I
106TH CONGRESS
1ST SESSION
H. R. 1941
To protect the privacy of personally identifiable health information.
IN THE HOUSE OF REPRESENTATIVES
MAY 25, 1999
Mr. CONDIT (for himself, Mr. WAXMAN, Mr. MARKEY, Mr. DINGELL, Mr.
BROWN of Ohio, Mr. TURNER, Mr. LANTOS, Mr. CRAMER, Mr. WISE, Mr.
OWENS, Mrs. TAUSCHER, Mr. TOWNS, Mr. SHOWS, Mr. KANJORSKI, Mrs.
MINK of Hawaii, Mr. SANDERS, Mrs. MALONEY of New York, Ms. NOR-
TON, Mr. FATTAH, Mr. CUMMINGS, Mr. KUCINICH, Mr. BLAGOJEVICH,
Mr. DAVIS of Illinois, Mr. TIERNEY, Mr. ALLEN, Mr. FORD, Ms.
SCHAKOWSKI, Mr. ROMERO-BARCELO´, and Mr. STUPAK) introduced the
following bill; which was referred to the Committee on Commerce, and
in addition to the Committee on Government Reform, for a period to be
subsequently determined by the Speaker, in each case for consideration
of such provisions as fall within the jurisdiction of the committee con-
cerned
A BILL
To protect the privacy of personally identifiable health
information.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Health Information Privacy Act’’.
TITLE I—PROTECTION OF
HEALTH INFORMATION
SEC. 101. RESTRICTIONS ON USES.
(a) IN GENERAL.—Use of protected health informa-
tion by health information custodians—
(1) shall protect the reasonable expectation of
privacy of protected individuals; and
(2) shall be in accordance with fair information
practices.
(b) MINIMUM REQUIREMENTS.—
(1) LIMITATION
ON
USES.—Unless otherwise
authorized by a protected individual under section
103, a health information custodian may use pro-
tected health information only for the uses for which
disclosure is authorized under title III.
(2) MINIMUM
AMOUNT
OF
INFORMATION.—A
health information custodian shall limit use of pro-
tected health information to the minimum amount
and duration necessary to accomplish the use.
SEC. 102. RESTRICTIONS ON DISCLOSURE.
(a) IN GENERAL.—Disclosure of protected health in-
formation by a health information custodian shall protect
the reasonable expectations of privacy of protected individ-
uals.
(b) MINIMUM REQUIREMENTS.—
(1) LIMITATION
ON
DISCLOSURES.—A health
information custodian may not disclose protected
health information unless—
(A) the disclosure is authorized by the pro-
tected individual under section 103; or
(B) the disclosure is authorized under title
III.
(2) MINIMUM
AMOUNT
OF
INFORMATION.—A
health information custodian shall limit a disclosure
of protected health information to the minimum
amount of information necessary to accomplish the
purpose for which the information is disclosed.
(c) NO REQUIREMENT TO DISCLOSE.—Nothing in
this Act shall be construed as requiring disclosure of pro-
tected health information that is not otherwise required
to be disclosed by law.
SEC. 103. STANDARDS FOR AUTHORIZATIONS FOR USE AND
DISCLOSURE.
(a) IN GENERAL.—A health information custodian
may use or disclose protected information pursuant to an
authorization by a protected individual only if that author-
ization is based on informed consent by the protected indi-
vidual.
(b) MINIMUM REQUIREMENTS.—
(1) PROHIBITION ON CONDITIONING.—A health
information custodian may not, as a condition of
providing or paying for health care, require a pro-
tected individual to execute an authorization for use
or disclosure of protected health information.
(2) INFORMED CONSENT.—For the purposes of
subsection (a), an authorization shall not be consid-
ered to be based on informed consent unless, at a
minimum, it satisfies the conditions in part II.D.1 of
the Secretary’s HIPAA recommendations (relating
to ‘‘Disclosure with Patient Authorization: Author-
ization Content’’).
SEC. 104. SAFEGUARDS AGAINST MISUSE AND PROHIBITED
DISCLOSURES.
(a) IN GENERAL.—Health information custodians
shall establish and implement safeguards against misuse
and prohibited disclosure of protected health information.
(b) MINIMUM
REQUIREMENTS.—The safeguards
under subsection (a) shall include reasonable and appro-
priate administrative, technical, and physical safeguards—
(1) to ensure that protected health information
is used or disclosed only when necessary;
(2) to ensure the integrity and confidentiality of
protected health information;
(3) to protect against any reasonably antici-
pated threats or hazards to the security or integrity
of the information or unauthorized use or disclosure
of the information; and
(4) otherwise to ensure compliance with this
Act.
(c) MENTAL HEALTH AND OTHER ESPECIALLY SEN-
SITIVE INFORMATION.—In establishing and implementing
the safeguards under subsection (a), a health information
custodian shall consider providing additional protections
for mental health and other especially sensitive protected
health information, as appropriate.
(d) RELATIONSHIP TO SOCIAL SECURITY ACT AD-
MINISTRATIVE
SIMPLIFICATION
REQUIREMENTS.—Any
safeguard established under this section shall be con-
sistent with the standards adopted by the Secretary under
paragraph (1) of section 1173(d) of the Social Security
Act (42 U.S.C. 1320d–2(d)) and the requirement in para-
graph (2) of such section.
TITLE II—RIGHTS OF
PROTECTED INDIVIDUALS
SEC. 201. RIGHT OF ACCESS.
(a) IN GENERAL.—Protected individuals shall have
the right to a reasonable opportunity to inspect and copy
protected health information maintained by a health infor-
mation custodian.
(b) MINIMUM REQUIREMENTS.—Subject to section
405(b), a health information custodian, at a minimum,
shall provide a protected individual at least as much op-
portunity to inspect and copy protected health information
as was recommended by the Secretary in part II.C.2 of
the Secretary’s HIPAA recommendations (relating to
‘‘Patient Inspection and Copying of Records’’).
SEC. 202. RIGHT OF CORRECTION AND AMENDMENT.
(a) IN GENERAL.—Protected individuals shall have
the right to a reasonable opportunity to correct or amend
protected health information maintained by a health infor-
mation custodian.
(b) MINIMUM REQUIREMENTS.—A health informa-
tion custodian, at a minimum, shall provide a protected
individual correction and amendment protections that are
at least equivalent to those recommended by the Secretary
in part II.C.3 of the Secretary’s HIPAA recommendations
(relating to ‘‘Patient Correction of Records’’).
SEC. 203. RIGHT TO REVIEW DISCLOSURE HISTORY.
(a) IN GENERAL.—Protected individuals shall have
the right to a reasonable opportunity to review a history
of the disclosures of protected health information about
the individual made by a health information custodian.
custodian’s health information practices, which
notice shall include, at a minimum, the expla-
nation recommended in part II.C.1 of the Sec-
retary’s HIPAA recommendations (relating to
‘‘Explanation of Information Practices’’);
(B) shall provide the protected individual a
reasonable opportunity to seek limitations on
the use or disclosure of protected health infor-
mation in addition to the limitations provided in
such practices; and
(C) shall obtain a signed acknowledgment
from the protected individual acknowledging
that the notice required under subparagraph
(A) has been provided to the protected indi-
vidual and the individual has been informed of
the opportunity to seek additional limitations
required to be provided under subparagraph
(B).
(2) 
OTHER
HEALTH
INFORMATION
CUSTODIANS.—A health information custodian who
receives protected health information about a pro-
tected individual from a source other than the indi-
vidual shall provide a notice of the custodian’s
health information practices that is consistent with
paragraph (1)(A) to the individual upon request.
(c) COMPLIANCE.—If a protected individual seeks
limitations on the use or disclosure of protected health in-
formation in addition to the limitations described in a
health information custodian’s notice of health informa-
tion practices, and the custodian agrees to provide such
additional limitations, the custodian shall comply with
such additional limitations, unless such compliance would
violate another provision of law.
TITLE 
III—PERMISSIBLE 
DIS-
CLOSURES 
OF 
PROTECTED
HEALTH INFORMATION
SEC. 301. PROVISION OF AND PAYMENT FOR HEALTH CARE.
(a) IN GENERAL.—A health information custodian,
to the extent the Secretary determines appropriate, may
disclose protected health information, without obtaining
an authorization under section 103, for the purpose of
providing health care to an individual or paying for health
care provided to an individual, except as provided in sub-
section (c).
(b) CONSTRUCTION.—For purposes of subsection (a),
a disclosure of protected health information by a health
information custodian for the purpose of rendering an em-
ployment decision, conducting a marketing activity, or
conducting an insurance underwriting activity, shall not
be considered a disclosure for the purpose of providing
health care to an individual or paying for health care pro-
vided to an individual.
(c) SPECIAL RULE
FOR PATIENTS PAYING
FOR
CARE.—In the case of health care provided to an indi-
vidual who pays for the care himself or herself, a health
information custodian may not disclose to a health care
payer, without obtaining an authorization under section
103, protected health information created or received in
the course of providing such care.
SEC. 302. HEALTH OVERSIGHT.
(a) IN GENERAL.—A health information custodian,
to the extent the Secretary determines appropriate, may
disclose protected health information for the purpose of
health oversight, without obtaining an authorization under
section 103.
(b) MINIMUM REQUIREMENTS.—The Secretary—
(1) shall permit a health information custodian
to disclose protected health information to Federal,
State, and local agencies (or affiliated persons of
such agencies) that are authorized by law to inves-
tigate, regulate, enforce laws relating to, or license,
certify, or accredit persons engaged in, the provision
of, or payment for, health care; and
(2) may permit a health information custodian
to disclose protected health information to appro-
priate private organizations engaged in licensing,
certification, or accreditation of health care pro-
viders.
SEC. 303. PUBLIC HEALTH.
A health information custodian, to the extent the Sec-
retary determines appropriate, may disclose protected
health information, without obtaining an authorization
under section 103—
(1) to a public health authority for use in le-
gally authorized disease or injury reporting, public
health surveillance, or a public health investigation
or intervention; or
(2) to a person who is otherwise authorized by
law or a public health authority to receive the infor-
mation for public health purposes.
SEC. 304. HEALTH RESEARCH.
(a) IN GENERAL.—A health information custodian,
to the extent the Secretary determines appropriate, may
disclose protected health information for health research,
without obtaining an authorization under section 103.
(b) MINIMUM REQUIREMENTS.—A health informa-
tion custodian may disclose protected health information
without such an authorization only for uses that have been
approved by an entity certified by the Secretary.
(c) REGULATIONS.—The Secretary shall promulgate
regulations that, at a minimum—
(1) require that, before approving a use of pro-
tected health information for purposes of subsection
(b), a certified entity shall determine that—
(A) the importance of the health research
outweighs the intrusion into the privacy of the
protected individuals who are the subjects of
the protected health information; and
(B) it would be impracticable to conduct
the health research without using the protected
health information;
(2) establish requirements for certifying entities
that ensure that such entities—
(A) meet the requirements for institutional
review boards established under section 491(a)
of the Public Health Service Act with respect to
information protection, use, and disclosure; and
(B) are qualified to assess and protect the
confidentiality of protected health information;
and
(3) require a person conducting health research
to remove or destroy personal identifiers at the ear-
liest opportunity consistent with the purpose of the
research, unless a certified entity has determined
that there is a health or research justification for re-
tention of identifiers and the person has an adequate
plan to protect the identifiers from improper use and
disclosure.
SEC. 305. LAW ENFORCEMENT.
(a) IN GENERAL.—A health information custodian
may disclose protected health information to a law en-
forcement official for a law enforcement inquiry if the law
enforcement official complies with the fourth amendment
to the Constitution.
(b) CONSTRUCTION.—For purposes of subsection (a),
all protected health information shall be treated as if it
were held in a home over which the protected individual
has exclusive authority.
(c) RELATIONSHIP TO HEALTH OVERSIGHT ACTIVI-
TIES.—This section shall not apply to a disclosure of pro-
tected health information for purposes of health oversight.
SEC. 306. JUDICIAL OR ADMINISTRATIVE PROCEEDINGS.
(a) IN GENERAL.—A health information custodian,
to the extent the Secretary determines appropriate, may
disclose protected health information, without obtaining
an authorization under section 103, pursuant to—
(1) a judicial or administrative subpoena issued
in a civil administrative or judicial adjudication; or
(2) a subpoena issued by a defendant in a
criminal proceeding.
(b) MINIMUM REQUIREMENTS.—A health informa-
tion custodian may not disclose protected health informa-
tion about a protected individual under this section, unless
the individual has had—
(1) reasonable notice of the subpoena; and
(2) a reasonable opportunity to move the court,
or other presiding official, to quash the subpoena on
the basis that the individual’s privacy interest out-
weighs the interest of the person seeking the infor-
mation.
SEC. 307. OTHER DISCLOSURES.
A health information custodian, to the extent the Sec-
retary determines appropriate, may disclose protected
health information, without obtaining an authorization
under section 103—
(1) where necessary to prevent or lessen a seri-
ous threat to the health or safety of an individual;
(2) to a next of kin;
(3) to individuals with close personal relation-
ships with the protected individual;
(4) for purposes of directory information within
a health care facility; and
(5) for State data systems.
SEC. 308. REDISCLOSURES.
(a) IN GENERAL.—A health information custodian
who receives protected health information through a dis-
closure under this title, to the extent the Secretary deter-
mines appropriate, may redisclose such information to
carry out the purposes for which the information was dis-
closed to the custodian.
(b) PROHIBITION.—Notwithstanding subsection (a),
protected health information received by a health informa-
tion custodian through a disclosure under this title may
not be disclosed to any person for use in, or be used in,
any administrative, civil, or criminal action or investiga-
tion directed against the protected individual who is the
subject of the information, unless—
(1) the action or investigation arises out of and
is directly related to the purpose for which the infor-
mation was obtained by the custodian; or
(2) the use or disclosure is authorized—
(A) by law for the protection of the public
health; or
(B) by an appropriate order of a court of
competent jurisdiction, granted, after a hearing
with notice to the health information custodian
and to all other affected individuals, on the
basis that there is—
(i) probable cause to believe that all
other possible sources for the information
have been exhausted; and
(ii) a specific and compelling public
interest 
in 
disclosure 
or 
use 
that
outweighs—
(I) the privacy interest of the
protected individual;
(II) the effect of the disclosure
on future provision of health care; and
(III) the effect of the disclosure
on health research and health over-
sight functions.
TITLE IV—MISCELLANEOUS
PROVISIONS
SEC. 401. SPECIFIC CLASSES OF INDIVIDUALS.
(a) MINORS.—Individuals under the age of 18 shall
have privacy protections regarding protected health infor-
mation that are at least equivalent to those recommended
in part II.F.4 of the Secretary’s HIPAA recommendations
(relating to ‘‘Minors’’).
(b) AGENTS AND ATTORNEYS.—
(1) IN GENERAL.—To the extent the Secretary
determines appropriate, a person may exercise the
rights of a protected individual under this Act, if—
(A) the person is authorized by law (other
than on account of minority), or by an instru-
ment recognized under law, to act for the pro-
tected individual; or
(B) the protected individual is not capable
of exercising his or her rights under this Act
and there has been no formal legal arrangement
for others to exercise the rights.
(2) RELATIONSHIP
TO
RECOMMENDATIONS.—
The authority of such a person to exercise the rights
of a protected individual shall be equivalent to the
authority described in parts II.F.5 and II.F.6 of the
Secretary’s HIPAA recommendations (relating to
‘‘Powers of Attorney’’ and ‘‘Patients Unable to
Make Choices for Themselves’’).
(c) DECEASED PERSONS.—Deceased individuals shall
have privacy protections regarding protected health infor-
mation that are at least equivalent to those recommended
by the Secretary in part II.F.1 of the Secretary’s HIPAA
recommendations (relating to ‘‘Deceased Persons’’).
SEC. 402. FALSE PRETENSES.
A person may not—
(1) obtain or disclose protected health informa-
tion from a health information custodian or affili-
ated person under false pretenses; or
(2) knowingly disseminate protected health in-
formation obtained in violation of this Act.
SEC. 403. OBLIGATIONS OF AFFILIATED PERSONS.
An affiliated person shall be subject to the same re-
quirements with respect to use and disclosure of protected
health information as apply to the health information cus-
todian with whom the affiliated person is affiliated, except
that an affiliated person—
(1) is subject to the requirements of sections
201 and 202 only if the affiliated person maintains
the individual’s protected health information and the
health information custodian does not maintain the
individual’s protected health information; and
(2) is subject to the requirements of section
203 only to the extent that the affiliated person
makes a disclosure.
SEC. 404. PROHIBITION OF RETALIATION WITH RESPECT
TO EMPLOYMENT.
A person may not subject an individual to retaliation,
in regard to job application procedures, the hiring, ad-
vancement, or discharge of employees, employee com-
pensation, job training, or other terms, conditions, and
privileges of employment, for reporting to a governmental
agency conditions that may constitute a violation of a re-
quirement under this Act.
SEC. 405. MENTAL HEALTH AND OTHER ESPECIALLY SEN-
SITIVE INFORMATION.
(a) ADDITIONAL LIMITATIONS.—Not later than 1
year after the date of the enactment of this Act, the
Secretary—
(1) shall consider, after consulting with physi-
cians and other health care providers, patients, and
other appropriate groups, additional limitations re-
lating to access to, and use and disclosure of, mental
health and other especially sensitive protected health
information; and
(2) shall promulgate regulations to provide any
such additional limitations as the Secretary deter-
mines to be appropriate.
(b) RIGHT OF ACCESS.—For purposes of subsection
(a)(2), the Secretary may limit an individual’s access to
his or her mental health information, if the information
is not used by, or disclosed to, any person other than the
health care provider who received or created the informa-
tion.
(c) PSYCHOTHERAPIST-PATIENT PRIVILEGE.—Noth-
ing in this Act shall be construed to preempt, supersede,
or modify the operation of the psychotherapist-patient
privilege recognized by the Supreme Court in Jaffee v.
Redmond, 518 U.S. 1 (1996).
SEC. 406. CESSATION OF OPERATIONS.
Not later than 1 year after the date of the enactment
of this Act, the Secretary shall promulgate regulations
that ensure that the reasonable expectation of privacy of
protected individuals in protected health information is
maintained when health information custodians cease op-
erations.
SEC. 407. CONFORMING AMENDMENTS TO FEDERAL PRI-
VACY ACT.
(a) NEW SUBSECTION.—Section 552a of title 5,
United States Code, is amended by adding at the end the
following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is a health information custodian (as defined in
section 504 of the Health Information Privacy Act) shall
promulgate rules, in accordance with the requirements (in-
cluding general notice) of subsections (b)(1), (b)(2),
(b)(3), (c), and (e) of section 553 of this title, to exempt
a system of records within the agency, to the extent that
the system of records contains protected health informa-
tion (as defined in section 504 of such Act), from all provi-
sions of this section except subsections (e)(1), (e)(2), sub-
paragraphs (A) through (C) and (E) through (I) of sub-
section (e)(4), and subsections (e)(5), (e)(6), (e)(9),
(e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.
(b) REPEAL.—
(1) IN GENERAL.—Section 552a(f)(3) of title 5,
United States Code, as amended by this Act, is
amended by striking ‘‘pertaining to him,’’ and all
that follows through the semicolon and inserting
‘‘pertaining to the individual;’’.
(2) EFFECTIVE DATE.—The amendment made
by paragraph (1) shall take effect 18 months after
the date of the enactment of this Act.
TITLE V—GENERAL PROVISIONS
SEC. 501. AUTHORITY OF THE SECRETARY.
(a) REGULATIONS.—
(1) IN GENERAL.—Not later than 1 year after
the date of the enactment of this Act, the Secretary
shall promulgate such regulations as may be nec-
essary to implement this Act, including regulations
establishing recordkeeping or reporting require-
ments. Such regulations may provide greater protec-
tion of protected health information, or more rights
to protected individuals regarding such information,
than is provided by the minimum requirements set
forth in this Act.
(2) PROTECTIONS FOR OTHER HEALTH INFOR-
MATION.—The Secretary may promulgate such regu-
lations as may be necessary to protect the privacy of
individually identifiable health information that is
not protected health information.
(3) CONSULTATION.—In promulgating regula-
tions under this Act, the Secretary shall consult with
elected State and local government officials.
(b) RESEARCH AND DEVELOPMENT.—The Secretary
may sponsor or carry out research and development activi-
ties related to the protection of the privacy of individually
identifiable health information.
(c) PUBLIC AWARENESS AND TRAINING.—The Sec-
retary may sponsor or carry out activities to inform pro-
tected individuals of their rights under this Act or to in-
form other persons of their rights or responsibilities under
this Act. The Secretary may also sponsor or carry out
training to increase compliance with requirements under
this Act.
(d) OTHER AUTHORITIES.—The Secretary may hold
hearings, administer oaths, require the testimony or depo-
sition of witnesses, require the production of documents
or the answering of interrogatories, or enter and inspect
premises owned or controlled by health information
custodians in order to ensure compliance with this Act or
otherwise further the purposes of this Act.
SEC. 502. ENFORCEMENT.
(a) EQUITABLE RELIEF.—The Secretary may bring
an action in an appropriate court to enjoin a violation of
a requirement under this Act or to obtain such other equi-
table relief as may be appropriate under the cir-
cumstances.
(b) CIVIL MONEY PENALTIES.—Any person who the
Secretary determines has failed to comply with a require-
ment under this Act shall be subject, in addition to any
other penalties that may be prescribed by law, to a civil
penalty of not more than $10,000 for each such failure.
The provisions of section 1128A of the Social Security Act
(other than subsections (a) and (b)) shall apply to the im-
position of a civil money penalty under this subsection in
the same manner as such provisions apply with respect
to the imposition of a penalty under section 1128A of such
Act.
(c) CRIMINAL PENALTIES.—
(1) IN GENERAL.—Whoever knowingly violates
a requirement under this Act shall be fined under
title 18, United States Code, imprisoned for not
more than 5 years, or both.
(2) MONETARY GAIN.—Whoever knowingly vio-
lates a requirement under this Act, with the intent
to sell, transfer, or use protected health information
obtained through the violation for profit or monetary
gain, shall be fined under title 18, United States
Code, imprisoned for not more than 10 years, or
both.
(d) CIVIL ACTIONS.—
(1) IN GENERAL.—
(A) INJUNCTION
OR
DAMAGES.—A pro-
tected individual who is adversely affected by a
person’s violation of a requirement under this
Act may bring an action—
(i) to enjoin the violation; or
(ii) in the case of a knowing or neg-
ligent violation, to recover from the person
the greater of—
(I) the compensatory damages
(including nonpecuniary damages) in-
curred by the protected individual as
a result of the violation; or
(II) 
liquidated 
damages 
of
$5,000 per action.
(B) COSTS
AND
ATTORNEY’S
FEES.—A
protected individual bringing an action under
subparagraph (A) may recover the costs of liti-
gation and reasonable attorney’s fees (including
expert fees). The United States shall be liable
for fees and costs under this subparagraph the
same as a private person.
(C) PUNITIVE DAMAGES.—In the case of a
knowing violation, the person committing the
violation may also be held liable for punitive
damages.
(2) TIME FOR COMMENCING ACTION.—An ac-
tion under this subsection shall be commenced not
later than 3 years after the date on which the viola-
tion was discovered or reasonably should have been
discovered.
SEC. 503. RELATIONSHIP TO OTHER LAWS.
(a) IN GENERAL.—
(1) FEDERAL, STATE, OR LOCAL LAWS.—The
requirements under this Act shall not preempt, su-
persede, or modify the operation of, any Federal,
State, or local law that provides—
(A) greater protection of protected health
information; or
(B) more rights to protected individuals re-
garding such information.
(2) PETITIONS.—
(A) 
ADVISORY
DETERMINATIONS.—Any
person may petition the Secretary for an advi-
sory determination whether the operation of a
particular Federal, State, or local law satisfies
the standard in paragraph (1). Any person who
acts in reliance on such advisory determination
shall not be subject to any penalty or liability
under section 502, except as provided in sub-
paragraph (B).
(B) CONTRARY COURT DETERMINATION.—
If a Federal or State court has reached a deter-
mination whether the operation of a particular
Federal, State, or local law satisfies the stand-
ard in paragraph (1), a person thereafter may
not rely on an advisory determination under
subparagraph (A) to the contrary.
(b) SPECIFIC LAWS.—This Act shall not be construed
to preempt, supersede, or modify the operation of, any of
the following:
(1) Any law that provides for the reporting of
vital statistics such as birth or death information.
(2) Any law that requires the reporting of
abuse or neglect information about an individual or
other information relating to violence against an in-
dividual.
(3) Subpart II of part E of title XXVI of the
Public Health Service Act (relating to notifications