of emergency response employees of possible expo-
sure to infectious diseases).
(4) The Americans with Disabilities Act of
1990.
(5) Any law that establishes a privilege for
records used in health professional peer review ac-
tivities.
(6) Any law that requires the disclosure of pro-
tected health information, if the disclosure is per-
mitted under this Act.
(c) DEPARTMENT OF VETERANS AFFAIRS.—The lim-
itations on use and disclosure of protected health informa-
tion under this Act shall not be construed to prevent any
exchange of such information within and among compo-
nents of the Department of Veterans Affairs that deter-
mine eligibility for or entitlement to, or that provide, bene-
fits under laws administered by the Secretary of Veterans
Affairs.
(d) CONGRESS.—Nothing in this Act shall be inter-
preted to affect the ability of the Congress, a committee
of the Congress, or the Members of the Congress referred
to in section 2954 of title 5, United States Code, to obtain
such information as may be necessary for the fulfillment
of the Congress’, the committee’s, or the Members’ legisla-
tive or oversight functions.
(e) PRIVILEGES.—A disclosure about a protected in-
dividual made under title III, or a protected individual’s
disclosure of protected health information for the purpose
of obtaining, or paying for, health care, may not be con-
strued as diminishing, waiving, or otherwise impairing any
privilege that the protected individual has in a court of
a State or the United States.
SEC. 504. DEFINITIONS.
For purposes of this Act:
(1) AFFILIATED PERSON.—The term ‘‘affiliated
person’’ means a person who—
(A) is not a health information custodian;
(B) is an agent or contractor of a health
information custodian; and
(C) pursuant to an agreement with such
custodian, receives, creates, uses, maintains, or
discloses protected health information.
(2) DISCLOSE.—The term ‘‘disclose’’, when
used with respect to protected health information,
means to provide access to the information to a per-
son other than—
(A) the custodian or an officer or employee
of the custodian;
(B) an affiliated person of the custodian;
or
(C) a protected individual who is a subject
of the information.
(3) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means the act or an instance of disclosing.
(4) HEALTH CARE.—The term ‘‘health care’’
means—
(A) any preventive, diagnostic, therapeutic,
rehabilitative, maintenance, or palliative care,
counseling, service, or procedure—
(i) with respect to the physical or
mental condition, or functional status, of
an individual; or
(ii) affecting the structure or function
of the human body or any part of the
human body, including banking of blood,
sperm, organs, or any other tissue for ad-
ministration to patients; or
(B) any sale or dispensing of a drug, de-
vice, equipment, or other item to an individual,
or for the use of an individual, pursuant to a
prescription.
(5) HEALTH CARE PAYER.—The term ‘‘health
care payer’’ means a person who pays for health
care in the ordinary course of business.
(6) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who provides
health care in the ordinary course of business or
practice of a profession, pursuant to license, certifi-
cation, accreditation, or other legal authorization.
(7) HEALTH INFORMATION CUSTODIAN.—
(A) IN GENERAL.—The term ‘‘health infor-
mation custodian’’ means a health care pro-
vider, a health care payer, or any other person
who obtains protected health information as a
result of a disclosure authorized under this Act.
(B) EXCEPTIONS.—Such term does not
include—
(i) an affiliated person;
(ii) an individual who obtains pro-
tected health information under paragraph
(2), (3), or (4) of section 307; or
(iii) an individual who receives pro-
tected health information in a public health
intervention because the individual’s health
is at risk.
(8) HEALTH RESEARCH.—The term ‘‘health re-
search’’ means a biomedical, epidemiological, or
health services research or statistics project, or a re-
search project on behavioral and social factors af-
fecting health, that is designed to develop or con-
tribute to generalizable scientific or clinical knowl-
edge.
(9) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means a lawful investiga-
tion or official proceeding inquiring into a violation
of, or failure to comply with, any criminal or civil
statute or any regulation, rule, or order issued pur-
suant to such a statute.
(10) PERSON.—The term ‘‘person’’ includes an
authority of the United States, a State, or a political
subdivision of a State.
(11) PROTECTED HEALTH INFORMATION.—The
term ‘‘protected health information’’ means any in-
formation, whether oral or recorded in any form or
medium, that—
(A) relates in any way to the past, present,
or future physical or mental health or condition
of a protected individual, the provision of health
care to an individual, or payment for the provi-
sion of health care to an individual;
(B) is received or created by a health care
provider in the ordinary course of business or
practice of a profession or by a health care
payer, or is obtained as a result of a disclosure
authorized under this Act; and
(C) identifies the individual, or with re-
spect to which there is a reasonable basis to be-
lieve that the information can be used to iden-
tify the individual.
(12) PROTECTED INDIVIDUAL.—The term ‘‘pro-
tected individual’’ means an individual who is the
subject of protected health information.
(13) 
SECRETARY.—The 
term 
‘‘Secretary’’
means the Secretary of Health and Human Services.
(14) 
SECRETARY’S
HIPAA
RECOMMENDA-
TIONS.—The 
term 
‘‘Secretary’s 
HIPAA 
rec-
ommendations’’ means the recommendations of the
Secretary of Health and Human Services, pursuant
to section 264 of the Health Insurance Portability
and Accountability Act of 1996, entitled ‘‘Confiden-
tiality of Individually-Identifiable Health Informa-
tion’’ that were submitted to the Committee on
Commerce and the Committee on Ways and Means
of the House of Representatives and the Committee
on Labor and Human Resources and the Committee
on Finance of the Senate, on September 11, 1997.
(15) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
(16) USE.—The term ‘‘use’’, when used with
respect to protected health information that is held
by a health information custodian, means—
(A) to use, or provide access to, the infor-
mation in any manner that does not constitute
a disclosure; or
(B) any act or instance of using, or pro-
viding access, described in subparagraph (A).
SEC. 505. EFFECTIVE DATE.
The requirements under this Act applicable to health
information custodians and affiliated persons shall take ef-
fect 18 months after the date of the enactment of this
Act.
Æ