I

104TH CONGRESS

1ST SESSION H. R. 435

To establish a code of fair information practices for health information,

to amend section 552a of title 5, United States Code, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

JANUARY 9, 1995

Mr. CONDIT introduced the following bill; which was referred to the Committee on Commerce and, in addition, to the Committees on Government Reform and Oversight and the Judiciary, for a period to be subsequently

determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To establish a code of fair information practices for health

information, to amend section 552a of title 5, United

States Code, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Fair Health Information Practices Act of 1995’’.

6 (b) TABLE OF CONTENTS.—The table of contents for

7 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings and purposes.
2

•HR 435 IH

Sec. 3. Definitions.

TITLE I—FAIR HEALTH INFORMATION PRACTICES

Subtitle A—Duties of Health Information Trustees

Sec. 101. Inspection of protected health information.

Sec. 102. Amendment of protected health information.

Sec. 103. Notice of information practices.

Sec. 104. Accounting for disclosures.

Sec. 105. Security.

Subtitle B—Use and Disclosure of Protected Health Information

Sec. 111. General limitations on use and disclosure.

Sec. 112. Authorizations for disclosure of protected health information.

Sec. 113. Treatment, payment, and oversight.

Sec. 114. Next of kin and directory information.

Sec. 115. Public health.

Sec. 116. Health research.

Sec. 117. Emergency circumstances.

Sec. 118. Judicial and administrative purposes.

Sec. 119. Law enforcement.

Sec. 120. Subpoenas, warrants, and search warrants.

Sec. 121. Health information service organizations.

Subtitle C—Access Procedures and Challenge Rights

Sec. 131. Access procedures for law enforcement subpoenas, warrants, and

search warrants.

Sec. 132. Challenge procedures for law enforcement subpoenas.

Sec. 133. Access and challenge procedures for other subpoenas.

Sec. 134. Construction of subtitle; suspension of statute of limitations.

Sec. 135. Responsibilities of Secretary.

Subtitle D—Miscellaneous Provisions

Sec. 141. Payment card and electronic payment transactions.

Sec. 142. Access to protected health information outside of the United States.

Sec. 143. Standards for electronic documents and communications.

Sec. 144. Duties and authorities of affiliated persons.

Sec. 145. Agents and attorneys.

Sec. 146. Minors.

Sec. 147. Maintenance of certain protected health information.

Subtitle E—Enforcement

Sec. 151. Civil actions.

Sec. 152. Civil money penalties.

Sec. 153. Alternative dispute resolution.

Sec. 154. Amendments to criminal law.

TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE

Sec. 201. Amendments to title 5, United States Code.
3

•HR 435 IH

TITLE III—REGULATIONS, RESEARCH, AND EDUCATION; EFFECTIVE DATES; APPLICABILITY; AND RELATIONSHIP TO OTHER

LAWS

Sec. 301. Regulations; research and education.

Sec. 302. Effective dates.

Sec. 303. Applicability.

Sec. 304. Relationship to other laws.

1 SEC. 2. FINDINGS AND PURPOSES.

2 (a) FINDINGS.—The Congress finds as follows:

3 (1) The right to privacy is a personal and fun4 damental right protected by the Constitution of the

5 United States.

6 (2) The improper use or disclosure of personally

7 identifiable health information about an individual

8 may cause significant harm to the interests of the

9 individual in privacy and health care, and may un10 fairly affect the ability of the individual to obtain

11 employment, education, insurance, credit, and other

12 necessities.

13 (3) Current legal protections for health infor14 mation vary from State to State and are inadequate

15 to meet the need for fair information practices

16 standards.

17 (4) The movement of individuals and health in18 formation across State lines, access to and exchange

19 of health information from automated data banks

20 and networks, and the emergence of multistate

21 health care providers and payors create a compelling

22 need for uniform Federal law, rules, and procedures
4

•HR 435 IH

1 governing the use, maintenance, and disclosure of

2 health information.

3 (5) Uniform rules governing the use, mainte4 nance, and disclosure of health information are an

5 essential part of health care reform, are necessary to

6 support the computerization of health information,

7 and can reduce the cost of providing health services

8 by making the necessary transfer of health informa9 tion more efficient.

10 (6) An individual needs access to health infor11 mation about the individual as a matter of fairness,

12 to enable the individual to make informed decisions

13 about health care, and to correct inaccurate or in14 complete information.

15 (b) PURPOSES.—The purposes of this Act are as

16 follows:

17 (1) To define the rights of an individual with

18 respect to health information about the individual

19 that is created or maintained as part of the health

20 treatment and payment process.

21 (2) To define the rights and responsibilities of

22 a person who creates or maintains individually iden23 tifiable health information that originates or is used

24 in the health treatment or payment process.
5

•HR 435 IH

1 (3) To establish effective mechanisms to enforce

2 the rights and responsibilities defined in this Act.

3 SEC. 3. DEFINITIONS.

4 (a) DEFINITIONS RELATING TO PROTECTED

5 HEALTH INFORMATION.—For purposes of this Act:

6 (1) DISCLOSE.—The term ‘‘disclose’’, when

7 used with respect to protected health information

8 that is held by a health information trustee, means

9 to provide access to the information, but only if such

10 access is provided by the trustee to a person other

11 than—

12 (A) the trustee or an officer or employee of

13 the trustee;

14 (B) an affiliated person of the trustee; or

15 (C) a protected individual who is a subject

16 of the information.

17 (2) DISCLOSURE.—The term ‘‘disclosure’’

18 means the act or an instance of disclosing.

19 (3) PROTECTED HEALTH INFORMATION.—The

20 term ‘‘protected health information’’ means any in21 formation, whether oral or recorded in any form or

22 medium—

23 (A) that is created or received in a State

24 by—

25 (i) a health care provider;
6

•HR 435 IH

1 (ii) a health benefit plan sponsor;

2 (iii) a health oversight agency;

3 (iv) a health information service orga4 nization; or

5 (v) a public health authority;

6 (B) that relates in any way to the past,

7 present, or future physical or mental health or

8 condition or functional status of a protected in9 dividual, the provision of health care to a pro10 tected individual, or payment for the provision

11 of health care to a protected individual; and

12 (C) that—

13 (i) identifies the individual; or

14 (ii) with respect to which there is a

15 reasonable basis to believe that the infor16 mation can be used to identify the individ17 ual.

18 (4) PROTECTED INDIVIDUAL.—The term ‘‘pro19 tected individual’’ means an individual who, with re20 spect to a date—

21 (A) is living on the date; or

22 (B) has died within the 2-year period end23 ing on the date.
7

•HR 435 IH

1 (5) USE.—The term ‘‘use’’, when used with re2 spect to protected health information that is held by

3 a health information trustee, means—

4 (A) to use, or provide access to, the infor5 mation in any manner that does not constitute

6 a disclosure; or

7 (B) any act or instance of using, or provid8 ing access, described in subparagraph (A).

9 (b) DEFINITIONS RELATING TO HEALTH INFORMA10 TION TRUSTEES.—For purposes of this Act:

11 (1) CARRIER.—The term ‘‘carrier’’ means a li12 censed insurance company, a hospital or medical

13 service corporation (including an existing Blue Cross

14 or Blue Shield organization, within the meaning of

15 section 833(c)(2) of the Internal Revenue Code of

16 1986), a health maintenance organization, or other

17 entity licensed or certified by a State to provide

18 health insurance or health benefits.

19 (2) HEALTH BENEFIT PLAN.—The term

20 ‘‘health benefit plan’’ means—

21 (A) any contract of health insurance, in22 cluding any hospital or medical service policy or

23 certificate, hospital or medical service plan con24 tract, or health maintenance organization group

25 contract, that is provided by a carrier; and
8

•HR 435 IH

1 (B) an employee welfare benefit plan or

2 other arrangement insofar as the plan or ar3 rangement provides health benefits and is fund4 ed in a manner other than through the pur5 chase of one or more policies or contracts de6 scribed in subparagraph (A).

7 (3) HEALTH BENEFIT PLAN SPONSOR.—The

8 term ‘‘health benefit plan sponsor’’ means a person

9 who, with respect to a specific item of protected

10 health information, receives, creates, uses, main11 tains, or discloses the information while acting in

12 whole or in part in the capacity of—

13 (A) a carrier or other person providing a

14 health benefit plan, including any public entity

15 that provides payments for health care items

16 and services under a health benefit plan that

17 are equivalent to payments provided by a pri18 vate person under such a plan; or

19 (B) an officer or employee of a person de20 scribed in subparagraph (A).

21 (4) HEALTH CARE PROVIDER.—The term

22 ‘‘health care provider’’ means a person who, with re23 spect to a specific item of protected health informa24 tion, receives, creates, uses, maintains, or discloses
9

•HR 435 IH

1 the information while acting in whole or in part in

2 the capacity of—

3 (A) a person who is licensed, certified, reg4 istered, or otherwise authorized by law to pro5 vide an item or service that constitutes health

6 care in the ordinary course of business or prac7 tice of a profession;

8 (B) a Federal or State program that di9 rectly provides items or services that constitute

10 health care to beneficiaries; or

11 (C) an officer or employee of a person de12 scribed in subparagraph (A) or (B).

13 (5) HEALTH INFORMATION SERVICE ORGANIZA14 TION.—The term ‘‘health information service organi15 zation’’ means a person who, with respect to a spe16 cific item of protected health information, receives,

17 creates, uses, maintains, or discloses the information

18 while acting in whole or in part in the capacity of—

19 (A) a person, other than an affiliated per20 son, who performs specific functions for which

21 the Secretary has authorized (by means of a

22 designation or certification) the person to re23 ceive access to specific health care data in elec24 tronic or magnetic form; or
10

•HR 435 IH

1 (B) an officer or employee of a person de2 scribed in subparagraph (A).

3 (6) HEALTH INFORMATION TRUSTEE.—The

4 term ‘‘health information trustee’’ means—

5 (A) a health care provider;

6 (B) a health information service organiza7 tion;

8 (C) a health oversight agency;

9 (D) a health benefit plan sponsor;

10 (E) a public health authority;

11 (F) a health researcher;

12 (G) a person who, with respect to a spe13 cific item of protected health information, is not

14 described in subparagraphs (A) through (F) but

15 receives the information—

16 (i) pursuant to—

17 (I) section 117 (relating to emer18 gency circumstances);

19 (II) section 118 (relating to judi20 cial and administrative purposes);

21 (III) section 119 (relating to law

22 enforcement); or

23 (IV) section 120 (relating to sub24 poenas, warrants, and search war25 rants); or
11

•HR 435 IH

1 (ii) while acting in whole or in part in

2 the capacity of an officer or employee of a

3 person described in clause (i).

4 (7) HEALTH OVERSIGHT AGENCY.—The term

5 ‘‘health oversight agency’’ means a person who, with

6 respect to a specific item of protected health infor7 mation, receives, creates, uses, maintains, or dis8 closes the information while acting in whole or in

9 part in the capacity of—

10 (A) a person who performs or oversees the

11 performance of an assessment, evaluation, de12 termination, or investigation relating to the li13 censing, accreditation, or certification of health

14 care providers;

15 (B) a person who—

16 (i) performs or oversees the perform17 ance of an audit, assessment, evaluation,

18 determination, or investigation relating to

19 the effectiveness of, compliance with, or

20 applicability of, legal, fiscal, medical, or

21 scientific standards or aspects of perform22 ance related to the delivery of, or payment

23 for, health care; and

24 (ii) is a public agency, acting on be25 half of a public agency, acting pursuant to
12

•HR 435 IH

1 a requirement of a public agency, or carry2 ing out activities under a State or Federal

3 statute regulating the assessment, evalua4 tion, determination, or investigation; or

5 (C) an officer or employee of a person de6 scribed in subparagraph (A) or (B).

7 (8) HEALTH RESEARCHER.—The term ‘‘health

8 researcher’’ means a person who, with respect to a

9 specific item of protected health information, re10 ceives the information—

11 (A) pursuant to section 116 (relating to

12 health research); or

13 (B) while acting in whole or in part in the

14 capacity of an officer or employee of a person

15 described in subparagraph (A).

16 (9) PUBLIC HEALTH AUTHORITY.—The term

17 ‘‘public health authority’’ means a person who, with

18 respect to a specific item of protected health infor19 mation, receives, creates, uses, maintains, or dis20 closes the information while acting in whole or in

21 part in the capacity of—

22 (A) an authority of the United States, a

23 State, or a political subdivision of a State that

24 is responsible for public health matters;
13

•HR 435 IH

1 (B) a person acting under the direction of

2 such an authority; or

3 (C) an officer or employee of a person de4 scribed in subparagraph (A) or (B).

5 (c) OTHER DEFINITIONS.—For purposes of this Act:

6 (1) AFFILIATED PERSON.—The term ‘‘affiliated

7 person’’ means a person who—

8 (A) is not a health information trustee;

9 (B) is a contractor, subcontractor, associ10 ate, or subsidiary of a person who is a health

11 information trustee; and

12 (C) pursuant to an agreement or other re13 lationship with such trustee, receives, creates,

14 uses, maintains, or discloses protected health

15 information.

16 (2) APPROVED HEALTH RESEARCH PROJECT.—

17 The term ‘‘approved health research project’’ means

18 a biomedical, epidemiological, or health services re19 search or statistics project, or a research project on

20 behavioral and social factors affecting health, that

21 has been approved by a certified institutional review

22 board.

23 (3) CERTIFIED INSTITUTIONAL REVIEW

24 BOARD.—The term ‘‘certified institutional review

25 board’’ means a board—
14

•HR 435 IH

1 (A) established by an entity to review re2 search involving protected health information

3 and the rights of protected individuals con4 ducted at or supported by the entity;

5 (B) established in accordance with regula6 tions of the Secretary under section 116(d)(1);

7 and

8 (C) certified by the Secretary under section

9 116(d)(2).

10 (4) HEALTH CARE.—The term ‘‘health care’’—

11 (A) means—

12 (i) any preventive, diagnostic, thera13 peutic, rehabilitative, maintenance, or pal14 liative care, counseling, service, or proce15 dure—

16 (I) with respect to the physical or

17 mental condition, or functional status,

18 of an individual; or

19 (II) affecting the structure or

20 function of the human body or any

21 part of the human body, including

22 banking of blood, sperm, organs, or

23 any other tissue; or

24 (ii) any sale or dispensing of a drug,

25 device, equipment, or other item to an indi-
15

•HR 435 IH

1 vidual, or for the use of an individual, pur2 suant to a prescription; but

3 (B) does not include any item or service

4 that is not furnished for the purpose of main5 taining or improving the health of an individual.

6 (5) LAW ENFORCEMENT INQUIRY.—The term

7 ‘‘law enforcement inquiry’’ means a lawful investiga8 tion or official proceeding inquiring into a violation

9 of, or failure to comply with, any criminal or civil

10 statute or any regulation, rule, or order issued pur11 suant to such a statute.

12 (6) PERSON.—The term ‘‘person’’ includes an

13 authority of the United States, a State, or a political

14 subdivision of a State.

15 (7) SECRETARY.—The term ‘‘Secretary’’ means

16 the Secretary of Health and Human Services.

17 (8) STATE.—The term ‘‘State’’ includes the

18 District of Columbia, Puerto Rico, the Virgin Is19 lands, Guam, American Samoa, and the Northern

20 Mariana Islands.
16

•HR 435 IH

1 TITLE I—FAIR HEALTH

2 INFORMATION PRACTICES

3 Subtitle A—Duties of Health

4 Information Trustees

5 SEC. 101. INSPECTION OF PROTECTED HEALTH INFORMA6 TION.

7 (a) IN GENERAL.—Except as provided in subsection

8 (b), a health information trustee described in subsection

9 (g)—

10 (1) shall permit a protected individual to in11 spect any protected health information about the in12 dividual that the trustee maintains, any accounting

13 with respect to such information required under sec14 tion 104, and any copy of an authorization required

15 under section 112 that pertains to such information;

16 (2) shall provide the protected individual with a

17 copy of the information upon request by the individ18 ual and subject to any conditions imposed by the

19 trustee under subsection (d);

20 (3) shall permit a person who has been des21 ignated in writing by the protected individual to in22 spect the information on behalf of the individual or

23 to accompany the individual during the inspection;

24 and
17

•HR 435 IH

1 (4) may offer to explain or interpret informa2 tion that is inspected or copied under this sub3 section.

4 (b) EXCEPTIONS.—A health information trustee is

5 not required by this section to permit inspection or copy6 ing of protected health information by a protected individ7 ual if any of the following conditions apply:

8 (1) MENTAL HEALTH TREATMENT NOTES.—

9 The information consists of psychiatric, psycho10 logical, or mental health treatment notes about the

11 individual, the trustee determines in the exercise of

12 reasonable professional judgment that inspection or

13 copying of the notes would cause sufficient harm to

14 the protected individual so as to outweigh the desir15 ability of permitting access, and the trustee does not

16 disclose the notes to any person not directly engaged

17 in treating the individual, except with the authoriza18 tion of the individual or under compulsion of law.

19 (2) INFORMATION ABOUT OTHERS.—The infor20 mation relates to an individual, other than the pro21 tected individual or a health care provider, and the

22 trustee determines in the exercise of reasonable pro23 fessional judgment that inspection or copying of the

24 information would cause sufficient harm to one or
18

•HR 435 IH

1 both of the individuals so as to outweigh the desir2 ability of permitting access.

3 (3) ENDANGERMENT TO LIFE OR SAFETY.—In4 spection or copying of the information could reason5 ably be expected to endanger the life or physical

6 safety of an individual.

7 (4) CONFIDENTIAL SOURCE.—The information

8 identifies or could reasonably lead to the identifica9 tion of an individual (other than a health care pro10 vider) who provided information under a promise of

11 confidentiality to a health care provider concerning

12 a protected individual who is a subject of the infor13 mation.

14 (5) ADMINISTRATIVE PURPOSES.—The informa15 tion—

16 (A) is used by the trustee solely for admin17 istrative purposes and not in the provision of

18 health care to a protected individual who is a

19 subject of the information; and

20 (B) is not disclosed by the trustee to any

21 person.

22 (6) DUPLICATIVE INFORMATION.—The informa23 tion duplicates information available for inspection

24 under subsection (a).
19

•HR 435 IH

1 (7) INFORMATION COMPILED IN ANTICIPATION

2 OF LITIGATION.—The information is compiled prin3 cipally—

4 (A) in anticipation of a civil, criminal, or

5 administrative action or proceeding; or

6 (B) for use in such an action or proceed7 ing.

8 (c) INSPECTION AND COPYING OF SEGREGABLE POR9 TION.—A health information trustee shall permit inspec10 tion and copying under subsection (a) of any reasonably

11 segregable portion of a record after deletion of any portion

12 that is exempt under subsection (b).

13 (d) CONDITIONS.—A health information trustee

14 may—

15 (1) require a written request for the inspection

16 and copying of protected health information under

17 this section; and

18 (2) charge a reasonable cost-based fee for—

19 (A) permitting inspection of information

20 under this section; and

21 (B) providing a copy of protected health

22 information under this section.

23 (e) STATEMENT OF REASONS FOR DENIAL.—If a

24 health information trustee denies in whole or in part a

25 request for inspection or copying under this section, the
20

•HR 435 IH

1 trustee shall provide the protected individual who made

2 the request with a written statement of the reasons for

3 the denial.

4 (f) DEADLINE.—A health information trustee shall

5 comply with or deny a request for inspection or copying

6 of protected health information under this section within

7 the 30-day period beginning on the date the trustee re8 ceives the request.

9 (g) APPLICABILITY.—This section applies to a health

10 information trustee who is—

11 (1) a health benefit plan sponsor;

12 (2) a health care provider;

13 (3) a health information service organization;

14 (4) a health oversight agency; or

15 (5) a public health authority.

16 SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA17 TION.

18 (a) IN GENERAL.—A health information trustee de19 scribed in subsection (f) shall, within the 45-day period

20 beginning on the date the trustee receives from a protected

21 individual about whom the trustee maintains protected

22 health information a written request that the trustee cor23 rect or amend the information, complete the duties de24 scribed in one of the following paragraphs:
21

•HR 435 IH

1 (1) CORRECTION OR AMENDMENT AND NOTIFI2 CATION.—The trustee shall—

3 (A) make the correction or amendment re4 quested;

5 (B) inform the protected individual of the

6 amendment or correction that has been made;

7 (C) make reasonable efforts to inform any

8 person who is identified by the protected indi9 vidual, who is not an employee of the trustee,

10 and to whom the uncorrected or unamended

11 portion of the information was previously dis12 closed of the correction or amendment that has

13 been made; and

14 (D) at the request of the individual, make

15 reasonable efforts to inform any known source

16 of the uncorrected or unamended portion of the

17 information about the correction or amendment

18 that has been made.

19 (2) REASONS FOR REFUSAL AND REVIEW PRO20 CEDURES.—The trustee shall inform the protected

21 individual of—

22 (A) the reasons for the refusal of the trust23 ee to make the correction or amendment;

24 (B) any procedures for further review of

25 the refusal; and
22

•HR 435 IH

1 (C) the individual’s right to file with the

2 trustee a concise statement setting forth the re3 quested correction or amendment and the indi4 vidual’s reasons for disagreeing with the refusal

5 of the trustee.

6 (b) STANDARDS FOR CORRECTION OR AMEND7 MENT.—A trustee shall correct or amend protected health

8 information in accordance with a request made under sub9 section (a) if the trustee determines that the information

10 is not accurate, relevant, timely, or complete for the pur11 poses for which the information may be used or disclosed

12 by the trustee.

13 (c) STATEMENT OF DISAGREEMENT.—After a pro14 tected individual has filed a statement of disagreement

15 under subsection (a)(2)(C), the trustee, in any subsequent

16 disclosure of the disputed portion of the information, shall

17 include a copy of the individual’s statement and may in18 clude a concise statement of the trustee’s reasons for not

19 making the requested correction or amendment.

20 (d) CONSTRUCTION.—This section may not be con21 strued to require a health information trustee to conduct

22 a hearing or proceeding concerning a request for a correc23 tion or amendment to protected health information the

24 trustee maintains.
23

•HR 435 IH

1 (e) CORRECTION.—For purposes of subsection (a), a

2 correction is deemed to have been made to protected

3 health information when—

4 (1) information that is not timely, accurate, rel5 evant, or complete is clearly marked as incorrect; or

6 (2) supplementary correct information is made

7 part of the information and adequately cross-ref8 erenced.

9 (f) APPLICABILITY.—This section applies to a health

10 information trustee who is—

11 (1) a health benefit plan sponsor;

12 (2) a health care provider;

13 (3) a health information service organization;

14 (4) a health oversight agency; or

15 (5) a public health authority.

16 SEC. 103. NOTICE OF INFORMATION PRACTICES.

17 (a) PREPARATION OF NOTICE.—A health information

18 trustee described in subsection (d) shall prepare a written

19 notice of information practices describing the following:

20 (1) The rights under this Act of a protected in21 dividual who is the subject of protected health infor22 mation, including the right to inspect and copy such

23 information and the right to seek amendments to

24 such information, and the procedures for authorizing
24

•HR 435 IH

1 disclosures of protected health information and for

2 revoking such authorizations.

3 (2) The procedures established by the trustee

4 for the exercise of such rights.

5 (3) The uses and disclosures of protected health

6 information that are authorized under this Act.

7 (b) DISSEMINATION OF NOTICE.—A health informa8 tion trustee—

9 (1) shall, upon request, provide any person with

10 a copy of the trustee’s notice of information prac11 tices (described in subsection (a)); and

12 (2) shall make reasonable efforts to inform per13 sons in a clear and conspicuous manner of the exist14 ence and availability of such notice.

15 (c) MODEL NOTICES.—Not later than July 1, 1996,

16 the Secretary, after notice and opportunity for public com17 ment, shall develop and disseminate model notices of infor18 mation practices for use by health information trustees

19 under this section.

20 (d) APPLICABILITY.—This section applies to a health

21 information trustee who is—

22 (1) a health benefit plan sponsor;

23 (2) a health care provider;

24 (3) a health information service organization; or

25 (4) a health oversight agency.
25

•HR 435 IH

1 SEC. 104. ACCOUNTING FOR DISCLOSURES.

2 (a) IN GENERAL.—Except as provided in subsection

3 (b) and section 114, each health information trustee shall

4 create and maintain, with respect to any protected health

5 information the trustee discloses, a record of—

6 (1) the date and purpose of the disclosure;

7 (2) the name of the person to whom the disclo8 sure was made;

9 (3) the address of the person to whom the dis10 closure was made or the location to which the disclo11 sure was made; and

12 (4) where practicable, a description of the infor13 mation disclosed.

14 (b) REGULATIONS.—Not later than July 1, 1996, the

15 Secretary shall promulgate regulations that exempt a

16 health information trustee from maintaining a record

17 under subsection (a) with respect protected health infor18 mation disclosed by the trustee for purposes of peer

19 review, licensing, certification, accreditation, and similar

20 activities.

21 SEC. 105. SECURITY.

22 (a) IN GENERAL.—Each health information trustee

23 who receives or creates protected health information that

24 is subject to this Act shall maintain reasonable and appro25 priate administrative, technical, and physical safeguards—
26

•HR 435 IH

1 (1) to ensure the integrity and confidentiality of

2 the information;

3 (2) to protect against any reasonably antici4 pated—

5 (A) threats or hazards to the security or

6 integrity of the information; and

7 (B) unauthorized uses or disclosures of the

8 information; and

9 (3) otherwise ensure compliance with this Act

10 by the trustee and the officers and employees of the

11 trustee.

12 (b) GUIDELINES.—Not later than July 1, 1996, the

13 Secretary, after notice and opportunity for public com14 ment, shall develop and disseminate guidelines for the im15 plementation of this section. The guidelines shall take into

16 account—

17 (1) the technical capabilities of record systems

18 used to maintain protected health information;

19 (2) the costs of security measures;

20 (3) the need for training persons who have ac21 cess to protected health information; and

22 (4) the value of audit trails in computerized

23 record systems.
27

•HR 435 IH

1 Subtitle B—Use and Disclosure of

2 Protected Health Information

3 SEC. 111. GENERAL LIMITATIONS ON USE AND DISCLO4 SURE.

5 (a) USE.—Except as otherwise provided under this

6 Act, a health information trustee may use protected health

7 information only for a purpose—

8 (1) that is compatible with and directly related

9 to the purpose for which the information—

10 (A) was collected; or

11 (B) was received by the trustee; or

12 (2) for which the trustee is authorized to dis13 close the information under this Act.

14 (b) DISCLOSURE.—A health information trustee may

15 disclose protected health information only as authorized

16 under this Act.

17 (c) SCOPE OF USES AND DISCLOSURES.—

18 (1) IN GENERAL.—A use or disclosure of pro19 tected health information by a health information

20 trustee shall be limited, when practicable, to the

21 minimum amount of information necessary to ac22 complish the purpose for which the information is

23 used or disclosed.

24 (2) GUIDELINES.—Not later than July 1, 1996,

25 the Secretary, after notice and opportunity for pub-
28

•HR 435 IH

1 lic comment, shall issue guidelines to implement

2 paragraph (1), which shall take into account the

3 technical capabilities of the record systems used to

4 maintain protected health information and the costs

5 of limiting use and disclosure.

6 (d) IDENTIFICATION OF DISCLOSED INFORMATION

7 AS PROTECTED INFORMATION.—Except with respect to

8 protected health information that is disclosed under sec9 tion 114 (relating to next of kin and directory informa10 tion), a health information trustee may disclose protected

11 health information only if the recipient has been notified

12 that the information is protected health information that

13 is subject to this Act.

14 (e) AGREEMENT TO LIMIT USE OR DISCLOSURE.—

15 A health information trustee who receives protected health

16 information from any person pursuant to a written agree17 ment to restrict use or disclosure of the information to

18 a greater extent than otherwise would be required under

19 this Act shall comply with the terms of the agreement,

20 except where use or disclosure of the information in viola21 tion of the agreement is required by law. A trustee who

22 fails to comply with the preceding sentence shall be subject

23 to section 151 (relating to civil actions) with respect to

24 such failure.
29

•HR 435 IH

1 (f) NO GENERAL REQUIREMENT TO DISCLOSE.—

2 Nothing in this Act shall be construed to require a health

3 information trustee to disclose protected health informa4 tion not otherwise required to be disclosed by law.

5 SEC. 112. AUTHORIZATIONS FOR DISCLOSURE OF PRO6 TECTED HEALTH INFORMATION.

7 (a) WRITTEN AUTHORIZATIONS.—A health informa8 tion trustee, other than a health information service orga9 nization, may disclose protected health information pursu10 ant to an authorization executed by the protected individ11 ual who is the subject of the information, if each of the

12 following requirements is satisfied:

13 (1) WRITING.—The authorization is in writing,

14 signed by the individual, and dated on the date of

15 such signature.

16 (2) SEPARATE FORM.—The authorization is not

17 on a form used to authorize or facilitate the provi18 sion of, or payment for, health care.

19 (3) TRUSTEE DESCRIBED.—The trustee is spe20 cifically named or generically described in the au21 thorization as authorized to disclose such informa22 tion.

23 (4) RECIPIENT DESCRIBED.—The person to

24 whom the information is to be disclosed is specifi25 cally named or generically described in the author-
30

•HR 435 IH

1 ization as a person to whom such information may

2 be disclosed.

3 (5) STATEMENT OF INTENDED USES AND DIS4 CLOSURES RECEIVED.—The authorization contains

5 an acknowledgment that the individual has received

6 a statement described in subsection (b) from such

7 person.

8 (6) INFORMATION DESCRIBED.—The informa9 tion to be disclosed is described in the authorization.

10 (7) AUTHORIZATION TIMELY RECEIVED.—The

11 authorization is received by the trustee during a pe12 riod described in subsection (c)(1).

13 (8) DISCLOSURE TIMELY MADE.—The disclo14 sure occurs during a period described in subsection

15 (c)(2).

16 (b) STATEMENT OF INTENDED USES AND DISCLO17 SURES.—

18 (1) IN GENERAL.—A person who wishes to re19 ceive from a health information trustee protected

20 health information about a protected individual pur21 suant to an authorization executed by the individual

22 shall supply the individual, in writing and on a form

23 that is distinct from the authorization, with a state24 ment of the uses for which the person intends the

25 information and the disclosures the person intends
31

•HR 435 IH

1 to make of the information. Such statement shall be

2 supplied before the authorization is executed.

3 (2) ENFORCEMENT.—If the person uses or dis4 closes the information in a manner that is inconsist5 ent with such statement, the person shall be subject

6 to section 151 (relating to civil actions) with respect

7 to such failure, except where such use or disclosure

8 is required by law.

9 (3) MODEL STATEMENTS.—Not later than July

10 1, 1996, the Secretary, after notice and opportunity

11 for public comment, shall develop and disseminate

12 model statements of intended uses and disclosures of

13 the type described in paragraph (1).

14 (c) TIME LIMITATIONS ON AUTHORIZATIONS.—

15 (1) RECEIPT BY TRUSTEE.—For purposes of

16 subsection (a)(7), an authorization is timely received

17 if it is received by the trustee during—

18 (A) the 1-year period beginning on the

19 date that the authorization is signed under sub20 section (a)(1), if the authorization permits the

21 disclosure of protected health information to—

22 (i) a health benefit plan sponsor;

23 (ii) a health care provider;

24 (iii) a health oversight agency;

25 (iv) a public health authority;
32

•HR 435 IH

1 (v) a health researcher; or

2 (vi) a person who provides counseling

3 or social services to individuals; or

4 (B) the 30-day period beginning on the

5 date that the authorization is signed under sub6 section (a)(1), if the authorization permits the

7 disclosure of protected health information to a

8 person other than a person described in sub9 paragraph (A).

10 (2) DISCLOSURE BY TRUSTEE.—For purposes

11 of subsection (a)(8), a disclosure is timely made if

12 it occurs before—

13 (A) the date or event (if any) specified in

14 the authorization upon which the authorization

15 expires; and

16 (B) the expiration of the 6-month period

17 beginning on the date the trustee receives the

18 authorization.

19 (d) REVOCATION OR AMENDMENT OF AUTHORIZA20 TION.—

21 (1) IN GENERAL.—A protected individual in

22 writing may revoke or amend an authorization de23 scribed in subsection (a), in whole or in part, at any

24 time, except insofar as—
33

•HR 435 IH

1 (A) disclosure of protected health informa2 tion has been authorized to permit validation of

3 expenditures based on health condition by a

4 government authority; or

5 (B) action has been taken in reliance on

6 the authorization.

7 (2) NOTICE OF REVOCATION.—A health infor8 mation trustee who discloses protected health infor9 mation in reliance on an authorization that has been

10 revoked shall not be subject to any liability or pen11 alty under this Act if—

12 (A) the reliance was in good faith;

13 (B) the trustee had no notice of the rev14 ocation; and

15 (C) the disclosure was otherwise in accord16 ance with the requirements of this section.

17 (e) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A

18 health information trustee may impose requirements for

19 an authorization that are in addition to the requirements

20 in this section.

21 (f) COPY.—A health information trustee who dis22 closes protected health information pursuant to an author23 ization under this section shall maintain a copy of the au24 thorization.
34

•HR 435 IH

1 (g) CONSTRUCTION.—This section may not be con2 strued—

3 (1) to require a health information trustee to

4 disclose protected health information; or

5 (2) to limit the right of a health information

6 trustee to charge a fee for the disclosure or repro7 duction of protected health information.

8 (h) SUBPOENAS, WARRANTS, AND SEARCH WAR9 RANTS.—If a health information trustee discloses pro10 tected health information pursuant to an authorization in

11 order to comply with an administrative subpoena or war12 rant or a judicial subpoena or search warrant, the author13 ization—

14 (1) shall specifically authorize the disclosure for

15 the purpose of permitting the trustee to comply with

16 the subpoena, warrant, or search warrant; and

17 (2) shall otherwise meet the requirements in

18 this section.

19 SEC. 113. TREATMENT, PAYMENT, AND OVERSIGHT.

20 (a) DISCLOSURES BY PLANS, PROVIDERS, AND

21 OVERSIGHT AGENCIES.—A health information trustee de22 scribed in subsection (d) may disclose protected health in23 formation to a health benefit plan sponsor, health care

24 provider, or health oversight agency if the disclosure is—
35

•HR 435 IH

1 (1) for the purpose of providing health care and

2 a protected individual who is a subject of the infor3 mation has not previously objected to the disclosure

4 in writing;

5 (2) for the purpose of providing for the pay6 ment for health care furnished to an individual; or

7 (3) for use by a health oversight agency for a

8 purpose that is described in subparagraph (A) or

9 (B)(i) of section 3(b)(7).

10 (b) DISCLOSURES BY CERTAIN OTHER TRUSTEES.—

11 A health information trustee may disclose protected health

12 information to a health care provider if—

13 (1) the disclosure is for the purpose described

14 in subsection (a)(1); and

15 (2) the trustee—

16 (A) is a public health authority;

17 (B) received protected health information

18 pursuant to section 117 (relating to emergency

19 circumstances); or

20 (C) is an officer or employee of a trustee

21 described in subsection (B).

22 (c) USE IN ACTION AGAINST INDIVIDUAL.—A person

23 who receives protected health information about a pro24 tected individual through a disclosure under this section

25 may not use or disclose the information in any administra-
36

•HR 435 IH

1 tive, civil, or criminal action or investigation directed

2 against the individual, except an action or investigation

3 arising out of and related to receipt of health care or pay4 ment for health care.

5 (d) APPLICABILITY.—A health information trustee

6 referred to in subsection (a) is any of the following:

7 (1) A health benefit plan sponsor.

8 (2) A health care provider.

9 (3) A health oversight agency.

10 (4) A health information service organization.

11 SEC. 114. NEXT OF KIN AND DIRECTORY INFORMATION.

12 (a) NEXT OF KIN.—A health information trustee who

13 is a health care provider, who received protected health

14 information pursuant to section 117 (relating to emer15 gency circumstances), or who is an officer or employee of

16 such a recipient may orally disclose protected health infor17 mation about a protected individual to the next of kin of

18 the individual (as defined under State law), or to a person

19 with whom the individual has a close personal relationship,

20 if—

21 (1) the trustee has no reason to believe that the

22 individual would consider the information especially

23 sensitive;

24 (2) the individual has not previously objected to

25 the disclosure;
37

•HR 435 IH

1 (3) the disclosure is consistent with good medi2 cal or other professional practice; and

3 (4) the information disclosed is limited to infor4 mation about health care that is being provided to

5 the individual at or about the time of the disclosure.

6 (b) DIRECTORY INFORMATION.—

7 (1) IN GENERAL.—A health information trustee

8 who is a health care provider, who received protected

9 health information pursuant to section 117 (relating

10 to emergency circumstances), or who is an officer or

11 employee of a such a recipient may disclose to any

12 person the information described in paragraph (2)

13 if—

14 (A) a protected individual who is a subject

15 of the information has not objected in writing

16 to the disclosure;

17 (B) the disclosure is otherwise consistent

18 with good medical and other professional prac19 tice; and

20 (C) the information does not reveal specific

21 information about the physical or mental condi22 tion or functional status of a protected individ23 ual or about the health care provided to a pro24 tected individual.
38

•HR 435 IH

1 (2) INFORMATION DESCRIBED.—The informa2 tion referred to in paragraph (1) is the following:

3 (A) The name of an individual receiving

4 health care from a health care provider on a

5 premises controlled by the provider.

6 (B) The location of the individual on such

7 premises.

8 (C) The general health status of the indi9 vidual, described in terms of critical, poor, fair,

10 stable, satisfactory, or terms denoting similar

11 conditions.

12 (c) NO ACCOUNTING REQUIRED.—A health informa13 tion trustee who discloses protected health information

14 under this section is not required to maintain an account15 ing of the disclosure under section 104.

16 (d) RECIPIENTS.—A person to whom protected

17 health information is disclosed under this section shall not,

18 by reason of such disclosure, be subject to any require19 ment under this Act.

20 SEC. 115. PUBLIC HEALTH.

21 (a) IN GENERAL.—A health information trustee who

22 is a health care provider or a public health authority may

23 disclose protected health information to—

24 (1) a public health authority for use in legally

25 authorized—
39

•HR 435 IH

1 (A) disease or injury reporting;

2 (B) public health surveillance; or

3 (C) public health investigation or interven4 tion; or

5 (2) an individual who is authorized by law to

6 receive the information in a public health interven7 tion.

8 (b) USE IN ACTION AGAINST INDIVIDUAL.—A public

9 health authority who receives protected health information

10 about a protected individual through a disclosure under

11 this section may not use or disclose the information in any

12 administrative, civil, or criminal action or investigation di13 rected against the individual, except where the use or dis14 closure is authorized by law for protection of the public

15 health.

16 (c) INDIVIDUAL RECIPIENTS.—An individual to

17 whom protected health information is disclosed under sub18 section (a)(2) shall not, by reason of such disclosure, be

19 subject to any requirement under this Act.

20 SEC. 116. HEALTH RESEARCH.

21 (a) IN GENERAL.—A health information trustee de22 scribed in subsection (d) may disclose protected health in23 formation to a person if—

24 (1) the person is conducting an approved health

25 research project;
40

•HR 435 IH

1 (2) the information is to be used in the project;

2 and

3 (3) the project has been determined by a cer4 tified institutional review board to be—

5 (A) of sufficient importance so as to out6 weigh the intrusion into the privacy of the pro7 tected individual who is the subject of the infor8 mation that would result from the disclosure;

9 and

10 (B) impracticable to conduct without the

11 information.

12 (b) DISCLOSURES BY HEALTH INFORMATION SERV13 ICE ORGANIZATIONS.—A health information service orga14 nization may disclose protected health information under

15 subsection (a) only if the certified institutional review

16 board referred to in subsection (a)(3) has been certified

17 as being qualified to make determinations under such sub18 section with respect to disclosures by such organizations.

19 (c) LIMITATIONS ON USE AND DISCLOSURE; OBLIGA20 TIONS OF RECIPIENT.—A health researcher who receives

21 protected health information about a protected individual

22 pursuant to subsection (a)—

23 (1) may use the information solely for purposes

24 of an approved health research project;
41

•HR 435 IH

1 (2) may not use or disclose the information in

2 any administrative, civil, or criminal action or inves3 tigation directed against the individual; and

4 (3) shall remove or destroy, at the earliest op5 portunity consistent with the purposes of the ap6 proved health research project in connection with

7 which the disclosure was made, information that

8 would enable an individual to be identified, unless a

9 certified institutional review board has determined

10 that there is a health or research justification for re11 tention of such identifiers and there is an adequate

12 plan to protect the identifiers from use and disclo13 sure that is inconsistent with this Act.

14 (d) APPLICABILITY.—A health information trustee

15 referred to in subsection (a) is any health information

16 trustee other than a person who, with respect to the spe17 cific protected health information to be disclosed under

18 such subsection, received the information—

19 (1) pursuant to—

20 (A) section 118 (relating to judicial and

21 administrative purposes);

22 (B) paragraph (1), (2), (3), or (4) of sec23 tion 119(a) (relating to law enforcement); or

24 (C) section 120 (relating to subpoenas,

25 warrants, and search warrants); or
42

•HR 435 IH

1 (2) while acting in whole or in part in the ca2 pacity of an officer or employee of a person de3 scribed in paragraph (1).

4 (e) REQUIREMENTS FOR INSTITUTIONAL REVIEW

5 BOARDS.—

6 (1) REGULATIONS.—Not later than July 1,

7 1996, the Secretary, after opportunity for notice and

8 comment, shall promulgate regulations establishing

9 requirements for certified institutional review boards

10 under this Act. The regulations shall be based on

11 regulations promulgated under section 491(a) of the

12 Public Health Service Act and shall ensure that cer13 tified institutional review boards are qualified to as14 sess and protect the confidentiality of research sub15 jects. The regulations shall include specific require16 ments for certified institutional review boards that

17 make determinations under subsection (a)(3) with

18 respect to disclosures by health information service

19 organizations.

20 (2) CERTIFICATION.—The Secretary shall cer21 tify that an institutional review board satisfies the

22 requirements of the regulations promulgated under

23 paragraph (1).
43

•HR 435 IH

1 SEC. 117. EMERGENCY CIRCUMSTANCES.

2 (a) IN GENERAL.—A health information trustee may

3 disclose protected health information if the trustee be4 lieves, on reasonable grounds, that the disclosure is nec5 essary to prevent or lessen a serious and imminent threat

6 to the health or safety of an individual.

7 (b) USE IN ACTION AGAINST INDIVIDUAL.—A person

8 who receives protected health information about a pro9 tected individual through a disclosure under this section

10 may not use or disclose the information in any administra11 tive, civil, or criminal action or investigation directed

12 against the individual, except an action or investigation

13 arising out of and related to receipt of health care or pay14 ment for health care.

15 SEC. 118. JUDICIAL AND ADMINISTRATIVE PURPOSES.

16 (a) IN GENERAL.—A health information trustee de17 scribed in subsection (d) may disclose protected health in18 formation—

19 (1) pursuant to the Federal Rules of Civil Pro20 cedure, the Federal Rules of Criminal Procedure, or

21 comparable rules of other courts or administrative

22 agencies in connection with litigation or proceedings

23 to which a protected individual who is a subject of

24 the information is a party and in which the individ25 ual has placed the individual’s physical or mental

26 condition or functional status in issue;
44

•HR 435 IH

1 (2) if directed by a court in connection with a

2 court-ordered examination of an individual; or

3 (3) to assist in the identification of a dead

4 individual.

5 (b) WRITTEN STATEMENT.—A person seeking pro6 tected health information about a protected individual held

7 by health information trustee under—

8 (1) subsection (a)(1)—

9 (A) shall notify the protected individual or

10 the attorney of the protected individual of the

11 request for the information;

12 (B) shall provide the trustee with a signed

13 document attesting—

14 (i) that the protected individual is a

15 party to the litigation or proceedings for

16 which the information is sought;

17 (ii) that the individual has placed the

18 individual’s physical or mental condition or

19 functional status in issue; and

20 (iii) the date on which the protected

21 individual or the attorney of the protected

22 individual was notified under subparagraph

23 (A); and

24 (C) shall not accept any requested pro25 tected health information from the trustee until
45

•HR 435 IH

1 the termination of the 10-day period beginning

2 on the date notice was given under subpara3 graph (A); or

4 (2) subsection (a)(3) shall provide the trustee

5 with a written statement that the information is

6 sought to assist in the identification of a dead

7 individual.

8 (c) USE AND DISCLOSURE.—A person to whom pro9 tected health information is disclosed under this section

10 may use and disclose the information only to accomplish

11 the purpose for which the disclosure was made.

12 (d) APPLICABILITY.—A health information trustee

13 referred to in subsection (a) is any of the following:

14 (1) A health benefit plan sponsor.

15 (2) A health care provider.

16 (3) A health oversight agency.

17 (4) A person who, with respect to the specific

18 protected health information to be disclosed under

19 such subsection, received the information—

20 (A) pursuant to—

21 (i) section 117 (relating to emergency

22 circumstances); or

23 (ii) section 120 (relating to subpoe24 nas, warrants, and search warrants); or
46

•HR 435 IH

1 (B) while acting in whole or in part in the

2 capacity of an officer or employee of a person

3 described in subparagraph (A).

4 SEC. 119. LAW ENFORCEMENT.

5 (a) IN GENERAL.—A health information trustee,

6 other than a health information service organization, may

7 disclose protected health information to a law enforcement

8 agency, other than a health oversight agency—

9 (1) if the information is disclosed for use in an

10 investigation or prosecution of a health information

11 trustee;

12 (2) in connection with criminal activity commit13 ted against the trustee or an affiliated person of the

14 trustee or on premises controlled by the trustee; or

15 (3) if the information is needed to determine

16 whether a crime has been committed and the nature

17 of any crime that may have been committed (other

18 than a crime that may have been committed by the

19 protected individual who is the subject of the infor20 mation).

21 (b) ADDITIONAL AUTHORITY OF CERTAIN TRUST22 EES.—A health information trustee who is not a health

23 information service organization, a public health author24 ity, or a health researcher may disclose protected health
47

•HR 435 IH

1 information to a law enforcement agency (other than a

2 health oversight agency)—

3 (1) to assist in the identification or location of

4 a victim, fugitive, or witness in a law enforcement

5 inquiry;

6 (2) pursuant to a law requiring the reporting of

7 specific health care information to law enforcement

8 authorities; or

9 (3) if the information is specific health informa10 tion described in paragraph (2) and the trustee is

11 operated by a Federal agency;

12 (c) CERTIFICATION.—Where a law enforcement agen13 cy requests a health information trustee to disclose pro14 tected health information under subsection (a) or (b)(1),

15 the agency shall provide the trustee with a written certifi16 cation that—

17 (1) is signed by a supervisory official of a rank

18 designated by the head of the agency;

19 (2) specifies the information requested; and

20 (3) states that the information is needed for a

21 lawful purpose under this section.

22 (d) RESTRICTIONS ON DISCLOSURE AND USE.—A

23 person who receives protected health information about a

24 protected individual through a disclosure under this sec25 tion may not use or disclose the information—
48

•HR 435 IH

1 (1) in any administrative, civil, or criminal ac2 tion or investigation directed against the individual,

3 except an action or investigation arising out of and

4 directly related to the action or investigation for

5 which the information was obtained; and

6 (2) otherwise unless the use or disclosure is

7 necessary to fulfill the purpose for which the infor8 mation was obtained and is not prohibited by any

9 other provision of law.

10 SEC. 120. SUBPOENAS, WARRANTS, AND SEARCH WAR11 RANTS.

12 (a) IN GENERAL.—A health information trustee de13 scribed in subsection (g) may disclose protected health in14 formation if the disclosure is pursuant to any of the fol15 lowing:

16 (1) A subpoena issued under the authority of a

17 grand jury and the trustee is provided a written cer18 tification by the grand jury that the grand jury has

19 complied with the applicable access provisions of sec20 tion 5151.

21 (2) An administrative subpoena or warrant or

22 a judicial subpoena or search warrant and the trust23 ee is provided a written certification by the person

24 seeking the information that the person has com-
49

•HR 435 IH

1 plied with the applicable access provisions of section

2 131 or 133(a).

3 (3) An administrative subpoena or warrant or

4 a judicial subpoena or search warrant and the dis5 closure otherwise meets the conditions of one of sec6 tions 113 through 119.

7 (b) AUTHORITY OF ALL TRUSTEES.—Any health in8 formation trustee may disclose protected health informa9 tion if the disclosure is pursuant to subsection (a)(3).

10 (c) RESTRICTIONS ON USE AND DISCLOSURE.—Pro11 tected health information about a protected individual that

12 is disclosed by a health information trustee pursuant to—

13 (1) subsection (a)(2) may not be otherwise used

14 or disclosed by the recipient unless the use or disclo15 sure is necessary to fulfill the purpose for which the

16 information was obtained; and

17 (2) subsection (a)(3) may not be used or dis18 closed by the recipient unless the recipient complies

19 with the conditions and restrictions on use and dis20 closure with which the recipient would have been re21 quired to comply if the disclosure by the trustee had

22 been made under the section referred to in sub23 section (a)(3) the conditions of which were met by

24 the disclosure.
50

•HR 435 IH

1 (d) RESTRICTIONS ON GRAND JURIES.—Protected

2 health information that is disclosed by a health informa3 tion trustee under subsection (a)(1)—

4 (1) shall be returnable on a date when the

5 grand jury is in session and actually presented to

6 the grand jury;

7 (2) shall be used only for the purpose of consid8 ering whether to issue an indictment or report by

9 that grand jury, or for the purpose of prosecuting a

10 crime for which that indictment or report is issued,

11 or for a purpose authorized by rule 6(e) of the Fed12 eral Rules of Criminal Procedure or a comparable

13 State rule;

14 (3) shall be destroyed or returned to the trustee

15 if not used for one of the purposes specified in para16 graph (2); and

17 (4) shall not be maintained, or a description of

18 the contents of such information shall not be main19 tained, by any government authority other than in

20 the sealed records of the grand jury, unless such in21 formation has been used in the prosecution of a

22 crime for which the grand jury issued an indictment

23 or presentment or for a purpose authorized by rule

24 6(e) of the Federal Rules of Criminal Procedure or

25 a comparable State rule.
51

•HR 435 IH

1 (e) USE IN ACTION AGAINST INDIVIDUAL.—A person

2 who receives protected health information about a pro3 tected individual through a disclosure under this section

4 may not use or disclose the information in any administra5 tive, civil, or criminal action or investigation directed

6 against the individual, except an action or investigation

7 arising out of and directly related to the inquiry for which

8 the information was obtained;

9 (f) CONSTRUCTION.—Nothing in this section shall be

10 construed as authority for a health information trustee to

11 refuse to comply with a valid administrative subpoena or

12 warrant or a valid judicial subpoena or search warrant

13 that meets the requirements of this Act.

14 (g) APPLICABILITY.—A health information trustee

15 referred to in subsection (a) is any trustee other than the

16 following:

17 (1) A health information service organization.

18 (2) A public health authority.

19 (3) A health researcher.

20 SEC. 121. HEALTH INFORMATION SERVICE ORGANIZA21 TIONS.

22 A health information trustee may disclose protected

23 health information to a health information service organi24 zation for the purpose of permitting the organization to

25 perform a function for which the Secretary has authorized
52

•HR 435 IH

1 (by means of a designation or certification) the organiza2 tion to receive access to specific health care data in elec3 tronic or magnetic form.

4 Subtitle C—Access Procedures and

5 Challenge Rights

6 SEC. 131. ACCESS PROCEDURES FOR LAW ENFORCEMENT

7 SUBPOENAS, WARRANTS, AND SEARCH WAR8 RANTS.

9 (a) PROBABLE CAUSE REQUIREMENT.—A govern10 ment authority may not obtain protected health informa11 tion about a protected individual from a health informa12 tion trustee under paragraph (1) or (2) of section 120(a)

13 for use in a law enforcement inquiry unless there is prob14 able cause to believe that the information is relevant to

15 a legitimate law enforcement inquiry being conducted by

16 the government authority.

17 (b) WARRANTS AND SEARCH WARRANTS.—A govern18 ment authority that obtains protected health information

19 about a protected individual from a health information

20 trustee under circumstances described in subsection (a)

21 and pursuant to a warrant or search warrant shall, not

22 later than 30 days after the date the warrant was served

23 on the trustee, serve the individual with, or mail to the

24 last known address of the individual, a copy of the war25 rant.
53

•HR 435 IH

1 (c) SUBPOENAS.—Except as provided in subsection

2 (d), a government authority may not obtain protected

3 health information about a protected individual from a

4 health information trustee under circumstances described

5 in subsection (a) and pursuant to a subpoena unless a

6 copy of the subpoena has been served by hand delivery

7 upon the individual, or mailed to the last known address

8 of the individual, on or before the date on which the sub9 poena was served on the trustee, together with a notice

10 (published by the Secretary under section 135(1)) of the

11 individual’s right to challenge the subpoena in accordance

12 with section 132, and—

13 (1) 30 days have passed from the date of serv14 ice, or 30 days have passed from the date of mailing,

15 and within such time period the individual has not

16 initiated a challenge in accordance with section 132;

17 or

18 (2) disclosure is ordered by a court under sec19 tion 132.

20 (d) APPLICATION FOR DELAY.—

21 (1) IN GENERAL.—A government authority may

22 apply to an appropriate court to delay (for an initial

23 period of not longer than 90 days) serving a copy of

24 a subpoena and a notice otherwise required under

25 subsection (c) with respect to a law enforcement in-
54

•HR 435 IH

1 quiry. The government authority may apply to the

2 court for extensions of the delay.

3 (2) REASONS FOR DELAY.—An application for

4 a delay, or extension of a delay, under this sub5 section shall state, with reasonable specificity, the

6 reasons why the delay or extension is being sought.

7 (3) EX PARTE ORDER.—The court shall enter

8 an ex parte order delaying, or extending the delay

9 of, the notice and an order prohibiting the trustee

10 from revealing the request for, or the disclosure of,

11 the protected health information being sought if the

12 court finds that—

13 (A) the inquiry being conducted is within

14 the lawful jurisdiction of the government au15 thority seeking the protected health informa16 tion;

17 (B) there is probable cause to believe that

18 the protected health information being sought is

19 relevant to a legitimate law enforcement inquiry

20 being conducted by the government authority;

21 (C) the government authority’s need for

22 the information outweighs the privacy interest

23 of the protected individual who is the subject of

24 the information; and
55

•HR 435 IH

1 (D) there are reasonable grounds to believe

2 that receipt of a notice by the individual will re3 sult in—

4 (i) endangering the life or physical

5 safety of any individual;

6 (ii) flight from prosecution;

7 (iii) destruction of or tampering with

8 evidence or the information being sought;

9 or

10 (iv) intimidation of potential wit11 nesses.

12 (4) SERVICE OF APPLICATION ON INDIVID13 UAL.—Upon the expiration of a period of delay of

14 notice under this subsection, the government author15 ity shall serve upon the individual, with the service

16 of the subpoena and the notice, a copy of any appli17 cations filed and approved under this subsection.

18 SEC. 132. CHALLENGE PROCEDURES FOR LAW ENFORCE19 MENT SUBPOENAS.

20 (a) MOTION TO QUASH SUBPOENA.—Within 30 days

21 of the date of service, or 30 days of the date of mailing,

22 of a subpoena of a government authority seeking protected

23 health information about a protected individual from a

24 health information trustee under paragraph (1) or (2) of

25 section 120(a) (except a subpoena to which section 133
56

•HR 435 IH

1 applies), the individual may file (without filing fee) a mo2 tion to quash the subpoena—

3 (1) in the case of a State judicial subpoena, in

4 the court which issued the subpoena;

5 (2) in the case of a subpoena issued under the

6 authority of a State that is not a State judicial sub7 poena, in a court of competent jurisdiction;

8 (3) in the case of a subpoena issued under the

9 authority of a Federal court, in any court of the

10 United States of competent jurisdiction; or

11 (4) in the case of any other subpoena issued

12 under the authority of the United States, in—

13 (A) the United States district court for the

14 district in which the individual resides or in

15 which the subpoena was issued; or

16 (B) another United States district court of

17 competent jurisdiction.

18 (b) COPY.—A copy of the motion shall be served by

19 the individual upon the government authority by delivery

20 of registered or certified mail.

21 (c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov22 ernment authority may file with the court such affidavits

23 and other sworn documents as sustain the validity of the

24 subpoena. The individual may file with the court, within

25 5 days of the date of the authority’s filing, affidavits and
57

•HR 435 IH

1 sworn documents in response to the authority’s filing. The

2 court, upon the request of the individual, the government

3 authority, or both, may proceed in camera.

4 (d) PROCEEDINGS AND DECISION ON MOTION.—The

5 court may conduct such proceedings as it deems appro6 priate to rule on the motion. All such proceedings shall

7 be completed, and the motion ruled on, within 10 calendar

8 days of the date of the government authority’s filing.

9 (e) EXTENSION OF TIME LIMITS FOR GOOD

10 CAUSE.—The court, for good cause shown, may at any

11 time in its discretion enlarge the time limits established

12 by subsections (c) and (d).

13 (f) STANDARD FOR DECISION.—A court may deny a

14 motion under subsection (a) if it finds that there is prob15 able cause to believe that the protected health information

16 being sought is relevant to a legitimate law enforcement

17 inquiry being conducted by the government authority, un18 less the court finds that the individual’s privacy interest

19 outweighs the government authority’s need for the infor20 mation. The individual shall have the burden of dem21 onstrating that the individual’s privacy interest outweighs

22 the need established by the government authority for the

23 information.

24 (g) SPECIFIC CONSIDERATIONS WITH RESPECT TO

25 PRIVACY INTEREST.—In determining under subsection (f)
58

•HR 435 IH

1 whether an individual’s privacy interest outweighs the gov2 ernment authority’s need for the information, the court

3 shall consider—

4 (1) the particular purpose for which the infor5 mation was collected by the trustee;

6 (2) the degree to which disclosure of the infor7 mation will embarrass, injure, or invade the privacy

8 of the individual;

9 (3) the effect of the disclosure on the individ10 ual’s future health care;

11 (4) the importance of the inquiry being con12 ducted by the government authority, and the impor13 tance of the information to that inquiry; and

14 (5) any other factor deemed relevant by the

15 court.

16 (h) ATTORNEY’S FEES.—In the case of any motion

17 brought under subsection (a) in which the individual has

18 substantially prevailed, the court, in its discretion, may as19 sess against a government authority a reasonable attor20 ney’s fee and other litigation costs (including expert fees)

21 reasonably incurred.

22 (i) NO INTERLOCUTORY APPEAL.—A court ruling de23 nying a motion to quash under this section shall not be

24 deemed a final order and no interlocutory appeal may be

25 taken therefrom by the individual. An appeal of such a
59

•HR 435 IH

1 ruling may be taken by the individual within such period

2 of time as is provided by law as part of any appeal from

3 a final order in any legal proceeding initiated against the

4 individual arising out of or based upon the protected

5 health information disclosed.

6 SEC. 133. ACCESS AND CHALLENGE PROCEDURES FOR

7 OTHER SUBPOENAS.

8 (a) IN GENERAL.—A person (other than a govern9 ment authority seeking protected health information under

10 circumstances described in section 131(a)) may not obtain

11 protected health information about a protected individual

12 from a health information trustee pursuant to a subpoena

13 under section 120(a)(2) unless—

14 (1) a copy of the subpoena has been served

15 upon the individual or mailed to the last known ad16 dress of the individual on or before the date on

17 which the subpoena was served on the trustee, to18 gether with a notice (published by the Secretary

19 under section 135(2)) of the individual’s right to

20 challenge the subpoena, in accordance with sub21 section (b); and

22 (2) either—

23 (A) 30 days have passed from the date of

24 service or 30 days have passed from the date of

25 the mailing and within such time period the in-
60

•HR 435 IH

1 dividual has not initiated a challenge in accord2 ance with subsection (b); or

3 (B) disclosure is ordered by a court under

4 such subsection.

5 (b) MOTION TO QUASH.—Within 30 days of the date

6 of service or 30 days of the date of mailing of a subpoena

7 seeking protected health information about a protected in8 dividual from a health information trustee under sub9 section (a), the individual may file (without filing fee) in

10 any court of competent jurisdiction, a motion to quash the

11 subpoena, with a copy served on the person seeking the

12 information. The individual may oppose, or seek to limit,

13 the subpoena on any grounds that would otherwise be

14 available if the individual were in possession of the infor15 mation.

16 (c) STANDARD FOR DECISION.—The court shall

17 grant an individual’s motion under subsection (b) if the

18 person seeking the information has not sustained the bur19 den of demonstrating that—

20 (1) there are reasonable grounds to believe that

21 the information will be relevant to a lawsuit or other

22 judicial or administrative proceeding; and

23 (2) the need of the person for the information

24 outweighs the privacy interest of the individual.
61

•HR 435 IH

1 (d) SPECIFIC CONSIDERATIONS WITH RESPECT TO

2 PRIVACY INTEREST.—In determining under subsection (c)

3 whether the need of the person for the information out4 weighs the privacy interest of the individual, the court

5 shall consider—

6 (1) the particular purpose for which the infor7 mation was collected by the trustee;

8 (2) the degree to which disclosure of the infor9 mation will embarrass, injure, or invade the privacy

10 of the individual;

11 (3) the effect of the disclosure on the individ12 ual’s future health care;

13 (4) the importance of the information to the

14 lawsuit or proceeding; and

15 (5) any other factor deemed relevant by the

16 court.

17 (e) ATTORNEY’S FEES.—In the case of any motion

18 brought under subsection (b) by an individual against a

19 person in which the individual has substantially prevailed,

20 the court, in its discretion, may assess against the person

21 a reasonable attorney’s fee and other litigation costs (in22 cluding expert fees) reasonably incurred.
62

•HR 435 IH

1 SEC. 134. CONSTRUCTION OF SUBTITLE; SUSPENSION OF

2 STATUTE OF LIMITATIONS.

3 (a) IN GENERAL.—Nothing in this subtitle shall af4 fect the right of a health information trustee to challenge

5 a request for protected health information. Nothing in this

6 subtitle shall entitle a protected individual to assert the

7 rights of a health information trustee.

8 (b) EFFECT OF MOTION ON STATUTE OF LIMITA9 TIONS.—If an individual who is the subject of protected

10 health information files a motion under this subtitle which

11 has the effect of delaying the access of a government au12 thority to such information, the period beginning on the

13 date such motion was filed and ending on the date on

14 which the motion is decided shall be excluded in computing

15 any period of limitations within which the government au16 thority may commence any civil or criminal action in con17 nection with which the access is sought.

18 SEC. 135. RESPONSIBILITIES OF SECRETARY.

19 Not later than July 1, 1996, the Secretary, after no20 tice and opportunity for public comment, shall develop and

21 disseminate brief, clear, and easily understood model

22 notices—

23 (1) for use under subsection (c) of section 131,

24 detailing the rights of a protected individual who

25 wishes to challenge, under section 132, the disclo-
63

•HR 435 IH

1 sure of protected health information about the indi2 vidual under such subsection; and

3 (2) for use under subsection (a) of section 133,

4 detailing the rights of a protected individual who

5 wishes to challenge, under subsection (b) of such

6 section, the disclosure of protected health informa7 tion about the individual under such section.

8 Subtitle D—Miscellaneous

9 Provisions

10 SEC. 141. PAYMENT CARD AND ELECTRONIC PAYMENT

11 TRANSACTIONS.

12 (a) PAYMENT FOR HEALTH CARE THROUGH CARD

13 OR ELECTRONIC MEANS.—If a protected individual pays

14 a health information trustee for health care by presenting

15 a debit, credit, or other payment card or account number,

16 or by any other electronic payment means, the trustee may

17 disclose to a person described in subsection (b) only such

18 protected health information about the individual as is

19 necessary for the processing of the payment transaction

20 or the billing or collection of amounts charged to, debited

21 from, or otherwise paid by, the individual using the card,

22 number, or other electronic payment means.

23 (b) TRANSACTION PROCESSING.—A person who is a

24 debit, credit, or other payment card issuer, is otherwise

25 directly involved in the processing of payment transactions
64

•HR 435 IH

1 involving such cards or other electronic payment trans2 actions, or is otherwise directly involved in the billing or

3 collection of amounts paid through such means, may only

4 use or disclose protected health information about a pro5 tected individual that has been disclosed in accordance

6 with subsection (a) when necessary for—

7 (1) the authorization, settlement, billing or col8 lection of amounts charged to, debited from, or oth9 erwise paid by, the individual using a debit, credit,

10 or other payment card or account number, or by

11 other electronic payment means;

12 (2) the transfer of receivables, accounts, or in13 terest therein;

14 (3) the audit of the credit, debit, or other pay15 ment card account information;

16 (4) compliance with Federal, State, or local law;

17 or

18 (5) a properly authorized civil, criminal, or reg19 ulatory investigation by Federal, State, or local au20 thorities.

21 SEC. 142. ACCESS TO PROTECTED HEALTH INFORMATION

22 OUTSIDE OF THE UNITED STATES.

23 (a) IN GENERAL.—Notwithstanding the provisions of

24 subtitle B, and except as provided in subsection (b), a

25 health information trustee may not permit any person who
65

•HR 435 IH

1 is not in a State to have access to protected health infor2 mation about a protected individual unless one or more

3 of the following conditions exist:

4 (1) SPECIFIC AUTHORIZATION.—The individual

5 has specifically consented to the provision of such

6 access outside of the United States in an authoriza7 tion that meets the requirements of section 112.

8 (2) EQUIVALENT PROTECTION.—The provision

9 of such access is authorized under this Act and the

10 Secretary has determined that there are fair infor11 mation practices for protected health information in

12 the jurisdiction where the access will be provided

13 that provide protections for individuals and pro14 tected health information that are equivalent to the

15 protections provided for by this Act.

16 (3) ACCESS REQUIRED BY LAW.—The provision

17 of such access is required under—

18 (A) a Federal statute; or

19 (B) a treaty or other international agree20 ment applicable to the United States.

21 (b) EXCEPTIONS.—Subsection (a) does not apply

22 where the provision of access to protected health informa23 tion—

24 (1) is to a foreign public health authority;
66

•HR 435 IH

1 (2) is authorized under section 114 (relating to

2 next of kin and directory information), 116 (relating

3 to health research), or 117 (relating to emergency

4 circumstances); or

5 (3) is necessary for the purpose of providing for

6 payment for health care that has been provided to

7 an individual.

8 SEC. 143. STANDARDS FOR ELECTRONIC DOCUMENTS AND

9 COMMUNICATIONS.

10 (a) STANDARDS.—Not later than July 1, 1996, the

11 Secretary, after notice and opportunity for public com12 ment and in consultation with appropriate private stand13 ard-setting organizations and other interested parties,

14 shall establish standards with respect to the creation,

15 transmission, receipt, and maintenance, in electronic and

16 magnetic form, of each type of written document specifi17 cally required or authorized under this Act. Where a sig18 nature is required under any other provision of this Act,

19 such standards shall provide for an electronic or magnetic

20 substitute that serves the functional equivalent of a signa21 ture.

22 (b) TREATMENT OF COMPLYING DOCUMENTS AND

23 COMMUNICATIONS.—An electronic or magnetic document

24 or communication that satisfies the standards established

25 under subsection (a) with respect to such document or
67

•HR 435 IH

1 communication shall be treated as satisfying the require2 ments of this Act that apply to an equivalent written docu3 ment.

4 SEC. 144. DUTIES AND AUTHORITIES OF AFFILIATED PER5 SONS.

6 (a) REQUIREMENTS ON TRUSTEES.—

7 (1) PROVISION OF INFORMATION.—A health in8 formation trustee may provide protected health in9 formation to a person who, with respect to the trust10 ee, is an affiliated person and may permit the affili11 ated person to use such information, only for the

12 purpose of conducting, supporting, or facilitating an

13 activity that the trustee is authorized to undertake.

14 (2) NOTICE TO AFFILIATED PERSON.—A health

15 information trustee shall notify a person who, with

16 respect to the trustee, is an affiliated person of any

17 duties under this Act that the affiliated person is re18 quired to fulfill and of any authorities under this

19 Act that the affiliated person is authorized to exer20 cise.

21 (b) DUTIES OF AFFILIATED PERSONS.—

22 (1) IN GENERAL.—An affiliated person shall

23 fulfill any duty under this Act that—

24 (A) the health information trustee with

25 whom the person has an agreement or relation-
68

•HR 435 IH

1 ship described in section 3(c)(1)(C) is required

2 to fulfill; and

3 (B) the person has undertaken to fulfill

4 pursuant to such agreement or relationship.

5 (2) CONSTRUCTION OF OTHER SUBTITLES.—

6 With respect to a duty described in paragraph (1)

7 that an affiliated person is required to fulfill, the

8 person shall be considered a health information

9 trustee for purposes of this Act. The person shall be

10 subject to subtitle E (relating to enforcement) with

11 respect to any such duty that the person fails to ful12 fill.

13 (3) EFFECT ON TRUSTEE.—An agreement or

14 relationship with an affiliated person does not relieve

15 a health information trustee of any duty or liability

16 under this Act.

17 (b) AUTHORITIES OF AFFILIATED PERSONS.—

18 (1) IN GENERAL.—An affiliated person may

19 only exercise an authority under this Act that the

20 health information trustee with whom the person is

21 affiliated may exercise and that the person has been

22 given by the trustee pursuant to an agreement or re23 lationship described in section 3(c)(1)(C). With re24 spect to any such authority, the person shall be con25 sidered a health information trustee for purposes of
69

•HR 435 IH

1 this Act. The person shall be subject to subtitle E

2 (relating to enforcement) with respect to any act

3 that exceeds such authority.

4 (2) EFFECT ON TRUSTEE.—An agreement or

5 relationship with an affiliated person does not affect

6 the authority of a health information trustee under

7 this Act.

8 SEC. 145. AGENTS AND ATTORNEYS.

9 (a) IN GENERAL.—Except as provided in subsections

10 (b) and (c), a person who is authorized by law (on grounds

11 other than an individual’s minority), or by an instrument

12 recognized under law, to act as an agent, attorney, proxy,

13 or other legal representative for a protected individual or

14 the estate of a protected individual, or otherwise to exer15 cise the rights of the individual or estate, may, to the ex16 tent authorized, exercise and discharge the rights of the

17 individual or estate under this Act.

18 (b) HEALTH CARE POWER OF ATTORNEY.—A person

19 who is authorized by law (on grounds other than an indi20 vidual’s minority), or by an instrument recognized under

21 law, to make decisions about the provision of health care

22 to an individual who is incapacitated may exercise and dis23 charge the rights of the individual under this Act to the

24 extent necessary to effectuate the terms or purposes of

25 the grant of authority.
70

•HR 435 IH

1 (c) NO COURT DECLARATION.—If a health care pro2 vider determines that an individual, who has not been de3 clared to be legally incompetent, suffers from a medical

4 condition that prevents the individual from acting know5 ingly or effectively on the individual’s own behalf, the right

6 of the individual to authorize disclosure under section 112

7 may be exercised and discharged in the best interest of

8 the individual by—

9 (1) a person described in subsection (b) with re10 spect to the individual;

11 (2) a person described in subsection (a) with re12 spect to the individual, but only if a person de13 scribed in paragraph (1) cannot be contacted after

14 a reasonable effort;

15 (3) the next of kin of the individual, but only

16 if a person described in paragraph (1) or (2) cannot

17 be contacted after a reasonable effort; or

18 (4) the health care provider, but only if a per19 son described in paragraph (1), (2), or (3) cannot be

20 contacted after a reasonable effort.

21 SEC. 146. MINORS.

22 (a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA23 BLE.—In the case of an individual—
71

•HR 435 IH

1 (1) who is 18 years of age or older, all rights

2 of the individual shall be exercised by the individual,

3 except as provided in section 145; or

4 (2) who, acting alone, has the legal capacity to

5 apply for and obtain health care and has sought

6 such care, the individual shall exercise all rights of

7 an individual under this Act with respect to pro8 tected health information relating to such care.

9 (b) INDIVIDUALS UNDER 18.—Except as provided in

10 subsection (a)(2), in the case of an individual who is—

11 (1) under 14 years of age, all the individual’s

12 rights under this Act shall be exercised through the

13 parent or legal guardian of the individual; or

14 (2) 14, 15, 16, or 17 years of age, the right of

15 inspection (under section 101), the right of amend16 ment (under section 102), and the right to authorize

17 disclosure of protected health information (under

18 section 112) of the individual may be exercised ei19 ther by the individual or by the parent or legal

20 guardian of the individual.

21 SEC. 147. MAINTENANCE OF CERTAIN PROTECTED HEALTH

22 INFORMATION.

23 (a) IN GENERAL.—A State shall establish a process

24 under which the protected health information described in

25 subsection (b) that is maintained by a person described
72

•HR 435 IH

1 in subsection (c) is delivered to, and maintained by, the

2 State or an individual or entity designated by the State.

3 (b) INFORMATION DESCRIBED.—The protected

4 health information referred to in subsection (a) is pro5 tected health information that—

6 (1) is recorded in any form or medium;

7 (2) is created by—

8 (A) a health care provider; or

9 (B) a health benefit plan sponsor that pro10 vides benefits in the form of items and services

11 to enrollees and not in the form of reimburse12 ment for items and services; and

13 (3) relates in any way to the past, present, or

14 future physical or mental health or condition or

15 functional status of a protected individual or the

16 provision of health care to a protected individual.

17 (c) PERSONS DESCRIBED.—A person referred to in

18 subsection (a) is any of the following:

19 (1) A health care facility previously located in

20 the State that has closed.

21 (2) A professional practice previously operated

22 by a health care provider in the State that has

23 closed.

24 (3) A health benefit plan sponsor that—
73

•HR 435 IH

1 (A) previously provided benefits in the

2 form of items and services to enrollees in the

3 State; and

4 (B) has ceased to do business.

5 Subtitle E—Enforcement

6 SEC. 151. CIVIL ACTIONS.

7 (a) IN GENERAL.—Any individual whose right under

8 this Act has been knowingly or negligently violated—

9 (1) by a health information trustee, or any

10 other person, who is not described in paragraph (2),

11 (3), (4), or (5) may maintain a civil action for actual

12 damages and for equitable relief against the health

13 information trustee or other person;

14 (2) by an officer or employee of the United

15 States while the officer or employee was acting with16 in the scope of the office or employment may main17 tain a civil action for actual damages and for equi18 table relief against the United States;

19 (3) by an officer or employee of any government

20 authority of a State that has waived its sovereign

21 immunity to a claim for damages resulting from a

22 violation of this Act while the officer or employee

23 was acting within the scope of the office or employ24 ment may maintain a civil action for actual damages
74

•HR 435 IH

1 and for equitable relief against the State govern2 ment;

3 (4) by an officer or employee of a government

4 of a State that is not described in paragraph (3)

5 may maintain a civil action for actual damages and

6 for equitable relief against the officer or employee;

7 or

8 (5) by an officer or employee of a government

9 authority while the officer or employee was not act10 ing within the scope of the office or employment

11 may maintain a civil action for actual damages and

12 for equitable relief against the officer or employee.

13 (b) KNOWING VIOLATIONS.—Any individual entitled

14 to recover actual damages under this section because of

15 a knowing violation of a provision of this Act (other than

16 subsection (c) or (d) of section 111) shall be entitled to

17 recover the amount of the actual damages demonstrated

18 or $5000, whichever is greater.

19 (c) ACTUAL DAMAGES.—For purposes of this section,

20 the term ‘‘actual damages’’ includes damages paid to com21 pensate an individual for nonpecuniary losses such as

22 physical and mental injury as well as damages paid to

23 compensate for pecuniary losses.

24 (d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In

25 any action brought under this section in which the com-
75

•HR 435 IH

1 plainant has prevailed because of a knowing violation of

2 a provision of this Act (other than subsection (c) or (d)

3 of section 111), the court may, in addition to any relief

4 awarded under subsections (a) and (b), award such puni5 tive damages as may be warranted. In such an action, the

6 court, in its discretion, may allow the prevailing party a

7 reasonable attorney’s fee (including expert fees) as part

8 of the costs, and the United States shall be liable for costs

9 the same as a private person.

10 (e) LIMITATION.—A civil action under this section

11 may not be commenced more than 2 years after the date

12 on which the aggrieved individual discovered the violation

13 or the date on which the aggrieved individual had a rea14 sonable opportunity to discover the violation, whichever oc15 curs first.

16 (f) INSPECTION AND AMENDMENT.—If a health in17 formation trustee has established a formal internal proce18 dure that allows an individual who has been denied inspec19 tion or amendment of protected health information to ap20 peal the denial, the individual may not maintain a civil

21 action in connection with the denial until the earlier of—

22 (1) the date the appeal procedure has been ex23 hausted; or

24 (2) the date that is 4 months after the date on

25 which the appeal procedure was initiated.
76

•HR 435 IH

1 (g) NO LIABILITY FOR PERMISSIBLE DISCLO2 SURES.—A health information trustee who makes a disclo3 sure of protected health information about a protected in4 dividual that is permitted by this Act and not otherwise

5 prohibited by State or Federal statute shall not be liable

6 to the individual for the disclosure under common law.

7 (h) NO LIABILITY FOR INSTITUTIONAL REVIEW

8 BOARD DETERMINATIONS.—If the members of a certified

9 institutional review board have in good faith determined

10 that an approved health research project is of sufficient

11 importance so as to outweigh the intrusion into the privacy

12 of an individual pursuant to section 116(a)(1), the mem13 bers, the board, and the parent institution of the board

14 shall not be liable to the individual as a result of such

15 determination.

16 (i) GOOD FAITH RELIANCE ON CERTIFICATION.—A

17 health information trustee who relies in good faith on a

18 certification by a government authority or other person

19 and discloses protected health information about an indi20 vidual in accordance with this Act shall not be liable to

21 the individual for such disclosure.

22 SEC. 152. CIVIL MONEY PENALTIES.

23 (a) VIOLATION.—Any health information trustee who

24 the Secretary determines has demonstrated a pattern or

25 practice of failure to comply with the provisions of this
77

•HR 435 IH

1 Act shall be subject, in addition to any other penalties that

2 may be prescribed by law, to a civil money penalty of not

3 more than $10,000 for each such failure. In determining

4 the amount of any penalty to be assessed under the proce5 dures established under subsection (b), the Secretary shall

6 take into account the previous record of compliance of the

7 person being assessed with the applicable requirements of

8 this Act and the gravity of the violation.

9 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

10 The provisions of section 1128A of the Social Security Act

11 (other than subsections (a) and (b)) shall apply to the im12 position of a civil monetary penalty under this section in

13 the same manner as such provisions apply with respect

14 to the imposition of a penalty under section 1128A of such

15 Act.

16 SEC. 153. ALTERNATIVE DISPUTE RESOLUTION.

17 (a) IN GENERAL.—Not later than July 1, 1996, the

18 Secretary shall, by regulation, develop alternative dispute

19 resolution methods for use by individuals, health informa20 tion trustees, and other persons in resolving claims under

21 section 151.

22 (b) EFFECT ON INITIATION OF CIVIL ACTIONS.—

23 (1) IN GENERAL.—Subject to paragraph (2),

24 the regulations established under subsection (a) may

25 provide that an individual alleging that a right of
78

•HR 435 IH

1 the individual under this Act has been violated shall

2 pursue at least one alternative dispute resolution

3 method developed under such subsection as a condi4 tion precedent to commencing a civil action under

5 section 151.

6 (2) LIMITATION.—Such regulations may not re7 quire an individual to refrain from commencing a

8 civil action to pursue one or more alternative dispute

9 resolution method for a period that is greater than

10 6 months.

11 (3) SUSPENSION OF STATUTE OF LIMITA12 TIONS.—The regulations established by the Sec13 retary under subsection (a) may provide that a pe14 riod in which an individual described in paragraph

15 (1) pursues (as defined by the Secretary) an alter16 native dispute resolution method under this section

17 shall be excluded in computing the period of limita18 tions under section 151(e).

19 (c) METHODS.—The methods under subsection (a)

20 shall include at least the following:

21 (1) ARBITRATION.—The use of arbitration.

22 (2) MEDIATION.—The use of mediation.

23 (3) EARLY OFFERS OF SETTLEMENT.—The use

24 of a process under which parties make early offers

25 of settlement.
79

•HR 435 IH

1 (d) STANDARDS FOR ESTABLISHING METHODS.—In

2 developing alternative dispute resolution methods under

3 subsection (a), the Secretary shall ensure that the meth4 ods promote the resolution of claims in a manner that—

5 (1) is affordable for the parties involved;

6 (2) provides for timely and fair resolution of

7 claims; and

8 (3) provides for reasonably convenient access to

9 dispute resolution for individuals.

10 SEC. 154. AMENDMENTS TO CRIMINAL LAW.

11 (a) IN GENERAL.—Title 18, United States Code, is

12 amended by inserting after chapter 89 the following:

13 ‘‘CHAPTER 90—PROTECTED HEALTH

14 INFORMATION

‘‘Sec.

‘‘1831. Definitions.

‘‘1832. Obtaining protected health information under false pretenses.

‘‘1833. Monetary gain from obtaining protected health information under false

pretenses.

‘‘1834. Knowing and unlawful obtaining of protected health information.

‘‘1835. Monetary gain from knowing and unlawful obtaining of protected health

information.

‘‘1836. Knowing and unlawful use or disclosure of protected health information.

‘‘1837. Monetary gain from knowing and unlawful sale, transfer, or use of protected health information.

15 ‘‘§ 1831. Definitions

16 ‘‘As used in this chapter—

17 ‘‘(1) the term ‘health information trustee’ has

18 the meaning given such term in section 3(b)(6) of

19 the Fair Health Information Practices Act of 1995;
80

•HR 435 IH

1 ‘‘(2) the term ‘protected health information’ has

2 the meaning given such term in section 3(a)(3) of

3 such Act; and

4 ‘‘(3) the term ‘protected individual’ has the

5 meaning given such term in section 3(a)(4) of such

6 Act.

7 ‘‘§ 1832. Obtaining protected health information

8 under false pretenses

9 ‘‘Whoever under false pretenses—

10 ‘‘(1) requests or obtains protected health infor11 mation from a health information trustee; or

12 ‘‘(2) obtains from a protected individual an au13 thorization for the disclosure of protected health in14 formation about the individual maintained by a

15 health information trustee;

16 shall be fined under this title or imprisoned not more than

17 5 years, or both.

18 ‘‘§ 1833. Monetary gain from obtaining protected

19 health information under false pretenses

20 ‘‘Whoever under false pretenses—

21 ‘‘(1) requests or obtains protected health infor22 mation from a health information trustee with the

23 intent to sell, transfer, or use such information for

24 profit or monetary gain; or
81

•HR 435 IH

1 ‘‘(2) obtains from a protected individual an au2 thorization for the disclosure of protected health in3 formation about the individual maintained by a

4 health information trustee with the intent to sell,

5 transfer, or use such authorization for profit or

6 monetary gain;

7 and knowingly sells, transfers, or uses such information

8 or authorization for profit or monetary gain shall be fined

9 under this title or imprisoned not more than 10 years, or

10 both.

11 ‘‘§ 1834. Knowing and unlawful obtaining of pro12 tected health information

13 ‘‘Whoever knowingly obtains protected health infor14 mation from a health information trustee in violation of

15 the Fair Health Information Practices Act of 1995, know16 ing that such obtaining is unlawful, shall be fined under

17 this title or imprisoned not more than 5 years, or both.

18 ‘‘§ 1835. Monetary gain from knowing and unlawful

19 obtaining of protected health information

20 ‘‘Whoever knowingly—

21 ‘‘(1) obtains protected health information from

22 a health information trustee in violation of the Fair

23 Health Information Practices Act of 1995, knowing

24 that such obtaining is unlawful and with the intent
82

•HR 435 IH

1 to sell, transfer, or use such information for profit

2 or monetary gain; and

3 ‘‘(2) knowingly sells, transfers, or uses such in4 formation for profit or monetary gain;

5 shall be fined under this title or imprisoned not more than

6 10 years, or both.

7 ‘‘§ 1836. Knowing and unlawful use or disclosure of

8 protected health information

9 ‘‘Whoever knowingly uses or discloses protected

10 health information in violation of the Fair Health Infor11 mation Practices Act of 1995, knowing that such use or

12 disclosure is unlawful, shall be fined under this title or

13 imprisoned not more than 5 years, or both.

14 ‘‘§ 1837. Monetary gain from knowing and unlawful

15 sale, transfer, or use of protected health

16 information

17 ‘‘Whoever knowingly sells, transfers, or uses pro18 tected health information in violation of the Fair Health

19 Information Practices Act of 1995, knowing that such

20 sale, transfer, or use is unlawful, shall be fined under this

21 title or imprisoned not more than 10 years, or both.’’.

22 (b) CLERICAL AMENDMENT.—The table of chapters

23 for part I of title 18, United States Code, is amended by

24 inserting after the item relating to chapter 89 the follow25 ing:

‘‘90. Protected health information .............................................. 1831’’.
83

•HR 435 IH

1 TITLE II—AMENDMENTS TO

2 TITLE 5, UNITED STATES CODE

3 SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.

4 (a) NEW SUBSECTION.—Section 552a of title 5,

5 United States Code, is amended by adding at the end the

6 following:

7 ‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen8 cy that is a health information trustee (as defined in sec9 tion 3(b)(6) of the Fair Health Information Practices Act

10 of 1995) shall promulgate rules, in accordance with the

11 requirements (including general notice) of subsections

12 (b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this

13 title, to exempt a system of records within the agency, to

14 the extent that the system of records contains protected

15 health information (as defined in section 3(a)(3) of such

16 Act), from all provisions of this section except subsections

17 (e)(1), (e)(2), subparagraphs (A) through (C) and (E)

18 through (I) of subsection (e)(4), and subsections (e)(5),

19 (e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.

20 (b) REPEAL.—Section 552a(f)(3) of title 5, United

21 States Code, is amended by striking ‘‘pertaining to him,’’

22 and all that follows through the semicolon and inserting

23 ‘‘pertaining to the individual;’’.
84

•HR 435 IH

1 TITLE III—REGULATIONS, RE2 SEARCH, AND EDUCATION;

3 EFFECTIVE DATES; APPLICA4 BILITY; AND RELATIONSHIP

5 TO OTHER LAWS

6 SEC. 301. REGULATIONS; RESEARCH AND EDUCATION.

7 (a) REGULATIONS.—Not later than July 1, 1996, the

8 Secretary shall prescribe regulations to carry out this Act.

9 (b) RESEARCH AND TECHNICAL SUPPORT.—The

10 Secretary may sponsor—

11 (1) research relating to the privacy and security

12 of protected health information;

13 (2) the development of consent forms governing

14 disclosure of such information; and

15 (3) the development of technology to implement

16 standards regarding such information.

17 (c) EDUCATION.—The Secretary shall establish edu18 cation and awareness programs—

19 (1) to foster adequate security practices by

20 health information trustees;

21 (2) to train personnel of health information

22 trustees respecting the duties of such personnel with

23 respect to protected health information; and
85

•HR 435 IH

1 (3) to inform individuals and employers who

2 purchase health care respecting their rights with re3 spect to such information.

4 SEC. 302. EFFECTIVE DATES.

5 (a) IN GENERAL.—Except as provided in subsection

6 (b), this Act, and the amendments made by this Act, shall

7 take effect on January 1, 1997.

8 (b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro9 vision of this Act shall take effect on the date of the enact10 ment of this Act if the provision—

11 (1) imposes a duty on the Secretary to develop,

12 establish, or promulgate regulations, guidelines, no13 tices, statements, or education and awareness pro14 grams; or

15 (2) authorizes the Secretary to sponsor research

16 or the development of forms or technology.

17 SEC. 303. APPLICABILITY.

18 (a) PROTECTED HEALTH INFORMATION.—Except as

19 provided in subsections (b) and (c), the provisions of this

20 Act shall apply to any protected health information that

21 is received, created, used, maintained, or disclosed by a

22 health information trustee in a State on or after January

23 1, 1997, regardless of whether the information existed or

24 was disclosed prior to such date.

25 (b) EXCEPTION.—
86

•HR 435 IH

1 (1) IN GENERAL.—The provisions of this Act

2 shall not apply to a trustee described in paragraph

3 (2), except with respect to protected health informa4 tion that is received by the trustee on or after Janu5 ary 1, 1997.

6 (2) APPLICABILITY.—A trustee referred to in

7 paragraph (1) is—

8 (A) a health researcher; or

9 (B) a person who, with respect to specific

10 protected health information, received the infor11 mation—

12 (i) pursuant to—

13 (I) section 117 (relating to emer14 gency circumstances);

15 (II) section 118 (relating to judi16 cial and administrative purposes);

17 (III) section 119 (relating to law

18 enforcement); or

19 (IV) section 120 (relating to sub20 poenas, warrants, and search war21 rants); or

22 (ii) while acting in whole or in part in

23 the capacity of an officer or employee of a

24 person described in clause (i).
87

•HR 435 IH

1 (c) AUTHORIZATIONS FOR DISCLOSURES.—An au2 thorization for the disclosure of protected health informa3 tion about a protected individual that is executed by the

4 individual before January 1, 1997, and is recognized and

5 valid under State law on December 31, 1996, shall remain

6 valid and shall not be subject to the requirements of sec7 tion 112 until January 1, 1998, or the occurrence of the

8 date or event (if any) specified in the authorization upon

9 which the authorization expires, whichever occurs earlier.

10 SEC. 304. RELATIONSHIP TO OTHER LAWS.

11 (a) STATE LAW.—Except as otherwise provided in

12 subsections (b), (c), (d), and (f), a State may not estab13 lish, continue in effect, or enforce any State law to the

14 extent that the law is inconsistent with, or imposes addi15 tional requirements with respect to, any of the following:

16 (1) A duty of a health information trustee

17 under this Act.

18 (2) An authority of a health information trustee

19 under this Act to disclose protected health informa20 tion.

21 (3) A provision of subtitle C (relating to access

22 procedures and challenge rights), subtitle D (mis23 cellaneous provisions), or subtitle E (relating to en24 forcement).
88

•HR 435 IH

1 (b) LAWS RELATING TO PUBLIC HEALTH AND MEN2 TAL HEALTH.—This Act does not preempt, supersede, or

3 modify the operation of any State law regarding public

4 health or mental health to the extent that the law prohibits

5 or regulates a disclosure of protected health information

6 that is permitted under this Act.

7 (c) CRIMINAL PENALTIES.—A State may establish

8 and enforce criminal penalties with respect to a failure to

9 comply with a provision of this Act.

10 (d) PRIVILEGES.—A privilege that a person has

11 under law in a court of a State or the United States or

12 under the rules of any agency of a State or the United

13 States may not be diminished, waived, or otherwise af14 fected by—

15 (1) the execution by a protected individual of an

16 authorization for disclosure of protected health in17 formation under this Act, if the authorization is exe18 cuted for the purpose of receiving health care or pro19 viding for the payment for health care; or

20 (2) any provision of this Act that authorizes the

21 disclosure of protected health information for the

22 purpose of receiving health care or providing for the

23 payment for health care.

24 (e) DEPARTMENT OF VETERANS AFFAIRS.—The lim25 itations on use and disclosure of protected health informa-
89

•HR 435 IH

1 tion under this Act shall not be construed to prevent any

2 exchange of such information within and among compo3 nents of the Department of Veterans Affairs that deter4 mine eligibility for or entitlement to, or that provide, bene5 fits under laws administered by the Secretary of Veterans

6 Affairs.

7 (f) CERTAIN DUTIES UNDER STATE OR FEDERAL

8 LAW.—This Act shall not be construed to preempt, super9 sede, or modify the operation of any of the following:

10 (1) Any law that provides for the reporting of

11 vital statistics such as birth or death information.

12 (2) Any law requiring the reporting of abuse or

13 neglect information about any individual.

14 (3) Subpart II of part E of title XXVI of the

15 Public Health Service Act (relating to notifications

16 of emergency response employees of possible expo17 sure to infectious diseases).

18 (4) The Americans with Disabilities Act of

19 1990.

20 (5) Any Federal or State statute that estab21 lishes a privilege for records used in health profes22 sional peer review activities.

23 (f) SECRETARIAL AUTHORITY.—

24 (1) SECRETARY OF HEALTH AND HUMAN SERV25 ICES.—A provision of this Act does not preempt, su-
90

•HR 435 IH

1 persede, or modify the operation of section 543 of

2 the Public Health Service Act, except to the extent

3 that the Secretary of Health and Human Services

4 determines through regulations promulgated by such

5 Secretary that the provision provides greater protec6 tion for protected health information, and the rights

7 of protected individuals, than is provided under such

8 section 543.

9 (2) SECRETARY OF VETERANS AFFAIRS.—A

10 provision of this Act does not preempt, supersede, or

11 modify the operation of section 7332 of title 38,

12 United States Code, except to the extent that the

13 Secretary of Veterans Affairs determines through

14 regulations promulgated by such Secretary that the

15 provision provides greater protection for protected

16 health information, and the rights of protected indi17 viduals, than is provided under such section 7332.

Æ

HR 435 IH——2

HR 435 IH——3

HR 435 IH——4

HR 435 IH——5

HR 435 IH——6

HR 435 IH——7