I
103D CONGRESS
2D SESSION
H. R. 4077
To establish a code of fair information practices for health information,
to amend section 552a of title 5, United States Code, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
MARCH 17, 1994
Mr. CONDIT (for himself, Mr. CONYERS, and Ms. VELA´ZQUEZ) introduced the
following bill; which was referred jointly to the Committees on Govern-
ment Operations, the Judiciary, and Energy and Commerce
A BILL
To establish a code of fair information practices for health
information, to amend section 552a of title 5, United
States Code, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Fair Health Information Practices Act of 1994’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Definitions.
TITLE I—FAIR INFORMATION PRACTICES FOR PROTECTED
HEALTH INFORMATION
Subtitle A—Treatment of Protected Health Information
Sec. 101. Duties and authorities of health use trustees.
Sec. 102. Duties and authorities of public health trustees.
Sec. 103. Duties and authorities of special purpose trustees.
Sec. 104. Duties and authorities of affiliated persons.
Subtitle B—Duties and Authorities of Health Information Trustees
PART 1—DUTIES OF HEALTH INFORMATION TRUSTEES
Sec. 111. Inspection of protected health information.
Sec. 112. Amendment of protected health information.
Sec. 113. Notice of information practices.
Sec. 114. Accounting for disclosures.
Sec. 115. Security.
PART 2—USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Sec. 121. General limitations on use and disclosure.
Sec. 122. Authorizations for disclosure of protected health information.
Sec. 123. Treatment, payment, and oversight.
Sec. 124. Next of kin and directory information.
Sec. 125. Public health.
Sec. 126. Emergency circumstances.
Sec. 127. Judicial, administrative, and other legal purposes.
Sec. 128. Health research.
Sec. 129. Law enforcement.
Sec. 130. Subpoenas, warrants, and search warrants.
Subtitle C—Access Procedures and Challenge Rights
Sec. 141. Access procedures for law enforcement subpoenas, warrants, and
search warrants.
Sec. 142. Challenge procedures for law enforcement subpoenas.
Sec. 143. Access and challenge procedures for other subpoenas.
Sec. 144. Construction of subtitle; suspension of statute of limitations.
Sec. 145. Responsibilities of Secretary.
Subtitle D—Miscellaneous Provisions
Sec. 151. Debit and credit card transactions.
Sec. 152. Access to protected health information outside of the United States.
Sec. 153. Standards for electronic documents and communications.
Sec. 154. Powers of attorney.
Sec. 155. Rights of incompetents.
Sec. 156. Rights of minors.
Subtitle E—Enforcement
Sec. 161. Civil actions.
Sec. 162. Civil money penalties.
Sec. 163. Alternative dispute resolution.
Sec. 164. Amendments to criminal law.
TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE
Sec. 201. Amendments to title 5, United States Code.
TITLE III—REGULATIONS; EFFECTIVE DATES; APPLICABILITY;
AND RELATIONSHIP TO OTHER LAWS
Sec. 301. Regulations.
Sec. 302. Effective dates.
Sec. 303. Applicability.
Sec. 304. Relationship to other laws.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds as follows:
(1) The right to privacy is a personal and fun-
damental right protected by the Constitution of the
United States.
(2) The improper use or disclosure of personally
identifiable health information about an individual
may cause significant harm to the interests of the
individual in privacy and health care, and may un-
fairly affect the ability of the individual to obtain
employment, education, insurance, credit, and other
necessities.
(3) Current legal protections for health infor-
mation vary from State to State and are inadequate
to meet the need for fair information practices
standards.
(4) The movement of individuals and health in-
formation across State lines, access to and exchange
of health information from automated data banks
and networks, and the emergence of multistate
health care providers and payors create a compelling
need for uniform Federal law, rules, and procedures
governing the use, maintenance, and disclosure of
health information.
(5) Uniform rules governing the use, mainte-
nance, and disclosure of health information are an
essential part of health care reform, are necessary to
support the computerization of health information,
and can reduce the cost of providing health services
by making the necessary transfer of health informa-
tion more efficient.
(6) An individual needs access to health infor-
mation about the individual as a matter of fairness,
to enable the individual to make informed decisions
about health care, and to correct inaccurate or in-
complete information.
(b) PURPOSES.—The purposes of this Act are as
follows:
(1) To define the rights of an individual with
respect to health information about the individual
that is created or maintained as part of the health
treatment and payment process.
(2) To define the rights and responsibilities of
a person who creates or maintains individually iden-
tifiable health information that originates or is used
in the health treatment or payment process.
(3) To establish effective mechanisms to enforce
the rights and responsibilities defined in this Act.
SEC. 3. DEFINITIONS.
(a) 
DEFINITIONS
RELATING
TO
PROTECTED
HEALTH INFORMATION.—For purposes of this Act:
(1) DISCLOSE.—The term ‘‘disclose’’, when
used with respect to protected health information,
means to provide access to the information, but only
if such access is provided by a health information
trustee to a person other than—
(A) the trustee or an officer or employee of
the trustee;
(B) an affiliated person of the trustee; or
(C) the individual who is the subject of the
information.
(2) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means the act or an instance of disclosing.
(3) PROTECTED HEALTH INFORMATION.—The
term ‘‘protected health information’’ means any in-
formation, whether oral or recorded in any form or
medium, that—
(A) is created or received by a health use
trustee or a public health trustee in a State;
and
(B) relates to the past, present, or future
physical or mental health of an individual, the
provision of health care to an individual, or
payment for the provision of health care to an
individual and—
(i) identifies the individual; or
(ii) with respect to which there is a
reasonable basis to believe that the infor-
mation can be used readily to identify the
individual.
(b) DEFINITIONS RELATING TO HEALTH INFORMA-
TION TRUSTEES.—For purposes of this Act:
(1) 
HEALTH
BENEFIT
PLAN.—The 
term
‘‘health benefit plan’’ means any public or private
entity or program that provides payments for health
care—
(A) including—
(i) a group health plan (as defined in
section 607 of the Employee Retirement
Income Security Act of 1974) or a multiple
employer welfare arrangement (as defined
(v) an organization, association, com-
mittee, joint board of trustees, or similar
group of representatives of 2 or more em-
ployers described in clause (iii) or 2 or
more employee organizations described in
clause (iv).
(2) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who is li-
censed, certified, registered, or otherwise authorized
by law to provide an item or service that constitutes
health care in the ordinary course of business or
practice of a profession.
(3) HEALTH
INFORMATION
TRUSTEE.—The
term ‘‘health information trustee’’ means a person
who—
(A) creates or receives protected health in-
formation that affects interstate commerce; and
(B) is a health use trustee, public health
trustee, or special purpose trustee.
(4) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person—
(A) who performs or oversees the perform-
ance of an assessment, evaluation, determina-
tion, or investigation relating to the licensing,
accreditation, or certification of health care
providers;
(B) who—
(i) enters into agreements with health
benefit plans that are offered to individuals
residing in a specific geographic region in
order to facilitate the enrollment of such
individuals in such plans; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a State or Federal
statute regulating the agreements; or
(C) who—
(i) performs or oversees the perform-
ance of an assessment, evaluation, deter-
mination, or investigation relating to the
effectiveness of, compliance with, or appli-
cability of, legal, fiscal, medical, or sci-
entific standards or aspects of performance
related to the delivery of, or payment for,
health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a State or Federal
statute regulating the assessment, evalua-
tion, determination, or investigation.
(5) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who conducts a health
research project.
(6) HEALTH USE TRUSTEE.—The term ‘‘health
use trustee’’ means a person who, with respect to
protected health information, receives, creates, uses,
maintains, or transmits such information while act-
ing in whole or in part in the capacity of—
(A) a health care provider, health benefit
plan, or health oversight agency; or
(B) an officer or employee of a person de-
scribed in subparagraph (A).
(7) PUBLIC
HEALTH
AUTHORITY.—The term
‘‘public health authority’’ means an authority of the
United States, a State, or a political subdivision of
a State that—
(A) is responsible for public health mat-
ters; and
(B) is conducting—
(i) a disease or injury reporting pro-
gram;
(ii) public health surveillance; or
(iii) a public health investigation.
(8) PUBLIC
HEALTH
TRUSTEE.—The term
‘‘public health trustee’’ means a person who, with
respect to protected health information, receives,
creates, uses, maintains, or transmits such informa-
tion while acting in whole or in part in the capacity
of—
(A) a health researcher;
(B) a public health authority; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(9) SPECIAL
PURPOSE
TRUSTEE.—The term
‘‘special purpose trustee’’ means a person who, with
respect to protected health information—
(A) receives such information under sec-
tion 126 (relating to emergency circumstances),
127 (relating to judicial, administrative, and
other legal purposes), 129 (relating to law en-
forcement), or 130 (relating to subpoenas, war-
rants, and search warrants); or
(B) is acting in whole or in part in the ca-
pacity of an officer or employee of a person de-
scribed in subparagraph (A) with respect to
such information.
(c) OTHER DEFINITIONS.—For purposes of this Act:
(1) AFFILIATED PERSON.—The term ‘‘affiliated
person’’ means a person who—
(A) is not a health information trustee;
(B) is a contractor, subcontractor, affiliate,
or subsidiary of a person who is a health infor-
mation trustee; and
(C) pursuant to an agreement or other re-
lationship with such trustee, receives, creates,
uses, maintains, or transmits protected health
information in order to conduct a legitimate
business activity of the trustee.
(2) HEALTH CARE.—The term ‘‘health care’’—
(A) means—
(i) any preventive, diagnostic, thera-
peutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or proce-
dure—
(I) with respect to the physical or
mental condition of an individual; or
(II) affecting the structure or
function of the human body or any
part of the human body, including
banking of blood, sperm, organs, or
any other tissue; or
(ii) any sale or dispensing of a drug,
device, equipment, or other item to an indi-
vidual, or for the use of an individual, pur-
suant to a prescription; but
(B) does not include any item or service
that is not furnished for the purpose of main-
taining or improving the health of an individual.
(3) HEALTH RESEARCH PROJECT.—The term
‘‘health research project’’ means a biomedical, epide-
miological, or health services research project, or a
health statistics project, that has been approved
by—
(A) an institutional review board for the
organization sponsoring the project;
(B) an institutional review board for each
health information trustee that maintains pro-
tected health information intended to be used in
the project; or
(C) an institutional review board estab-
lished or designated by the Secretary.
(4) INSTITUTIONAL REVIEW BOARD.—The term
‘‘institutional review board’’ means—
(A) a board established in accordance with
regulations of the Secretary under section
491(a) of the Public Health Service Act;
(B) a similar board established by the Sec-
retary for the protection of human subjects in
research conducted by the Secretary;
(C) a similar board established under regu-
lations of a Federal Government authority other
than the Secretary; or
(D) a similar board which meets such re-
quirements as the Secretary may specify.
(5) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means a lawful investiga-
tion or official proceeding inquiring into a specific
violation of, or failure to comply with, any criminal
or civil statute or any regulation, rule, or order is-
sued pursuant to such a statute.
(6) PERSON.—The term ‘‘person’’ includes an
authority of the United States, a State, or a political
subdivision of a State.
(7) SECRETARY.—The term ‘‘Secretary’’ means
the Secretary of Health and Human Services.
(8) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
TITLE 
I—FAIR 
INFORMATION
PRACTICES FOR PROTECTED
HEALTH INFORMATION
Subtitle A—Treatment of Protected
Health Information
SEC. 101. DUTIES AND AUTHORITIES OF HEALTH USE
TRUSTEES.
A health use trustee—
(1) shall comply with sections 111 (relating to
inspection), 112 (relating to amendment), 113 (re-
lating to notice of information practices), 114 (relat-
ing to accounting for disclosures), and 115 (relating
to security);
(2) may use protected health information if
such use is in accordance with section 121; and
(3) may disclose such information if such dis-
closure is in accordance with section 121 and 1 or
more of the following sections:
(A) Section 122 (relating to authoriza-
tions).
(B) Section 123 (relating to treatment,
payment, and oversight).
(C) Section 124 (relating to next of kin
and directory information).
(D) Section 125 (relating to public health).
(E) Section 126 (relating to emergency cir-
cumstances).
(F) Section 127 (relating to judicial, ad-
ministrative, and other legal purposes).
(G) Section 128 (relating to health re-
search).
(H) Section 129 (relating to law enforce-
ment).
(I) Section 130 (relating to subpoenas,
warrants, and search warrants).
SEC. 102. DUTIES AND AUTHORITIES OF PUBLIC HEALTH
TRUSTEES.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a public health trustee—
(1) shall comply with sections 111 (relating to
inspection), 114 (relating to accounting for disclo-
sures), and 115 (relating to security);
(2) may use protected health information if
such use is in accordance with section 121; and
(3) may disclose such information if—
(A) such disclosure is essential to fulfill a
public health purpose; or
(B) such disclosure is in accordance with
section 121 and 1 or more of the following
sections:
(i) Section 122 (relating to authoriza-
tions).
(ii) Section 125 (relating to public
health).
(iii) Section 126 (relating to emer-
gency circumstances).
(iv) Section 128 (relating to health re-
search).
(v) Section 129 (relating to law en-
forcement) (except section 129(a)(2)).
(b) DETERMINATIONS BY PUBLIC HEALTH TRUST-
EES SPECIFIC TO AN INDIVIDUAL.—A public health trust-
ee who makes a decision concerning a right, benefit, or
privilege of a individual using protected health information
about the individual shall be considered to be a health use
trustee with respect to such information and is subject to
section 101 (and not this section) with respect to such
information.
(c) OVERLAP WITH HEALTH USE TRUSTEE.—A per-
son who is a public health trustee and a health use trustee
with respect to the same protected health information is
subject to section 101 and is not subject to this section
with respect to such information.
SEC. 103. DUTIES AND AUTHORITIES OF SPECIAL PURPOSE
TRUSTEES.
(a) IN GENERAL.—A special purpose trustee—
(1) shall comply with sections 114 (relating
to accounting for disclosures) and 115 (relating to
security);
(2) may use protected health information if
such use is in accordance with section 121; and
(3) may disclose such information if such dis-
closure is in accordance with section 121 and one or
more of the following sections:
(A) Section 122 (relating to authoriza-
tions).
(B) Section 126 (relating to emergency cir-
cumstances).
(C) Section 128 (relating to health re-
search).
(D) Section 129 (relating to law enforce-
ment).
(E) Section 130 (relating to subpoenas,
warrants, and search warrants).
(b) OVERLAP WITH HEALTH USE
AND PUBLIC
HEALTH TRUSTEES.—A person who is a health use trust-
ee and a special purpose trustee with respect to the same
protected health information is subject to section 101 and
is not subject to this section with respect to such informa-
tion. A person who is a public health trustee and a special
purpose trustee with respect to the same protected health
information is subject to section 102 and is not subject
to this section with respect to such information.
SEC. 104. DUTIES AND AUTHORITIES OF AFFILIATED PER-
SONS.
(a) DUTIES OF AFFILIATED PERSONS.—
(1) IN GENERAL.—An affiliated person is re-
quired to fulfill any duty under this Act that—
(A) the health information trustee with
whom the person has an agreement or relation-
ship described in section 3(c)(1)(C) is required
to fulfill; and
(B) the person has undertaken to fulfill
pursuant to such agreement or relationship.
(2) CONSTRUCTION
OF
OTHER
SUBTITLES.—
With respect to a duty described in paragraph (1)
that an affiliated person is required to fulfill, the
person shall be considered a health information
trustee for purposes of this Act. The person shall be
subject to subtitle E (relating to enforcement) with
respect to any such duty that the person fails to ful-
fill.
(3) EFFECT ON TRUSTEE.—An agreement or
relationship described in section 3(c)(1)(C) does not
relieve a health information trustee of any duty or
liability under this Act.
(b) AUTHORITIES.—
(1) IN GENERAL.—An affiliated person may ex-
ercise any authority under this Act that the health
information trustee with whom the person has an
agreement or relationship described in section
3(c)(1)(C) may exercise and that the person has
been given pursuant to such agreement. With re-
spect to any such authority, the person shall be con-
sidered a health information trustee for purposes of
this Act. The person shall be subject to subtitle E
(relating to enforcement) with respect to any act
that exceeds such authority.
(2) EFFECT ON TRUSTEE.—An agreement or
relationship described in section 3(c)(1)(C) does not
affect the authority of a health information trustee
under this Act.
Subtitle B—Duties and Authorities
of Health Information Trustees
PART 1—DUTIES OF HEALTH INFORMATION
TRUSTEES
SEC. 111. INSPECTION OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—Except as provided in subsection
(b), a health information trustee who is required by sub-
title A to comply with this section—
(1) shall permit an individual to inspect any
protected health information about the individual
that the trustee maintains;
(2) shall permit the individual to have a copy
of the information;
(3) shall permit a person who has been des-
ignated in writing by the individual to inspect, or to
have a copy of, the information on behalf of the indi-
vidual or to accompany the individual during the in-
spection; and
(4) may offer to explain or interpret informa-
tion that is inspected or copied under this sub-
section.
(b) EXCEPTIONS.—A health information trustee is
not required by this section to permit inspection or copy-
ing of protected health information if any of the following
conditions apply:
(1) MENTAL
HEALTH
TREATMENT
NOTES.—
The information consists of psychiatric, psycho-
logical, or mental health treatment notes, the trustee
determines in the exercise of reasonable medical
judgment that inspection or copying of the notes
would cause sufficient harm to the individual who is
the subject of the notes so as to outweigh the desir-
ability of permitting access, and the trustee does not
disclose the notes to any person not directly engaged
in treating the individual, except with the authoriza-
tion of the individual or under compulsion of law.
(2) INFORMATION ABOUT OTHERS.—The infor-
mation relates to an individual other than the indi-
vidual seeking to inspect or have a copy of the infor-
mation and the trustee determines in the exercise of
reasonable medical judgment that inspection or
copying of the information would cause sufficient
harm to one or both of the individuals so as to out-
weigh the desirability of permitting access.
(3) ENDANGERMENT
TO
LIFE
OR
SAFETY.—
Disclosure of the information could reasonably be
expected to endanger the life or physical safety of an
individual.