tected health information for purposes of health oversight.

18 SEC. 306. JUDICIAL OR ADMINISTRATIVE PROCEEDINGS.

19 (a) IN GENERAL.—A health information custodian,

20 to the extent the Secretary determines appropriate, may

21 disclose protected health information, without obtaining

22 an authorization under section 103, pursuant to—

23 (1) a judicial or administrative subpoena issued

24 in a civil administrative or judicial adjudication; or
17

•HR 1941 IH

1 (2) a subpoena issued by a defendant in a

2 criminal proceeding.

3 (b) MINIMUM REQUIREMENTS.—A health informa4 tion custodian may not disclose protected health informa5 tion about a protected individual under this section, unless

6 the individual has had—

7 (1) reasonable notice of the subpoena; and

8 (2) a reasonable opportunity to move the court,

9 or other presiding official, to quash the subpoena on

10 the basis that the individual’s privacy interest out11 weighs the interest of the person seeking the infor12 mation.

13 SEC. 307. OTHER DISCLOSURES.

14 A health information custodian, to the extent the Sec15 retary determines appropriate, may disclose protected

16 health information, without obtaining an authorization

17 under section 103—

18 (1) where necessary to prevent or lessen a seri19 ous threat to the health or safety of an individual;

20 (2) to a next of kin;

21 (3) to individuals with close personal relation22 ships with the protected individual;

23 (4) for purposes of directory information within

24 a health care facility; and

25 (5) for State data systems.
18

•HR 1941 IH

1 SEC. 308. REDISCLOSURES.

2 (a) IN GENERAL.—A health information custodian

3 who receives protected health information through a dis4 closure under this title, to the extent the Secretary deter5 mines appropriate, may redisclose such information to

6 carry out the purposes for which the information was dis7 closed to the custodian.

8 (b) PROHIBITION.—Notwithstanding subsection (a),

9 protected health information received by a health informa10 tion custodian through a disclosure under this title may

11 not be disclosed to any person for use in, or be used in,

12 any administrative, civil, or criminal action or investiga13 tion directed against the protected individual who is the

14 subject of the information, unless—

15 (1) the action or investigation arises out of and

16 is directly related to the purpose for which the infor17 mation was obtained by the custodian; or

18 (2) the use or disclosure is authorized—

19 (A) by law for the protection of the public

20 health; or

21 (B) by an appropriate order of a court of

22 competent jurisdiction, granted, after a hearing

23 with notice to the health information custodian

24 and to all other affected individuals, on the

25 basis that there is—
19

•HR 1941 IH

1 (i) probable cause to believe that all

2 other possible sources for the information

3 have been exhausted; and

4 (ii) a specific and compelling public

5 interest in disclosure or use that

6 outweighs—

7 (I) the privacy interest of the

8 protected individual;

9 (II) the effect of the disclosure

10 on future provision of health care; and

11 (III) the effect of the disclosure

12 on health research and health over13 sight functions.

14 TITLE IV—MISCELLANEOUS

15 PROVISIONS

16 SEC. 401. SPECIFIC CLASSES OF INDIVIDUALS.

17 (a) MINORS.—Individuals under the age of 18 shall

18 have privacy protections regarding protected health infor19 mation that are at least equivalent to those recommended

20 in part II.F.4 of the Secretary’s HIPAA recommendations

21 (relating to ‘‘Minors’’).

22 (b) AGENTS AND ATTORNEYS.—

23 (1) IN GENERAL.—To the extent the Secretary

24 determines appropriate, a person may exercise the

25 rights of a protected individual under this Act, if—
20

•HR 1941 IH

1 (A) the person is authorized by law (other

2 than on account of minority), or by an instru3 ment recognized under law, to act for the pro4 tected individual; or

5 (B) the protected individual is not capable

6 of exercising his or her rights under this Act

7 and there has been no formal legal arrangement

8 for others to exercise the rights.

9 (2) RELATIONSHIP TO RECOMMENDATIONS.—

10 The authority of such a person to exercise the rights

11 of a protected individual shall be equivalent to the

12 authority described in parts II.F.5 and II.F.6 of the

13 Secretary’s HIPAA recommendations (relating to

14 ‘‘Powers of Attorney’’ and ‘‘Patients Unable to

15 Make Choices for Themselves’’).

16 (c) DECEASED PERSONS.—Deceased individuals shall

17 have privacy protections regarding protected health infor18 mation that are at least equivalent to those recommended

19 by the Secretary in part II.F.1 of the Secretary’s HIPAA

20 recommendations (relating to ‘‘Deceased Persons’’).

21 SEC. 402. FALSE PRETENSES.

22 A person may not—

23 (1) obtain or disclose protected health informa24 tion from a health information custodian or affili25 ated person under false pretenses; or
21

•HR 1941 IH

1 (2) knowingly disseminate protected health in2 formation obtained in violation of this Act.

3 SEC. 403. OBLIGATIONS OF AFFILIATED PERSONS.

4 An affiliated person shall be subject to the same re5 quirements with respect to use and disclosure of protected

6 health information as apply to the health information cus7 todian with whom the affiliated person is affiliated, except

8 that an affiliated person—

9 (1) is subject to the requirements of sections

10 201 and 202 only if the affiliated person maintains

11 the individual’s protected health information and the

12 health information custodian does not maintain the

13 individual’s protected health information; and

14 (2) is subject to the requirements of section

15 203 only to the extent that the affiliated person

16 makes a disclosure.

17 SEC. 404. PROHIBITION OF RETALIATION WITH RESPECT

18 TO EMPLOYMENT.

19 A person may not subject an individual to retaliation,

20 in regard to job application procedures, the hiring, ad21 vancement, or discharge of employees, employee com22 pensation, job training, or other terms, conditions, and

23 privileges of employment, for reporting to a governmental

24 agency conditions that may constitute a violation of a re25 quirement under this Act.
22

•HR 1941 IH

1 SEC. 405. MENTAL HEALTH AND OTHER ESPECIALLY SEN2 SITIVE INFORMATION.

3 (a) ADDITIONAL LIMITATIONS.—Not later than 1

4 year after the date of the enactment of this Act, the

5 Secretary—

6 (1) shall consider, after consulting with physi7 cians and other health care providers, patients, and

8 other appropriate groups, additional limitations re9 lating to access to, and use and disclosure of, mental

10 health and other especially sensitive protected health

11 information; and

12 (2) shall promulgate regulations to provide any

13 such additional limitations as the Secretary deter14 mines to be appropriate.

15 (b) RIGHT OF ACCESS.—For purposes of subsection

16 (a)(2), the Secretary may limit an individual’s access to

17 his or her mental health information, if the information

18 is not used by, or disclosed to, any person other than the

19 health care provider who received or created the informa20 tion.

21 (c) PSYCHOTHERAPIST-PATIENT PRIVILEGE.—Noth22 ing in this Act shall be construed to preempt, supersede,

23 or modify the operation of the psychotherapist-patient

24 privilege recognized by the Supreme Court in Jaffee v.

25 Redmond, 518 U.S. 1 (1996).
23

•HR 1941 IH

1 SEC. 406. CESSATION OF OPERATIONS.

2 Not later than 1 year after the date of the enactment

3 of this Act, the Secretary shall promulgate regulations

4 that ensure that the reasonable expectation of privacy of

5 protected individuals in protected health information is

6 maintained when health information custodians cease op7 erations.

8 SEC. 407. CONFORMING AMENDMENTS TO FEDERAL PRI9 VACY ACT.

10 (a) NEW SUBSECTION.—Section 552a of title 5,

11 United States Code, is amended by adding at the end the

12 following:

13 ‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen14 cy that is a health information custodian (as defined in

15 section 504 of the Health Information Privacy Act) shall

16 promulgate rules, in accordance with the requirements (in17 cluding general notice) of subsections (b)(1), (b)(2),

18 (b)(3), (c), and (e) of section 553 of this title, to exempt

19 a system of records within the agency, to the extent that

20 the system of records contains protected health informa21 tion (as defined in section 504 of such Act), from all provi22 sions of this section except subsections (e)(1), (e)(2), sub23 paragraphs (A) through (C) and (E) through (I) of sub24 section (e)(4), and subsections (e)(5), (e)(6), (e)(9),

25 (e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.

26 (b) REPEAL.—
24

•HR 1941 IH

1 (1) IN GENERAL.—Section 552a(f)(3) of title 5,

2 United States Code, as amended by this Act, is

3 amended by striking ‘‘pertaining to him,’’ and all

4 that follows through the semicolon and inserting

5 ‘‘pertaining to the individual;’’.

6 (2) EFFECTIVE DATE.—The amendment made

7 by paragraph (1) shall take effect 18 months after

8 the date of the enactment of this Act.

9 TITLE V—GENERAL PROVISIONS

10 SEC. 501. AUTHORITY OF THE SECRETARY.

11 (a) REGULATIONS.—

12 (1) IN GENERAL.—Not later than 1 year after

13 the date of the enactment of this Act, the Secretary

14 shall promulgate such regulations as may be nec15 essary to implement this Act, including regulations

16 establishing recordkeeping or reporting require17 ments. Such regulations may provide greater protec18 tion of protected health information, or more rights

19 to protected individuals regarding such information,

20 than is provided by the minimum requirements set

21 forth in this Act.

22 (2) PROTECTIONS FOR OTHER HEALTH INFOR23 MATION.—The Secretary may promulgate such regu24 lations as may be necessary to protect the privacy of
25

•HR 1941 IH

1 individually identifiable health information that is

2 not protected health information.

3 (3) CONSULTATION.—In promulgating regula4 tions under this Act, the Secretary shall consult with

5 elected State and local government officials.

6 (b) RESEARCH AND DEVELOPMENT.—The Secretary

7 may sponsor or carry out research and development activi8 ties related to the protection of the privacy of individually

9 identifiable health information.

10 (c) PUBLIC AWARENESS AND TRAINING.—The Sec11 retary may sponsor or carry out activities to inform pro12 tected individuals of their rights under this Act or to in13 form other persons of their rights or responsibilities under

14 this Act. The Secretary may also sponsor or carry out

15 training to increase compliance with requirements under

16 this Act.

17 (d) OTHER AUTHORITIES.—The Secretary may hold

18 hearings, administer oaths, require the testimony or depo19 sition of witnesses, require the production of documents

20 or the answering of interrogatories, or enter and inspect

21 premises owned or controlled by health information

22 custodians in order to ensure compliance with this Act or

23 otherwise further the purposes of this Act.
26

•HR 1941 IH

1 SEC. 502. ENFORCEMENT.

2 (a) EQUITABLE RELIEF.—The Secretary may bring

3 an action in an appropriate court to enjoin a violation of

4 a requirement under this Act or to obtain such other equi5 table relief as may be appropriate under the cir6 cumstances.

7 (b) CIVIL MONEY PENALTIES.—Any person who the

8 Secretary determines has failed to comply with a require9 ment under this Act shall be subject, in addition to any

10 other penalties that may be prescribed by law, to a civil

11 penalty of not more than $10,000 for each such failure.

12 The provisions of section 1128A of the Social Security Act

13 (other than subsections (a) and (b)) shall apply to the im14 position of a civil money penalty under this subsection in

15 the same manner as such provisions apply with respect

16 to the imposition of a penalty under section 1128A of such

17 Act.

18 (c) CRIMINAL PENALTIES.—

19 (1) IN GENERAL.—Whoever knowingly violates

20 a requirement under this Act shall be fined under

21 title 18, United States Code, imprisoned for not

22 more than 5 years, or both.

23 (2) MONETARY GAIN.—Whoever knowingly vio24 lates a requirement under this Act, with the intent

25 to sell, transfer, or use protected health information

26 obtained through the violation for profit or monetary
27

•HR 1941 IH

1 gain, shall be fined under title 18, United States

2 Code, imprisoned for not more than 10 years, or

3 both.

4 (d) CIVIL ACTIONS.—

5 (1) IN GENERAL.—

6 (A) INJUNCTION OR DAMAGES.—A pro7 tected individual who is adversely affected by a

8 person’s violation of a requirement under this

9 Act may bring an action—

10 (i) to enjoin the violation; or

11 (ii) in the case of a knowing or neg12 ligent violation, to recover from the person

13 the greater of—

14 (I) the compensatory damages

15 (including nonpecuniary damages) in16 curred by the protected individual as

17 a result of the violation; or

18 (II) liquidated damages of

19 $5,000 per action.

20 (B) COSTS AND ATTORNEY’S FEES.—A

21 protected individual bringing an action under

22 subparagraph (A) may recover the costs of liti23 gation and reasonable attorney’s fees (including

24 expert fees). The United States shall be liable
28

•HR 1941 IH

1 for fees and costs under this subparagraph the

2 same as a private person.

3 (C) PUNITIVE DAMAGES.—In the case of a

4 knowing violation, the person committing the

5 violation may also be held liable for punitive

6 damages.

7 (2) TIME FOR COMMENCING ACTION.—An ac8 tion under this subsection shall be commenced not

9 later than 3 years after the date on which the viola10 tion was discovered or reasonably should have been

11 discovered.

12 SEC. 503. RELATIONSHIP TO OTHER LAWS.

13 (a) IN GENERAL.—

14 (1) FEDERAL, STATE, OR LOCAL LAWS.—The

15 requirements under this Act shall not preempt, su16 persede, or modify the operation of, any Federal,

17 State, or local law that provides—

18 (A) greater protection of protected health

19 information; or

20 (B) more rights to protected individuals re21 garding such information.

22 (2) PETITIONS.—

23 (A) ADVISORY DETERMINATIONS.—Any

24 person may petition the Secretary for an advi25 sory determination whether the operation of a
29

•HR 1941 IH

1 particular Federal, State, or local law satisfies

2 the standard in paragraph (1). Any person who

3 acts in reliance on such advisory determination

4 shall not be subject to any penalty or liability

5 under section 502, except as provided in sub6 paragraph (B).

7 (B) CONTRARY COURT DETERMINATION.—

8 If a Federal or State court has reached a deter9 mination whether the operation of a particular

10 Federal, State, or local law satisfies the stand11 ard in paragraph (1), a person thereafter may

12 not rely on an advisory determination under

13 subparagraph (A) to the contrary.

14 (b) SPECIFIC LAWS.—This Act shall not be construed

15 to preempt, supersede, or modify the operation of, any of

16 the following:

17 (1) Any law that provides for the reporting of

18 vital statistics such as birth or death information.

19 (2) Any law that requires the reporting of

20 abuse or neglect information about an individual or

21 other information relating to violence against an in22 dividual.

23 (3) Subpart II of part E of title XXVI of the

24 Public Health Service Act (relating to notifications
30

•HR 1941 IH

1 of emergency response employees of possible expo2 sure to infectious diseases).

3 (4) The Americans with Disabilities Act of

4 1990.

5 (5) Any law that establishes a privilege for

6 records used in health professional peer review ac7 tivities.

8 (6) Any law that requires the disclosure of pro9 tected health information, if the disclosure is per10 mitted under this Act.

11 (c) DEPARTMENT OF VETERANS AFFAIRS.—The lim12 itations on use and disclosure of protected health informa13 tion under this Act shall not be construed to prevent any

14 exchange of such information within and among compo15 nents of the Department of Veterans Affairs that deter16 mine eligibility for or entitlement to, or that provide, bene17 fits under laws administered by the Secretary of Veterans

18 Affairs.

19 (d) CONGRESS.—Nothing in this Act shall be inter20 preted to affect the ability of the Congress, a committee

21 of the Congress, or the Members of the Congress referred

22 to in section 2954 of title 5, United States Code, to obtain

23 such information as may be necessary for the fulfillment

24 of the Congress’, the committee’s, or the Members’ legisla25 tive or oversight functions.
31

•HR 1941 IH

1 (e) PRIVILEGES.—A disclosure about a protected in2 dividual made under title III, or a protected individual’s

3 disclosure of protected health information for the purpose

4 of obtaining, or paying for, health care, may not be con5 strued as diminishing, waiving, or otherwise impairing any

6 privilege that the protected individual has in a court of

7 a State or the United States.

8 SEC. 504. DEFINITIONS.

9 For purposes of this Act:

10 (1) AFFILIATED PERSON.—The term ‘‘affiliated

11 person’’ means a person who—

12 (A) is not a health information custodian;

13 (B) is an agent or contractor of a health

14 information custodian; and

15 (C) pursuant to an agreement with such

16 custodian, receives, creates, uses, maintains, or

17 discloses protected health information.

18 (2) DISCLOSE.—The term ‘‘disclose’’, when

19 used with respect to protected health information,

20 means to provide access to the information to a per21 son other than—

22 (A) the custodian or an officer or employee

23 of the custodian;

24 (B) an affiliated person of the custodian;

25 or
32

•HR 1941 IH

1 (C) a protected individual who is a subject

2 of the information.

3 (3) DISCLOSURE.—The term ‘‘disclosure’’

4 means the act or an instance of disclosing.

5 (4) HEALTH CARE.—The term ‘‘health care’’

6 means—

7 (A) any preventive, diagnostic, therapeutic,

8 rehabilitative, maintenance, or palliative care,

9 counseling, service, or procedure—

10 (i) with respect to the physical or

11 mental condition, or functional status, of

12 an individual; or

13 (ii) affecting the structure or function

14 of the human body or any part of the

15 human body, including banking of blood,

16 sperm, organs, or any other tissue for ad17 ministration to patients; or

18 (B) any sale or dispensing of a drug, de19 vice, equipment, or other item to an individual,

20 or for the use of an individual, pursuant to a

21 prescription.

22 (5) HEALTH CARE PAYER.—The term ‘‘health

23 care payer’’ means a person who pays for health

24 care in the ordinary course of business.
33

•HR 1941 IH

1 (6) HEALTH CARE PROVIDER.—The term

2 ‘‘health care provider’’ means a person who provides

3 health care in the ordinary course of business or

4 practice of a profession, pursuant to license, certifi5 cation, accreditation, or other legal authorization.

6 (7) HEALTH INFORMATION CUSTODIAN.—

7 (A) IN GENERAL.—The term ‘‘health infor8 mation custodian’’ means a health care pro9 vider, a health care payer, or any other person

10 who obtains protected health information as a

11 result of a disclosure authorized under this Act.

12 (B) EXCEPTIONS.—Such term does not

13 include—

14 (i) an affiliated person;

15 (ii) an individual who obtains pro16 tected health information under paragraph

17 (2), (3), or (4) of section 307; or

18 (iii) an individual who receives pro19 tected health information in a public health

20 intervention because the individual’s health

21 is at risk.

22 (8) HEALTH RESEARCH.—The term ‘‘health re23 search’’ means a biomedical, epidemiological, or

24 health services research or statistics project, or a re25 search project on behavioral and social factors af-
34

•HR 1941 IH

1 fecting health, that is designed to develop or con2 tribute to generalizable scientific or clinical knowl3 edge.

4 (9) LAW ENFORCEMENT INQUIRY.—The term

5 ‘‘law enforcement inquiry’’ means a lawful investiga6 tion or official proceeding inquiring into a violation

7 of, or failure to comply with, any criminal or civil

8 statute or any regulation, rule, or order issued pur9 suant to such a statute.

10 (10) PERSON.—The term ‘‘person’’ includes an

11 authority of the United States, a State, or a political

12 subdivision of a State.

13 (11) PROTECTED HEALTH INFORMATION.—The

14 term ‘‘protected health information’’ means any in15 formation, whether oral or recorded in any form or

16 medium, that—

17 (A) relates in any way to the past, present,

18 or future physical or mental health or condition

19 of a protected individual, the provision of health

20 care to an individual, or payment for the provi21 sion of health care to an individual;

22 (B) is received or created by a health care

23 provider in the ordinary course of business or

24 practice of a profession or by a health care
35

•HR 1941 IH

1 payer, or is obtained as a result of a disclosure

2 authorized under this Act; and

3 (C) identifies the individual, or with re4 spect to which there is a reasonable basis to be5 lieve that the information can be used to iden6 tify the individual.

7 (12) PROTECTED INDIVIDUAL.—The term ‘‘pro8 tected individual’’ means an individual who is the

9 subject of protected health information.

10 (13) SECRETARY.—The term ‘‘Secretary’’

11 means the Secretary of Health and Human Services.

12 (14) SECRETARY’S HIPAA RECOMMENDA13 TIONS.—The term ‘‘Secretary’s HIPAA rec14 ommendations’’ means the recommendations of the

15 Secretary of Health and Human Services, pursuant

16 to section 264 of the Health Insurance Portability

17 and Accountability Act of 1996, entitled ‘‘Confiden18 tiality of Individually-Identifiable Health Informa19 tion’’ that were submitted to the Committee on

20 Commerce and the Committee on Ways and Means

21 of the House of Representatives and the Committee

22 on Labor and Human Resources and the Committee

23 on Finance of the Senate, on September 11, 1997.

24 (15) STATE.—The term ‘‘State’’ includes the

25 District of Columbia, Puerto Rico, the Virgin Is-
36

•HR 1941 IH

1 lands, Guam, American Samoa, and the Northern

2 Mariana Islands.

3 (16) USE.—The term ‘‘use’’, when used with

4 respect to protected health information that is held

5 by a health information custodian, means—

6 (A) to use, or provide access to, the infor7 mation in any manner that does not constitute

8 a disclosure; or

9 (B) any act or instance of using, or pro10 viding access, described in subparagraph (A).

11 SEC. 505. EFFECTIVE DATE.

12 The requirements under this Act applicable to health

13 information custodians and affiliated persons shall take ef14 fect 18 months after the date of the enactment of this

15 Act.

Æ