TITLE II—RESTRICTIONS ON 
USE AND DISCLOSURE 
SEC. 201. GENERAL RULES REGARDING USE AND DISCLO-
SURE. 
(a) GENERAL RULE.—A health information trustee 
may not use or disclose protected health information ex-
cept as authorized under this title. 
(b) SCOPE OF USE AND DISCLOSURE.— 
(1) COMPATIBILITY
WITH
PURPOSE
FOR
OB-
TAINING
INFORMATION.—A 
health 
information 
trustee may not use, or disclose to any person, pro-
tected health information unless the use or disclo-
sure is compatible with and directly related to— 
(A) the purposes for which the information 
was obtained by the health information trustee; 
and 
(B) in the case where an individual has ex-
ecuted an authorization, for the specific purpose 
authorized by the individual. 
(2) LIMITATION
ON
AMOUNT
OF
INFORMA-
TION.— 
(A) USE AND DISCLOSURE.— 
(i) IN GENERAL.—Every use and dis-
closure of protected health information by 
a health information trustee shall be lim-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
ited to the minimum amount of informa-
tion necessary to accomplish the purpose 
for which the information is used or dis-
closed. 
(ii) 
NONIDENTIFIABLE
INFORMA-
TION.—A health information trustee shall 
use and disclose nonidentifiable health in-
formation, in lieu of protected health infor-
mation, to maximum extent possible, con-
sistent with the purpose for the use or dis-
closure. 
(iii) CODED HEALTH INFORMATION.— 
A health information trustee shall use and 
disclose coded health information, in lieu of 
any other kind of protected health informa-
tion, to maximum extent possible, con-
sistent with the purpose for the use or dis-
closure. 
(B) COLLECTION, CREATION, AND
RE-
QUESTS.—A health information trustee may not 
collect, create, or request the disclosure of, 
more protected health information than is nec-
essary to accomplish the purpose for which the 
information is collected, created, or requested. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(c) SPECIAL RULES FOR PROTECTED HEALTH IN-
FORMATION SUBFILES.— 
(1) SEGREGATION.—A health information trust-
ee shall, upon creating or obtaining protected health 
information, comply with the request of a subject of 
such information— 
(A) to segregate any amount or type of 
protected health information; and 
(B) to maintain such protected health in-
formation as one or more protected health in-
formation subfiles. 
(2) DISCLOSURE AND USE.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), a person, other than a health care 
provider who is otherwise authorized to access 
or use protected health information about an 
individual contained in a protected health infor-
mation subfile for purposes of delivering health 
care to the individual, may not use or disclose 
any information that is in the subfile, except as 
authorized under section 202, 203, or 206. 
(B) 
EMPLOYEES, 
AGENTS, 
CONTRAC-
TORS.—A health information trustee, with re-
spect to a protected health information subfile 
created pursuant to paragraph (1), shall limit 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
use of the subfile to those employees, contrac-
tors, or agents of the trustee, described by 
name or job title, who, with respect to the 
subfile are authorized, pursuant to section 202 
or 203, to use or obtain such information. 
(C) INFORMATION
ON
EXISTENCE
OF 
SUBFILES.—A health information trustee may 
not disclose information about the existence of 
a health information subfile to any person who 
is not authorized to obtain, access, or use the 
subfile. 
(d) NO GENERAL REQUIREMENT TO DISCLOSE.— 
Nothing in this title that permits a disclosure of protected 
health information shall be construed to require such dis-
closure. 
(e) LIMITATIONS ON DISCLOSURE AND USE WITHIN 
A TRUSTEE.— 
(1) CONDITION OF TREATMENT OR PAYMENT.— 
A health information trustee may not condition de-
livery of health care, or payment for services, on the 
receipt of an authorization described in section 202 
or 203 that authorizes the disclosure of protected 
health information to any employee, agent, or con-
tractor who does not perform a legitimate and nec-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
essary function with respect to the purpose for 
which the information was obtained or created. 
(2) EMPLOYMENT.—A health information trust-
ee may not condition employment on the receipt of 
an authorization described in section 202 or 203 
that authorizes the disclosure of protected health in-
formation to any employee, agent, or contractor who 
does not perform a legitimate and necessary function 
with respect to the purpose for which the informa-
tion was obtained or created. 
(f) IDENTIFICATION OF DISCLOSED INFORMATION AS 
PROTECTED INFORMATION.—Except as provided in this 
title, a health information trustee may not disclose pro-
tected health information unless such information is clear-
ly identified as protected health information that is subject 
to this title. 
(g) INFORMATION IDENTIFYING PROVIDERS.—The 
Secretary shall issue regulations protecting information 
identifying health care providers in order to promote the 
availability of health care services. 
(h) USE OF SOCIAL SECURITY NUMBER.—A Social 
Security account number, or a derivative of a Social Secu-
rity account number, may not be used by a health informa-
tion trustee for any purpose relating to protected health 
information or the use or disclosure of such information. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(i) MULTIPLE RECORDS.—No person may aggregate, 
compile, link, or match protected health information held 
by two or more different health information trustees, or 
two or more protected health information subfiles per-
taining to an individual, without obtaining specific author-
ization under section 202 or 203 for such use. 
(j) NO EFFECT OF AGENCY ON DUTY OR LIABILITY 
OF PRINCIPAL.—An agreement or relationship between a 
trustee and an agent or contractor does not relieve a 
health information trustee of any duty or liability under 
this Act. 
SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION FOR TREAT-
MENT OR PAYMENT. 
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee may disclose protected health information for 
purposes of treatment or payment pursuant to an author-
ization executed by an individual who is the subject of the 
information (or a person acting for the individual pursu-
ant to State law) if each of the following requirements is 
met: 
(1) WRITING.—The authorization is in written 
or electronic form, signed or electronically authenti-
cated by the individual, and dated. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(2) SEPARATE FORMS.—Separate forms author-
izing disclosures for treatment and separate forms 
authorizing disclosures for payment processes are 
provided to the individual. 
(3) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is specified, or is described, in 
the authorization. 
(4) TRUSTEE DESCRIBED.—The trustee who is 
authorized to disclose such information is specifically 
identified, or is described, in the authorization. 
(5) RECIPIENT
DESCRIBED.—The person to 
whom the information is to be disclosed is specifi-
cally identified, or is described, in the authorization. 
(6) RIGHT TO REVOKE OR AMEND.—The au-
thorization contains an acknowledgement that the 
individual who is executing the authorization has the 
right to revoke or amend the authorization, subject 
to subsection (b). 
(7) PURPOSE DESCRIBED.—The authorization 
describes in detail the purpose for which the infor-
mation will be used. 
(8) STATEMENT OF INTENDED DISCLOSURES.— 
The authorization contains an acknowledgment that 
the individual who is executing the authorization has 
read a statement of any disclosures of the protected 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
health information that the recipient intends to 
make. 
(9) USE AND DISCLOSURE RESTRICTED.—The 
authorization includes a statement that the informa-
tion will be used and disclosed solely for one or more 
purposes specified in the authorization. 
(10) EXPIRATION DATE SPECIFIED.—The au-
thorization specifies a date on which, or event upon 
which, the authorization expires, which shall be no 
later than one year after the date on which the au-
thorization is executed. 
(b) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.— 
(1) IN GENERAL.—An authorization under sub-
section (a) shall be subject to revocation and amend-
ment at any time by the individual who executed the 
authorization, except that— 
(A) the revocation or amendment shall be 
in writing; and 
(B) an authorization executed for the pur-
pose of validation of expenditures for health 
care that the individual has authorized to be 
rendered may not be revoked. 
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
mation pursuant to an authorization described in 
subsection (a) that has been revoked shall not be 
subject to any liability or penalty under this Act if 
the trustee has no actual or constructive notice of 
the revocation at the time the trustee makes the dis-
closure. 
(c) MODEL AUTHORIZATIONS.—The Secretary, after 
providing notice and opportunity for public comment, shall 
develop and disseminate model written authorizations of 
the type described in subsection (a) and model statements 
of intended disclosures of the type described in subsection 
(a)(7). 
(d) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization for not less than 7 years. 
SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION FOR PUR-
POSES OTHER THAN TREATMENT OR PAY-
MENT. 
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee may disclose protected health information for 
a purpose other than treatment or payment pursuant to 
an authorization executed by an individual who is the sub-
ject of the information (or a person acting for the indi-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
vidual pursuant to State law) if each of the following re-
quirements is met: 
(1) GENERAL
REQUIREMENTS.—The require-
ments of paragraphs (1) through (7) of section 
202(a). 
(2) STATEMENT OF INTENDED DISCLOSURES.— 
The statement of intended disclosure shall be in 
writing, and shall be received by the individual au-
thorizing the disclosure on or before the date the au-
thorization is executed. 
(3) EXPIRATION
DATE
SPECIFIED.—The au-
thorization specifies a date on which, or an event 
upon which, the authorization expires, which shall 
not occur more than 1 year from the date of the exe-
cution of the authorization. 
(b) LIMITATION
ON REQUESTS
FOR AUTHORIZA-
TIONS.— 
(1) CONDITION OF TREATMENT OR PAYMENT.— 
A health information trustee may not condition de-
livery of treatment, or payment for services, on the 
receipt of an authorization described in subsection 
(a). 
(2) EMPLOYMENT.—A health information trust-
ee may not adversely affect, or condition, the em-
ployment of any person based on the agreement or 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
refusal of the person to execute or provide an author-
ization described in subsection (a). 
(c) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.— 
(1) IN GENERAL.—An individual may in writing 
revoke or amend an authorization described in sub-
section (a). 
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation pursuant to an authorization described in 
subsection (a) that has been revoked shall not be 
subject to any liability or penalty under this Act if 
the trustee has no actual or constructive notice of 
the revocation at the time the trustee makes the dis-
closure. 
(d) MODEL AUTHORIZATIONS.—The Secretary, after 
notice and opportunity for public comment, shall develop 
and disseminate model written authorizations of the type 
described in subsection (a) and model statements of the 
intended disclosures of the type described in subsection 
(a)(2). 
SEC. 204. CREATION OF NONIDENTIFIABLE AND CODED IN-
FORMATION. 
(a) CREATION
OF
NONIDENTIFIABLE
INFORMA-
TION.—A health information trustee may disclose pro-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
tected health information about an individual to an em-
ployee, agent, or contractor for the purpose of creating 
nonidentifiable health information if— 
(1) the individual is informed of the purpose for 
the creation of the nonidentifiable information; 
(2) the individual is given the option to prohibit 
any specific uses of the nonidentifiable information, 
such as use of the information for marketing pur-
poses; and 
(3) the health information trustee does not con-
dition the delivery of health care, payment for serv-
ices, or employment, on the granting by the indi-
vidual of permission to create the nonidentifiable in-
formation. 
(b) CREATION OF CODED HEALTH INFORMATION.— 
A health care provider may create coded health informa-
tion, or disclose protected health information about an in-
dividual to an employee, agent, or contractor for the pur-
pose of creating coded health information, if— 
(1) the individual is informed of the purpose for 
the creation of the coded information; 
(2) the individual is informed of which persons 
will have the authority to link or match the coded 
health information to reveal the identity of the indi-
vidual; 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS