I
106TH CONGRESS
1ST SESSION
H. R. 2455
To establish Federal penalties for prohibited uses and disclosures of individ-
ually identifiable health information, to establish a right in an individual
to inspect and copy their own health information, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JULY 1, 1999
Mr. SHAYS
(for himself, Mr. HILLIARD, Mr. LATOURETTE, and Mr.
MCHUGH) introduced the following bill; which was referred to the Com-
mittee on Commerce, and in addition to the Committees on Ways and
Means, and Government Reform, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisons
as fall within the jurisdiction of the committee concerned
A BILL
To establish Federal penalties for prohibited uses and disclo-
sures of individually identifiable health information, to
establish a right in an individual to inspect and copy
their own health information, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Consumer Health and Research Technology (CHART)
Protection Act’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
TITLE I—RESTRICTIONS ON USE AND DISCLOSURE
Sec. 101. General prohibitions and exceptions.
Sec. 102. Special rules for anonymized information.
Sec. 103. General requirements for authorization of disclosure of information.
Sec. 104. Disclosure in civil proceedings.
Sec. 105. Disclosure for criminal law enforcement purposes.
Sec. 106. Disclosures for archival research.
TITLE II—INDIVIDUALS’ RIGHTS
Sec. 201. Inspection and copying of health information.
Sec. 202. Amendment of individually identifiable health information.
Sec. 203. Notice of confidentiality practices.
TITLE III—ENFORCEMENT
Sec. 301. Criminal penalties.
Sec. 302. Civil action.
Sec. 303. Program exclusions.
TITLE IV—GENERAL PROVISIONS
Sec. 401. Standards for electronic disclosures.
Sec. 402. Authorized representatives.
Sec. 403. Relationship to other laws.
Sec. 404. Reports analyzing impact of Act.
Sec. 405. Effective date.
Sec. 406. Definitions.
TITLE I—RESTRICTIONS ON USE
AND DISCLOSURE
SEC. 101. GENERAL PROHIBITIONS AND EXCEPTIONS.
Except as otherwise provided in this Act, and subject
to the following exceptions, the following prohibited ac-
tions and inactions on the part of a person shall be consid-
ered a violation of this Act:
(1) DISCLOSURE IN ABSENCE OF, OR INCON-
SISTENT WITH, AUTHORIZATION.—
(A) IN GENERAL.—Subject to the excep-
tions described in subparagraph (B)—
(i) a negligent or intentional disclo-
sure of individually identifiable health in-
formation without an authorization with
respect to the information that satisfies
the requirements of section 103, is prohib-
ited, unless the disclosure is governed by
section 104 or 105; and
(ii) a negligent or intentional disclo-
sure of individually identifiable health in-
formation, by a person granted authority
under an authorization with respect to the
information that satisfies the requirements
of section 103, that is inconsistent with the
provisions of the authorization, is prohib-
ited.
(B) EXCEPTIONS.—A disclosure otherwise
prohibited under subparagraph (A) is not pro-
hibited when—
(i) made by an individual whose
health or health care is the subject of the
information (or an authorized representa-
tive of such an individual, pursuant to sec-
tion 402);
(ii) made for the purpose of providing,
or facilitating the provision of, health care
to an individual described in clause (i);
(iii) made for the purpose of facili-
tating payment activities related to health
care provided to an individual described in
clause (i);
(iv) made pursuant to a specific af-
firmative authorization, or a requirement,
under State or Federal law, for use in le-
gally authorized—
(I) reporting of abuse, domestic
violence, or neglect information about
any individual;
(II) disease or injury reporting
about any individual;
(III) public health surveillance,
such as birth and death reporting;
(IV) public health investigation
or intervention;
(V) management audits, financial
audits, or program monitoring and
evaluation; or
(VI) licensure, certification, ac-
creditation, utilization review, quality
assurance activities, benchmarking, or
outcomes management and assess-
ment;
(v) made pursuant to an authorization
granted in a contract providing health care
benefits for an individual described in
clause (i), for the purpose of licensure, cer-
tification, accreditation, utilization review,
quality assurance activities, benchmarking,
or outcomes management and assessment;
(vi) made to a health researcher—
(I) in accordance with a research
protocol approved by an institutional
review board that satisfies the re-
quirements of the policy set forth in
45 C.F.R. § 46.107 (or any successor
to such policy); or
(II) in accordance with section
106(a); or
(vii) made to a party to, or potential
party to, a merger or acquisition of a com-
mercial enterprise, in anticipation of, or
upon, the merger or acquisition.
(2) FAILURE
TO
PROVIDE
FOR
REASONABLE
PROTECTIONS
AGAINST
PROHIBITED
DISCLO-
SURES.—
(A) IN GENERAL.—Subject to the excep-
tion described in subparagraph (B), a negligent
or intentional failure to provide for reasonable
protections against disclosures of individually
identifiable health information that are prohib-
ited under this Act is prohibited, including—
(i) a failure to establish and enforce
reasonable and appropriate administrative,
technical, and physical safeguards—
(I) to ensure the confidentiality
of individually identifiable health in-
formation; and
(II) to protect against—
(aa) any reasonably antici-
pated threats or hazards to the
security or integrity of such in-
formation; and
(bb) unauthorized uses or
disclosures of the information;
(ii) a failure to establish procedures
for determining a response to a subpoena,
warrant, court order, or other request from
a government authority for disclosure of
such information; and
(iii) a failure to provide for secure de-
struction of such information, where de-
struction of the information is desired.
(B) EXCEPTION.—A failure described in
subparagraph (A) is not prohibited when it is
by an individual whose health or health care is
the subject of the information (or an authorized
representative of such an individual, pursuant
to section 402).
(3) FAILURE TO IMPLEMENT WRITTEN POLI-
CIES FOR COMPLIANCE.—
(A) IN GENERAL.—Subject to the excep-
tion described in subparagraph (B), with re-
spect to a person whose employees, agents, or
contractors come in contact with individually
identifiable health information in the course of
their employment, agency, or contract execu-
tion, a negligent or intentional failure to estab-
lish and implement written policies concerning
compliance 
with 
this 
Act 
is 
prohibited,
including—
(i) a failure to establish procedures
for monitoring access to individually identi-
fiable health information;
(ii) a failure to establish rules limiting
access to such information to persons
whose duties require such access; and
(iii) a failure to provide for the en-
forcement of such policies.
(B) EXCEPTION.—A failure described in
subparagraph (A) is not prohibited when it is
by an individual whose health or health care is
the subject of the information (or an authorized
representative of such an individual, pursuant
to section 402).
(4) FAILURE TO ENTER INTO WRITTEN AGREE-
MENT
WITH
BUSINESS
ASSOCIATES
RESPECTING
COMPLIANCE.—A negligent or intentional failure to
enter into a written agreement with an agent, con-
tractor, or other person to whom individually identi-
fiable health information is disclosed for a business
purpose (such as persons who encode or encrypt in-
formation, data management contractors, and utili-
zation review and accreditation organizations), prior
to such disclosure, specifying the limitations on their
use and retention of such information and informing
benefits for an individual described in subpara-
graph (A), for the purpose of licensure, certifi-
cation, accreditation, utilization review, quality
assurance activities, benchmarking, or outcomes
management and assessment.
(G) The use is by a health researcher and
is—
(i) in accordance with a research pro-
tocol approved by an institutional review
board and any other requirement or condi-
tion concerning such use established by
such a review board; or
(ii) in accordance with any require-
ment or condition concerning such use es-
tablished by a person making, or approv-
ing, a disclosure under section 106.
(H) The use is by a party to, or potential
party to, a merger or acquisition of a commer-
cial enterprise, in anticipation of, or upon, the
merger or acquisition.
(c) DISCLOSURE.—
(1) ANONYMIZED INFORMATION.—For purposes
of this Act, disclosure of anonymized information
shall not be considered disclosure of individually
identifiable health information, unless it is disclosed