Sec. 3. Definitions.
TITLE I—FAIR HEALTH INFORMATION PRACTICES
Subtitle A—Duties of Health Information Trustees
Sec. 101. Inspection of protected health information.
Sec. 102. Amendment of protected health information.
Sec. 103. Notice of information practices.
Sec. 104. Accounting for disclosures.
Sec. 105. Security.
Subtitle B—Use and Disclosure of Protected Health Information
Sec. 111. General limitations on use and disclosure.
Sec. 112. Authorizations for disclosure of protected health information.
Sec. 113. Treatment, payment, and oversight.
Sec. 114. Next of kin and directory information.
Sec. 115. Public health.
Sec. 116. Health research.
Sec. 117. Emergency circumstances.
Sec. 118. Judicial and administrative purposes.
Sec. 119. Law enforcement.
Sec. 120. Subpoenas, warrants, and search warrants.
Sec. 121. Health information service organizations.
Subtitle C—Access Procedures and Challenge Rights
Sec. 131. Access procedures for law enforcement subpoenas, warrants, and
search warrants.
Sec. 132. Challenge procedures for law enforcement subpoenas.
Sec. 133. Access and challenge procedures for other subpoenas.
Sec. 134. Construction of subtitle; suspension of statute of limitations.
Sec. 135. Responsibilities of Secretary.
Subtitle D—Miscellaneous Provisions
Sec. 141. Payment card and electronic payment transactions.
Sec. 142. Access to protected health information outside of the United States.
Sec. 143. Standards for electronic documents and communications.
Sec. 144. Duties and authorities of affiliated persons.
Sec. 145. Agents and attorneys.
Sec. 146. Minors.
Sec. 147. Maintenance of certain protected health information.
Subtitle E—Enforcement
Sec. 151. Civil actions.
Sec. 152. Civil money penalties.
Sec. 153. Alternative dispute resolution.
Sec. 154. Amendments to criminal law.
TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE
Sec. 201. Amendments to title 5, United States Code.
TITLE III—REGULATIONS, RESEARCH, AND EDUCATION; EFFEC-
TIVE DATES; APPLICABILITY; AND RELATIONSHIP TO OTHER
LAWS
Sec. 301. Regulations; research and education.
Sec. 302. Effective dates.
Sec. 303. Applicability.
Sec. 304. Relationship to other laws.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds as follows:
(1) The right to privacy is a personal and fun-
damental right protected by the Constitution of the
United States.
(2) The improper use or disclosure of personally
identifiable health information about an individual
may cause significant harm to the interests of the
individual in privacy and health care, and may un-
fairly affect the ability of the individual to obtain
employment, education, insurance, credit, and other
necessities.
(3) Current legal protections for health infor-
mation vary from State to State and are inadequate
to meet the need for fair information practices
standards.
(4) The movement of individuals and health in-
formation across State lines, access to and exchange
of health information from automated data banks
and networks, and the emergence of multistate
health care providers and payors create a compelling
need for uniform Federal law, rules, and procedures
governing the use, maintenance, and disclosure of
health information.
(5) Uniform rules governing the use, mainte-
nance, and disclosure of health information are an
essential part of health care reform, are necessary to
support the computerization of health information,
and can reduce the cost of providing health services
by making the necessary transfer of health informa-
tion more efficient.
(6) An individual needs access to health infor-
mation about the individual as a matter of fairness,
to enable the individual to make informed decisions
about health care, and to correct inaccurate or in-
complete information.
(b) PURPOSES.—The purposes of this Act are as
follows:
(1) To define the rights of an individual with
respect to health information about the individual
that is created or maintained as part of the health
treatment and payment process.
(2) To define the rights and responsibilities of
a person who creates or maintains individually iden-
tifiable health information that originates or is used
in the health treatment or payment process.
(3) To establish effective mechanisms to enforce
the rights and responsibilities defined in this Act.
SEC. 3. DEFINITIONS.
(a) 
DEFINITIONS
RELATING
TO
PROTECTED
HEALTH INFORMATION.—For purposes of this Act:
(1) DISCLOSE.—The term ‘‘disclose’’, when
used with respect to protected health information
that is held by a health information trustee, means
to provide access to the information, but only if such
access is provided by the trustee to a person other
than—
(A) the trustee or an officer or employee of
the trustee;
(B) an affiliated person of the trustee; or
(C) a protected individual who is a subject
of the information.
(2) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means the act or an instance of disclosing.
(3) PROTECTED HEALTH INFORMATION.—The
term ‘‘protected health information’’ means any in-
formation, whether oral or recorded in any form or
medium—
(A) that is created or received in a State
by—
(i) a health care provider;
(ii) a health benefit plan sponsor;
(iii) a health oversight agency;
(iv) a health information service orga-
nization; or
(v) a public health authority;
(B) that relates in any way to the past,
present, or future physical or mental health or
condition or functional status of a protected in-
dividual, the provision of health care to a pro-
tected individual, or payment for the provision
of health care to a protected individual; and
(C) that—
(i) identifies the individual; or
(ii) with respect to which there is a
reasonable basis to believe that the infor-
mation can be used to identify the individ-
ual.
(4) PROTECTED INDIVIDUAL.—The term ‘‘pro-
tected individual’’ means an individual who, with re-
spect to a date—
(A) is living on the date; or
(B) has died within the 2-year period end-
ing on the date.
(5) USE.—The term ‘‘use’’, when used with re-
spect to protected health information that is held by
a health information trustee, means—
(A) to use, or provide access to, the infor-
mation in any manner that does not constitute
a disclosure; or
(B) any act or instance of using, or provid-
ing access, described in subparagraph (A).
(b) DEFINITIONS RELATING TO HEALTH INFORMA-
TION TRUSTEES.—For purposes of this Act:
(1) CARRIER.—The term ‘‘carrier’’ means a li-
censed insurance company, a hospital or medical
service corporation (including an existing Blue Cross
or Blue Shield organization, within the meaning of
section 833(c)(2) of the Internal Revenue Code of
1986), a health maintenance organization, or other
entity licensed or certified by a State to provide
health insurance or health benefits.
(2) 
HEALTH
BENEFIT
PLAN.—The 
term
‘‘health benefit plan’’ means—
(A) any contract of health insurance, in-
cluding any hospital or medical service policy or
certificate, hospital or medical service plan con-
tract, or health maintenance organization group
contract, that is provided by a carrier; and
the information while acting in whole or in part in
the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by law to pro-
vide an item or service that constitutes health
care in the ordinary course of business or prac-
tice of a profession;
(B) a Federal or State program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(5) HEALTH INFORMATION SERVICE ORGANIZA-
TION.—The term ‘‘health information service organi-
zation’’ means a person who, with respect to a spe-
cific item of protected health information, receives,
creates, uses, maintains, or discloses the information
while acting in whole or in part in the capacity of—
(A) a person, other than an affiliated per-
son, who performs specific functions for which
the Secretary has authorized (by means of a
designation or certification) the person to re-
ceive access to specific health care data in elec-
tronic or magnetic form; or
(B) an officer or employee of a person de-
scribed in subparagraph (A).
(6) HEALTH
INFORMATION
TRUSTEE.—The
term ‘‘health information trustee’’ means—
(A) a health care provider;
(B) a health information service organiza-
tion;
(C) a health oversight agency;
(D) a health benefit plan sponsor;
(E) a public health authority;
(F) a health researcher;
(G) a person who, with respect to a spe-
cific item of protected health information, is not
described in subparagraphs (A) through (F) but
receives the information—
(i) pursuant to—
(I) section 117 (relating to emer-
gency circumstances);
(II) section 118 (relating to judi-
cial and administrative purposes);
(III) section 119 (relating to law
enforcement); or
(IV) section 120 (relating to sub-
poenas, warrants, and search war-
rants); or
(ii) while acting in whole or in part in
the capacity of an officer or employee of a
person described in clause (i).
(7) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
closes the information while acting in whole or in
part in the capacity of—
(A) a person who performs or oversees the
performance of an assessment, evaluation, de-
termination, or investigation relating to the li-
censing, accreditation, or certification of health
care providers;
(B) a person who—
(i) performs or oversees the perform-
ance of an audit, assessment, evaluation,
determination, or investigation relating to
the effectiveness of, compliance with, or
applicability of, legal, fiscal, medical, or
scientific standards or aspects of perform-
ance related to the delivery of, or payment
for, health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a State or Federal
statute regulating the assessment, evalua-
tion, determination, or investigation; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(8) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who, with respect to a
specific item of protected health information, re-
ceives the information—
(A) pursuant to section 116 (relating to
health research); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
(9) PUBLIC
HEALTH
AUTHORITY.—The term
‘‘public health authority’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
closes the information while acting in whole or in
part in the capacity of—
(A) an authority of the United States, a
State, or a political subdivision of a State that
is responsible for public health matters;
(B) a person acting under the direction of
such an authority; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(c) OTHER DEFINITIONS.—For purposes of this Act:
(1) AFFILIATED PERSON.—The term ‘‘affiliated
person’’ means a person who—
(A) is not a health information trustee;
(B) is a contractor, subcontractor, associ-
ate, or subsidiary of a person who is a health
information trustee; and
(C) pursuant to an agreement or other re-
lationship with such trustee, receives, creates,
uses, maintains, or discloses protected health
information.
(2) APPROVED HEALTH RESEARCH PROJECT.—
The term ‘‘approved health research project’’ means
a biomedical, epidemiological, or health services re-
search or statistics project, or a research project on
behavioral and social factors affecting health, that
has been approved by a certified institutional review
board.
(3) 
CERTIFIED
INSTITUTIONAL
REVIEW
BOARD.—The term ‘‘certified institutional review
board’’ means a board—
(A) established by an entity to review re-
search involving protected health information
and the rights of protected individuals con-
ducted at or supported by the entity;
(B) established in accordance with regula-
tions of the Secretary under section 116(d)(1);
and
(C) certified by the Secretary under section
116(d)(2).
(4) HEALTH CARE.—The term ‘‘health care’’—
(A) means—
(i) any preventive, diagnostic, thera-
peutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or proce-
dure—
(I) with respect to the physical or
mental condition, or functional status,
of an individual; or
(II) affecting the structure or
function of the human body or any
part of the human body, including
banking of blood, sperm, organs, or
any other tissue; or
(ii) any sale or dispensing of a drug,
device, equipment, or other item to an indi-
TITLE I—FAIR HEALTH
INFORMATION PRACTICES
Subtitle A—Duties of Health
Information Trustees
SEC. 101. INSPECTION OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—Except as provided in subsection
(b), a health information trustee described in subsection
(g)—
(1) shall permit a protected individual to in-
spect any protected health information about the in-
dividual that the trustee maintains, any accounting
with respect to such information required under sec-
tion 104, and any copy of an authorization required
under section 112 that pertains to such information;
(2) shall provide the protected individual with a
copy of the information upon request by the individ-
ual and subject to any conditions imposed by the
trustee under subsection (d);
(3) shall permit a person who has been des-
ignated in writing by the protected individual to in-
spect the information on behalf of the individual or
to accompany the individual during the inspection;
and
(4) may offer to explain or interpret informa-
tion that is inspected or copied under this sub-
section.
(b) EXCEPTIONS.—A health information trustee is
not required by this section to permit inspection or copy-
ing of protected health information by a protected individ-
ual if any of the following conditions apply:
(1) MENTAL
HEALTH
TREATMENT
NOTES.—
The information consists of psychiatric, psycho-
logical, or mental health treatment notes about the
individual, the trustee determines in the exercise of
reasonable professional judgment that inspection or
copying of the notes would cause sufficient harm to
the protected individual so as to outweigh the desir-
ability of permitting access, and the trustee does not
disclose the notes to any person not directly engaged
in treating the individual, except with the authoriza-
tion of the individual or under compulsion of law.
(2) INFORMATION ABOUT OTHERS.—The infor-
mation relates to an individual, other than the pro-
tected individual or a health care provider, and the
trustee determines in the exercise of reasonable pro-
fessional judgment that inspection or copying of the
information would cause sufficient harm to one or
both of the individuals so as to outweigh the desir-
ability of permitting access.
(3) ENDANGERMENT TO LIFE OR SAFETY.—In-
spection or copying of the information could reason-
ably be expected to endanger the life or physical
safety of an individual.
(4) CONFIDENTIAL SOURCE.—The information
identifies or could reasonably lead to the identifica-
tion of an individual (other than a health care pro-
vider) who provided information under a promise of
confidentiality to a health care provider concerning
a protected individual who is a subject of the infor-
mation.
(5) ADMINISTRATIVE PURPOSES.—The informa-
tion—
(A) is used by the trustee solely for admin-
istrative purposes and not in the provision of
health care to a protected individual who is a
subject of the information; and
(B) is not disclosed by the trustee to any
person.
(6) DUPLICATIVE INFORMATION.—The informa-
tion duplicates information available for inspection
under subsection (a).
(7) INFORMATION COMPILED IN ANTICIPATION
OF LITIGATION.—The information is compiled prin-
cipally—
(A) in anticipation of a civil, criminal, or
administrative action or proceeding; or
(B) for use in such an action or proceed-
ing.
(c) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee shall permit inspec-
tion and copying under subsection (a) of any reasonably
segregable portion of a record after deletion of any portion
that is exempt under subsection (b).
(d) CONDITIONS.—A health information trustee
may—
(1) require a written request for the inspection
and copying of protected health information under
this section; and
(2) charge a reasonable cost-based fee for—
(A) permitting inspection of information
under this section; and
(B) providing a copy of protected health
information under this section.
(e) STATEMENT OF REASONS FOR DENIAL.—If a
health information trustee denies in whole or in part a
request for inspection or copying under this section, the
trustee shall provide the protected individual who made
the request with a written statement of the reasons for
the denial.
(f) DEADLINE.—A health information trustee shall
comply with or deny a request for inspection or copying
of protected health information under this section within
the 30-day period beginning on the date the trustee re-
ceives the request.
(g) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health information service organization;
(4) a health oversight agency; or
(5) a public health authority.
SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (f) shall, within the 45-day period
beginning on the date the trustee receives from a protected
individual about whom the trustee maintains protected
health information a written request that the trustee cor-
rect or amend the information, complete the duties de-
scribed in one of the following paragraphs:
(1) CORRECTION OR AMENDMENT AND NOTIFI-
CATION.—The trustee shall—
(A) make the correction or amendment re-
quested;
(B) inform the protected individual of the
amendment or correction that has been made;
(C) make reasonable efforts to inform any
person who is identified by the protected indi-
vidual, who is not an employee of the trustee,
and to whom the uncorrected or unamended
portion of the information was previously dis-
closed of the correction or amendment that has
been made; and
(D) at the request of the individual, make
reasonable efforts to inform any known source
of the uncorrected or unamended portion of the
information about the correction or amendment
that has been made.
(2) REASONS FOR REFUSAL AND REVIEW PRO-
CEDURES.—The trustee shall inform the protected
individual of—
(A) the reasons for the refusal of the trust-
ee to make the correction or amendment;
(B) any procedures for further review of
the refusal; and
(C) the individual’s right to file with the
trustee a concise statement setting forth the re-
quested correction or amendment and the indi-
vidual’s reasons for disagreeing with the refusal
of the trustee.
(b) STANDARDS
FOR
CORRECTION
OR
AMEND-
MENT.—A trustee shall correct or amend protected health
information in accordance with a request made under sub-
section (a) if the trustee determines that the information
is not accurate, relevant, timely, or complete for the pur-
poses for which the information may be used or disclosed
by the trustee.
(c) STATEMENT OF DISAGREEMENT.—After a pro-
tected individual has filed a statement of disagreement
under subsection (a)(2)(C), the trustee, in any subsequent
disclosure of the disputed portion of the information, shall
include a copy of the individual’s statement and may in-
clude a concise statement of the trustee’s reasons for not
making the requested correction or amendment.
(d) CONSTRUCTION.—This section may not be con-
strued to require a health information trustee to conduct
a hearing or proceeding concerning a request for a correc-
tion or amendment to protected health information the
trustee maintains.
(e) CORRECTION.—For purposes of subsection (a), a
correction is deemed to have been made to protected
health information when—
(1) information that is not timely, accurate, rel-
evant, or complete is clearly marked as incorrect; or
(2) supplementary correct information is made
part of the information and adequately cross-ref-
erenced.
(f) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health information service organization;
(4) a health oversight agency; or
(5) a public health authority.
SEC. 103. NOTICE OF INFORMATION PRACTICES.
(a) PREPARATION OF NOTICE.—A health information
trustee described in subsection (d) shall prepare a written
notice of information practices describing the following:
(1) The rights under this Act of a protected in-
dividual who is the subject of protected health infor-
mation, including the right to inspect and copy such
information and the right to seek amendments to
such information, and the procedures for authorizing
disclosures of protected health information and for
revoking such authorizations.
(2) The procedures established by the trustee
for the exercise of such rights.
(3) The uses and disclosures of protected health
information that are authorized under this Act.
(b) DISSEMINATION OF NOTICE.—A health informa-
tion trustee—
(1) shall, upon request, provide any person with
a copy of the trustee’s notice of information prac-
tices (described in subsection (a)); and
(2) shall make reasonable efforts to inform per-
sons in a clear and conspicuous manner of the exist-
ence and availability of such notice.
(c) MODEL NOTICES.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate model notices of infor-
mation practices for use by health information trustees
under this section.
(d) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health information service organization; or
(4) a health oversight agency.
SEC. 104. ACCOUNTING FOR DISCLOSURES.
(a) IN GENERAL.—Except as provided in subsection
(b) and section 114, each health information trustee shall
create and maintain, with respect to any protected health
information the trustee discloses, a record of—
(1) the date and purpose of the disclosure;
(2) the name of the person to whom the disclo-
sure was made;
(3) the address of the person to whom the dis-
closure was made or the location to which the disclo-
sure was made; and
(4) where practicable, a description of the infor-
mation disclosed.
(b) REGULATIONS.—Not later than July 1, 1996, the
Secretary shall promulgate regulations that exempt a
health information trustee from maintaining a record
under subsection (a) with respect protected health infor-
mation disclosed by the trustee for purposes of peer
review, licensing, certification, accreditation, and similar
activities.
SEC. 105. SECURITY.
(a) IN GENERAL.—Each health information trustee
who receives or creates protected health information that
is subject to this Act shall maintain reasonable and appro-
priate administrative, technical, and physical safeguards—
(1) to ensure the integrity and confidentiality of
the information;
(2) to protect against any reasonably antici-
pated—
(A) threats or hazards to the security or
integrity of the information; and
(B) unauthorized uses or disclosures of the
information; and
(3) otherwise ensure compliance with this Act
by the trustee and the officers and employees of the
trustee.
(b) GUIDELINES.—Not later than July 1, 1996, the
Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate guidelines for the im-
plementation of this section. The guidelines shall take into
account—
(1) the technical capabilities of record systems
used to maintain protected health information;
(2) the costs of security measures;
(3) the need for training persons who have ac-
cess to protected health information; and
(4) the value of audit trails in computerized
record systems.
Subtitle B—Use and Disclosure of
Protected Health Information
SEC. 111. GENERAL LIMITATIONS ON USE AND DISCLO-
SURE.
(a) USE.—Except as otherwise provided under this
Act, a health information trustee may use protected health
information only for a purpose—
(1) that is compatible with and directly related
to the purpose for which the information—
(A) was collected; or
(B) was received by the trustee; or
(2) for which the trustee is authorized to dis-
close the information under this Act.
(b) DISCLOSURE.—A health information trustee may
disclose protected health information only as authorized
under this Act.
(c) SCOPE OF USES AND DISCLOSURES.—
(1) IN GENERAL.—A use or disclosure of pro-
tected health information by a health information
trustee shall be limited, when practicable, to the
minimum amount of information necessary to ac-
complish the purpose for which the information is
used or disclosed.
(2) GUIDELINES.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for pub-
lic comment, shall issue guidelines to implement
paragraph (1), which shall take into account the
technical capabilities of the record systems used to
maintain protected health information and the costs
of limiting use and disclosure.
(d) IDENTIFICATION OF DISCLOSED INFORMATION
AS PROTECTED INFORMATION.—Except with respect to
protected health information that is disclosed under sec-
tion 114 (relating to next of kin and directory informa-
tion), a health information trustee may disclose protected
health information only if the recipient has been notified
that the information is protected health information that
is subject to this Act.
(e) AGREEMENT TO LIMIT USE OR DISCLOSURE.—
A health information trustee who receives protected health
information from any person pursuant to a written agree-
ment to restrict use or disclosure of the information to
a greater extent than otherwise would be required under
this Act shall comply with the terms of the agreement,
except where use or disclosure of the information in viola-
tion of the agreement is required by law. A trustee who
fails to comply with the preceding sentence shall be subject
to section 151 (relating to civil actions) with respect to
such failure.
(f) NO GENERAL REQUIREMENT TO DISCLOSE.—
Nothing in this Act shall be construed to require a health
information trustee to disclose protected health informa-
tion not otherwise required to be disclosed by law.
SEC. 112. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION.
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee, other than a health information service orga-
nization, may disclose protected health information pursu-
ant to an authorization executed by the protected individ-
ual who is the subject of the information, if each of the
following requirements is satisfied:
(1) WRITING.—The authorization is in writing,
signed by the individual, and dated on the date of
such signature.
(2) SEPARATE FORM.—The authorization is not
on a form used to authorize or facilitate the provi-
sion of, or payment for, health care.
(3) TRUSTEE DESCRIBED.—The trustee is spe-
cifically named or generically described in the au-
thorization as authorized to disclose such informa-
tion.
(4) RECIPIENT
DESCRIBED.—The person to
whom the information is to be disclosed is specifi-
cally named or generically described in the author-
ization as a person to whom such information may
be disclosed.
(5) STATEMENT OF INTENDED USES AND DIS-
CLOSURES
RECEIVED.—The authorization contains
an acknowledgment that the individual has received
a statement described in subsection (b) from such
person.
(6) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is described in the authorization.
(7) AUTHORIZATION TIMELY RECEIVED.—The
authorization is received by the trustee during a pe-
riod described in subsection (c)(1).
(8) DISCLOSURE
TIMELY
MADE.—The disclo-
sure occurs during a period described in subsection
(c)(2).
(b) STATEMENT OF INTENDED USES AND DISCLO-
SURES.—
(1) IN GENERAL.—A person who wishes to re-
ceive from a health information trustee protected
health information about a protected individual pur-
suant to an authorization executed by the individual
shall supply the individual, in writing and on a form
that is distinct from the authorization, with a state-
ment of the uses for which the person intends the
information and the disclosures the person intends
to make of the information. Such statement shall be
supplied before the authorization is executed.
(2) ENFORCEMENT.—If the person uses or dis-
closes the information in a manner that is inconsist-
ent with such statement, the person shall be subject
to section 151 (relating to civil actions) with respect
to such failure, except where such use or disclosure
is required by law.
(3) MODEL STATEMENTS.—Not later than July
1, 1996, the Secretary, after notice and opportunity
for public comment, shall develop and disseminate
model statements of intended uses and disclosures of
the type described in paragraph (1).
(c) TIME LIMITATIONS ON AUTHORIZATIONS.—
(1) RECEIPT BY TRUSTEE.—For purposes of
subsection (a)(7), an authorization is timely received
if it is received by the trustee during—
(A) the 1-year period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to—
(i) a health benefit plan sponsor;
(ii) a health care provider;
(iii) a health oversight agency;
(iv) a public health authority;
(v) a health researcher; or
(vi) a person who provides counseling
or social services to individuals; or
(B) the 30-day period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to a
person other than a person described in sub-
paragraph (A).
(2) DISCLOSURE BY TRUSTEE.—For purposes
of subsection (a)(8), a disclosure is timely made if
it occurs before—
(A) the date or event (if any) specified in
the authorization upon which the authorization
expires; and
(B) the expiration of the 6-month period
beginning on the date the trustee receives the
authorization.
(d) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN
GENERAL.—A protected individual in
writing may revoke or amend an authorization de-
scribed in subsection (a), in whole or in part, at any
time, except insofar as—
(A) disclosure of protected health informa-
tion has been authorized to permit validation of
expenditures based on health condition by a
government authority; or
(B) action has been taken in reliance on
the authorization.
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation in reliance on an authorization that has been
revoked shall not be subject to any liability or pen-
alty under this Act if—
(A) the reliance was in good faith;
(B) the trustee had no notice of the rev-
ocation; and
(C) the disclosure was otherwise in accord-
ance with the requirements of this section.
(e) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A
health information trustee may impose requirements for
an authorization that are in addition to the requirements
in this section.
(f) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization.
(g) CONSTRUCTION.—This section may not be con-
strued—
(1) to require a health information trustee to
disclose protected health information; or
(2) to limit the right of a health information
trustee to charge a fee for the disclosure or repro-
duction of protected health information.
(h) SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.—If a health information trustee discloses pro-
tected health information pursuant to an authorization in
order to comply with an administrative subpoena or war-
rant or a judicial subpoena or search warrant, the author-
ization—
(1) shall specifically authorize the disclosure for
the purpose of permitting the trustee to comply with
the subpoena, warrant, or search warrant; and
(2) shall otherwise meet the requirements in
this section.
SEC. 113. TREATMENT, PAYMENT, AND OVERSIGHT.
(a) DISCLOSURES
BY
PLANS, PROVIDERS, AND
OVERSIGHT AGENCIES.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation to a health benefit plan sponsor, health care
provider, or health oversight agency if the disclosure is—
(1) for the purpose of providing health care and
a protected individual who is a subject of the infor-
mation has not previously objected to the disclosure
in writing;
(2) for the purpose of providing for the pay-
ment for health care furnished to an individual; or
(3) for use by a health oversight agency for a
purpose that is described in subparagraph (A) or
(B)(i) of section 3(b)(7).
(b) DISCLOSURES BY CERTAIN OTHER TRUSTEES.—
A health information trustee may disclose protected health
information to a health care provider if—
(1) the disclosure is for the purpose described
in subsection (a)(1); and
(2) the trustee—
(A) is a public health authority;
(B) received protected health information
pursuant to section 117 (relating to emergency
circumstances); or
(C) is an officer or employee of a trustee
described in subsection (B).
(c) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and related to receipt of health care or pay-
ment for health care.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
(4) A health information service organization.
SEC. 114. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—A health information trustee who
is a health care provider, who received protected health
information pursuant to section 117 (relating to emer-
gency circumstances), or who is an officer or employee of
such a recipient may orally disclose protected health infor-
mation about a protected individual to the next of kin of
the individual (as defined under State law), or to a person
with whom the individual has a close personal relationship,
if—
(1) the trustee has no reason to believe that the
individual would consider the information especially
sensitive;
(2) the individual has not previously objected to
the disclosure;
(3) the disclosure is consistent with good medi-
cal or other professional practice; and
(4) the information disclosed is limited to infor-
mation about health care that is being provided to
the individual at or about the time of the disclosure.
(b) DIRECTORY INFORMATION.—
(1) IN GENERAL.—A health information trustee
who is a health care provider, who received protected
health information pursuant to section 117 (relating
to emergency circumstances), or who is an officer or
employee of a such a recipient may disclose to any
person the information described in paragraph (2)
if—
(A) a protected individual who is a subject
of the information has not objected in writing
to the disclosure;
(B) the disclosure is otherwise consistent
with good medical and other professional prac-
tice; and
(C) the information does not reveal specific
information about the physical or mental condi-
tion or functional status of a protected individ-
ual or about the health care provided to a pro-
tected individual.
(2) INFORMATION
DESCRIBED.—The informa-
tion referred to in paragraph (1) is the following:
(A) The name of an individual receiving
health care from a health care provider on a
premises controlled by the provider.
(B) The location of the individual on such
premises.
(C) The general health status of the indi-
vidual, described in terms of critical, poor, fair,
stable, satisfactory, or terms denoting similar
conditions.
(c) NO ACCOUNTING REQUIRED.—A health informa-
tion trustee who discloses protected health information
under this section is not required to maintain an account-
ing of the disclosure under section 104.
(d) RECIPIENTS.—A person to whom protected
health information is disclosed under this section shall not,
by reason of such disclosure, be subject to any require-
ment under this Act.
SEC. 115. PUBLIC HEALTH.
(a) IN GENERAL.—A health information trustee who
is a health care provider or a public health authority may
disclose protected health information to—
(1) a public health authority for use in legally
authorized—
(A) disease or injury reporting;
(B) public health surveillance; or
(C) public health investigation or interven-
tion; or
(2) an individual who is authorized by law to
receive the information in a public health interven-
tion.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A public
health authority who receives protected health information
about a protected individual through a disclosure under
this section may not use or disclose the information in any
administrative, civil, or criminal action or investigation di-
rected against the individual, except where the use or dis-
closure is authorized by law for protection of the public
health.
(c) INDIVIDUAL
RECIPIENTS.—An individual to
whom protected health information is disclosed under sub-
section (a)(2) shall not, by reason of such disclosure, be
subject to any requirement under this Act.
SEC. 116. HEALTH RESEARCH.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation to a person if—
(1) the person is conducting an approved health
research project;
(2) the information is to be used in the project;
and
(3) the project has been determined by a cer-
tified institutional review board to be—
(A) of sufficient importance so as to out-
weigh the intrusion into the privacy of the pro-
tected individual who is the subject of the infor-
mation that would result from the disclosure;
and
(B) impracticable to conduct without the
information.
(b) DISCLOSURES BY HEALTH INFORMATION SERV-
ICE ORGANIZATIONS.—A health information service orga-
nization may disclose protected health information under
subsection (a) only if the certified institutional review
board referred to in subsection (a)(3) has been certified
as being qualified to make determinations under such sub-
section with respect to disclosures by such organizations.
(c) LIMITATIONS ON USE AND DISCLOSURE; OBLIGA-
TIONS OF RECIPIENT.—A health researcher who receives
protected health information about a protected individual
pursuant to subsection (a)—
(1) may use the information solely for purposes
of an approved health research project;
(2) may not use or disclose the information in
any administrative, civil, or criminal action or inves-
tigation directed against the individual; and
(3) shall remove or destroy, at the earliest op-
portunity consistent with the purposes of the ap-
proved health research project in connection with
which the disclosure was made, information that
would enable an individual to be identified, unless a
certified institutional review board has determined
that there is a health or research justification for re-
tention of such identifiers and there is an adequate
plan to protect the identifiers from use and disclo-
sure that is inconsistent with this Act.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any health information
trustee other than a person who, with respect to the spe-
cific protected health information to be disclosed under
such subsection, received the information—
(1) pursuant to—
(A) section 118 (relating to judicial and
administrative purposes);
(B) paragraph (1), (2), (3), or (4) of sec-
tion 119(a) (relating to law enforcement); or
(C) section 120 (relating to subpoenas,
warrants, and search warrants); or
(2) while acting in whole or in part in the ca-
pacity of an officer or employee of a person de-
scribed in paragraph (1).
(e) REQUIREMENTS
FOR INSTITUTIONAL REVIEW
BOARDS.—
(1) REGULATIONS.—Not later than July 1,
1996, the Secretary, after opportunity for notice and
comment, shall promulgate regulations establishing
requirements for certified institutional review boards
under this Act. The regulations shall be based on
regulations promulgated under section 491(a) of the
Public Health Service Act and shall ensure that cer-
tified institutional review boards are qualified to as-
sess and protect the confidentiality of research sub-
jects. The regulations shall include specific require-
ments for certified institutional review boards that
make determinations under subsection (a)(3) with
respect to disclosures by health information service
organizations.
(2) CERTIFICATION.—The Secretary shall cer-
tify that an institutional review board satisfies the
requirements of the regulations promulgated under
paragraph (1).
SEC. 117. EMERGENCY CIRCUMSTANCES.
(a) IN GENERAL.—A health information trustee may
disclose protected health information if the trustee be-
lieves, on reasonable grounds, that the disclosure is nec-
essary to prevent or lessen a serious and imminent threat
to the health or safety of an individual.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and related to receipt of health care or pay-
ment for health care.
SEC. 118. JUDICIAL AND ADMINISTRATIVE PURPOSES.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation—
(1) pursuant to the Federal Rules of Civil Pro-
cedure, the Federal Rules of Criminal Procedure, or
comparable rules of other courts or administrative
agencies in connection with litigation or proceedings
to which a protected individual who is a subject of
the information is a party and in which the individ-
ual has placed the individual’s physical or mental
condition or functional status in issue;
(2) if directed by a court in connection with a
court-ordered examination of an individual; or
(3) to assist in the identification of a dead
individual.
(b) WRITTEN STATEMENT.—A person seeking pro-
tected health information about a protected individual held
by health information trustee under—
(1) subsection (a)(1)—
(A) shall notify the protected individual or
the attorney of the protected individual of the
request for the information;
(B) shall provide the trustee with a signed
document attesting—
(i) that the protected individual is a
party to the litigation or proceedings for
which the information is sought;
(ii) that the individual has placed the
individual’s physical or mental condition or
functional status in issue; and
(iii) the date on which the protected
individual or the attorney of the protected
individual was notified under subparagraph
(A); and
(C) shall not accept any requested pro-
tected health information from the trustee until
the termination of the 10-day period beginning
on the date notice was given under subpara-
graph (A); or
(2) subsection (a)(3) shall provide the trustee
with a written statement that the information is
sought to assist in the identification of a dead
individual.
(c) USE AND DISCLOSURE.—A person to whom pro-
tected health information is disclosed under this section
may use and disclose the information only to accomplish
the purpose for which the disclosure was made.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
(4) A person who, with respect to the specific
protected health information to be disclosed under
such subsection, received the information—
(A) pursuant to—
(i) section 117 (relating to emergency
circumstances); or
(ii) section 120 (relating to subpoe-
nas, warrants, and search warrants); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
SEC. 119. LAW ENFORCEMENT.
(a) IN GENERAL.—A health information trustee,
other than a health information service organization, may
disclose protected health information to a law enforcement
agency, other than a health oversight agency—
(1) if the information is disclosed for use in an
investigation or prosecution of a health information
trustee;
(2) in connection with criminal activity commit-
ted against the trustee or an affiliated person of the
trustee or on premises controlled by the trustee; or
(3) if the information is needed to determine
whether a crime has been committed and the nature
of any crime that may have been committed (other
than a crime that may have been committed by the
protected individual who is the subject of the infor-
mation).
(b) ADDITIONAL AUTHORITY OF CERTAIN TRUST-
EES.—A health information trustee who is not a health
information service organization, a public health author-
ity, or a health researcher may disclose protected health
information to a law enforcement agency (other than a
health oversight agency)—
(1) to assist in the identification or location of
a victim, fugitive, or witness in a law enforcement
inquiry;
(2) pursuant to a law requiring the reporting of
specific health care information to law enforcement
authorities; or
(3) if the information is specific health informa-
tion described in paragraph (2) and the trustee is
operated by a Federal agency;
(c) CERTIFICATION.—Where a law enforcement agen-
cy requests a health information trustee to disclose pro-
tected health information under subsection (a) or (b)(1),
the agency shall provide the trustee with a written certifi-
cation that—
(1) is signed by a supervisory official of a rank
designated by the head of the agency;
(2) specifies the information requested; and
(3) states that the information is needed for a
lawful purpose under this section.
(d) RESTRICTIONS ON DISCLOSURE AND USE.—A
person who receives protected health information about a
protected individual through a disclosure under this sec-
tion may not use or disclose the information—
(1) in any administrative, civil, or criminal ac-
tion or investigation directed against the individual,
except an action or investigation arising out of and
directly related to the action or investigation for
which the information was obtained; and
(2) otherwise unless the use or disclosure is
necessary to fulfill the purpose for which the infor-
mation was obtained and is not prohibited by any
other provision of law.
SEC. 120. SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (g) may disclose protected health in-
formation if the disclosure is pursuant to any of the fol-
lowing:
(1) A subpoena issued under the authority of a
grand jury and the trustee is provided a written cer-
tification by the grand jury that the grand jury has
complied with the applicable access provisions of sec-
tion 5151.
(2) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the trust-
ee is provided a written certification by the person
seeking the information that the person has com-
plied with the applicable access provisions of section
131 or 133(a).
(3) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the dis-
closure otherwise meets the conditions of one of sec-
tions 113 through 119.
(b) AUTHORITY OF ALL TRUSTEES.—Any health in-
formation trustee may disclose protected health informa-
tion if the disclosure is pursuant to subsection (a)(3).
(c) RESTRICTIONS ON USE AND DISCLOSURE.—Pro-
tected health information about a protected individual that
is disclosed by a health information trustee pursuant to—
(1) subsection (a)(2) may not be otherwise used
or disclosed by the recipient unless the use or disclo-
sure is necessary to fulfill the purpose for which the
information was obtained; and
(2) subsection (a)(3) may not be used or dis-
closed by the recipient unless the recipient complies
with the conditions and restrictions on use and dis-
closure with which the recipient would have been re-
quired to comply if the disclosure by the trustee had
been made under the section referred to in sub-
section (a)(3) the conditions of which were met by
the disclosure.
(d) RESTRICTIONS ON GRAND JURIES.—Protected
health information that is disclosed by a health informa-
tion trustee under subsection (a)(1)—
(1) shall be returnable on a date when the
grand jury is in session and actually presented to
the grand jury;
(2) shall be used only for the purpose of consid-
ering whether to issue an indictment or report by
that grand jury, or for the purpose of prosecuting a
crime for which that indictment or report is issued,
or for a purpose authorized by rule 6(e) of the Fed-
eral Rules of Criminal Procedure or a comparable
State rule;
(3) shall be destroyed or returned to the trustee
if not used for one of the purposes specified in para-
graph (2); and
(4) shall not be maintained, or a description of
the contents of such information shall not be main-
tained, by any government authority other than in
the sealed records of the grand jury, unless such in-
formation has been used in the prosecution of a
crime for which the grand jury issued an indictment
or presentment or for a purpose authorized by rule
6(e) of the Federal Rules of Criminal Procedure or
a comparable State rule.
(e) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and directly related to the inquiry for which
the information was obtained;
(f) CONSTRUCTION.—Nothing in this section shall be
construed as authority for a health information trustee to
refuse to comply with a valid administrative subpoena or
warrant or a valid judicial subpoena or search warrant
that meets the requirements of this Act.
(g) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any trustee other than the
following:
(1) A health information service organization.
(2) A public health authority.
(3) A health researcher.
SEC. 121. HEALTH INFORMATION SERVICE ORGANIZA-
TIONS.
A health information trustee may disclose protected
health information to a health information service organi-
zation for the purpose of permitting the organization to
perform a function for which the Secretary has authorized
(by means of a designation or certification) the organiza-
tion to receive access to specific health care data in elec-
tronic or magnetic form.
Subtitle C—Access Procedures and
Challenge Rights
SEC. 131. ACCESS PROCEDURES FOR LAW ENFORCEMENT
SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) PROBABLE CAUSE REQUIREMENT.—A govern-
ment authority may not obtain protected health informa-
tion about a protected individual from a health informa-
tion trustee under paragraph (1) or (2) of section 120(a)
for use in a law enforcement inquiry unless there is prob-
able cause to believe that the information is relevant to
a legitimate law enforcement inquiry being conducted by
the government authority.
(b) WARRANTS AND SEARCH WARRANTS.—A govern-
ment authority that obtains protected health information
about a protected individual from a health information
trustee under circumstances described in subsection (a)
and pursuant to a warrant or search warrant shall, not
later than 30 days after the date the warrant was served
on the trustee, serve the individual with, or mail to the
last known address of the individual, a copy of the war-
rant.
(c) SUBPOENAS.—Except as provided in subsection
(d), a government authority may not obtain protected
health information about a protected individual from a
health information trustee under circumstances described
in subsection (a) and pursuant to a subpoena unless a
copy of the subpoena has been served by hand delivery
upon the individual, or mailed to the last known address
of the individual, on or before the date on which the sub-
poena was served on the trustee, together with a notice
(published by the Secretary under section 135(1)) of the
individual’s right to challenge the subpoena in accordance
with section 132, and—
(1) 30 days have passed from the date of serv-
ice, or 30 days have passed from the date of mailing,
and within such time period the individual has not
initiated a challenge in accordance with section 132;
or
(2) disclosure is ordered by a court under sec-
tion 132.
(d) APPLICATION FOR DELAY.—
(1) IN GENERAL.—A government authority may
apply to an appropriate court to delay (for an initial
period of not longer than 90 days) serving a copy of
a subpoena and a notice otherwise required under
subsection (c) with respect to a law enforcement in-
quiry. The government authority may apply to the
court for extensions of the delay.
(2) REASONS FOR DELAY.—An application for
a delay, or extension of a delay, under this sub-
section shall state, with reasonable specificity, the
reasons why the delay or extension is being sought.
(3) EX PARTE ORDER.—The court shall enter
an ex parte order delaying, or extending the delay
of, the notice and an order prohibiting the trustee
from revealing the request for, or the disclosure of,
the protected health information being sought if the
court finds that—
(A) the inquiry being conducted is within
the lawful jurisdiction of the government au-
thority seeking the protected health informa-
tion;
(B) there is probable cause to believe that
the protected health information being sought is
relevant to a legitimate law enforcement inquiry
being conducted by the government authority;
(C) the government authority’s need for
the information outweighs the privacy interest
of the protected individual who is the subject of
the information; and
(D) there are reasonable grounds to believe
that receipt of a notice by the individual will re-
sult in—
(i) endangering the life or physical
safety of any individual;
(ii) flight from prosecution;
(iii) destruction of or tampering with
evidence or the information being sought;
or
(iv) intimidation of potential wit-
nesses.
(4) SERVICE
OF
APPLICATION
ON
INDIVID-
UAL.—Upon the expiration of a period of delay of
notice under this subsection, the government author-
ity shall serve upon the individual, with the service
of the subpoena and the notice, a copy of any appli-
cations filed and approved under this subsection.
SEC. 132. CHALLENGE PROCEDURES FOR LAW ENFORCE-
MENT SUBPOENAS.
(a) MOTION TO QUASH SUBPOENA.—Within 30 days
of the date of service, or 30 days of the date of mailing,
of a subpoena of a government authority seeking protected
health information about a protected individual from a
health information trustee under paragraph (1) or (2) of
section 120(a) (except a subpoena to which section 133
applies), the individual may file (without filing fee) a mo-
tion to quash the subpoena—
(1) in the case of a State judicial subpoena, in
the court which issued the subpoena;
(2) in the case of a subpoena issued under the
authority of a State that is not a State judicial sub-
poena, in a court of competent jurisdiction;
(3) in the case of a subpoena issued under the
authority of a Federal court, in any court of the
United States of competent jurisdiction; or
(4) in the case of any other subpoena issued
under the authority of the United States, in—
(A) the United States district court for the
district in which the individual resides or in
which the subpoena was issued; or
(B) another United States district court of
competent jurisdiction.
(b) COPY.—A copy of the motion shall be served by
the individual upon the government authority by delivery
of registered or certified mail.
(c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov-
ernment authority may file with the court such affidavits
and other sworn documents as sustain the validity of the
subpoena. The individual may file with the court, within
5 days of the date of the authority’s filing, affidavits and
sworn documents in response to the authority’s filing. The
court, upon the request of the individual, the government
authority, or both, may proceed in camera.
(d) PROCEEDINGS AND DECISION ON MOTION.—The
court may conduct such proceedings as it deems appro-
priate to rule on the motion. All such proceedings shall
be completed, and the motion ruled on, within 10 calendar
days of the date of the government authority’s filing.
(e) EXTENSION
OF
TIME
LIMITS
FOR
GOOD
CAUSE.—The court, for good cause shown, may at any
time in its discretion enlarge the time limits established
by subsections (c) and (d).
(f) STANDARD FOR DECISION.—A court may deny a
motion under subsection (a) if it finds that there is prob-
able cause to believe that the protected health information
being sought is relevant to a legitimate law enforcement
inquiry being conducted by the government authority, un-
less the court finds that the individual’s privacy interest
outweighs the government authority’s need for the infor-
mation. The individual shall have the burden of dem-
onstrating that the individual’s privacy interest outweighs
the need established by the government authority for the
information.
(g) SPECIFIC CONSIDERATIONS WITH RESPECT TO
PRIVACY INTEREST.—In determining under subsection (f)
whether an individual’s privacy interest outweighs the gov-
ernment authority’s need for the information, the court
shall consider—
(1) the particular purpose for which the infor-
mation was collected by the trustee;
(2) the degree to which disclosure of the infor-
mation will embarrass, injure, or invade the privacy
of the individual;
(3) the effect of the disclosure on the individ-
ual’s future health care;
(4) the importance of the inquiry being con-
ducted by the government authority, and the impor-
tance of the information to that inquiry; and
(5) any other factor deemed relevant by the
court.
(h) ATTORNEY’S FEES.—In the case of any motion
brought under subsection (a) in which the individual has
substantially prevailed, the court, in its discretion, may as-
sess against a government authority a reasonable attor-
ney’s fee and other litigation costs (including expert fees)
reasonably incurred.
(i) NO INTERLOCUTORY APPEAL.—A court ruling de-
nying a motion to quash under this section shall not be
deemed a final order and no interlocutory appeal may be
taken therefrom by the individual. An appeal of such a
ruling may be taken by the individual within such period
of time as is provided by law as part of any appeal from
a final order in any legal proceeding initiated against the
individual arising out of or based upon the protected
health information disclosed.
SEC. 133. ACCESS AND CHALLENGE PROCEDURES FOR
OTHER SUBPOENAS.
(a) IN GENERAL.—A person (other than a govern-
ment authority seeking protected health information under
circumstances described in section 131(a)) may not obtain
protected health information about a protected individual
from a health information trustee pursuant to a subpoena
under section 120(a)(2) unless—
(1) a copy of the subpoena has been served
upon the individual or mailed to the last known ad-
dress of the individual on or before the date on
which the subpoena was served on the trustee, to-
gether with a notice (published by the Secretary
under section 135(2)) of the individual’s right to
challenge the subpoena, in accordance with sub-
section (b); and
(2) either—
(A) 30 days have passed from the date of
service or 30 days have passed from the date of
the mailing and within such time period the in-
dividual has not initiated a challenge in accord-
ance with subsection (b); or
(B) disclosure is ordered by a court under
such subsection.
(b) MOTION TO QUASH.—Within 30 days of the date
of service or 30 days of the date of mailing of a subpoena
seeking protected health information about a protected in-
dividual from a health information trustee under sub-
section (a), the individual may file (without filing fee) in
any court of competent jurisdiction, a motion to quash the
subpoena, with a copy served on the person seeking the
information. The individual may oppose, or seek to limit,
the subpoena on any grounds that would otherwise be
available if the individual were in possession of the infor-
mation.
(c) STANDARD
FOR DECISION.—The court shall
grant an individual’s motion under subsection (b) if the
person seeking the information has not sustained the bur-
den of demonstrating that—
(1) there are reasonable grounds to believe that
the information will be relevant to a lawsuit or other
judicial or administrative proceeding; and
(2) the need of the person for the information
outweighs the privacy interest of the individual.
(d) SPECIFIC CONSIDERATIONS WITH RESPECT TO
PRIVACY INTEREST.—In determining under subsection (c)
whether the need of the person for the information out-
weighs the privacy interest of the individual, the court
shall consider—
(1) the particular purpose for which the infor-
mation was collected by the trustee;
(2) the degree to which disclosure of the infor-
mation will embarrass, injure, or invade the privacy
of the individual;
(3) the effect of the disclosure on the individ-
ual’s future health care;
(4) the importance of the information to the
lawsuit or proceeding; and
(5) any other factor deemed relevant by the
court.
(e) ATTORNEY’S FEES.—In the case of any motion
brought under subsection (b) by an individual against a
person in which the individual has substantially prevailed,
the court, in its discretion, may assess against the person
a reasonable attorney’s fee and other litigation costs (in-
cluding expert fees) reasonably incurred.
SEC. 134. CONSTRUCTION OF SUBTITLE; SUSPENSION OF
STATUTE OF LIMITATIONS.
(a) IN GENERAL.—Nothing in this subtitle shall af-
fect the right of a health information trustee to challenge
a request for protected health information. Nothing in this
subtitle shall entitle a protected individual to assert the
rights of a health information trustee.
(b) EFFECT OF MOTION ON STATUTE OF LIMITA-
TIONS.—If an individual who is the subject of protected
health information files a motion under this subtitle which
has the effect of delaying the access of a government au-
thority to such information, the period beginning on the
date such motion was filed and ending on the date on
which the motion is decided shall be excluded in computing
any period of limitations within which the government au-
thority may commence any civil or criminal action in con-
nection with which the access is sought.
SEC. 135. RESPONSIBILITIES OF SECRETARY.
Not later than July 1, 1996, the Secretary, after no-
tice and opportunity for public comment, shall develop and
disseminate brief, clear, and easily understood model
notices—
(1) for use under subsection (c) of section 131,
detailing the rights of a protected individual who
wishes to challenge, under section 132, the disclo-
sure of protected health information about the indi-
vidual under such subsection; and
(2) for use under subsection (a) of section 133,
detailing the rights of a protected individual who
wishes to challenge, under subsection (b) of such
section, the disclosure of protected health informa-
tion about the individual under such section.
Subtitle D—Miscellaneous
Provisions
SEC. 141. PAYMENT CARD AND ELECTRONIC PAYMENT
TRANSACTIONS.
(a) PAYMENT FOR HEALTH CARE THROUGH CARD
OR ELECTRONIC MEANS.—If a protected individual pays
a health information trustee for health care by presenting
a debit, credit, or other payment card or account number,
or by any other electronic payment means, the trustee may
disclose to a person described in subsection (b) only such
protected health information about the individual as is
necessary for the processing of the payment transaction
or the billing or collection of amounts charged to, debited
from, or otherwise paid by, the individual using the card,
number, or other electronic payment means.
(b) TRANSACTION PROCESSING.—A person who is a
debit, credit, or other payment card issuer, is otherwise
directly involved in the processing of payment transactions
involving such cards or other electronic payment trans-
actions, or is otherwise directly involved in the billing or
collection of amounts paid through such means, may only
use or disclose protected health information about a pro-
tected individual that has been disclosed in accordance
with subsection (a) when necessary for—
(1) the authorization, settlement, billing or col-
lection of amounts charged to, debited from, or oth-
erwise paid by, the individual using a debit, credit,
or other payment card or account number, or by
other electronic payment means;
(2) the transfer of receivables, accounts, or in-
terest therein;
(3) the audit of the credit, debit, or other pay-
ment card account information;
(4) compliance with Federal, State, or local law;
or
(5) a properly authorized civil, criminal, or reg-
ulatory investigation by Federal, State, or local au-
thorities.
SEC. 142. ACCESS TO PROTECTED HEALTH INFORMATION
OUTSIDE OF THE UNITED STATES.
(a) IN GENERAL.—Notwithstanding the provisions of
subtitle B, and except as provided in subsection (b), a
health information trustee may not permit any person who
is not in a State to have access to protected health infor-
mation about a protected individual unless one or more
of the following conditions exist:
(1) SPECIFIC AUTHORIZATION.—The individual
has specifically consented to the provision of such
access outside of the United States in an authoriza-
tion that meets the requirements of section 112.
(2) EQUIVALENT PROTECTION.—The provision
of such access is authorized under this Act and the
Secretary has determined that there are fair infor-
mation practices for protected health information in
the jurisdiction where the access will be provided
that provide protections for individuals and pro-
tected health information that are equivalent to the
protections provided for by this Act.
(3) ACCESS REQUIRED BY LAW.—The provision
of such access is required under—
(A) a Federal statute; or
(B) a treaty or other international agree-
ment applicable to the United States.
(b) EXCEPTIONS.—Subsection (a) does not apply
where the provision of access to protected health informa-
tion—
(1) is to a foreign public health authority;
(2) is authorized under section 114 (relating to
next of kin and directory information), 116 (relating
to health research), or 117 (relating to emergency
circumstances); or
(3) is necessary for the purpose of providing for
payment for health care that has been provided to
an individual.
SEC. 143. STANDARDS FOR ELECTRONIC DOCUMENTS AND
COMMUNICATIONS.
(a) STANDARDS.—Not later than July 1, 1996, the
Secretary, after notice and opportunity for public com-
ment and in consultation with appropriate private stand-
ard-setting organizations and other interested parties,
shall establish standards with respect to the creation,
transmission, receipt, and maintenance, in electronic and
magnetic form, of each type of written document specifi-
cally required or authorized under this Act. Where a sig-
nature is required under any other provision of this Act,
such standards shall provide for an electronic or magnetic
substitute that serves the functional equivalent of a signa-
ture.
(b) TREATMENT OF COMPLYING DOCUMENTS AND
COMMUNICATIONS.—An electronic or magnetic document
or communication that satisfies the standards established
under subsection (a) with respect to such document or
communication shall be treated as satisfying the require-
ments of this Act that apply to an equivalent written docu-
ment.
SEC. 144. DUTIES AND AUTHORITIES OF AFFILIATED PER-
SONS.
(a) REQUIREMENTS ON TRUSTEES.—
(1) PROVISION OF INFORMATION.—A health in-
formation trustee may provide protected health in-
formation to a person who, with respect to the trust-
ee, is an affiliated person and may permit the affili-
ated person to use such information, only for the
purpose of conducting, supporting, or facilitating an
activity that the trustee is authorized to undertake.
(2) NOTICE TO AFFILIATED PERSON.—A health
information trustee shall notify a person who, with
respect to the trustee, is an affiliated person of any
duties under this Act that the affiliated person is re-
quired to fulfill and of any authorities under this
Act that the affiliated person is authorized to exer-
cise.
(b) DUTIES OF AFFILIATED PERSONS.—
(1) IN
GENERAL.—An affiliated person shall
fulfill any duty under this Act that—
(A) the health information trustee with
whom the person has an agreement or relation-
ship described in section 3(c)(1)(C) is required
to fulfill; and
(B) the person has undertaken to fulfill
pursuant to such agreement or relationship.
(2) CONSTRUCTION
OF
OTHER
SUBTITLES.—
With respect to a duty described in paragraph (1)
that an affiliated person is required to fulfill, the
person shall be considered a health information
trustee for purposes of this Act. The person shall be
subject to subtitle E (relating to enforcement) with
respect to any such duty that the person fails to ful-
fill.
(3) EFFECT ON TRUSTEE.—An agreement or
relationship with an affiliated person does not relieve
a health information trustee of any duty or liability
under this Act.
(b) AUTHORITIES OF AFFILIATED PERSONS.—
(1) IN
GENERAL.—An affiliated person may
only exercise an authority under this Act that the
health information trustee with whom the person is
affiliated may exercise and that the person has been
given by the trustee pursuant to an agreement or re-
lationship described in section 3(c)(1)(C). With re-
spect to any such authority, the person shall be con-
sidered a health information trustee for purposes of