(3) the individual gives written authorization 
for a disclosure for this purpose in accordance with 
subsections (a)(1) through (a)(3), (c), and (d) of 
section 203; 
(4) the health care provider does not condition 
the delivery of health care, payment for services, em-
ployment, or the terms of employment on the grant-
ing by the individual of permission to create the 
coded health information; and 
(5) agents and contractors who receive pro-
tected health information for the purpose of creating 
coded health information use the information exclu-
sively for such purpose. 
SEC. 205. NEXT OF KIN AND DIRECTORY INFORMATION. 
(a) NEXT OF KIN.—Except as provided in subsection 
(c), a health care provider, or a person who receives pro-
tected health information under section 206, may disclose 
protected health information regarding an individual who 
is an inpatient in a health care facility to the individual’s 
next of kin, to an individual representative of the indi-
vidual, or to an individual with whom the individual has 
a significant personal relationship if— 
(1) the individual who is the subject of the in-
formation— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(A) has been notified of the individual’s 
right to object at the time of admission to the 
facility and has not objected to the disclosure; 
or 
(B) is in a physical or mental condition 
such that it would not be possible to notify the 
individual of the right to object and there are 
no prior indications that the individual would 
object; and 
(2) the information relates to health care cur-
rently being provided to the individual at the time 
of the disclosure. 
(b) DIRECTORY INFORMATION.— 
(1) DISCLOSURE.—Except as provided in sub-
section (c), a health information trustee may disclose 
to any person protected health information con-
cerning an individual if the information is described 
in paragraph (2) and the individual who is the sub-
ject of the information— 
(A) has been notified of the individual’s 
right to object and has not objected to the dis-
closure; or 
(B) is in a physical or mental condition 
such that it would not be possible to notify the 
individual of the right to object and there are 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
no prior indications that the individual would 
object. 
(2) INFORMATION
DESCRIBED.—The informa-
tion referred to in paragraph (1) is any one or more 
of the following: 
(A) The name of the individual who is the 
subject of the information. 
(B) The general health status of the indi-
vidual, described as critical, poor, fair, stable, 
or satisfactory, or in terms denoting similar 
conditions. 
(C) The location of the individual, if on a 
premises controlled by a health care provider. 
(c) EXCEPTION.—A health care provider may not dis-
close protected health information without specific author-
ization pursuant to section 203— 
(1) in the case of a disclosure under subsection 
(b), if disclosure of the location of the individual 
would reveal specific information about the physical 
or mental condition of the individual; or 
(2) in the case of a disclosure under subsection 
(a) or (b), if the provider has reason to believe that 
the disclosure could lead to physical, mental, or emo-
tional harm to the individual. 
(d) DECEASED INDIVIDUAL.— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(1) IDENTIFICATION.—A health information 
trustee may disclose protected health information if 
necessary to assist in the identification of a deceased 
individual. 
(2) REGULATIONS.—The Secretary shall de-
velop and establish through regulation a procedure 
for obtaining protected health information relating 
to a deceased individual when there is no individual 
representative for such individual. 
SEC. 206. EMERGENCY CIRCUMSTANCES. 
(a) DISCLOSURE WHEN SUBJECT OF INFORMATION 
IS IN DANGER.—A health information trustee who re-
ceives protected health information under this title may 
disclose such protected health information to a health care 
provider or emergency medical personnel, or use such in-
formation in emergency medical circumstances, to the ex-
tent necessary to protect the health or safety of an indi-
vidual who is a subject of such information from serious 
imminent harm. 
(b) DISCLOSURE WHEN ANOTHER INDIVIDUAL IS IN 
DANGER.—A health information trustee may disclose pro-
tected health information, to the extent necessary, where 
such trustee determines that— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(1) there is an identifiable threat of serious in-
jury or death to an identifiable individual or group 
of individuals; and 
(2) the disclosure of the information to the per-
son is necessary to prevent or significantly reduce 
the possibility of such threat. 
SEC. 207. OVERSIGHT. 
(a) IN GENERAL.—A health information trustee, 
other than a public health authority or a health re-
searcher, may disclose protected health information to— 
(1) a health oversight agency for any function 
of the agency authorized by law, if— 
(A) there is probable cause to believe fraud 
has been committed; 
(B) the oversight agency is investigating 
the fraud; 
(C) the oversight agency has obtained a 
subpoena for purposes of obtaining the informa-
tion; and 
(D)(i) a subject of the information is be-
lieved to have committed the fraud; or 
(ii) the information is necessary to permit 
the agency to investigate the fraud; or 
(2) a health oversight agency charged by law to 
protect individuals from harm, abuse, neglect, or ex-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
ploitation, if the information is necessary to inves-
tigate whether abuse, neglect, or exploitation of an 
individual has occurred. 
(b) USE OF CODED HEALTH INFORMATION.—The 
health oversight agency shall receive exclusively coded 
health information under subsection (a) whenever the pur-
pose of the agency may be accomplished using only such 
information. 
(c) NOTICE TO SUBJECTS.—In any case where an in-
dividual who is a subject of protected health information 
disclosed under subsection (a) is not believed to have com-
mitted fraud, the individual shall be notified, at the first 
practical opportunity— 
(1) that an investigation described in such sub-
section is being conducted; 
(2) of the reason why disclosure of the informa-
tion is necessary; and 
(3) of all intended subsequent disclosures of the 
information that the agency intends to make. 
(d) USE IN ACTION AGAINST INDIVIDUALS.— 
(1) IN GENERAL.—Subject to paragraph (2), 
protected health information about an individual 
that is disclosed under this section may not be used 
in, or disclosed to any person for use in, an adminis-
trative, civil, or criminal action or investigation di-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
rected against the individual, unless the action or in-
vestigation arises out of and is directly related to the 
purpose for which the disclosure was authorized 
under subsection (a). 
(2) SPECIAL RULE.—A health oversight agency 
may not disclose protected health information re-
ceived by the agency under subsection (a)(2) for any 
purpose other than protecting individuals from 
harm, abuse, neglect, or exploitation. 
(e) PUBLIC HEALTH AND HEALTH RESEARCH.—A 
public health authority may disclose protected health in-
formation to a health oversight agency only if such infor-
mation is necessary for use in an investigation of whether 
the authority has committed fraud. A health researcher 
may disclose protected health information to a health over-
sight agency only if such information is necessary for use 
in an investigation of whether the researcher has com-
mitted fraud. 
SEC. 208. ACCREDITATION. 
(a) IN GENERAL.—A health information trustee may 
disclose protected health information to an accrediting 
body for the exclusive purpose of permitting the accred-
iting body to carry out accreditation, licensing, or 
credentialing activities. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(b) USE OF CODED HEALTH INFORMATION.—The 
accrediting body shall receive exclusively coded health in-
formation under subsection (a) whenever the purpose of 
the body may be accomplished using only such informa-
tion. 
(c) RESTRICTION ON USE AND DISCLOSURE.—A per-
son to whom protected health information is disclosed 
under subsection (a) may not use or disclose the informa-
tion for any purpose other than the purpose for which the 
information was disclosed to the person. 
SEC. 209. PUBLIC HEALTH. 
(a) DISCLOSURES BY PROVIDERS.—A health care 
provider may disclose protected health information about 
an individual to a public health authority where— 
(1) the information is disclosed for the purpose 
of permitting the authority to ascertain the identity 
of such individual; 
(2) there is a specific nexus between such indi-
vidual’s identity and a threat of death or injury to 
any person; and 
(3) knowledge of such individual’s identity 
would allow the public health authority to prevent or 
significantly reduce the possibility of injury or death 
to any person. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(b) LIMITATION ON LIABILITY.—A health informa-
tion trustee shall not be liable to any person for a disclo-
sure of protected health information under this section 
that is made based upon a good faith belief by the trustee 
of a representation made by a public health authority that 
such disclosure satisfies the requirements of subsection 
(a). 
(c) LIMITATION ON USE AND DISCLOSURE BY PUB-
LIC HEALTH AUTHORITIES.—A public health authority 
may not use or disclose protected health information for 
any purpose other than for public health reporting, sur-
veillance, protection, investigation, or intervention. 
SEC. 210. HEALTH RESEARCH. 
(a) IN GENERAL.—A health information trustee may 
disclose protected health information, other than coded 
health information, to a health researcher for use in a re-
search project engaged in by the health researcher, if an 
institutional review board, using standards and procedures 
that are generally consistent with the official written pol-
icy of the Secretary with respect to research involving 
human subjects conducted, supported, or otherwise subject 
to regulation by Federal departments and agencies, and 
this Act, determines that the research project— 
(1) requires use of the protected health infor-
mation for the effectiveness of the project and could 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
not be carried out with either coded or nonidentifi-
able health information; and 
(2) has obtained an authorization for the disclo-
sure executed by an individual who is a subject of 
the information that— 
(A) is consistent with the requirements of 
section 203; and 
(B) in a case where the researcher foresees 
using or disclosing the information for any pur-
pose subsequent to the conclusion of the 
project, specifically states— 
(i) such intent; and 
(ii) that the individual has the right 
to limit such subsequent uses or disclo-
sures consistent with this Act. 
(b) USE OF CODED OR NONIDENTIFIABLE HEALTH 
INFORMATION.—A health information trustee may dis-
close coded health information that is not contained in a 
protected health information subfile, or nonidentifiable 
health information, to a health researcher for use in a re-
search project engaged in by the health researcher upon 
approval of the proposed research by an institutional re-
view board, regardless of whether the researcher has ob-
tained an authorization for the disclosure consistent with 
the requirements of section 203. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(c) ANONYMIZATION OF PREVIOUSLY STORED BIO-
LOGICAL SAMPLES.—The Secretary may develop interim 
guidelines for the use by a health researcher of biological 
samples derived from a human body collected before the 
effective date of this Act. Such guidelines shall address 
the requirements pertinent to a health researcher who 
wishes to use stored biological samples derived from a 
human body in nonidentifiable or coded form. Such guide-
lines shall authorize a health researcher, for the purpose 
of facilitating future health research— 
(1) to convert protected health information into 
nonidentifiable information or coded health informa-
tion, if such conversion is permitted in a written au-
thorization; or 
(2) if no such authorization exists, to make 
such conversion after publishing notice of the re-
searcher’s intent and providing individuals the op-
portunity to prohibit the use of their biological sam-
ples for such purpose. 
(d) OBLIGATIONS OF RECIPIENT.—A person who re-
ceives protected health information pursuant to subsection 
(a)— 
(1) shall remove or destroy, at the earliest op-
portunity consistent with the purposes of the project, 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
information that would enable an individual to be 
identified, unless— 
(A) an institutional review board has de-
termined that there is a health or research jus-
tification for retention of such identifiers; and 
(B) there is an adequate plan to protect 
the identifiers from disclosure that is incon-
sistent with this section; and 
(2) shall use the information solely for purposes 
of the health research project for which disclosure 
was authorized by an institutional review board 
under subsection (a). 
SEC. 211. JUDICIAL AND ADMINISTRATIVE PURPOSES. 
A health care provider, health plan, health oversight 
agency, employer, school, institution of higher education, 
insurer, court, or a person who receives protected health 
information pursuant to section 206 may disclose pro-
tected health information about an individual— 
(1) pursuant to the requirements governing 
subpoenas, warrants, and court orders under sec-
tions 212 and 213, where such information has been 
determined to be discoverable by a court under any 
applicable rules of civil or criminal procedure; 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(2) to a court, and to others as ordered by the 
court, if the information is developed in response to 
a court-ordered physical or mental examination; 
(3) where the subject of such information has 
brought a claim for medical malpractice against a 
health care provider and the information is nec-
essary for the defense of the claim; and 
(4) to legal counsel for the person making the 
disclosure, where the disclosure is necessary to en-
sure compliance with this Act or any other legal re-
quirement. 
SEC. 212. GENERAL REQUIREMENTS GOVERNING SUB-
POENAS. 
(a) IN GENERAL.—A health care provider, health 
plan, health oversight agency, employer, school, institution 
of higher education, insurer, court, or a person who re-
ceives protected health information pursuant to section 
206 may disclose protected health information to any per-
son, other than a law enforcement authority, under section 
211(1), if the disclosure is pursuant to a subpoena issued 
on behalf of a party to a lawsuit or other judicial or ad-
ministrative proceeding who has complied with subsection 
(b) or (c), and subsection (d). 
(b) REQUEST FOR ACCESS BY COUNSEL TO REVIEW 
PROTECTED HEALTH INFORMATION.—A person may have 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
access to protected health information under subsection 
(a), by means solely of a review of the information by the 
person’s counsel, acting in the capacity of an officer of 
the court, and on premises of, and under the control of, 
the court, if— 
(1) the person has included in a subpoena a 
proffer of evidence specifying with reasonable speci-
ficity the information to which access is sought and 
the precise grounds for seeking such access for re-
view; 
(2) a copy of such subpoena for access to re-
view, together with a notice of the individual’s right 
to challenge the subpoena under subsection (d), has 
been served upon the individual on or before the 
date of return of the subpoena; 
(3)(A) 15 days have passed since the date of 
service on the individual, and within that period the 
individual has not initiated a challenge in accordance 
with subsection (d)(1); or 
(B) such access is ordered by the court; and 
(4) such counsel agrees not to copy such infor-
mation, remove such information from the court 
premises, or disclose the information to any person 
other than the person permitted access under this 
subsection. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(c) REQUEST TO OBTAIN PROTECTED HEALTH IN-
FORMATION FOR INTRODUCTION IN COURT.— 
(1) REQUIREMENTS FOR OBTAINING INFORMA-
TION.—A person may obtain protected health infor-
mation about an individual pursuant to a subpoena, 
for purposes of introducing such information as evi-
dence in a court, only if— 
(A) counsel for the person has obtained ac-
cess to the information under subsection (b); 
(B) a copy of the subpoena to obtain the 
information for introduction in court, specifying 
the precise information sought and the precise 
grounds for seeking introduction of the infor-
mation as evidence in court, together with a no-
tice of the individual’s right to challenge the 
subpoena under subsection (d), has been served 
upon the individual on or before the date of re-
turn of such subpoena; and 
(C)(i) 15 days have passed since the date 
of service on the individual, and within that 
time period the individual has not indicated a 
challenge in accordance with subsection (d)(1); 
or 
(ii) the information is ordered to be pro-
vided to the court. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(2) USE AND DISCLOSURE.—A person who ob-
tains protected health information under paragraph 
(1) may use and disclose such information only for 
the purpose of prosecuting or defending the lawsuit 
or other judicial or administrative proceeding de-
scribed in subsection (a). 
(d) CHALLENGE PROCEDURES.— 
(1) MOTION
TO
QUASH
SUBPOENA.—After 
being served of a copy of a subpoena seeking access 
for review by counsel of, or access to, protected 
health information under subsection (b), or a sub-
poena seeking to obtain protected health information 
for introduction as evidence in court, under sub-
section (c), an individual who is a subject of such in-
formation may file in any court of competent juris-
diction a motion to quash the subpoena. 
(2) STANDARD FOR DECISION.— 
(A) IN GENERAL.—The court shall grant a 
motion under paragraph (1) unless the respond-
ent demonstrates— 
(i) by clear and convincing evidence 
that the information is necessary in rela-
tion to the lawsuit or other judicial or ad-
ministrative proceeding with respect to 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
which the information is sought, includ-
ing— 
(I) a demonstration that use or 
disclosure of solely nonidentifiable 
health information would be insuffi-
cient to accomplish the purpose for 
which the information is sought; and 
(II) if protected health informa-
tion that is not coded health informa-
tion is sought, a demonstration that 
use or disclosure of coded health in-
formation would be insufficient to ac-
complish the purpose for which the in-
formation is sought; and 
(ii) that the need of the respondent 
for the information outweighs the privacy 
interest of the individual. 
(B) CRITERIA
FOR
DECISION.—In deter-
mining whether the need of the respondent for 
the information outweighs the privacy interest 
of the individual, the court shall consider— 
(i) the particular purpose for which 
the information was collected; 
(ii) the invasion of the individual’s 
privacy caused by the disclosure; 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(iii) the degree to which disclosure of 
the information would embarrass, injure, 
or further invade, the privacy of the indi-
vidual; 
(iv) the effect of the disclosure on the 
individual’s future health care; 
(v) the importance of the information 
to the lawsuit or proceeding; and 
(vi) any other relevant factor. 
(3) ATTORNEY’S FEES.—In the case of a mo-
tion brought under paragraph (1) in which the indi-
vidual who brought the motion has prevailed in 
whole or in part, the court may assess against the 
respondent a reasonable attorney’s fee and other liti-
gation costs and expenses (including expert fees) 
reasonably incurred. 
(e) SEALING OF INFORMATION.—Any portion of a 
record of a court that contains protected health informa-
tion disclosed under this section shall be kept by the court 
under seal and used or disclosed only pursuant to an order 
of the court consistent with this section. 
SEC. 213. ADDITIONAL REQUIREMENTS FOR LAW ENFORCE-
MENT ACCESS. 
(a) LAW ENFORCEMENT SUBPOENAS
AND WAR-
RANTS IN GENERAL.—A health care provider, health plan, 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
health oversight agency, employer, school, institution of 
higher education, insurer, court, or a person who receives 
protected health information pursuant to section 206 may 
disclose protected health information to a law enforcement 
authority under section 211(1), if— 
(1)(A) the disclosure is made pursuant to a 
subpoena for review under section 212(b), a sub-
poena for purposes of introducing evidence in a 
court under section 212(c), or both, issued under the 
authority of a grand jury or a court; and 
(B) the requirements of subsections (b) through 
(e) of section 212, and subsections (b) and (c) of 
this section, are satisfied; 
(2) the disclosure is made pursuant to a judicial 
warrant for search and seizure and the requirements 
of subsection (d) are satisfied; or 
(3)(A) the disclosure is made pursuant to a 
subpoena for purposes of introducing evidence in a 
court under section 212(c), issued under the author-
ity of a grand jury or a court, and obtained pursu-
ant to subsection (d)(5) following the execution of a 
judicial warrant for search and seizure under sub-
section (d); and 
(B) the requirements of subsections (c) through 
(e) (other than subsection (c)(1)(A)) of section 212, 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
and subsections (b) and (c) of this section, are satis-
fied. 
(b) CLEAR AND CONVINCING REQUIREMENT.—A law 
enforcement authority may not obtain protected health in-
formation about an individual under subsection (a) unless 
the authority demonstrates by clear and convincing evi-
dence that the information is necessary to a legitimate law 
enforcement inquiry into a particular violation of criminal 
law being conducted by the authority. 
(c) LIMITATION
ON USE
AND DISCLOSURE
FOR 
OTHER
LAW
ENFORCEMENT
INQUIRIES.—Protected 
health information about an individual that is disclosed 
under this section may not be used in, or disclosed to any 
person for use in, any administrative, civil, or criminal ac-
tion or investigation directed against the individual, unless 
the action or investigation arises out of, or is directly re-
lated to, the law enforcement inquiry for which the infor-
mation was obtained. 
(d) REQUIREMENTS FOR WARRANTS FOR SEARCH 
AND SEIZURE.— 
(1) LIMITED
PURPOSE.—A health care pro-
vider, health plan, health oversight agency, em-
ployer, school, institution of higher education, in-
surer, or a person who receives protected health in-
formation pursuant to section 206 may disclose pro-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
tected health information to a law enforcement au-
thority pursuant to a warrant for search and sei-
zure, issued under the authority of a court, for the 
exclusive purpose of permitting the authority to se-
cure the information described in the warrant for de-
livery to the court. 
(2) LIMITATION
ON
EXECUTION
OF
WAR-
RANTS.—In executing a warrant under paragraph 
(1), a law enforcement authority shall engage in the 
most minimal examination of protected health infor-
mation that is necessary in order to determine 
whether the information is or is not within the scope 
of the warrant. The authority immediately shall 
place any such information that the authority deter-
mines is within the scope of the warrant under seal, 
and shall deliver such sealed information, without 
any further examination or other use or disclosure, 
to the court. The authority may not use or disclose 
for any purpose protected health information that 
the authority determines is not within the scope of 
the warrant, but that is obtained or discovered by 
the authority directly or indirectly through execution 
of the warrant. 
(3) NOTICE OF WARRANT.—A law enforcement 
authority that obtains protected health information 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
about an individual pursuant to the execution of a 
warrant under paragraph (2) shall, not later than 30 
days after the date of such execution, serve the indi-
vidual with, or mail to the last known address of the 
individual, a notice that protected health information 
about the individual was obtained, together with a 
notice of the individual’s right to challenge the war-
rant under paragraph (4). 
(4) 
CHALLENGE
PROCEDURES
FOR
WAR-
RANTS.— 
(A) MOTION TO QUASH.—Within 15 days 
after the date of service of a notice of execution 
of a warrant of a law enforcement authority 
seeking protected health information about an 
individual under paragraph (3), the individual 
(or any other person who was in possession of 
the information and against whom the warrant 
was executed) may file in any court of com-
petent jurisdiction a motion to quash the war-
rant. 
(B) STANDARD FOR DECISION.—The court 
shall grant a motion under subparagraph (A) 
unless the law enforcement authority dem-
onstrates by clear and convincing evidence that 
the protected health information is necessary to 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
a legitimate law enforcement inquiry being con-
ducted by the law enforcement authority and 
the government authority’s need for the infor-
mation outweighs the privacy interest of the in-
dividual. 
(C) ATTORNEY’S FEES.—In the case of a 
motion brought under subparagraph (A) in 
which the individual has prevailed, in whole or 
in part, the court may assess against the law 
enforcement authority reasonable attorney’s 
fees and other litigation costs (including expert 
fees) reasonably incurred. 
(5) ACTION IN COURT ON INFORMATION DELIV-
ERED.—Upon termination of the period described in 
paragraph (4)(A) (in a case where a motion to 
quash is not filed under such paragraph), or upon 
the denial of a motion to quash under such para-
graph, the law enforcement authority may obtain 
protected health information delivered to the court 
under this subsection solely through a disclosure 
under subsection (a)(3). 
(6) SEALING OF INFORMATION.—Any protected 
health information that is delivered to a court under 
this section shall be kept by the court under seal and 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
used or disclosed only pursuant to an order of the 
court consistent with this section. 
TITLE III—SANCTIONS 
Subtitle A—Civil Sanctions 
SEC. 301. CIVIL PENALTY. 
(a) VIOLATION.—Any person who the Secretary de-
termines has materially failed to comply with this Act shall 
be subject, in addition to any other penalties that may 
be prescribed by law, to— 
(1) a civil penalty of not more than $25,000 for 
each such violation, but not to exceed $150,000 in 
the aggregate for multiple violations in any one year; 
and 
(2) a civil penalty of not more than $500,000 
and exclusion from participation in the program 
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, and any other 
federally funded health care program, if the Sec-
retary finds that such violations have occurred with 
such frequency as to constitute a general business 
practice. 
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.— 
Section 1128A of the Social Security Act, other than sub-
sections (a) and (b) and the second sentence of subsection 
(f) of that section, shall apply to the imposition of a civil, 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
monetary, or exclusionary penalty under this section in the 
same manner as such provisions apply with respect to the 
imposition of a penalty under section 1128A of such Act. 
SEC. 302. CIVIL ACTION. 
(a) IN GENERAL.—An individual who is aggrieved by 
conduct in violation of this Act may bring a civil action 
to recover— 
(1) such preliminary and equitable relief as the 
court determines to be appropriate; 
(2) the greater of— 
(A) actual damages; and 
(B) liquidated damages of— 
(i) $25,000, in the case of a material 
violation; or 
(ii) $50,000, in the case of a violation 
that was willful or resulted in profit or 
monetary gain; and 
(3) punitive damages. 
(b) ATTORNEY’S FEES.—In the case of a civil action 
brought under subsection (a) in which the individual has 
substantially prevailed, the court may assess against the 
respondent a reasonable attorney’s fee and other litigation 
costs and expenses (including expert fees) reasonably in-
curred. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(c) LIMITATION.—No action may be commenced 
under this section by an individual more than 3 years after 
the date on which the violation was or should reasonably 
have been discovered by the individual. 
Subtitle B—Criminal Sanctions 
SEC. 
311. 
WRONGFUL 
DISCLOSURE 
OF 
PROTECTED 
HEALTH INFORMATION. 
(a) OFFENSE.—Whoever knowingly— 
(1) obtains protected health information relat-
ing to an individual in violation of this Act; 
(2) discloses protected health information to an-
other person in violation of this Act; 
(3) coerces or attempts to coerce a health infor-
mation trustee to disclose protected health informa-
tion in violation of this title; or 
(4) without authorization pursuant to this Act, 
identifies or attempts to identify an individual who 
is the subject of protected health information that a 
health information trustee has converted into coded 
health information, 
shall be punished as provided in subsection (b). 
(b) PENALTIES.—A person referred to in subsection 
(a) shall be fined under title 18, United States Code, im-
prisoned not more than 1 year, or both, except that— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(1) if the offense is committed under false pre-
tenses, the person shall be fined under title 18, 
United States Code, imprisoned not more than 5 
years, or excluded from participation in the program 
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, or any other fed-
erally funded health care program, or any combina-
tion of such penalties; and 
(2) if the offense is committed with intent to 
sell, transfer, or use protected health information for 
commercial advantage, personal gain, or malicious 
harm, the person shall be fined under title 18, 
United States Code, or imprisoned not more than 10 
years, or excluded from participation in the program 
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, or any other fed-
erally funded health care program, or any combina-
tion of such penalties. 
TITLE IV—MISCELLANEOUS 
SEC. 401. REGULATIONS. 
(a) PROMULGATION.— 
(1) CONSULTATION WITH ADVISORY GROUP.— 
In promulgating regulations under this Act, the Sec-
retary shall appoint and consult an advisory group 
of knowledgeable individuals. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(2) MEMBERSHIP.—The advisory group shall 
consist of at least 7 but no more than 12 individ-
uals, including representatives of— 
(A) health care providers; 
(B) health care consumers; 
(C) health plans; 
(D) privacy advocates; and 
(E) electronic security experts. 
(3) RESPONSIBILITIES.—The advisory group 
shall review all proposed rules and regulations and 
submit recommendations to the Secretary. The advi-
sory group shall also assist the Secretary in estab-
lishing the standards for compliance with rules and 
regulations, in developing an annual report to the 
Congress on the status of the requirements set forth 
in this Act, their cost impact, and any recommenda-
tions for modifications to this Act in order to ensure 
efficient and confidential electronic interchange of 
protected health information. 
(b) CONSULTATION WITH OTHERS.—In promul-
gating regulations under this Act, the Secretary may con-
sult— 
(1) privacy, industry, health care professional, 
and consumer groups; 
(2) medical societies; and 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(3) academic computer security and privacy ex-
perts. 
SEC. 402. RELATIONSHIP TO OTHER LAWS. 
(a) IN GENERAL.—Nothing in this Act shall be con-
strued to preempt any provision of State law or any privi-
lege, whether derived from statute or common law, that— 
(1) more completely protects the confidentiality 
or privacy of an individual with respect to protected 
health information about the individual than does 
this Act; or 
(2) provides a greater right of access to pro-
tected health information to a subject of the infor-
mation than does this Act. 
(b) CRIMINAL PENALTIES.—A State may establish 
and enforce criminal penalties with respect to a failure to 
comply with a provision of this Act. 
(c) PRIVILEGES.—This Act does not preempt or mod-
ify State common or statutory law to the extent such law 
concerns a privilege of a witness or person in a court of 
the State. This Act does not supersede or modify Federal 
common or statutory law to the extent such law concerns 
a privilege of a witness or person in a court of the United 
States and more completely protects the confidentiality or 
privacy of an individual with respect to protected health 
information about the individual than does this Act. The 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
execution of an authorization pursuant to section 202 or 
203 may not be construed as a waiver of any such privi-
lege. 
(d) CERTAIN DUTIES UNDER STATE OR FEDERAL 
LAW.—This Act does not preempt, supersede, or modify 
the operation of any of the following: 
(1) Any law that provides for the reporting of 
vital statistics such as birth or death information. 
(2) Any law requiring the reporting of abuse or 
neglect information about any individual. 
(3) Any State law relating to public or mental 
health that prevents or otherwise restricts disclosure 
of protected health information otherwise permitted 
under this Act. 
(4) Subpart II of part E of title XXVI of the 
Public Health Service Act (relating to notifications 
of emergency response employees of possible expo-
sure to infectious diseases). 
(5) Any Federal law or regulation governing 
confidentiality of alcohol and drug patient records. 
(6) The Americans With Disabilities Act of 
1990. 
(7) Any Federal or State statute that estab-
lishes a privilege for records used in health profes-
sional peer review activities. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
SEC. 403. EFFECTIVE DATES. 
(a) IN GENERAL.—Except as provided in subsection 
(b), this Act shall take effect on the date that is 18 months 
after the date of the enactment of this Act. 
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro-
vision of this Act shall take effect on the date of the enact-
ment of this Act if the provision imposes on the Secretary 
a duty to develop, establish, or promulgate regulations, 
guidelines, or model forms. 
(c) DEADLINE FOR REGULATIONS.—The Secretary 
shall promulgate regulations implementing this Act not 
later than the date that is 12 months after the date of 
the enactment of this Act. 
SEC. 404. APPLICABILITY. 
(a) PROTECTED HEALTH INFORMATION.—Except as 
provided in subsection (b), the provisions of this Act shall 
apply to any protected health information that is received, 
created, used, maintained, or disclosed by a health infor-
mation trustee on or after the date that is 18 months after 
the date of the enactment of this Act, regardless of wheth-
er the information existed or was disclosed prior to such 
date. 
(b) AUTHORIZATIONS FOR DISCLOSURES.—An au-
thorization for the disclosure of protected health informa-
tion about a protected individual that is executed by the 
individual before the date that is 18 months after the date 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
of the enactment of this Act, and is recognized and valid 
under State law on the day before such date, shall remain 
valid and shall not be subject to the requirements of title 
II until the date that is 30 months after the date of the 
enactment of this Act, or the occurrence of the date or 
event in the authorization upon which the authorization 
expires, whichever occurs earlier. 
Æ 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6301
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS