II 

110TH CONGRESS 

1ST SESSION S. 1814 

To provide individuals with access to health information of which they are 

a subject, ensure personal privacy with respect to health related information, promote the use of non-identifiable information for health research, 

impose criminal and civil penalties for unauthorized use of protected 

health information, to provide for the strong enforcement of these rights, 

and to protect States’ rights. 

IN THE SENATE OF THE UNITED STATES 

JULY 18 (legislative day, JULY 17), 2007 

Mr. LEAHY (for himself and Mr. KENNEDY) introduced the following bill; 

which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To provide individuals with access to health information of 

which they are a subject, ensure personal privacy with 

respect to health related information, promote the use 

of non-identifiable information for health research, impose criminal and civil penalties for unauthorized use 

of protected health information, to provide for the strong 

enforcement of these rights, and to protect States’ rights. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


cprice-sewell on PROD1PC62 with BILLS
2 

•S 1814 IS

1 SECTION 1. SHORT TITLE. 

2 (a) SHORT TITLE.—This Act may be cited as the 

3 ‘‘Health Information Privacy and Security Act’’. 

4 (b) TABLE OF CONTENTS.—The table of contents for 

5 this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Purposes. 

Sec. 3. Definitions. 

TITLE I—INDIVIDUALS’ RIGHTS 

Subtitle A—Rights of the Subjects of Protected Health Information 

Sec. 101. Right to privacy and security. 

Sec. 102. Inspection and copying of protected health information. 

Sec. 103. Modifications to protected health information. 

Sec. 104. Notice of privacy practices. 

Sec. 105. Demonstration grant. 

Subtitle B—Establishment of Safeguards 

Sec. 111. Establishment of safeguards. 

Sec. 112. Transparency. 

Sec. 113. Risk management. 

Sec. 114. Accounting for disclosures and use. 

TITLE II—RESTRICTIONS ON USE AND DISCLOSURE 

Subtitle A—General Restrictions on Use and Disclosure 

Sec. 201. General rules regarding use and disclosure. 

Sec. 202. Informed consent for disclosure of protected health information for 

treatment and payment. 

Sec. 203. Authorizations for disclosure of protected health information other 

than for treatment or payment. 

Sec. 204. Notification in the case of breach. 

Subtitle B—Disclosure Under Special Circumstances 

Sec. 211. Emergency circumstances. 

Sec. 212. Public health. 

Sec. 213. Protection and advocacy agencies. 

Sec. 214. Oversight. 

Sec. 215. Disclosure for law enforcement, national security, and intelligence 

purposes. 

Sec. 216. Next of kin and directory information. 

Sec. 217. Health research. 

Sec. 218. Judicial and administrative purposes. 

Sec. 219. Individual representatives. 

TITLE III—OFFICE OF HEALTH INFORMATION PRIVACY OF THE 

DEPARTMENT OF HEALTH AND HUMAN SERVICES 


cprice-sewell on PROD1PC62 with BILLS
3 

•S 1814 IS

Subtitle A—Designation 

Sec. 301. Designation. 

Subtitle B—Enforcement 

CHAPTER 1—CRIMINAL PROVISIONS

Sec. 311. Wrongful disclosure of protected health information. 

Sec. 312. Debarment for crimes and civil violations. 

CHAPTER 2—CIVIL SANCTIONS

Sec. 321. Civil penalty. 

Sec. 322. Procedures for imposition of penalties. 

Sec. 323. Civil action by individuals. 

Sec. 324. Enforcement by State attorneys general. 

Sec. 325. Protection for whistleblower. 

TITLE IV—MISCELLANEOUS 

Sec. 401. Relationship to other laws. 

Sec. 402. Effective date. 

1 SEC. 2. PURPOSES. 

2 The purposes of this Act are as follows: 

3 (1) To recognize that individuals have a right 

4 to privacy, confidentiality, and security with respect 

5 to health information, including genetic information, 

6 and that those rights must be protected. 

7 (2) To create incentives to turn protected 

8 health information into de-identified health informa9 tion, where appropriate. 

10 (3) To designate an Office of Health Informa11 tion Privacy within the Department of Health and 

12 Human Services to protect that right of privacy. 

13 (4) To provide individuals with— 

14 (A) access to health information of which 

15 they are the subject; and 


cprice-sewell on PROD1PC62 with BILLS
4 

•S 1814 IS

1 (B) the opportunity to challenge the accu2 racy and completeness of such information by 

3 being able to file modifications to or request the 

4 deletion of such information. 

5 (5) To provide individuals with the right to 

6 limit the use and disclosure of protected health in7 formation. 

8 (6) To establish strong and effective mecha9 nisms to protect against the unauthorized and inap10 propriate use of protected health information. 

11 (7) To invoke the sweep of congressional pow12 ers, including the power to enforce the 14th amend13 ment to the Constitution, to regulate commerce, and 

14 to abrogate the immunity of the States under the 

15 11th amendment to the Constitution, in order to ad16 dress violations of the rights of individuals to pri17 vacy, to provide individuals with access to their 

18 health information, and to prevent the unauthorized 

19 use of protected health information that is genetic 

20 information. 

21 (8) To establish strong and effective remedies 

22 for violations of this Act. 

23 (9) To protect the rights of States. 

24 SEC. 3. DEFINITIONS. 

25 In this Act: 


cprice-sewell on PROD1PC62 with BILLS
5 

•S 1814 IS

1 (1) ADMINISTRATIVE BILLING INFORMATION.— 

2 The term ‘‘administrative billing information’’ 

3 means any of the following forms of protected health 

4 information: 

5 (A) Date of service, policy, patient identi6 fiers, and practitioner or facility identifiers. 

7 (B) Diagnostic codes, in accordance with 

8 medicare billing codes, for which treatment is 

9 being rendered or requested. 

10 (C) Complexity of service codes, indicating 

11 duration of treatment. 

12 (D) Total billed charges. 

13 (2) AGENT.—The term ‘‘agent’’ means a person 

14 that represents or acts for another person (a prin15 cipal) under a contract or relationship of agency, or 

16 that functions to bring about, modify, affect, accept 

17 performance of, or terminate, contractual obligations 

18 between the principal and a third person. With re19 spect to an employer, the term includes the employ20 ees of the employer. 

21 (3) AUTHORIZATION.—The term ‘‘authoriza22 tion’’ means the authority granted by an individual 

23 that is the subject of protected health information, 

24 in accordance with title II, for the disclosure of the 

25 individual’s protected health information. 


cprice-sewell on PROD1PC62 with BILLS
6 

•S 1814 IS

1 (4) AUTHORIZED RECIPIENT.—The term ‘‘au2 thorized recipient’’ means a person granted the au3 thority by an individual, in accordance with title II, 

4 to access, maintain, retain, modify, record, store, de5 stroy, or otherwise use the individual’s protected 

6 health information through an authorized disclosure. 

7 (5) BREACH.—The term ‘‘breach’’ means the 

8 unauthorized acquisition, disclosure, or loss of pro9 tected health information which compromises the se10 curity, privacy, or integrity of protected health infor11 mation maintained by or on behalf of a person. 

12 (6) CONFIDENTIALITY.—The term ‘‘confiden13 tiality’’ means the obligations of those who receive 

14 information to respect the privacy interests of those 

15 to whom the data relate. 

16 (7) DATA BROKER.—The term ‘‘data broker’’ 

17 means a data bank, data warehouse, information 

18 clearinghouse, record locator system, or other busi19 ness entity, which for monetary fees, dues, or on a 

20 cooperative nonprofit basis, engages in the practice 

21 of accessing, collecting, maintaining, modifying, stor22 ing, recording, transmitting, destroying, or otherwise 

23 using or disclosing the protected health information 

24 of individuals. Any person maintaining protected 

25 health information for the purposes of making such 


cprice-sewell on PROD1PC62 with BILLS
7 

•S 1814 IS

1 information available to the individual or the health 

2 care provider, including persons furnishing free or 

3 paid personal health records, electronic health 

4 records, electronic medical records, and related prod5 ucts and services, shall be deemed to be a data 

6 broker subject to the requirements of this Act. 

7 (8) DE-IDENTIFIED HEALTH INFORMATION.— 

8 (A) IN GENERAL.—The term ‘‘de-identified 

9 health information’’ means any protected health 

10 information, with respect to which— 

11 (i) all personal identifiers, or other in12 formation that may be used by itself or in 

13 combination with other information which 

14 may be available to re-identify the subject 

15 of the information, have been removed; 

16 (ii) a good faith effort has been made 

17 to evaluate, minimize, and mitigate the 

18 risks of re-identification of the subject of 

19 such information, using commonly accept20 ed scientific and statistical standards and 

21 methods for minimizing risk of disclosure; 

22 and 

23 (iii) there is no reasonable basis to be24 lieve that the information can be used to 

25 identify an individual. 


cprice-sewell on PROD1PC62 with BILLS
8 

•S 1814 IS

1 (B) EXAMPLES.—Such term includes ag2 gregate statistics, redacted health information, 

3 information in which random or fictitious alter4 natives have been substituted for personally 

5 identifiable information, and information in 

6 which personally identifiable information has 

7 been encrypted and the decryption key is main8 tained only by persons otherwise authorized to 

9 have access to such protected health informa10 tion in an identifiable format. 

11 (9) DISCLOSE.—The term ‘‘disclose’’ means to 

12 release, publish, share, transfer, transmit, dissemi13 nate, show, permit access to, communicate (orally or 

14 otherwise), re-identify, or otherwise divulge protected 

15 health information to any person other than the in16 dividual who is the subject of such information. 

17 Such term includes the initial disclosure and any 

18 subsequent redisclosure of protected health informa19 tion. 

20 (10) DECRYPTION KEY.—The term ‘‘decryption 

21 key’’ means the variable information used in or pro22 duced by a mathematical formula, code, or algo23 rithm, or any component thereof, used for 

24 encryption or decryption of wire, electronic, or other 

25 communications or stored information. 


cprice-sewell on PROD1PC62 with BILLS
9 

•S 1814 IS

1 (11) EMPLOYER.—The term ‘‘employer’’ means 

2 a person that is engaged in business affecting com3 merce and that has employees. 

4 (12) ENCRYPTION.—The term ‘‘encryption’’— 

5 (A) means the protection of data in elec6 tronic form, in storage or in transit, using an 

7 encryption technology that has been adopted by 

8 an established standards setting body which 

9 renders such data indecipherable in the absence 

10 of associated cryptographic keys necessary to 

11 enable decryption of such data; and 

12 (B) includes appropriate management and 

13 safeguards of such cryptographic keys so as to 

14 protect the integrity of the encryption. 

15 (13) HEALTH CARE.—The term ‘‘health care’’ 

16 means— 

17 (A) preventive, diagnostic, therapeutic, re18 habilitative, maintenance, or palliative care, in19 cluding appropriate assistance with disease or 

20 symptom management and maintenance, coun21 seling, service, or procedure— 

22 (i) with respect to the physical or 

23 mental condition of an individual; or 

24 (ii) affecting the structure or function 

25 of the human body or any part of the 


cprice-sewell on PROD1PC62 with BILLS
10 

•S 1814 IS

1 human body, including the banking of 

2 blood, sperm, organs, or any other tissue. 

3 (B) any sale or dispensing of a drug, de4 vice, equipment, or other health care-related 

5 item to an individual, or for the use of an indi6 vidual, pursuant to a prescription. 

7 (14) HEALTH CARE PROVIDER.—The term 

8 ‘‘health care provider’’ means a person that, with re9 spect to a specific item of protected health informa10 tion, receives, accesses, maintains, retains, modifies, 

11 records, stores, destroys, or otherwise uses or dis12 closes the information while acting in whole or in 

13 part in the capacity of— 

14 (A) an entity that is, or holds itself out to 

15 be, licensed, certified, registered, or otherwise 

16 authorized by Federal or State law to provide 

17 an item or service that constitutes health care 

18 in the ordinary course of business, or practice 

19 of a profession; 

20 (B) contractors and other health care pro21 viders or facilities authorized to provide items 

22 or services related to diagnosis or treatment of 

23 a health concern, including hospitals, nursing 

24 facilities, allied health professionals, and faciliVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
11 

•S 1814 IS

1 ties used or maintained by allied health profes2 sionals; 

3 (C) a Federal or State program that di4 rectly provides items or services that constitute 

5 health care to beneficiaries; 

6 (D) an officer or employee or agent of a 

7 person described in subparagraph (A) or (C) 

8 who is engaged in the provision of health care 

9 or who uses health information; or 

10 (E) medical personnel in an emergency sit11 uation, including while communicating pro12 tected health information by radio transmission 

13 or other means. 

14 (15) HEALTH OR LIFE INSURER.—The term 

15 ‘‘health or life insurer’’ means a health insurance 

16 issuer (as defined in section 9805(b)(2) of the Inter17 nal Revenue Code of 1986) or a life insurance com18 pany (as defined in section 816 of such Code) and 

19 includes the employees and agents of such a person. 

20 (16) HEALTH OVERSIGHT AGENCY.—The term 

21 ‘‘health oversight agency’’— 

22 (A) means a person that— 

23 (i) performs or oversees the perform24 ance of an assessment, investigation, or 

25 prosecution relating to compliance with 


cprice-sewell on PROD1PC62 with BILLS
12 

•S 1814 IS

1 legal or fiscal standards relating to health 

2 care fraud or fraudulent claims regarding 

3 health care, health services or equipment, 

4 or related activities and items; and 

5 (ii) is a public executive branch agen6 cy, acting on behalf of a public executive 

7 branch agency, acting pursuant to a re8 quirement of a public executive branch 

9 agency, or carrying out activities under a 

10 Federal or State law governing an assess11 ment, evaluation, determination, investiga12 tion, or prosecution described in clause (i); 

13 and 

14 (B) includes the employees and agents of 

15 such a person. 

16 (17) HEALTH PLAN.—The term ‘‘health plan’’ 

17 has the meaning given such term for purposes of the 

18 regulations promulgated under section 264(c) of the 

19 Health Insurance Portability and Accountability Act 

20 of 1996. 

21 (18) HEALTH RECORD SET.—The term ‘‘health 

22 record set’’ means any item, collection, or grouping 

23 of information that includes protected health infor24 mation, such as an electronic health record, elec25 tronic medical record, personal health record, or acVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
13 

•S 1814 IS

1 count of disclosure, use or access, that is created, 

2 accessed, received, maintained, retained, modified, 

3 recorded, stored, destroyed, or otherwise used or dis4 closed by a health care provider, employer, insurer, 

5 health plan, health researcher, school or university, 

6 data broker, or other person. 

7 (19) HEALTH RESEARCHER.—The term ‘‘health 

8 researcher’’ means a person that, with respect to a 

9 specific item of protected health information, re10 ceives the information— 

11 (A) pursuant to section 217 (relating to 

12 health research); or 

13 (B) while acting in whole or in part in the 

14 capacity of an officer, employee, or agent of a 

15 person that receives the information pursuant 

16 to such section. 

17 (20) INFORMED CONSENT.—The term ‘‘in18 formed consent’’ means the authorization for use or 

19 disclosure of protected health information by the in20 dividual who is the subject of such information, con21 ditioned upon that individual’s having been informed 

22 of the nature and probability of harm to the indi23 vidual resulting from such authorization. 

24 (21) LAW ENFORCEMENT INQUIRY.—The term 

25 ‘‘law enforcement inquiry’’ means a lawful executive 


cprice-sewell on PROD1PC62 with BILLS
14 

•S 1814 IS

1 branch investigation or official proceeding inquiring 

2 into a violation of, or failure to comply with, any 

3 criminal or civil statute or any regulation, rule, or 

4 order issued pursuant to such a statute. 

5 (22) OFFICE OF HEALTH INFORMATION PRI6 VACY.—The term ‘‘Office of Health Information Pri7 vacy’’ means the Office of Health Information Pri8 vacy designated under section 301. 

9 (23) PERSON.—The term ‘‘person’’ means an 

10 entity that is a government, governmental subdivi11 sion of an executive branch agency or authority, cor12 poration, company, association, firm, partnership, 

13 society, estate, trust, joint venture, individual, indi14 vidual representative, tribal government, and any 

15 other legal entity. Such term also includes the em16 ployees, contractors, agents, and affiliates of all legal 

17 entities described in the preceding sentence, whether 

18 or not they are acting in the capacity of their em19 ployment, contract, agency, or affiliation. 

20 (24) PRIVACY.—The term ‘‘privacy’’ means an 

21 individual’s right to control the acquisition, uses, or 

22 disclosures of his or her identifiable health data. 

23 (25) PROTECTED HEALTH INFORMATION.— 

24 (A) IN GENERAL.—The term ‘‘protected 

25 health information’’ means any information, inVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
15 

•S 1814 IS

1 cluding genetic information, biometric informa2 tion, demographic information, and tissue sam3 ples collected from an individual, whether oral 

4 or recorded in any form or medium, that— 

5 (i) is created or received by a health 

6 care provider, health researcher, health 

7 plan, health or life insurer, medical or 

8 health savings plan administrator, school 

9 or university, health care clearinghouse, 

10 health oversight agency, public health au11 thority, employer, data broker, or other 

12 person or such person’s agent, officer, or 

13 employee; and 

14 (ii)(I) relates to the past, present, or 

15 future physical or mental health or condi16 tion of an individual (including individual 

17 cells and their components), the provision 

18 of health care to an individual, or the past, 

19 present, or future payment for the provi20 sion of health care to an individual; and 

21 (II)(aa) identifies an individual; or 

22 (bb) with respect to which there is a 

23 reasonable basis to believe that the infor24 mation can be used to identify an indi25 vidual. 


cprice-sewell on PROD1PC62 with BILLS
16 

•S 1814 IS

1 (B) DECRYPTION KEY.—The term ‘‘pro2 tected health information’’ includes any infor3 mation described in paragraph (8). 

4 (26) PUBLIC HEALTH AUTHORITY.—The term 

5 ‘‘public health authority’’ means an authority or in6 strumentality of the United States, a tribal govern7 ment, a State, or a political subdivision of a State 

8 that is— 

9 (A) primarily responsible for public health 

10 matters; and 

11 (B) primarily engaged in activities such as 

12 injury reporting, public health surveillance, and 

13 public health investigation or intervention. 

14 (27) RE-IDENTIFY.—The term ‘‘re-identify’’, 

15 when used with respect to de-identified health infor16 mation, means an attempt, successful or otherwise, 

17 to ascertain— 

18 (A) the identity of the individual who is 

19 the subject of such information; or 

20 (B) the decryption key with respect to the 

21 information (when undertaken with knowledge 

22 that such key would allow for the identification 

23 of the individual who is the subject of such in24 formation). 


cprice-sewell on PROD1PC62 with BILLS
17 

•S 1814 IS

1 (28) SCHOOL OR UNIVERSITY.—The term 

2 ‘‘school or university’’ means an institution or place 

3 for instruction or education, including an elementary 

4 school, secondary school, or institution of higher 

5 education, a college, or an assemblage of colleges 

6 united under one corporate organization or govern7 ment. 

8 (29) SECRETARY.—The term ‘‘Secretary’’ 

9 means the Secretary of Health and Human Services. 

10 (30) SECURITY.—The term ‘‘security’’ means 

11 physical, technological, or administrative safeguards 

12 or tools used to protect identifiable health data from 

13 unwarranted access or disclosure. 

14 (31) SECURITY BREACH.—The term ‘‘security 

15 breach’’ means the physical, structural, or sub16 stantive compromise of the security of protected 

17 health information, through unauthorized disclosure, 

18 use, or access, whether actual or attempted, result19 ing in the acquisition, access, or use of such infor20 mation by an unauthorized person. Such term does 

21 not apply to good faith or accidental acquisition, or 

22 disclosure of protected health information by an un23 authorized person, so long as no further use or dis24 closure is made by such person. 


cprice-sewell on PROD1PC62 with BILLS
18 

•S 1814 IS

1 (32) STATE.—The term ‘‘State’’ includes the 

2 District of Columbia, Puerto Rico, the Virgin Is3 lands, Guam, American Samoa, and the Northern 

4 Mariana Islands. 

5 (33) TO THE MAXIMUM EXTENT PRAC6 TICABLE.—The term ‘‘to the maximum extent prac7 ticable’’ means the level of compliance that a reason8 able person would deem technologically feasible so 

9 long as such feasibility is periodically evaluated in 

10 light of scientific advances. 

11 (34) USE.—The term ‘‘use’’ means to create, 

12 record, collect, access, obtain, store, maintain, 

13 amend, correct, restore, modify, supplement, iden14 tify, re-identify, employ, apply, utilize, examine, ana15 lyze, detect, remove, destroy, dispose of, account for, 

16 or monitor the flow of protected health information. 

17 (35) WRITING.—The term ‘‘writing’’ means 

18 writing in either a paper-based or computer-based 

19 form, including electronic and digital signatures. 

20 TITLE I—INDIVIDUALS’ RIGHTS 

21 Subtitle A—Rights of the Subjects 

22 of Protected Health Information 

23 SEC. 101. RIGHT TO PRIVACY AND SECURITY. 

24 (a) IN GENERAL.—Individuals who are the subject 

25 of protected health information have the right to— 


cprice-sewell on PROD1PC62 with BILLS
19 

•S 1814 IS

1 (1) privacy and security with respect to the use 

2 and disclosure of such information; 

3 (2) control and withhold protected health infor4 mation of which they are the subject; and 

5 (3) exercise nondisclosure and nonuse rights 

6 (referred to in this Act as ‘‘opt-out’’) with respect to 

7 their protected health information, including the 

8 right to opt out of any local, regional, or nationwide 

9 health information network or system that is used 

10 by the person. 

11 (b) OBLIGATIONS.—A person that discloses, uses, or 

12 receives an individual’s protected health information shall 

13 expressly recognize the right to privacy and security of 

14 such individual with respect to the use and disclosure of 

15 such information. 

16 SEC. 102. INSPECTION AND COPYING OF PROTECTED 

17 HEALTH INFORMATION. 

18 (a) RIGHT OF INDIVIDUAL.— 

19 (1) IN GENERAL.—A person, including a health 

20 care provider, health researcher, health plan, health 

21 or life insurer, medical or health savings plan admin22 istrator, school or university, health care clearing23 house, health oversight agency, public health author24 ity, employer, or data broker, or such person’s 

25 agent, officer, employee, or affiliate, that accesses, 


cprice-sewell on PROD1PC62 with BILLS
20 

•S 1814 IS

1 maintains, retains, modifies, records, stores, or oth2 erwise holds, uses, or discloses protected health in3 formation, shall permit an individual who is the sub4 ject of such protected health information, or the in5 dividual’s designee, to inspect and copy the protected 

6 health information concerning the individual, includ7 ing records created under sections 102, 112, 202, 

8 203, and 211. 

9 (2) PROCEDURES AND FEES.—A person de10 scribed in paragraph (1) may establish appropriate 

11 procedures to be followed for inspection and copying 

12 under such paragraph and may require an individual 

13 to pay reasonable fees associated with such inspec14 tion and copying in an amount that is not in excess 

15 of the actual costs of providing such copying. Such 

16 fees may not be assessed where such an assessment 

17 would have the effect of inhibiting an individual 

18 from gaining access to the information described in 

19 paragraph (1). 

20 (b) DEADLINE.—A person described in subsection 

21 (a)(1) shall comply with a request for inspection or copy22 ing of protected health information under this section not 

23 later than— 

24 (1) 15 business days after the date on which 

25 the person receives the request, if such request reVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
21 

•S 1814 IS

1 quires the inspection, copying, or sending of printed 

2 materials; or 

3 (2) 5 business days after the date on which the 

4 person receives the request, or sooner if the Sec5 retary determines appropriate, if such request re6 quires only the inspection, copying, or sending of 

7 electronic or other digital materials. 

8 (c) RULES GOVERNING AGENTS.—A person that is 

9 the agent, officer, or employee of a person described in 

10 subsection (a) shall provide for the inspection and copying 

11 of protected health information if— 

12 (1) the protected health information is retained 

13 by the person; and 

14 (2) the person has been asked by the person de15 scribed in subsection (a)(1) to fulfill the require16 ments of this section. 

17 (d) SPECIAL RULE RELATING TO ONGOING CLINICAL

18 TRIALS.—With respect to protected health information 

19 that is created as part of an individual’s participation in 

20 an ongoing clinical trial, access to the information shall 

21 be provided consistent with the individual’s agreement to 

22 participate in the clinical trial. 


cprice-sewell on PROD1PC62 with BILLS
22 

•S 1814 IS

1 SEC. 103. MODIFICATIONS TO PROTECTED HEALTH INFOR2 MATION. 

3 (a) IN GENERAL.—Not later than 15 business days, 

4 or earlier if the Secretary determines appropriate, after 

5 the date on which a person described in section 102(a)(1) 

6 receives from an individual a request in writing to supple7 ment, correct, amend, segregate, or remove protected 

8 health information concerning the individual, such per9 son— 

10 (1) shall, subject to subsections (b) and (c), 

11 modify the information, by adding the requested 

12 supplement, correction, or amendment to the infor13 mation, or by removing any information that has 

14 been requested to be destroyed; 

15 (2) shall inform the individual that the modi16 fication has been made; and 

17 (3) shall make reasonable efforts to inform any 

18 person to which the portion of the unmodified infor19 mation was previously disclosed, of any substantive 

20 modification that has been made. 

21 (b) REFUSAL TO MODIFY.—If a person described in 

22 subsection (a) declines to make the modification requested 

23 under such subsection within 15 business days after re24 ceipt of such request, such person shall inform the indi25 vidual in writing of— 


cprice-sewell on PROD1PC62 with BILLS
23 

•S 1814 IS

1 (1) the reasons for declining to make the modi2 fication; 

3 (2) any procedures for further review of the de4 clining of such modification; and 

5 (3) the individual’s right to file with the person 

6 a concise statement setting forth the requested 

7 modification and the individual’s reasons for dis8 agreeing with the declining person and the individ9 ual’s right to include a copy of this refusal in the 

10 health record set concerning the individual. 

11 (c) STATEMENT OF DISAGREEMENT.—If an indi12 vidual has filed with a person a statement of disagreement 

13 under subsection (b)(3), the person, in any subsequent dis14 closure of the disputed portion of the information— 

15 (1) shall include, at the individual’s request, a 

16 copy of the individual’s statement in the individual’s 

17 health record set; and 

18 (2) may include a concise statement of the rea19 sons for not making the requested modification. 

20 (d) RULES GOVERNING AGENTS.—A person that is 

21 the agent of a person described in subsection (a) shall only 

22 be required to make a modification to protected health in23 formation where— 

24 (1) the protected health information is retained, 

25 distributed, used, or maintained by the agent; and 


cprice-sewell on PROD1PC62 with BILLS
24 

•S 1814 IS

1 (2) the agent has been asked by such person to 

2 fulfill the requirements of this section. 

3 (e) NOTIFICATION OF LOSS OR CORRUPTION.—Not 

4 later than 15 business days, or earlier if the Secretary de5 termines appropriate, after the date on which a person de6 scribed in subsection (a) discovers loss or corruption of 

7 health record sets or protected health information under 

8 its management, or if such person has reason to believe 

9 that its database has been compromised, such person 

10 shall— 

11 (1) notify individuals whose records have been 

12 affected; 

13 (2) notify persons and the agents of persons 

14 that receive, access, maintain, retain, modify, record, 

15 store, destroy, or otherwise use or disclose such 

16 data; and 

17 (3) repair or restore corrupted data to the ex18 tent practicable. 

19 SEC. 104. NOTICE OF PRIVACY PRACTICES. 

20 (a) PREPARATION OF WRITTEN NOTICE.—A person 

21 described in section 102(a)(1) shall prepare a written no22 tice of the privacy practices of such person, including in23 formation with respect to the following: 

24 (1) The express right of an individual to pri25 vacy, security, and confidentiality with respect to the 


cprice-sewell on PROD1PC62 with BILLS
25 

•S 1814 IS

1 electronic disclosure of such individual’s protected 

2 health information; 

3 (2) The procedures for an individual to author4 ize disclosures of protected health information, and 

5 to object to, modify, and revoke such authorizations. 

6 (3) The right of an individual to inspect, copy, 

7 and modify that individual’s protected health infor8 mation. 

9 (4) The right of an individual not to have em10 ployment or the receipt of services or choice of 

11 health plan conditioned upon the execution by the 

12 individual of an authorization for disclosure. 

13 (5) A description of the categories or types of 

14 employees, by general category or by general job de15 scription, who have access to or use of protected 

16 health information regarding the individual. 

17 (6) A simple, concise description of any infor18 mation systems used to store or transmit protected 

19 health information, including a description of any 

20 linkages made with other networks, systems, or 

21 databases outside the person’s direct control. 

22 (7) The right of and procedures for an indi23 vidual to request segregation of protected health in24 formation, and to restrict the use of such informaVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
26 

•S 1814 IS

1 tion by employees, agents, and contractors of a per2 son. 

3 (8) The circumstances under which the infor4 mation will be, lawfully and actually, used or dis5 closed without an authorization executed by the indi6 vidual. 

7 (9) A statement that, if an individual elects to 

8 pay for health care from the individual’s own funds, 

9 that individual may elect for identifying information 

10 not to be disclosed to anyone other than designated 

11 health care providers, unless such disclosure is re12 quired by mandatory reporting requirements or 

13 other similar information collection duties required 

14 by law. 

15 (10) The right of the individual to have contin16 ued maintenance, distribution, or storage of that in17 dividual’s personal health information not condi18 tioned upon whether that individual amends or re19 vokes an authorization for disclosure, or requests a 

20 modification of protected health information. 

21 (11) The right of and procedures for an indi22 vidual to request that protected health information 

23 be transferred to a third party person without un24 reasonable delay. 


cprice-sewell on PROD1PC62 with BILLS
27 

•S 1814 IS

1 (12) The right to prompt notification of an ac2 tual or suspected security breach of protected health 

3 information, and how such breaches will be remedied 

4 by the person. 

5 (13) The right of an individual to inspect and 

6 obtain a copy of records of authorized and unauthor7 ized disclosures as well as attempted and actual ac8 cess and use by an authorized or unauthorized per9 son. 

10 (14) The right of an individual to exercise non11 disclosure and nonuse rights (referred to in this Act 

12 as ‘‘opt-out’’) with respect to their protected health 

13 information, including the right to opt out of any 

14 local, regional, or nationwide health information net15 work or system that is used by the person. 

16 (b) PROVISION AND POSTING OF WRITTEN NO17 TICE.— 

18 (1) PROVISION.—A person described in sub19 section (a) shall provide a copy of the written notice 

20 of privacy practices required under such sub21 section— 

22 (A) at the time an authorization is sought 

23 for the disclosure of protected health informa24 tion; and 

25 (B) upon the request of an individual. 


cprice-sewell on PROD1PC62 with BILLS
28 

•S 1814 IS

1 (2) POSTING.—A person described in subsection 

2 (a) shall post, in a clear and conspicuous manner, a 

3 brief summary of the privacy practices of the person. 

4 (c) MODEL NOTICE.—The Secretary, in consultation 

5 with the Director of the Office of Health Information Pri6 vacy appointed under section 301, after notice and oppor7 tunity for public comment, shall develop and disseminate 

8 model notices of privacy practices, and model summary 

9 notices for posting for use under this section. Use of such 

10 model notice shall be deemed to satisfy the requirements 

11 of this section. 

12 (d) REQUIREMENT FOR OPT-OUT.—A person shall 

13 not access, maintain, retain, modify, record, store, destroy, 

14 or otherwise use or disclose an individual’s protected 

15 health information for other than treatment or payment 

16 purposes until that individual has been given an oppor17 tunity, before the time that such information is initially 

18 used or disclosed, to direct that such information not be 

19 used or disclosed. The individual must be given adequate 

20 time to exercise the nondisclosure and nonuse option (re21 ferred to as the ‘‘opt-out’’) through the method that is 

22 most convenient to the individual, along with an expla23 nation of how the individual can exercise such option. 


cprice-sewell on PROD1PC62 with BILLS
29 

•S 1814 IS

1 SEC. 105. DEMONSTRATION GRANT. 

2 (a) IN GENERAL.—The Secretary shall award con3 tracts or competitive grants to eligible entities to support 

4 demonstration projects that are designed to improve the 

5 communication of information pertaining to health privacy 

6 rights with individuals with limited English language pro7 ficiency and limited health literacy. 

8 (b) PURPOSE.—It is the purpose of this section, to 

9 promote the cultural competency of persons that access, 

10 maintain, retain, modify, record, store, destroy, or other11 wise use or disclose protected health information, and to 

12 enable such persons to better communicate privacy proce13 dures to non-English speakers, those with limited English 

14 proficiency, and those with limited health literacy. 

15 (c) ELIGIBLE ENTITIES.—In this section, the term 

16 ‘‘eligible entity’’ means an organization or community17 based consortium that includes— 

18 (1) individuals who are representatives of orga19 nizations serving or advocating for ethnic and racial 

20 minorities, low income immigrant populations, and 

21 others with limited English language proficiency and 

22 limited health literacy; 

23 (2) health care providers that provide care for 

24 ethnic and racial minorities, low income immigrant 

25 populations, and others with limited English lan26 guage proficiency and limited health literacy; 


cprice-sewell on PROD1PC62 with BILLS
30 

•S 1814 IS

1 (3) community leaders and leaders of commu2 nity-based organizations; and 

3 (4) experts and researchers in the areas of so4 cial and behavioral sciences, who have knowledge, 

5 training, or practical experience in health policy, ad6 vocacy, cultural and linguistic competency, or other 

7 relevant areas as determined by the Secretary. 

8 (d) APPLICATION.—An eligible entity seeking a con9 tract or grant under this section shall submit an applica10 tion to the Secretary at such time, in such manner, and 

11 containing such information as the Secretary may require. 

12 (e) USE OF FUNDS.—An eligible entity shall use 

13 amounts received under this section to carry out programs 

14 and studies designed to help identify best practices in the 

15 communication of privacy rights and procedures to ensure 

16 comprehension by individuals with limited English pro17 ficiency and limited health literacy. 

18 Subtitle B—Establishment of 

19 Safeguards 

20 SEC. 111. ESTABLISHMENT OF SAFEGUARDS. 

21 (a) IN GENERAL.—A person described in section 

22 102(a)(1) shall establish and maintain appropriate admin23 istrative, organizational, technical, and physical safe24 guards and procedures to ensure the privacy, confiden25 tiality, security, accuracy, and integrity of protected health 


cprice-sewell on PROD1PC62 with BILLS
31 

•S 1814 IS

1 information that is accessed, maintained, retained, modi2 fied, recorded, stored, destroyed, or otherwise used or dis3 closed by such person. 

4 (b) FACTORS TO BE CONSIDERED.—The policies and 

5 safeguards established under subsection (a) shall ensure 

6 that— 

7 (1) protected health information is used or dis8 closed only with informed consent; 

9 (2) the categories of personnel who will have ac10 cess to protected health information are identified; 

11 (3) the feasibility of limiting access to protected 

12 health information is considered; 

13 (4) the privacy, security and confidentiality of 

14 protected health information is maintained; 

15 (5) protected health information is protected 

16 against any anticipated vulnerabilities to the privacy, 

17 security, or integrity of such information; and 

18 (6) protected health information is protected 

19 against unauthorized access, use, or misuse of such 

20 information. 

21 (c) MODEL GUIDELINES.—The Secretary, in con22 sultation with the Director of the Office of Health Infor23 mation Privacy appointed under section 301, after notice 

24 and opportunity for public comment, shall develop and dis25 seminate model guidelines for the establishment of safeVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
32 

•S 1814 IS

1 guards and procedures for use under this section, such 

2 as, where appropriate, individual authentication of uses of 

3 computer systems, access controls, audit trails, encryption, 

4 physical security, protection of remote access points and 

5 protection of external electronic communications, periodic 

6 security assessments, incident reports, and sanctions. The 

7 Director shall update and disseminate the guidelines, as 

8 appropriate, to take advantage of new technologies. 

9 (d) REVIEW AND UPDATING OF SAFEGUARDS.—Per10 sons subject to this Act shall monitor, evaluate, and ad11 just, as appropriate, all safeguards and procedures, con12 comitant with relevant changes in technology, the sensi13 tivity of personally identifiable information, internal or ex14 ternal threats to personally identifiable information, and 

15 any changes in the contracts or business of the person. 

16 For the purpose of reviewing and updating safeguards, the 

17 Secretary may provide technical assistance to persons de18 scribed in subsection (a), as appropriate. 

19 SEC. 112. TRANSPARENCY. 

20 (a) PUBLIC LIST OF DATA BROKERS.—A person de21 scribed in section 102(a)(1) shall establish a list of data 

22 brokers with which such person has entered into a con23 tract or relationship for the purposes of providing services 

24 involving any protected health information. Such list and 


cprice-sewell on PROD1PC62 with BILLS
33 

•S 1814 IS

1 the contact information for each broker shall be made pub2 licly accessible on the Internet. 

3 (b) SUBCONTRACTING AND OUTSOURCING OVER4 SEAS.—In the event a person subject to this Act contracts 

5 with service providers not subject to this Act, including 

6 service providers operating in a foreign country, such per7 son shall— 

8 (1) take reasonable steps to select and retain 

9 third party service providers capable of maintaining 

10 appropriate safeguards for the security, privacy, and 

11 integrity of protected health information; 

12 (2) require by contract that such service pro13 viders implement and maintain appropriate meas14 ures designed to meet the requirements of persons 

15 subject to this Act; 

16 (3) be held liable for any violation of this Act 

17 by an overseas service provider or other provider not 

18 subject to this law; and 

19 (4) in the case of a service provider operating 

20 in a foreign country, obtain the informed consent of 

21 the individual involved prior to outsourcing such in22 dividual’s protected health information to such pro23 vider. 

24 (c) LIST OF PERSONS.—The Secretary shall maintain 

25 a public list identifying persons described in section 


cprice-sewell on PROD1PC62 with BILLS
34 

•S 1814 IS

1 102(a)(1) that have lost, stolen, disclosed or used in an 

2 unauthorized manner or for an unauthorized purpose the 

3 protected health information of a significant number of 

4 individuals. The list shall include how many individuals 

5 were affected by such action. 

6 SEC. 113. RISK MANAGEMENT. 

7 (a) IN GENERAL.—Persons described in section 

8 102(a)(1) that have access to protected health information 

9 shall establish risk management and control processes to 

10 protect against anticipated vulnerabilities to the privacy, 

11 security, and integrity of protected health information. 

12 (b) RISK ASSESSMENT.—A person described in sub13 section (a) shall perform annual risk assessments of proce14 dures, systems, or networks involved in the creation, ac15 cessing, maintenance, retention, modification, recording, 

16 storage, distribution, destruction, or other use or disclo17 sure of personal health information. Such risk assessment 

18 may include— 

19 (1) identifying reasonably foreseeable internal 

20 and external vulnerabilities that could result in inac21 curacy or in unauthorized access, disclosure, use, or 

22 modification of protected health information, or of 

23 systems containing protected health information; 

24 (2) assessing the likelihood of and potential 

25 damage from inaccuracy or from unauthorized acVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
35 

•S 1814 IS

1 cess, disclosure, use, or modification of protected 

2 health information; 

3 (3) assessing the sufficiency of policies, tech4 nologies, and safeguards in place to minimize and 

5 control risks from unauthorized access, disclosure, 

6 use, or modification of protected health information; 

7 and 

8 (4) assessing the vulnerability of protected 

9 health information during destruction and disposal 

10 of such information, including through the disposal 

11 or retirement of hardware. 

12 (c) RISK MANAGEMENT.—A person described in sub13 section (a) shall establish risk management and control 

14 procedures designed to control risks such as those identi15 fied in subsection (b). Such procedures shall include— 

16 (1) a means for the detection and recording of 

17 actual or attempted, unauthorized, fraudulent, or 

18 otherwise unlawful access, disclosure, transmission, 

19 modification, use, or loss of personal health informa20 tion; 

21 (2) procedures for ensuring the secure disposal 

22 of personal health information; 

23 (3) a means for limiting physical access to 

24 hardware, software, data storage technology, servers, 

25 systems, or networks by unauthorized persons in 


cprice-sewell on PROD1PC62 with BILLS
36 

•S 1814 IS

1 order to minimize the risk of information disclosure, 

2 modification, transmission, access, use, or loss; 

3 (4) providing appropriate risk management and 

4 control training for employees; and 

5 (5) carrying out annual testing of such risk 

6 management and control procedures. 

7 SEC. 114. ACCOUNTING FOR DISCLOSURES AND USE. 

8 (a) IN GENERAL.—A person described in section 

9 102(a)(1) shall establish and maintain, with respect to any 

10 protected health information disclosure, a record of each 

11 disclosure in accordance with regulations promulgated by 

12 the Secretary in consultation with the Director of the Of13 fice of Health Information Privacy. Such record shall in14 clude the purpose of any disclosure and the identity of 

15 the specific individual executing the disclosure, as well as 

16 the person to which such information is disclosed. 

17 (b) MAINTENANCE OF RECORD.—A record estab18 lished under subsection (a) shall be maintained for not less 

19 than 7 years. 

20 (c) ELECTRONIC RECORDS.—A person described in 

21 subsection (a) shall, to the maximum extent practicable, 

22 maintain an accessible electronic record concerning each 

23 access, use, or disclosure, whether authorized or unauthor24 ized and whether successful or unsuccessful, of protected 

25 health information maintained by such person in electronic 


cprice-sewell on PROD1PC62 with BILLS
37 

•S 1814 IS

1 form. The record shall include the identities of the specific 

2 individuals (or a way to identify such individuals, or infor3 mation helpful in determining the identities of such indi4 viduals) who access or seek to gain access to, use or seek 

5 to use, or disclose or seek to disclose, information suffi6 cient to identify the protected health information sought 

7 or accessed, and other appropriate information. 

8 (d) ACCESS TO RECORDS.—A person described in 

9 subsection (a) shall permit an individual who is the subject 

10 of protected health information, or the individual’s des11 ignee, to inspect and copy the records created in para12 graphs (a) and (c) of this section. 

13 TITLE II—RESTRICTIONS ON 

14 USE AND DISCLOSURE 

15 Subtitle A—General Restrictions 

16 on Use and Disclosure 

17 SEC. 201. GENERAL RULES REGARDING USE AND DISCLO18 SURE. 

19 (a) PROHIBITION.— 

20 (1) GENERAL RULE.—A person may not dis21 close, access, or use protected health information ex22 cept as authorized under this Act. 

23 (2) RULE OF CONSTRUCTION.—Disclosure or 

24 use of health information that meets the standards 

25 of being de-identified health information shall not be 


cprice-sewell on PROD1PC62 with BILLS
38 

•S 1814 IS

1 construed as a disclosure or use of protected health 

2 information. 

3 (b) SCOPE OF DISCLOSURE OR USE.— 

4 (1) IN GENERAL.—A disclosure or use of pro5 tected health information under this title shall be 

6 limited to the minimum amount of information nec7 essary to accomplish the purpose for which the dis8 closure or use is made. 

9 (2) DETERMINATION.—The determination as to 

10 what constitutes the minimum disclosure or use pos11 sible for purposes of paragraph (1) shall be made by 

12 a health care provider to the extent required by law. 

13 The minimum necessary standard is intended to be 

14 consistent with, and not override, professional judg15 ment and standards. 

16 (c) USE OR DISCLOSURE FOR PURPOSE ONLY.—An 

17 authorized recipient of information pursuant to this title 

18 may use or disclose such information solely to carry out 

19 the purpose for which the information was disclosed, ex20 cept as provided in section 214. 

21 (d) NO GENERAL REQUIREMENT TO DISCLOSE.— 

22 Nothing in this title permitting the disclosure of protected 

23 health information shall be construed to require such dis24 closure. 


cprice-sewell on PROD1PC62 with BILLS
39 

•S 1814 IS

1 (e) IDENTIFICATION OF DISCLOSED INFORMATION AS

2 PROTECTED HEALTH INFORMATION.—Protected health 

3 information disclosed or used pursuant to this title shall 

4 be clearly identified and labeled as protected health infor5 mation that is subject to this Act. 

6 (f) DISCLOSURE OR USE BY AGENTS.—An agent, 

7 employee, or affiliate of a person described in section 

8 102(a)(1) that accesses, seeks to access, obtains, discloses, 

9 uses, or receives protected health information from such 

10 person, shall be subject to this title to the same extent 

11 as the person. 

12 (g) DISCLOSURE OR USE BY OTHERS.—A person re13 ceiving protected health information initially held by a per14 son described in subsection (f) shall be subject to this title 

15 to the same extent as the person described in subsection 

16 (f). 

17 (h) CREATION OF DE-IDENTIFIED INFORMATION.— 

18 Notwithstanding subsection (c), but subject to the other 

19 provisions of this section, a person described in subsection 

20 (f) may disclose protected health information to an em21 ployee or other agent of the person for purposes of cre22 ating de-identified information. 

23 (i) UNAUTHORIZED USE OR DISCLOSURE OF THE

24 DECRYPTION KEY.—The unauthorized disclosure of a 

25 decryption key or other secondary or tertiary means for 


cprice-sewell on PROD1PC62 with BILLS
40 

•S 1814 IS

1 accessing protected health information shall be deemed to 

2 be a disclosure of protected health information. The unau3 thorized use of a decryption key (or other secondary or 

4 tertiary means for accessing protected health information) 

5 or de-identified health information in order to identify an 

6 individual is deemed to be disclosure of protected health 

7 information. 

8 (j) NO WAIVER.—Except as provided in this Act, an 

9 authorization to disclose or use personally identifiable 

10 health information executed by an individual pursuant to 

11 section 202 or 203 shall not be construed as a waiver of 

12 any rights that the individual has under other Federal or 

13 State laws, the rules of evidence, or common law. 

14 (k) OPT-OUT.—A person may not disclose, access, or 

15 use an individual’s protected health information until that 

16 individual has been given the opportunity to opt out of 

17 any local, regional, or nationwide health information net18 work or system that is used by the person. 

19 (l) DISPOSAL OF DATA.—To prevent the unauthor20 ized disclosure or use of protected health information, 

21 such information, when disposed of, shall be fully de-iden22 tified, destroyed, and expunged from any electronic, paper, 

23 or other files and documents maintained by authorized 

24 persons. 


cprice-sewell on PROD1PC62 with BILLS
41 

•S 1814 IS

1 (m) OBLIGATIONS OF UNAUTHORIZED RECIPI2 ENTS.—A person that obtains, accesses, or receives pro3 tected health information and that is an unauthorized re4 cipient of such information may not access, maintain, re5 tain, modify, record, store, destroy, or otherwise use or 

6 disclose such information for any purposes, and use or dis7 closure of protected health information under such cir8 cumstances shall be deemed an unauthorized disclosure of 

9 protected health information. 

10 (n) DEFINITIONS.—In this title: 

11 (1) INVESTIGATIVE OR LAW ENFORCEMENT OF12 FICER.—The term ‘‘investigative or law enforcement 

13 officer’’ means any officer of the United States or of 

14 a State or political subdivision thereof, who is em15 powered by law to conduct investigations of, or to 

16 make arrests for, civil or criminal offenses, and any 

17 attorney authorized by law to prosecute or partici18 pate in the prosecution of such offenses. 

19 (2) SEGREGATE.—The term ‘‘segregate’’ means 

20 to hide, mask, or mark separate a designated subset 

21 of an individual’s protected health information, or to 

22 place such a subset in a location that is securely sep23 arated from the location used to store other pro24 tected health information, such that access to or use 

25 of any information so segregated may be effectively 


cprice-sewell on PROD1PC62 with BILLS
42 

•S 1814 IS

1 limited to those persons that are authorized by the 

2 individual to access or use that segregated informa3 tion. 

4 (3) SIGNED.—The term ‘‘signed’’ refers to both 

5 signatures in ink and electronic signatures, and the 

6 term ‘‘written’’ refers to both paper and computer7 ized formats. 

8 SEC. 202. INFORMED CONSENT FOR DISCLOSURE OF PRO9 TECTED HEALTH INFORMATION FOR TREAT10 MENT AND PAYMENT. 

11 (a) REQUIREMENTS RELATING TO EMPLOYERS, 

12 HEALTH PLANS, HEALTH OR LIFE INSURERS, UNIN13 SURED AND SELF-PAY INDIVIDUALS, AND PROVIDERS.— 

14 (1) IN GENERAL.—To satisfy the requirement 

15 under section 201(b)(1), an employer, health plan, 

16 health or life insurer, or health care provider that 

17 seeks to disclose protected health information in con18 nection with treatment or payment shall obtain an 

19 authorization from the subject of such protected 

20 health information that satisfies the requirements of 

21 this section. A single authorization may authorize 

22 multiple disclosures. 

23 (2) EMPLOYERS.—Every employer offering a 

24 health plan to its employees shall, at the time of an 

25 employee’s enrollment in the health plan, obtain a 


cprice-sewell on PROD1PC62 with BILLS
43 

•S 1814 IS

1 signed, written authorization that is an authoriza2 tion based on informed consent that satisfies the re3 quirements of subsection (b) concerning the use and 

4 disclosure of protected health information for treat5 ment or payment with respect to each individual who 

6 is eligible to receive care under the health plan. 

7 (3) HEALTH PLANS, HEALTH OR LIFE INSUR8 ERS.—Every health plan or health or life insurer of9 fering enrollment to individual or nonemployer 

10 groups shall, at the time of enrollment in the plan 

11 or insurance, obtain a signed, written authorization 

12 that is a legal, informed authorization that satisfies 

13 the requirements of subsection (b) concerning the 

14 use and disclosure of protected health information 

15 with respect to each individual who is eligible to re16 ceive care or benefits under the plan or insurance. 

17 (4) UNINSURED AND SELF-PAY.—An origi18 nating provider that provides health care in other 

19 than a network plan setting, or provides health care 

20 to an uninsured individual, shall obtain a signed, 

21 written authorization that satisfies the requirements 

22 of subsection (b) to access or use protected health 

23 information in providing health care or arranging for 

24 health care from other providers or seeking payment 

25 for the provision of health care services. 


cprice-sewell on PROD1PC62 with BILLS
44 

•S 1814 IS

1 (5) PROVIDERS.— 

2 (A) IN GENERAL.—Every health care pro3 vider that provides health care to an individual 

4 that has not been given the appropriate prior 

5 authorization under this section, shall at the 

6 time of providing such care obtain a signed, 

7 written authorization that is a legal, informed 

8 authorization, that satisfies the requirements of 

9 subsection (b), concerning the use and disclo10 sure of protected health information with re11 spect to such individual. 

12 (B) RULE OF CONSTRUCTION.—Subpara13 graph (A) shall not be construed to preclude 

14 the provision of health care to an individual 

15 who has not given appropriate authorization 

16 prior to receipt of such care if— 

17 (i) the health care provider involved 

18 determines that such care is essential; and 

19 (ii) the individual can reasonably be 

20 expected to sign an authorization for such 

21 care when appropriate. 

22 (b) REQUIREMENTS FOR INDIVIDUAL INFORMED

23 CONSENT.—To satisfy the requirements of this sub24 section, an authorization from an individual to disclose the 

25 individual’s protected health information shall— 


cprice-sewell on PROD1PC62 with BILLS
45 

•S 1814 IS

1 (1) identify, by general job description or other 

2 functional description and by geographic location, 

3 those persons that are authorized to disclose the in4 formation, including entities employed by, or oper5 ating within, a person authorized to disclose the in6 formation; 

7 (2) describe the nature of the information to be 

8 disclosed; 

9 (3) identify, by general job description or other 

10 functional description and by geographic location, 

11 those persons to which the information will be dis12 closed, including entities employed by, or operating 

13 within, a person to which information is authorized 

14 to be disclosed; 

15 (4) describe the purpose of the disclosures; 

16 (5) permit the executing individual to indicate 

17 that a particular person or class of persons (a group 

18 of persons with similar roles or functions) listed on 

19 the authorization is not authorized to receive pro20 tected health information concerning the individual, 

21 except as provided for in subsection (c)(3); 

22 (6) provide the means by which an individual 

23 may indicate that some of the individual’s protected 

24 health information should be segregated and to what 


cprice-sewell on PROD1PC62 with BILLS
46 

•S 1814 IS

1 persons or classes of persons such segregated infor2 mation may be disclosed; 

3 (7) be subject to revocation by the individual 

4 and indicate that the authorization is valid until rev5 ocation by the individual or until an event or date 

6 specified; 

7 (8)(A) be— 

8 (i) in writing, dated, and signed by the in9 dividual; or 

10 (ii) in electronic form, dated and authenti11 cated by the individual using an authentication 

12 method approved by the Secretary; and 

13 (B) not have been revoked under subparagraph 

14 (A); 

15 (9) describe the procedure by which an indi16 vidual can amend an authorization previously ob17 tained by a person; 

18 (10) include a concise description of any sys19 tems or services used for access, maintenance, reten20 tion, modification, recording, storage, destruction, or 

21 other use of protected health information by the au22 thorized person, including— 

23 (A) a description of any linkages made 

24 with other systems, databases, networks, or 

25 services external to the authorized person; and 


cprice-sewell on PROD1PC62 with BILLS
47 

•S 1814 IS

1 (B) how the linkages made with other sys2 tems, databases, networks, or services external 

3 to the authorized person meet the privacy and 

4 security standards of the authorized person; 

5 (11) describe the extent to which the authorized 

6 person will share information with sub-contracted 

7 persons, and the geographic location of sub-con8 tracted persons, including those operating or located 

9 overseas, except that the authorized person shall ob10 tain the informed consent of the individual involved 

11 prior to outsourcing such individual’s protected 

12 health information to a sub-contracted person oper13 ating or located overseas; and 

14 (12) describe the nature and probability of 

15 harm to the individual resulting from authorization 

16 for use or disclosure, consistent with the principle of 

17 informed consent. 

18 (c) LIMITATION ON AUTHORIZATIONS.— 

19 (1) IN GENERAL.—Subject to paragraphs (2) 

20 and (3), a person described in section 102(a)(1) that 

21 seeks an authorization under this title may not con22 dition the delivery of treatment or payment for serv23 ices on the receipt of such an authorization. 

24 (2) RIGHT TO REQUIRE SELF-PAYMENT.—If an 

25 individual has refused to provide an authorization 


cprice-sewell on PROD1PC62 with BILLS
48 

•S 1814 IS

1 for disclosure of administrative billing information to 

2 a person and such authorization is necessary for a 

3 health care provider to receive payment for services 

4 delivered, the health care provider may require the 

5 individual to pay from their own funds for the serv6 ices. 

7 (3) RIGHT OF HEALTH CARE PROVIDER TO RE8 QUIRE AUTHORIZATION FOR TREATMENT PUR9 POSES.—If a health care provider that is seeking an 

10 authorization for disclosure of an individual’s pro11 tected health information believes that the disclosure 

12 of such information is necessary so as not to endan13 ger the health or treatment of the individual, and if 

14 the withholding of services will not endanger the life 

15 of the individual, the health care provider may con16 dition the provision of services upon the individual’s 

17 execution of an authorization to disclose personal 

18 health information to the minimum extent necessary. 

19 (4) AUTHORIZATIONS FOR PAYMENT UNDER

20 CERTAIN CIRCUMSTANCES.—If an individual is in a 

21 physical or mental condition such that the individual 

22 is not capable of authorizing the disclosure of pro23 tected health information and no other arrange24 ments have been made to pay for the health care 

25 services being rendered to the patient, such informaVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00048 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
49 

•S 1814 IS

1 tion may be disclosed to a governmental authority to 

2 the extent necessary to determine the individual’s 

3 eligibility for, and to obtain, payment under a gov4 ernmental program for health care services provided 

5 to the patient. The information may also be dis6 closed to another provider of health care or health 

7 care service plan as necessary to assist the other 

8 provider or health care service plan in obtaining pay9 ment for health care services rendered by that pro10 vider of health care or health care service plan to the 

11 patient. 

12 (d) MODEL AUTHORIZATIONS.—The Secretary, in 

13 consultation with the Director of the Office of Health In14 formation Privacy, after notice and opportunity for public 

15 comment, shall develop and disseminate model written au16 thorizations of the type described in this section and model 

17 statements of the limitations on authorizations. Any au18 thorization obtained on a model authorization form under 

19 section 202 developed by the Secretary pursuant to the 

20 preceding sentence shall be deemed to satisfy the require21 ments of this section. 

22 (e) SEGREGATION OF FILES.—A person described in 

23 section 102(a)(1) shall comply with the request of an indi24 vidual who is the subject of protected health information— 


cprice-sewell on PROD1PC62 with BILLS
50 

•S 1814 IS

1 (1) to hide, mask, or mark separate any type or 

2 amount of protected health information held by the 

3 person; and 

4 (2) to limit the use or disclosure of the seg5 regated health information within the person to 

6 those specifically designated by the subject of the 

7 protected health information. 

8 (f) REVOCATION OF AUTHORIZATION.— 

9 (1) IN GENERAL.—An individual may, electroni10 cally or in writing, revoke or amend an authorization 

11 under this section at any time, unless the disclosure 

12 that is the subject of the authorization is required 

13 to effectuate payment for health care that has been 

14 provided to the individual and for which the indi15 vidual has declined or refused to pay from the indi16 vidual’s own funds. 

17 (2) HEALTH PLANS.—With respect to a health 

18 plan, the authorization of an individual is deemed to 

19 be revoked at the time of the cancellation or non-re20 newal of enrollment in the health plan, except as 

21 may be necessary to complete plan administration 

22 and payment requirements related to the individual’s 

23 period of enrollment. 


cprice-sewell on PROD1PC62 with BILLS
51 

•S 1814 IS

1 (3) ACTIONS.—An individual may not maintain 

2 an action against a person for disclosure of person3 ally identifiable health information— 

4 (A) if the disclosure was made based on a 

5 good faith reliance on the individual’s author6 ization under this section at the time such dis7 closure was made; 

8 (B) in a case in which the authorization is 

9 revoked, if the disclosing person had no actual 

10 or constructive notice of the revocation; or 

11 (C) if the disclosure was for the purpose of 

12 protecting another individual from imminent 

13 physical harm, and is authorized under section 

14 204. 

15 (g) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND

16 REVOCATIONS.—Each person accessing, maintaining, re17 taining, modifying, recording, storing, destroying, or oth18 erwise using personally identifiable or protected health in19 formation shall maintain a record for a period of 7 years 

20 of each authorization by an individual and any revocation 

21 thereof, and such record shall become part of the individ22 ual’s health record set. 

23 (h) RULE OF CONSTRUCTION.—Authorizations for 

24 the disclosure of protected health information for treat25 ment or payment shall not authorize the disclosure of such 


cprice-sewell on PROD1PC62 with BILLS
52 

•S 1814 IS

1 information where the intent is to sell, market, transfer, 

2 or use the protected health information for a commercial 

3 advantage other than for the revenues directly derived 

4 from the provision of health care to that individual. With 

5 respect to such a disclosure for a use other than for treat6 ment or payment, a separate authorization that satisfies 

7 the requirements of section 203 is required. 

8 SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO9 TECTED HEALTH INFORMATION OTHER THAN 

10 FOR TREATMENT OR PAYMENT. 

11 (a) IN GENERAL.—To satisfy the requirement under 

12 section 201(b)(1), a health care provider, health plan, 

13 health oversight agency, public health authority, employer, 

14 health researcher, law enforcement official, health or life 

15 insurer, school or university, or other person described 

16 under section 102(a)(1) that seeks to disclose protected 

17 health information for a purpose other than treatment or 

18 payment shall obtain an authorization that satisfies the 

19 requirements of subsections (b), (e), (f), and (g) of section 

20 202. Such an authorization under this section shall be sep21 arate from an authorization provided under section 202. 

22 (b) LIMITATION ON AUTHORIZATIONS.— 

23 (1) IN GENERAL.—A person subject to section 

24 202 may not condition the delivery of treatment, or 


cprice-sewell on PROD1PC62 with BILLS
53 

•S 1814 IS

1 payment for services, on the receipt of an authoriza2 tion described in this section. 

3 (2) REQUIREMENT FOR SEPARATE AUTHORIZA4 TION.—A person subject to section 202 may not dis5 close protected health information to any employees 

6 or agents who are responsible for making employ7 ment, work assignment, or other personnel decisions 

8 with respect to the subject of the information with9 out a separate authorization permitting such a dis10 closure. 

11 (c) MODEL AUTHORIZATIONS.—The Secretary, in 

12 consultation with the Director of the Office of Health In13 formation Privacy, after notice and opportunity for public 

14 comment, shall develop and disseminate model written au15 thorizations of the type described in subsection (a). Any 

16 authorization obtained on a model authorization form 

17 under this section shall be deemed to meet the authoriza18 tion requirements of this section. 

19 (d) REQUIREMENT TO RELEASE PROTECTED

20 HEALTH INFORMATION TO CORONERS AND MEDICAL EX21 AMINERS.— 

22 (1) IN GENERAL.—When a coroner or medical 

23 examiner or their duly appointed deputies seek pro24 tected health information for the purpose of inquiry 

25 into and determination of, the cause, manner, and 


cprice-sewell on PROD1PC62 with BILLS
54 

•S 1814 IS

1 circumstances of an individual’s death, the health 

2 care provider, health plan, health oversight agency, 

3 public health authority, employer, health researcher, 

4 law enforcement officer, health or life insurer, school 

5 or university, or other person involved shall provide 

6 that individual’s protected health information to the 

7 coroner or medical examiner or to the duly ap8 pointed deputies without undue delay. 

9 (2) PRODUCTION OF ADDITIONAL INFORMA10 TION.—If a coroner or medical examiner or their 

11 duly appointed deputies receives health information 

12 from a person referred to in paragraph (1), such 

13 health information shall remain as protected health 

14 information unless the health information is at15 tached to or otherwise made a part of a coroner’s or 

16 medical examiner’s official report, in which case it 

17 shall no longer be protected. 

18 (3) EXEMPTION.—Health information attached 

19 to or otherwise made a part of a coroner’s or med20 ical examiner’s official report shall be exempt from 

21 the provisions of this Act except as provided for in 

22 this subsection. 

23 (4) REIMBURSEMENT.—A person referred to 

24 paragraph (1) may request reimbursement from a 

25 coroner or medical examiner for the reasonable costs 


cprice-sewell on PROD1PC62 with BILLS
55 

•S 1814 IS

1 associated with inspection or copying of protected 

2 health information maintained, retained, or stored 

3 by such person. 

4 (e) REVOCATION OR AMENDMENT OF AUTHORIZA5 TION.—An individual may, in writing, revoke or amend an 

6 authorization under this section at any time. 

7 (f) ACTIONS.—An individual may not maintain an ac8 tion against a person described in section 102(a)(1) for 

9 the disclosure of protected health information— 

10 (1) if the disclosure was made based on a good 

11 faith reliance on the individual’s authorization under 

12 this section at the time disclosure was made; 

13 (2) in a case in which the authorization is re14 voked, if the disclosing person had no actual or con15 structive notice of the revocation; or 

16 (3) if the disclosure was for the purpose of pro17 tecting another individual from imminent physical 

18 harm, and is authorized under section 204. 

19 (g) RECORD OF AUTHORIZATIONS AND REVOCA20 TIONS.—Each person accessing, maintaining, retaining, 

21 modifying, recording, storing, destroying, or otherwise 

22 using personally identifiable or protected health informa23 tion for purposes other than treatment or payment shall 

24 maintain a record for a period of 7 years of each author25 ization by an individual and any revocation thereof, and 


cprice-sewell on PROD1PC62 with BILLS
56 

•S 1814 IS

1 such record shall become part of the individual’s health 

2 record set. 

3 SEC. 204. NOTIFICATION IN THE CASE OF BREACH. 

4 (a) IN GENERAL.—A person described in section 

5 102(a)(1) that accesses, maintains, retains, modifies, 

6 records, stores, destroys, or otherwise uses or discloses 

7 protected health information shall, following the discovery 

8 of a security breach of such information, notify each indi9 vidual whose protected health information has been, or is 

10 reasonably believed to have been, accessed, or acquired 

11 during such breach. 

12 (b) OBLIGATION OF OWNER OR LICENSEE.— 

13 (1) NOTICE TO OWNER OR LICENSEE.—Any 

14 person engaged in interstate commerce, that uses, 

15 accesses, transmits, stores, disposes of, or collects 

16 protected health information that the person does 

17 not own or license shall notify the owner or licensee 

18 of the information following the discovery of a secu19 rity breach involving such information. 

20 (2) NOTICE BY OWNER, LICENSEE, OR OTHER

21 DESIGNATED THIRD PARTY.—Nothing in this sub22 title shall be construed to prevent or abrogate an 

23 agreement between a person required to give notice 

24 under this section and a designated third party, in25 cluding an owner or licensee of the protected health 


cprice-sewell on PROD1PC62 with BILLS
57 

•S 1814 IS

1 information subject to the security breach, to pro2 vide the notifications required under subsection (a). 

3 (3) PERSON RELIEVED FROM GIVING NOTICE.— 

4 A person obligated to give notice under subsection 

5 (a) shall be relieved of such obligation if an owner 

6 or licensee of the protected health information sub7 ject to the security breach, or other designated third 

8 party, provides such notification. 

9 (c) TIMELINESS OF NOTIFICATION.— 

10 (1) IN GENERAL.—All notifications required 

11 under this section shall be made within 15 business 

12 days, or earlier if the Secretary determines appro13 priate, following the discovery by the person of a se14 curity breach. 

15 (2) BURDEN OF PROOF.—The person required 

16 to provide notification under this section shall have 

17 the burden of demonstrating that all notifications 

18 were made as required under this subtitle, including 

19 evidence demonstrating the necessity of any delay. 

20 (d) METHODS OF NOTICE.—A person described in 

21 subsection (a) shall provide to an individual the following 

22 forms of notice in the case of a security breach: 

23 (1) INDIVIDUAL NOTICE.—Notice required 

24 under this section shall be provided in such form as 

25 the individual selects, including— 


cprice-sewell on PROD1PC62 with BILLS
58 

•S 1814 IS

1 (A) written notification to the last known 

2 home mailing address of the individual in the 

3 records of the person; 

4 (B) telephone notice to the individual per5 sonally; or 

6 (C) e-mail notice, if the individual has con7 sented to receive such notice and the notice is 

8 consistent with the provisions permitting elec9 tronic transmission of notices under section 101 

10 of the Electronic Signatures in Global and Na11 tional Commerce Act (15 U.S.C. 7001). 

12 (2) MEDIA NOTICE.—Notice shall be provided 

13 to prominent media outlets serving a State or juris14 diction, if the protected health information of more 

15 than 1,000 residents of such State or jurisdiction is, 

16 or is reasonably believed to have been, acquired by 

17 an unauthorized person. 

18 (3) NOTICE TO SECRETARY.—Notice shall be 

19 provided to the Secretary for persons described in 

20 section 102 (a)(1) that have lost, stolen, disclosed, 

21 or used in an unauthorized manner or for an unau22 thorized purpose the protected health information of 

23 a significant number of individuals. 

24 (e) CONTENT OF NOTIFICATION.—Regardless of the 

25 method by which notice is provided to individuals under 


cprice-sewell on PROD1PC62 with BILLS
59 

•S 1814 IS

1 section 104, notice of a security breach shall include, to 

2 the extent possible— 

3 (1) a description of the protected health infor4 mation that has been, or is reasonably believed to 

5 have been, accessed, disclosed, or otherwise used by 

6 an unauthorized person; 

7 (2) a toll-free number that the individual may 

8 use to contact the person described in subsection (a) 

9 to learn what types of protected health information 

10 the person maintained about that individual; and 

11 (3) toll-free contact telephone numbers and ad12 dresses for major credit reporting agencies. 

13 (f) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

14 ENFORCEMENT PURPOSES.— 

15 (1) IN GENERAL.—If a Federal law enforce16 ment agency determines that the notification re17 quired under this section would impede a criminal 

18 investigation or cause damage to national security, 

19 such notification shall be delayed upon written no20 tice from the Federal law enforcement agency to the 

21 person that experienced the breach. 

22 (2) EXTENDED DELAY OF NOTIFICATION.—If 

23 the notification required under subsection (a) is de24 layed pursuant to paragraph (1), a person shall give 

25 notice not later than 30 days after such law enforceVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00059 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
60 

•S 1814 IS

1 ment delay was invoked unless a Federal law en2 forcement agency provides written notification that 

3 further delay is necessary. 

4 (3) LAW ENFORCEMENT IMMUNITY.—No cause 

5 of action shall arise in any court against any Fed6 eral law enforcement agency for acts relating to the 

7 delay of notification for law enforcement purposes 

8 under this subtitle. 

9 Subtitle B—Disclosure Under 

10 Special Circumstances 

11 SEC. 211. EMERGENCY CIRCUMSTANCES. 

12 (a) GENERAL RULE.—In the event of a threat of im13 minent physical or mental harm to the subject of protected 

14 health information, any person may, in order to allay or 

15 remedy such threat, disclose protected health information 

16 about such subject to a health care provider, health care 

17 facility, law enforcement authority, or emergency medical 

18 personnel, to the minimum extent necessary and only if 

19 determined appropriate by a health care provider. 

20 (b) HARM TO OTHERS.—Any person may disclose 

21 protected health information about the subject of the in22 formation where— 

23 (1) such subject has made an identifiable threat 

24 of serious injury or death with respect to an identifi25 able individual or group of individuals; 


cprice-sewell on PROD1PC62 with BILLS
61 

•S 1814 IS

1 (2) the subject has the ability to carry out such 

2 threat; and 

3 (3) the release of such information is necessary 

4 to prevent or significantly reduce the possibility of 

5 such threat being carried out. 

6 SEC. 212. PUBLIC HEALTH. 

7 (a) IN GENERAL.—A health care provider, health 

8 plan, public health authority, employer, health or life in9 surer, law enforcement official, school or university, or 

10 other person described in section 102(a)(1) may disclose 

11 protected health information to a public health authority 

12 or other entity authorized by public health law, when re13 ceipt of such information by the authority or other enti14 ty— 

15 (1) relates directly to a specified public health 

16 purpose; 

17 (2) is reasonably likely to achieve such purpose; 

18 and 

19 (3) is intended for a purpose that cannot be 

20 achieved through the receipt or use of de-identified 

21 health information. 

22 (b) PUBLIC HEALTH PROTECTION DEFINED.—For 

23 purposes of subsection (a), the term ‘‘public health protec24 tion’’ means a population-based activity or individual ef25 fort, authorized by law, the purpose of which is the prevenVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00061 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
62 

•S 1814 IS

1 tion of injury, disease, or premature mortality, or the pro2 motion of health, in a community, including— 

3 (1) assessing the health needs and status of the 

4 community through public health surveillance and 

5 epidemiological research; 

6 (2) implementing public health policy; 

7 (3) responding to public health needs and emer8 gencies; and 

9 (4) any other activities or efforts authorized by 

10 law. 

11 (c) LIMITATIONS.—The purpose of the disclosure de12 scribed in subsection (a) should be of sufficient importance 

13 to warrant the potential effect on, or risk to, the privacy 

14 of individuals that the additional exposure of protected 

15 health information might bring. Any infringement on the 

16 right to privacy under this section should use the least 

17 intrusive means that are tailored to minimize intrusion on 

18 the right to privacy. 

19 SEC. 213. PROTECTION AND ADVOCACY AGENCIES. 

20 Any person described in section 102(a)(1) that cre21 ates, accesses, maintains, retains, modifies, records, 

22 stores, destroys, or otherwise uses or discloses protected 

23 health information under this title may disclose such infor24 mation to a protection and advocacy agency established 

25 under part C of title I of the Developmental Disabilities 


cprice-sewell on PROD1PC62 with BILLS
63 

•S 1814 IS

1 Assistance and Bill of Rights Act (42 U.S.C. 6041 et seq.) 

2 or under the Protection and Advocacy for Mentally Ill In3 dividuals Act of 1986 (42 U.S.C. 10801 et seq.) when 

4 such person can establish that there is probable cause to 

5 believe that an individual who is the subject of the pro6 tected health information is vulnerable to abuse and ne7 glect by an entity providing health or social services to 

8 the individual. 

9 SEC. 214. OVERSIGHT. 

10 (a) IN GENERAL.—A health care provider, health 

11 plan, employer, law enforcement official, health or life in12 surer, public health authority, health researcher, school or 

13 university, or other person described in section 102(a)(1) 

14 may disclose protected health information to a health over15 sight agency to enable the agency to perform a health 

16 oversight function authorized by law, if— 

17 (1) the purpose for which the disclosure is to be 

18 made cannot reasonably be accomplished without 

19 protected health information; 

20 (2) the purpose for which the disclosure is to be 

21 made is of sufficient importance to warrant the ef22 fect on, or the risk to, the privacy of the individuals 

23 that additional exposure of the information might 

24 bring; and 


cprice-sewell on PROD1PC62 with BILLS
64 

•S 1814 IS

1 (3) there is a reasonable probability that the 

2 purpose of the disclosure will be accomplished. 

3 (b) USE AND MAINTENANCE OF PROTECTED

4 HEALTH INFORMATION.—A health oversight agency that 

5 receives protected health information under this section— 

6 (1) shall secure protected health information in 

7 all work papers and all documents summarizing the 

8 health oversight activity through technological, ad9 ministrative, and physical safeguards including cryp10 tographic-key based encryption; 

11 (2) shall maintain in its records only such infor12 mation about an individual as is relevant and nec13 essary to accomplish the purpose for which the pro14 tected health information was obtained; 

15 (3) using appropriate encryption measures. 

16 shall maintain such information securely and limit 

17 access to such information to those persons with a 

18 legitimate need for access to carry out the purpose 

19 for which the records were obtained; and 

20 (4) shall remove or destroy the information that 

21 allows subjects of protected health information to be 

22 identified at the earliest time at which removal or 

23 destruction can be accomplished, consistent with the 

24 purpose of the health oversight activity. 


cprice-sewell on PROD1PC62 with BILLS
65 

•S 1814 IS

1 (c) USE OF PROTECTED HEALTH INFORMATION IN

2 JUDICIAL PROCEEDINGS.— 

3 (1) IN GENERAL.—The disclosure and use of 

4 protected health information in any judicial, admin5 istrative, court, or other public proceeding or inves6 tigation relating to a health oversight activity shall 

7 be undertaken in such a manner as to preserve the 

8 confidentiality and privacy of individuals who are the 

9 subject of the information, unless disclosure is re10 quired by the nature of the proceedings. 

11 (2) LIMITING DISCLOSURE.—Whenever disclo12 sure of the identity of the subject of protected health 

13 information is required by the nature of the pro14 ceedings, or it is impracticable to redact the identity 

15 of such individual, the agency shall request that the 

16 presiding judicial or administrative officer enter an 

17 order limiting the disclosure of the identity of the 

18 subject to the extent possible, including the redact19 ing of the protected health information from publicly 

20 disclosed or filed pleadings or records. 

21 (d) AUTHORIZATION BY A SUPERVISOR.—For pur22 poses of this section, the individual with authority to au23 thorize the oversight function involved shall provide to the 

24 disclosing person described in subsection (a) a statement 


cprice-sewell on PROD1PC62 with BILLS
66 

•S 1814 IS

1 that the protected health information is being sought for 

2 a legally authorized oversight function. 

3 (e) USE IN ACTION AGAINST INDIVIDUALS.—Pro4 tected health information about an individual that is dis5 closed under this section may not be used in, or disclosed 

6 to any person for use in, an administrative, civil, or crimi7 nal action or investigation directed against the individual, 

8 unless the action or investigation arises out of and is di9 rectly related to— 

10 (1) the receipt of health care or payment for 

11 health care; 

12 (2) a fraudulent claim related to health; or 

13 (3) oversight of a public health authority or a 

14 health researcher. 

15 SEC. 215. DISCLOSURE FOR LAW ENFORCEMENT, NA16 TIONAL SECURITY, AND INTELLIGENCE PUR17 POSES. 

18 (a) ACCESS TO PROTECTED HEALTH INFORMATION

19 FOR LAW ENFORCEMENT, NATIONAL SECURITY, AND IN20 TELLIGENCE ACTIVITIES.—A person described in section 

21 102(a)(1), or a person who receives protected health infor22 mation pursuant to section 211, may disclose protected 

23 health information to— 

24 (1) an investigative or law enforcement officer 

25 pursuant to a warrant issued under the Federal 


cprice-sewell on PROD1PC62 with BILLS
67 

•S 1814 IS

1 Rules of Criminal Procedure, an equivalent State 

2 warrant, a grand jury subpoena, civil subpoena, civil 

3 investigative demand, or a court order under limita4 tions set forth in subsection (b); and 

5 (2) an authorized Federal official for the con6 duct of lawful intelligence, counter-intelligence, and 

7 other national security activities authorized by the 

8 National Security Act (50 U.S.C. 401 et seq.) and 

9 implementing authority (Executive Order 12333), or 

10 otherwise by law. 

11 (b) REQUIREMENTS FOR COURT ORDERS FOR AC12 CESS TO PROTECTED HEALTH INFORMATION.—A court 

13 order for the disclosure of protected health information 

14 under subsection (a)(1) may be issued by any court that 

15 is a court of competent jurisdiction and shall issue only 

16 if the investigative or law enforcement officer submits a 

17 written application upon oath or equivalent affirmation 

18 demonstrating that there is probable cause to believe 

19 that— 

20 (1) the protected health information sought is 

21 relevant and material to an ongoing criminal inves22 tigation, except in the case of a State government 

23 authority, such a court order shall not issue if pro24 hibited by the law of such State; 


cprice-sewell on PROD1PC62 with BILLS
68 

•S 1814 IS

1 (2) the investigative or evidentiary needs of the 

2 investigative or law enforcement officer cannot rea3 sonably be satisfied by de-identified health informa4 tion or by any other information; and 

5 (3) the law enforcement need for the informa6 tion outweighs the privacy interest of the individual 

7 to whom the information pertains. 

8 (c) MOTIONS TO QUASH OR MODIFY.—A court 

9 issuing an order pursuant to this section, on a motion 

10 made promptly by a person described in subsection (a)(1) 

11 may quash or modify such order if the court finds that 

12 information or records requested are unreasonably volumi13 nous or if compliance with such order otherwise would 

14 cause an unreasonable burden on such entities. 

15 (d) NOTICE.— 

16 (1) IN GENERAL.—Except as provided in para17 graph (2), no order for the disclosure of protected 

18 health information about an individual may be 

19 issued by a court under this section unless prior no20 tice of the application for the order has been served 

21 on the individual and the individual has been af22 forded an opportunity to oppose the issuance of the 

23 order. 

24 (2) NOTICE NOT REQUIRED.—An order for the 

25 disclosure of protected health information about an 


cprice-sewell on PROD1PC62 with BILLS
69 

•S 1814 IS

1 individual may be issued without prior notice to the 

2 individual if the court finds that notice would be im3 practical because— 

4 (A) the name and address of the individual 

5 are unknown; or 

6 (B) notice would risk destruction or un7 availability of the evidence, intelligence, 

8 counter-intelligence, or other national security 

9 information. 

10 (e) CONDITIONS.—Upon the granting of an order for 

11 disclosure of protected health information under this sec12 tion, the court shall impose appropriate safeguards to en13 sure the confidentiality of such information and to protect 

14 against unauthorized or improper use or disclosure. 

15 (f) LIMITATION ON USE AND DISCLOSURE FOR NA16 TIONAL SECURITY, INTELLIGENCE, AND OTHER LAW EN17 FORCEMENT INQUIRIES.—Protected health information 

18 about an individual that is disclosed under this section 

19 may not be used in, or disclosed to any entity for use in, 

20 any administrative, civil, or criminal action or investiga21 tion directed against the individual, unless the action or 

22 investigation arises out of, or is directly related to, the 

23 law enforcement, national security, or intelligence inquiry 

24 for which the information was obtained. 


cprice-sewell on PROD1PC62 with BILLS
70 

•S 1814 IS

1 (g) DESTRUCTION OR RETURN OF INFORMATION.— 

2 When the matter or need for which protected health infor3 mation was disclosed to an investigative or law enforce4 ment officer, a Federal official authorized for the conduct 

5 of lawful intelligence, counter-intelligence, and other na6 tional security activities, or authorized Federal official, or 

7 grand jury has concluded, including any derivative matters 

8 arising from such matter or need, the law enforcement 

9 agency, authorized Federal official, or grand jury shall ei10 ther destroy the protected health information, or return 

11 it to the entity from which it was obtained. 

12 (h) REDACTIONS.—To the extent practicable, and 

13 consistent with the requirements of due process, a law en14 forcement agency shall redact personally identifying infor15 mation from protected health information prior to the 

16 public disclosure of such protected information in a judi17 cial or administrative proceeding. 

18 (i) EXCEPTION.—This section shall not be construed 

19 to limit or restrict the ability of law enforcement authori20 ties to gain information while in hot pursuit of a suspect 

21 or if other exigent circumstances exist. 

22 SEC. 216. NEXT OF KIN AND DIRECTORY INFORMATION. 

23 (a) NEXT OF KIN.—A health care provider, or a per24 son that receives protected health information under sec25 tion 211, may disclose protected health information about 


cprice-sewell on PROD1PC62 with BILLS
71 

•S 1814 IS

1 health care services provided to an individual to the indi2 vidual’s next of kin, or to another entity that the indi3 vidual has identified, if at the time of the treatment of 

4 the individual— 

5 (1) the individual— 

6 (A) has been notified of the individual’s 

7 right to object to such disclosure and the indi8 vidual has not objected to the disclosure; or 

9 (B) is in a physical or mental condition 

10 such that the individual is not capable of object11 ing, and there are no prior indications that the 

12 individual would object; and 

13 (2) the information disclosed is relevant to 

14 health care services currently being provided to that 

15 individual. 

16 (b) DIRECTORY INFORMATION.— 

17 (1) DISCLOSURE.— 

18 (A) IN GENERAL.—Except as provided in 

19 paragraph (2), with respect to an individual 

20 who is admitted as an inpatient to a health care 

21 facility, a person described in subsection (a) 

22 may disclose information described in subpara23 graph (B) about the individual to any entity if, 

24 at the time of the admission, the individual— 


cprice-sewell on PROD1PC62 with BILLS
72 

•S 1814 IS

1 (i) has been notified of the individ2 ual’s right to object and has not objected 

3 to the disclosure; or 

4 (ii) is in a physical or mental condi5 tion such that the individual is not capable 

6 of objecting and there are no prior indica7 tions that the individual would object. 

8 (B) INFORMATION.—Information described 

9 in this subparagraph is information that con10 sists only of 1 or more of the following items: 

11 (i) The name of the individual who is 

12 the subject of the information. 

13 (ii) The general health status of the 

14 individual, described as critical, poor, fair, 

15 stable, or satisfactory or in terms denoting 

16 similar conditions. 

17 (iii) The location of the individual 

18 within the health care facility to which the 

19 individual is admitted. 

20 (2) EXCEPTION.—Paragraph (1)(B)(iii) shall 

21 not apply if disclosure of the location of the indi22 vidual would reveal specific information about the 

23 physical or mental condition of the individual, unless 

24 the individual expressly authorizes such disclosure. 


cprice-sewell on PROD1PC62 with BILLS
73 

•S 1814 IS

1 (c) DIRECTORY OR NEXT-OF-KIN INFORMATION.—A 

2 disclosure may not be made under this section if the dis3 closing person described in subsection (a) has reason to 

4 believe that the disclosure of directory or next-of-kin infor5 mation could lead to the physical or mental harm of the 

6 individual, unless the individual expressly authorizes such 

7 disclosure. 

8 SEC. 217. HEALTH RESEARCH. 

9 (a) REGULATIONS.— 

10 (1) IN GENERAL.—The requirements and pro11 tections provided for under part 46 of title 45, Code 

12 of Federal Regulations (as in effect on the date of 

13 enactment of this Act), shall apply to all health re14 search. 

15 (2) EFFECTIVE DATE.—Paragraph (1) shall not 

16 take effect until the Secretary has promulgated final 

17 regulations to implement such paragraph. 

18 (b) EVALUATION.—Not later than 24 months after 

19 the date of enactment of this Act, the Secretary shall pre20 pare and submit to Congress detailed recommendations on 

21 whether written informed consent should be required, and 

22 if so, under what circumstances, before protected health 

23 information can be used for health research. 


cprice-sewell on PROD1PC62 with BILLS
74 

•S 1814 IS

1 (c) RECOMMENDATIONS.—The recommendations re2 quired to be submitted under subsection (b) shall in3 clude— 

4 (1) a detailed explanation of current institu5 tional review board practices, including the extent to 

6 which the privacy of individuals is taken into ac7 count as a factor before allowing waivers and under 

8 what circumstances informed consent is being 

9 waived; 

10 (2) a summary of how technology could be used 

11 to strip identifying data for the purposes of re12 search; 

13 (3) an analysis of the risks and benefits of re14 quiring informed consent versus the waiver of in15 formed consent; 

16 (4) an analysis of the risks and benefits of 

17 using protected health information for research pur18 poses other than the health research project for 

19 which such information was obtained; and 

20 (5) an analysis of the risks and benefits of al21 lowing individuals to consent or to refuse to consent, 

22 at the time of receiving medical treatment, to the 

23 possible future use of records of medical treatments 

24 for research studies. 


cprice-sewell on PROD1PC62 with BILLS
75 

•S 1814 IS

1 (d) CONSULTATION.—In carrying out this section, 

2 the Secretary shall consult with individuals who have dis3 tinguished themselves in the fields of health research, pri4 vacy, related technology, consumer interests in health in5 formation, health data standards, and the provision of 

6 health services. 

7 (e) CONGRESSIONAL NOTICE.—Not later than 6 

8 months after the date on which the Secretary submits to 

9 Congress the recommendations required under subsection 

10 (b), the Secretary shall propose to implement such rec11 ommendations through regulations promulgated on the 

12 record after opportunity for a hearing, and shall advise 

13 the Congress of such proposal. 

14 (f) OTHER REQUIREMENTS.— 

15 (1) OBLIGATIONS OF THE RECIPIENT.—A per16 son who receives protected health information pursu17 ant to this section shall remove or destroy, at the 

18 earliest opportunity consistent with the purposes of 

19 the project involved, information that would enable 

20 an individual to be identified, unless— 

21 (A) an institutional review board has de22 termined that there is a health or research jus23 tification for the retention of such identifiers; 

24 and 


cprice-sewell on PROD1PC62 with BILLS
76 

•S 1814 IS

1 (B) there is an adequate plan to protect 

2 the identifiers from disclosure consistent with 

3 this section. 

4 (2) PERIODIC REVIEW AND TECHNICAL ASSIST5 ANCE.— 

6 (A) INSTITUTIONAL REVIEW BOARD.—Any 

7 institutional review board that authorizes re8 search under this section shall provide the Sec9 retary with the names and addresses of the in10 stitutional review board members. 

11 (B) TECHNICAL ASSISTANCE.—The Sec12 retary shall provide technical assistance to insti13 tutional review boards described in this sub14 section. 

15 (C) MONITORING.—The Secretary shall pe16 riodically monitor institutional review boards 

17 described in this subsection. 

18 (D) REPORTS.—Not later than 3 years 

19 after the date of enactment of this Act, the Sec20 retary shall report to Congress regarding the 

21 activities of institutional review boards de22 scribed in this subsection. 

23 (g) LIMITATION.—Nothing in this section shall be 

24 construed to permit protected health information that is 

25 received by a researcher under this section to be accessed 


cprice-sewell on PROD1PC62 with BILLS
77 

•S 1814 IS

1 for purposes other than research or as authorized by the 

2 individual that is the subject of such protected health in3 formation. 

4 SEC. 218. JUDICIAL AND ADMINISTRATIVE PURPOSES. 

5 (a) IN GENERAL.—A person described in section 

6 102(a)(1), or a person who receives protected health infor7 mation under section 211, may disclose protected health 

8 information— 

9 (1) pursuant to the standards and procedures 

10 established in the Federal Rules of Civil Procedure 

11 or comparable rules of other courts or administrative 

12 agencies, in connection with litigation or proceedings 

13 to which an individual who is the subject of the in14 formation is a party and in which the individual has 

15 placed his or her physical or mental condition at 

16 issue; 

17 (2) to a court, and to others ordered by the 

18 court, if in response to a court order issued by a 

19 court of competent jurisdiction in accordance with 

20 subsections (b) and (c); or 

21 (3) if necessary to present to a court an appli22 cation regarding the provision of treatment of an in23 dividual or the appointment of a guardian. 

24 (b) COURT ORDERS FOR ACCESS TO PROTECTED

25 HEALTH INFORMATION.—A court order for the disclosure 


cprice-sewell on PROD1PC62 with BILLS
78 

•S 1814 IS

1 of protected health information under subsection (a) may 

2 be issued only if the person seeking disclosure submits a 

3 written application upon oath or equivalent affirmation 

4 demonstrating by clear and convincing evidence that— 

5 (1) the protected health information sought is 

6 necessary for the adjudication of a material fact in 

7 dispute in a civil proceeding; 

8 (2) the adjudicative need cannot be reasonably 

9 satisfied by de-identified health information or by 

10 any other information; and 

11 (3) the need for the information outweighs the 

12 privacy interest of the individual to whom the infor13 mation pertains. 

14 (c) NOTICE.— 

15 (1) IN GENERAL.—Except as provided in para16 graph (2), no order for the disclosure of protected 

17 health information about an individual may be 

18 issued by a court unless notice of the application for 

19 the order has been served on the individual and the 

20 individual has been afforded an opportunity to op21 pose the issuance of the order. 

22 (2) NOTICE NOT REQUIRED.—An order for the 

23 disclosure of protected health information about an 

24 individual may be issued without notice to the indiVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00078 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
79 

•S 1814 IS

1 vidual if the court finds, by clear and convincing evi2 dence, that notice would be impractical because— 

3 (A) the name and address of the individual 

4 are unknown; or 

5 (B) notice would risk destruction or un6 availability of the evidence. 

7 (d) OBLIGATIONS OF RECIPIENT.—A person seeking 

8 protected health information pursuant to subsection 

9 (a)(1)— 

10 (1) shall notify the individual or the individual’s 

11 attorney of the request for the information; 

12 (2) shall provide the health care provider, 

13 health plan, health oversight agency, employer, in14 surer, health or life insurer, school or university, 

15 agent, or other person involved with a signed docu16 ment attesting— 

17 (A) that the individual has placed his or 

18 her physical or mental condition at issue in liti19 gation or proceedings in which the individual is 

20 a party; and 

21 (B) the date on which the individual or the 

22 individual’s attorney was notified under para23 graph (1); and 

24 (3) shall not accept any requested protected 

25 health information from the health care provider, 


cprice-sewell on PROD1PC62 with BILLS
80 

•S 1814 IS

1 health plan, health oversight agency, employer, in2 surer, health or life insurer, school or university, 

3 agent, or other person until the termination of the 

4 10-day period beginning on the date notice was 

5 given under paragraph (1). 

6 SEC. 219. INDIVIDUAL REPRESENTATIVES. 

7 (a) IN GENERAL.—Except as provided in subsections 

8 (b) and (c), a person who is authorized by law (based on 

9 grounds other than an individual’s status as a minor), or 

10 by an instrument recognized under law, to act as an agent, 

11 attorney, proxy, or other legal representative of an indi12 vidual, may, to the extent so authorized, exercise and dis13 charge the rights of the individual under this Act. 

14 (b) HEALTH CARE POWER OF ATTORNEY.—A person 

15 who is authorized by law (based on grounds other than 

16 being a minor), or by an instrument recognized under law, 

17 to make decisions about the provision of health care to 

18 an individual who is incapacitated, may exercise and dis19 charge the rights of the individual under this Act to the 

20 extent necessary to effectuate the terms or purposes of 

21 the grant of authority. 

22 (c) NO COURT DECLARATION.—If a physician or 

23 other health care provider determines that an individual, 

24 who has not been declared to be legally incompetent, suf25 fers from a medical condition that prevents the individual 


cprice-sewell on PROD1PC62 with BILLS
81 

•S 1814 IS

1 from acting knowingly or effectively on the individual’s 

2 own behalf, the right of the individual to access or amend 

3 the health information and to authorize disclosure under 

4 this Act may be exercised and discharged in the best inter5 est of the individual by— 

6 (1) a person described in subsection (b) with re7 spect to the individual; 

8 (2) a person described in subsection (a) with re9 spect to the individual, but only if a person de10 scribed in paragraph (1) cannot be contacted after 

11 a reasonable effort or if there is no individual who 

12 fits the description in paragraph (1); 

13 (3) the next of kin of the individual, but only 

14 if a person described in paragraph (1) or (2) cannot 

15 be contacted after a reasonable effort; or 

16 (4) the health care provider, but only if a per17 son described in paragraph (1), (2), or (3) cannot be 

18 contacted after a reasonable effort. 

19 (d) RIGHTS OF MINORS.— 

20 (1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA21 PABLE.—In the case of an individual— 

22 (A) who is 18 years of age or older, all 

23 rights of the individual under this Act shall be 

24 exercised by the individual; or 


cprice-sewell on PROD1PC62 with BILLS
82 

•S 1814 IS

1 (B) who, acting alone, can consent to 

2 health care without violating any applicable law, 

3 and who has sought such care, the individual 

4 shall exercise all rights of an individual under 

5 this Act with respect to protected health infor6 mation relating to such health care. 

7 (2) INDIVIDUALS UNDER 18.—Except as pro8 vided in paragraph (1)(B), in the case of an indi9 vidual who is— 

10 (A) under 14 years of age, all of the indi11 vidual’s rights under this Act shall be exercised 

12 through the parent or legal guardian; or 

13 (B) 14 through 17 years of age, the rights 

14 of inspection, supplementation, and modifica15 tion, and the right to authorize use and disclo16 sure of protected health information of the indi17 vidual shall be exercised by— 

18 (i) the individual where no parent or 

19 legal guardian exists; 

20 (ii) the parent or legal guardian of the 

21 individual; or 

22 (iii) the individual if the parent or 

23 legal guardian determined that the indi24 vidual has the sole right the control their 

25 health information. 


cprice-sewell on PROD1PC62 with BILLS
83 

•S 1814 IS

1 (e) DECEASED INDIVIDUALS.— 

2 (1) APPLICATION OF ACT.—The provisions of 

3 this Act shall continue to apply to protected health 

4 information concerning a deceased individual. 

5 (2) EXERCISE OF RIGHTS ON BEHALF OF A DE6 CEASED INDIVIDUAL.—A person who is authorized 

7 by law or by an instrument recognized under law, to 

8 act as an executor or administrator of the estate of 

9 a deceased individual, or otherwise to exercise the 

10 rights of the deceased individual, may, to the extent 

11 so authorized, exercise and discharge the rights of 

12 such deceased individual under this Act. If no such 

13 designee has been authorized, the rights of the de14 ceased individual may be exercised as provided for in 

15 subsection (c). 

16 (3) IDENTIFICATION OF DECEASED INDI17 VIDUAL.—A person described in section 216(a) may 

18 disclose protected health information if such disclo19 sure is necessary to assist in the identification of a 

20 deceased individual. 


cprice-sewell on PROD1PC62 with BILLS
84 

•S 1814 IS

1 TITLE III—OFFICE OF HEALTH 

2 INFORMATION PRIVACY OF 

3 THE DEPARTMENT OF 

4 HEALTH AND HUMAN SERV5 ICES 

6 Subtitle A—Designation 

7 SEC. 301. DESIGNATION. 

8 (a) IN GENERAL.—The Secretary shall designate an 

9 office within the Department of Health and Human Serv10 ices to be known as the Office of Health Information Pri11 vacy (referred to in this section as the ‘‘Office’’). The Of12 fice shall be headed by a Director, who shall be appointed 

13 by the Secretary. 

14 (b) DUTIES.—The Director of the Office shall— 

15 (1) receive and investigate complaints of alleged 

16 violations of this Act; 

17 (2) provide for the conduct of audits where ap18 propriate; 

19 (3) provide guidance to the Secretary on the 

20 implementation of this Act; 

21 (4) provide guidance to health care providers 

22 and other relevant individuals concerning the man23 ner in which to interpret and implement the privacy 

24 protections under this Act (and the regulations pro25 mulgated under this Act); 


cprice-sewell on PROD1PC62 with BILLS
85 

•S 1814 IS

1 (5) prepare and submit the report described in 

2 subsection (c); 

3 (6) consult with, and provide recommendation 

4 to, the Secretary concerning improvements in the 

5 privacy and security of protected health information 

6 and concerning medical privacy research needs; and 

7 (7) carry out any other activities determined 

8 appropriate by the Secretary. 

9 (c) STANDARDS FOR CERTIFICATION.— 

10 (1) ESTABLISHMENT.—Not later than 12 

11 months after the date of enactment of this Act, the 

12 Secretary, in consultation with the Director of the 

13 Office and the Director of the Office of Civil Rights, 

14 shall establish and implement standards for health 

15 information technology products used to access, dis16 close, maintain, store, distribute, transmit, amend, 

17 or dispose of protected health information in a man18 ner that protects the individual’s right to privacy, 

19 confidentiality, and security relating to that informa20 tion. 

21 (2) STAKEHOLDER PARTICIPATION.—In estab22 lishing the standards under paragraph (1), the Sec23 retary shall ensure the participation of various 

24 stakeholders, including patients and consumer advo25 cates, privacy advocates, experts in information techVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00085 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
86 

•S 1814 IS

1 nology and information systems, and experts in 

2 health care. 

3 (d) REPORT ON COMPLIANCE.—Not later than Janu4 ary 1 of the first calendar year beginning more than 1 

5 year after the establishment of the Office under subsection 

6 (a), and every January 1 thereafter, the Secretary, in con7 sultation with the Director of the Office, shall prepare and 

8 submit to Congress a report concerning the number of 

9 complaints of alleged violations of this Act that are re10 ceived during the year for which the report is being pre11 pared. Such report shall describe the complaints and any 

12 remedial action taken concerning such complaints and 

13 shall be made available to the public on the Internet 

14 website of the Department of Health and Human Services. 

15 Subtitle B—Enforcement 

16 CHAPTER 1—CRIMINAL PROVISIONS 

17 SEC. 311. WRONGFUL DISCLOSURE OF PROTECTED 

18 HEALTH INFORMATION. 

19 (a) IN GENERAL.—Part I of title 18, United States 

20 Code, is amended by adding at the end the following: 


cprice-sewell on PROD1PC62 with BILLS
87 

•S 1814 IS

1 ‘‘CHAPTER 124—WRONGFUL DISCLOSURE 

2 OF PROTECTED HEALTH INFORMATION 

3 ‘‘SEC. 2801. WRONGFUL DISCLOSURE OF PROTECTED 

4 HEALTH INFORMATION. 

5 ‘‘(a) OFFENSE.—The penalties described in sub6 section (b) shall apply to a person that knowingly and in7 tentionally— 

8 ‘‘(1) obtains, uses, or attempts to obtain or use 

9 protected health information relating to an indi10 vidual in violation of title II of the Health Informa11 tion Privacy and Security Act; or 

12 ‘‘(2) discloses or attempts to disclose protected 

13 health information to another person in violation of 

14 title II of the Health Information Privacy and Secu15 rity Act. 

16 ‘‘(b) PENALTIES.—A person described in subsection 

17 (a) shall— 

18 ‘‘(1) be fined not more than $50,000, impris19 oned not more than 1 year, or both; 

20 ‘‘(2) if the offense is committed under false pre21 tenses, be fined not more than $250,000 or impris22 oned not more than 5 years, or both; or 

23 ‘‘(3) if the offense is committed with the intent 

24 to sell, transfer, or use protected health information 

25 for commercial advantage, personal gain, or maliVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00087 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
88 

•S 1814 IS

1 cious harm, be fined not more than $500,000, im2 prisoned not more than 10 years, or any combina3 tion of such penalties. 

4 ‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per5 son described in subsection (a), the maximum penalties 

6 described in subsection (b) shall be doubled for every sub7 sequent conviction for an offense arising out of a violation 

8 or violations related to a set of circumstances that are dif9 ferent from those involved in the previous violation or set 

10 of related violations described in such subsection (a).’’. 

11 (b) CLERICAL AMENDMENT.—The table of chapters 

12 for part I of title 18, United States Code, is amended by 

13 inserting after the item relating to chapter 123 the fol14 lowing new item: 

‘‘Sec. 2801. Wrongful disclosure of protected health information.’’. 

15 SEC. 312. DEBARMENT FOR CRIMES AND CIVIL VIOLA16 TIONS. 

17 (a) PURPOSE.—The purpose of this section is to pre18 vent and deter instances of intentional criminal actions 

19 that violate criminal laws that are designed to protect the 

20 privacy of protected health information in a manner con21 sistent with this Act. 

22 (b) DEBARMENT.—Not later than 270 days after the 

23 date of enactment of this Act, the Attorney General, in 

24 consultation with the Secretary, shall promulgate regula25 tions and establish procedures to permit the debarment 


cprice-sewell on PROD1PC62 with BILLS
89 

•S 1814 IS

1 of health care providers, health researchers, health or life 

2 insurers, employers, or schools or universities from receiv3 ing benefits under any Federal health program or other 

4 Federal procurement program if the managers or officers 

5 of such persons are found guilty of violating section 2801 

6 of title 18, United States Code, have civil penalties im7 posed against such officers or managers under section 321 

8 in connection with the illegal disclosure of protected health 

9 information, or are found guilty of making a false state10 ment or obstructing justice related to attempting to con11 ceal or concealing such illegal disclosure. Such regulations 

12 shall take into account the need for continuity of medical 

13 care and may provide for a delay of any debarment im14 posed under this section to take into account the medical 

15 needs of patients. 

16 (c) CONSULTATION.—Prior to publishing a proposed 

17 rule to implement subsection (b), the Attorney General 

18 shall consult with State law enforcement officials, health 

19 care providers, patient privacy rights’ advocates, and other 

20 appropriate persons, to gain additional information re21 garding the debarment of persons under subsection (b) 

22 and the best methods to ensure the continuity of medical 

23 care. 

24 (d) REPORT.—The Attorney General shall annually 

25 prepare and submit to the Committee on the Judiciary of 


cprice-sewell on PROD1PC62 with BILLS
90 

•S 1814 IS

1 the House of Representatives and the Committee on the 

2 Judiciary of the Senate a report concerning the activities 

3 and debarment actions taken by the Attorney General 

4 under this section. 

5 (e) ASSISTANCE TO PREVENT CRIMINAL VIOLA6 TIONS.—The Attorney General, in cooperation with any 

7 other appropriate individual, organization, or agency, may 

8 provide advice, training, technical assistance, and guid9 ance regarding ways to reduce the incidence of improper 

10 disclosure of protected health information. 

11 (f) RELATIONSHIP TO OTHER AUTHORITIES.—A de12 barment imposed under this section shall not reduce or 

13 diminish the authority of a Federal, State, or local govern14 mental agency or court to penalize, imprison, fine, sus15 pend, debar, or take other adverse action against a person, 

16 in a civil, criminal, or administrative proceeding. 

17 CHAPTER 2—CIVIL SANCTIONS 

18 SEC. 321. CIVIL PENALTY. 

19 A health care provider, health researcher, health 

20 plan, health oversight agency, public health agency, law 

21 enforcement agency, employer, health or life insurer, 

22 school or university, agent or other person described in 

23 section 102(a)(1), who the Secretary, in consultation with 

24 the Attorney General, determines has substantially and 

25 materially failed to comply with this Act shall be subject, 


cprice-sewell on PROD1PC62 with BILLS
91 

•S 1814 IS

1 in addition to any other penalties that may be prescribed 

2 by law— 

3 (1) in a case in which the violation relates to 

4 title I, to a civil penalty of not more than $500 for 

5 each such violation, but not to exceed $5,000 in the 

6 aggregate for multiple violations; 

7 (2) in a case in which the violation relates to 

8 title II, to a civil penalty of not more than $10,000 

9 for each such violation, but not to exceed $50,000 

10 in the aggregate for multiple violations; or 

11 (3) in a case in which such violations have oc12 curred with such frequency as to constitute a gen13 eral business practice, to a civil penalty of not more 

14 than $100,000. 

15 SEC. 322. PROCEDURES FOR IMPOSITION OF PENALTIES. 

16 (a) INITIATION OF PROCEEDINGS.—The Attorney 

17 General, in consultation with the Secretary, may initiate 

18 a proceeding in United States District Court to recover 

19 a civil money penalty under section 321. The Attorney 

20 General may not initiate an action under this section with 

21 respect to any violation described in section 321 after the 

22 expiration of the 6-year period beginning on the date on 

23 which such violation was alleged to have occurred. The At24 torney General may initiate an action under this section 


cprice-sewell on PROD1PC62 with BILLS
92 

•S 1814 IS

1 by filing a complaint pursuant to Rule 4 of the Federal 

2 Rules of Civil Procedure. 

3 (b) SCOPE OF PENALTY.—In determining the 

4 amount or scope of any penalty sought pursuant to section 

5 321, the Attorney General shall take into account— 

6 (1) the nature of claims and the circumstances 

7 under which they were presented; 

8 (2) the degree of culpability, history of prior of9 fenses, and financial condition of the person against 

10 whom the claim is brought; and 

11 (3) such other matters as justice may require. 

12 (c) RECOVERY OF PENALTIES.— 

13 (1) IN GENERAL.—Civil money penalties im14 posed under this section may be recovered in a civil 

15 action in the name of the United States brought in 

16 United States district court for the district where 

17 the claim was presented, or where the claimant re18 sides, as determined by the Attorney General. 

19 Amounts recovered under this section shall be paid 

20 to the United States and deposited as miscellaneous 

21 receipts of the Treasury of the United States. 

22 (2) DEDUCTION FROM AMOUNTS OWING.—The 

23 amount of any penalty may be deducted from any 

24 sum then or later owing by the United States or a 


cprice-sewell on PROD1PC62 with BILLS
93 

•S 1814 IS

1 State to the person against whom the penalty has 

2 been assessed. 

3 (d) INJUNCTIVE RELIEF.—Whenever the Attorney 

4 General in consultation with the Secretary has reason to 

5 believe that any person has engaged, is engaging, or is 

6 about to engage in any activity which makes the person 

7 subject to a civil monetary penalty under section 321, the 

8 Attorney General may bring an action in an appropriate 

9 district court of the United States (or, if applicable, a 

10 United States court of any territory) to enjoin such activ11 ity, or to enjoin the person from concealing, removing, en12 cumbering, or disposing of assets which may be required 

13 in order to pay a civil monetary penalty if any such pen14 alty were to be imposed or to seek other appropriate relief. 

15 (e) AGENCY.—A principal is jointly and severally lia16 ble with the principal’s agent for penalties under section 

17 321 for the actions of the principal’s agent acting within 

18 the scope of the agency. 

19 SEC. 323. CIVIL ACTION BY INDIVIDUALS. 

20 (a) IN GENERAL.—Any individual whose rights under 

21 this Act have been knowingly or negligently violated may 

22 bring a civil action to recover— 

23 (1) such preliminary and equitable relief as the 

24 court determines to be appropriate; and 


cprice-sewell on PROD1PC62 with BILLS
94 

•S 1814 IS

1 (2) the greater of compensatory damages or liq2 uidated damages of $5,000. 

3 (b) PUNITIVE DAMAGES.—In any action brought 

4 under this section in which the individual has prevailed 

5 because of a knowing violation of a provision of this Act, 

6 the court may, in addition to any relief awarded under 

7 subsection (a), award such punitive damages as may be 

8 warranted. 

9 (c) ATTORNEY’S FEES.—In the case of a civil action 

10 brought under subsection (a) in which the individual has 

11 substantially prevailed, the court may assess against the 

12 respondent a reasonable attorney’s fee and other litigation 

13 costs and expenses (including expert fees) reasonably in14 curred. 

15 (d) LIMITATION.—No action may be commenced 

16 under this section more than 3 years after the date on 

17 which the violation was or should reasonably have been 

18 discovered. 

19 (e) AGENCY.—A principal is jointly and severally lia20 ble with the principal’s agent for damages under this sec21 tion for the actions of the principal’s agent acting within 

22 the scope of the agency. 

23 (f) VENUE; SERVICE OF PROCESS.— 

24 (1) VENUE.—An action shall be brought under 

25 subsection (a) in the district court of the United 


cprice-sewell on PROD1PC62 with BILLS
95 

•S 1814 IS

1 States that meets applicable requirements relating to 

2 venue under section 1391 of title 28, United States 

3 Code. 

4 (2) SERVICE OF PROCESS.—In an action 

5 brought under subsection (a), process may be served 

6 in any district in which the defendant— 

7 (A) is an inhabitant; and 

8 (B) may be found. 

9 (g) ADDITIONAL REMEDIES.—The equitable relief or 

10 damages that may be available under this section shall be 

11 in addition to any other lawful remedy or award that may 

12 be available. 

13 SEC. 324. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

14 (a) IN GENERAL.— 

15 (1) CIVIL ACTIONS.—In any case in which the 

16 attorney general of a State or any State or local law 

17 enforcement agency authorized by the State attorney 

18 general or by State law to prosecute violations of 

19 consumer protection laws, has reason to believe that 

20 an interest of the residents of that State has been 

21 or is threatened or adversely affected by the engage22 ment of a person in a practice that is prohibited 

23 under this subtitle, the State or local law enforce24 ment agency on behalf of the residents of the agen25 cy’s jurisdiction, may bring a civil action on behalf 


cprice-sewell on PROD1PC62 with BILLS
96 

•S 1814 IS

1 of the residents of the State or jurisdiction in a dis2 trict court of the United States of appropriate juris3 diction to— 

4 (A) enjoin that act or practice; 

5 (B) enforce compliance with this subtitle; 

6 or 

7 (C) obtain civil penalties of not more than 

8 $1,000 per day per individual whose personally 

9 identifiable information was, or is reasonably 

10 believed to have been, accessed or acquired by 

11 an unauthorized person, up to a maximum of 

12 $50,000 per day. 

13 (2) NOTICE.— 

14 (A) IN GENERAL.—Prior to filing an ac15 tion under paragraph (1), the attorney general 

16 of the State involved shall provide to the Attor17 ney General and Secretary— 

18 (i) written notice of the action; and 

19 (ii) a copy of the complaint for the ac20 tion. 

21 (B) EXEMPTION.—Subparagraph (A) shall 

22 not apply with respect to the filing of an action 

23 by a State attorney general under this sub24 section, if the attorney general of a State deter25 mines that it is not feasible to provide the noVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00096 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
97 

•S 1814 IS

1 tice described in this paragraph before the filing 

2 of the action. 

3 (C) NOTIFICATION WHEN PRACTICABLE.— 

4 In an action described under subparagraph (B), 

5 the attorney general of a State shall provide the 

6 written notice and a copy of the complaint to 

7 the Attorney General and Secretary as soon 

8 after the filing of the complaint as practicable. 

9 (b) FEDERAL PROCEEDINGS.—Upon receiving notice 

10 under subsection (a)(2), the Attorney General in consulta11 tion with the Secretary, shall, have the right to— 

12 (1) move to stay the action, pending the final 

13 disposition of a pending Federal proceeding or ac14 tion; 

15 (2) intervene in an action brought under sub16 section (a)(2); and 

17 (3) file petitions for appeal. 

18 (c) PENDING PROCEEDINGS.—If the Attorney Gen19 eral has instituted a proceeding or action for a violation 

20 of this subtitle or any regulations thereunder, no attorney 

21 general of a State may, during the pendency of such pro22 ceeding or action, bring an action under this subtitle 

23 against any defendant named in such criminal proceeding 

24 or civil action for any violation that is alleged in that pro25 ceeding or action. 


cprice-sewell on PROD1PC62 with BILLS
98 

•S 1814 IS

1 (d) RULE OF CONSTRUCTION.—For purposes of 

2 bringing any civil action under subsection (a), nothing in 

3 this subtitle regarding notification shall be construed to 

4 prevent an attorney general of a State from exercising the 

5 powers conferred on such attorney general by the laws of 

6 that State to— 

7 (1) conduct investigations; 

8 (2) administer oaths or affirmations; or 

9 (3) compel the attendance of witnesses or the 

10 production of documentary and other evidence. 

11 (e) VENUE; SERVICE OF PROCESS.— 

12 (1) VENUE.—Any action brought under sub13 section (a) may be brought in the district court of 

14 the United States that meets applicable require15 ments relating to venue under section 1391 of title 

16 28, United States Code. 

17 (2) SERVICE OF PROCESS.—In an action 

18 brought under subsection (a), process may be served 

19 in any district in which the defendant— 

20 (A) is an inhabitant; or 

21 (B) may be found. 

22 SEC. 325. PROTECTION FOR WHISTLEBLOWER. 

23 (a) PROHIBITION AGAINST DISCRIMINATION.—An 

24 employer may not discharge, demote, suspend, threaten, 

25 harass, retaliate against, or in any other manner discrimiVerDate Aug 31 2005 08:15 Jul 19, 2007 Jkt 059200 PO 00000 Frm 00098 Fmt 6652 Sfmt 6201 E:\BILLS\S1814.IS S1814

cprice-sewell on PROD1PC62 with BILLS
99 

•S 1814 IS

1 nate or cause any employer to discriminate against an em2 ployee in the terms and conditions of employment because 

3 of any lawful act committed by the employee to provide 

4 information or cause information to be provided to a State 

5 or Federal official relating to an actual or suspected viola6 tion of this Act by an employer or an employee of an em7 ployer. 

8 (b) ENFORCEMENT ACTIONS.— 

9 (1) IN GENERAL.—Any employee or former em10 ployee who alleges discharge or discrimination by 

11 any person in violation of subsection (a) may seek 

12 relief under subsection (c), by— 

13 (A) filing a complaint with the Secretary of 

14 Labor; or 

15 (B) if the Secretary has not issued a final 

16 decision within 180 days of the filing of the 

17 complaint under subparagraph (A), and there is 

18 no showing that such delay is due to the bad 

19 faith of the claimant, bringing an action at law 

20 or equity for de novo review in the appropriate 

21 district court of the United States, which shall 

22 have jurisdiction over such an action without 

23 regard to the amount in controversy. 

24 (2) PROCEDURES.— 


cprice-sewell on PROD1PC62 with BILLS
100 

•S 1814 IS

1 (A) IN GENERAL.—Except as provided in 

2 this paragraph, the complaint procedures con3 tained in section 42121(b) of title 49, United 

4 States Code, shall apply with respect to a com5 plaint filed under paragraph (1)(A). 

6 (B) EXCEPTION.—With respect to a com7 plaint filed under paragraph (1)(A), the notifi8 cation provided for under section 42121(b)(1) 

9 of title 49, United States Code, (as required 

10 under subparagraph (A)) shall be made to the 

11 person named in the complaint and to the em12 ployer. 

13 (C) BURDEN OF PROOF.—The legal bur14 dens of proof contained in section 42121(b) of 

15 title 49, United States Code, shall apply to an 

16 action brought under paragraph (1)(B). 

17 (D) STATUTE OF LIMITATIONS.—An action 

18 shall be filed under paragraph (1)(B), not later 

19 than 2 years after the date on which the alleged 

20 violation occurs. 

21 (c) REMEDIES.— 

22 (1) IN GENERAL.—If the district court deter23 mines in an action under subsection (b)(1) that a 

24 violation of subsection (a) has occurred, the court 


cprice-sewell on PROD1PC62 with BILLS
101 

•S 1814 IS

1 shall order any relief necessary to make the em2 ployee whole. 

3 (2) COMPENSATORY DAMAGES.—Relief in any 

4 action under subsection (b)(1) shall include— 

5 (A) reinstatement of the employee to the 

6 employee’s former position with the same se7 niority status that the employee would have had 

8 but for the discrimination; 

9 (B) payment of the amount of back pay, 

10 with interest, to which the employee is entitled; 

11 and 

12 (C) the payment of compensation for any 

13 special damages sustained by the employee as a 

14 result of the discrimination, including litigation 

15 costs, expert witness fees, and reasonable attor16 ney fees. 

17 (d) RIGHTS RETAINED BY THE EMPLOYEE.—Noth18 ing in this section shall be construed to diminish or elimi19 nate the rights, privileges, or remedies available to an em20 ployee under any Federal or State law, or under any col21 lective bargaining agreement. 

22 (e) LIMITATION.—The protections of this section 

23 shall not apply to any employee who— 

24 (1) deliberately causes or participates in the al25 leged violation; or 


cprice-sewell on PROD1PC62 with BILLS
102 

•S 1814 IS

1 (2) knowingly or recklessly provides materially 

2 false information to an individual or entity described 

3 in subsection (a). 

4 (f) DEFINITIONS.—In this section: 

5 (1) EMPLOY.—The term ‘‘employ’’ has the 

6 meaning given such term under section 3(g) of the 

7 Fair Labor Standards Act of 1938 (29 U.S.C. 

8 203(g)) for the purposes of implementing the re9 quirements of that Act (29 U.S.C. 201, et seq.). 

10 (2) EMPLOYEE.—The term ‘‘employee’’ means 

11 an individual who is employed by an employer. 

12 (3) EMPLOYER.—The term ‘‘employer’’ means 

13 any person who employs employees, including any 

14 person acting directly or indirectly in the interest of 

15 any employer in relation to an employee and in16 cludes a public agency. 

17 (g) GENERAL PROHIBITION AGAINST RETALIA18 TION.—A person described in section 102(a)(1), or any 

19 other person that receives protected health information 

20 under this title, may not adversely affect another person, 

21 directly or indirectly, because such person has exercised 

22 a right under this Act, disclosed information relating to 

23 a possible violation of this Act, or associated with, or as24 sisted, an individual in the exercise of a right under this 

25 Act. 


cprice-sewell on PROD1PC62 with BILLS
103 

•S 1814 IS

1 TITLE IV—MISCELLANEOUS 

2 SEC. 401. RELATIONSHIP TO OTHER LAWS. 

3 (a) FEDERAL AND STATE LAWS.—Nothing in this 

4 Act shall be construed as preempting, superseding, or re5 pealing, explicitly or implicitly, other Federal or State laws 

6 or regulations relating to protected health information or 

7 relating to an individual’s access to protected health infor8 mation or health care services, if such laws or regulations 

9 provide protections for the rights of individuals to the pri10 vacy of, and access to, their health information that is 

11 greater than those provided for in this Act. 

12 (b) PRIVILEGES.—Nothing in this Act shall be con13 strued to preempt or modify any provisions of State statu14 tory or common law to the extent that such law concerns 

15 a privilege of a witness or person in a court of that State. 

16 This Act shall not be construed to supersede or modify 

17 any provision of Federal statutory or common law to the 

18 extent such law concerns a privilege of a witness or entity 

19 in a court of the United States. Authorizations pursuant 

20 to section 202 shall not be construed as a waiver of any 

21 such privilege. 

22 (c) CERTAIN DUTIES UNDER LAW.—Nothing in this 

23 Act shall be construed to preempt, supersede, or modify 

24 the operation of any State law that— 


cprice-sewell on PROD1PC62 with BILLS
104 

•S 1814 IS

1 (1) provides for the reporting of vital statistics 

2 such as birth or death information; 

3 (2) requires the reporting of abuse or neglect 

4 information about any individual; 

5 (3) regulates the disclosure or reporting of in6 formation concerning an individual’s mental health; 

7 or 

8 (4) governs a minor’s rights to access protected 

9 health information or health care services. 

10 (d) FEDERAL PRIVACY ACT.— 

11 (1) MEDICAL EXEMPTIONS.—Section 552a of 

12 title 5, United States Code, is amended by adding 

13 at the end the following: 

14 ‘‘(w) CERTAIN PROTECTED HEALTH INFORMA15 TION.—The head of an agency that is a health care pro16 vider, health plan, health oversight agency, employer, in17 surer, health or life insurer, school or university, or other 

18 entity who receives protected health information under 

19 section 218 of the Health Information Privacy and Secu20 rity Act shall promulgate rules, in accordance with the re21 quirements (including general notice) of subsections 

22 (b)(1), (b)(2), (b)(3), (c), (e) of section 553 of this title, 

23 to exempt a system of records within the agency, to the 

24 extent that the system of records contains protected health 

25 information (as defined in section 4 of such Act), from 


cprice-sewell on PROD1PC62 with BILLS
105 

•S 1814 IS

1 all provisions of this section except subsections (b)(6), (d), 

2 (e)(1), (e)(2), subparagraphs (A) through (C) and (E) 

3 through (I) of subsection (e)(4), and subsections (e)(5), 

4 (e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (r), and (u).’’. 

5 (2) TECHNICAL AMENDMENT.—Section 

6 552a(f)(3) of title 5, United States Code, is amend7 ed by striking ‘‘pertaining to him,’’ and all that fol8 lows through the semicolon and inserting ‘‘per9 taining to the individual’’. 

10 (e) HEALTH INSURANCE PORTABILITY AND AC11 COUNTABILITY ACT.—The standards governing the pri12 vacy and security of individually identifiable health infor13 mation promulgated by the Secretary of Health and 

14 Human Services under sections 262(a) and 264 of the 

15 Health Insurance Portability and Accountability Act of 

16 1996 shall remain in effect to the extent that they are 

17 consistent with this Act. The Secretary shall amend such 

18 Federal regulations as required to make such regulations 

19 consistent with this Act. 

20 SEC. 402. EFFECTIVE DATE. 

21 (a) EFFECTIVE DATE.—Unless specifically provided 

22 for otherwise, this Act shall take effect on the date that 

23 is 12 months after the date of the promulgation of the 

24 regulations required under subsection (b), or 30 months 


cprice-sewell on PROD1PC62 with BILLS
106 

•S 1814 IS

1 after the date of enactment of this Act, whichever is ear2 lier. 

3 (b) REGULATIONS.—Not later than 12 months after 

4 the date of enactment of this Act, or as specifically pro5 vided for otherwise, the Secretary shall promulgate regula6 tions implementing this Act. 

Æ 


cprice-sewell on PROD1PC62 with BILLS