(4) CONFIDENTIAL SOURCE.—The information
identifies or could reasonably lead to the identifica-
tion of an individual (other than a health care pro-
vider) who provided information under a promise of
confidentiality to a health care provider concerning
the individual who is the subject of the information.
(5) ADMINISTRATIVE PURPOSES.—The informa-
tion—
(A) is used by the trustee solely for admin-
istrative purposes and not in the provision of
health care to the individual who is the subject
of the information; and
(B) is not disclosed by the trustee to any
person.
(6) DUPLICATIVE INFORMATION.—The informa-
tion duplicates information available for inspection
under subsection (a).
(7) INFORMATION COMPILED IN ANTICIPATION
OF LITIGATION.—The information is compiled prin-
cipally—
(A) in reasonable anticipation of a civil ac-
tion or proceeding; or
(B) for use in such an action or proceed-
ing.
(c) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee who is required by
subtitle A to comply with this section shall permit inspec-
tion and copying under subsection (a) of any reasonably
segregable portion of a record after deletion of any portion
that is exempt under subsection (b).
(d) CONDITIONS.—A health information trustee
may—
(1) require a written request for the inspection
and copying of protected health information under
this section; and
(2) charge a reasonable fee (not greater than
the actual cost) for—
(A) permitting inspection of information
under this section; and
(B) providing a copy of protected health
information under this section.
(e) STATEMENT OF REASONS FOR DENIAL.—If a
health information trustee denies a request for inspection
or copying under this section, the trustee shall provide the
individual who made the request (or the individual’s des-
ignated representative) with a written statement of the
reasons for the denial.
(f) DEADLINE.—A health information trustee shall
comply with or deny a request for inspection or copying
of protected health information under this section within
the 30-day period beginning on the date the trustee re-
ceives the request.
SEC. 112. AMENDMENT OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—A health information trustee who
is required by subtitle A to comply with this section shall,
within the 45-day period beginning on the date the trustee
receives from an individual about whom the trustee main-
tains protected health information a written request that
the trustee correct or amend the information, either—
(1) make the correction or amendment re-
quested, inform the individual of the correction or
amendment that has been made, and inform any
person who is identified by the individual, who is not
an employee of the trustee, and to whom the uncor-
rected or unamended portion of the information was
previously disclosed of the correction or amendment
that has been made; or
(2) inform the individual of—
(A) the reasons for the refusal of the trust-
ee to make the correction or amendment;
(B) any procedures for further review of
the refusal; and
(C) the individual’s right to file with the
trustee a concise statement setting forth the re-
quested correction or amendment and the indi-
vidual’s reasons for disagreeing with the refusal
of the trustee.
(b) BASES FOR REQUEST TO CORRECT OR AMEND.—
An individual may request correction or amendment of
protected health information about the individual under
subsection (a) if the information is not timely, accurate,
relevant, or complete.
(c) STATEMENT OF DISAGREEMENT.—After an indi-
vidual has filed a statement of disagreement under sub-
section (a)(2)(C), the trustee, in any subsequent disclosure
of the disputed portion of the information, shall include
a copy of the individual’s statement and may include a
concise statement of the trustee’s reasons for not making
the requested correction or amendment.
(d) CONSTRUCTION.—This section shall not be con-
strued to require a health information trustee to conduct
a formal, informal, or other hearing or proceeding con-
cerning a request for a correction or amendment to pro-
tected health information the trustee maintains.
(e) CORRECTION.—For purposes of subsection (a), a
correction is deemed to have been made to protected
health information where information that is not timely,
accurate, relevant, or complete is clearly marked as incor-
rect or where supplementary correct information is made
part of the information.
SEC. 113. NOTICE OF INFORMATION PRACTICES.
(a) PREPARATION OF WRITTEN NOTICE.—A health
information trustee who is required by subtitle A of this
title to comply with this section shall prepare a written
notice of information practices describing the following:
(1) RIGHTS
OF
INDIVIDUALS.—The rights
under this title of an individual who is the subject
of protected health information, including the right
to inspect and copy such information and the right
to seek amendments to such information, and the
procedures for authorizing disclosures of protected
health information and for revoking such authoriza-
tions.
(2) PROCEDURES
OF
TRUSTEE.—The proce-
dures established by the trustee for the exercise of
such rights.
(3) AUTHORIZED
DISCLOSURES.—The disclo-
sures of protected health information that are au-
thorized under this Act.
(b) DISSEMINATION OF NOTICE.—A health informa-
tion trustee who is required by subtitle A to comply with
this section—
(1) shall, upon request, provide any person with
a copy of the trustee’s notice of information prac-
tices (described in subsection (a)); and
(2) shall make reasonable efforts to inform per-
sons in a clear and conspicuous manner of the exist-
ence and availability of such notice.
(c) MODEL NOTICE.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate a model notice of in-
formation practices for use by health information trustees
under this section.
SEC. 114. ACCOUNTING FOR DISCLOSURES.
(a) IN GENERAL.—A health information trustee who
is required by subtitle A to comply with this section shall
create and maintain, with respect to any protected health
information the trustee discloses, a record of—
(1) the date and purpose of the disclosure;
(2) the name of the person to whom the disclo-
sure was made;
(3) the address of the person to whom the dis-
closure was made or the location to which the disclo-
sure was made; and
(4) the information disclosed, but only where
the recording of the information disclosed is prac-
ticable, taking into account the technical capabilities
of the system used to maintain the record and the
costs of such maintenance.
(b) DISCLOSURE RECORD PART OF INFORMATION.—
A record created and maintained under subsection (a)
shall be maintained as part of the protected health infor-
mation to which the record pertains.
SEC. 115. SECURITY.
(a) IN GENERAL.—A health information trustee who
is required by subtitle A to comply with this section shall
maintain reasonable and appropriate administrative, tech-
nical, and physical safeguards—
(1) to ensure the integrity and confidentiality of
protected health information created or received by
the trustee;
(2) to protect against any anticipated threats or
hazards to the security or integrity of, improper dis-
closures of, or unauthorized uses of, such informa-
tion; and
(3) otherwise ensure compliance with this Act
by the trustee and the officers and employees of the
trustee.
(b) SPECIFIC SECURITY MEASURES.—A health infor-
mation trustee who is required by subtitle A to comply
with this section shall ensure that—
(1) officers, employees, and affiliated persons of
the trustee who have access to protected health in-
formation created or received by the trustee are reg-
ularly trained in the requirements governing such
information;
(2) audit trails are maintained, but only where
the maintenance of such trails is practicable, taking
into account the technical capabilities of the system
used to maintain protected health information and
the costs of such maintenance; and
(3) appropriate signs and warnings are posted
to advise persons described in paragraph (1) regard-
ing the need to secure protected health information.
PART 2—USE AND DISCLOSURE OF PROTECTED
HEALTH INFORMATION
SEC. 121. GENERAL LIMITATIONS ON USE AND DISCLO-
SURE.
(a) USE.—A health information trustee may use pro-
tected health information only for a purpose that is com-
patible with and related to the purpose for which the infor-
mation—
(1) was collected; or
(2) was received by the trustee.
(b) DISCLOSURE.—A health information trustee may
disclose protected health information only for a purpose
that is authorized under this Act.
(c) SCOPE OF USES AND DISCLOSURES.—
(1) IN GENERAL.—A use or disclosure of pro-
tected health information by a health information
trustee shall be limited, when practicable, to the
minimum amount of information necessary to ac-
complish the purpose for which the information is
used or disclosed.
(2) GUIDELINES.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for pub-
lic comment, shall issue guidelines to implement
paragraph (1), which shall take into account the
technical capabilities of the record systems used to
maintain protected health information and the costs
of limiting use and disclosure.
(d) IDENTIFICATION OF DISCLOSED INFORMATION
AS PROTECTED INFORMATION.—Except with respect to
protected health information that is disclosed under sec-
tion 111 (relating to inspection) or 124 (relating to next
of kin and directory information), and except as provided
in subsection (e), a health information trustee may dis-
close protected health information only if such information
is clearly identified as protected health information that
is subject to this Act.
(e) ROUTINE DISCLOSURES SUBJECT TO WRITTEN
AGREEMENT.—A health information trustee who routinely
discloses protected health information to a person may
satisfy the identification requirement in subsection (d)
through the conclusion of a written agreement between the
trustee and the person with respect to the identification
of protected health information.
(f) AGREEMENT TO LIMIT USE OR DISCLOSURE.—
A health information trustee who receives protected health
information from any person pursuant to a written agree-
ment to restrict use or disclosure of the information to
a greater extent than would otherwise be required under
this Act shall comply with the terms of the agreement,
except where use or disclosure of the information in viola-
tion of the agreement is required by law. A trustee who
fails to comply with the preceding sentence shall be subject
to section 161 (relating to civil actions) with respect to
such failure.
(f) NO GENERAL REQUIREMENT TO DISCLOSE.—Ex-
cept as provided in section 111, nothing in this Act shall
be construed to require a health information trustee to dis-
close protected health information not otherwise required
to be disclosed by law.
SEC. 122. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION.
(a) STATEMENT OF INTENDED USES AND DISCLO-
SURES.—
(1) IN GENERAL.—A person who wishes to re-
ceive from a health information trustee protected
health information about an individual pursuant to
an authorization executed by the individual shall
supply the individual, in writing and on a form that
is distinct from the authorization, with a statement
of the uses for which the person intends the infor-
mation and the disclosures the person intends to
make of the information. Such statement shall be
supplied on or before the date on which the author-
ization is executed.
(2) ENFORCEMENT.—If the person uses or dis-
closes the information in a manner that is inconsist-
ent with such statement, the person shall be subject
to section 161 (relating to civil actions) with respect
to such failure, except where such use or disclosure
is required by law.
(3) MODEL STATEMENTS.—Not later than July
1, 1996, the Secretary, after notice and opportunity
for public comment, shall develop and disseminate
model statements of intended uses and disclosures of
the type described in paragraph (1).
(b) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee who is authorized by subtitle A to disclose
protected health information under this section may dis-
close such information pursuant to an authorization exe-
cuted by the individual who is the subject of the informa-
tion, if each of the following requirements is met:
(1) WRITING.—The authorization is in writing,
signed by the individual, and dated on the date of
such signature.
(2) SEPARATE FORM.—The authorization is not
on a form used to authorize or facilitate the provi-
sion of, or payment for, health care.
(3) TRUSTEE DESCRIBED.—The trustee is spe-
cifically named or generically described in the au-
thorization as authorized to disclose such informa-
tion.
(4) RECIPIENT
DESCRIBED.—The person to
whom the information is to be disclosed is specifi-
cally named or generically described in the author-
ization as a person to whom such information may
be disclosed.
(5) STATEMENT OF INTENDED USES AND DIS-
CLOSURES
RECEIVED.—The authorization contains
an acknowledgment that the individual has received
a statement described in subsection (a) from such
person.
(6) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is described in the authorization.
(7) AUTHORIZATION TIMELY RECEIVED.—The
authorization is received by the trustee during a pe-
riod described in subsection (d)(1).
(8) DISCLOSURE
TIMELY
MADE.—The disclo-
sure occurs during a period described in subsection
(d)(2).
(c) AUTHORIZATIONS REQUESTED IN CONNECTION
WITH PROVISION OF HEALTH CARE.—
(1) IN GENERAL.—A health use trustee or a
public health trustee may not request that an indi-
vidual provide to any person an authorization de-
scribed in subsection (b) on a day on which—
(A) the trustee provides health care to the
individual; or
(B) in the case of a trustee that is a health
facility, the individual is admitted into the facil-
ity as a resident or inpatient in order to receive
health care.
(2) EXCEPTION.—Paragraph (1) does not apply
if a health use trustee or a public health trustee re-
quests that an individual provide an authorization
described in subsection (b) for the purpose of assist-
ing the individual in obtaining counseling or social
services from a person other than the trustee.
(d) TIME LIMITATIONS ON AUTHORIZATIONS.—
(1) RECEIPT BY TRUSTEE.—For purposes of
subsection (b)(7), an authorization is timely received
if it is received by the trustee during—
(A) the 1-year period beginning on the
date that the authorization is signed under sub-
section (b)(1), if the authorization permits the
disclosure of protected health information to a
health use trustee, public health trustee, or per-
son who provides counseling or social services to
individuals; or
(B) the 30-day period beginning on the
date that the authorization is signed under sub-
section (b)(1), if the authorization permits the
disclosure of protected health information to a
person other than a person described in sub-
paragraph (A).
(2) DISCLOSURE BY TRUSTEE.—For purposes
of subsection (b)(8), a disclosure is timely made if
it occurs before—
(A) the date or event (if any) specified in
the authorization upon which the authorization
expires; and
(B) the expiration of the 6-month period
beginning on the date the trustee receives the
authorization.
(e) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN GENERAL.—An individual in writing may
revoke or amend an authorization described in sub-
section (b), in whole or in part, at any time, except
when—
(A) disclosure of protected health informa-
tion has been authorized to permit validation of
expenditures for health care, or based on health
condition, by a government authority; or
(B) action has been taken in reliance on
the authorization.
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation pursuant to an authorization that has been
revoked shall not be subject to any liability or pen-
alty under this Act if—
(A) the reliance was in good faith;
(B) the trustee had no notice of the rev-
ocation; and
(C) the disclosure was otherwise in accord-
ance with the requirements of this Act.
(f) EFFECT OF AUTHORIZATION ON PRIVILEGES.—
The execution by an individual of an authorization that
meets the requirements of this section for the purpose of
receiving health care or providing for the payment for
health care shall not be construed as affecting any privi-
lege that the individual may have under common or statu-
tory law in a court of a State or the United States.
(g) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A
health information trustee may impose requirements for
an authorization that are in addition to the requirements
in this section.
(h) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization as part of the information.
(i) CONSTRUCTION.—This section shall not be con-
strued—
(1) to require a health information trustee to
disclose protected health information; or
(2) to limit the right of a health information
trustee to charge a fee for the disclosure or repro-
duction of protected health information.
(j) SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.—If a health information trustee discloses pro-
tected health information pursuant to an authorization in
order to comply with an administrative subpoena or war-
rant or a judicial subpoena or search warrant, the author-
ization—
(1) shall specifically authorize the disclosure for
the purpose of permitting the trustee to comply with
the subpoena, warrant, or search warrant; and
(2) shall otherwise meet the requirements in
this section.
SEC. 123. TREATMENT, PAYMENT, AND OVERSIGHT.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion to a health use trustee if the disclosure is—
(1) for the purpose of providing health care to
an individual and the individual who is the subject
of the information has not previously objected to the
disclosure in writing;
(2) for the purpose of providing for the pay-
ment for health care furnished to an individual; or
(3) for use by a health oversight agency for a
purpose authorized by law.
(b) USE
IN ACTION AGAINST INDIVIDUAL.—Pro-
tected health information about an individual that is dis-
closed under this section may not be used in, or disclosed
to any person for use in, any administrative, civil, or crimi-
nal action or investigation directed against the individual,
except an action or investigation arising out of and di-
rectly related to receipt of health care or payment for
health care.
SEC. 124. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion to the next of kin or legal representative (as defined
under State law) of the individual who is the subject of
the information, or to a person with whom the individual
has a personal relationship, if—
(1) the individual has not previously objected to
the disclosure;
(2) the disclosure is consistent with accepted
medical practice; and
(3) the information disclosed relates to the on-
going provision of health care to the individual.
(b) DIRECTORY INFORMATION.—A health informa-
tion trustee who is authorized by subtitle A to disclose
protected health information under this section may dis-
close such information to any person, if—
(1) the information does not reveal specific in-
formation about the physical or mental condition of
the individual or health care provided to the individ-
ual;
(2) the individual who is the subject of the in-
formation has not objected in writing to the disclo-
sure;
(3) the disclosure is consistent with accepted
medical practice; and
(4) the information consists only of 1 or more
of the following items:
(A) The name of the individual.
(B) If the individual is receiving health
care from a health care provider on a premises
controlled by the provider, the location of the
individual on such premises.
(C) If the individual is receiving health
care from a health care provider on a premises
controlled by the provider, the general health
status of the individual, described in terms of
critical, poor, fair, stable, satisfactory, or terms
denoting similar conditions.
(c) RECIPIENTS.—A person to whom protected health
information is disclosed under this section shall not, by
reason of such disclosure, be subject to any requirement
under this Act.
SEC. 125. PUBLIC HEALTH.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion to a public health trustee for use in legally author-
ized—
(1) disease or injury reporting;
(2) public health surveillance; or
(3) public health investigation.
(b) USE
IN ACTION AGAINST INDIVIDUAL.—Pro-
tected health information about an individual that is dis-
closed under this section may not be used in, or disclosed
to any person for use in, any administrative, civil, or crimi-
nal action or investigation directed against the individual,
except where the use or disclosure is authorized by law
for protection of the public health.
SEC. 126. EMERGENCY CIRCUMSTANCES.
A health information trustee who is authorized by
subtitle A to disclose protected health information under
this section may disclose such information to alleviate
emergency circumstances affecting the health or safety of
an individual.
SEC. 127. JUDICIAL, ADMINISTRATIVE, AND OTHER LEGAL
PURPOSES.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion—
(1) pursuant to the Federal Rules of Civil Pro-
cedure, the Federal Rules of Criminal Procedure, or
comparable rules of other courts or administrative
agencies in connection with litigation or proceedings
to which the individual who is the subject of the in-
formation is a party and in which the individual has
placed the individual’s physical or mental condition
in issue;
(2) pursuant to a law requiring the reporting of
specific medical information to law enforcement au-
thorities;
(3) if the disclosure is of information described
in paragraph (2) and the trustee is operated by a
Federal agency;
(4) if directed by a court in connection with a
court-ordered examination of an individual; or
(5) to assist in the identification of a dead indi-
vidual.
(b) WRITTEN STATEMENT.—A person seeking pro-
tected health information about an individual maintained
by health information trustee under—
(1) subsection (a)(1) shall provide the trustee
with a written statement that the individual is a
party to the litigation or proceedings for which the
information is sought; or
(2) subsection (a)(5) shall provide the trustee
with a written statement that the information is
sought to assist in the identification of a dead indi-
vidual.
(c) USE AND DISCLOSURE.—A person to whom pro-
tected health information is disclosed under this section
may use and disclose the information only under a condi-
tion described in subsection (a).
SEC. 128. HEALTH RESEARCH.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion to a public health trustee if the disclosure is for use
in a health research project that has been determined by
an institutional review board to be—
(1) of sufficient importance so as to outweigh
the intrusion into the privacy of the individual who
is the subject of the information that would result
from the disclosure; and
(2) reasonably impracticable to conduct without
such information.
(b) OBLIGATIONS OF RECIPIENT.—A person who re-
ceives protected health information pursuant to subsection
(a) shall remove or destroy, at the earliest opportunity
consistent with the purposes of the project, information
that would enable 1 or more individuals to be identified,
unless an institutional review board has determined that
there is a health or research justification for retention of
such identifiers and there is an adequate plan to protect
the identifiers from use and disclosure that is inconsistent
with this Act.
SEC. 129. LAW ENFORCEMENT.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion to a law enforcement agency (other than a health
oversight agency) if the information is—
(1) for use in an investigation or prosecution of
a health information trustee;
(2) to assist in the identification or location of
a suspect, fugitive, or witness in a law enforcement
inquiry;
(3) in connection with criminal activity commit-
ted against the trustee or an affiliated person of the
trustee or on premises controlled by the trustee; or
(4) needed to determine whether a crime has
been committed and the nature of any crime that
may have been committed (other than a crime that
may have been committed by the individual who is
the subject of the information).
(b) CERTIFICATION.—Where a law enforcement
agency requests a health information trustee to disclose
protected health information under this section, the agen-
cy shall provide the trustee with a written certification
that—
(1) is signed by a supervisory official of a rank
designated by the head of the agency;
(2) specifies the information requested; and
(3) states that the information is needed for a
lawful purpose under this section.
(c) RESTRICTIONS ON DISCLOSURE AND USE.—Pro-
tected health information about an individual that is dis-
closed by a health information trustee to a law enforce-
ment agency under this section—
(1) may not be disclosed for, or used in, any
administrative, civil, or criminal action or investiga-
tion against the individual, except in an action or in-
vestigation arising out of and directly related to the
action or investigation for which the information was
obtained; and
(2) may not be otherwise used or disclosed by
the agency, unless the use or disclosure is necessary
to fulfill the purpose for which the information was
obtained and is not otherwise prohibited by law.
SEC. 130. SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) IN GENERAL.—A health information trustee who
is authorized by subtitle A to disclose protected health in-
formation under this section may disclose such informa-
tion if the disclosure is pursuant to any of the following:
(1) A subpoena issued under the authority of a
grand jury and the trustee is provided a written cer-
tification by the grand jury seeking the information
that the grand jury has complied with the applicable
access provisions of section 141 or 143(a).
(2) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the trust-
ee is provided a written certification by the person
seeking the information that the person has com-
plied with the applicable access provisions of section
141 or 143(a).
(3) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the dis-
closure otherwise meets the conditions of one of sec-
tions 123 through 129.
(b) RESTRICTIONS ON USE AND DISCLOSURE.—Pro-
tected health information about an individual that is dis-
closed by a health information trustee under—
(1) subsection (a) may not be disclosed for, or
used in, any administrative, civil, or criminal action
or investigation against the individual, except in an
action or investigation arising out of and directly re-
lated to the inquiry for which the information was
obtained;
(2) subsection (a)(2) may not be otherwise used
or disclosed by the recipient unless the use or disclo-
sure is necessary to fulfill the purpose for which the
information was obtained; and
(3) subsection (a)(3) may not be used or dis-
closed by the recipient unless the recipient complies
with the conditions and restrictions on use and dis-
closure with which the recipient would have been re-
quired to comply if the disclosure by the trustee had
been made under the section referred to in sub-
section (a)(3) the conditions of which were met by
the disclosure.
(c) RESTRICTIONS ON GRAND JURIES.—Protected
health information that is disclosed by a health informa-
tion trustee under subsection (a)(1)—
(1) shall be returnable on a date when the
grand jury is in session and actually presented to
the grand jury;
(2) shall be used only for the purpose of consid-
ering whether to issue an indictment or report by
that grand jury, or for the purpose of prosecuting a
crime for which that indictment or report is issued,
or for a purpose authorized by rule 6(e) of the Fed-
eral Rules of Criminal Procedure or a comparable
State rule;
(3) shall be destroyed or returned to the trustee
if not used for one of the purposes specified in para-
graph (2); and
(4) shall not be maintained, or a description of
the contents of such information shall not be main-
tained, by any government authority other than in
the sealed records of the grand jury, unless such in-
formation has been used in the prosecution of a
crime for which the grand jury issued an indictment
or presentment or for a purpose authorized by rule
6(e) of the Federal Rules of Criminal Procedure or
a comparable State rule.
(d) COPY AS PART OF PROTECTED INFORMATION.—
A health information trustee who discloses protected
health information under this section shall maintain a
copy of the applicable subpoena, warrant, or search war-
rant as part of the information.
(e) CONSTRUCTION.—Nothing in this section shall be
construed as authority for a health information trustee to
refuse to comply with an administrative subpoena or war-
rant or a judicial subpoena or search warrant that meets
the requirements of this Act.
Subtitle C—Access Procedures and
Challenge Rights
SEC. 141. ACCESS PROCEDURES FOR LAW ENFORCEMENT
SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) PROBABLE CAUSE REQUIREMENT.—A govern-
ment authority may not obtain protected health informa-
tion about an individual from a health information trustee
under paragraph (1) or (2) of section 130(a) for use in
a law enforcement inquiry unless there is probable cause
to believe that the information is relevant to a legitimate
law enforcement inquiry being conducted by the govern-
ment authority.
(b) WARRANTS AND SEARCH WARRANTS.—A govern-
ment authority that obtains protected health information
about an individual from a health information trustee
under circumstances described in subsection (a) and pur-
suant to a warrant or search warrant shall, not later than
30 days after the date the warrant was served on the
trustee, serve the individual with, or mail to the last
known address of the individual, a copy of the warrant.
(c) SUBPOENAS.—Except as provided in subsection
(d), a government authority may not obtain protected
health information about an individual from a health in-
formation trustee under circumstances described in sub-
section (a) and pursuant to a subpoena unless a copy of
the subpoena has been served by hand delivery upon the
individual, or mailed to the last known address of the indi-
vidual, on or before the date on which the subpoena was
served on the trustee, together with a notice (published
by the Secretary under section 145(1)) of the individual’s
right to challenge the subpoena in accordance with section
142, and—
(1) 30 days have passed from the date of serv-
ice, or 30 days have passed from the date of mailing,
and within such time period the individual has not
initiated a challenge in accordance with section 142;
or
(2) disclosure is ordered by a court under sec-
tion 142.
(d) APPLICATION FOR DELAY.—
(1) IN GENERAL.—A government authority may
apply to an appropriate court to delay (for an initial
period of not longer than 90 days) serving a copy of
a subpoena and a notice otherwise required under
subsection (c) with respect to a law enforcement in-
quiry. The government authority may apply to the
court for extensions of the delay.
(2) REASONS FOR DELAY.—An application for
a delay, or extension of a delay, under this sub-
section shall state, with reasonable specificity, the
reasons why the delay or extension is being sought.
(3) EX PARTE ORDER.—The court shall enter
an ex parte order delaying, or extending the delay
of, the notice and an order prohibiting the trustee
from revealing the request for, or the disclosure of,
the protected health information being sought if the
court finds that—
(A) the inquiry being conducted is within
the lawful jurisdiction of the government au-
thority seeking the protected health informa-
tion;
(B) there is probable cause to believe that
the protected health information being sought is
relevant to a legitimate law enforcement inquiry
being conducted by the government authority;
(C) the government authority’s need for
the information outweighs the privacy interest
of the individual who is the subject of the infor-
mation; and
(D) there are reasonable grounds to believe
that receipt of a notice by the individual will re-
sult in—
(i) endangering the life or physical
safety of any individual;
(ii) flight from prosecution;
(iii) destruction of or tampering with
evidence or the information being sought;
or
(iv) intimidation of potential wit-
nesses.
(4) SERVICE
OF
APPLICATION
ON
INDIVID-
UAL.—Upon the expiration of a period of delay of
notice under this subsection, the government author-
ity shall serve upon the individual, with the service
of the subpoena and the notice, a copy of any appli-
cations filed and approved under this subsection.
SEC. 142. CHALLENGE PROCEDURES FOR LAW ENFORCE-
MENT SUBPOENAS.
(a) MOTION TO QUASH SUBPOENA.—Within 30 days
of the date of service, or 30 days of the date of mailing,
of a subpoena of a government authority seeking protected
health information about an individual from a health in-
formation trustee under paragraph (1) or (2) of section
130(a) (except a subpoena issued in compliance with the
provisions of section 143(a)), the individual may file (with-
out filing fee) a motion to quash the subpoena—
(1) in the case of a State judicial subpoena, in
the court which issued the subpoena;
(2) in the case of a subpoena issued under the
authority of a State that is not a State judicial sub-
poena, in a court of competent jurisdiction;
(3) in the case of a subpoena issued under the
authority of a Federal court, in any court of the
United States of competent jurisdiction; or
(4) in the case of any other subpoena issued
under the authority of the United States, in—
(A) the United States district court for the
district in which the individual resides or in
which the subpoena was issued; or
(B) another United States district court of
competent jurisdiction.
(b) COPY.—A copy of the motion shall be served by
the individual upon the government authority by delivery
of registered or certified mail.
(c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov-
ernment authority may file with the court such affidavits
and other sworn documents as sustain the validity of the
subpoena. The individual may file with the court, within
5 days of the date of the authority’s filing, affidavits and
sworn documents in response to the authority’s filing. The
court, upon the request of the individual, the government
authority, or both, may proceed in camera.
(d) PROCEEDINGS AND DECISION ON MOTION.—The
court may conduct such proceedings as it deems appro-
priate to rule on the motion. All such proceedings shall
be completed, and the motion ruled on, within 10 calendar
days of the date of the government authority’s filing.
(e) EXTENSION
OF
TIME
LIMITS
FOR
GOOD
CAUSE.—The court, for good cause shown, may at any
time in its discretion enlarge the time limits established
by subsections (c) and (d).
(f) STANDARD FOR DECISION.—A court may deny an
individual’s timely motion under subsection (a) if it finds
that there is probable cause to believe that the protected
health information being sought is relevant to a legitimate
law enforcement inquiry being conducted by the govern-
ment authority, unless the court finds that the individual’s
privacy interest outweighs the government authority’s
need for the information. The individual shall have the
burden of demonstrating that the individual’s privacy in-
terest outweighs the need established by the government
authority for the information.
(g) SPECIFIC CONSIDERATIONS WITH RESPECT TO
PRIVACY INTEREST.—In determining under subsection (f)
whether an individual’s privacy interest outweighs the gov-
ernment authority’s need for the information, the court
shall consider—
(1) the particular purpose for which the infor-
mation was collected by the trustee;
(2) the degree to which disclosure of the infor-
mation will embarrass, injure, or invade the privacy
of the individual;
(3) the effect of the disclosure on the individ-
ual’s future health care;
(4) the importance of the inquiry being con-
ducted by the government authority, and the impor-
tance of the information to that inquiry; and
(5) any other factor deemed relevant by the
court.
(h) ATTORNEY’S FEES.—In the case of any motion
brought under subsection (a) in which the individual has
substantially prevailed, the court, in its discretion, may as-
sess against a government authority a reasonable attor-
ney’s fee and other litigation costs (including expert fees)
reasonably incurred.
(i) NO INTERLOCUTORY APPEAL.—A court ruling de-
nying a motion to quash under this section shall not be
deemed a final order and no interlocutory appeal may be
taken therefrom by the individual. An appeal of such a
ruling may be taken by the individual within such period
of time as is provided by law as part of any appeal from
a final order in any legal proceeding initiated against the
individual arising out of or based upon the protect health
information disclosed.
SEC. 143. ACCESS AND CHALLENGE PROCEDURES FOR
OTHER SUBPOENAS.
(a) IN GENERAL.—A person (other than a govern-
ment authority under section 141) may not obtain pro-
tected health information about an individual from a
health information trustee pursuant to a subpoena under
section 130(a)(2) unless—
(1) a copy of the subpoena has been served
upon the individual or mailed to the last known ad-
dress of the individual on or before the date on
which the subpoena was served on the trustee, to-
gether with a notice (published by the Secretary
under section 145(2)) of the individual’s right to
challenge the subpoena, in accordance with sub-
section (b); and
(2) either—
(A) 30 days have passed from the date of
service or 30 days have passed from the date of
the mailing and within such time period the in-
dividual has not initiated a challenge in accord-
ance with subsection (b); or
(B) disclosure is ordered by a court under
such subsection.
(b) MOTION TO QUASH.—Within 30 days of the date
of service or 30 days of the date of mailing of a subpoena
seeking protected health information about an individual
from a health information trustee under subsection (a),
the individual may file (without filing fee) in any court
of competent jurisdiction, a motion to quash the subpoena,
with a copy served on the person seeking the information.
The individual may oppose, or seek to limit, the subpoena
on any grounds that would otherwise be available if the
individual were in possession of the information.
(c) STANDARD
FOR DECISION.—The court shall
grant an individual’s timely motion under subsection (b)
if the person seeking the information has not sustained
the burden of demonstrating that—
a reasonable attorney’s fee and other litigation costs (in-
cluding expert fees) reasonably incurred.
SEC. 144. CONSTRUCTION OF SUBTITLE; SUSPENSION OF
STATUTE OF LIMITATIONS.
(a) IN GENERAL.—Nothing in this subtitle shall af-
fect the right of a health information trustee to challenge
requests for protected health information. Nothing in this
subtitle shall entitle an individual who is the subject of
such information to assert the rights of a health informa-
tion trustee.
(b) EFFECT OF MOTION ON STATUTE OF LIMITA-
TIONS.—If an individual who is the subject of protected
health information files a motion under this Act which has
the effect of delaying the access of a government authority
to such information, any applicable statute of limitations
is deemed to be tolled for the period beginning on the date
such motion was filed and ending on the date on which
the motion is decided.
SEC. 145. RESPONSIBILITIES OF SECRETARY.
Not later than July 1, 1996, the Secretary, after no-
tice and opportunity for public comment, shall develop and
disseminate a brief, clear, and easily understood notice—
(1) for use under subsection (c) of section 141,
detailing the rights of an individual who wishes to
challenge, under section 142, the disclosure of pro-
tected health information about the individual under
such subsection; and
(2) for use under subsection (a) of section 143,
detailing the rights of an individual who wishes to
challenge, under subsection (b) of such section, the
disclosure of protected health information about the
individual under such section.
Subtitle D—Miscellaneous
Provisions
SEC. 151. DEBIT AND CREDIT CARD TRANSACTIONS.
(a) PAYMENT FOR HEALTH CARE THROUGH DEBIT
OR CREDIT CARD.—If an individual pays a health infor-
mation trustee for health care by presenting a debit or
credit card or card number, the trustee may use or dis-
close such protected health information about the individ-
ual as is necessary for the processing of the debit or credit
card transaction or the billing or collection of amounts
charged or debited to the individual using the card or
number.
(b) TRANSACTION PROCESSING BY CARD ISSUERS.—
A person who is a debit or credit card issuer or is other-
wise directly involved in the processing of credit or debit
transactions or the billing or collection of amounts charged
or debited thereto may only use or disclose protected
health information about an individual—
(1) that has been disclosed in accordance with
subsection (a); and
(2) when necessary for—
(A) the billing or collection of amounts
charged or debited to the individual using a
debit or credit card;
(B) the transfer of receivables, accounts,
or interest therein;
(C) the audit of the credit or debit card ac-
count information;
(D) compliance with Federal, State, or
local law; and
(E) a properly authorized civil, criminal, or
regulatory investigation by Federal, State, or
local authorities.
SEC. 152. ACCESS TO PROTECTED HEALTH INFORMATION
OUTSIDE OF THE UNITED STATES.
(a) IN GENERAL.—Except as provided in subsection
(b), notwithstanding the provisions of subtitle A and part
2 of subtitle B, a health information trustee may not per-
mit any person who is not in a State to have access to
protected health information about an individual unless
one or more of the following conditions exist:
(1) SPECIFIC AUTHORIZATION.—The individual
has specifically consented to the provision of such
access outside of the United States in an authoriza-
tion that meets the requirements of section 122.
(2) EQUIVALENT
INFORMATION
PRACTICES.—
The provision of such access is authorized under this
Act and the Secretary has determined that there are
fair information practices for protected health infor-
mation in the country where the access will be pro-
vided that are equivalent to the fair information
practices provided for by this Act.
(3) ACCESS REQUIRED BY LAW.—The provision
of such access is required under—
(A) a Federal statute; or
(B) a treaty or other international agree-
ment applicable to the United States.
(b) EXCEPTIONS.—Subsection (a) does not apply
where the provision of access to protected health informa-
tion—
(1) is to a foreign public health authority;
(2) is authorized under section 126; or
(3) is necessary for the purpose of providing for
payment for health care that has been provided to
an individual.
SEC. 153. STANDARDS FOR ELECTRONIC DOCUMENTS AND
COMMUNICATIONS.
(a) STANDARDS.—Not later than July 1, 1996, the
Secretary, after notice and opportunity for public com-
ment, shall promulgate standards with respect to the cre-
ation, transmission, receipt, and maintenance, in elec-
tronic form, of each written document required or author-
ized under this Act. Where a signature is required with
respect to a written document under any other provision
of this Act, such standards shall provide for an electronic
substitute that serves the functional equivalent of a
signature.
(b) TREATMENT OF COMPLYING DOCUMENTS AND
COMMUNICATIONS.—An electronic document or commu-
nication that satisfies the standards promulgated under
subsection (a) with respect to such document or commu-
nication shall be treated as satisfying the requirements of
this Act that apply to an equivalent written document.
SEC. 154. POWERS OF ATTORNEY.
In the case of an individual who has executed a power
of attorney, recognized under State law, authorizing a per-
son to act as agent or attorney for the individual for one
or more purposes, the person may exercise any right of
the individual under this title that the person is authorized
to exercise by the power of attorney, if—
(1) any condition precedent to the exercise of
such right that is set forth in the power of attorney
has been satisfied; and
(2) the power of attorney specifically references
or describes the rights under this title that may be
exercised by the person.
SEC. 155. RIGHTS OF INCOMPETENTS.
(a) EFFECT OF DECLARATION OF INCOMPETENCE.—
Except as provided in section 154, if an individual has
been declared to be incompetent by a court of competent
jurisdiction, the rights of the individual under this title
shall be exercised and discharged in the best interests of
the individual through an authorized legal representative
of the individual.
(b) NO COURT DECLARATION.—Except as provided
in section 154, if a health care provider determines that
an individual, who has not been declared to be incom-
petent by a court of competent jurisdiction, suffers from
a medical condition that prevents the individual from act-
ing knowingly or effectively on the individual’s own behalf,
the right of the individual to authorize disclosure under
section 122 may be exercised and discharged in the best
interest of the individual by the individual’s next of kin.
SEC. 156. RIGHTS OF MINORS.
(a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA-
BLE.—In the case of an individual—
(1) who is 18 years of age or older, all rights
of the individual shall be exercised by the individual,
except as provided in sections 154 and 155; or
(2) who, acting alone, has the legal capacity to
apply for and obtain a type of medical examination,
care, or treatment and who has sought such exam-
ination, care, or treatment, the individual shall exer-
cise all rights of an individual under this title with
respect to protected health information relating to
such examination, care, or treatment.
(b) INDIVIDUALS UNDER 18.—Except as provided in
subsection (a)(2), in the case of an individual who is—
(1) under 14 years of age, all the individual’s
rights under this title shall be exercised through the
parent or legal guardian of the individual; or
(2) 14, 15, 16, or 17 years of age, the right of
inspection (under section 111), the right of amend-
ment (under section 112), and the right to authorize
disclosure of protected health information (under
section 122) of the individual may be exercised ei-
ther by the individual or by the parent or legal
guardian of the individual.
Subtitle E—Enforcement
SEC. 161. CIVIL ACTIONS.
(a) IN GENERAL.—Any individual whose rights under
this title have been knowingly or negligently violated—
(1) by a health information trustee, or any
other person, who is not described in paragraph (2),
(3), (4), or (5) may maintain a civil action for actual
damages and for equitable relief against the health
information trustee or other person;
(2) by an officer or employee of the United
States while the officer or employee was acting with-
in the scope of the office or employment may main-
tain a civil action for actual damages and for equi-
table relief against the United States;
(3) by an officer or employee of any government
authority of a State that has waived its sovereign
immunity to a claim for damages resulting from a
violation of this title while the officer or employee
was acting within the scope of the office or employ-
ment may maintain a civil action for actual damages
and for equitable relief against the State govern-
ment;
(4) by an officer or employee of a government
of a State that is not described in paragraph (3)
may maintain a civil action for actual damages and
for equitable relief against the officer or employee;
or
(5) by an officer or employee of a government
authority while the officer or employee was not act-
ing within the scope of the office or employment
may maintain a civil action for actual damages and
for equitable relief against the officer or employee.
(b) KNOWING VIOLATIONS.—Any individual entitled
to recover actual damages under this section because of
a knowing violation of a provision of this title (other than
subsection (c) or (d) of section 121) shall be entitled to
recover the amount of the actual damages demonstrated
or $5000, whichever is greater.
(c) ACTUAL DAMAGES.—For purposes of this section,
the term ‘‘actual damages’’ includes damages paid to com-
pensate an individual for nonpecuniary losses such as
physical and mental injury as well as damages paid to
compensate for pecuniary losses.
(d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In
any action brought under this section in which the com-
plainant has prevailed because of a knowing violation of
a provision of this title (other than subsection (c) or (d)
of section 121), the court may, in addition to any relief
awarded under subsections (a) and (b), award such puni-
tive damages as may be warranted. In such an action, the
court, in its discretion, may allow the prevailing party a
reasonable attorney’s fee (including expert fees) as part
of the costs, and the United States shall be liable for costs
the same as a private person.
(e) INSPECTION AND AMENDMENT.—If a health in-
formation trustee has established a written internal proce-
dure that allows an individual who has been denied inspec-
tion or amendment of protected health information to ap-
peal the denial, the individual may not maintain a civil
action in connection with the denial until the earlier of—
(1) the date the appeal procedure has been ex-
hausted; or
(2) 3 months after the date the original request
for inspection or amendment was made.
(f) NO
LIABILITY
FOR
PERMISSIBLE
DISCLO-
SURES.—A health information trustee who makes a disclo-
sure of protected health information about an individual
that is permitted by this title and not otherwise prohibited
by State or Federal statute shall not be liable to the indi-
vidual for the disclosure under common law.
(g) NO LIABILITY
FOR INSTITUTIONAL REVIEW
BOARD DETERMINATIONS.—If the members of an institu-
tional review board have in good faith determined that a
health research project is of sufficient importance so as
to outweigh the intrusion into the privacy of an individual
pursuant to section 128(a)(1), the members, the board,
and the parent institution of the board shall not be liable
to the individual as a result of such determination.
(h) GOOD FAITH RELIANCE ON CERTIFICATION.—A
health information trustee who relies in good faith on a
certification by a government authority or other person
and discloses protected health information about an indi-
vidual in accordance with this title shall not be liable to
the individual for such disclosure.
SEC. 162. CIVIL MONEY PENALTIES.
(a) VIOLATION.—Any health information trustee who
the Secretary determines has substantially failed to com-
ply with the provisions of this Act shall be subject, in addi-
tion to any other penalties that may be prescribed by law,
to a civil money penalty of not more than $10,000 for
each such violation.
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.—
The provisions of section 1128A of the Social Security Act
(other than subsections (a) and (b) and the second sen-
tence of subsection (f)) shall apply to the imposition of
a civil monetary penalty under this section in the same
manner as such provisions apply with respect to the impo-
sition of a penalty under section 1128A of such Act.
SEC. 163. ALTERNATIVE DISPUTE RESOLUTION.
(a) IN GENERAL.—The Secretary shall, by regula-
tion, develop alternative dispute resolution methods for
use by individuals, health information trustees, and other
persons in resolving claims under section 161.
(b) METHODS.—The methods under subsection (a)
shall include at least the following:
(1) ARBITRATION.—The use of arbitration.
(2) MEDIATION.—The use of mediation.
(3) EARLY OFFERS OF SETTLEMENT.—The use
of a process under which parties make early offers
of settlement.
(c) STANDARDS FOR ESTABLISHING METHODS.—In
developing alternative dispute resolution methods under
subsection (a), the Secretary shall ensure that the meth-
ods promote the resolution of claims in a manner that—
(1) is affordable for the parties involved;
(2) provides for timely resolution of claims;
(3) provides for the consistent and fair resolu-
tion of claims; and
(4) provides for reasonably convenient access to
dispute resolution for individuals.
SEC. 164. AMENDMENTS TO CRIMINAL LAW.
(a) IN GENERAL.—Title 18, United States Code, is
amended by inserting after chapter 89 the following:
‘‘CHAPTER 90—PROTECTED HEALTH
INFORMATION
‘‘Sec.
‘‘1831. Definitions.
‘‘1832. Obtaining protected health information under false pretenses.
‘‘1833. Monetary gain from obtaining protected health information under false
pretenses.
‘‘1834. Knowing and unlawful obtaining of protected health information.
‘‘1835. Monetary gain from knowing and unlawful obtaining of protected health
information.
‘‘1836. Knowing and unlawful use or disclosure of protected health information.
‘‘1837. Monetary gain from knowing and unlawful sale, transfer, or use of pro-
tected health information.
‘‘§ 1831. Definitions
‘‘As used in this chapter—
‘‘(1) the term ‘health information trustee’ has
the meaning given such term in section 3(b)(3) of
the Fair Health Information Practices Act of 1994;
and
‘‘(2) the term ‘protected health information has
the meaning given such term in section 3(a)(3) of
such Act.
‘‘§ 1832. 
Obtaining 
protected 
health 
information
under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee; or
‘‘(2) obtains from an individual an authoriza-
tion for the disclosure of protected health informa-
tion about the individual maintained by a health in-
formation trustee;
shall be fined under this title or imprisoned not more than
5 years, or both.
‘‘§ 1833. Monetary gain from obtaining protected
health information under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee with the
intent to sell, transfer, or use such information for
profit or monetary gain; or
‘‘(2) obtains from an individual an authoriza-
tion for the disclosure of protected health informa-
tion about the individual maintained by a health in-
formation trustee with the intent to sell, transfer, or
use such authorization for profit or monetary gain;
and knowingly sells, transfers, or uses such information
or authorization for profit or monetary gain shall be fined
under this title or imprisoned not more than 10 years, or
both.
‘‘§ 1834. Knowing and unlawful obtaining of pro-
tected health information
‘‘Whoever knowingly obtains protected health infor-
mation from a health information trustee in violation of
the Fair Health Information Practices Act of 1994, know-
ing that such obtaining is unlawful, shall be fined under
this title or imprisoned not more than 5 years, or both.
‘‘§ 1835. Monetary gain from knowing and unlawful
obtaining of protected health information
‘‘Whoever knowingly—
‘‘(1) obtains protected health information from
a health information trustee in violation of the Fair
Health Information Practices Act of 1994, knowing
that such obtaining is unlawful and with the intent
to sell, transfer, or use such information for profit
or monetary gain; and
‘‘(2) knowingly sells, transfers, or uses such in-
formation for profit or monetary gain;
shall be fined under this title or imprisoned not more than
10 years, or both.
‘‘§ 1836. Knowing and unlawful use or disclosure of
protected health information
‘‘Whoever knowingly uses or discloses protected
health information in violation of the Fair Health Infor-
mation Practices Act of 1994, knowing that such use or
disclosure is unlawful, shall be fined under this title or
imprisoned not more than 5 years, or both.
‘‘§ 1837. Monetary gain from knowing and unlawful
sale, transfer, or use of protected health
information
‘‘Whoever knowingly sells, transfers, or uses pro-
tected health information in violation of the Fair Health
Information Practices Act of 1994, knowing that such
sale, transfer, or use is unlawful, shall be fined under this
title or imprisoned not more than 10 years, or both.’’.
(b) CLERICAL AMENDMENT.—The table of chapters
for part I of title 18, United States Code, is amended by
inserting after the item relating to chapter 89 the
following:
‘‘90. Protected health information .............................................. 1831’’.
TITLE II—AMENDMENTS TO
TITLE 5, UNITED STATES CODE
SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.
(a) NEW SUBSECTION.—Section 552a of title 5,
United States Code, is amended by adding at the end the
following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is a health information trustee (as defined in sec-
tion 3(b)(3) of the Fair Health Information Practices Act
of 1994) shall promulgate rules, in accordance with the
requirements (including general notice) of subsections
(b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this
title, to exempt a system of records within the agency, to
the extent that the system of records contains protected
health information (as defined in section 3(a)(3) of such
Act), from all provisions of this section except subsections
(e)(1), (e)(2), subparagraphs (A) through (C) and (E)
through (I) of subsection (e)(4), and subsections (e)(5),
(e)(6), (e)(9), (e)(12), (l), (m), (n), (o), (p), (q), (r),
and (u).’’.
(b) REPEAL.—Section 552a(f)(3) of title 5, United
States Code, is amended by striking ‘‘pertaining to him,’’
and all that follows through the semicolon and inserting
‘‘pertaining to the individual;’’.
TITLE 
III—REGULATIONS; 
EF-
FECTIVE DATES; APPLICABIL-
ITY; AND RELATIONSHIP TO
OTHER LAWS
SEC. 301. REGULATIONS.
Not later than July 1, 1996, the Secretary shall pre-
scribe regulations to carry out this Act.
SEC. 302. EFFECTIVE DATES.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act, and the amendments made by this Act, shall
take effect on January 1, 1997.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—Any
provision of this Act that imposes a duty on the Secretary
shall take effect on the date of the enactment of this Act.
SEC. 303. APPLICABILITY.
(a) PROTECTED HEALTH INFORMATION.—Except as
provided in subsections (b) and (c), the provisions of this
Act shall apply to any protected health information that
exists in a State on or after January 1, 1997, regardless
of whether the information existed or was disclosed prior
to such date.
(b) SPECIAL PURPOSE TRUSTEES.—The provisions
of this Act shall not apply to any special purpose trustee,
except with respect to protected health information that
is received by such a trustee on or after January 1, 1997.
(c) AUTHORIZATIONS FOR DISCLOSURES.—An au-
thorization for the disclosure of protected health informa-
tion about an individual that is executed by the individual
before January 1, 1997, and is recognized and valid under
State law on December 31, 1996, shall remain valid and
shall not be subject to the requirements of section 122
until July 1, 1998, or the occurrence of the date or event
(if any) specified in the authorization upon which the au-
thorization expires, whichever occurs earlier.
SEC. 304. RELATIONSHIP TO OTHER LAWS.
(a) STATE LAW.—Except as provided in subsections
(b) and (c), this Act shall prevent the establishment, con-
tinuing in effect, or enforcement of State law to the extent
such law is inconsistent with a provision of this Act, but
nothing in this Act shall be construed to indicate an intent
on the part of Congress to occupy the field in which its
provisions operate to the exclusion of the laws of any State
on the same subject matter.
(b) PRIVILEGES.—This Act does not preempt or mod-
ify State common or statutory law to the extent such law
concerns a privilege of a witness or person in a court of
the State. This Act does not supersede or modify Federal
common or statutory law to the extent such law concerns
a privilege of a witness or person in a court of the United
States.
(c) CERTAIN DUTIES UNDER STATE OR FEDERAL
LAW.—This Act shall not be construed to preempt, super-
sede, or modify the operation of—
(1) any law that provides for the reporting of
vital statistics such as birth or death information;
(2) any law requiring the reporting of abuse or
neglect information about any individual; or
(3) subpart II of part E of title XXVI of the
Public Health Service Act (relating to notifications
of emergency response employees of possible expo-
sure to infectious diseases).
Æ
HR 4077 IH—2
HR 4077 IH—3
HR 4077 IH—4
HR 4077 IH—5