I

107TH CONGRESS

1ST SESSION H. R. 1215

To ensure confidentiality with respect to medical records and health carerelated information, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

MARCH 27, 2001

Mr. GREENWOOD introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committee on

the Judiciary, for a period to be subsequently determined by the Speaker,

in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To ensure confidentiality with respect to medical records

and health care-related information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Medical Information Protection and Research Enhance6 ment Act of 2001’’.

7 (b) TABLE OF CONTENTS.—The table of contents for

8 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Definitions.
2

•HR 1215 IH

TITLE I—INDIVIDUAL’S RIGHTS

Subtitle A—Review of Protected Health Information by Subjects of the

Information

Sec. 101. Inspection and copying of protected health information.

Sec. 102. Amendment of protected health information.

Sec. 103. Notice of confidentiality practices.

Subtitle B—Establishment of Safeguards

Sec. 111. Establishment of safeguards.

Sec. 112. Accounting for disclosures.

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE

Sec. 201. General rules regarding use and disclosure.

Sec. 202. General rules regarding use and disclosure of health care information.

Sec. 203. Authorizations for use or disclosure of protected health information

other than for treatment, payment, health care operations, or

health research.

Sec. 204. Next of kin and directory information.

Sec. 205. Emergency circumstances.

Sec. 206. Oversight.

Sec. 207. Public health.

Sec. 208. Health research.

Sec. 209. Disclosure in civil, judicial, and administrative procedures.

Sec. 210. Disclosure for law enforcement purposes.

Sec. 211. Payment card and electronic payment transaction.

Sec. 212. Individual representatives.

Sec. 213. No liability for permissible disclosures.

Sec. 214. Sale of business, mergers, etc.

TITLE III—SANCTIONS

Subtitle A—Criminal Provisions

Sec. 301. Wrongful disclosure of protected health information.

Subtitle B—Civil Sanctions

Sec. 311. Civil penalty violation.

Sec. 312. Procedures for imposition of penalties.

Sec. 313. Enforcement by State insurance commissioners.

TITLE IV—MISCELLANEOUS

Sec. 401. Relationship to other laws.

Sec. 402. Conforming amendment.

Sec. 403. Study by Institute of Medicine.

Sec. 404. Effective date.

1 SEC. 2. DEFINITIONS.

2 As used in this Act:
3

•HR 1215 IH

1 (1) ACCREDITING BODY.—The term ‘‘accred2 iting body’’ means a national body, committee, orga3 nization, or institution (such as the Joint Commis4 sion on Accreditation of Health Care Organizations

5 or the National Committee for Quality Assurance)

6 that has been authorized by law or is recognized by

7 a health care regulating authority as an accrediting

8 entity or any other entity that has been similarly au9 thorized or recognized by law to perform specific ac10 creditation, licensing or credentialing activities.

11 (2) AGENT.—The term ‘‘agent’’ means a per12 son, including a contractor, who represents and acts

13 for another under the contract or relation of agency,

14 or whose function is to bring about, modify, effect,

15 accept performance of, or terminate contractual obli16 gations between the principal and a third person.

17 (3) COMMON RULE.—The term ‘‘common rule’’

18 means the Federal policy for protection of human

19 subjects from research risks originally published as

20 56 Federal Register 28.025 (1991) as adopted and

21 implemented by a Federal department or agency.

22 (4) DISCLOSE/DISCLOSURE.—The term ‘‘dis23 close’’ means to release, transfer, provide access to,

24 or otherwise divulge protected health information to

25 any person other than the individual who is the sub-
4

•HR 1215 IH

1 ject of such information. The term ‘‘disclosure’’ re2 fers to such a release, transfer, provisions for access

3 to, or communication of such information. The use

4 of protected health information by an authorized

5 person and its agents shall not be considered a dis6 closure for purposes of this Act, provided that the

7 use is consistent with the purposes for which the in8 formation was lawfully obtained. Using or providing

9 access to health information in the form of non10 identifiable health information shall not be construed

11 as a disclosure of protected health information.

12 (5) EMPLOYER.—The term ‘‘employer’’ has the

13 meaning given such term under section 3(5) of the

14 Employee Retirement Income Security Act of 1974

15 (29 U.S.C. 1002(5)), except that such term shall in16 clude only employers of two or more employees.

17 (6) HEALTH CARE.—The term ‘‘health care’’

18 means—

19 (A) preventive, diagnostic, therapeutic, re20 habilitative, maintenance, or palliative care, in21 cluding appropriate assistance with disease or

22 symptom management and maintenance, coun23 seling, service, or procedure—

24 (i) with respect to the physical or

25 mental condition of an individual; or
5

•HR 1215 IH

1 (ii) affecting the structure or function

2 of the human body or any part of the

3 human body, including the banking of

4 blood, sperm, organs, or any other tissue;

5 or

6 (B) pursuant to a prescription or medical

7 order any sale or dispensing of a drug, device,

8 equipment, or other health care related item to

9 an individual, or for the use of an individual.

10 (7) HEALTH CARE OPERATIONS.—The term

11 ‘‘health care operations’’ means services provided by

12 or on behalf of a health plan or health care provider

13 for the purpose of carrying out the management

14 functions of a health care provider or health plan, or

15 implementing the terms of a contract for health plan

16 benefits, including—

17 (A) coordinating health care, including

18 health care management of the individual

19 through risk assessment and case management;

20 (B) conducting quality assessment and im21 provement activities, including outcomes evalua22 tion, clinical guideline development, and im23 provement;

24 (C) reviewing the competence or qualifica25 tions of health care professionals, evaluating
6

•HR 1215 IH

1 provider performance, and conducting health

2 care education, accreditation, certification, li3 censing, or credentialing activities;

4 (D) carrying out utilization review activi5 ties, including precertification and

6 preauthorization of services, and health plan

7 rating and insurance activities, including under8 writing, experience rating and reinsurance; and

9 (E) conducting or arranging for auditing

10 services, including fraud detection and compli11 ance programs.

12 (8) HEALTH CARE PROVIDER.—The term

13 ‘‘health care provider’’ means a person, who with re14 spect to a specific item of protected health informa15 tion, receives, creates, uses, maintains, or discloses

16 the information while acting in whole or in part in

17 the capacity of—

18 (A) a person who is licensed, certified, reg19 istered, or otherwise authorized by Federal or

20 State law to provide an item or service that

21 constitutes health care in the ordinary course of

22 business, or practice of a profession;

23 (B) a Federal, State, employer sponsored

24 or other privately sponsored program that di-
7

•HR 1215 IH

1 rectly provides items or services that constitute

2 health care to beneficiaries; or

3 (C) an officer or employee of a person de4 scribed in subparagraph (A) or (B).

5 Such term does not include a person that provides

6 no health care and that provides only a religious

7 method for healing.

8 (9) HEALTH OVERSIGHT AGENCY.—The term

9 ‘‘health oversight agency’’ means a person who, with

10 respect to a specific item of protected health infor11 mation, receives, creates, uses, maintains, or dis12 closes the information while acting in whole or in

13 part in the capacity of—

14 (A) a person who performs or oversees the

15 performance of an assessment, evaluation, de16 termination, or investigation, relating to the li17 censing, accreditation, certification, or

18 credentialing of health care providers; or

19 (B) a person who—

20 (i) performs or oversees the perform21 ance of an audit, assessment, evaluation,

22 determination, or investigation relating to

23 the effectiveness of, compliance with, or

24 applicability of, legal, fiscal, medical, or

25 scientific standards or aspects of perform-
8

•HR 1215 IH

1 ance related to the delivery of health care;

2 and

3 (ii) is a public agency, acting on be4 half of a public agency, acting pursuant to

5 a requirement of a public agency, or car6 rying out activities under a Federal or

7 State law governing the assessment, eval8 uation, determination, investigation, or

9 prosecution described in subparagraph (A).

10 (10) HEALTH PLAN.—The term ‘‘health

11 plan’’ means has the meaning given such term

12 in section 1171(5) of the Social Security Act

13 (42 U.S.C. 1320d(5)) and includes any health

14 insurance issuer, health insurance plan (includ15 ing any hospital or medical service plan, dental

16 or other health service plan, or health mainte17 nance organization plan), provider sponsored

18 organization, or other program providing or ar19 ranging for the provision of health benefits.

20 Such term does not include any policy, plan, or

21 program to the extent that it provides, ar22 ranges, supports, or administers any excepted

23 benefits (as defined in section 2791(c)(1) of the

24 Public Health Service Act (42 U.S.C. 300gg–

25 91(c)(1))).
9

•HR 1215 IH

1 (11) HEALTH RESEARCH/HEALTH RE2 SEARCHER.—The term ‘‘health research’’ means a

3 systematic investigation of health (including but not

4 limited to basic biological processes and structures),

5 health care, or its delivery and financing, including

6 research development, testing and evaluation, de7 signed to develop or contribute to generalizable

8 knowledge concerning human health, health care, or

9 health care delivery. The term ‘‘health researcher’’

10 means a person involved in health research, or an of11 ficer, employee, or agent of such person.

12 (12) KEY.—The term ‘‘key’’ means a method

13 or procedure used to transform nonidentifiable

14 health information that is in a coded or encrypted

15 form into protected health information.

16 (13) LAW ENFORCEMENT INQUIRY.—The term

17 ‘‘law enforcement inquiry’’ means a lawful investiga18 tion or official proceeding inquiring into a violation

19 of, or failure to comply with, any criminal or civil

20 statute or any regulation, rule, or order issued pur21 suant to such a statute.

22 (14) LIFE INSURER.—The term ‘‘life insurer’’

23 means life insurance company as defined in section

24 816 of the Internal Revenue Code of 1986.
10

•HR 1215 IH

1 (15) NONIDENTIFIABLE HEALTH INFORMA2 TION.—The term ‘‘nonidentifiable health informa3 tion’’ means protected health information from

4 which personal identifiers, that directly reveal the

5 identity of the individual who is the subject of such

6 information or provide a direct means of identifying

7 the individual (such as name, address, and social se8 curity number), have been removed, encrypted, or

9 replaced with a code, such that the identity of the

10 individual is not evident without (in the case of

11 encrypted or coded information) use of key.

12 (16) ORIGINATING PROVIDER.—The term ‘‘orig13 inating provider’’ means a health care provider who

14 initiates a treatment episode, such as prescribing a

15 drug, ordering a diagnostic test, or admitting an in16 dividual to a health care facility. A hospital or nurs17 ing facility is the originating provider with respect to

18 protected health information created or received as

19 part of inpatient or outpatient treatment provided in

20 such settings.

21 (17) PAYMENT.—The term ‘‘payment’’

22 means—

23 (A) the activities undertaken by—
11

•HR 1215 IH

1 (i) or on behalf of a health plan to de2 termine its responsibility for coverage

3 under the plan; or

4 (ii) a health care provider to obtain

5 payment for items or services provided to

6 an individual, provided under a health

7 plan, or provided based on a determination

8 by the health plan of responsibility for cov9 erage under the plan; and

10 (B) activities undertaken as described in

11 subparagraph (A) including—

12 (i) billing, claims management, med13 ical data processing, other administrative

14 services, and actual payment;

15 (ii) determinations of coverage or ad16 judication of health benefit or subrogation

17 claims; and

18 (iii) review of health care services with

19 respect to coverage under a health plan or

20 justification of charges.

21 (18) PERSON.—The term ‘‘person’’ means a

22 government, governmental subdivision, agency or au23 thority; corporation; company; association; firm;

24 partnership; society; estate; trust; joint venture; indi-
12

•HR 1215 IH

1 vidual; individual representative; tribal government;

2 and any other legal entity.

3 (19) PROTECTED HEALTH INFORMATION.—The

4 term ‘‘protected health information’’ with respect to

5 the individual who is the subject of such information

6 means any information which identifies such indi7 vidual, whether oral or recorded in any form or me8 dium, that—

9 (A) is created or received by a health care

10 provider, health plan, health oversight agency,

11 public health authority, employer, life insurer,

12 school or university;

13 (B) relates to the past, present, or future

14 physical or mental health or condition of an in15 dividual (including individual cells and their

16 components);

17 (C) is derived from—

18 (i) the provision of health care to the

19 individual; or

20 (ii) payment for the provision of

21 health care to the individual; and

22 (D) is not nonidentifiable health informa23 tion.

24 (20) PUBLIC HEALTH AUTHORITY.—The term

25 ‘‘public health authority’’ means an authority or in-
13

•HR 1215 IH

1 strumentality of the United States, a tribal govern2 ment, a State, or a political subdivision of a State

3 that is—

4 (A) primarily responsible for health and/or

5 welfare matters; and

6 (B) primarily engaged in activities such as

7 incidence reporting, public health surveillance,

8 and investigation or intervention.

9 (21) SCHOOL OR UNIVERSITY.—The term

10 ‘‘school or university’’ means an institution or place

11 accredited or licensed for purposes of providing for

12 instruction or education, including an elementary

13 school, secondary school, or institution of higher

14 learning, a college, or an assemblage of colleges

15 united under one corporate organization or govern16 ment.

17 (22) SECRETARY.—The term ‘‘Secretary’’

18 means the Secretary of Health and Human Services.

19 (23) SIGNED.—The term ‘‘signed’’ refers to

20 documentation of assent in any medium, whether

21 ink, digital or biometric signatures, or recorded oral

22 authorizations.

23 (24) STATE.—The term ‘‘State’’ includes the

24 District of Columbia, Puerto Rico, the Virgin Is-
14

•HR 1215 IH

1 lands, Guam, American Samoa, and the Northern

2 Mariana Islands.

3 (25) TREATMENT.—The term ‘‘treatment’’

4 means the provision of health care by a health care

5 provider.

6 (26) WRITING/WRITTEN.—The term ‘‘writing’’

7 means any form of documentation, whether paper,

8 electronic, digital, biometric or tape recorded. The

9 term ‘‘written’’ includes paper, electronic, digital, bi10 ometric and tape-recorded formats.

11 TITLE I—INDIVIDUAL’S RIGHTS

12 Subtitle A—Review of Protected

13 Health Information by Subjects

14 of the Information

15 SEC. 101. INSPECTION AND COPYING OF PROTECTED

16 HEALTH INFORMATION.

17 (a) GENERAL RULES.—

18 (1) COMPLIANCE WITH SECTION.—At the re19 quest of an individual who is the subject of protected

20 health information and except as provided in sub21 section (c), a health care provider, a health plan,

22 employer, life insurer, school, or university shall ar23 range for inspection or copying of protected health

24 information concerning the individual, including
15

•HR 1215 IH

1 records created under section 102, as provided for in

2 this section.

3 (2) AVAILABILITY OF INFORMATION THROUGH

4 ORIGINATING PROVIDER.—Protected health informa5 tion that is created or received by a health plan or

6 health care provider as part of treatment or pay7 ment shall be made available for inspection or copy8 ing as provided for in this title through the origi9 nating provider.

10 (3) OTHER ENTITIES.—An employer, life in11 surer, school, or university that creates or receives

12 protected health information in performing any func13 tion other than providing treatment, payment, or

14 health care operations with respect to the individual

15 who is the subject of such information, shall make

16 such information available for inspection or copying

17 as provided for in this title, or through any provider

18 designated by the individual.

19 (4) PROCEDURES.—The person providing ac20 cess to information under this title may set forth ap21 propriate procedures to be followed for such inspec22 tion or copying and may require an individual to pay

23 reasonable costs associated with such inspection or

24 copying.
16

•HR 1215 IH

1 (b) SPECIAL CIRCUMSTANCES.—If an originating

2 provider, its agent, or contractor no longer maintains the

3 protected health information sought by an individual pur4 suant to subsection (a), a health plan or another health

5 care provider that maintains such information shall ar6 range for inspection or copying.

7 (c) EXCEPTIONS.—Unless ordered by a court of com8 petent jurisdiction, a person acting pursuant to subsection

9 (a) or (b) is not required to permit the inspection or copy10 ing of protected health information if any of the following

11 conditions are met:

12 (1) ENDANGERMENT TO LIFE OR SAFETY.—

13 The person determines that the disclosure of the in14 formation could reasonably be expected to endanger

15 the life or physical safety of any individual.

16 (2) CONFIDENTIAL SOURCE.—The information

17 identifies, or could reasonably lead to the identifica18 tion of, a person who provided information under a

19 promise of confidentiality to a health care provider

20 concerning the individual who is the subject of the

21 information.

22 (3) INFORMATION COMPILED IN ANTICIPATION

23 OF OR IN CONNECTION WITH A FRAUD INVESTIGA24 TION OR LITIGATION.—The information is compiled

25 principally—
17

•HR 1215 IH

1 (A) in anticipation of or in connection with

2 a fraud investigation, an investigation of mate3 rial misrepresentation in connection with an in4 surance policy, a civil, criminal, or administra5 tive action or proceeding; or

6 (B) for use in such action or proceeding.

7 (4) INVESTIGATIONAL INFORMATION.—The pro8 tected health information was created, received or

9 maintained by a health researcher as provided in

10 section 208.

11 (d) DENIAL OF A REQUEST FOR INSPECTION OR

12 COPYING.—If a person described in subsection (a) or (b)

13 denies a request for inspection or copying pursuant to sub14 section (c), the person shall inform the individual in writ15 ing of—

16 (1) the reasons for the denial of the request for

17 inspection or copying;

18 (2) the availability of procedures for further re19 view of the denial; and

20 (3) the individual’s right to file with the person

21 a concise statement setting forth the request for in22 spection or copying.

23 (e) STATEMENT REGARDING REQUEST.—If an indi24 vidual has filed a statement under subsection (d)(3), the
18

•HR 1215 IH

1 person in any subsequent disclosure of the portion of the

2 information requested under subsection (a) or (b)—

3 (1) shall include a notation concerning the indi4 vidual’s statement; and

5 (2) may include a concise statement of the rea6 sons for denying the request for inspection or copy7 ing.

8 (f) INSPECTION AND COPYING OF SEGREGABLE POR9 TION.—A person described in subsection (a) or (b) shall

10 permit the inspection and copying of any reasonably seg11 regable portion of a record after deletion of any portion

12 that is exempt under subsection (c).

13 (g) DEADLINE.—A person described in subsection (a)

14 or (b) shall comply with or deny, in accordance with sub15 section (d), a request for inspection or copying of pro16 tected health information under this section not later than

17 60 days after the date on which the person receives the

18 request.

19 (h) RULES OF CONSTRUCTION.—

20 (1) AGENTS.—An agent of a person described

21 in subsection (a) or (b) shall not be required to pro22 vide for the inspection and copying of protected

23 health information, except where—

24 (A) the protected health information is re25 tained by the agent; and
19

•HR 1215 IH

1 (B) the agent has been asked in writing by

2 the person involved to fulfill the requirements of

3 this section.

4 (2) NO REQUIREMENT FOR HEARING.—This

5 section shall not be construed to require a person

6 described in subsection (a) or (b) to conduct a for7 mal, informal, or other hearing or proceeding con8 cerning a request for inspection or copying of pro9 tected health information.

10 SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA11 TION.

12 (a) IN GENERAL.—Protected health information shall

13 be subject to amendment as provided for in this section.

14 Protected health information that is created or received

15 by a health plan or health care provider as part of treat16 ment or payment shall be subject to amendment as pro17 vided in this section upon request to the originating pro18 vider. Except as provided in subsection (b), not later than

19 45 days after the date on which an originating provider,

20 employer, life insurer, school, or university receives from

21 an individual a request in writing to amend protected

22 health information, such person shall—

23 (1) make the amendment requested;

24 (2) inform the individual of the amendment

25 that has been made; and
20

•HR 1215 IH

1 (3) inform any person identified by the indi2 vidual in the request for amendment and—

3 (A) who is not an officer, employee, or

4 agent of the person; and

5 (B) to whom the unamended portion of the

6 information was disclosed within the previous

7 yearby sending a notice to the individual’s last

8 known address that there has been a sub9 stantive amendment to the protected health in10 formation of such individual.

11 (b) SPECIAL CIRCUMSTANCES.—If an originating

12 provider, its agent, or contractor no longer maintains the

13 protected health information sought to be amended by an

14 individual pursuant to subsection (a), a health plan or an15 other health care provider that maintains such informa16 tion may arrange for amendment consistent with this sec17 tion.

18 (c) REFUSAL TO AMEND.—If a person described in

19 subsection (a) refuses to make the amendment requested

20 under such subsection, the person shall inform the indi21 vidual in writing of—

22 (1) the reasons for the refusal to make the

23 amendment;

24 (2) the availability of procedures for further re25 view of the refusal; and
21

•HR 1215 IH

1 (3) the procedures by which the individual may

2 file with the person a concise statement setting forth

3 the requested amendment and the individual’s rea4 sons for disagreeing with the refusal.

5 (d) STATEMENT OF DISAGREEMENT.—If an indi6 vidual has filed a statement of disagreement under sub7 section (c)(3), the person involved, in any subsequent dis8 closure of the disputed portion of the information—

9 (1) shall include a notation concerning the indi10 vidual’s statement; and

11 (2) may include a concise statement of the rea12 sons for not making the requested amendment.

13 (e) RULES GOVERNING AGENTS.—The agent of a

14 person described in subsection (a) shall not be required

15 to make amendments to protected health information, ex16 cept where—

17 (1) the protected health information is retained

18 by the agent; and

19 (2) the agent has been asked in writing by such

20 person to fulfill the requirements of this section.

21 (f) REPEATED REQUESTS FOR AMENDMENTS.—If a

22 person described in subsection (a) receives a request for

23 an amendment of information as provided for in such sub24 section and a statement of disagreement has been filed

25 pursuant to subsection (d), the person shall inform the
22

•HR 1215 IH

1 individual of such filing and shall not be required to carry

2 out the procedures required under this section.

3 (g) RULES OF CONSTRUCTION.—This section shall

4 not be construed to—

5 (1) require that a person described in sub6 section (a) conduct a formal, informal, or other

7 hearing or proceeding concerning a request for an

8 amendment to protected health information;

9 (2) require a provider to amend an individual’s

10 protected health information as to the type, dura11 tion, or quality of treatment the individual believes

12 he or she should have been provided; or

13 (3) permit any deletions or alterations of the

14 original information.

15 SEC. 103. NOTICE OF CONFIDENTIALITY PRACTICES.

16 (a) PREPARATION OF WRITTEN NOTICE.—A health

17 care provider, health plan, health oversight agency, public

18 health authority, employer, life insurer, health researcher,

19 school, or university shall post or provide, in writing and

20 in a clear and conspicuous manner, notice of the person’s

21 confidentiality practices, that shall include—

22 (1) a description of an individual’s rights with

23 respect to protected health information;

24 (2) the uses and disclosures of protected health

25 information authorized under this Act;
23

•HR 1215 IH

1 (3) the procedures for authorizing disclosures of

2 protected health information and for revoking such

3 authorizations;

4 (4) the procedures established by the person for

5 the exercise of the individual’s rights; and

6 (5) the right to obtain a copy of the notice of

7 the confidentiality practices required under this Act.

8 (b) MODEL NOTICE.—The Secretary, after notice

9 and opportunity for public comment, shall develop and dis10 seminate model notices of confidentiality practices, using

11 the advice of the National Committee on Vital Health Sta12 tistics, for use under this section. Use of the model notice

13 shall serve as an absolute defense against claims of receiv14 ing inappropriate notice.

15 Subtitle B—Establishment of

16 Safeguards

17 SEC. 111. ESTABLISHMENT OF SAFEGUARDS.

18 (a) IN GENERAL.—A health care provider, health

19 plan, health oversight agency, public health authority, em20 ployer, life insurer, health researcher, law enforcement of21 ficial, school, or university shall establish and maintain ap22 propriate administrative, technical, and physical safe23 guards to protect the confidentiality, security, accuracy,

24 and integrity of protected health information created, re-
24

•HR 1215 IH

1 ceived, obtained, maintained, used, transmitted, or dis2 posed of by such person.

3 (b) FUNDAMENTAL SAFEGUARDS.—The safeguards

4 established pursuant to subsection (a) shall address the

5 following factors:

6 (1) The need for protected health information

7 and whether the purpose can be accomplished with

8 nonidentifiable health information.

9 (2) Appropriate procedures for maintaining the

10 security and assuring appropriate use of any key

11 used in creating nonidentifiable health information.

12 (3) The categories of personnel who will have

13 access to protected health information and appro14 priate training, supervision and sanctioning of such

15 persons with respect to their use of protected health

16 information and adherence to established safe17 guards.

18 (4) Appropriate limitations on access to indi19 vidual identifiers.

20 (5) Appropriate mechanism for limiting disclo21 sures to the protected health information necessary

22 to respond to the request for disclosure.

23 (6) Procedures for handling requests for pro24 tected health information by persons other than the

25 individual who is the subject of such information, in-
25

•HR 1215 IH

1 cluding but not limited to relatives and affiliates of

2 such individual, law enforcement officials, parties in

3 civil litigation, health care providers, and health

4 plans.

5 SEC. 112. ACCOUNTING FOR DISCLOSURES.

6 (a) IN GENERAL.—A health care provider, health

7 plan, health oversight agency, public health authority, em8 ployer, life insurer, health researcher, law enforcement of9 ficial, school, or university shall establish and maintain a

10 process for documenting its disclosures of protected health

11 information by recording the name and address or other

12 means of contacting the recipient, and the purpose of the

13 disclosure.

14 (b) RECORD OF DISCLOSURE.—A record established

15 under subsection (a) shall be maintained for not less than

16 7 years.

17 (c) IDENTIFICATION OF DISCLOSED INFORMATION AS

18 PROTECTED HEALTH INFORMATION.—Except as other19 wise provided in this title, protected health information

20 shall be clearly identified as protected health information

21 that is subject to this Act.
26

•HR 1215 IH

1 TITLE II—RESTRICTIONS ON

2 USE AND DISCLOSURE

3 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO4 SURE.

5 (a) DISCLOSURE PROHIBITED.—A health care pro6 vider, health plan, health oversight agency, public health

7 authority, employer, life insurer, health researcher, law en8 forcement official, school, or university, or any of their

9 agents may not disclose protected health information ex10 cept as authorized under this Act or as authorized by the

11 individual who is the subject of such information.

12 (b) APPLICABILITY TO AGENTS.—A person described

13 in subsection (a) may use an agent, including a contractor,

14 to carry out an otherwise lawful activity using protected

15 health information maintained by such person, provided

16 that the person specifies the activities for which the agent

17 is authorized and prohibits the agent from using or dis18 closing protected health information for purposes other

19 than carrying out the specified activities.

20 (1) Notwithstanding any other provision of this

21 Act, a person who has limited the activities of an

22 agent as provided in this subsection, shall not be lia23 ble for the actions or disclosures of the agent that

24 are not in fulfillment of the agent’s specified activi25 ties.
27

•HR 1215 IH

1 (2) An agent who receives protected health in2 formation from a person described in subsection (a)

3 shall in its own right be subject to the applicable

4 provisions of this Act.

5 (c) CREATION OF NONIDENTIFIABLE HEALTH IN6 FORMATION.—A person described in subsection (a) may

7 use protected health information for the purpose of cre8 ating nonidentifiable health information.

9 (d) INDIVIDUAL AUTHORIZATION.—To be valid, an

10 authorization to disclose protected health information

11 under this title shall—

12 (1) identify the individual who is the subject of

13 the protected health information;

14 (2) describe the nature of the information to be

15 disclosed;

16 (3) identify the type of person to whom the in17 formation is to be disclosed;

18 (4) describe the purpose of the disclosure;

19 (5) be subject to revocation by the individual

20 and indicate that the authorization is valid until rev21 ocation by the individual; and

22 (6) be in writing, dated, and signed by the indi23 vidual, a family member or other authorized rep24 resentative.
28

•HR 1215 IH

1 (e) MANIPULATION OF NONIDENTIFIABLE HEALTH

2 INFORMATION.—Any person who manipulates nonidentifi3 able health information in order to identify an individual,

4 or uses a key to identify an individual without authoriza5 tion, is deemed to have disclosed protected health informa6 tion.

7 SEC. 202. GENERAL RULES REGARDING USE AND DISCLO8 SURE OF HEALTH CARE INFORMATION.

9 (a) IN GENERAL.—An individual who furnishes pro10 tected health information in the context of obtaining

11 health care or health care benefits has a justifiable expec12 tation that such information will not be misused and that

13 its confidentiality will be maintained. Protected health in14 formation in possession or control of a health care pro15 vider or health plan shall be available—

16 (1) for use by a health plan or a health care

17 provider in furnishing health care to an individual

18 who is the subject of such information, including ar19 rangements for treatment, payment, and health care

20 operations; and

21 (2) for use in health research that is not incon22 sistent with the requirements of other applicable

23 Federal laws.

24 (3) LIMITATION.—For purposes of subsection

25 (b), use of protected health information in activities
29

•HR 1215 IH

1 described in this subsection is not a disclosure of

2 such information by persons lawfully engaged in

3 such activities.

4 (b) PROHIBITION.—A health care provider, health

5 plan, health oversight agency, public health authority, em6 ployer, health or life insurer, health researcher, law en7 forcement official, school, or university may not disclose

8 protected health information except as authorized under

9 this title.

10 (1) RULES OF CONSTRUCTION.—

11 (A) Disclosure of health information in the

12 form of nonidentifiable health information shall

13 not be construed as a disclosure of protected

14 health information.

15 (B) Arrangements by a person and its

16 agents for carrying out an authorized use of

17 protected health information, including uses au18 thorized under subsection (a), shall not be con19 sidered disclosures for purposes of this Act,

20 provided that the use is consistent with the pur21 poses for which the information was lawfully

22 obtained by such person.

23 (C) Nothing in this title shall be construed

24 to require disclosure by a health care provider

25 or a health plan.
30

•HR 1215 IH

1 (2) DISCLOSURE BY AGENTS.—An agent who

2 receives protected health information from a person

3 described in subsection (b) shall be subject to all

4 rules of disclosure and safeguard requirements

5 under this title.

6 (c) SCOPE OF DISCLOSURE.—Every disclosure of pro7 tected health information by a person under this title shall

8 be limited to the information necessary to accomplish the

9 purpose for which the information is disclosed.

10 (d) IDENTIFICATION OF DISCLOSED INFORMATION

11 AS PROTECTED HEALTH INFORMATION.—Except as oth12 erwise provided in this title, protected health information

13 may not be disclosed unless such information is clearly

14 identified as protected health information that is subject

15 to this Act.

16 (e) CREATION OF NONIDENTIFIABLE HEALTH IN17 FORMATION.—A person described in subsection (b) may

18 use protected health information for the purpose of cre19 ating nonidentifiable health information, if the person pro20 hibits the employee or agent creating the nonidentifiable

21 health information from using or disclosing the protected

22 health information for purposes other than the sole pur23 pose of creating nonidentifiable health information as

24 specified by the person.
31

•HR 1215 IH

1 (f) DISCLOSURE USING THE KEY.—Any person who

2 manipulates nonidentifiable health information in order to

3 identity an individual, without lawfully using the key, is

4 deemed to have disclosed protected health information.

5 SEC. 203. AUTHORIZATIONS FOR USE OR DISCLOSURE OF

6 PROTECTED HEALTH INFORMATION OTHER

7 THAN FOR TREATMENT, PAYMENT, HEALTH

8 CARE OPERATIONS, OR HEALTH RESEARCH.

9 (a) IN GENERAL.—An individual who is the subject

10 of protected health information may authorize any person

11 to disclose or use such information for any purpose. An

12 authorization under this section is not valid if its signing

13 by the individual is a prerequisite for signing an authoriza14 tion under section 202.

15 (b) WRITTEN AUTHORIZATIONS.—A person may dis16 close and use protected health information, for purposes

17 other than those authorized under section 202, pursuant

18 to a written authorization signed by the individual who

19 is the subject of the information that meets the require20 ments of section 201(d). An authorization under this sec21 tion shall be separate from any authorization provided

22 under section 202.

23 (c) LIMITATION ON AUTHORIZATIONS.—Notwith24 standing any other provision of Federal law, life insurers,

25 and other entities issuing disability income or long-term
32

•HR 1215 IH

1 care insurance under the laws of any State, shall meet

2 the requirements of section 201(a) with respect to an indi3 vidual for purposes of life, disability income or long-term

4 care insurance, by obtaining authorization of such indi5 vidual under this section 203.

6 (1) Notwithstanding subsection (d), an author7 ization obtained in the ordinary course of business

8 by a life insurer under this section shall remain in

9 effect during the term of the individual’s insurance

10 coverage and as may be necessary for the issuer to

11 meet its obligations with respect to such individual

12 under the terms of the policy, plan or program.

13 (2) An authorization obtained from an indi14 vidual in connection with an application that does

15 not result in coverage with respect to such individual

16 shall expire the earlier of the date specified in the

17 individual’s authorization or the effective date of any

18 revocation under subsection (d).

19 (d) REVOCATION OR AMENDMENT OF AUTHORIZA20 TION.—

21 (1) IN GENERAL.—Except as otherwise pro22 vided in this section, an individual may revoke or

23 amend an authorization described in this section by

24 providing written notice to the person who obtained

25 such authorization unless the disclosure that is the
33

•HR 1215 IH

1 subject of the authorization is related to the evalua2 tion of an application for life insurance coverage or

3 a claim for life insurance benefits.

4 (2) NOTICE OF REVOCATION.—A person that

5 discloses protected health information pursuant to

6 an authorization that has been revoked under para7 graph (1) shall not be subject to any liability or pen8 alty under this title if that person had no actual no9 tice of the revocation.

10 (e) DISCLOSURE FOR PURPOSE ONLY.—A recipient

11 of protected health information pursuant to an authoriza12 tion under section 203(b) may disclose such information

13 only to carry out the purposes for which the information

14 was authorized to be disclosed.

15 (f) MODEL AUTHORIZATIONS.—

16 (1) The Secretary, after notice and opportunity

17 for public comment, shall develop and disseminate

18 model written authorizations of the type described in

19 subsection (b). The Secretary shall consult with the

20 National Committee on Vital and Health Statistics

21 in developing such authorizations.

22 (2) Notwithstanding paragraph (1), the insur23 ance commissioner of the State of domicile of a life

24 insurer may exercise exclusive authority in devel-
34

•HR 1215 IH

1 oping and disseminating model written authoriza2 tions for purposes of subsection (c).

3 (3) Any authorization obtained using a model

4 authorization promulgated under this subsection

5 shall be deemed to meet the authorization require6 ments of this section.

7 (g) AUTHORIZATIONS FOR RESEARCH.—This section

8 applies to health research only where such research is not

9 governed by section 208.

10 SEC. 204. NEXT OF KIN AND DIRECTORY INFORMATION.

11 (a) NEXT OF KIN.—A health care provider, or a per12 son who receives protected health information under sec13 tion 205, may disclose protected health information re14 garding an individual to the individual’s spouse, parent,

15 child, sister, brother, next of kin, or to another person

16 whom the individual has identified, if—

17 (1) the individual who is the subject of the

18 information—

19 (A) has been notified of the individual’s

20 right to object to such disclosure and the indi21 vidual has not objected to the disclosure; or

22 (B) is in a physical or mental condition

23 such that the individual is not capable of object24 ing, and there are no prior indications that the

25 individual would object;
35

•HR 1215 IH

1 (2) the information disclosed relates to health

2 care currently being provided to that individual; and

3 (3) the disclosure of the protected health infor4 mation is consistent with good medical or profes5 sional practice.

6 (b) DIRECTORY INFORMATION.—

7 (1) DISCLOSURE.—

8 (A) IN GENERAL.—Except as provided in

9 paragraph (2), a person described in subsection

10 (a) may disclose the information described in

11 subparagraph (B) to any person if the indi12 vidual who is the subject of the information—

13 (i) has been notified of the individ14 ual’s right to object and the individual has

15 not objected to the disclosure; or

16 (ii) is in a physical or mental condi17 tion such that the individual is not capable

18 of objecting, the individual’s next of kin

19 has not objected, and there are no prior in20 dications that the individual would object.

21 (B) INFORMATION.—Information described

22 in this subparagraph is information that con23 sists only of 1 or more of the following items:

24 (i) The name of the individual who is

25 the subject of the information.
36

•HR 1215 IH

1 (ii) The general health status of the

2 individual, described as critical, poor, fair,

3 stable, or satisfactory or in terms denoting

4 similar conditions.

5 (iii) The location of the individual on

6 premises controlled by a provider.

7 (2) EXCEPTION.—

8 (A) LOCATION.—Paragraph (1)(B)(iii)

9 shall not apply if disclosure of the location of

10 the individual would reveal specific information

11 about the physical or mental condition of the

12 individual, unless the individual expressly au13 thorizes such disclosure.

14 (B) DIRECTORY OR NEXT OF KIN INFOR15 MATION.—A disclosure may not be made under

16 this section if the health care provider involved

17 has reason to believe that the disclosure of di18 rectory or next of kin information could lead to

19 the physical or mental harm of the individual,

20 unless the individual expressly authorizes such

21 disclosure.

22 SEC. 205. EMERGENCY CIRCUMSTANCES.

23 Any person who creates or receives protected health

24 information under this title may disclose protected health

25 information in emergency circumstances when necessary
37

•HR 1215 IH

1 to protect the health or safety of the individual who is

2 the subject of such information from serious, imminent

3 harm. No disclosure made in the good faith belief that

4 the disclosure was necessary to protect the health or safety

5 of an individual from serious, imminent harm shall be in

6 violation of, or punishable under, this Act.

7 SEC. 206. OVERSIGHT.

8 (a) IN GENERAL.—Any person may disclose pro9 tected health information to an accrediting body or public

10 health authority, a health oversight agency, or a State in11 surance department, for purposes of an oversight function

12 authorized by law.

13 (b) PROTECTION FROM FURTHER DISCLOSURE.—

14 Protected health information disclosed under this section

15 shall not be further disclosed by an accrediting body or

16 public health authority, a health oversight agency, a State

17 insurance department, or their agents for any purpose un18 related to the authorized oversight function. Notwith19 standing any other provision of law, protected health in20 formation disclosed under this section shall be protected

21 from further disclosure by an accrediting body or public

22 health authority, a health oversight agency, a State insur23 ance department, or their agents pursuant to a subpoena,

24 discovery request, introduction as evidence, testimony, or

25 otherwise.
38

•HR 1215 IH

1 (c) AUTHORIZATION BY A SUPERVISOR.—For pur2 poses of this section, the individual with authority to au3 thorize the oversight function involved shall provide to the

4 person described in subsection (a) a statement that the

5 protected health information is being sought for a legally

6 authorized oversight function.

7 (d) USE IN ACTION AGAINST INDIVIDUALS.—Pro8 tected health information about an individual that is dis9 closed under this section may not be used by the recipient

10 in, or disclosed by the recipient to any person for use in,

11 an administrative, civil, or criminal action or investigation

12 directed against the individual who is the subject of the

13 protected health information unless the action or inves14 tigation arises out of and is directly related to—

15 (1) the receipt of health care or payment for

16 health care; or

17 (2) a fraudulent claim related to health care, or

18 a fraudulent or material misrepresentation of the

19 health of the individual.

20 SEC. 207. PUBLIC HEALTH.

21 (a) IN GENERAL.—A health care provider, health

22 plan, public health authority, health researcher, employer,

23 life insurer, law enforcement official, school, or university

24 may disclose protected health information to a public
39

•HR 1215 IH

1 health authority or other person authorized by law for use

2 in a legally authorized—

3 (1) disease or injury report;

4 (2) public health surveillance;

5 (3) public health investigation or intervention;

6 (4) vital statistics report, such as birth or death

7 information;

8 (5) report of abuse or neglect information about

9 any individual; or

10 (6) report of information concerning a commu11 nicable disease status.

12 (b) IDENTIFICATION OF DECEASED INDIVIDUAL.—

13 Any person may disclose protected health information if

14 such disclosure is necessary to assist in the identification

15 or safe handling of a deceased individual.

16 (c) REQUIREMENT TO RELEASE PROTECTED

17 HEALTH INFORMATION TO CORONERS AND MEDICAL

18 EXAMINERS.—

19 (1) IN GENERAL.—When a Coroner or Medical

20 Examiner or their duly appointed deputies seek pro21 tected health information for the purpose of inquiry

22 into and determination of, the cause, manner, and

23 circumstances of a death, the health care provider,

24 health plan, health oversight agency, public health

25 authority, employer, life insurer, health researcher,
40

•HR 1215 IH

1 law enforcement official, school, or university in2 volved shall provide the protected health information

3 to the Coroner or Medical Examiner or to the duly

4 appointed deputies without undue delay.

5 (2) PRODUCTION OF ADDITIONAL INFORMA6 TION.—If a Coroner or Medical Examiner or their

7 duly appointed deputies receives health information

8 from a person referred to in paragraph (1), such

9 health information shall remain as protected health

10 information unless the health information is at11 tached to or otherwise made a part of a Coroner’s

12 or Medical Examiner’s official report, in which case

13 it shall no longer be protected.

14 (3) EXEMPTION.—Health information attached

15 to or otherwise made a part of a Coroner’s or Med16 ical Examiner’s official report, shall be exempt from

17 the provisions of this Act.

18 SEC. 208. HEALTH RESEARCH.

19 (a) IN GENERAL.—A person lawfully in possession of

20 protected health information may disclose such informa21 tion to a health researcher under any of the following ar22 rangements:

23 (1) RESEARCH GOVERNED BY THE COMMON

24 RULE.—A person identified in subsection (a) may

25 disclose protected health information to a health re-
41

•HR 1215 IH

1 searcher if the research project has been approved

2 by an institutional review board pursuant to the re3 quirements of the common rule as implemented by

4 a Federal agency.

5 (2) ANALYSES OF HEALTH CARE RECORDS AND

6 MEDICAL ARCHIVES.—A person identified in sub7 section (a) may disclose protected health information

8 to a health researcher if—

9 (A) consistent with the safeguards estab10 lished pursuant to section 111 and the person’s

11 policies and procedures established under this

12 section, the health research has been reviewed

13 by a board, committee, or other group formally

14 designated by such person to review research

15 programs;

16 (B) the health research involves analysis of

17 protected health information previously created

18 or collected by the person;

19 (C) the person that maintains the pro20 tected health information to be used in the

21 analyses has in place a written policy and pro22 cedure to assure the security and confidentiality

23 of protected health information and to specify

24 permissible and impermissible uses of such in25 formation for health research;
42

•HR 1215 IH

1 (D) the person that maintains the pro2 tected health information to be used in the

3 analyses enters into a written agreement with

4 the recipient health researcher that specifies the

5 permissible and impermissible uses of the pro6 tected health information and provides notice to

7 the researcher that any misuse or further dis8 closure of the information to other persons is

9 prohibited and may provide a basis for action

10 against the health researcher under this Act;

11 and

12 (E) the person keeps a record of health re13 searchers to whom protected health information

14 has been disclosed.

15 (3) SAFETY AND EFFICACY REPORTS.—A per16 son may disclose protected health information to a

17 manufacturer of a drug, biologic or medical device,

18 in connection with any monitoring activity or reports

19 made to such manufacturer for use in verifying the

20 safety or efficacy of such manufacturer’s approved

21 product in special populations or for long-term use.

22 (b) OVERSIGHT.—On the advice of the National Com23 mittee on Vital and Health Statistics, the Secretary shall

24 report to the Congress not later than 18 months after the

25 effective date of this section concerning the adequacy of
43

•HR 1215 IH

1 the policies and procedures implemented pursuant to sub2 section (a)(2) for protecting the confidentiality of pro3 tected health information while promoting its use in re4 search concerning health care outcomes, the epidemiology

5 and etiology of diseases and conditions and the safety, effi6 cacy and cost effectiveness of health care interventions.

7 Based on the conclusions of such report, the Secretary

8 may promulgate model language for written agreements

9 deemed to comply with subsection (a)(2)(C).

10 (c) STATUTORY ASSURANCE OF CONFIDEN11 TIALITY.—

12 (1) Protected health information obtained by a

13 health researcher pursuant to this section shall be

14 used and maintained in confidence, consistent with

15 the confidentiality practices established by the health

16 researcher pursuant to section 111.

17 (2) A recipient health researcher may not be

18 compelled in any Federal, State, or local civil, crimi19 nal, administrative, legislative, or other proceeding

20 to disclose protected health information created,

21 maintained or received under this section, provided

22 that nothing in this paragraph shall be construed to

23 prevent an audit or lawful investigation pursuant to

24 the authority of a Federal department or agency, of
44

•HR 1215 IH

1 a research project conducted, supported or subject to

2 regulation by such department or agency.

3 (3) Notwithstanding any other provision of law,

4 information disclosed by a health researcher to a

5 Federal agency under this subsection may not be

6 further used or disclosed by the agency for a pur7 pose unrelated to the agency’s oversight or investiga8 tion.

9 SEC. 209. DISCLOSURE IN CIVIL, JUDICIAL, AND ADMINIS10 TRATIVE PROCEDURES.

11 (a) IN GENERAL.—A health care provider, health

12 plan, public health authority, employer, life insurer, law

13 enforcement official, school, or university may disclose

14 protected health information—

15 (1) pursuant to a discovery request or subpoena

16 in a civil action brought in a Federal or State court

17 or a request or subpoena related to a Federal or

18 State administrative proceeding, provided that

19 (2) such discovery request or subpoena is made

20 through or pursuant to a court order as provided for

21 in subsection (b).

22 (b) COURT ORDERS.—

23 (1) STANDARD FOR ISSUANCE.—In considering

24 a request for a court order regarding the disclosure

25 of protected health information under subsection (a),
45

•HR 1215 IH

1 the court shall issue such order if the court deter2 mines that without the disclosure of such informa3 tion, the person requesting the order would be im4 paired from establishing a claim or defense.

5 (2) REQUIREMENTS.—An order issued under

6 paragraph (1) shall—

7 (A) provide that the protected health infor8 mation involved is subject to court protection;

9 (B) specify to whom the information may

10 be disclosed;

11 (C) specify that such information may not

12 otherwise be disclosed or used; and

13 (D) meet any other requirements that the

14 court determines are needed to protect the con15 fidentiality of the information.

16 (c) APPLICABILITY.—This section shall not apply in

17 a case in which the protected health information sought

18 under such discovery request or subpoena relates to a

19 party to the litigation or an individual whose medical con20 dition is at issue.

21 (d) EFFECT OF SECTION.—This section shall not be

22 construed to supersede any grounds that may apply under

23 Federal or State law for objecting to turning over the pro24 tected health information.
46

•HR 1215 IH

1 SEC. 210. DISCLOSURE FOR LAW ENFORCEMENT PUR2 POSES.

3 (a) DISCLOSURE.—

4 (1) IN GENERAL.—A person who receives pro5 tected health information pursuant to sections 202

6 through 207, may disclose such information to a

7 State or Federal law enforcement agency if such dis8 closure is pursuant to—

9 (A) a subpoena issued under the authority

10 of a grand jury;

11 (B) an administrative subpoena or sum12 mons or a judicial subpoena or warrant if the

13 determination described in paragraph (2) has

14 been made;

15 (C) a warrant issued upon a showing of

16 probable cause if the determination described in

17 paragraph (2) has been made;

18 (D) a Federal or state law requiring the

19 reporting of specific medical information to law

20 enforcement authorities;

21 (E) a written consent or waiver of privilege

22 by an individual allowing access to the individ23 ual’s protected health information; or

24 (F) by other court order if the determina25 tion described in paragraph (2) has been made.
47

•HR 1215 IH

1 (2) HIGHER STANDARD FOR DISCLOSURE OF

2 CERTAIN INFORMATION.—The determination under

3 this paragraph is a determination, by the court or

4 administrative body issuing the subpoena, summons,

5 warrant, or order involved, that the need of the per6 son requesting the disclosure for the information

7 substantially outweighs the privacy interest of each

8 individual whose health or health care is the subject

9 of the information.

10 (b) REDACTIONS.—To the extent practicable and

11 consistent with the requirements of due process, in the

12 case of information disclosed under subsection (a) the

13 State or Federal law enforcement agency to which the in14 formation is disclosed shall react personal identifiers from

15 protected health information prior to the public disclosure

16 of such information in a judicial or administrative pro17 ceeding.

18 (c) USE OF INFORMATION.—Protected health infor19 mation obtained by a State or Federal law enforcement

20 agency under subsection (a) may only be used for purposes

21 of a legitimate law enforcement activity.

22 (d) EXCEPTION IN EXIGENT CIRCUMSTANCES.—Sub23 section (a) shall not be construed to limit or restrict the

24 ability of State or Federal law enforcement agencies to
48

•HR 1215 IH

1 gain protected health information if exigent circumstances

2 exist.

3 SEC. 211. PAYMENT CARD AND ELECTRONIC PAYMENT

4 TRANSACTION.

5 (a) PAYMENT FOR HEALTH CARE THROUGH CARD

6 OR ELECTRONIC MEANS.—If an individual pays for health

7 care by presenting a debit, credit, or other payment card

8 or account number, or by any other payment means, the

9 person receiving the payment may disclose to a person de10 scribed in subsection (b) only such protected health infor11 mation about the individual as is necessary in connection

12 with activities described in subsection (b), including the

13 processing of the payment transaction or the billing or col14 lection of amounts charged to, debited from, or otherwise

15 paid by, the individual using the card, number, or other

16 means.

17 (b) TRANSACTION PROCESSING.—A person who is a

18 debit, credit, or other payment card issuer, a payment sys19 tem operator, a financial institution participant in a pay20 ment system or is an entity assisting such an issuer, oper21 ator, or participant in connection with activities described

22 in this subsection, may use or disclose protected health

23 information about an individual in connection with—

24 (1) the authorization, settlement, billing, proc25 essing, clearing, transferring, reconciling, or collec-
49

•HR 1215 IH

1 tion of amounts charged, debited or otherwise paid

2 using a debit, credit, or other payment card or ac3 count number, or by other payment means;

4 (2) the transfer of receivables, accounts, or in5 terest therein;

6 (3) the audit of the debit, credit, or other pay7 ment information;

8 (4) compliance with Federal, State, or local law;

9 (5) compliance with a properly authorized civil,

10 criminal, or regulatory investigation by Federal,

11 State, or local authorities as governed by the re12 quirements of this section; or

13 (6) fraud protection, risk control, resolving cus14 tomer disputes or inquiries, communicating with the

15 person to whom the information relates, or reporting

16 to consumer reporting agencies.

17 (c) SPECIFIC PROHIBITIONS.—A person described in

18 subsection (b) may not disclose protected health informa19 tion for any purpose that is not described in subsection

20 (b). Notwithstanding any other provision of law, any

21 health care provider, health plan, health oversight agency,

22 health researcher, employer, life insurer, school or univer23 sity who makes a good faith disclosure of protected health

24 information to an entity and for the purposes described
50

•HR 1215 IH

1 in subsection (b) shall not be liable for subsequent disclo2 sures by such entity.

3 (d) SCOPE.—

4 (1) IN GENERAL.—The use of protected health

5 information by a person described in subsection (b)

6 and its agents shall not be considered a disclosure

7 for purposes of this Act, so long as the use involved

8 is consistent with the activities authorized in sub9 section (b) or other purposes for which the informa10 tion was lawfully obtained.

11 (2) REGULATED INSTITUTIONS.—A person who

12 is subject to enforcement pursuant to section 8 of

13 the Federal Deposit Insurance Act or who is a Fed14 eral credit union or State credit union as defined in

15 the Federal Credit Union Act or who is registered

16 pursuant to the Securities and Exchange Act, or

17 who is an entity assisting such a person—

18 (A) shall not be subject to this Act to the

19 extent that such person or entity is described in

20 subsection (b) and to the extent that such per21 son or entity is engaged in activities authorized

22 in that subsection; and

23 (B) shall be subject to enforcement exclu24 sively under section 8 of the Federal Deposit

25 Insurance Act, the Federal Credit Union Act,
51

•HR 1215 IH

1 or the Securities and Exchange Act, as applica2 ble, to the extent that such person or entity is

3 engaged in activities other than those permitted

4 under subsection (b).

5 (3) RULE OF CONSTRUCTION.—Nothing in this

6 subsection shall be deemed to exempt entities de7 scribed in paragraph (2) from the prohibition set

8 forth in subsection (c).

9 SEC. 212. INDIVIDUAL REPRESENTATIVES.

10 (a) IN GENERAL.—Except as provided in subsections

11 (b) and (c), a person who is authorized by law (based on

12 grounds other than the individual being a minor), or by

13 an instrument recognized under law, to act as an agent,

14 attorney, proxy, or other legal representative of a pro15 tected individual, may, to the extent so authorized, exer16 cise and discharge the rights of the individual under this

17 Act.

18 (b) HEALTH CARE POWER OF ATTORNEY.—A person

19 who is authorized by law (based on grounds other than

20 being a minor), or by an instrument recognized under law,

21 to make decisions about the provision of health care to

22 an individual who is incapacitated, may exercise and dis23 charge the rights of the individual under this Act to the

24 extent necessary to effectuate the terms or purposes of

25 the grant of authority.
52

•HR 1215 IH

1 (c) NO COURT DECLARATION.—If a health care pro2 vider determines that an individual, who has not been de3 clared to be legally incompetent, suffers from a medical

4 condition that prevents the individual from acting know5 ingly or effectively on the individual’s own behalf, the right

6 of the individual to authorize disclosure under this Act

7 may be exercised and discharged in the best interest of

8 the individual by—

9 (1) a person described in subsection (b) with re10 spect to the individual;

11 (2) a person described in subsection (a) with re12 spect to the individual, but only if a person de13 scribed in paragraph (1) cannot be contacted after

14 a reasonable effort;

15 (3) the next of kin of the individual, but only

16 if a person described in paragraph (1) or (2) cannot

17 be contacted after a reasonable effort; or

18 (4) the health care provider, but only if a per19 son described in paragraph (1), (2), or

20 (5) cannot be contacted after a reasonable ef21 fort.

22 (d) APPLICATION TO DECEASED INDIVIDUALS.—The

23 provisions of this Act shall continue to prevent disclosure

24 of protected health information concerning a deceased in25 dividual.
53

•HR 1215 IH

1 (e) EXERCISE OF RIGHTS ON BEHALF OF A DE2 CEASED INDIVIDUAL.—

3 (1) IN GENERAL.—A person who is authorized

4 by law or by an instrument recognized under law, to

5 act as an executor of the estate of a deceased indi6 vidual, or otherwise to exercise the rights of the de7 ceased individual, may, to the extent so authorized,

8 exercise and discharge the rights of such deceased

9 individual under this Act for a period of 2 years fol10 lowing the death of such individual. If no such des11 ignee has been authorized, the rights of the deceased

12 individual may be exercised as provided for in sub13 section (c).

14 (2) INSURED INDIVIDUALS.—In the case of an

15 individual who is deceased and who was the insured

16 under an insurance policy or policies, the right to

17 authorize disclosure of protected health information

18 may be exercised by the beneficiary or beneficiaries

19 of such insurance policy or policies.

20 (f) RIGHTS OF MINORS.—The rights of minors under

21 this Act shall be exercised by a parent, the minor or other

22 person as provided under applicable state law.

23 SEC. 213. NO LIABILITY FOR PERMISSIBLE DISCLOSURES.

24 A health care provider, health plan, health oversight

25 agency, health researcher, employer, life insurer, school,
54

•HR 1215 IH

1 or university, or an agent of such persons, that makes a

2 disclosure of protected health information about an indi3 vidual that is permitted by this Act shall not be liable to

4 the individual for such disclosure under common law.

5 SEC. 214. SALE OF BUSINESS, MERGERS, ETC.

6 (a) IN GENERAL.—A health care provider, health

7 plan, health oversight agency, employer, life insurer,

8 school, or university may disclose protected health infor9 mation to a person or persons for purposes of enabling

10 business decisions to be made about or in connection with

11 the purchase, transfer, merger, or sale of a business or

12 businesses.

13 (b) NO FURTHER DISCLOSURE.—A person or per14 sons who receive protected health information under this

15 section shall make no further use or disclosure of such

16 information unless otherwise authorized under this Act.

17 TITLE III—SANCTIONS

18 Subtitle A—Criminal Provisions

19 SEC. 301. WRONGFUL DISCLOSURE OF PROTECTED

20 HEALTH INFORMATION.

21 (a) IN GENERAL.—Part I of title 18, United States

22 Code, is amended by adding at the end the following:
55

•HR 1215 IH

1 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE

2 OF PROTECTED HEALTH INFORMATION

3 ‘‘§ 2801. Wrongful disclosure of protected health in4 formation

5 ‘‘(a) OFFENSE.—The penalties described in sub6 section (b) shall apply to a person that knowingly and

7 intentionally—

8 ‘‘(1) obtains protected health information relat9 ing to an individual from a health care provider,

10 health plan, health oversight agency, public health

11 authority, employer, life insurer, health researcher,

12 law enforcement official, school, or university except

13 as provided in title II of the Medical Information

14 Protection Act of 2001; or

15 ‘‘(2) discloses protected health information to

16 another person in a manner other than that which

17 is permitted under title II of the Medical Informa18 tion Protection Act of 2001.

19 ‘‘(b) PENALTIES.—A person described in subsection

20 (a) shall—

21 ‘‘(1) be fined not more than $50,000, impris22 oned not more than 1 year, or both;

23 ‘‘(2) if the offense is committed under false pre24 tenses, be fined not more than $100,000, imprisoned

25 not more than 5 years, or both; or
56

•HR 1215 IH

1 ‘‘(3) if the offense is committed with the intent

2 to sell, transfer, or use protected health information

3 for monetary gain or malicious harm, be fined not

4 more than $250,000, imprisoned not more than 10

5 years, or both.

6 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per7 son described in subsection (a), the maximum penalties

8 described in subsection (b) shall be doubled for every sub9 sequent conviction for an offense arising out of a violation

10 or violations related to a set of circumstances that are dif11 ferent from those involved in the previous violation or set

12 of related violations described in such subsection (a).’’.

13 (b) CLERICAL AMENDMENT.—The table of chapters

14 for part I of title 18, United States Code, is amended by

15 inserting after the item relating to chapter 123 the fol16 lowing new item:

‘‘Sec. 2801. Wrongful disclosure of protected health information.’’.

17 Subtitle B—Civil Sanctions

18 SEC. 311. CIVIL PENALTY VIOLATION.

19 A person who the Secretary, in consultation with the

20 Attorney General, determines has substantially and mate21 rially failed to comply with this Act shall be subject, in

22 addition to any other penalties that may be prescribed by

23 law—

24 (1) in a case in which the violation relates to

25 title I, to a civil penalty of not more than $500 for
57

•HR 1215 IH

1 each such violation, but not to exceed $5,000 in the

2 aggregate for multiple violations arising from the

3 same failure to comply with the Act;

4 (2) in a case in which the violation relates to

5 title II, to a civil penalty of not more than $10,000

6 for each such violation, but not to exceed $50,000

7 in the aggregate for multiple violations arising from

8 the same failure to comply with the Act; or

9 (3) in a case in which the Secretary finds that

10 such violations have occurred with such frequency as

11 to constitute a general business practice, to a civil

12 penalty of not more than $100,000.

13 SEC. 312. PROCEDURES FOR IMPOSITION OF PENALTIES.

14 (a) INITIATION OF PROCEEDINGS.—

15 (1) IN GENERAL.—The Secretary, in consulta16 tion with the Attorney General, may initiate a pro17 ceeding to determine whether to impose a civil

18 money penalty under section 311. The Secretary

19 may not initiate an action under this section with re20 spect to any violation described in section 311 after

21 the expiration of the 6-year period beginning on the

22 date on which such violation was alleged to have oc23 curred. The Secretary may initiate an action under

24 this section by serving notice of the action in any
58

•HR 1215 IH

1 manner authorized by Rule 4 of the Federal Rules

2 of Civil Procedure.

3 (2) NOTICE AND OPPORTUNITY FOR HEAR4 ING.—The Secretary shall not make a determination

5 adverse to any person under paragraph (1) until the

6 person has been given written notice and an oppor7 tunity for the determination to be made on the

8 record after a hearing at which the person is entitled

9 to be represented by counsel, to present witnesses,

10 and to cross-examine witnesses against the person.

11 (3) SANCTIONS FOR FAILURE TO COMPLY.—

12 The official conducting a hearing under this section

13 may sanction a person, including any party or attor14 ney, for failing to comply with an order or proce15 dure, failing to defend an action, or other mis16 conduct as would interfere with the speedy, orderly,

17 or fair conduct of the hearing. Such sanction shall

18 reasonably relate to the severity and nature of the

19 failure or misconduct. Such sanction may include—

20 (A) in the case of refusal to provide or per21 mit discovery, drawing negative factual infer22 ences or treating such refusal as an admission

23 by deeming the matter, or certain facts, to be

24 established;
59

•HR 1215 IH

1 (B) prohibiting a party from introducing

2 certain evidence or otherwise supporting a par3 ticular claim or defense;

4 (C) striking pleadings, in whole or in part;

5 (D) staying the proceedings;

6 (E) dismissal of the action;

7 (F) entering a default judgment;

8 (G) ordering the party or attorney to pay

9 attorneys’ fees and other costs caused by the

10 failure or misconduct; and

11 (H) refusing to consider any motion or

12 other action which is not filed in a timely man13 ner.

14 (b) SCOPE OF PENALTY.—In determining the

15 amount or scope of any penalty imposed pursuant to sec16 tion 311, the Secretary shall take into account—

17 (1) the nature of claims and the circumstances

18 under which they were presented;

19 (2) the degree of culpability, history of prior of20 fenses, and financial condition of the person pre21 senting the claims;

22 (3) evidence of good faith endeavor to protect

23 the confidentiality of protected health information;

24 and

25 (4) such other matters as justice may require.
60

•HR 1215 IH

1 (c) REVIEW OF DETERMINATION.—

2 (1) IN GENERAL.—Any person adversely af3 fected by a determination of the Secretary under

4 this section may obtain a review of such determina5 tion in the United States Court of Appeals for the

6 circuit in which the person resides, or in which the

7 claim was presented, by filing in such court (within

8 60 days following the date the person is notified of

9 the determination of the Secretary) a written peti10 tion requesting that the determination be modified

11 or set aside.

12 (2) FILING OF RECORD.—A copy of the petition

13 filed under paragraph (1) shall be forthwith trans14 mitted by the clerk of the court to the Secretary,

15 and thereupon the Secretary shall file in the Court

16 the record in the proceeding as provided in section

17 2112 of title 28, United States Code. Upon such fil18 ing, the court shall have jurisdiction of the pro19 ceeding and of the question determined therein, and

20 shall have the power to make and enter upon the

21 pleadings, testimony, and proceedings set forth in

22 such record a decree affirming, modifying, remand23 ing for further consideration, or setting aside, in

24 whole or in part, the determination of the Secretary
61

•HR 1215 IH

1 and enforcing the same to the extent that such order

2 is affirmed or modified.

3 (3) CONSIDERATION OF OBJECTIONS.—No ob4 jection that has not been raised before the Secretary

5 with respect to a determination described in para6 graph (1) shall be considered by the court, unless

7 the failure or neglect to raise such objection shall be

8 excused because of extraordinary circumstances.

9 (4) FINDINGS.—The findings of the Secretary

10 with respect to questions of fact in an action under

11 this subsection, if supported by substantial evidence

12 on the record considered as a whole, shall be conclu13 sive. If any party shall apply to the court for leave

14 to adduce additional evidence and shall show to the

15 satisfaction of the court that such additional evi16 dence is material and that there were reasonable

17 grounds for the failure to adduce such evidence in

18 the hearing before the Secretary, the court may

19 order such additional evidence to be taken before the

20 Secretary and to be made a part of the record. The

21 Secretary may modify findings as to the facts, or

22 make new findings, by reason of additional evidence

23 so taken and filed, and shall file with the court such

24 modified or new findings, and such findings with re25 spect to questions of fact, if supported by substan-
62

•HR 1215 IH

1 tial evidence on the record considered as a whole,

2 and the recommendations of the Secretary, if any,

3 for the modification or setting aside of the original

4 order, shall be conclusive.

5 (5) EXCLUSIVE JURISDICTION.—Upon the filing

6 of the record with the court under paragraph (2),

7 the jurisdiction of the court shall be exclusive and its

8 judgment and decree shall be final, except that the

9 same shall be subject to review by the Supreme

10 Court of the United States, as provided for in sec11 tion 1254 of title 28, United States Code.

12 (d) RECOVERY OF PENALTIES.—

13 (1) IN GENERAL.—Civil money penalties im14 posed under this subtitle may be compromised by

15 the Secretary and may be recovered in a civil action

16 in the name of the United States brought in United

17 States district court for the district where the claim

18 was presented, or where the claimant resides, as de19 termined by the Secretary. Amounts recovered under

20 this section shall be paid to the Secretary and depos21 ited as miscellaneous receipts of the Treasury of the

22 United States.

23 (2) DEDUCTION FROM AMOUNTS OWING.—The

24 amount of any penalty, when finally determined

25 under this section, or the amount agreed upon in
63

•HR 1215 IH

1 compromise under paragraph (1), may be deducted

2 from any sum then or later owing by the United

3 States or a State to the person against whom the

4 penalty has been assessed.

5 (e) DETERMINATION FINAL.—A determination by

6 the Secretary to impose a penalty under section 321 shall

7 be final upon the expiration of the 60-day period referred

8 to in subsection (c)(1). Matters that were raised or that

9 could have been raised in a hearing before the Secretary

10 or in an appeal pursuant to subsection (c) may not be

11 raised as a defense to a civil action by the United States

12 to collect a penalty under section 321.

13 (f) SUBPOENA AUTHORITY.—

14 (1) IN GENERAL.—For the purpose of any

15 hearing, investigation, or other proceeding author16 ized or directed under this section, or relative to any

17 other matter within the jurisdiction of the Attorney

18 General hereunder, the Attorney General, acting

19 through the Secretary shall have the power to issue

20 subpoenas requiring the attendance and testimony of

21 witnesses and the production of any evidence that

22 relates to any matter under investigation or in ques23 tion before the Secretary. Such attendance of wit24 nesses and production of evidence at the designated

25 place of such hearing, investigation, or other pro-
64

•HR 1215 IH

1 ceeding may be required from any place in the

2 United States or in any Territory or possession

3 thereof.

4 (2) SERVICE.—Subpoenas of the Secretary

5 under paragraph (1) shall be served by anyone au6 thorized by the Secretary by delivering a copy there7 of to the individual named therein.

8 (3) PROOF OF SERVICE.—A verified return by

9 the individual serving the subpoena under this sub10 section setting forth the manner of service shall be

11 proof of service.

12 (4) FEES.—Witnesses subpoenaed under this

13 subsection shall be paid the same fees and mileage

14 as are paid witnesses in the district court of the

15 United States.

16 (5) REFUSAL TO OBEY.—In case of contumacy

17 by, or refusal to obey a duly served upon, any per18 son, any district court of the United States for the

19 judicial district in which such person charged with

20 contumacy or refusal to obey is found or resides or

21 transacts business, upon application by the Sec22 retary, shall have jurisdiction to issue an order re23 quiring such person to appear and give testimony, or

24 to appear and produce evidence, or both. Any failure
65

•HR 1215 IH

1 to obey such order of the court may be punished

2 by the court as contempt thereof.

3 (g) INJUNCTIVE RELIEF.—Whenever the Secretary

4 has reason to believe that any person has engaged, is en5 gaging, or is about to engage in any activity which makes

6 the person subject to a civil monetary penalty under sec7 tion 311, the Secretary may bring an action in an appro8 priate district court of the United States (or, if applicable,

9 a United States court of any territory) to enjoin such ac10 tivity, or to enjoin the person from concealing, removing,

11 encumbering, or disposing of assets which may be required

12 in order to pay a civil monetary penalty if any such pen13 alty were to be imposed or to seek other appropriate relief.

14 (h) AGENCY.—A principal is liable for penalties

15 under section 311 for the actions of the principal’s agent

16 acting within the scope of the agency.

17 SEC. 313. ENFORCEMENT BY STATE INSURANCE COMMIS18 SIONERS.

19 (a) STATE PENALTIES.—Subject to section 401, and

20 notwithstanding any other provision of this title, a state

21 insurance commissioner of the State of domicile of a life

22 insurer may exercise exclusive authority to impose any

23 penalties on a life insurer for violations of this Act pursu24 ant to the administrative procedures provided under that

25 State’s insurance laws.
66

•HR 1215 IH

1 (b) FAIL-SAFE FEDERAL AUTHORITY.—In the case

2 of a State that fails to substantially enforce the require3 ments of Title I and Title II of this Act with respect to

4 life insurers regulated by such State, the provisions of this

5 title shall apply with respect to a life insurer in the same

6 way that they apply to other persons subject to the Act.

7 TITLE IV—MISCELLANEOUS

8 SEC. 401. RELATIONSHIP TO OTHER LAWS.

9 (a) STATE AND FEDERAL LAW.—Except as provided

10 in this section—

11 (1) the provisions of this Act shall preempt any

12 State law that relates to matters covered by this

13 Act;

14 (2) this Act shall not be construed to preempt,

15 modify, repeal, or affect the interpretation of a pro16 vision of State or Federal law that relates to the dis17 closure of protected health information or any other

18 information about a minor to a parent or guardian

19 of such minor; and

20 (3) this Act shall not be construed as repealing,

21 explicitly or implicitly, other Federal laws or regula22 tions relating to protected health information or re23 lating to an individual’s access to protected health

24 information or health care services.
67

•HR 1215 IH

1 (b) RELATIONSHIP TO OTHER REGULATIONS.—This

2 Act is legislation described in section 264(c)(1) of the

3 Health Insurance Portability and Accountability Act of

4 1996 (Public Law 104–191; 110 Stat. 2033) and the reg5 ulations issued under such section as of December 28,

6 2000, shall be of no effect.

7 (c) PRIVILEGES.—Nothing in this Act shall be con8 strued to preempt or modify any provisions of State statu9 tory or common law to the extent that such law concerns

10 a privilege of a witness or person in a court of that State.

11 This Act shall not be construed to supersede or modify

12 any provision of Federal statutory or common law to the

13 extent such law concerns a privilege of a witness or person

14 in a court of the United States. Authorizations pursuant

15 to sections 202 and 203 shall not be construed as a waiver

16 of any such privilege.

17 (d) REPORTS CONCERNING FEDERAL PRIVACY

18 ACT.—Not later than 1 year after the date of the enact19 ment of this Act, the head of each Federal agency shall

20 prepare and submit to Congress a report concerning the

21 effect of this Act on each such agency. Such reports shall

22 include recommendations for legislation to address con23 cerns relating to the Federal Privacy Act.

24 (e) APPLICATION TO CERTAIN FEDERAL AGEN25 CIES.—
68

•HR 1215 IH

1 (1) DEPARTMENT OF DEFENSE.—

2 (A) EXCEPTIONS.—The Secretary of De3 fense may, by regulation, establish exceptions to

4 the disclosure requirements of this Act to the

5 extent such Secretary determines that disclo6 sure of protected health information relating to

7 members of the armed forces from systems of

8 records operated by the Department of Defense

9 is necessary under circumstances different from

10 those permitted under this Act for the proper

11 conduct of national defense functions by mem12 bers of the armed forces.

13 (B) APPLICATION TO CIVILIAN EMPLOY14 EES.—The Secretary of Defense may, by regu15 lation, establish for civilian employees of the

16 Department of Defense and employees of De17 partment of Defense contractors, limitations on

18 the right of such persons to revoke or amend

19 authorizations for disclosures under section 203

20 when such authorizations were provided by such

21 employees as a condition of employment and

22 the disclosure is determined necessary by the

23 Secretary of Defense to the proper conduct of

24 national defense functions by such employees.

25 (2) DEPARTMENT OF TRANSPORTATION.——
69

•HR 1215 IH

1 (A) EXCEPTIONS.—The Secretary of

2 Transportation may, with respect to members

3 of the Coast Guard, exercise the same powers

4 as the Secretary of Defense may exercise under

5 paragraph (1)(A).

6 (B) APPLICATION TO CIVILIAN EMPLOY7 EES.—The Secretary of Transportation may,

8 with respect to civilian employees of the Coast

9 Guard and Coast Guard contractors, exercise

10 the same powers as the Secretary of Defense

11 may exercise under paragraph (1)(B).

12 (3) DEPARTMENT OF VETERANS AFFAIRS.—

13 The limitations on use and disclosure of protected

14 health information under this Act shall not be con15 strued to prevent any exchange of such information

16 within and among components of the Department of

17 Veterans Affairs that determine eligibility for or en18 titlement to, or that provide, benefits under laws ad19 ministered by the Secretary of Veteran Affairs.

20 SEC. 402. CONFORMING AMENDMENT.

21 Section 1171(6) of the Social Security Act (42 U.S.C.

22 1320d(6)) is amended to read as follows:

23 ‘‘(6) INDIVIDUALLY IDENTIFIABLE HEALTH IN24 FORMATION.—The term ‘individually identifiable

25 health information’ has the same meaning given the
70

•HR 1215 IH

1 term ‘protected health information’ by section 2 of

2 the Medical Information Protection Act of 2001.’’.

3 SEC. 403. STUDY BY INSTITUTE OF MEDICINE.

4 Not later than 2 years after the date of enactment

5 of this Act, the National Research Council in conjunction

6 with the Institute of Medicine of the National Academy

7 of Sciences shall conduct a study to examine research

8 issues relating to protected health information, such as the

9 quality and uniformity of institutional review boards and

10 their practices with respect to data management for both

11 researchers and institutional review boards, as well as cur12 rent and proposed protection of health information in rela13 tion to the legitimate needs of law enforcement. The Coun14 cil shall prepare and submit to Congress a report con15 cerning the results of such study.

16 SEC. 404. EFFECTIVE DATE.

17 (a) EFFECTIVE DATE.—Except as provided in sub18 section (b), this Act shall take effect on the date that is

19 12 months after the date on which regulations are promul20 gated as required under subsection (c).

21 (b) APPLICABILITY.—The provisions of this Act shall

22 only apply to protected health information collected and

23 disclosed 12 months after the date on which regulations

24 are promulgated as required under subsection (c).
71

•HR 1215 IH

1 (c) REGULATIONS.—Not later than 12 months after

2 the date of enactment of this Act, the Secretary shall, in

3 consultation with the National Committee on Vital and

4 Health Statistics, promulgate regulations implementing

5 this Act.

6 (d) EXCEPTION.—If, not later than 18 months after

7 the date of enactment of this Act, the Secretary has not

8 promulgated the regulations required under subsection (c),

9 the effective date for purposes of subsections (a) and (b)

10 shall be the date that is 30 months after the date of enact11 ment of this Act or 12 months after the promulgation of

12 such regulations, whichever is earlier.

Æ