(1) the reasons for the refusal to make the cor-
rection or amendment;
(2) any procedures for further review of the re-
fusal; and
(3) the individual’s right to file with the trust-
ee, if the individual so wishes, a concise statement
setting forth the requested correction or amendment
and the individual’s reasons for disagreeing with the
refusal.
(c) STATEMENT OF DISAGREEMENT.—If an individ-
ual has filed a statement of disagreement under subsection
(b)(3), the health information trustee in any subsequent
disclosure of the disputed portion of the information—
(1) shall include a copy of the individual’s
statement; and
(2) shall include a concise statement of the rea-
sons for not making the requested correction or
amendment.
(d) RULE OF CONSTRUCTION.—This section shall not
be construed to require a health information trustee to
conduct a formal, informal, or other hearing or proceeding
concerning a request for a correction or amendment to
protected health information.
(e) CORRECTION.—For purposes of subsection (a), a
correction is deemed to have been made to protected
health information when information that has been dis-
puted by an individual has been corrected, clearly marked
as incorrect, or supplemented by correct information.
(f) RULES GOVERNING AGENTS
AND CONTRAC-
TORS.—A person acting in the capacity of an agent or con-
tractor of a health care provider, health plan, health over-
sight agency, public health authority, health researcher,
employer, insurer, school, institution of higher education,
or insurance support organization is not authorized to
make corrections or amendments to protected health infor-
mation received from their principal, except when the
agent or contractor has been asked by the principal to ful-
fill the principal’s obligations under this section.
SEC. 103. NOTICE OF INFORMATION PRACTICES.
(a) PREPARATION OF WRITTEN NOTICE.—A health
information trustee shall prepare and provide, in accord-
ance with subsection (b), a written notice containing the
following:
(1) INDIVIDUALS’ RIGHTS.—A description of
the following rights of an individual who is a subject
of protected health information maintained by the
trustee:
(A) The right of the individual to request
segregation of protected health information, and
to restrict the use of such information by em-
ployees, agents, and contractors of the trustee,
under section 201(c).
(B) The right of the individual to inspect,
copy, amend, and correct the protected health
information under sections 101 and 102.
(C) The right of the individual to object to
the disclosure of the information to next of kin
or in directory information under section 205.
(D) The circumstances under which the in-
formation may be used or disclosed without an
authorization executed by the individual.
(E) The right of the individual not to have
employment or the receipt of services condi-
tioned upon the execution by the individual of
an authorization for disclosure or use for any
purpose other than treatment or payment.
(F) The procedures the individual must
follow in order to exercise the foregoing rights.
(2) TRUSTEE INFORMATION PRACTICES.—A de-
scription of the trustee’s health information prac-
tices, including the safeguards and practices used to
protect such information.
(b) AVAILABILITY
OF NOTICE
TO SUBJECTS.—A
health information trustee shall provide a copy of a notice
prepared under this section to an individual who is a sub-
ject of protected health information—
(1) along with any request for authorization to
use or disclose the information created pursuant to
section 202 or 203 and presented by the trustee to
the individual for execution;
(2) at the first practicable opportunity after the
trustee uses or discloses the information without an
authorization executed by the individual;
(3) at the first practicable opportunity after a
health information trustee commences the collection
of the information; or
(4) when the individual requests to inspect,
copy, correct, or amend their protected health infor-
mation pursuant to section 101 or 102.
Subtitle B—Establishment of
Safeguards
SEC. 111. ESTABLISHMENT OF SAFEGUARDS.
(a) IN GENERAL.—A health information trustee shall
establish and maintain appropriate administrative, tech-
nical, and physical safeguards to ensure the confidential-
ity, security, accuracy, and integrity of protected health
information created, received, obtained, maintained, used
or transmitted by the trustee.
(b) SAFEGUARDS FOR ELECTRONIC INFORMATION.—
(1) APPLICATION AND CONSTRUCTION.—
(A) APPLICATION.—This subsection ap-
plies only with respect to protected health infor-
mation that is electronic.
(B) CONSTRUCTION.—Nothing in this Act
shall be construed to require that protected
health information be created, received, main-
tained, used, or disclosed in electronic form.
(2) REQUIREMENTS FOR ELECTRONIC MAINTE-
NANCE, USE, AND
DISCLOSURE.—The Secretary
shall develop, and by regulation impose on health in-
formation trustees, requirements for the electronic
maintenance, use, and disclosure of protected health
information. Such requirements shall include the fol-
lowing:
(A) CONTROL OF ACCESS TO PROTECTED
HEALTH INFORMATION.—
(i) IN GENERAL.—A health informa-
tion trustee shall implement controls with
respect to access to electronic protected
health information. The trustee may grant
a request by any person for access to such
information for use by the health informa-
tion trustee, or for disclosure to another
health information trustee, only after veri-
fying that—
(I) the person making the re-
quest can prove their identity; and
(II) the proposed use of the pro-
tected health information, or the re-
quested 
disclosure, 
is 
authorized
under this Act.
(ii) AUTHENTICATION
OF
IDENTITY
OF
REQUESTERS.—A health information
trustee shall use a method of verification
to verify the identity of persons requesting
access to electronic protected health infor-
mation. A health information trustee who
issues a device that verifies the identity of
a person making a request for information
for purposes of this clause shall instruct
the person in the proper care and use of
the device and shall require the person to
protect the device from misuse. Any system
used by a health information trustee to
maintain verification information collected
under this clause shall prevent the disclo-
sure of such verification information to any
person other than a person who is specifi-
cally authorized to receive such informa-
tion.
(B) ACCESS FOR USE BY HEALTH INFOR-
MATION TRUSTEE.—A health information trust-
ee shall limit the persons who may use pro-
tected health information created or maintained
by the trustee in electronic form to persons spe-
cifically authorized by the trustee to use such
information consistent with this Act.
(C) DISCLOSURE TO OTHERS.—
(i) PROTECTION
OF
REQUESTS
FOR
DISCLOSURE
AND
RESPONSES.—A health
information trustee who requests, using
electronic means, to receive protected
health information, or who responds, using
electronic means, to such a request, shall
implement procedures to prevent the inter-
ception of such request or response by per-
sons who are not authorized to intercept it.
(ii) IDENTIFICATION OF SUBJECT.—A
health information trustee who receives,
using electronic means, a request for pro-
tected health information from another
health information trustee may not provide
such information in response to the request
unless the request contains sufficient de-
tails to uniquely identify one individual
who is the subject of the request.
(D) AUDIT TRAIL.—
(i) ACCESS
TO
INFORMATION
MAIN-
TAINED
BY
OTHERS.—A health informa-
tion trustee shall maintain an electronic
record concerning each attempt that is
made by the trustee, whether authorized or
unauthorized, successful or unsuccessful,
to access protected health information that
is maintained by any other health informa-
tion trustee in electronic form. The record
shall include the identity of the specific in-
dividual attempting to gain such access
and information sufficient to identify the
information sought.
(ii) ACCESS TO INFORMATION MAIN-
TAINED BY THE TRUSTEE.—A health in-
formation trustee shall maintain an elec-
tronic record concerning each attempt that
is made by the trustee, or by any other
person, whether authorized or unauthor-
ized, successful or unsuccessful, to access
protected health information maintained by
the trustee in electronic form. The record
shall include the identity of the specific in-
dividual attempting to gain such access
and information sufficient to identify the
information sought.
(3) REVIEW
OF
REQUIREMENTS.—The Sec-
retary from time to time shall review the require-
ments developed and imposed under paragraph (2),
to determine whether technological advances or other
factors make necessary changes to the requirements.
If the Secretary determines that such changes are
necessary, the Secretary shall make them.
SEC. 112. ACCOUNTING FOR DISCLOSURES.
(a) IN GENERAL.—
(1) PERSONS NOT ACTING AS AGENTS OR CON-
TRACTORS.—Except as provided in paragraph (2), a
health information trustee shall create and maintain,
with respect to any protected health information dis-
closure made by the trustee that is not related to
treatment, a record of the disclosure in accordance
with regulations promulgated by the Secretary.
(2) AGENTS
AND
CONTRACTORS.—A person
acting in the capacity of an agent or contractor of
a health care provider, health plan, health oversight
agency, public health authority, health researcher,
employer, insurer, school, institution of higher edu-
cation, or insurance support organization shall cre-
ate and maintain, with respect to any protected
health information disclosure made by the person
that is authorized under one of section 202, 203,
204, or 206 through 213, a record of the disclosure
in accordance with regulations promulgated by the
Secretary.
(b) RECORD OF DISCLOSURE PART OF PROTECTED
HEALTH INFORMATION.—A record created and main-
tained under subsection (a) shall be maintained as pro-
tected health information for not less than 7 years.
SEC. 113. PROHIBITION AGAINST RETALIATION.
A health information trustee may not adversely affect
another person, directly or indirectly, because such person
has exercised a right under this Act, disclosed information
relating to a possible violation of this Act, or associated
with, or assisted a person in the exercise of a right under
this Act.
TITLE II—RESTRICTIONS ON
USE AND DISCLOSURE
SEC. 201. GENERAL RULES REGARDING USE AND DISCLO-
SURE.
(a) GENERAL RULE.—A health information trustee
may not use or disclose protected health information ex-
cept as authorized under this title.
(b) SCOPE OF USE AND DISCLOSURE.—
(1) COMPATIBILITY
WITH
PURPOSE
FOR
OB-
TAINING
INFORMATION.—A 
health 
information
trustee may not use, or disclose to any person, pro-
tected health information unless the use or disclo-
sure is compatible with and directly related to—
(A) the purposes for which the information
was obtained by the health information trustee;
and
(B) in the case where an individual has ex-
ecuted an authorization, for the specific purpose
authorized by the individual.
(2) LIMITATION
ON
AMOUNT
OF
INFORMA-
TION.—
(A) USE AND DISCLOSURE.—
(i) IN GENERAL.—Every use and dis-
closure of protected health information by
a health information trustee shall be lim-
ited to the minimum amount of informa-
tion necessary to accomplish the purpose
for which the information is used or dis-
closed.
(ii) 
NONIDENTIFIABLE
INFORMA-
TION.—A health information trustee shall
use and disclose nonidentifiable health in-
formation, in lieu of protected health infor-
mation, to the maximum extent possible,
consistent with the purpose for the use or
disclosure.
(iii) CODED HEALTH INFORMATION.—
A health information trustee shall use and
disclose coded health information, in lieu of
any other kind of protected health informa-
tion, to the maximum extent possible, con-
sistent with the purpose for the use or dis-
closure.
(B) COLLECTION, CREATION, AND
RE-
QUESTS.—A health information trustee may not
collect, create, or request the disclosure of,
more protected health information than is nec-
essary to accomplish the purpose for which the
information is collected, created, or requested.
(c) SPECIAL RULES FOR PROTECTED HEALTH IN-
FORMATION SUBFILES.—
(1) SEGREGATION.—A health information trust-
ee shall, upon creating or obtaining protected health
information, comply with the request of a subject of
such information—
(A) to segregate any amount or type of
protected health information; and
(B) to maintain such protected health in-
formation as one or more protected health in-
formation subfiles.
(2) DISCLOSURE AND USE.—
(A) IN
GENERAL.—Subject to subpara-
graph (B), a person, other than a health care
provider who is otherwise authorized to access
or use protected health information about an
individual contained in a protected health infor-
mation subfile for purposes of delivering health
care to the individual, may not use or disclose
any information that is in the subfile, except as
authorized under section 202, 203, or 206.
(B) 
EMPLOYEES, 
AGENTS, 
CONTRAC-
TORS.—A health information trustee, with re-
spect to a protected health information subfile
created pursuant to paragraph (1), shall limit
use of the subfile to those employees, contrac-
tors, or agents of the trustee, described by
name or job title, who, with respect to the
subfile are authorized, pursuant to section 202
or 203, to use or obtain such information.
(C) INFORMATION
ON
EXISTENCE
OF
SUBFILES.—A health information trustee may
not disclose information about the existence of
a health information subfile to any person who
is not authorized to obtain, access, or use the
subfile.
(d) NO GENERAL REQUIREMENT TO DISCLOSE.—
Nothing in this title that permits a disclosure of protected
health information shall be construed to require such dis-
closure.
(e) LIMITATIONS ON DISCLOSURE AND USE WITHIN
A TRUSTEE.—
(1) CONDITION OF TREATMENT OR PAYMENT.—
A health information trustee may not condition de-
livery of health care, or payment for services, on the
receipt of an authorization described in section 202
or 203 that authorizes the disclosure of protected
health information to any employee, agent, or con-
tractor who does not perform a legitimate and nec-
essary function with respect to the purpose for
which the information was obtained or created.
(2) EMPLOYMENT.—A health information trust-
ee may not condition employment on the receipt of
an authorization described in section 202 or 203
that authorizes the disclosure of protected health in-
formation to any employee, agent, or contractor who
does not perform a legitimate and necessary function
with respect to the purpose for which the informa-
tion was obtained or created.
(f) IDENTIFICATION OF DISCLOSED INFORMATION AS
PROTECTED INFORMATION.—Except as provided in this
title, a health information trustee may not disclose pro-
tected health information unless such information is clear-
ly identified as protected health information that is subject
to this title.
(g) INFORMATION IDENTIFYING PROVIDERS.—The
Secretary shall issue regulations protecting information
identifying health care providers in order to promote the
availability of health care services.
(h) USE OF SOCIAL SECURITY NUMBER.—A Social
Security account number, or a derivative of a Social Secu-
rity account number, may not be used by a health informa-
tion trustee for any purpose relating to protected health
information or the use or disclosure of such information.
(i) MULTIPLE RECORDS.—No person may aggregate,
compile, link, or match protected health information held
by two or more different health information trustees, or
two or more protected health information subfiles pertain-
ing to an individual, without obtaining specific authoriza-
tion under section 202 or 203 for such use.
(j) NO EFFECT OF AGENCY ON DUTY OR LIABILITY
OF PRINCIPAL.—An agreement or relationship between a
trustee and an agent or contractor does not relieve a
health information trustee of any duty or liability under
this Act.
SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION FOR TREAT-
MENT OR PAYMENT.
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee may disclose protected health information for
purposes of treatment or payment pursuant to an author-
ization executed by an individual who is the subject of the
information (or a person acting for the individual pursu-
ant to State law) if each of the following requirements is
met:
(1) WRITING.—The authorization is in written
or electronic form, signed or electronically authenti-
cated by the individual, and dated.
(2) SEPARATE FORMS.—Separate forms author-
izing disclosures for treatment and separate forms
authorizing disclosures for payment processes are
provided to the individual.
(3) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is specified, or is described, in
the authorization.
(4) TRUSTEE DESCRIBED.—The trustee who is
authorized to disclose such information is specifically
identified, or is described, in the authorization.
(5) RECIPIENT
DESCRIBED.—The person to
whom the information is to be disclosed is specifi-
cally identified, or is described, in the authorization.
(6) RIGHT TO REVOKE OR AMEND.—The au-
thorization contains an acknowledgement that the
individual who is executing the authorization has the
right to revoke or amend the authorization, subject
to subsection (b).
(7) PURPOSE
DESCRIBED.—The authorization
describes in detail the purpose for which the infor-
mation will be used.
(8) STATEMENT OF INTENDED DISCLOSURES.—
The authorization contains an acknowledgment that
the individual who is executing the authorization has
read a statement of any disclosures of the protected
health information that the recipient intends to
make.
(9) USE AND DISCLOSURE RESTRICTED.—The
authorization includes a statement that the informa-
tion will be used and disclosed solely for one or more
purposes specified in the authorization.
(10) EXPIRATION DATE SPECIFIED.—The au-
thorization specifies a date on which, or event upon
which, the authorization expires, which shall be no
later than one year after the date on which the au-
thorization is executed.
(b) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN GENERAL.—An authorization under sub-
section (a) shall be subject to revocation and amend-
ment at any time by the individual who executed the
authorization, except that—
(A) the revocation or amendment shall be
in writing; and
(B) an authorization executed for the pur-
pose of validation of expenditures for health
care that the individual has authorized to be
rendered may not be revoked.
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation pursuant to an authorization described in
subsection (a) that has been revoked shall not be
subject to any liability or penalty under this Act if
the trustee has no actual or constructive notice of
the revocation at the time the trustee makes the dis-
closure.
(c) MODEL AUTHORIZATIONS.—The Secretary, after
providing notice and opportunity for public comment, shall
develop and disseminate model written authorizations of
the type described in subsection (a) and model statements
of intended disclosures of the type described in subsection
(a)(7).
(d) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization for not less than 7 years.
SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION FOR PUR-
POSES OTHER THAN TREATMENT OR PAY-
MENT.
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee may disclose protected health information for
a purpose other than treatment or payment pursuant to
an authorization executed by an individual who is the sub-
ject of the information (or a person acting for the individ-
ual pursuant to State law) if each of the following require-
ments is met:
(1) GENERAL
REQUIREMENTS.—The require-
ments of paragraphs (1) through (7) of section
202(a).
(2) STATEMENT OF INTENDED DISCLOSURES.—
The statement of intended disclosure shall be in
writing, and shall be received by the individual au-
thorizing the disclosure on or before the date the au-
thorization is executed.
(3) EXPIRATION
DATE
SPECIFIED.—The au-
thorization specifies a date on which, or an event
upon which, the authorization expires, which shall
not occur more than 1 year from the date of the exe-
cution of the authorization.
(b) LIMITATION
ON REQUESTS
FOR AUTHORIZA-
TIONS.—
(1) CONDITION OF TREATMENT OR PAYMENT.—
A health information trustee may not condition de-
livery of treatment, or payment for services, on the
receipt of an authorization described in subsection
(a).
(2) EMPLOYMENT.—A health information trust-
ee may not adversely affect, or condition, the em-
ployment of any person based on the agreement or
refusal of the person to execute or provide an au-
thorization described in subsection (a).
(c) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN GENERAL.—An individual may in writing
revoke or amend an authorization described in sub-
section (a).
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation pursuant to an authorization described in
subsection (a) that has been revoked shall not be
subject to any liability or penalty under this Act if
the trustee has no actual or constructive notice of
the revocation at the time the trustee makes the dis-
closure.
(d) MODEL AUTHORIZATIONS.—The Secretary, after
notice and opportunity for public comment, shall develop
and disseminate model written authorizations of the type
described in subsection (a) and model statements of the
intended disclosures of the type described in subsection
(a)(2).
SEC. 204. CREATION OF NONIDENTIFIABLE AND CODED IN-
FORMATION.
(a) CREATION
OF
NONIDENTIFIABLE
INFORMA-
TION.—A health information trustee may disclose pro-
tected health information about an individual to an em-
ployee, agent, or contractor for the purpose of creating
nonidentifiable health information if—
(1) the individual is informed of the purpose for
the creation of the nonidentifiable information;
(2) the individual is given the option to prohibit
any specific uses of the nonidentifiable information,
such as use of the information for marketing pur-
poses; and
(3) the health information trustee does not con-
dition the delivery of health care, payment for serv-
ices, or employment, on the granting by the individ-
ual of permission to create the nonidentifiable infor-
mation.
(b) CREATION OF CODED HEALTH INFORMATION.—
A health care provider may create coded health informa-
tion, or disclose protected health information about an in-
dividual to an employee, agent, or contractor for the pur-
pose of creating coded health information, if—
(1) the individual is informed of the purpose for
the creation of the coded information;
(2) the individual is informed of which persons
will have the authority to link or match the coded
health information to reveal the identity of the indi-
vidual;
(3) the individual gives written authorization
for a disclosure for this purpose in accordance with
subsections (a)(1) through (a)(3), (c), and (d) of
section 203;
(4) the health care provider does not condition
the delivery of health care, payment for services, em-
ployment, or the terms of employment on the grant-
ing by the individual of permission to create the
coded health information; and
(5) agents and contractors who receive pro-
tected health information for the purpose of creating
coded health information use the information exclu-
sively for such purpose.
SEC. 205. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—Except as provided in subsection
(c), a health care provider, or a person who receives pro-
tected health information under section 206, may disclose
protected health information regarding an individual who
is an inpatient in a health care facility to the individual’s
next of kin, to an individual representative of the individ-
ual, or to an individual with whom the individual has a
significant personal relationship if—
(1) the individual who is the subject of the in-
formation—
(A) has been notified of the individual’s
right to object at the time of admission to the
facility and has not objected to the disclosure;
or
(B) is in a physical or mental condition
such that it would not be possible to notify the
individual of the right to object and there are
no prior indications that the individual would
object; and
(2) the information relates to health care cur-
rently being provided to the individual at the time
of the disclosure.
(b) DIRECTORY INFORMATION.—
(1) DISCLOSURE.—Except as provided in sub-
section (c), a health information trustee may disclose
to any person protected health information concern-
ing an individual if the information is described in
paragraph (2) and the individual who is the subject
of the information—
(A) has been notified of the individual’s
right to object and has not objected to the dis-
closure; or
(B) is in a physical or mental condition
such that it would not be possible to notify the
individual of the right to object and there are
no prior indications that the individual would
object.
(2) INFORMATION
DESCRIBED.—The informa-
tion referred to in paragraph (1) is any one or more
of the following:
(A) The name of the individual who is the
subject of the information.
(B) The general health status of the indi-
vidual, described as critical, poor, fair, stable,
or satisfactory, or in terms denoting similar
conditions.
(C) The location of the individual, if on a
premises controlled by a health care provider.
(c) EXCEPTION.—A health care provider may not dis-
close protected health information without specific author-
ization pursuant to section 203—
(1) in the case of a disclosure under subsection
(b), if disclosure of the location of the individual
would reveal specific information about the physical
or mental condition of the individual; or
(2) in the case of a disclosure under subsection
(a) or (b), if the provider has reason to believe that
the disclosure could lead to physical, mental, or emo-
tional harm to the individual.
(d) DECEASED INDIVIDUAL.—
(1) IDENTIFICATION.—A health information
trustee may disclose protected health information if
necessary to assist in the identification of a deceased
individual.
(2) REGULATIONS.—The Secretary shall de-
velop and establish through regulation a procedure
for obtaining protected health information relating
to a deceased individual when there is no individual
representative for such individual.
SEC. 206. EMERGENCY CIRCUMSTANCES.
(a) DISCLOSURE WHEN SUBJECT OF INFORMATION
IS IN DANGER.—A health information trustee who re-
ceives protected health information under this title may
disclose such protected health information to a health care
provider or emergency medical personnel, or use such in-
formation in emergency medical circumstances, to the ex-
tent necessary to protect the health or safety of an individ-
ual who is a subject of such information from serious im-
minent harm.
(b) DISCLOSURE WHEN ANOTHER INDIVIDUAL IS IN
DANGER.—A health information trustee may disclose pro-
tected health information, to the extent necessary, where
such trustee determines that—
(1) there is an identifiable threat of serious in-
jury or death to an identifiable individual or group
of individuals; and
(2) the disclosure of the information to the per-
son is necessary to prevent or significantly reduce
the possibility of such threat.
SEC. 207. OVERSIGHT.
(a) IN GENERAL.—A health information trustee,
other than a public health authority or a health re-
searcher, may disclose protected health information to—
(1) a health oversight agency for any function
of the agency authorized by law, if—
(A) there is probable cause to believe fraud
has been committed;
(B) the oversight agency is investigating
the fraud;
(C) the oversight agency has obtained a
subpoena for purposes of obtaining the informa-
tion; and
(D)(i) a subject of the information is be-
lieved to have committed the fraud; or
(ii) the information is necessary to permit
the agency to investigate the fraud; or
(2) a health oversight agency charged by law to
protect individuals from harm, abuse, neglect, or ex-
ploitation, if the information is necessary to inves-
tigate whether abuse, neglect, or exploitation of an
individual has occurred.
(b) USE OF CODED HEALTH INFORMATION.—The
health oversight agency shall receive exclusively coded
health information under subsection (a) whenever the pur-
pose of the agency may be accomplished using only such
information.
(c) NOTICE TO SUBJECTS.—In any case where an in-
dividual who is a subject of protected health information
disclosed under subsection (a) is not believed to have com-
mitted fraud, the individual shall be notified, at the first
practical opportunity—
(1) that an investigation described in such sub-
section is being conducted;
(2) of the reason why disclosure of the informa-
tion is necessary; and
(3) of all intended subsequent disclosures of the
information that the agency intends to make.
(d) USE IN ACTION AGAINST INDIVIDUALS.—
(1) IN GENERAL.—Subject to paragraph (2),
protected health information about an individual
that is disclosed under this section may not be used
in, or disclosed to any person for use in, an adminis-
trative, civil, or criminal action or investigation di-
rected against the individual, unless the action or in-
vestigation arises out of and is directly related to the
purpose for which the disclosure was authorized
under subsection (a).
(2) SPECIAL RULE.—A health oversight agency
may not disclose protected health information re-
ceived by the agency under subsection (a)(2) for any
purpose other than protecting individuals from
harm, abuse, neglect, or exploitation.
(e) PUBLIC HEALTH AND HEALTH RESEARCH.—A
public health authority may disclose protected health in-
formation to a health oversight agency only if such infor-
mation is necessary for use in an investigation of whether
the authority has committed fraud. A health researcher
may disclose protected health information to a health over-
sight agency only if such information is necessary for use
in an investigation of whether the researcher has commit-
ted fraud.
SEC. 208. ACCREDITATION.
(a) IN GENERAL.—A health information trustee may
disclose protected health information to an accrediting
body for the exclusive purpose of permitting the accredit-
ing body to carry out accreditation, licensing, or
credentialing activities.
(b) USE OF CODED HEALTH INFORMATION.—The
accrediting body shall receive exclusively coded health in-
formation under subsection (a) whenever the purpose of
the body may be accomplished using only such informa-
tion.
(c) RESTRICTION ON USE AND DISCLOSURE.—A per-
son to whom protected health information is disclosed
under subsection (a) may not use or disclose the informa-
tion for any purpose other than the purpose for which the
information was disclosed to the person.
SEC. 209. PUBLIC HEALTH.
(a) DISCLOSURES BY PROVIDERS.—A health care
provider may disclose protected health information about
an individual to a public health authority where—
(1) the information is disclosed for the purpose
of permitting the authority to ascertain the identity
of such individual;
(2) there is a specific nexus between such indi-
vidual’s identity and a threat of death or injury to
any person; and
(3) knowledge of such individual’s identity
would allow the public health authority to prevent or
significantly reduce the possibility of injury or death
to any person.
(b) LIMITATION ON LIABILITY.—A health informa-
tion trustee shall not be liable to any person for a disclo-
sure of protected health information under this section
that is made based upon a good faith belief by the trustee
of a representation made by a public health authority that
such disclosure satisfies the requirements of subsection
(a).
(c) LIMITATION ON USE AND DISCLOSURE BY PUB-
LIC HEALTH AUTHORITIES.—A public health authority
may not use or disclose protected health information for
any purpose other than for public health reporting, sur-
veillance, protection, investigation, or intervention.
SEC. 210. HEALTH RESEARCH.
(a) IN GENERAL.—A health information trustee may
disclose protected health information, other than coded
health information, to a health researcher for use in a re-
search project engaged in by the health researcher, if an
institutional review board, using standards and procedures
that are generally consistent with the official written pol-
icy of the Secretary with respect to research involving
human subjects conducted, supported, or otherwise subject
to regulation by Federal departments and agencies, and
this Act, determines that the research project—
(1) requires use of the protected health infor-
mation for the effectiveness of the project and could
(c) ANONYMIZATION OF PREVIOUSLY STORED BIO-
LOGICAL SAMPLES.—The Secretary may develop interim
guidelines for the use by a health researcher of biological
samples derived from a human body collected before the
effective date of this Act. Such guidelines shall address
the requirements pertinent to a health researcher who
wishes to use stored biological samples derived from a
human body in nonidentifiable or coded form. Such guide-
lines shall authorize a health researcher, for the purpose
of facilitating future health research—
(1) to convert protected health information into
nonidentifiable information or coded health informa-
tion, if such conversion is permitted in a written au-
thorization; or
(2) if no such authorization exists, to make
such conversion after publishing notice of the re-
searcher’s intent and providing individuals the op-
portunity to prohibit the use of their biological sam-
ples for such purpose.
(d) OBLIGATIONS OF RECIPIENT.—A person who re-
ceives protected health information pursuant to subsection
(a)—
(1) shall remove or destroy, at the earliest op-
portunity consistent with the purposes of the project,
information that would enable an individual to be
identified, unless—
(A) an institutional review board has de-
termined that there is a health or research jus-
tification for retention of such identifiers; and
(B) there is an adequate plan to protect
the identifiers from disclosure that is inconsist-
ent with this section; and
(2) shall use the information solely for purposes
of the health research project for which disclosure
was authorized by an institutional review board
under subsection (a).
SEC. 211. JUDICIAL AND ADMINISTRATIVE PURPOSES.
A health care provider, health plan, health oversight
agency, employer, school, institution of higher education,
insurer, court, or a person who receives protected health
information pursuant to section 206 may disclose pro-
tected health information about an individual—
(1) pursuant to the requirements governing
subpoenas, warrants, and court orders under sec-
tions 212 and 213, where such information has been
determined to be discoverable by a court under any
applicable rules of civil or criminal procedure;
(2) to a court, and to others as ordered by the
court, if the information is developed in response to
a court-ordered physical or mental examination;
(3) where the subject of such information has
brought a claim for medical malpractice against a
health care provider and the information is nec-
essary for the defense of the claim; and
(4) to legal counsel for the person making the
disclosure, where the disclosure is necessary to en-
sure compliance with this Act or any other legal re-
quirement.
SEC. 212. GENERAL REQUIREMENTS GOVERNING SUBPOE-
NAS.
(a) IN GENERAL.—A health care provider, health
plan, health oversight agency, employer, school, institution
of higher education, insurer, court, or a person who re-
ceives protected health information pursuant to section
206 may disclose protected health information to any per-
son, other than a law enforcement authority, under section
211(1), if the disclosure is pursuant to a subpoena issued
on behalf of a party to a lawsuit or other judicial or ad-
ministrative proceeding who has complied with subsection
(b) or (c), and subsection (d).
(b) REQUEST FOR ACCESS BY COUNSEL TO REVIEW
PROTECTED HEALTH INFORMATION.—A person may have
access to protected health information under subsection
(a), by means solely of a review of the information by the
person’s counsel, acting in the capacity of an officer of
the court, and on premises of, and under the control of,
the court, if—
(1) the person has included in a subpoena a
proffer of evidence specifying with reasonable speci-
ficity the information to which access is sought and
the precise grounds for seeking such access for re-
view;
(2) a copy of such subpoena for access to re-
view, together with a notice of the individual’s right
to challenge the subpoena under subsection (d), has
been served upon the individual on or before the
date of return of the subpoena;
(3)(A) 15 days have passed since the date of
service on the individual, and within that period the
individual has not initiated a challenge in accordance
with subsection (d)(1); or
(B) such access is ordered by the court; and
(4) such counsel agrees not to copy such infor-
mation, remove such information from the court
premises, or disclose the information to any person
other than the person permitted access under this
subsection.
(c) REQUEST TO OBTAIN PROTECTED HEALTH IN-
FORMATION FOR INTRODUCTION IN COURT.—
(1) REQUIREMENTS FOR OBTAINING INFORMA-
TION.—A person may obtain protected health infor-
mation about an individual pursuant to a subpoena,
for purposes of introducing such information as evi-
dence in a court, only if—
(A) counsel for the person has obtained ac-
cess to the information under subsection (b);
(B) a copy of the subpoena to obtain the
information for introduction in court, specifying
the precise information sought and the precise
grounds for seeking introduction of the infor-
mation as evidence in court, together with a no-
tice of the individual’s right to challenge the
subpoena under subsection (d), has been served
upon the individual on or before the date of re-
turn of such subpoena; and
(C)(i) 15 days have passed since the date
of service on the individual, and within that
time period the individual has not indicated a
challenge in accordance with subsection (d)(1);
or
(ii) the information is ordered to be pro-
vided to the court.
(2) USE AND DISCLOSURE.—A person who ob-
tains protected health information under paragraph
(1) may use and disclose such information only for
the purpose of prosecuting or defending the lawsuit
or other judicial or administrative proceeding de-
scribed in subsection (a).
(d) CHALLENGE PROCEDURES.—
(1) MOTION
TO
QUASH
SUBPOENA.—After
being served of a copy of a subpoena seeking access
for review by counsel of, or access to, protected
health information under subsection (b), or a sub-
poena seeking to obtain protected health information
for introduction as evidence in court, under sub-
section (c), an individual who is a subject of such in-
formation may file in any court of competent juris-
diction a motion to quash the subpoena.
(2) STANDARD FOR DECISION.—
(A) IN GENERAL.—The court shall grant a
motion under paragraph (1) unless the respond-
ent demonstrates—
(i) by clear and convincing evidence
that the information is necessary in rela-
tion to the lawsuit or other judicial or ad-
ministrative proceeding with respect to
which the information is sought, includ-
ing—
(I) a demonstration that use or
disclosure of solely nonidentifiable
health information would be insuffi-
cient to accomplish the purpose for
which the information is sought; and
(II) if protected health informa-
tion that is not coded health informa-
tion is sought, a demonstration that
use or disclosure of coded health in-
formation would be insufficient to ac-
complish the purpose for which the in-
formation is sought; and
(ii) that the need of the respondent
for the information outweighs the privacy
interest of the individual.
(B) CRITERIA
FOR
DECISION.—In deter-
mining whether the need of the respondent for
the information outweighs the privacy interest
of the individual, the court shall consider—
(i) the particular purpose for which
the information was collected;
(ii) the invasion of the individual’s
privacy caused by the disclosure;
(iii) the degree to which disclosure of
the information would embarrass, injure,
or further invade, the privacy of the indi-
vidual;
(iv) the effect of the disclosure on the
individual’s future health care;
(v) the importance of the information
to the lawsuit or proceeding; and
(vi) any other relevant factor.
(3) ATTORNEY’S FEES.—In the case of a mo-
tion brought under paragraph (1) in which the indi-
vidual who brought the motion has prevailed in
whole or in part, the court may assess against the
respondent a reasonable attorney’s fee and other liti-
gation costs and expenses (including expert fees)
reasonably incurred.
(e) SEALING OF INFORMATION.—Any portion of a
record of a court that contains protected health informa-
tion disclosed under this section shall be kept by the court
under seal and used or disclosed only pursuant to an order
of the court consistent with this section.
SEC. 213. ADDITIONAL REQUIREMENTS FOR LAW ENFORCE-
MENT ACCESS.
(a) LAW ENFORCEMENT SUBPOENAS
AND WAR-
RANTS IN GENERAL.—A health care provider, health plan,
health oversight agency, employer, school, institution of
higher education, insurer, court, or a person who receives
protected health information pursuant to section 206 may
disclose protected health information to a law enforcement
authority under section 211(1), if—
(1)(A) the disclosure is made pursuant to a
subpoena for review under section 212(b), a sub-
poena for purposes of introducing evidence in a
court under section 212(c), or both, issued under the
authority of a grand jury or a court; and
(B) the requirements of subsections (b) through
(e) of section 212, and subsections (b) and (c) of
this section, are satisfied;
(2) the disclosure is made pursuant to a judicial
warrant for search and seizure and the requirements
of subsection (d) are satisfied; or
(3)(A) the disclosure is made pursuant to a
subpoena for purposes of introducing evidence in a
court under section 212(c), issued under the author-
ity of a grand jury or a court, and obtained pursu-
ant to subsection (d)(5) following the execution of a
judicial warrant for search and seizure under sub-
section (d); and
(B) the requirements of subsections (c) through
(e) (other than subsection (c)(1)(A)) of section 212,
and subsections (b) and (c) of this section, are satis-
fied.
(b) CLEAR AND CONVINCING REQUIREMENT.—A law
enforcement authority may not obtain protected health in-
formation about an individual under subsection (a) unless
the authority demonstrates by clear and convincing evi-
dence that the information is necessary to a legitimate law
enforcement inquiry into a particular violation of criminal
law being conducted by the authority.
(c) LIMITATION
ON USE
AND DISCLOSURE
FOR
OTHER
LAW
ENFORCEMENT
INQUIRIES.—Protected
health information about an individual that is disclosed
under this section may not be used in, or disclosed to any
person for use in, any administrative, civil, or criminal ac-
tion or investigation directed against the individual, unless
the action or investigation arises out of, or is directly re-
lated to, the law enforcement inquiry for which the infor-
mation was obtained.
(d) REQUIREMENTS FOR WARRANTS FOR SEARCH
AND SEIZURE.—
(1) LIMITED
PURPOSE.—A health care pro-
vider, health plan, health oversight agency, em-
ployer, school, institution of higher education, in-
surer, or a person who receives protected health in-
formation pursuant to section 206 may disclose pro-
tected health information to a law enforcement au-
thority pursuant to a warrant for search and sei-
zure, issued under the authority of a court, for the
exclusive purpose of permitting the authority to se-
cure the information described in the warrant for de-
livery to the court.
(2) LIMITATION
ON
EXECUTION
OF
WAR-
RANTS.—In executing a warrant under paragraph
(1), a law enforcement authority shall engage in the
most minimal examination of protected health infor-
mation that is necessary in order to determine
whether the information is or is not within the scope
of the warrant. The authority immediately shall
place any such information that the authority deter-
mines is within the scope of the warrant under seal,
and shall deliver such sealed information, without
any further examination or other use or disclosure,
to the court. The authority may not use or disclose
for any purpose protected health information that
the authority determines is not within the scope of
the warrant, but that is obtained or discovered by
the authority directly or indirectly through execution
of the warrant.
(3) NOTICE OF WARRANT.—A law enforcement
authority that obtains protected health information
about an individual pursuant to the execution of a
warrant under paragraph (2) shall, not later than 30
days after the date of such execution, serve the indi-
vidual with, or mail to the last known address of the
individual, a notice that protected health information
about the individual was obtained, together with a
notice of the individual’s right to challenge the war-
rant under paragraph (4).
(4) 
CHALLENGE
PROCEDURES
FOR
WAR-
RANTS.—
(A) MOTION TO QUASH.—Within 15 days
after the date of service of a notice of execution
of a warrant of a law enforcement authority
seeking protected health information about an
individual under paragraph (3), the individual
(or any other person who was in possession of
the information and against whom the warrant
was executed) may file in any court of com-
petent jurisdiction a motion to quash the war-
rant.
(B) STANDARD FOR DECISION.—The court
shall grant a motion under subparagraph (A)
unless the law enforcement authority dem-
onstrates by clear and convincing evidence that
the protected health information is necessary to
a legitimate law enforcement inquiry being con-
ducted by the law enforcement authority and
the government authority’s need for the infor-
mation outweighs the privacy interest of the in-
dividual.
(C) ATTORNEY’S FEES.—In the case of a
motion brought under subparagraph (A) in
which the individual has prevailed, in whole or
in part, the court may assess against the law
enforcement authority reasonable attorney’s
fees and other litigation costs (including expert
fees) reasonably incurred.
(5) ACTION IN COURT ON INFORMATION DELIV-
ERED.—Upon termination of the period described in
paragraph (4)(A) (in a case where a motion to
quash is not filed under such paragraph), or upon
the denial of a motion to quash under such para-
graph, the law enforcement authority may obtain
protected health information delivered to the court
under this subsection solely through a disclosure
under subsection (a)(3).
(6) SEALING OF INFORMATION.—Any protected
health information that is delivered to a court under
this section shall be kept by the court under seal and
used or disclosed only pursuant to an order of the
court consistent with this section.
TITLE III—SANCTIONS
Subtitle A—Civil Sanctions
SEC. 301. CIVIL PENALTY.
(a) VIOLATION.—Any person who the Secretary de-
termines has materially failed to comply with this Act shall
be subject, in addition to any other penalties that may
be prescribed by law, to—
(1) a civil penalty of not more than $25,000 for
each such violation, but not to exceed $150,000 in
the aggregate for multiple violations in any one year;
and
(2) a civil penalty of not more than $500,000
and exclusion from participation in the program
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, and any other
federally funded health care program, if the Sec-
retary finds that such violations have occurred with
such frequency as to constitute a general business
practice.
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.—
Section 1128A of the Social Security Act, other than sub-
sections (a) and (b) and the second sentence of subsection
(f) of that section, shall apply to the imposition of a civil,
monetary, or exclusionary penalty under this section in the
same manner as such provisions apply with respect to the
imposition of a penalty under section 1128A of such Act.
SEC. 302. CIVIL ACTION.
(a) IN GENERAL.—An individual who is aggrieved by
conduct in violation of this Act may bring a civil action
to recover—
(1) such preliminary and equitable relief as the
court determines to be appropriate;
(2) the greater of—
(A) actual damages; and
(B) liquidated damages of—
(i) $25,000, in the case of a material
violation; or
(ii) $50,000, in the case of a violation
that was willful or resulted in profit or
monetary gain; and
(3) punitive damages.
(b) ATTORNEY’S FEES.—In the case of a civil action
brought under subsection (a) in which the individual has
substantially prevailed, the court may assess against the
respondent a reasonable attorney’s fee and other litigation
costs and expenses (including expert fees) reasonably in-
curred.
(c) LIMITATION.—No action may be commenced
under this section by an individual more than 3 years after
the date on which the violation was or should reasonably
have been discovered by the individual.
Subtitle B—Criminal Sanctions
SEC. 
311. 
WRONGFUL 
DISCLOSURE 
OF 
PROTECTED
HEALTH INFORMATION.
(a) OFFENSE.—Whoever knowingly—
(1) obtains protected health information relat-
ing to an individual in violation of this Act;
(2) discloses protected health information to an-
other person in violation of this Act;
(3) coerces or attempts to coerce a health infor-
mation trustee to disclose protected health informa-
tion in violation of this title; or
(4) without authorization pursuant to this Act,
identifies or attempts to identify an individual who
is the subject of protected health information that a
health information trustee has converted into coded
health information,
shall be punished as provided in subsection (b).
(b) PENALTIES.—A person referred to in subsection
(a) 
shall 
be 
fined 
under 
title 
18,
United States Code, imprisoned not more than 1 year, or
both, except that—
(1) if the offense is committed under false pre-
tenses, the person shall be fined under title 18,
United States Code, imprisoned not more than 5
years, or excluded from participation in the program
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, or any other fed-
erally funded health care program, or any combina-
tion of such penalties; and
(2) if the offense is committed with intent to
sell, transfer, or use protected health information for
commercial advantage, personal gain, or malicious
harm, the person shall be fined under title 18, Unit-
ed States Code, or imprisoned not more than 10
years, or excluded from participation in the program
under title XVIII of the Social Security Act, the pro-
gram under title XIX of such Act, or any other fed-
erally funded health care program, or any combina-
tion of such penalties.
TITLE IV—MISCELLANEOUS
SEC. 401. REGULATIONS.
(a) PROMULGATION.—
(1) CONSULTATION WITH ADVISORY GROUP.—
In promulgating regulations under this Act, the Sec-
retary shall appoint and consult an advisory group
of knowledgeable individuals.
(2) MEMBERSHIP.—The advisory group shall
consist of at least 7 but no more than 12 individ-
uals, including representatives of—
(A) health care providers;
(B) health care consumers;
(C) health plans;
(D) privacy advocates; and
(E) electronic security experts.
(3) RESPONSIBILITIES.—The advisory group
shall review all proposed rules and regulations and
submit recommendations to the Secretary. The advi-
sory group shall also assist the Secretary in estab-
lishing the standards for compliance with rules and
regulations, in developing an annual report to the
Congress on the status of the requirements set forth
in this Act, their cost impact, and any recommenda-
tions for modifications to this Act in order to ensure
efficient and confidential electronic interchange of
protected health information.
(b) CONSULTATION WITH OTHERS.—In promulgat-
ing regulations under this Act, the Secretary may con-
sult—
(1) privacy, industry, health care professional,
and consumer groups;
(2) medical societies; and
(3) academic computer security and privacy ex-
perts.
SEC. 402. RELATIONSHIP TO OTHER LAWS.
(a) IN GENERAL.—Nothing in this Act shall be con-
strued to preempt any provision of State law or any privi-
lege, whether derived from statute or common law, that—
(1) more completely protects the confidentiality
or privacy of an individual with respect to protected
health information about the individual than does
this Act; or
(2) provides a greater right of access to pro-
tected health information to a subject of the infor-
mation than does this Act.
(b) CRIMINAL PENALTIES.—A State may establish
and enforce criminal penalties with respect to a failure to
comply with a provision of this Act.
(c) PRIVILEGES.—This Act does not preempt or mod-
ify State common or statutory law to the extent such law
concerns a privilege of a witness or person in a court of
the State. This Act does not supersede or modify Federal
common or statutory law to the extent such law concerns
a privilege of a witness or person in a court of the United
States and more completely protects the confidentiality or
privacy of an individual with respect to protected health
information about the individual than does this Act. The
execution of an authorization pursuant to section 202 or
203 may not be construed as a waiver of any such privi-
lege.
(d) CERTAIN DUTIES UNDER STATE OR FEDERAL
LAW.—This Act does not preempt, supersede, or modify
the operation of any of the following:
(1) Any law that provides for the reporting of
vital statistics such as birth or death information.
(2) Any law requiring the reporting of abuse or
neglect information about any individual.
(3) Any State law relating to public or mental
health that prevents or otherwise restricts disclosure
of protected health information otherwise permitted
under this Act.
(4) Subpart II of part E of title XXVI of the
Public Health Service Act (relating to notifications
of emergency response employees of possible expo-
sure to infectious diseases).
(5) Any Federal law or regulation governing
confidentiality of alcohol and drug patient records.
(6) The Americans With Disabilities Act of
1990.
(7) Any Federal or State statute that estab-
lishes a privilege for records used in health profes-
sional peer review activities.
SEC. 403. EFFECTIVE DATES.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act shall take effect on the date that is 18 months
after the date of the enactment of this Act.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro-
vision of this Act shall take effect on the date of the enact-
ment of this Act if the provision imposes on the Secretary
a duty to develop, establish, or promulgate regulations,
guidelines, or model forms.
(c) DEADLINE FOR REGULATIONS.—The Secretary
shall promulgate regulations implementing this Act not
later than the date that is 12 months after the date of
the enactment of this Act.
SEC. 404. APPLICABILITY.
(a) PROTECTED HEALTH INFORMATION.—Except as
provided in subsection (b), the provisions of this Act shall
apply to any protected health information that is received,
created, used, maintained, or disclosed by a health infor-
mation trustee on or after the date that is 18 months after
the date of the enactment of this Act, regardless of wheth-
er the information existed or was disclosed prior to such
date.
(b) AUTHORIZATIONS FOR DISCLOSURES.—An au-
thorization for the disclosure of protected health informa-
tion about a protected individual that is executed by the
individual before the date that is 18 months after the date
of the enactment of this Act, and is recognized and valid
under State law on the day before such date, shall remain
valid and shall not be subject to the requirements of title
II until the date that is 30 months after the date of the
enactment of this Act, or the occurrence of the date or
event in the authorization upon which the authorization
expires, whichever occurs earlier.
Æ