SEC. 208. DISCLOSURE FOR LAW ENFORCEMENT PUR-
POSES.
(a) LAW ENFORCEMENT ACCESS
TO PROTECTED
HEALTH INFORMATION.—A health care provider, health
researcher, health plan, health oversight agency, employer,
health or life insurer, school, university, a person acting
as the agent of any such person, or a person who receives
protected health information pursuant to section 204, may
disclose protected health information to an investigative
or law enforcement officer pursuant to a warrant issued
under the Federal Rules of Criminal Procedure, an equiva-
lent State warrant, a grand jury subpoena, or a court
order under limitations set forth in subsection (b).
(b) REQUIREMENTS FOR COURT ORDERS FOR AC-
CESS TO PROTECTED HEALTH INFORMATION.—A court
order for the disclosure of protected health information
under subsection (a) may be issued by any court that is
a court of competent jurisdiction and shall issue only if
the investigative or law enforcement officer submits a writ-
ten application upon oath or equivalent affirmation dem-
onstrating that there is probable cause to believe that—
(1) the protected health information sought is
relevant and material to an ongoing criminal inves-
tigation, except in the case of a State government
authority, such a court order shall not issue if pro-
hibited by the law of such State;
(2) the investigative or evidentiary needs of the
investigative or law enforcement officer cannot rea-
sonably be satisfied by de-identified health informa-
tion or by any other information; and
(3) the law enforcement need for the informa-
tion outweighs the privacy interest of the individual
to whom the information pertains.
(c) MOTIONS TO QUASH
OR MODIFY.—A court
issuing an order pursuant to this section, on a motion
made promptly by the health care provider, health re-
searcher, health plan, health oversight agency, employer,
health or life insurer, school, university, a person acting
as the agent of any such person, or a person who receives
protected health information pursuant to section 204, may
quash or modify such order if the court finds that informa-
tion or records requested are unreasonably voluminous or
if compliance with such order otherwise would cause an
unreasonable burden on such persons.
(d) NOTICE.—
(1) IN GENERAL.—Except as provided in para-
graph (2), no order for the disclosure of protected
health information about an individual may be
issued by a court under this section unless prior no-
tice of the application for the order has been served
on the individual and the individual has been af-
forded an opportunity to oppose the issuance of the
order.
(2) NOTICE NOT REQUIRED.—An order for the
disclosure of protected health information about an
individual may be issued without prior notice to the
individual if the court finds that notice would be im-
practical because—
(A) the name and address of the individual
are unknown; or
(B) notice would risk destruction or un-
availability of the evidence.
(e) CONDITIONS.—Upon the granting of an order for
disclosure of protected health information under this sec-
tion, the court shall impose appropriate safeguards to en-
sure the confidentiality of such information and to protect
against unauthorized or improper use or disclosure.
(f) LIMITATION
ON USE
AND DISCLOSURE
FOR
OTHER
LAW
ENFORCEMENT
INQUIRIES.—Protected
health information about an individual that is disclosed
under this section may not be used in, or disclosed to any
person for use in, any administrative, civil, or criminal ac-
tion or investigation directed against the individual, unless
the action or investigation arises out of, or is directly re-
lated to, the law enforcement inquiry for which the infor-
mation was obtained.
(g) DESTRUCTION OR RETURN OF INFORMATION.—
When the matter or need for which protected health infor-
mation was disclosed to an investigative or law enforce-
ment officer or grand jury has concluded, including any
derivative matters arising from such matter or need, the
law enforcement agency or grand jury shall either destroy
the protected health information, or return it to the person
from whom it was obtained.
(h) REDACTIONS.—To the extent practicable, and
consistent with the requirements of due process, a law en-
forcement agency shall redact personally identifying infor-
mation from protected health information prior to the
public disclosure of such protected information in a judi-
cial or administrative proceeding.
(i) EXCEPTION.—This section shall not be construed
to limit or restrict the ability of law enforcement authori-
ties to gain information while in hot pursuit of a suspect
or if other exigent circumstances exist.
SEC. 209. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—A health care provider, or a per-
son who receives protected health information under sec-
tion 204, may disclose protected health information about
health care services provided to an individual to the indi-
vidual’s next of kin, or to another person whom the indi-
vidual has identified, if at the time of the treatment of
the individual—
(1) the individual—
(A) has been notified of the individual’s
right to object to such disclosure and the indi-
vidual has not objected to the disclosure; or
(B) is in a physical or mental condition
such that the individual is not capable of object-
ing, and there are no prior indications that the
individual would object; and
(2) the information disclosed relates to health
care services currently being provided to that indi-
vidual.
(b) DIRECTORY INFORMATION.—
(1) DISCLOSURE.—
(A) IN GENERAL.—Except as provided in
paragraph (2), with respect to an individual
who is admitted as an inpatient to a health care
facility, a person described in subsection (a)
may disclose information described in subpara-
graph (B) about the individual to any person if,
at the time of the admission, the individual—
(i) has been notified of the individ-
ual’s right to object and has not objected
to the disclosure; or
(ii) is in a physical or mental condi-
tion such that the individual is not capable
of objecting and there are no prior indica-
tions that the individual would object.
(B) INFORMATION.—Information described
in this subparagraph is information that con-
sists only of 1 or more of the following items:
(i) The name of the individual who is
the subject of the information.
(ii) The general health status of the
individual, described as critical, poor, fair,
stable, or satisfactory or in terms denoting
similar conditions.
(iii) The location of the individual
within the health care facility to which the
individual is admitted.
(2) EXCEPTION.—Paragraph (1)(B)(iii) shall
not apply if disclosure of the location of the individ-
ual would reveal specific information about the phys-
ical or mental condition of the individual, unless the
individual expressly authorizes such disclosure.
(c) DIRECTORY OR NEXT-OF-KIN INFORMATION.—A
disclosure may not be made under this section if the dis-
closing person described in subsection (a) has reason to
believe that the disclosure of directory or next-of-kin infor-
mation could lead to the physical or mental harm of the
individual, unless the individual expressly authorizes such
disclosure.
SEC. 210. HEALTH RESEARCH.
(a) REGULATIONS.—
(1) IN GENERAL.—The requirements and pro-
tections provided for under part 46 of title 45, Code
of Federal Regulations (as in effect on the date of
enactment of this Act), shall apply to all health re-
search.
(2) EFFECTIVE DATE.—Paragraph (1) shall not
take effect until the Secretary has promulgated final
regulations to implement such paragraph.
(b) EVALUATION.—Not later than 24 months after
the date of enactment of this Act, the Secretary shall pre-
pare and submit to Congress detailed recommendations on
whether written informed consent should be required, and
if so, under what circumstances, before protected health
information can be used for health research.
(c) RECOMMENDATIONS.—The recommendations re-
quired to be submitted under subsection (b) shall
include—
(1) a detailed explanation of current institu-
tional review board practices, including the extent to
which the privacy of individuals is taken into ac-
count as a factor before allowing waivers and under
what circumstances informed consent is being
waived;
(2) a summary of how technology could be used
to strip identifying data for the purposes of re-
search;
(3) an analysis of the risks and benefits of re-
quiring informed consent versus the waiver of in-
formed consent;
(4) an analysis of the risks and benefits of
using protected health information for research pur-
poses other than the health research project for
which such information was obtained; and
(5) an analysis of the risks and benefits of al-
lowing individuals to consent or to use consent, at
the time of receiving medical treatment, to the pos-
sible future use of records of medical treatments for
research studies.
(d) CONSULTATION.—In carrying out this section,
the Secretary shall consult with individuals who have dis-
tinguished themselves in the fields of health research, pri-
vacy, related technology, consumer interests in health in-
formation, health data standards, and the provision of
health services.
(e) CONGRESSIONAL NOTICE.—Not later than 6
months after the date on which the Secretary submits to
Congress the recommendations required under subsection
(b), the Secretary shall propose to implement such rec-
ommendations through regulations promulgated on the
record after opportunity for a hearing, and shall advise
the Congress of such proposal.
(f) OTHER REQUIREMENTS.—
(1) OBLIGATIONS OF THE RECIPIENT.—A per-
son who receives protected health information pursu-
ant to this section shall remove or destroy, at the
earliest opportunity consistent with the purposes of
the project involved, information that would enable
an individual to be identified, unless—
(A) an institutional review board has de-
termined that there is a health or research jus-
tification for the retention of such identifiers;
and
(B) there is an adequate plan to protect
the identifiers from disclosure consistent with
this section; and
(2) PERIODIC REVIEW AND TECHNICAL ASSIST-
ANCE.—
(A) INSTITUTIONAL REVIEW BOARD.—Any
institutional review board that authorizes re-
search under this section shall provide the Sec-
retary with the names and addresses of the in-
stitutional review board members.
(B) TECHNICAL
ASSISTANCE.—The Sec-
retary may provide technical assistance to insti-
tutional review boards described in this sub-
section.
(C) MONITORING.—The Secretary shall pe-
riodically monitor institutional review boards
described in this subsection.
(D) REPORTS.—Not later than 3 years
after the date of enactment of this Act, the Sec-
retary shall report to Congress regarding the
activities of institutional review boards de-
scribed in this subsection.
(g) LIMITATION.—Nothing in this section shall be
construed to permit protected health information that is
received by a researcher under this section to be accessed
for purposes other than research or as authorized by the
individual.
SEC. 211. JUDICIAL AND ADMINISTRATIVE PURPOSES.
(a) IN GENERAL.—A health care provider, health
plan, health oversight agency, employer, insurer, health or
life insurer, school or university, a person acting as the
agent of any such person, or a person who receives pro-
tected health information under section 204, may disclose
protected health information—
(1) pursuant to the standards and procedures
established in the Federal Rules of Civil Procedure
or comparable rules of other courts or administrative
agencies, in connection with litigation or proceedings
to which an individual who is the subject of the in-
formation is a party and in which the individual has
placed his or her physical or mental condition at
issue;
(2) to a court, and to others ordered by the
court, if in response to a court order issued by a
court of competent jurisdiction in accordance with
subsections (b) and (c); or
(3) if necessary to present to a court an appli-
cation regarding the provision of treatment of an in-
dividual or the appointment of a guardian.
(b) COURT ORDERS FOR ACCESS TO PROTECTED
HEALTH INFORMATION.—A court order for the disclosure
of protected health information under subsection (a) may
be issued only if the person seeking disclosure submits a
written application upon oath or equivalent affirmation
demonstrating by clear and convincing evidence that—
(1) the protected health information sought is
necessary for the adjudication of a material fact in
dispute in a civil proceeding;
(2) the adjudicative need cannot be reasonably
satisfied by de-identified health information or by
any other information; and
(3) the need for the information outweighs the
privacy interest of the individual to whom the infor-
mation pertains.
(c) NOTICE.—
(1) IN GENERAL.—Except as provided in para-
graph (2), no order for the disclosure of protected
health information about an individual may be
issued by a court unless notice of the application for
the order has been served on the individual and the
individual has been afforded an opportunity to op-
pose the issuance of the order.
(2) NOTICE NOT REQUIRED.—An order for the
disclosure of protected health information about an
individual may be issued without notice to the indi-
vidual if the court finds, by clear and convincing evi-
dence, that notice would be impractical because—
(A) the name and address of the individual
are unknown; or