Protecting Jessica Grubb's Legacy Act

To amend the Public Health Service Act to protect the confidentiality of substance use disorder patient records. 1. Short title This Act may be cited as the ‘Protecting Jessica Grubb’s Legacy Act' 2. Confidentiality and disclosure of records relating to substance use disorder (a) Conforming changes relating to substance use disorder Subsections (a) and (h) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 substance abuse substance use disorder (b) Disclosures to covered entities consistent with HIPAA Paragraph (1) of section 543(b) of the Public Health Service Act ( 42 U.S.C. 290dd–2(b) (1) Consent The following shall apply with respect to the contents of any record referred to in subsection (a): (A) Such contents may be used or disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained. (B) Once prior written consent of the patient has been obtained, such contents may be used or disclosed by a covered entity, business associate, or a program subject to this section for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations. Any information so disclosed may then be redisclosed in accordance with the HIPAA regulations. Section 13405(c) of the Health Information Technology and Clinical Health Act ( 42 U.S.C. 17935(c) (C) It shall be permissible for a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until such time as the patient revokes such consent in writing. (D) Section 13405(a) of the Health Information Technology and Clinical Health Act ( 42 U.S.C. 17935(a) . (c) Disclosures of de-Identified health information to public health authorities Paragraph (2) of section 543(b) of the Public Health Service Act ( 42 U.S.C. 290dd–2(b) (D) To a public health authority, so long as such content meets the standards established in section 164.514(b) of title 45, Code of Federal Regulations (or successor regulations) for creating de-identified information. . (d) Definitions Section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (k) Definitions For purposes of this section: (1) Breach The term breach (2) Business associate The term business associate (3) Covered entity The term covered entity (4) Health care operations The term health care operations (5) HIPPA regulations The term HIPAA regulations (6) Payment The term payment (7) Public health authority The term public health authority (8) Treatment The term treatment (9) Unsecured protected health information The term unprotected health information . (e) Use of records in criminal, civil, or administrative investigations, actions, or proceedings Subsection (c) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2(c) (c) Use of records in criminal, civil, or administrative contexts Except as otherwise authorized by a court order under subsection (b)(2)(C) or by the consent of the patient, a record referred to in subsection (a), or testimony relaying the information contained therein, may not be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority, including with respect to the following activities: (1) Such record or testimony shall not be entered into evidence in any criminal prosecution or civil action before a Federal or State court. (2) Such record or testimony shall not form part of the record for decision or otherwise be taken into account in any proceeding before a Federal, State, or local agency. (3) Such record or testimony shall not be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation. (4) Such record or testimony shall not be used in any application for a warrant. . (f) Penalties Subsection (f) of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (f) Penalties The provisions of sections 1176 and 1177 of the Social Security Act shall apply to a violation of this section to the extent and in the same manner as such provisions apply to a violation of part C of title XI of such Act. In applying the previous sentence— (1) the reference to this subsection this subsection (including as applied pursuant to section 543(f) of the Public Health Service Act) (2) in subsection (b) of such section 1176— (A) each reference to a penalty imposed under subsection (a) a penalty imposed under subsection (a) (including as applied pursuant to section 543(f) of the Public Health Service Act) (B) each reference to no damages obtained under subsection (d) no damages obtained under subsection (d) (including as applied pursuant to section 543(f) of the Public Health Service Act) . (g) Antidiscrimination Section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (i) Antidiscrimination (1) In general No entity shall discriminate against an individual on the basis of information received by such entity pursuant to an inadvertent or intentional disclosure of records, or information contained in records, described in subsection (a) in— (A) admission, access to, or treatment for health care; (B) hiring, firing, or terms of employment, or receipt of worker’s compensation; (C) the sale, rental, or continued rental of housing; (D) access to Federal, State, or local courts; or (E) access to, approval of, or maintenance of social services and benefits provided or funded by Federal, State, or local governments. (2) Recipients of Federal funds No recipient of Federal funds shall discriminate against an individual on the basis of information received by such recipient pursuant to an intentional or inadvertent disclosure of such records or information contained in records described in subsection (a) in affording access to the services provided with such funds. . (h) Notification in case of breach Section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (j) Notification in case of breach The provisions of section 13402 of the HITECH Act ( 42 U.S.C. 17932 . (i) Regulations (1) In general The Secretary of Health and Human Services, in consultation with appropriate Federal agencies, shall make such revisions to regulations as may be necessary for implementing and enforcing the amendments made by this section, such that such amendments shall apply with respect to uses and disclosures of information occurring on or after the date that is 12 months after the date of enactment of this Act. (2) Easily understandable notice of privacy practices Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services, in consultation with appropriate legal, clinical, privacy, and civil rights experts, shall update section 164.520 of title 45, Code of Federal Regulations, so that covered entities and entities creating or maintaining the records described in subsection (a) provide notice, written in plain language, of privacy practices regarding patient records referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (A) a statement of the patient’s rights, including self-pay patients, with respect to protected health information and a brief description of how the individual may exercise these rights (as required by subsection (b)(1)(iv) of such section 164.520); and (B) a description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient’s written authorization (as required by subsection (b)(2) of such section 164.520). (j) Rules of construction Nothing in this Act or the amendments made by this Act shall be construed to limit— (1) a patient’s right, as described in section 164.522 of title 45, Code of Federal Regulations, or any successor regulation, to request a restriction on the use or disclosure of a record referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (2) a covered entity’s choice, as described in section 164.506 of title 45, Code of Federal Regulations, or any successor regulation, to obtain the consent of the individual to use or disclose a record referred to in such section 543(a) to carry out treatment, payment, or health care operation. (k) Sense of Congress It is the sense of the Congress that— (1) any person treating a patient through a program or activity with respect to which the confidentiality requirements of section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 (2) patients have the right to request a restriction on the use or disclosure of a record referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a) (3) covered entities should make every reasonable effort to the extent feasible to comply with a patient’s request for a restriction regarding such use or disclosure; (4) for purposes of applying section 164.501 of title 45, Code of Federal Regulations, the definition of health care operations shall have the meaning given such term in such section, except that clause (v) of paragraph (6) shall not apply; and (5) programs creating records referred to in section 543(a) of the Public Health Service Act ( 42 U.S.C. 290dd–2(a)

Summary: Protecting Jessica Grubb's Legacy Act This bill more closely aligns the federal privacy standards applicable to substance-use disorder patient records with the relevant privacy and de-identification standards applicable to other records that contain personal health information for the purposes of (1) treatment, payment, and health care operations by health plans, providers, or clearinghouses; and (2) disclosures to public health authorities. The bill requires patients to give affirmative, written consent; once given, that consent applies to future disclosures. Such consent may be revoked by written request. The bill also (1) aligns criminal penalties for certain violations involving substance-use disorder patient records with the penalties that apply to violations involving other types of records containing personal health information; (2) expands the current prohibition against using substance-use disorder patient records in criminal proceedings to include any use in specified federal, state, and local criminal and civil actions; and (3) prohibits certain discrimination based on the release of such patient information with respect to access to treatment, employment, housing, and certain social services and benefits.