Protecting Jessica Grubb's Legacy Act

To amend the Public Health Service Act to protect the confidentiality of substance use disorder patient records. 1. Short title This Act may be cited as the Protecting Jessica Grubb’s Legacy Act 2. Confidentiality and disclosure of records relating to substance use disorder (a) Conforming changes relating to substance use disorder Subsections (a) and (h) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 substance abuse substance use disorder (b) Disclosures to covered entities consistent with HIPAA Paragraph (2) of section 543(b) of the Public Health Service Act ( 42 U.S.C. 290dd–2(b) (D) To a covered entity or to a program or activity described in subsection (a), for the purposes of treatment, payment, and health care operations, so long as such disclosure is made in accordance with HIPAA privacy regulation. Any redisclosure of information so disclosed may only be made in accordance with this section. . (c) Disclosures of de-Identified health information to public health authorities Paragraph (2) of section 543(b) of the Public Health Service Act ( 42 U.S.C. 290dd–2(b) (E) To a public health authority, so long as such content meets the standards established in section 164.514(b) of title 45, Code of Federal Regulations (or successor regulations) for creating de-identified information. . (d) Definitions Subsection (b) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (3) Definitions For purposes of this subsection: (A) Covered entity The term covered entity (B) Health care operations The term health care operations (C) HIPAA privacy regulation The term HIPAA privacy regulation (D) Individually identifiable health information The term individually identifiable health information (E) Payment The term payment (F) Public health authority The term public health authority (G) Treatment The term treatment . (e) Use of records in criminal, civil, or administrative investigations, actions, or proceedings Subsection (c) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (c) Use of records in criminal, civil, or administrative contexts Except as otherwise authorized by a court order under subsection (b)(2)(C) or by the consent of the patient, a record referred to in subsection (a) may not— (1) be entered into evidence in any criminal prosecution or civil action before a Federal or State court; (2) form part of the record for decision or otherwise be taken into account in any proceeding before a Federal agency; (3) be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation of a patient; or (4) be used in any application for a warrant. . (f) Penalties Subsection (f) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (f) Penalties The provisions of sections 1176 and 1177 of the Social Security Act shall apply to a violation of this section to the extent and in the same manner as such provisions apply to a violation of part C of title XI of such Act. In applying the previous sentence— (1) the reference to this subsection this subsection (including as applied pursuant to section 543(f) of the Public Health Service Act) (2) in subsection (b) of such section 1176— (A) each reference to a penalty imposed under subsection (a) a penalty imposed under subsection (a) (including as applied pursuant to section 543(f) of the Public Health Service Act) (B) each reference to no damages obtained under subsection (d) no damages obtained under subsection (d) (including as applied pursuant to section 543(f) of the Public Health Service Act) . (g) Antidiscrimination Section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (i) Antidiscrimination (1) In general No entity shall discriminate against an individual on the basis of information received by such entity pursuant to a disclosure made under subsection (b) in— (A) admission or treatment for health care; (B) hiring or terms of employment; (C) the sale or rental of housing; or (D) access to Federal, State, or local courts. (2) Recipients of Federal funds No recipient of Federal funds shall discriminate against an individual on the basis of information received by such recipient pursuant to a disclosure made under subsection (b) in affording access to the services provided with such funds. . (h) Notification in case of breach Section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (j) Notification in case of breach (1) Application of HITECH notification of breach provisions The provisions of section 13402 of the HITECH Act ( 42 U.S.C. 17932 (2) Definitions In this subsection, the terms covered entity unsecured protected health information . (i) Sense of Congress It is the sense of the Congress that any person treating a patient through a program or activity with respect to which the confidentiality requirements of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (j) Regulations (1) In general The Secretary of Health and Human Services, in consultation with appropriate Federal agencies, shall make such revisions to regulations as may be necessary for implementing and enforcing the amendments made by this section, such that such amendments shall apply with respect to uses and disclosures of information occurring on or after the date that is 12 months after the date of enactment of this Act. (2) Easily understandable notice of privacy practices Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services, in consultation with appropriate experts, shall update section 164.520 of title 45, Code of Federal Regulations, so that covered entities provide notice, written in plain language, of privacy practices regarding patient records referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (A) a statement of the patient’s rights, including self-pay patients, with respect to protected health information and a brief description of how the individual may exercise these rights (as required by paragraph (b)(1)(iv) of such section 164.520); and (B) a description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient’s written authorization (as required by paragraph (b)(2) of such section 164.520). (k) Development and dissemination of model training programs for substance use disorder patient records (1) Initial programs and materials Not later than 1 year after the date of the enactment of this Act, the Secretary of Health and Human Services (referred to in this subsection as the Secretary (A) Model programs and materials for training health care providers (including physicians, emergency medical personnel, psychiatrists, psychologists, counselors, therapists, nurse practitioners, physician assistants, behavioral health facilities and clinics, care managers, and hospitals, including individuals such as general counsels or regulatory compliance staff who are responsible for establishing provider privacy policies) concerning the permitted uses and disclosures, consistent with the standards and regulations governing the privacy and security of substance use disorder patient records promulgated by the Secretary under section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (B) Model programs and materials for training patients and their families regarding their rights to protect and obtain information under the standards and regulations described in subparagraph (A). (2) Requirements The model programs and materials described in subparagraphs (A) and (B) of paragraph (1) shall address circumstances under which disclosure of substance use disorder patient records is needed to— (A) facilitate communication between substance use disorder treatment providers and other health care providers to promote and provide the best possible integrated care; (B) avoid inappropriate prescribing that can lead to dangerous drug interactions, overdose, or relapse; and (C) notify and involve families and caregivers when individuals experience an overdose. (3) Periodic updates The Secretary shall— (A) periodically review and update the model programs and materials identified or developed under paragraph (1); and (B) disseminate such updated programs and materials to the individuals described in paragraph (1)(A). (4) Input of certain entities In identifying, reviewing, or updating the model programs and materials under this subsection, the Secretary shall solicit the input of relevant stakeholders. (l) Rules of construction Nothing in this Act or the amendments made by this Act shall be construed to limit— (1) a patient’s right, as described in section 164.522 of title 45, Code of Federal Regulations, or any successor regulation, to request a restriction on the use or disclosure of a record referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (2) a covered entity’s choice, as described in section 164.506 of title 45, Code of Federal Regulations, or any successor regulation, to obtain the consent of the individual to use or disclose a record referred to in such section 543(a) to carry out treatment, payment, or health care operation. (m) Sense of Congress It is the sense of the Congress that— (1) patients have the right to request a restriction on the use or disclosure of a record referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (2) covered entities should make every reasonable effort to the extent feasible to comply with a patient’s request for a restriction regarding such use or disclosure.

Summary: Protecting Jessica Grubb's Legacy Act This bill more closely aligns the federal privacy standards for substance use disorder (SUD) patient records with the standards under the Health Insurance Portability and Accountability Act (HIPAA). Specifically, the bill authorizes the disclosure of SUD patient records without a patient's written consent to: (1) a covered entity for the purposes of treatment, payment, and health care operations, as long as the disclosure is made in accordance with HIPAA; and (2) a public health authority, as long as the content of the disclosure meets HIPAA standards regarding de-identified information. Current law authorizes disclosure of SUD patient records without a patient's written consent only to medical personnel in a medical emergency, to specified personnel for research or program evaluations, or pursuant to a court order. The bill also repeals and replaces criminal penalties for certain violations involving SUD patient records with the HIPAA civil penalty structure. It also applies HIPAA criminal penalties to wrongful disclosures of SUD patient records. In addition, the bill expands the current prohibition against using SUD patient records in criminal proceedings to include any use in specified federal, state, and local criminal and civil actions. The bill prohibits certain discrimination based on the release of SUD information under this bill.