I
107TH CONGRESS
2D SESSION
H. R. 5646
To restore standards to protect the privacy of individually identifiable health
information that were weakened by the August 2002 modifications, and
for other purposes.
IN THE HOUSE OF REPRESENTATIVES
OCTOBER 16, 2002
Mr. MARKEY (for himself, Mr. WAXMAN, Mr. DINGELL, Mr. BERMAN, and
Mr. CAPUANO) introduced the following bill; which was referred to the
Committee on the Energy and Commerce, and in addition to the Commit-
tees on Ways and Means, and Education and the Workforce, for a period
to be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee
concerned
A BILL
To restore standards to protect the privacy of individually
identifiable health information that were weakened by
the August 2002 modifications, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Stop Taking Our
Health Privacy (STOHP) Act of 2002’’.
SEC. 2. FINDINGS.
The Congress finds as follows:
(1) People in the United States are deeply con-
cerned about the confidentiality of their health infor-
mation. According to a recent survey conducted by
the Princeton Survey Research Associates, 1 in 6
people in the United States has done something out
of the ordinary to keep personal health information
confidential, including withholding information, pro-
viding inaccurate information, or, in some cases,
avoiding care entirely.
(2) Pursuant to the Health Insurance Port-
ability and Accountability Act of 1996 (Public Law
104–191; 110 Stat. 1936 et seq.) (commonly re-
ferred to as ‘‘HIPAA’’), the Clinton Administration
issued comprehensive medical privacy regulations
which were promulgated in final form in December
2000.
(3) Such regulations established a sound foun-
dation of privacy protections by prohibiting the use
or disclosure of an individual’s health information
unless specifically authorized by the regulations or
by the individual. The regulations also provided indi-
viduals with the right to be notified of the privacy
practices of health plans, health care providers, and
health care clearinghouses regarding disclosure of
their health information, the right to access and
copy their own health records, and the right to re-
quest corrections of their health records, among
other provisions.
(4) Such regulations took effect in April 2001
and require health care providers, health plans
(other than small health plans) and health care
clearinghouses to comply not later than April 2003.
(5) In August 2002, the Bush Administration
issued a final rule that significantly weakened med-
ical privacy protections in the December 2000 med-
ical privacy rule.
(6) The Bush Administration undermined med-
ical privacy protections by eliminating the rule’s re-
quirement that covered entities obtain patient con-
sent before using and disclosing patient health infor-
mation for treatment, payment, and health care op-
erations. This change means that patients’ medical
records can be used and disclosed without their per-
mission for a wide range of purposes including busi-
ness activities that have nothing to do with the
treatment of a patient, such as the sale or merger
of a health maintenance organization. This change
also allows the use and disclosure of information in
existing medical records even though patients dis-
closed the information with the understanding and
expectation that it would not be further used or dis-
closed without their consent. The elimination of con-
sent compromises the confidentiality at the heart of
physician-patient relationships, which is indispen-
sable for the delivery of high-quality, thorough care.
(7) The Bush Administration also undermined
medical privacy protections by expanding the cir-
cumstances under which patients’ information can
be shared without their knowledge or consent to in-
clude activities that consumers typically consider
marketing. This change was accomplished by nar-
rowing the scope of activities that are regulated by
the provisions of the rule governing marketing.
Under this change, pharmacies and other providers
can use a consumer’s medical information without
consent to mail the consumer unsolicited drug prod-
uct recommendations, without having to disclose fees
paid by drug companies for sending such commu-
nications or provide the consumer an opportunity to
decline to receive such communications in the future.
(8) The Bush Administration further under-
mined medical privacy protections by changing the
language in the section of the rule governing public
health to allow the disclosure of medical information
without patient permission to entities regulated by
the Food and Drug Administration, such as pharma-
ceutical companies and medical device manufactur-
ers, for an expanded and broad range of purposes
which may include marketing campaigns. In con-
trast, the December 2000 rule allowed nonconsen-
sual disclosure of patient health information for an
exclusive list of public health related activities, such
as for the purpose of reporting serious side effects
from a prescription drug to the Food and Drug Ad-
ministration.
(9) Reversal of the Bush Administration’s
changes to the December 2000 medical privacy rule
is integral to any effort to ensure medical privacy
protection for consumers and preserve access to
high-quality health care in the United States.
(10) Core medical privacy protections of the
December 2000 medical privacy rule should be re-
stored by—
(A) reinstating the patient consent require-
ment for treatment, payment, and health care
operations, while ensuring that the requirement
does not impede important health care activities
such as filling pharmaceutical prescriptions and
making referrals;
(B) returning to the December 2000 defi-
nition of ‘‘marketing’’ and thus ensuring that
activities typically considered marketing, such
as drug companies paying pharmacies to send
product recommendations to patients, fall under
the rule’s privacy protections relating to the use
of patient health information for marketing ac-
tivities; and
(C) eliminating the broad ‘‘public health’’
exemption created by the August 2002 rule.
SEC. 3. PURPOSE.
The purpose of this Act is to restore patient privacy
protections essential for high-quality health care that were
undermined by the Bush Administration’s August 2002
modifications of the December 2000 medical privacy rule.
SEC. 4. RESTORATION OF PRIVACY PROTECTIONS.
(a) CONSENT FOR USES OR DISCLOSURES TO CARRY
OUT TREATMENT, PAYMENT, OR HEALTH CARE OPER-
ATIONS.—
(1) IN GENERAL.—The modifications made to
section 164.506 of title 45, Code of Federal Regula-
tions, by the August 2002 medical privacy rule shall
have no force or effect.
(2) CLARIFICATION
REGARDING
INSTANCES
WHEN CONSENT IS NOT REQUIRED.—In addition to
the circumstances described in the December 2000
medical privacy rule, and notwithstanding any provi-
sion to the contrary, such section 164.506 shall be
construed and applied so as to permit a health care
provider to use or disclose an individual’s protected
health information without obtaining the prior con-
sent of the individual in the following circumstances:
(A) A health care provider may use or dis-
close an individual’s protected health informa-
tion to fill or dispense a prescription, search for
drug interactions related to that prescription,
and determine eligibility and obtain authoriza-
tion for payment regarding that prescription, if
the health care provider obtains written consent
from the individual as soon as practicable.
(B) A health care provider may use or dis-
close an individual’s protected health informa-
tion to carry out treatment of that individual
if—
(i) the individual and the health care
provider have not had in-person commu-
nication regarding such treatment;
(ii) obtaining consent would be im-
practicable;
(iii) the health care provider deter-
mines, in the exercise of professional judg-
ment, that the individual’s consent is clear-
ly inferred from the circumstances, such as
an order or referral from another health
care provider; and
(iv) the health care provider obtains
written consent from the individual as soon
as practicable.
(b) MARKETING.—
(1) IN GENERAL.—The modifications made by
the August 2002 medical privacy rule to the defini-
tion of the term ‘‘marketing’’ in section 164.501 of
title 45, Code of Federal Regulations, shall have no
force or effect.
(2) TREATMENT
OF
CERTAIN
COMMUNICA-
TIONS.—The exception for oral communications in
paragraph (2)(i) of the definition of the term ‘‘mar-
keting’’ in section 164.501 of title 45, Code of Fed-
eral Regulations, as contained in the December 2000
medical privacy rule, shall have no force or effect.
(3) AUTHORIZATIONS
FOR
MARKETING.—Sec-
tion 164.508 of title 45, Code of Federal Regula-
tions, shall be construed and applied so as to require
that, if an authorization is required for a use or dis-
closure for marketing, the authorization shall be
considered invalid unless it—
(A) uses the term ‘‘marketing’’;
(B) states that the purpose of the use or
disclosure involved is marketing;
(C) describes the specific marketing uses
and disclosures authorized, including whether
the protected health information involved—
(i) may be used for purposes internal
to the covered entity;
(ii) may be disclosed to, and used by,
a business associate of the covered entity;
and
(iii) may be disclosed to, and used by,
any person or entity other than a business
associate of the covered entity; and
(D) states that the use or disclosure of
protected health information for marketing will
directly result in remuneration to the covered
entity from a third party, in any case in which
a covered entity expects, or reasonably should
expect, that such remuneration will occur.
(c) PUBLIC HEALTH.—The modifications made to
section 164.512(b)(1)(iii) of title 45, Code of Federal Reg-
ulations, by the August 2002 medical privacy rule shall
have no force or effect.
SEC. 5. DEFINITIONS; EFFECTIVE DATE.
(a) IN GENERAL.—For purposes of this Act:
(1) DECEMBER 2000 MEDICAL PRIVACY RULE.—
The term ‘‘December 2000 medical privacy rule’’
means the final rule on standards for privacy of in-
dividually identifiable health information published
on December 28, 2000, in the Federal Register (65
Fed. Reg. 82462), including the provisions of title
45, Code of Federal Regulations, revised or added
by such rule.
(2) AUGUST 2002 MEDICAL PRIVACY RULE.—
The term ‘‘August 2002 medical privacy rule’’
means the final rule, published on August 14, 2002,
in the Federal Register (67 Fed. Reg. 53182), that
modified the December 2000 medical privacy rule.
(b) OTHER TERMS DEFINED.—For purposes of this
Act:
(1) BUSINESS
ASSOCIATE; COVERED
ENTITY;
HEALTH CARE PROVIDER.—The terms ‘‘business as-
sociate’’, ‘‘covered entity’’, and ‘‘health care pro-
vider’’ shall have the meaning given such terms in
section 160.103 of title 45, Code of Federal Regula-
tions, as contained in the December 2000 medical
privacy rule.
(2) DISCLOSURE; 
INDIVIDUAL, 
PROTECTED
HEALTH
INFORMATION; 
TREATMENT; 
USE.—The
terms ‘‘disclosure’’, ‘‘individual’’, ‘‘protected health
information’’, ‘‘treatment’’, and ‘‘use’’ shall have the
meaning given such terms in section 164.501 of title
45, Code of Federal Regulations, as contained in the
December 2000 medical privacy rule.
(c) EFFECTIVE
DATE; NO
REGULATIONS
RE-
QUIRED.—This Act shall take effect on the date of the
enactment of this Act and does not require the issuance
of regulations.
Æ