I

105TH CONGRESS

1ST SESSION H. R. 52

To establish a code of fair information practices for health information,

to amend section 552a of title 5, United States Code, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

JANUARY 7, 1997

Mr. CONDIT introduced the following bill; which was referred to the Committee on Commerce, and in addition to the Committees on Government Reform and Oversight, and the Judiciary, for a period to be subsequently

determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To establish a code of fair information practices for health

information, to amend section 552a of title 5, United

States Code, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Fair Health Information Practices Act of 1997’’.

6 (b) TABLE OF CONTENTS.—The table of contents for

7 this Act is as follows:

Sec. 1. Short title; table of contents.

Sec. 2. Findings and purposes.
2

•HR 52 IH

Sec. 3. Definitions.

TITLE I—FAIR HEALTH INFORMATION PRACTICES

Subtitle A—Duties of Health Information Trustees

Sec. 101. Inspection of protected health information.

Sec. 102. Amendment of protected health information.

Sec. 103. Notice of information practices.

Sec. 104. Disclosure history.

Sec. 105. Security.

Subtitle B—Use and Disclosure of Protected Health Information

Sec. 111. General limitations on use and disclosure.

Sec. 112. Authorizations for disclosure of protected health information.

Sec. 113. Treatment, payment, and oversight.

Sec. 114. Next of kin and directory information.

Sec. 115. Public health.

Sec. 116. Health research.

Sec. 117. Emergency circumstances.

Sec. 118. Judicial and administrative purposes.

Sec. 119. Law enforcement.

Sec. 120. Subpoenas, warrants, and search warrants.

Subtitle C—Access Procedures and Challenge Rights

Sec. 131. Access procedures for law enforcement subpoenas, warrants, and

search warrants.

Sec. 132. Challenge procedures for law enforcement subpoenas.

Sec. 133. Access and challenge procedures for other subpoenas.

Sec. 134. Construction of subtitle; suspension of statute of limitations.

Sec. 135. Responsibilities of Secretary.

Subtitle D—Miscellaneous Provisions

Sec. 141. Payment card and electronic payment transactions.

Sec. 142. Access to protected health information outside of the United States.

Sec. 143. Standards for electronic documents and communications.

Sec. 144. Duties and authorities of affiliated persons.

Sec. 145. Agents and attorneys.

Sec. 146. Minors.

Sec. 147. Maintenance of certain protected health information.

Subtitle E—Enforcement

Sec. 151. Civil actions.

Sec. 152. Civil money penalties.

Sec. 153. Alternative dispute resolution.

Sec. 154. Amendments to criminal law.

TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE

Sec. 201. Amendments to title 5, United States Code.

TITLE III—REGULATIONS, RESEARCH, AND EDUCATION; EFFECTIVE DATES; APPLICABILITY; AND RELATIONSHIP TO OTHER

LAWS
3

•HR 52 IH

Sec. 301. Regulations; research and education.

Sec. 302. Effective dates.

Sec. 303. Applicability.

Sec. 304. Relationship to other laws.

1 SEC. 2. FINDINGS AND PURPOSES.

2 (a) FINDINGS.—The Congress finds as follows:

3 (1) The right to privacy is a personal and fun4 damental right protected by the Constitution of the

5 United States.

6 (2) The improper use or disclosure of personally

7 identifiable health information about an individual

8 may cause significant harm to the interests of the

9 individual in privacy and health care, and may un10 fairly affect the ability of the individual to obtain

11 employment, education, insurance, credit, and other

12 necessities.

13 (3) Current legal protections for health infor14 mation vary from State to State and are inadequate

15 to meet the need for fair information practices

16 standards.

17 (4) The movement of individuals and health in18 formation across State lines, access to and exchange

19 of health information from automated data banks

20 and networks, and the emergence of multistate

21 health care providers and payors create a compelling

22 need for uniform Federal law, rules, and procedures
4

•HR 52 IH

1 governing the use, maintenance, and disclosure of

2 health information.

3 (5) Uniform rules governing the use, mainte4 nance, and disclosure of health information are an

5 essential part of health care reform, are necessary to

6 support the computerization of health information,

7 and can reduce the cost of providing health services

8 by making the necessary transfer of health informa9 tion more efficient.

10 (6) An individual needs access to health infor11 mation about the individual as a matter of fairness,

12 to enable the individual to make informed decisions

13 about health care, and to correct inaccurate or in14 complete information.

15 (b) PURPOSES.—The purposes of this Act are as

16 follows:

17 (1) To define the rights of an individual with

18 respect to health information about the individual

19 that is created or maintained as part of the health

20 treatment and payment process.

21 (2) To define the rights and responsibilities of

22 a person who creates or maintains individually iden23 tifiable health information that originates or is used

24 in the health treatment or payment process.
5

•HR 52 IH

1 (3) To establish effective mechanisms to enforce

2 the rights and responsibilities defined in this Act.

3 SEC. 3. DEFINITIONS.

4 (a) DEFINITIONS RELATING TO PROTECTED

5 HEALTH INFORMATION.—For purposes of this Act:

6 (1) DISCLOSE.—The term ‘‘disclose’’, when

7 used with respect to protected health information

8 that is held by a health information trustee, means

9 to provide access to the information, but only if such

10 access is provided by the trustee to a person other

11 than—

12 (A) the trustee or an officer or employee of

13 the trustee;

14 (B) an affiliated person of the trustee; or

15 (C) a protected individual who is a subject

16 of the information.

17 (2) DISCLOSURE.—The term ‘‘disclosure’’

18 means the act or an instance of disclosing.

19 (3) PROTECTED HEALTH INFORMATION.—The

20 term ‘‘protected health information’’ means any in21 formation, whether oral or recorded in any form or

22 medium—

23 (A) that is created or received in a State

24 by—

25 (i) a health care provider;
6

•HR 52 IH

1 (ii) a health benefit plan sponsor;

2 (iii) a health oversight agency; or

3 (iv) a public health authority;

4 (B) that relates in any way to the past,

5 present, or future physical or mental health or

6 condition or functional status of a protected in7 dividual, the provision of health care to a pro8 tected individual, or payment for the provision

9 of health care to a protected individual; and

10 (C) that—

11 (i) identifies the individual; or

12 (ii) with respect to which there is a

13 reasonable basis to believe that the infor14 mation can be used to identify the individ15 ual.

16 (4) PROTECTED INDIVIDUAL.—The term ‘‘pro17 tected individual’’ means an individual who, with re18 spect to a date—

19 (A) is living on the date; or

20 (B) has died within the 2-year period end21 ing on the date.

22 (5) USE.—The term ‘‘use’’, when used with re23 spect to protected health information that is held by

24 a health information trustee, means—
7

•HR 52 IH

1 (A) to use, or provide access to, the infor2 mation in any manner that does not constitute

3 a disclosure; or

4 (B) any act or instance of using, or provid5 ing access, described in subparagraph (A).

6 (b) DEFINITIONS RELATING TO HEALTH INFORMA7 TION TRUSTEES.—For purposes of this Act:

8 (1) CARRIER.—The term ‘‘carrier’’ means a li9 censed insurance company, a hospital or medical

10 service corporation (including an existing Blue Cross

11 or Blue Shield organization, within the meaning of

12 section 833(c)(2) of the Internal Revenue Code of

13 1986), a health maintenance organization, or other

14 entity licensed or certified by a State to provide

15 health insurance or health benefits.

16 (2) HEALTH BENEFIT PLAN.—The term

17 ‘‘health benefit plan’’ means—

18 (A) any contract of health insurance, in19 cluding any hospital or medical service policy or

20 certificate, hospital or medical service plan con21 tract, or health maintenance organization group

22 contract, that is provided by a carrier; and
8

•HR 52 IH

1 (B) an employee welfare benefit plan or

2 other arrangement insofar as the plan or ar3 rangement provides health benefits and is fund4 ed in a manner other than through the pur5 chase of one or more policies or contracts de6 scribed in subparagraph (A).

7 (3) HEALTH BENEFIT PLAN SPONSOR.—The

8 term ‘‘health benefit plan sponsor’’ means a person

9 who, with respect to a specific item of protected

10 health information, receives, creates, uses, main11 tains, or discloses the information while acting in

12 whole or in part in the capacity of—

13 (A) a carrier or other person providing a

14 health benefit plan, including any public entity

15 that provides payments for health care items

16 and services under a health benefit plan that

17 are equivalent to payments provided by a pri18 vate person under such a plan; or

19 (B) an officer or employee of a person de20 scribed in subparagraph (A).

21 (4) HEALTH CARE PROVIDER.—The term

22 ‘‘health care provider’’ means a person who, with re23 spect to a specific item of protected health informa24 tion, receives, creates, uses, maintains, or discloses
9

•HR 52 IH

1 the information while acting in whole or in part in

2 the capacity of—

3 (A) a person who is licensed, certified, reg4 istered, or otherwise authorized by law to pro5 vide an item or service that constitutes health

6 care in the ordinary course of business or prac7 tice of a profession;

8 (B) a Federal or State program that di9 rectly provides items or services that constitute

10 health care to beneficiaries; or

11 (C) an officer or employee of a person de12 scribed in subparagraph (A) or (B).

13 (5) HEALTH INFORMATION TRUSTEE.—The

14 term ‘‘health information trustee’’ means—

15 (A) a health care provider;

16 (B) a health oversight agency;

17 (C) a health benefit plan sponsor;

18 (D) a public health authority;

19 (E) a health researcher; or

20 (F) a person who, with respect to a spe21 cific item of protected health information, is not

22 described in subparagraphs (A) through (E) but

23 receives the information—

24 (i) pursuant to—
10

•HR 52 IH

1 (I) section 117 (relating to emer2 gency circumstances);

3 (II) section 118 (relating to judi4 cial and administrative purposes);

5 (III) section 119 (relating to law

6 enforcement); or

7 (IV) section 120 (relating to sub8 poenas, warrants, and search war9 rants); or

10 (ii) while acting in whole or in part in

11 the capacity of an officer or employee of a

12 person described in clause (i).

13 (6) HEALTH OVERSIGHT AGENCY.—The term

14 ‘‘health oversight agency’’ means a person who, with

15 respect to a specific item of protected health infor16 mation, receives, creates, uses, maintains, or dis17 closes the information while acting in whole or in

18 part in the capacity of—

19 (A) a person who performs or oversees the

20 performance of an assessment, evaluation, de21 termination, or investigation relating to the li22 censing, accreditation, or certification of health

23 care providers;

24 (B) a person who—
11

•HR 52 IH

1 (i) performs or oversees the perform2 ance of an audit, assessment, evaluation,

3 determination, or investigation relating to

4 the effectiveness of, compliance with, or

5 applicability of, legal, fiscal, medical, or

6 scientific standards or aspects of perform7 ance related to the delivery of, or payment

8 for, health care; and

9 (ii) is a public agency, acting on be10 half of a public agency, acting pursuant to

11 a requirement of a public agency, or carry12 ing out activities under a State or Federal

13 statute regulating the assessment, evalua14 tion, determination, or investigation; or

15 (C) an officer or employee of a person de16 scribed in subparagraph (A) or (B).

17 (7) HEALTH RESEARCHER.—The term ‘‘health

18 researcher’’ means a person who, with respect to a

19 specific item of protected health information, re20 ceives the information—

21 (A) pursuant to section 116 (relating to

22 health research); or

23 (B) while acting in whole or in part in the

24 capacity of an officer or employee of a person

25 described in subparagraph (A).
12

•HR 52 IH

1 (8) PUBLIC HEALTH AUTHORITY.—The term

2 ‘‘public health authority’’ means a person who, with

3 respect to a specific item of protected health infor4 mation, receives, creates, uses, maintains, or dis5 closes the information while acting in whole or in

6 part in the capacity of—

7 (A) an authority of the United States, a

8 State, or a political subdivision of a State that

9 is responsible for public health matters;

10 (B) a person acting under the direction of

11 such an authority; or

12 (C) an officer or employee of a person de13 scribed in subparagraph (A) or (B).

14 (c) OTHER DEFINITIONS.—For purposes of this Act:

15 (1) AFFILIATED PERSON.—The term ‘‘affiliated

16 person’’ means a person who—

17 (A) is not a health information trustee;

18 (B) is a contractor, subcontractor, associ19 ate, or subsidiary of a person who is a health

20 information trustee; and

21 (C) pursuant to an agreement or other re22 lationship with such trustee, receives, creates,

23 uses, maintains, or discloses protected health

24 information.
13

•HR 52 IH

1 (2) APPROVED HEALTH RESEARCH PROJECT.—

2 The term ‘‘approved health research project’’ means

3 a biomedical, epidemiological, or health services re4 search or statistics project, or a research project on

5 behavioral and social factors affecting health, that

6 has been approved by a certified institutional review

7 board.

8 (3) CERTIFIED INSTITUTIONAL REVIEW

9 BOARD.—The term ‘‘certified institutional review

10 board’’ means a board—

11 (A) established by an entity to review re12 search involving protected health information

13 and the rights of protected individuals con14 ducted at or supported by the entity;

15 (B) established in accordance with regula16 tions of the Secretary under section 116(d)(1);

17 and

18 (C) certified by the Secretary under section

19 116(d)(2).

20 (4) HEALTH CARE.—The term ‘‘health care’’—

21 (A) means—

22 (i) any preventive, diagnostic, thera23 peutic, rehabilitative, maintenance, or pal24 liative care, counseling, service, or proce25 dure—
14

•HR 52 IH

1 (I) with respect to the physical or

2 mental condition, or functional status,

3 of an individual; or

4 (II) affecting the structure or

5 function of the human body or any

6 part of the human body, including

7 banking of blood, sperm, organs, or

8 any other tissue; or

9 (ii) any sale or dispensing of a drug,

10 device, equipment, or other item to an indi11 vidual, or for the use of an individual, pur12 suant to a prescription; but

13 (B) does not include any item or service

14 that is not furnished for the purpose of main15 taining or improving the health of an individual.

16 (5) LAW ENFORCEMENT INQUIRY.—The term

17 ‘‘law enforcement inquiry’’ means a lawful investiga18 tion or official proceeding inquiring into a violation

19 of, or failure to comply with, any criminal or civil

20 statute or any regulation, rule, or order issued pur21 suant to such a statute.

22 (6) PERSON.—The term ‘‘person’’ includes an

23 authority of the United States, a State, or a political

24 subdivision of a State.
15

•HR 52 IH

1 (7) SECRETARY.—The term ‘‘Secretary’’ means

2 the Secretary of Health and Human Services.

3 (8) STATE.—The term ‘‘State’’ includes the

4 District of Columbia, Puerto Rico, the Virgin Is5 lands, Guam, American Samoa, and the Northern

6 Mariana Islands.

7 TITLE I—FAIR HEALTH

8 INFORMATION PRACTICES

9 Subtitle A—Duties of Health

10 Information Trustees

11 SEC. 101. INSPECTION OF PROTECTED HEALTH INFORMA12 TION.

13 (a) IN GENERAL.—Except as provided in subsection

14 (b), a health information trustee described in subsection

15 (g)—

16 (1) shall permit a protected individual to in17 spect any protected health information about the in18 dividual that the trustee maintains, any record with

19 respect to such information required under section

20 104, and any copy of an authorization required

21 under section 112 that pertains to such information;

22 (2) shall provide the protected individual with a

23 copy of the information, upon request by the individ24 ual and subject to any conditions imposed by the

25 trustee under subsection (d), in any form or format
16

•HR 52 IH

1 requested by the individual, if the information is

2 readily reproducible by the trustee in such form or

3 format;

4 (3) shall permit a person who has been des5 ignated in writing by the protected individual to in6 spect the information on behalf of the individual or

7 to accompany the individual during the inspection;

8 and

9 (4) may offer to explain or interpret informa10 tion that is inspected or copied under this sub11 section.

12 (b) EXCEPTIONS.—A health information trustee is

13 not required by this section to permit inspection or copy14 ing of protected health information by a protected individ15 ual if any of the following conditions apply:

16 (1) INFORMATION ABOUT OTHERS.—The infor17 mation relates to an individual, other than the pro18 tected individual or a health care provider, and the

19 trustee determines in the exercise of reasonable pro20 fessional judgment that inspection or copying of the

21 information would cause sufficient harm to one or

22 both of the individuals so as to outweigh the desir23 ability of permitting access.
17

•HR 52 IH

1 (2) ENDANGERMENT TO LIFE OR SAFETY.—In2 spection or copying of the information could reason3 ably be expected to endanger the life or physical

4 safety of an individual.

5 (3) CONFIDENTIAL SOURCE.—The information

6 identifies or could reasonably lead to the identifica7 tion of an individual (other than a health care pro8 vider) who provided information under a promise of

9 confidentiality to a health care provider concerning

10 a protected individual who is a subject of the infor11 mation.

12 (4) ADMINISTRATIVE PURPOSES.—The informa13 tion—

14 (A) is used by the trustee solely for admin15 istrative purposes and not in the provision of

16 health care to a protected individual who is a

17 subject of the information; and

18 (B) is not disclosed by the trustee to any

19 person.

20 (5) DUPLICATIVE INFORMATION.—The informa21 tion duplicates information available for inspection

22 under subsection (a).

23 (6) INFORMATION COMPILED IN ANTICIPATION

24 OF LITIGATION.—The information is compiled prin25 cipally—
18

•HR 52 IH

1 (A) in anticipation of a civil, criminal, or

2 administrative action or proceeding; or

3 (B) for use in such an action or proceed4 ing.

5 (c) INSPECTION AND COPYING OF SEGREGABLE POR6 TION.—A health information trustee shall permit inspec7 tion and copying under subsection (a) of any reasonably

8 segregable portion of a record after deletion of any portion

9 that is exempt under subsection (b).

10 (d) CONDITIONS.—A health information trustee

11 may—

12 (1) require a written request for the inspection

13 and copying of protected health information under

14 this section; and

15 (2) charge a reasonable cost-based fee for—

16 (A) permitting inspection of information

17 under this section; and

18 (B) providing a copy of protected health

19 information under this section.

20 (e) STATEMENT OF REASONS FOR DENIAL.—If a

21 health information trustee denies in whole or in part a

22 request for inspection or copying under this section, the

23 trustee shall provide the protected individual who made

24 the request with a written statement of the reasons for

25 the denial.
19

•HR 52 IH

1 (f) DEADLINE.—A health information trustee shall

2 comply with or deny a request for inspection or copying

3 of protected health information under this section within

4 the 30-day period beginning on the date the trustee re5 ceives the request.

6 (g) APPLICABILITY.—This section applies to a health

7 information trustee who is—

8 (1) a health benefit plan sponsor;

9 (2) a health care provider;

10 (3) a health oversight agency; or

11 (4) a public health authority.

12 SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA13 TION.

14 (a) IN GENERAL.—A health information trustee de15 scribed in subsection (f) shall, within the 45-day period

16 beginning on the date the trustee receives from a protected

17 individual about whom the trustee maintains protected

18 health information a written request that the trustee cor19 rect or amend the information, complete the duties de20 scribed in one of the following paragraphs:

21 (1) CORRECTION OR AMENDMENT AND NOTIFI22 CATION.—The trustee shall—

23 (A) make the correction or amendment re24 quested;
20

•HR 52 IH

1 (B) inform the protected individual of the

2 amendment or correction that has been made;

3 (C) make reasonable efforts to inform any

4 person who is identified by the protected indi5 vidual, who is not an employee of the trustee,

6 and to whom the uncorrected or unamended

7 portion of the information was previously dis8 closed of the correction or amendment that has

9 been made; and

10 (D) at the request of the individual, make

11 reasonable efforts to inform any known source

12 of the uncorrected or unamended portion of the

13 information about the correction or amendment

14 that has been made.

15 (2) REASONS FOR REFUSAL AND REVIEW PRO16 CEDURES.—The trustee shall inform the protected

17 individual of—

18 (A) the reasons for the refusal of the trust19 ee to make the correction or amendment;

20 (B) any procedures for further review of

21 the refusal; and
21

•HR 52 IH

1 (C) the individual’s right to file with the

2 trustee a concise statement setting forth the re3 quested correction or amendment and the indi4 vidual’s reasons for disagreeing with the refusal

5 of the trustee.

6 (b) STANDARDS FOR CORRECTION OR AMEND7 MENT.—A trustee shall correct or amend protected health

8 information in accordance with a request made under sub9 section (a) if the trustee determines that the information

10 is not accurate, relevant, timely, or complete for the pur11 poses for which the information may be used or disclosed

12 by the trustee.

13 (c) STATEMENT OF DISAGREEMENT.—After a pro14 tected individual has filed a statement of disagreement

15 under subsection (a)(2)(C), the trustee, in any subsequent

16 disclosure of the disputed portion of the information, shall

17 include a copy of the individual’s statement and may in18 clude a concise statement of the trustee’s reasons for not

19 making the requested correction or amendment.

20 (d) CONSTRUCTION.—This section may not be con21 strued to require a health information trustee to conduct

22 a hearing or proceeding concerning a request for a correc23 tion or amendment to protected health information the

24 trustee maintains.
22

•HR 52 IH

1 (e) CORRECTION.—For purposes of subsection (a), a

2 correction is deemed to have been made to protected

3 health information when—

4 (1) information that is not timely, accurate, rel5 evant, or complete is clearly marked as incorrect; or

6 (2) supplementary correct information is made

7 part of the information and adequately cross-ref8 erenced.

9 (f) APPLICABILITY.—This section applies to a health

10 information trustee who is—

11 (1) a health benefit plan sponsor;

12 (2) a health care provider;

13 (3) a health oversight agency; or

14 (4) a public health authority.

15 SEC. 103. NOTICE OF INFORMATION PRACTICES.

16 (a) PREPARATION OF NOTICE.—A health information

17 trustee described in subsection (d) shall prepare a written

18 notice of information practices describing the following:

19 (1) The rights under this Act of a protected in20 dividual who is the subject of protected health infor21 mation, including the right to inspect and copy such

22 information and the right to seek amendments to

23 such information, and the procedures for authorizing

24 disclosures of protected health information and for

25 revoking such authorizations.
23

•HR 52 IH

1 (2) The procedures established by the trustee

2 for the exercise of such rights.

3 (3) The uses and disclosures of protected health

4 information that are authorized under this Act.

5 (b) DISSEMINATION OF NOTICE.—A health informa6 tion trustee—

7 (1) shall, upon request, provide any person with

8 a copy of the trustee’s notice of information prac9 tices (described in subsection (a)); and

10 (2) shall make reasonable efforts to inform per11 sons in a clear and conspicuous manner of the exist12 ence and availability of such notice.

13 (c) MODEL NOTICES.—Not later than July 1, 1999,

14 the Secretary, after notice and opportunity for public com15 ment, shall develop and disseminate model notices of infor16 mation practices for use by health information trustees

17 under this section.

18 (d) APPLICABILITY.—This section applies to a health

19 information trustee who is—

20 (1) a health benefit plan sponsor;

21 (2) a health care provider; or

22 (3) a health oversight agency.

23 SEC. 104. DISCLOSURE HISTORY.

24 (a) IN GENERAL.—Except as provided in subsection

25 (b) and section 114, each health information trustee shall
24

•HR 52 IH

1 create and maintain, with respect to any protected health

2 information the trustee discloses, a record of—

3 (1) the date and purpose of the disclosure;

4 (2) the name of the person to whom the disclo5 sure was made;

6 (3) the address of the person to whom the dis7 closure was made or the location to which the disclo8 sure was made; and

9 (4) where practicable, a description of the infor10 mation disclosed.

11 (b) REGULATIONS.—Not later than July 1, 1999, the

12 Secretary shall promulgate regulations that exempt a

13 health information trustee from maintaining a record

14 under subsection (a) with respect protected health infor15 mation disclosed by the trustee for purposes of peer re16 view, licensing, certification, accreditation, and similar ac17 tivities.

18 SEC. 105. SECURITY.

19 (a) IN GENERAL.—Each health information trustee

20 who receives or creates protected health information that

21 is subject to this Act shall maintain reasonable and appro22 priate administrative, technical, and physical safeguards—

23 (1) to ensure the integrity and confidentiality of

24 the information;
25

•HR 52 IH

1 (2) to protect against any reasonably antici2 pated—

3 (A) threats or hazards to the security or

4 integrity of the information; and

5 (B) unauthorized uses or disclosures of the

6 information; and

7 (3) otherwise ensure compliance with this Act

8 by the trustee and the officers and employees of the

9 trustee.

10 (b) GUIDELINES.—Not later than July 1, 1999, the

11 Secretary, after notice and opportunity for public com12 ment, shall develop and disseminate guidelines for the im13 plementation of this section. The guidelines shall take into

14 account—

15 (1) the technical capabilities of record systems

16 used to maintain protected health information;

17 (2) the costs of security measures;

18 (3) the need for training persons who have ac19 cess to protected health information; and

20 (4) the value of audit trails in computerized

21 record systems.
26

•HR 52 IH

1 Subtitle B—Use and Disclosure of

2 Protected Health Information

3 SEC. 111. GENERAL LIMITATIONS ON USE AND DISCLO4 SURE.

5 (a) USE.—Except as otherwise provided under this

6 Act, a health information trustee may use protected health

7 information only for a purpose—

8 (1) that is compatible with and directly related

9 to the purpose for which the information—

10 (A) was collected; or

11 (B) was received by the trustee; or

12 (2) for which the trustee is authorized to dis13 close the information under this Act.

14 (b) DISCLOSURE.—A health information trustee may

15 disclose protected health information only as authorized

16 under this Act.

17 (c) SCOPE OF USES AND DISCLOSURES.—

18 (1) IN GENERAL.—A use or disclosure of pro19 tected health information by a health information

20 trustee shall be limited, when practicable, to the

21 minimum amount of information necessary to ac22 complish the purpose for which the information is

23 used or disclosed.
27

•HR 52 IH

1 (2) GUIDELINES.—Not later than July 1, 1999,

2 the Secretary, after notice and opportunity for pub3 lic comment, shall issue guidelines to implement

4 paragraph (1), which shall take into account the

5 technical capabilities of the record systems used to

6 maintain protected health information and the costs

7 of limiting use and disclosure.

8 (d) IDENTIFICATION OF DISCLOSED INFORMATION

9 AS PROTECTED INFORMATION.—Except with respect to

10 protected health information that is disclosed under sec11 tion 114 (relating to next of kin and directory informa12 tion), a health information trustee may disclose protected

13 health information only if the recipient has been notified

14 that the information is protected health information that

15 is subject to this Act.

16 (e) AGREEMENT TO LIMIT USE OR DISCLOSURE.—

17 A health information trustee who receives protected health

18 information from any person pursuant to a written agree19 ment to restrict use or disclosure of the information to

20 a greater extent than otherwise would be required under

21 this Act shall comply with the terms of the agreement,

22 except where use or disclosure of the information in viola23 tion of the agreement is required by law. A trustee who

24 fails to comply with the preceding sentence shall be subject
28

•HR 52 IH

1 to section 151 (relating to civil actions) with respect to

2 such failure.

3 (f) NO GENERAL REQUIREMENT TO DISCLOSE.—

4 Nothing in this Act shall be construed to require a health

5 information trustee to disclose protected health informa6 tion not otherwise required to be disclosed by law.

7 SEC. 112. AUTHORIZATIONS FOR DISCLOSURE OF PRO8 TECTED HEALTH INFORMATION.

9 (a) WRITTEN AUTHORIZATIONS.—A health informa10 tion trustee may disclose protected health information

11 pursuant to an authorization executed by the protected in12 dividual who is the subject of the information, if each of

13 the following requirements is satisfied:

14 (1) WRITING.—The authorization is in writing,

15 signed by the individual, and dated on the date of

16 such signature.

17 (2) SEPARATE FORM.—The authorization is not

18 on a form used to authorize or facilitate the provi19 sion of, or payment for, health care.

20 (3) TRUSTEE DESCRIBED.—The trustee is spe21 cifically named or generically described in the au22 thorization as authorized to disclose such informa23 tion.
29

•HR 52 IH

1 (4) RECIPIENT DESCRIBED.—The person to

2 whom the information is to be disclosed is specifi3 cally named or generically described in the author4 ization as a person to whom such information may

5 be disclosed.

6 (5) STATEMENT OF INTENDED USES AND DIS7 CLOSURES RECEIVED.—The authorization contains

8 an acknowledgment that the individual has received

9 a statement described in subsection (b) from such

10 person.

11 (6) INFORMATION DESCRIBED.—The informa12 tion to be disclosed is described in the authorization.

13 (7) AUTHORIZATION TIMELY RECEIVED.—The

14 authorization is received by the trustee during a pe15 riod described in subsection (c)(1).

16 (8) DISCLOSURE TIMELY MADE.—The disclo17 sure occurs during a period described in subsection

18 (c)(2).

19 (b) STATEMENT OF INTENDED USES AND DISCLO20 SURES.—

21 (1) IN GENERAL.—A person who wishes to re22 ceive from a health information trustee protected

23 health information about a protected individual pur24 suant to an authorization executed by the individual

25 shall supply the individual, in writing and on a form
30

•HR 52 IH

1 that is distinct from the authorization, with a state2 ment of the uses for which the person intends the

3 information and the disclosures the person intends

4 to make of the information. Such statement shall be

5 supplied before the authorization is executed.

6 (2) ENFORCEMENT.—If the person uses or dis7 closes the information in a manner that is inconsist8 ent with such statement, the person shall be subject

9 to section 151 (relating to civil actions) with respect

10 to such failure, except where such use or disclosure

11 is required by law.

12 (3) MODEL STATEMENTS.—Not later than July

13 1, 1999, the Secretary, after notice and opportunity

14 for public comment, shall develop and disseminate

15 model statements of intended uses and disclosures of

16 the type described in paragraph (1).

17 (c) TIME LIMITATIONS ON AUTHORIZATIONS.—

18 (1) RECEIPT BY TRUSTEE.—For purposes of

19 subsection (a)(7), an authorization is timely received

20 if it is received by the trustee during—

21 (A) the 1-year period beginning on the

22 date that the authorization is signed under sub23 section (a)(1), if the authorization permits the

24 disclosure of protected health information to—

25 (i) a health benefit plan sponsor;
31

•HR 52 IH

1 (ii) a health care provider;

2 (iii) a health oversight agency;

3 (iv) a public health authority;

4 (v) a health researcher; or

5 (vi) a person who provides counseling

6 or social services to individuals; or

7 (B) the 30-day period beginning on the

8 date that the authorization is signed under sub9 section (a)(1), if the authorization permits the

10 disclosure of protected health information to a

11 person other than a person described in sub12 paragraph (A).

13 (2) DISCLOSURE BY TRUSTEE.—For purposes

14 of subsection (a)(8), a disclosure is timely made if

15 it occurs before—

16 (A) the date or event (if any) specified in

17 the authorization upon which the authorization

18 expires; and

19 (B) the expiration of the 6-month period

20 beginning on the date the trustee receives the

21 authorization.

22 (d) REVOCATION OR AMENDMENT OF AUTHORIZA23 TION.—
32

•HR 52 IH

1 (1) IN GENERAL.—A protected individual in

2 writing may revoke or amend an authorization de3 scribed in subsection (a), in whole or in part, at any

4 time, except insofar as—

5 (A) disclosure of protected health informa6 tion has been authorized to permit validation of

7 expenditures based on health condition by a

8 government authority; or

9 (B) action has been taken in reliance on

10 the authorization.

11 (2) NOTICE OF REVOCATION.—A health infor12 mation trustee who discloses protected health infor13 mation in reliance on an authorization that has been

14 revoked shall not be subject to any liability or pen15 alty under this Act if—

16 (A) the reliance was in good faith;

17 (B) the trustee had no notice of the rev18 ocation; and

19 (C) the disclosure was otherwise in accord20 ance with the requirements of this section.

21 (e) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A

22 health information trustee may impose requirements for

23 an authorization that are in addition to the requirements

24 in this section.
33

•HR 52 IH

1 (f) COPY.—A health information trustee who dis2 closes protected health information pursuant to an author3 ization under this section shall maintain a copy of the au4 thorization.

5 (g) CONSTRUCTION.—This section may not be con6 strued—

7 (1) to require a health information trustee to

8 disclose protected health information; or

9 (2) to limit the right of a health information

10 trustee to charge a fee for the disclosure or repro11 duction of protected health information.

12 (h) SUBPOENAS, WARRANTS, AND SEARCH WAR13 RANTS.—If a health information trustee discloses pro14 tected health information pursuant to an authorization in

15 order to comply with an administrative subpoena or war16 rant or a judicial subpoena or search warrant, the author17 ization—

18 (1) shall specifically authorize the disclosure for

19 the purpose of permitting the trustee to comply with

20 the subpoena, warrant, or search warrant; and

21 (2) shall otherwise meet the requirements in

22 this section.
34

•HR 52 IH

1 SEC. 113. TREATMENT, PAYMENT, AND OVERSIGHT.

2 (a) DISCLOSURES BY PLANS, PROVIDERS, AND

3 OVERSIGHT AGENCIES.—A health information trustee de4 scribed in subsection (d) may disclose protected health in5 formation to a health benefit plan sponsor, health care

6 provider, or health oversight agency if the disclosure is—

7 (1) for the purpose of providing health care and

8 a protected individual who is a subject of the infor9 mation has not previously objected to the disclosure

10 in writing;

11 (2) for the purpose of providing for the pay12 ment for health care furnished to an individual; or

13 (3) for use by a health oversight agency for a

14 purpose that is described in subparagraph (A) or

15 (B)(i) of section 3(b)(6).

16 (b) DISCLOSURES BY CERTAIN OTHER TRUSTEES.—

17 A health information trustee may disclose protected health

18 information to a health care provider if—

19 (1) the disclosure is for the purpose described

20 in subsection (a)(1); and

21 (2) the trustee—

22 (A) is a public health authority;

23 (B) received protected health information

24 pursuant to section 117 (relating to emergency

25 circumstances); or
35

•HR 52 IH

1 (C) is an officer or employee of a trustee

2 described in subparagraph (B).

3 (c) USE IN ACTION AGAINST INDIVIDUAL.—A person

4 who receives protected health information about a pro5 tected individual through a disclosure under this section

6 may not use or disclose the information in any administra7 tive, civil, or criminal action or investigation directed

8 against the individual, except an action or investigation

9 arising out of and related to receipt of health care or pay10 ment for health care.

11 (d) APPLICABILITY.—A health information trustee

12 referred to in subsection (a) is any of the following:

13 (1) A health benefit plan sponsor.

14 (2) A health care provider.

15 (3) A health oversight agency.

16 SEC. 114. NEXT OF KIN AND DIRECTORY INFORMATION.

17 (a) NEXT OF KIN.—A health information trustee who

18 is a health care provider, who received protected health

19 information pursuant to section 117 (relating to emer20 gency circumstances), or who is an officer or employee of

21 such a recipient may orally disclose protected health infor22 mation about a protected individual to the next of kin of

23 the individual (as defined under State law), or to a person

24 with whom the individual has a close personal relationship,

25 if—
36

•HR 52 IH

1 (1) the trustee has no reason to believe that the

2 individual would consider the information especially

3 sensitive;

4 (2) the individual has not previously objected to

5 the disclosure;

6 (3) the disclosure is consistent with good medi7 cal or other professional practice; and

8 (4) the information disclosed is limited to infor9 mation about health care that is being provided to

10 the individual at or about the time of the disclosure.

11 (b) DIRECTORY INFORMATION.—

12 (1) IN GENERAL.—A health information trustee

13 who is a health care provider, who received protected

14 health information pursuant to section 117 (relating

15 to emergency circumstances), or who is an officer or

16 employee of such a recipient may disclose to any

17 person the information described in paragraph (2)

18 if—

19 (A) a protected individual who is a subject

20 of the information has not objected in writing

21 to the disclosure;

22 (B) the disclosure is otherwise consistent

23 with good medical and other professional prac24 tice; and
37

•HR 52 IH

1 (C) the information does not reveal specific

2 information about the physical or mental condi3 tion or functional status of a protected individ4 ual or about the health care provided to a pro5 tected individual.

6 (2) INFORMATION DESCRIBED.—The informa7 tion referred to in paragraph (1) is the following:

8 (A) The name of an individual receiving

9 health care from a health care provider on a

10 premises controlled by the provider.

11 (B) The location of the individual on such

12 premises.

13 (C) The general health status of the indi14 vidual, described in terms of critical, poor, fair,

15 stable, satisfactory, or terms denoting similar

16 conditions.

17 (c) NO DISCLOSURE RECORD REQUIRED.—A health

18 information trustee who discloses protected health infor19 mation under this section is not required to create and

20 maintain a record of the disclosure under section 104.

21 (d) RECIPIENTS.—A person to whom protected

22 health information is disclosed under this section shall not,

23 by reason of such disclosure, be subject to any require24 ment under this Act.
38

•HR 52 IH

1 SEC. 115. PUBLIC HEALTH.

2 (a) IN GENERAL.—A health information trustee who

3 is a health care provider or a public health authority may

4 disclose protected health information to—

5 (1) a public health authority for use in legally

6 authorized—

7 (A) disease or injury reporting;

8 (B) public health surveillance; or

9 (C) public health investigation or interven10 tion; or

11 (2) an individual who is authorized by law to

12 receive the information in a public health interven13 tion.

14 (b) USE IN ACTION AGAINST INDIVIDUAL.—A public

15 health authority who receives protected health information

16 about a protected individual through a disclosure under

17 this section may not use or disclose the information in any

18 administrative, civil, or criminal action or investigation di19 rected against the individual, except where the use or dis20 closure is authorized by law for protection of the public

21 health.

22 (c) INDIVIDUAL RECIPIENTS.—An individual to

23 whom protected health information is disclosed under sub24 section (a)(2) shall not, by reason of such disclosure, be

25 subject to any requirement under this Act.
39

•HR 52 IH

1 SEC. 116. HEALTH RESEARCH.

2 (a) IN GENERAL.—A health information trustee de3 scribed in subsection (c) may disclose protected health in4 formation to a person if—

5 (1) the person is conducting an approved health

6 research project;

7 (2) the information is to be used in the project;

8 and

9 (3) the project has been determined by a cer10 tified institutional review board to be—

11 (A) of sufficient importance so as to out12 weigh the intrusion into the privacy of the pro13 tected individual who is the subject of the infor14 mation that would result from the disclosure;

15 and

16 (B) impracticable to conduct without the

17 information.

18 (b) LIMITATIONS ON USE AND DISCLOSURE; OBLIGA19 TIONS OF RECIPIENT.—A health researcher who receives

20 protected health information about a protected individual

21 pursuant to subsection (a)—

22 (1) may use the information solely for purposes

23 of an approved health research project;

24 (2) may not use or disclose the information in

25 any administrative, civil, or criminal action or inves26 tigation directed against the individual; and
40

•HR 52 IH

1 (3) shall remove or destroy, at the earliest op2 portunity consistent with the purposes of the ap3 proved health research project in connection with

4 which the disclosure was made, information that

5 would enable an individual to be identified, unless a

6 certified institutional review board has determined

7 that there is a health or research justification for re8 tention of such identifiers and there is an adequate

9 plan to protect the identifiers from use and disclo10 sure that is inconsistent with this Act.

11 (c) APPLICABILITY.—A health information trustee

12 referred to in subsection (a) is any health information

13 trustee other than a person who, with respect to the spe14 cific protected health information to be disclosed under

15 such subsection, received the information—

16 (1) pursuant to—

17 (A) section 118 (relating to judicial and

18 administrative purposes);

19 (B) paragraph (1), (2), (3), or (4) of sec20 tion 119(a) (relating to law enforcement); or

21 (C) section 120 (relating to subpoenas,

22 warrants, and search warrants); or

23 (2) while acting in whole or in part in the ca24 pacity of an officer or employee of a person de25 scribed in paragraph (1).
41

•HR 52 IH

1 (d) REQUIREMENTS FOR INSTITUTIONAL REVIEW

2 BOARDS.—

3 (1) REGULATIONS.—Not later than July 1,

4 1999, the Secretary, after opportunity for notice and

5 comment, shall promulgate regulations establishing

6 requirements for certified institutional review boards

7 under this Act. The regulations shall be based on

8 regulations promulgated under section 491(a) of the

9 Public Health Service Act and shall ensure that cer10 tified institutional review boards are qualified to as11 sess and protect the confidentiality of research sub12 jects.

13 (2) CERTIFICATION.—The Secretary shall cer14 tify that an institutional review board satisfies the

15 requirements of the regulations promulgated under

16 paragraph (1).

17 SEC. 117. EMERGENCY CIRCUMSTANCES.

18 (a) IN GENERAL.—A health information trustee may

19 disclose protected health information if the trustee be20 lieves, on reasonable grounds, that the disclosure is nec21 essary to prevent or lessen a serious and imminent threat

22 to the health or safety of an individual.

23 (b) USE IN ACTION AGAINST INDIVIDUAL.—A person

24 who receives protected health information about a pro25 tected individual through a disclosure under this section
42

•HR 52 IH

1 may not use or disclose the information in any administra2 tive, civil, or criminal action or investigation directed

3 against the individual, except an action or investigation

4 arising out of and related to receipt of health care or pay5 ment for health care.

6 SEC. 118. JUDICIAL AND ADMINISTRATIVE PURPOSES.

7 (a) IN GENERAL.—A health information trustee de8 scribed in subsection (d) may disclose protected health in9 formation—

10 (1) pursuant to the Federal Rules of Civil Pro11 cedure, the Federal Rules of Criminal Procedure, or

12 comparable rules of other courts or administrative

13 agencies in connection with litigation or proceedings

14 to which a protected individual who is a subject of

15 the information is a party and in which the individ16 ual has placed the individual’s physical or mental

17 condition or functional status in issue;

18 (2) if directed by a court in connection with a

19 court-ordered examination of an individual; or

20 (3) to assist in the identification of a dead

21 individual.

22 (b) WRITTEN STATEMENT.—A person seeking pro23 tected health information about a protected individual held

24 by health information trustee under—

25 (1) subsection (a)(1)—
43

•HR 52 IH

1 (A) shall notify the protected individual or

2 the attorney of the protected individual of the

3 request for the information;

4 (B) shall provide the trustee with a signed

5 document attesting—

6 (i) that the protected individual is a

7 party to the litigation or proceedings for

8 which the information is sought;

9 (ii) that the individual has placed the

10 individual’s physical or mental condition or

11 functional status in issue; and

12 (iii) the date on which the protected

13 individual or the attorney of the protected

14 individual was notified under subparagraph

15 (A); and

16 (C) shall not accept any requested pro17 tected health information from the trustee until

18 the termination of the 10-day period beginning

19 on the date notice was given under subpara20 graph (A); or

21 (2) subsection (a)(3) shall provide the trustee

22 with a written statement that the information is

23 sought to assist in the identification of a dead indi24 vidual.
44

•HR 52 IH

1 (c) USE AND DISCLOSURE.—A person to whom pro2 tected health information is disclosed under this section

3 may use and disclose the information only to accomplish

4 the purpose for which the disclosure was made.

5 (d) APPLICABILITY.—A health information trustee

6 referred to in subsection (a) is any of the following:

7 (1) A health benefit plan sponsor.

8 (2) A health care provider.

9 (3) A health oversight agency.

10 (4) A person who, with respect to the specific

11 protected health information to be disclosed under

12 such subsection, received the information—

13 (A) pursuant to—

14 (i) section 117 (relating to emergency

15 circumstances); or

16 (ii) section 120 (relating to subpoe17 nas, warrants, and search warrants); or

18 (B) while acting in whole or in part in the

19 capacity of an officer or employee of a person

20 described in subparagraph (A).

21 SEC. 119. LAW ENFORCEMENT.

22 (a) IN GENERAL.—A health information trustee may

23 disclose protected health information to a law enforcement

24 agency, other than a health oversight agency—
45

•HR 52 IH

1 (1) if the information is disclosed for use in an

2 investigation or prosecution of a health information

3 trustee;

4 (2) in connection with criminal activity commit5 ted against the trustee or an affiliated person of the

6 trustee or on premises controlled by the trustee; or

7 (3) if the information is needed to determine

8 whether a crime has been committed and the nature

9 of any crime that may have been committed (other

10 than a crime that may have been committed by the

11 protected individual who is the subject of the infor12 mation).

13 (b) ADDITIONAL AUTHORITY OF CERTAIN TRUST14 EES.—A health information trustee who is not a public

15 health authority or a health researcher may disclose pro16 tected health information to a law enforcement agency

17 (other than a health oversight agency)—

18 (1) to assist in the identification or location of

19 a victim, fugitive, or witness in a law enforcement

20 inquiry;

21 (2) pursuant to a law requiring the reporting of

22 specific health care information to law enforcement

23 authorities; or
46

•HR 52 IH

1 (3) if the information is specific health informa2 tion described in paragraph (2) and the trustee is

3 operated by a Federal agency;

4 (c) CERTIFICATION.—Where a law enforcement agen5 cy requests a health information trustee to disclose pro6 tected health information under subsection (a) or (b)(1),

7 the agency shall provide the trustee with a written certifi8 cation that—

9 (1) is signed by a supervisory official of a rank

10 designated by the head of the agency;

11 (2) specifies the information requested; and

12 (3) states that the information is needed for a

13 lawful purpose under this section.

14 (d) RESTRICTIONS ON DISCLOSURE AND USE.—A

15 person who receives protected health information about a

16 protected individual through a disclosure under this sec17 tion may not use or disclose the information—

18 (1) in any administrative, civil, or criminal ac19 tion or investigation directed against the individual,

20 except an action or investigation arising out of and

21 directly related to the action or investigation for

22 which the information was obtained; and
47

•HR 52 IH

1 (2) otherwise unless the use or disclosure is

2 necessary to fulfill the purpose for which the infor3 mation was obtained and is not prohibited by any

4 other provision of law.

5 SEC. 120. SUBPOENAS, WARRANTS, AND SEARCH WAR6 RANTS.

7 (a) IN GENERAL.—A health information trustee de8 scribed in subsection (g) may disclose protected health in9 formation if the disclosure is pursuant to any of the fol10 lowing:

11 (1) A subpoena issued under the authority of a

12 grand jury and the trustee is provided a written cer13 tification by the grand jury that the grand jury has

14 complied with the applicable access provisions of sec15 tion 131.

16 (2) An administrative subpoena or warrant or

17 a judicial subpoena or search warrant and the trust18 ee is provided a written certification by the person

19 seeking the information that the person has com20 plied with the applicable access provisions of section

21 131 or 133(a).

22 (3) An administrative subpoena or warrant or

23 a judicial subpoena or search warrant and the dis24 closure otherwise meets the conditions of one of sec25 tions 113 through 119.
48

•HR 52 IH

1 (b) AUTHORITY OF ALL TRUSTEES.—Any health in2 formation trustee may disclose protected health informa3 tion if the disclosure is pursuant to subsection (a)(3).

4 (c) RESTRICTIONS ON USE AND DISCLOSURE.—Pro5 tected health information about a protected individual that

6 is disclosed by a health information trustee pursuant to—

7 (1) subsection (a)(2) may not be otherwise used

8 or disclosed by the recipient unless the use or disclo9 sure is necessary to fulfill the purpose for which the

10 information was obtained; and

11 (2) subsection (a)(3) may not be used or dis12 closed by the recipient unless the recipient complies

13 with the conditions and restrictions on use and dis14 closure with which the recipient would have been re15 quired to comply if the disclosure by the trustee had

16 been made under the section referred to in sub17 section (a)(3) the conditions of which were met by

18 the disclosure.

19 (d) RESTRICTIONS ON GRAND JURIES.—Protected

20 health information that is disclosed by a health informa21 tion trustee under subsection (a)(1)—

22 (1) shall be returnable on a date when the

23 grand jury is in session and actually presented to

24 the grand jury;
49

•HR 52 IH

1 (2) shall be used only for the purpose of consid2 ering whether to issue an indictment or report by

3 that grand jury, or for the purpose of prosecuting a

4 crime for which that indictment or report is issued,

5 or for a purpose authorized by rule 6(e) of the Fed6 eral Rules of Criminal Procedure or a comparable

7 State rule;

8 (3) shall be destroyed or returned to the trustee

9 if not used for one of the purposes specified in para10 graph (2); and

11 (4) shall not be maintained, or a description of

12 the contents of such information shall not be main13 tained, by any government authority other than in

14 the sealed records of the grand jury, unless such in15 formation has been used in the prosecution of a

16 crime for which the grand jury issued an indictment

17 or presentment or for a purpose authorized by rule

18 6(e) of the Federal Rules of Criminal Procedure or

19 a comparable State rule.

20 (e) USE IN ACTION AGAINST INDIVIDUAL.—A person

21 who receives protected health information about a pro22 tected individual through a disclosure under this section

23 may not use or disclose the information in any administra24 tive, civil, or criminal action or investigation directed

25 against the individual, except an action or investigation
50

•HR 52 IH

1 arising out of and directly related to the inquiry for which

2 the information was obtained;

3 (f) CONSTRUCTION.—Nothing in this section shall be

4 construed as authority for a health information trustee to

5 refuse to comply with a valid administrative subpoena or

6 warrant or a valid judicial subpoena or search warrant

7 that meets the requirements of this Act.

8 (g) APPLICABILITY.—A health information trustee

9 referred to in subsection (a) is any trustee other than the

10 following:

11 (1) A public health authority.

12 (2) A health researcher.

13 Subtitle C—Access Procedures and

14 Challenge Rights

15 SEC. 131. ACCESS PROCEDURES FOR LAW ENFORCEMENT

16 SUBPOENAS, WARRANTS, AND SEARCH WAR17 RANTS.

18 (a) PROBABLE CAUSE REQUIREMENT.—A govern19 ment authority may not obtain protected health informa20 tion about a protected individual from a health informa21 tion trustee under paragraph (1) or (2) of section 120(a)

22 for use in a law enforcement inquiry unless there is prob23 able cause to believe that the information is relevant to

24 a legitimate law enforcement inquiry being conducted by

25 the government authority.
51

•HR 52 IH

1 (b) WARRANTS AND SEARCH WARRANTS.—A govern2 ment authority that obtains protected health information

3 about a protected individual from a health information

4 trustee under circumstances described in subsection (a)

5 and pursuant to a warrant or search warrant shall, not

6 later than 30 days after the date the warrant was served

7 on the trustee, serve the individual with, or mail to the

8 last known address of the individual, a copy of the

9 warrant.

10 (c) SUBPOENAS.—Except as provided in subsection

11 (d), a government authority may not obtain protected

12 health information about a protected individual from a

13 health information trustee under circumstances described

14 in subsection (a) and pursuant to a subpoena unless a

15 copy of the subpoena has been served by hand delivery

16 upon the individual, or mailed to the last known address

17 of the individual, on or before the date on which the sub18 poena was served on the trustee, together with a notice

19 (published by the Secretary under section 135(1)) of the

20 individual’s right to challenge the subpoena in accordance

21 with section 132, and—

22 (1) 30 days have passed from the date of serv23 ice, or 30 days have passed from the date of mailing,

24 and within such time period the individual has not
52

•HR 52 IH

1 initiated a challenge in accordance with section 132;

2 or

3 (2) disclosure is ordered by a court under sec4 tion 132.

5 (d) APPLICATION FOR DELAY.—

6 (1) IN GENERAL.—A government authority may

7 apply to an appropriate court to delay (for an initial

8 period of not longer than 90 days) serving a copy of

9 a subpoena and a notice otherwise required under

10 subsection (c) with respect to a law enforcement in11 quiry. The government authority may apply to the

12 court for extensions of the delay.

13 (2) REASONS FOR DELAY.—An application for

14 a delay, or extension of a delay, under this sub15 section shall state, with reasonable specificity, the

16 reasons why the delay or extension is being sought.

17 (3) EX PARTE ORDER.—The court shall enter

18 an ex parte order delaying, or extending the delay

19 of, the notice and an order prohibiting the trustee

20 from revealing the request for, or the disclosure of,

21 the protected health information being sought if the

22 court finds that—
53

•HR 52 IH

1 (A) the inquiry being conducted is within

2 the lawful jurisdiction of the government au3 thority seeking the protected health informa4 tion;

5 (B) there is probable cause to believe that

6 the protected health information being sought is

7 relevant to a legitimate law enforcement inquiry

8 being conducted by the government authority;

9 (C) the government authority’s need for

10 the information outweighs the privacy interest

11 of the protected individual who is the subject of

12 the information; and

13 (D) there are reasonable grounds to believe

14 that receipt of a notice by the individual will re15 sult in—

16 (i) endangering the life or physical

17 safety of any individual;

18 (ii) flight from prosecution;

19 (iii) destruction of or tampering with

20 evidence or the information being sought;

21 or

22 (iv) intimidation of potential wit23 nesses.

24 (4) SERVICE OF APPLICATION ON INDIVID25 UAL.—Upon the expiration of a period of delay of
54

•HR 52 IH

1 notice under this subsection, the government author2 ity shall serve upon the individual, with the service

3 of the subpoena and the notice, a copy of any appli4 cations filed and approved under this subsection.

5 SEC. 132. CHALLENGE PROCEDURES FOR LAW ENFORCE6 MENT SUBPOENAS.

7 (a) MOTION TO QUASH SUBPOENA.—Within 30 days

8 of the date of service, or 30 days of the date of mailing,

9 of a subpoena of a government authority seeking protected

10 health information about a protected individual from a

11 health information trustee under paragraph (1) or (2) of

12 section 120(a) (except a subpoena to which section 133

13 applies), the individual may file (without filing fee) a mo14 tion to quash the subpoena—

15 (1) in the case of a State judicial subpoena, in

16 the court which issued the subpoena;

17 (2) in the case of a subpoena issued under the

18 authority of a State that is not a State judicial sub19 poena, in a court of competent jurisdiction;

20 (3) in the case of a subpoena issued under the

21 authority of a Federal court, in any court of the

22 United States of competent jurisdiction; or

23 (4) in the case of any other subpoena issued

24 under the authority of the United States, in—
55

•HR 52 IH

1 (A) the United States district court for the

2 district in which the individual resides or in

3 which the subpoena was issued; or

4 (B) another United States district court of

5 competent jurisdiction.

6 (b) COPY.—A copy of the motion shall be served by

7 the individual upon the government authority by delivery

8 of registered or certified mail.

9 (c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov10 ernment authority may file with the court such affidavits

11 and other sworn documents as sustain the validity of the

12 subpoena. The individual may file with the court, within

13 5 days of the date of the authority’s filing, affidavits and

14 sworn documents in response to the authority’s filing. The

15 court, upon the request of the individual, the government

16 authority, or both, may proceed in camera.

17 (d) PROCEEDINGS AND DECISION ON MOTION.—The

18 court may conduct such proceedings as it deems appro19 priate to rule on the motion. All such proceedings shall

20 be completed, and the motion ruled on, within 10 calendar

21 days of the date of the government authority’s filing.

22 (e) EXTENSION OF TIME LIMITS FOR GOOD

23 CAUSE.—The court, for good cause shown, may at any

24 time in its discretion enlarge the time limits established

25 by subsections (c) and (d).
56

•HR 52 IH

1 (f) STANDARD FOR DECISION.—A court may deny a

2 motion under subsection (a) if it finds that there is prob3 able cause to believe that the protected health information

4 being sought is relevant to a legitimate law enforcement

5 inquiry being conducted by the government authority, un6 less the court finds that the individual’s privacy interest

7 outweighs the government authority’s need for the infor8 mation. The individual shall have the burden of dem9 onstrating that the individual’s privacy interest outweighs

10 the need established by the government authority for the

11 information.

12 (g) SPECIFIC CONSIDERATIONS WITH RESPECT TO

13 PRIVACY INTEREST.—In determining under subsection (f)

14 whether an individual’s privacy interest outweighs the gov15 ernment authority’s need for the information, the court

16 shall consider—

17 (1) the particular purpose for which the infor18 mation was collected by the trustee;

19 (2) the degree to which disclosure of the infor20 mation will embarrass, injure, or invade the privacy

21 of the individual;

22 (3) the effect of the disclosure on the individ23 ual’s future health care;
57

•HR 52 IH

1 (4) the importance of the inquiry being con2 ducted by the government authority, and the impor3 tance of the information to that inquiry; and

4 (5) any other factor deemed relevant by the

5 court.

6 (h) ATTORNEY’S FEES.—In the case of any motion

7 brought under subsection (a) in which the individual has

8 substantially prevailed, the court, in its discretion, may as9 sess against a government authority a reasonable attor10 ney’s fee and other litigation costs (including expert fees)

11 reasonably incurred.

12 (i) NO INTERLOCUTORY APPEAL.—A court ruling de13 nying a motion to quash under this section shall not be

14 deemed a final order and no interlocutory appeal may be

15 taken therefrom by the individual. An appeal of such a

16 ruling may be taken by the individual within such period

17 of time as is provided by law as part of any appeal from

18 a final order in any legal proceeding initiated against the

19 individual arising out of or based upon the protected

20 health information disclosed.

21 SEC. 133. ACCESS AND CHALLENGE PROCEDURES FOR

22 OTHER SUBPOENAS.

23 (a) IN GENERAL.—A person (other than a govern24 ment authority seeking protected health information under

25 circumstances described in section 131(a)) may not obtain
58

•HR 52 IH

1 protected health information about a protected individual

2 from a health information trustee pursuant to a subpoena

3 under section 120(a)(2) unless—

4 (1) a copy of the subpoena has been served

5 upon the individual or mailed to the last known ad6 dress of the individual on or before the date on

7 which the subpoena was served on the trustee, to8 gether with a notice (published by the Secretary

9 under section 135(2)) of the individual’s right to

10 challenge the subpoena, in accordance with sub11 section (b); and

12 (2) either—

13 (A) 30 days have passed from the date of

14 service or 30 days have passed from the date of

15 the mailing and within such time period the in16 dividual has not initiated a challenge in accord17 ance with subsection (b); or

18 (B) disclosure is ordered by a court under

19 such subsection.

20 (b) MOTION TO QUASH.—Within 30 days of the date

21 of service or 30 days of the date of mailing of a subpoena

22 seeking protected health information about a protected in23 dividual from a health information trustee under sub24 section (a), the individual may file (without filing fee) in

25 any court of competent jurisdiction, a motion to quash the
59

•HR 52 IH

1 subpoena, with a copy served on the person seeking the

2 information. The individual may oppose, or seek to limit,

3 the subpoena on any grounds that would otherwise be

4 available if the individual were in possession of the infor5 mation.

6 (c) STANDARD FOR DECISION.—The court shall

7 grant an individual’s motion under subsection (b) if the

8 person seeking the information has not sustained the bur9 den of demonstrating that—

10 (1) there are reasonable grounds to believe that

11 the information will be relevant to a lawsuit or other

12 judicial or administrative proceeding; and

13 (2) the need of the person for the information

14 outweighs the privacy interest of the individual.

15 (d) SPECIFIC CONSIDERATIONS WITH RESPECT TO

16 PRIVACY INTEREST.—In determining under subsection (c)

17 whether the need of the person for the information out18 weighs the privacy interest of the individual, the court

19 shall consider—

20 (1) the particular purpose for which the infor21 mation was collected by the trustee;

22 (2) the degree to which disclosure of the infor23 mation will embarrass, injure, or invade the privacy

24 of the individual;
60

•HR 52 IH

1 (3) the effect of the disclosure on the individ2 ual’s future health care;

3 (4) the importance of the information to the

4 lawsuit or proceeding; and

5 (5) any other factor deemed relevant by the

6 court.

7 (e) ATTORNEY’S FEES.—In the case of any motion

8 brought under subsection (b) by an individual against a

9 person in which the individual has substantially prevailed,

10 the court, in its discretion, may assess against the person

11 a reasonable attorney’s fee and other litigation costs (in12 cluding expert fees) reasonably incurred.

13 SEC. 134. CONSTRUCTION OF SUBTITLE; SUSPENSION OF

14 STATUTE OF LIMITATIONS.

15 (a) IN GENERAL.—Nothing in this subtitle shall af16 fect the right of a health information trustee to challenge

17 a request for protected health information. Nothing in this

18 subtitle shall entitle a protected individual to assert the

19 rights of a health information trustee.

20 (b) EFFECT OF MOTION ON STATUTE OF LIMITA21 TIONS.—If an individual who is the subject of protected

22 health information files a motion under this subtitle which

23 has the effect of delaying the access of a government au24 thority to such information, the period beginning on the

25 date such motion was filed and ending on the date on
61

•HR 52 IH

1 which the motion is decided shall be excluded in computing

2 any period of limitations within which the government au3 thority may commence any civil or criminal action in con4 nection with which the access is sought.

5 SEC. 135. RESPONSIBILITIES OF SECRETARY.

6 Not later than July 1, 1999, the Secretary, after no7 tice and opportunity for public comment, shall develop and

8 disseminate brief, clear, and easily understood model

9 notices—

10 (1) for use under subsection (c) of section 131,

11 detailing the rights of a protected individual who

12 wishes to challenge, under section 132, the disclo13 sure of protected health information about the indi14 vidual under such subsection; and

15 (2) for use under subsection (a) of section 133,

16 detailing the rights of a protected individual who

17 wishes to challenge, under subsection (b) of such

18 section, the disclosure of protected health informa19 tion about the individual under such section.

20 Subtitle D—Miscellaneous

21 Provisions

22 SEC. 141. PAYMENT CARD AND ELECTRONIC PAYMENT

23 TRANSACTIONS.

24 (a) PAYMENT FOR HEALTH CARE THROUGH CARD

25 OR ELECTRONIC MEANS.—If a protected individual pays
62

•HR 52 IH

1 a health information trustee for health care by presenting

2 a debit, credit, or other payment card or account number,

3 or by any other electronic payment means, the trustee may

4 disclose to a person described in subsection (b) only such

5 protected health information about the individual as is

6 necessary for the processing of the payment transaction

7 or the billing or collection of amounts charged to, debited

8 from, or otherwise paid by, the individual using the card,

9 number, or other electronic payment means.

10 (b) TRANSACTION PROCESSING.—A person who is a

11 debit, credit, or other payment card issuer, is otherwise

12 directly involved in the processing of payment transactions

13 involving such cards or other electronic payment trans14 actions, or is otherwise directly involved in the billing or

15 collection of amounts paid through such means, may only

16 use or disclose protected health information about a pro17 tected individual that has been disclosed in accordance

18 with subsection (a) when necessary for—

19 (1) the authorization, settlement, billing or col20 lection of amounts charged to, debited from, or oth21 erwise paid by, the individual using a debit, credit,

22 or other payment card or account number, or by

23 other electronic payment means;

24 (2) the transfer of receivables, accounts, or in25 terest therein;
63

•HR 52 IH

1 (3) the audit of the credit, debit, or other pay2 ment card account information;

3 (4) compliance with Federal, State, or local law;

4 or

5 (5) a properly authorized civil, criminal, or reg6 ulatory investigation by Federal, State, or local au7 thorities.

8 SEC. 142. ACCESS TO PROTECTED HEALTH INFORMATION

9 OUTSIDE OF THE UNITED STATES.

10 (a) IN GENERAL.—Notwithstanding the provisions of

11 subtitle B, and except as provided in subsection (b), a

12 health information trustee may not permit any person who

13 is not in a State to have access to protected health infor14 mation about a protected individual unless one or more

15 of the following conditions exist:

16 (1) SPECIFIC AUTHORIZATION.—The individual

17 has specifically consented to the provision of such

18 access outside of the United States in an authoriza19 tion that meets the requirements of section 112.

20 (2) EQUIVALENT PROTECTION.—The provision

21 of such access is authorized under this Act and the

22 Secretary has determined that there are fair infor23 mation practices for protected health information in

24 the jurisdiction where the access will be provided
64

•HR 52 IH

1 that provide protections for individuals and pro2 tected health information that are equivalent to the

3 protections provided for by this Act.

4 (3) ACCESS REQUIRED BY LAW.—The provision

5 of such access is required under—

6 (A) a Federal statute; or

7 (B) a treaty or other international agree8 ment applicable to the United States.

9 (b) EXCEPTIONS.—Subsection (a) does not apply

10 where the provision of access to protected health informa11 tion—

12 (1) is to a foreign public health authority;

13 (2) is authorized under section 114 (relating to

14 next of kin and directory information), 116 (relating

15 to health research), or 117 (relating to emergency

16 circumstances); or

17 (3) is necessary for the purpose of providing for

18 payment for health care that has been provided to

19 an individual.

20 SEC. 143. STANDARDS FOR ELECTRONIC DOCUMENTS AND

21 COMMUNICATIONS.

22 (a) STANDARDS.—Not later than July 1, 1999, the

23 Secretary, after notice and opportunity for public com24 ment and in consultation with appropriate private stand25 ard-setting organizations and other interested parties,
65

•HR 52 IH

1 shall establish standards with respect to the creation,

2 transmission, receipt, and maintenance, in electronic and

3 magnetic form, of each type of written document specifi4 cally required or authorized under this Act. Where a sig5 nature is required under any other provision of this Act,

6 such standards shall provide for an electronic or magnetic

7 substitute that serves the functional equivalent of a signa8 ture.

9 (b) TREATMENT OF COMPLYING DOCUMENTS AND

10 COMMUNICATIONS.—An electronic or magnetic document

11 or communication that satisfies the standards established

12 under subsection (a) with respect to such document or

13 communication shall be treated as satisfying the require14 ments of this Act that apply to an equivalent written docu15 ment.

16 SEC. 144. DUTIES AND AUTHORITIES OF AFFILIATED PER17 SONS.

18 (a) REQUIREMENTS ON TRUSTEES.—

19 (1) PROVISION OF INFORMATION.—A health in20 formation trustee may provide protected health in21 formation to a person who, with respect to the trust22 ee, is an affiliated person and may permit the affili23 ated person to use such information, only for the

24 purpose of conducting, supporting, or facilitating an

25 activity that the trustee is authorized to undertake.
66

•HR 52 IH

1 (2) NOTICE TO AFFILIATED PERSON.—A health

2 information trustee shall notify a person who, with

3 respect to the trustee, is an affiliated person of any

4 duties under this Act that the affiliated person is re5 quired to fulfill and of any authorities under this

6 Act that the affiliated person is authorized to exer7 cise.

8 (b) DUTIES OF AFFILIATED PERSONS.—

9 (1) IN GENERAL.—An affiliated person shall

10 fulfill any duty under this Act that—

11 (A) the health information trustee with

12 whom the person has an agreement or relation13 ship described in section 3(c)(1)(C) is required

14 to fulfill; and

15 (B) the person has undertaken to fulfill

16 pursuant to such agreement or relationship.

17 (2) CONSTRUCTION OF OTHER SUBTITLES.—

18 With respect to a duty described in paragraph (1)

19 that an affiliated person is required to fulfill, the

20 person shall be considered a health information

21 trustee for purposes of this Act. The person shall be

22 subject to subtitle E (relating to enforcement) with

23 respect to any such duty that the person fails to ful24 fill.
67

•HR 52 IH

1 (3) EFFECT ON TRUSTEE.—An agreement or

2 relationship with an affiliated person does not relieve

3 a health information trustee of any duty or liability

4 under this Act.

5 (b) AUTHORITIES OF AFFILIATED PERSONS.—

6 (1) IN GENERAL.—An affiliated person may

7 only exercise an authority under this Act that the

8 health information trustee with whom the person is

9 affiliated may exercise and that the person has been

10 given by the trustee pursuant to an agreement or re11 lationship described in section 3(c)(1)(C). With re12 spect to any such authority, the person shall be con13 sidered a health information trustee for purposes of

14 this Act. The person shall be subject to subtitle E

15 (relating to enforcement) with respect to any act

16 that exceeds such authority.

17 (2) EFFECT ON TRUSTEE.—An agreement or

18 relationship with an affiliated person does not affect

19 the authority of a health information trustee under

20 this Act.

21 SEC. 145. AGENTS AND ATTORNEYS.

22 (a) IN GENERAL.—Except as provided in subsections

23 (b) and (c), a person who is authorized by law (on grounds

24 other than an individual’s minority), or by an instrument

25 recognized under law, to act as an agent, attorney, proxy,
68

•HR 52 IH

1 or other legal representative for a protected individual or

2 the estate of a protected individual, or otherwise to exer3 cise the rights of the individual or estate, may, to the ex4 tent authorized, exercise and discharge the rights of the

5 individual or estate under this Act.

6 (b) HEALTH CARE POWER OF ATTORNEY.—A person

7 who is authorized by law (on grounds other than an indi8 vidual’s minority), or by an instrument recognized under

9 law, to make decisions about the provision of health care

10 to an individual who is incapacitated may exercise and dis11 charge the rights of the individual under this Act to the

12 extent necessary to effectuate the terms or purposes of

13 the grant of authority.

14 (c) NO COURT DECLARATION.—If a health care pro15 vider determines that an individual, who has not been de16 clared to be legally incompetent, suffers from a medical

17 condition that prevents the individual from acting know18 ingly or effectively on the individual’s own behalf, the right

19 of the individual to authorize disclosure under section 112

20 may be exercised and discharged in the best interest of

21 the individual by—

22 (1) a person described in subsection (b) with re23 spect to the individual;
69

•HR 52 IH

1 (2) a person described in subsection (a) with re2 spect to the individual, but only if a person de3 scribed in paragraph (1) cannot be contacted after

4 a reasonable effort;

5 (3) the next of kin of the individual, but only

6 if a person described in paragraph (1) or (2) cannot

7 be contacted after a reasonable effort; or

8 (4) the health care provider, but only if a per9 son described in paragraph (1), (2), or (3) cannot be

10 contacted after a reasonable effort.

11 SEC. 146. MINORS.

12 (a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA13 BLE.—In the case of an individual—

14 (1) who is 18 years of age or older, all rights

15 of the individual shall be exercised by the individual,

16 except as provided in section 145; or

17 (2) who, acting alone, has the legal capacity to

18 apply for and obtain health care and has sought

19 such care, the individual shall exercise all rights of

20 an individual under this Act with respect to pro21 tected health information relating to such care.

22 (b) INDIVIDUALS UNDER 18.—Except as provided in

23 subsection (a)(2), in the case of an individual who is—
70

•HR 52 IH

1 (1) under 14 years of age, all the individual’s

2 rights under this Act shall be exercised through the

3 parent or legal guardian of the individual; or

4 (2) 14, 15, 16, or 17 years of age, the right of

5 inspection (under section 101), the right of amend6 ment (under section 102), and the right to authorize

7 disclosure of protected health information (under

8 section 112) of the individual may be exercised ei9 ther by the individual or by the parent or legal

10 guardian of the individual.

11 SEC. 147. MAINTENANCE OF CERTAIN PROTECTED HEALTH

12 INFORMATION.

13 (a) IN GENERAL.—A State shall establish a process

14 under which the protected health information described in

15 subsection (b) that is maintained by a person described

16 in subsection (c) is delivered to, and maintained by, the

17 State or an individual or entity designated by the State.

18 (b) INFORMATION DESCRIBED.—The protected

19 health information referred to in subsection (a) is pro20 tected health information that—

21 (1) is recorded in any form or medium;

22 (2) is created by—

23 (A) a health care provider; or

24 (B) a health benefit plan sponsor that pro25 vides benefits in the form of items and services
71

•HR 52 IH

1 to enrollees and not in the form of reimburse2 ment for items and services; and

3 (3) relates in any way to the past, present, or

4 future physical or mental health or condition or

5 functional status of a protected individual or the

6 provision of health care to a protected individual.

7 (c) PERSONS DESCRIBED.—A person referred to in

8 subsection (a) is any of the following:

9 (1) A health care facility previously located in

10 the State that has closed.

11 (2) A professional practice previously operated

12 by a health care provider in the State that has

13 closed.

14 (3) A health benefit plan sponsor that—

15 (A) previously provided benefits in the

16 form of items and services to enrollees in the

17 State; and

18 (B) has ceased to do business.

19 Subtitle E—Enforcement

20 SEC. 151. CIVIL ACTIONS.

21 (a) IN GENERAL.—Any individual whose right under

22 this Act has been knowingly or negligently violated—

23 (1) by a health information trustee, or any

24 other person, who is not described in paragraph (2),

25 (3), (4), or (5) may maintain a civil action for actual
72

•HR 52 IH

1 damages and for equitable relief against the health

2 information trustee or other person;

3 (2) by an officer or employee of the United

4 States while the officer or employee was acting with5 in the scope of the office or employment may main6 tain a civil action for actual damages and for equi7 table relief against the United States;

8 (3) by an officer or employee of any government

9 authority of a State that has waived its sovereign

10 immunity to a claim for damages resulting from a

11 violation of this Act while the officer or employee

12 was acting within the scope of the office or employ13 ment may maintain a civil action for actual damages

14 and for equitable relief against the State govern15 ment;

16 (4) by an officer or employee of a government

17 of a State that is not described in paragraph (3)

18 may maintain a civil action for actual damages and

19 for equitable relief against the officer or employee;

20 or

21 (5) by an officer or employee of a government

22 authority while the officer or employee was not act23 ing within the scope of the office or employment

24 may maintain a civil action for actual damages and

25 for equitable relief against the officer or employee.
73

•HR 52 IH

1 (b) KNOWING VIOLATIONS.—Any individual entitled

2 to recover actual damages under this section because of

3 a knowing violation of a provision of this Act (other than

4 subsection (c) or (d) of section 111) shall be entitled to

5 recover the amount of the actual damages demonstrated

6 or $5000, whichever is greater.

7 (c) ACTUAL DAMAGES.—For purposes of this section,

8 the term ‘‘actual damages’’ includes damages paid to com9 pensate an individual for nonpecuniary losses such as

10 physical and mental injury as well as damages paid to

11 compensate for pecuniary losses.

12 (d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In

13 any action brought under this section in which the com14 plainant has prevailed because of a knowing violation of

15 a provision of this Act (other than subsection (c) or (d)

16 of section 111), the court may, in addition to any relief

17 awarded under subsections (a) and (b), award such puni18 tive damages as may be warranted. In such an action, the

19 court, in its discretion, may allow the prevailing party a

20 reasonable attorney’s fee (including expert fees) as part

21 of the costs, and the United States shall be liable for costs

22 the same as a private person.

23 (e) LIMITATION.—A civil action under this section

24 may not be commenced more than 2 years after the date

25 on which the aggrieved individual discovered the violation
74

•HR 52 IH

1 or the date on which the aggrieved individual had a rea2 sonable opportunity to discover the violation, whichever oc3 curs first.

4 (f) INSPECTION AND AMENDMENT.—If a health in5 formation trustee has established a formal internal proce6 dure that allows an individual who has been denied inspec7 tion or amendment of protected health information to ap8 peal the denial, the individual may not maintain a civil

9 action in connection with the denial until the earlier of—

10 (1) the date the appeal procedure has been ex11 hausted; or

12 (2) the date that is 4 months after the date on

13 which the appeal procedure was initiated.

14 (g) NO LIABILITY FOR PERMISSIBLE DISCLO15 SURES.—A health information trustee who makes a disclo16 sure of protected health information about a protected in17 dividual that is permitted by this Act and not otherwise

18 prohibited by State or Federal statute shall not be liable

19 to the individual for the disclosure under common law.

20 (h) NO LIABILITY FOR INSTITUTIONAL REVIEW

21 BOARD DETERMINATIONS.—If the members of a certified

22 institutional review board have in good faith determined

23 that an approved health research project is of sufficient

24 importance so as to outweigh the intrusion into the privacy
75

•HR 52 IH

1 of an individual pursuant to section 116(a)(1), the mem2 bers, the board, and the parent institution of the board

3 shall not be liable to the individual as a result of such

4 determination.

5 (i) GOOD FAITH RELIANCE ON CERTIFICATION.—A

6 health information trustee who relies in good faith on a

7 certification by a government authority or other person

8 and discloses protected health information about an indi9 vidual in accordance with this Act shall not be liable to

10 the individual for such disclosure.

11 SEC. 152. CIVIL MONEY PENALTIES.

12 (a) VIOLATION.—Any health information trustee who

13 the Secretary determines has demonstrated a pattern or

14 practice of failure to comply with the provisions of this

15 Act shall be subject, in addition to any other penalties that

16 may be prescribed by law, to a civil money penalty of not

17 more than $10,000 for each such failure. In determining

18 the amount of any penalty to be assessed under the proce19 dures established under subsection (b), the Secretary shall

20 take into account the previous record of compliance of the

21 person being assessed with the applicable requirements of

22 this Act and the gravity of the violation.

23 (b) PROCEDURES FOR IMPOSITION OF PENALTIES.—

24 The provisions of section 1128A of the Social Security Act
76

•HR 52 IH

1 (other than subsections (a) and (b)) shall apply to the im2 position of a civil monetary penalty under this section in

3 the same manner as such provisions apply with respect

4 to the imposition of a penalty under section 1128A of such

5 Act.

6 SEC. 153. ALTERNATIVE DISPUTE RESOLUTION.

7 (a) IN GENERAL.—Not later than July 1, 1999, the

8 Secretary shall, by regulation, develop alternative dispute

9 resolution methods for use by individuals, health informa10 tion trustees, and other persons in resolving claims under

11 section 151.

12 (b) EFFECT ON INITIATION OF CIVIL ACTIONS.—

13 (1) IN GENERAL.—Subject to paragraph (2),

14 the regulations established under subsection (a) may

15 provide that an individual alleging that a right of

16 the individual under this Act has been violated shall

17 pursue at least one alternative dispute resolution

18 method developed under such subsection as a condi19 tion precedent to commencing a civil action under

20 section 151.

21 (2) LIMITATION.—Such regulations may not re22 quire an individual to refrain from commencing a

23 civil action to pursue one or more alternative dispute

24 resolution method for a period that is greater than

25 6 months.
77

•HR 52 IH

1 (3) SUSPENSION OF STATUTE OF LIMITA2 TIONS.—The regulations established by the Sec3 retary under subsection (a) may provide that a pe4 riod in which an individual described in paragraph

5 (1) pursues (as defined by the Secretary) an alter6 native dispute resolution method under this section

7 shall be excluded in computing the period of limita8 tions under section 151(e).

9 (c) METHODS.—The methods under subsection (a)

10 shall include at least the following:

11 (1) ARBITRATION.—The use of arbitration.

12 (2) MEDIATION.—The use of mediation.

13 (3) EARLY OFFERS OF SETTLEMENT.—The use

14 of a process under which parties make early offers

15 of settlement.

16 (d) STANDARDS FOR ESTABLISHING METHODS.—In

17 developing alternative dispute resolution methods under

18 subsection (a), the Secretary shall ensure that the meth19 ods promote the resolution of claims in a manner that—

20 (1) is affordable for the parties involved;

21 (2) provides for timely and fair resolution of

22 claims; and

23 (3) provides for reasonably convenient access to

24 dispute resolution for individuals.
78

•HR 52 IH

1 SEC. 154. AMENDMENTS TO CRIMINAL LAW.

2 (a) IN GENERAL.—Title 18, United States Code, is

3 amended by inserting after chapter 73 the following:

4 ‘‘CHAPTER 74—OBTAINING PROTECTED HEALTH

5 INFORMATION

‘‘Sec.

‘‘1531. Definitions.

‘‘1532. Obtaining protected health information under false pretenses.

‘‘1533. Monetary gain from obtaining protected health information under false

pretenses.

‘‘1534. Knowing and unlawful obtaining of protected health information.

‘‘1535. Monetary gain from knowing and unlawful obtaining of protected health

information.

‘‘1536. Knowing and unlawful use or disclosure of protected health information.

‘‘1537. Monetary gain from knowing and unlawful sale, transfer, or use of protected health information.

6 ‘‘§ 1531. Definitions

7 ‘‘As used in this chapter—

8 ‘‘(1) the term ‘health information trustee’ has

9 the meaning given such term in section 3(b)(5) of

10 the Fair Health Information Practices Act of 1997;

11 ‘‘(2) the term ‘protected health information’ has

12 the meaning given such term in section 3(a)(3) of

13 such Act; and

14 ‘‘(3) the term ‘protected individual’ has the

15 meaning given such term in section 3(a)(4) of such

16 Act.

17 ‘‘§ 1532. Obtaining protected health information

18 under false pretenses

19 ‘‘Whoever under false pretenses—
79

•HR 52 IH

1 ‘‘(1) requests or obtains protected health infor2 mation from a health information trustee; or

3 ‘‘(2) obtains from a protected individual an au4 thorization for the disclosure of protected health in5 formation about the individual maintained by a

6 health information trustee;

7 shall be fined under this title or imprisoned not more than

8 5 years, or both.

9 ‘‘§ 1533. Monetary gain from obtaining protected

10 health information under false pretenses

11 ‘‘Whoever under false pretenses—

12 ‘‘(1) requests or obtains protected health infor13 mation from a health information trustee with the

14 intent to sell, transfer, or use such information for

15 profit or monetary gain; or

16 ‘‘(2) obtains from a protected individual an au17 thorization for the disclosure of protected health in18 formation about the individual maintained by a

19 health information trustee with the intent to sell,

20 transfer, or use such authorization for profit or

21 monetary gain;

22 and knowingly sells, transfers, or uses such information

23 or authorization for profit or monetary gain shall be fined

24 under this title or imprisoned not more than 10 years, or

25 both.
80

•HR 52 IH

1 ‘‘§ 1534. Knowing and unlawful obtaining of pro2 tected health information

3 ‘‘Whoever knowingly obtains protected health infor4 mation from a health information trustee in violation of

5 the Fair Health Information Practices Act of 1997, know6 ing that such obtaining is unlawful, shall be fined under

7 this title or imprisoned not more than 5 years, or both.

8 ‘‘§ 1535. Monetary gain from knowing and unlawful

9 obtaining of protected health information

10 ‘‘Whoever knowingly—

11 ‘‘(1) obtains protected health information from

12 a health information trustee in violation of the Fair

13 Health Information Practices Act of 1997, knowing

14 that such obtaining is unlawful and with the intent

15 to sell, transfer, or use such information for profit

16 or monetary gain; and

17 ‘‘(2) knowingly sells, transfers, or uses such in18 formation for profit or monetary gain;

19 shall be fined under this title or imprisoned not more than

20 10 years, or both.

21 ‘‘§ 1536. Knowing and unlawful use or disclosure of

22 protected health information

23 ‘‘Whoever knowingly uses or discloses protected

24 health information in violation of the Fair Health Infor25 mation Practices Act of 1997, knowing that such use or
81

•HR 52 IH

1 disclosure is unlawful, shall be fined under this title or

2 imprisoned not more than 5 years, or both.

3 ‘‘§ 1537. Monetary gain from knowing and unlawful

4 sale, transfer, or use of protected health

5 information

6 ‘‘Whoever knowingly sells, transfers, or uses pro7 tected health information in violation of the Fair Health

8 Information Practices Act of 1997, knowing that such

9 sale, transfer, or use is unlawful, shall be fined under this

10 title or imprisoned not more than 10 years, or both.’’.

11 (b) CLERICAL AMENDMENT.—The table of chapters

12 for part I of title 18, United States Code, is amended by

13 inserting after the item relating to chapter 73 the

14 following:

‘‘74. Obtaining protected health information ......................... 1531’’.

15 TITLE II—AMENDMENTS TO

16 TITLE 5, UNITED STATES CODE

17 SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.

18 (a) NEW SUBSECTION.—Section 552a of title 5,

19 United States Code, is amended by adding at the end the

20 following:

21 ‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen22 cy that is a health information trustee (as defined in sec23 tion 3(b)(5) of the Fair Health Information Practices Act

24 of 1997) shall promulgate rules, in accordance with the
82

•HR 52 IH

1 requirements (including general notice) of subsections

2 (b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this

3 title, to exempt a system of records within the agency, to

4 the extent that the system of records contains protected

5 health information (as defined in section 3(a)(3) of such

6 Act), from all provisions of this section except subsections

7 (e)(1), (e)(2), subparagraphs (A) through (C) and (E)

8 through (I) of subsection (e)(4), and subsections (e)(5),

9 (e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.

10 (b) REPEAL.—Section 552a(f)(3) of title 5, United

11 States Code, is amended by striking ‘‘pertaining to him,’’

12 and all that follows through the semicolon and inserting

13 ‘‘pertaining to the individual;’’.

14 TITLE III—REGULATIONS, RE15 SEARCH, AND EDUCATION;

16 EFFECTIVE DATES; APPLICA17 BILITY; AND RELATIONSHIP

18 TO OTHER LAWS

19 SEC. 301. REGULATIONS; RESEARCH AND EDUCATION.

20 (a) REGULATIONS.—Not later than July 1, 1999, the

21 Secretary shall prescribe regulations to carry out this Act.

22 (b) RESEARCH AND TECHNICAL SUPPORT.—The

23 Secretary may sponsor—

24 (1) research relating to the privacy and security

25 of protected health information;
83

•HR 52 IH

1 (2) the development of consent forms governing

2 disclosure of such information; and

3 (3) the development of technology to implement

4 standards regarding such information.

5 (c) EDUCATION.—The Secretary shall establish edu6 cation and awareness programs—

7 (1) to foster adequate security practices by

8 health information trustees;

9 (2) to train personnel of health information

10 trustees respecting the duties of such personnel with

11 respect to protected health information; and

12 (3) to inform individuals and employers who

13 purchase health care respecting their rights with re14 spect to such information.

15 (d) OFFICE OF INFORMATION PRIVACY.—

16 (1) ESTABLISHMENT.—There is established in

17 the Department of Health and Human Services,

18 within the Office of the Secretary, an Office of In19 formation Privacy. The Office of Information Pri20 vacy shall be headed by a Director, who shall also

21 be the Privacy Adviser of the Department of Health

22 and Human Services. The Director shall be the prin23 cipal adviser to the Secretary on the effect of the use

24 and disclosure of personally-identifiable information

25 on the privacy of individuals.
84

•HR 52 IH

1 (2) DUTIES.—The Director of the Office of In2 formation Privacy shall—

3 (A) monitor and participate in the develop4 ment of regulations under this Act;

5 (B) monitor the implementation of this Act

6 within the Department of Health and Human

7 Services;

8 (C) advise the Secretary of the effects of

9 current activities and proposed statutory, regu10 latory, administrative, and budgetary actions on

11 the information privacy of individuals;

12 (D) monitor the implementation within the

13 Department of Health and Human Services of

14 laws and policies affecting the confidentiality of

15 personally-identifiable health information or

16 other personally-identifiable information;

17 (E) advise the Secretary on the implica18 tions for privacy of automated systems for the

19 collection, storage, analysis, or transfer of per20 sonally-identifiable health information or other

21 personally-identifiable information;

22 (F) engage in, or commission, research and

23 technical studies on the implications of policies

24 and practices for information privacy promul25 gated by the Secretary;
85

•HR 52 IH

1 (G) serve as a point of contact within the

2 Department of Health and Human Services for

3 persons, such as other agencies of the Federal

4 Government, States, foreign governments, inter5 national organizations, privacy and consumer

6 advocacy organizations, businesses, nonprofit

7 organizations, and individuals, interested in the

8 effects on privacy of the collection, mainte9 nance, use, and disclosure of personally-identifi10 able health information or other personally11 identifiable information; and

12 (H) report from time to time to the Sec13 retary, the Congress, and the public on privacy

14 matters.

15 SEC. 302. EFFECTIVE DATES.

16 (a) IN GENERAL.—Except as provided in subsection

17 (b), this Act, and the amendments made by this Act, shall

18 take effect on January 1, 2000.

19 (b) PROVISIONS EFFECTIVE IMMEDIATELY.—

20 (1) IN GENERAL.—A provision of this Act shall

21 take effect on the date of the enactment of this Act

22 if the provision—

23 (A) imposes a duty on the Secretary to de24 velop, establish, or promulgate regulations,
86

•HR 52 IH

1 guidelines, notices, statements, or education

2 and awareness programs; or

3 (B) authorizes the Secretary to sponsor re4 search or the development of forms or tech5 nology.

6 (2) OFFICE OF INFORMATION PRIVACY.—Sec7 tion 301(d) (relating to the Office of Information

8 Privacy) shall take effect on the date of the enact9 ment of this Act.

10 SEC. 303. APPLICABILITY.

11 (a) PROTECTED HEALTH INFORMATION.—Except as

12 provided in subsections (b) and (c), the provisions of this

13 Act shall apply to any protected health information that

14 is received, created, used, maintained, or disclosed by a

15 health information trustee in a State on or after January

16 1, 2000, regardless of whether the information existed or

17 was disclosed prior to such date.

18 (b) EXCEPTION.—

19 (1) IN GENERAL.—The provisions of this Act

20 shall not apply to a trustee described in paragraph

21 (2), except with respect to protected health informa22 tion that is received by the trustee on or after Janu23 ary 1, 2000.

24 (2) APPLICABILITY.—A trustee referred to in

25 paragraph (1) is—
87

•HR 52 IH

1 (A) a health researcher; or

2 (B) a person who, with respect to specific

3 protected health information, received the infor4 mation—

5 (i) pursuant to—

6 (I) section 117 (relating to emer7 gency circumstances);

8 (II) section 118 (relating to judi9 cial and administrative purposes);

10 (III) section 119 (relating to law

11 enforcement); or

12 (IV) section 120 (relating to sub13 poenas, warrants, and search war14 rants); or

15 (ii) while acting in whole or in part in

16 the capacity of an officer or employee of a

17 person described in clause (i).

18 (c) AUTHORIZATIONS FOR DISCLOSURES.—An au19 thorization for the disclosure of protected health informa20 tion about a protected individual that is executed by the

21 individual before January 1, 2000, and is recognized and

22 valid under State law on December 31, 1999, shall remain

23 valid and shall not be subject to the requirements of sec24 tion 112 until January 1, 2001, or the occurrence of the
88

•HR 52 IH

1 date or event (if any) specified in the authorization upon

2 which the authorization expires, whichever occurs earlier.

3 SEC. 304. RELATIONSHIP TO OTHER LAWS.

4 (a) STATE LAW.—Except as otherwise provided in

5 subsections (b), (c), (d), (e), and (g), a State may not es6 tablish, continue in effect, or enforce any State law to the

7 extent that the law is inconsistent with, or imposes addi8 tional requirements with respect to, any of the following:

9 (1) A duty of a health information trustee

10 under this Act.

11 (2) An authority of a health information trustee

12 under this Act to disclose protected health informa13 tion.

14 (3) A provision of subtitle C (relating to access

15 procedures and challenge rights), subtitle D (mis16 cellaneous provisions), or subtitle E (relating to en17 forcement).

18 (b) LAWS RELATING TO PUBLIC HEALTH AND MEN19 TAL HEALTH.—This Act does not preempt, supersede, or

20 modify the operation of any State law regarding public

21 health or mental health to the extent that the law prohibits

22 or regulates a disclosure of protected health information

23 that is permitted under this Act.
89

•HR 52 IH

1 (c) CRIMINAL PENALTIES.—A State may establish

2 and enforce criminal penalties with respect to a failure to

3 comply with a provision of this Act.

4 (d) REQUIREMENTS ON STATE AGENCIES.—A State

5 may establish, continue in effect, and enforce any State

6 law to the extent that the law imposes on a judicial, legis7 lative, or executive agency of the State a requirement, lim8 itation, or procedure with respect to the use or disclosure

9 of protected health information that is in addition to the

10 requirements, limitations, and procedures imposed under

11 this Act.

12 (e) PRIVILEGES.—A privilege that a person has

13 under law in a court of a State or the United States or

14 under the rules of any agency of a State or the United

15 States may not be diminished, waived, or otherwise af16 fected by—

17 (1) the execution by a protected individual of an

18 authorization for disclosure of protected health in19 formation under this Act, if the authorization is exe20 cuted for the purpose of receiving health care or pro21 viding for the payment for health care; or

22 (2) any provision of this Act that authorizes the

23 disclosure of protected health information for the

24 purpose of receiving health care or providing for the

25 payment for health care.
90

•HR 52 IH

1 (f) DEPARTMENT OF VETERANS AFFAIRS.—The lim2 itations on use and disclosure of protected health informa3 tion under this Act shall not be construed to prevent any

4 exchange of such information within and among compo5 nents of the Department of Veterans Affairs that deter6 mine eligibility for or entitlement to, or that provide, bene7 fits under laws administered by the Secretary of Veterans

8 Affairs.

9 (g) CERTAIN DUTIES UNDER STATE OR FEDERAL

10 LAW.—This Act shall not be construed to preempt, super11 sede, or modify the operation of any of the following:

12 (1) Any law that provides for the reporting of

13 vital statistics such as birth or death information.

14 (2) Any law requiring the reporting of abuse or

15 neglect information about any individual.

16 (3) Subpart II of part E of title XXVI of the

17 Public Health Service Act (relating to notifications

18 of emergency response employees of possible expo19 sure to infectious diseases).

20 (4) The Americans with Disabilities Act of

21 1990.

22 (5) Any Federal or State statute that estab23 lishes a privilege for records used in health profes24 sional peer review activities.

25 (h) SECRETARIAL AUTHORITY.—
91

•HR 52 IH

1 (1) SECRETARY OF HEALTH AND HUMAN SERV2 ICES.—A provision of this Act does not preempt, su3 persede, or modify the operation of section 543 of

4 the Public Health Service Act, except to the extent

5 that the Secretary of Health and Human Services

6 determines through regulations promulgated by such

7 Secretary that the provision provides greater protec8 tion for protected health information, and the rights

9 of protected individuals, than is provided under such

10 section 543.

11 (2) SECRETARY OF VETERANS AFFAIRS.—A

12 provision of this Act does not preempt, supersede, or

13 modify the operation of section 7332 of title 38,

14 United States Code, except to the extent that the

15 Secretary of Veterans Affairs determines through

16 regulations promulgated by such Secretary that the

17 provision provides greater protection for protected

18 health information, and the rights of protected indi19 viduals, than is provided under such section 7332.

Æ