I
105TH CONGRESS
2D SESSION
H. R. 3900
To establish Federal penalties for prohibited uses and disclosures of individ-
ually identifiable health information, to establish a right in an individual
to inspect and copy their own health information, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
MAY 19, 1998
Mr. SHAYS (for himself and Mr. BARRETT of Wisconsin) introduced the fol-
lowing bill; which was referred to the Committee on Commerce, and in
addition to the Committees on Ways and Means, and Government Reform
and Oversight, for a period to be subsequently determined by the Speak-
er, in each case for consideration of such provisions as fall within the ju-
risdiction of the committee concerned
A BILL
To establish Federal penalties for prohibited uses and disclo-
sures of individually identifiable health information, to
establish a right in an individual to inspect and copy
their own health information, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Consumer Health and Research Technology (CHART)
Protection Act’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
TITLE I—RESTRICTIONS ON USE AND DISCLOSURE
Sec. 101. General prohibitions and exceptions.
Sec. 102. Special rules for anonymized information.
Sec. 103. General requirements for authorization of disclosure of information.
Sec. 104. Disclosure in civil proceedings.
Sec. 105. Disclosure for criminal law enforcement purposes.
Sec. 106. Disclosures for archival research.
TITLE II—INDIVIDUALS’ RIGHTS
Sec. 201. Inspection and copying of health information.
Sec. 202. Amendment of individually identifiable health information.
Sec. 203. Notice of confidentiality practices.
TITLE III—ENFORCEMENT
Sec. 301. Criminal penalties.
Sec. 302. Civil action.
Sec. 303. Program exclusions.
TITLE IV—GENERAL PROVISIONS
Sec. 401. Standards for electronic disclosures.
Sec. 402. Authorized representatives.
Sec. 403. Relationship to other laws.
Sec. 404. Reports analyzing impact of Act.
Sec. 405. Effective date.
Sec. 406. Definitions.
TITLE I—RESTRICTIONS ON USE
AND DISCLOSURE
SEC. 101. GENERAL PROHIBITIONS AND EXCEPTIONS.
Except as otherwise provided in this Act, and subject
to the following exceptions, the following prohibited ac-
tions and inactions on the part of a person shall be consid-
ered a violation of this Act:
(1) DISCLOSURE IN ABSENCE OF, OR INCON-
SISTENT WITH, AUTHORIZATION.—
(A) IN GENERAL.—Subject to the excep-
tions described in subparagraph (B)—
(i) a negligent or intentional disclo-
sure of individually identifiable health in-
formation without an authorization with
respect to the information that satisfies
the requirements of section 103, is prohib-
ited, unless the disclosure is governed by
section 104 or 105; and
(ii) a negligent or intentional disclo-
sure of individually identifiable health in-
formation, by a person granted authority
under an authorization with respect to the
information that satisfies the requirements
of section 103, that is inconsistent with the
provisions of the authorization, is prohib-
ited.
(B) EXCEPTIONS.—A disclosure otherwise
prohibited under subparagraph (A) is not pro-
hibited when—
(i) made by an individual whose
health or health care is the subject of the
information (or an authorized representa-
tive of such an individual, pursuant to sec-
tion 402);
(ii) made for the purpose of providing,
or facilitating the provision of, health care
to an individual described in clause (i);
(iii) made for the purpose of facilitat-
ing payment activities related to health
care provided to an individual described in
clause (i);
(iv) made pursuant to a specific af-
firmative authorization, or a requirement,
under State or Federal law, for use in le-
gally authorized—
(I) reporting of abuse, domestic
violence, or neglect information about
any individual;
(II) disease or injury reporting
about any individual;
(III) public health surveillance,
such as birth and death reporting;
(IV) public health investigation
or intervention;
(V) management audits, financial
audits, or program monitoring and
evaluation; or
(VI) licensure, certification, ac-
creditation, utilization review, quality
assurance activities, benchmarking, or
outcomes management and assess-
ment;
(v) made pursuant to an authorization
granted in a contract providing health care
benefits for an individual described in
clause (i), for the purpose of licensure, cer-
tification, accreditation, utilization review,
quality assurance activities, benchmarking,
or outcomes management and assessment;
(vi) made to a health researcher—
(I) in accordance with a research
protocol approved by an institutional
review board; or
(II) in accordance with section
106(a); or
(vii) made to a party to, or potential
party to, a merger or acquisition of a com-
mercial enterprise, in anticipation of, or
upon, the merger or acquisition.
(2) FAILURE
TO
PROVIDE
FOR
REASONABLE
PROTECTIONS
AGAINST
PROHIBITED
DISCLO-
SURES.—
(A) IN GENERAL.—Subject to the excep-
tion described in subparagraph (B), a negligent
or intentional failure to provide for reasonable
protections against disclosures of individually
identifiable health information that are prohib-
ited under this Act is prohibited, including—
(i) a failure to establish and enforce
reasonable and appropriate administrative,
technical, and physical safeguards—
(I) to ensure the confidentiality
of individually identifiable health in-
formation; and
(II) to protect against—
(aa) any reasonably antici-
pated threats or hazards to the
security or integrity of such in-
formation; and
(bb) unauthorized uses or
disclosures of the information;
(ii) a failure to establish procedures
for determining a response to a subpoena,
warrant, court order, or other request from
a government authority for disclosure of
such information; and
(iii) a failure to provide for secure de-
struction of such information, where de-
struction of the information is desired.
(B) EXCEPTION.—A failure described in
subparagraph (A) is not prohibited when it is
by an individual whose health or health care is
the subject of the information (or an authorized
representative of such an individual, pursuant
to section 402).
(3) FAILURE TO IMPLEMENT WRITTEN POLI-
CIES FOR COMPLIANCE.—
(A) IN GENERAL.—Subject to the excep-
tion described in subparagraph (B), with re-
spect to a person whose employees, agents, or
contractors come in contact with individually
identifiable health information in the course of
their employment, agency, or contract execu-
tion, a negligent or intentional failure to estab-
lish and implement written policies concerning
compliance with this Act is prohibited, includ-
ing—
(i) a failure to establish procedures
for monitoring access to individually identi-
fiable health information;
(ii) a failure to establish rules limiting
access to such information to persons
whose duties require such access; and
(iii) a failure to provide for the en-
forcement of such policies.
(B) EXCEPTION.—A failure described in
subparagraph (A) is not prohibited when it is
by an individual whose health or health care is
the subject of the information (or an authorized
representative of such an individual, pursuant
to section 402).
(4) FAILURE TO ENTER INTO WRITTEN AGREE-
MENT
WITH
BUSINESS
ASSOCIATES
RESPECTING
COMPLIANCE.—A negligent or intentional failure to
enter into a written agreement with an agent, con-
tractor, or other person to whom individually identi-
fiable health information is disclosed for a business
purpose (such as persons who encode or encrypt in-
formation, data management contractors, and utili-
zation review and accreditation organizations), prior
to such disclosure, specifying the limitations on their
use and retention of such information and informing
them of their responsibilities under this Act, is pro-
hibited.
(5) COMPLIANCE
WITH
RESEARCH
REQUIRE-
MENTS.—A negligent or intentional action is prohib-
ited where it consists of—
(A) a disclosure for health research pur-
poses of individually identifiable health informa-
tion that—
(i) has not been approved by an insti-
tutional review board; or
(ii) does not satisfy the requirements
of section 106; or
(B) a use or disclosure of individually iden-
tifiable health information in violation of—
(i) a research protocol approved by an
institutional review board or any other re-
quirement or condition concerning such use
or disclosure established by such a review
board; or
(ii) any requirement or condition con-
cerning such use or disclosure established
by a person making, or approving, a disclo-
sure under section 106.
(6) ANONYMIZED
INFORMATION.—A use of
anonymized information, or an encryption key or
coding system used to anonymize information, in
violation of section 102, is prohibited.
(7) CIVIL PROCEEDING.—A negligent or inten-
tional disclosure of individually identifiable health in-
formation pursuant to a subpoena or discovery re-
quest related to a civil proceeding, in violation of
section 104, is prohibited.
(8) CRIMINAL PROCEEDING.—A negligent or in-
tentional disclosure of individually identifiable health
information for a criminal law enforcement purpose,
in violation of section 105, or a negligent or inten-
tional use of information obtained pursuant to such
section in violation of the section, is prohibited.
(9) SALE OR COMMERCIAL PUBLICATION.—
(A) IN GENERAL.—Subject to the excep-
tions described in subparagraph (B), an inten-
tional disclosure of individually identifiable
health information that constitutes a sale or
commercial publication of the information, is
prohibited.
(B) EXCEPTIONS.—A disclosure otherwise
prohibited under subparagraph (A) is not pro-
hibited when—
(i) the disclosure is made by an indi-
vidual whose health or health care is the
subject of the information (or an author-
ized representative of such an individual,
pursuant to section 402); or
(ii) the disclosure is made to a person
having a written authorization permitting
the disclosure that satisfies the require-
ments of section 103.
(10) FRAUD OR MISREPRESENTATION.—Use of
fraud, duress, deceit, or misrepresentation to obtain
access to individually identifiable health information
is prohibited.
SEC. 102. SPECIAL RULES FOR ANONYMIZED INFORMA-
TION.
(a) DEFINITION.—For purposes of this Act, the term
‘‘anonymized information’’ means individually identifiable
health information from which personal identifiers and
means of directly contacting any subject of the informa-
tion (including name, address, and social security num-
ber), have been removed, encrypted, or replaced with a
code, in a manner such that the identity of any such sub-
ject is not apparent from the facts contained in the infor-
mation, but may, in the case of encrypted or coded infor-
mation, be determined by a person with access to the
encryption key or coding system. Such term does not in-
clude any such encryption key or coding system.
(b) USE.—
(1) IN GENERAL.—Subject to paragraph (2), a
person may use anonymized information, or an
encryption key or coding system described in sub-
section (c)(2), for any lawful purpose, if the person,
in such use, does not—
(A) attempt to identify any individual with
respect to whom information has been removed,
encrypted, or replaced with a code; or
(B) intentionally use the anonymized infor-
mation, the key, or the coding system in any
way that results in the identification of any
such individual.
(2) EXCEPTIONS.—A use otherwise prohibited
under paragraph (1) is not prohibited when any of
the following circumstances apply:
(A) The use is by an individual whose
health or health care is the subject of the infor-
mation (or an authorized representative of such
an individual, pursuant to section 402).
(B) The use is by a person having an au-
thorization permitting the use that satisfies the
requirements of section 103.
(C) The use is for the purpose of provid-
ing, or facilitating the provision of, health care
to an individual described in subparagraph (A).
(D) The use is for the purpose of facilitat-
ing payment activities related to health care
provided to an individual described in subpara-
graph (A).
(E) The use is pursuant to a specific af-
firmative authorization, or a requirement, under
State or Federal law, for legally authorized—
(i) disease or injury reporting;
(ii) public health surveillance, such as
birth and death reporting, and reporting
incidents of abuse, domestic violence, or
neglect;
(iii) public health investigation or
intervention;
(iv) management audits, financial au-
dits, or program monitoring and evalua-
tion; or
(v) licensure, certification, accredita-
tion, utilization review, quality assurance
activities, benchmarking, or outcomes man-
agement and assessment.
(F) The use is pursuant to an authoriza-
tion granted in a contract providing health care
benefits for an individual described in subpara-
graph (A), for the purpose of licensure, certifi-
cation, accreditation, utilization review, quality
assurance activities, benchmarking, or outcomes
management and assessment.
(G) The use is by a health researcher and
is—
(i) in accordance with a research pro-
tocol approved by an institutional review
board and any other requirement or condi-
tion concerning such use established by
such a review board; or
(ii) in accordance with any require-
ment or condition concerning such use es-
tablished by a person making, or approv-
ing, a disclosure under section 106.
(H) The use is by a party to, or potential
party to, a merger or acquisition of a commer-
cial enterprise, in anticipation of, or upon, the
merger or acquisition.
(c) DISCLOSURE.—
(1) ANONYMIZED INFORMATION.—For purposes
of this Act, disclosure of anonymized information
shall not be considered disclosure of individually
identifiable health information, unless it is disclosed
with an encryption key or coding system described in
paragraph (2) in manner such that the combined in-
formation satisfies the requirements of section
406(8).
(2) ENCRYPTION KEY OR CODE.—For purposes
of this Act, disclosure of an encryption key or coding
system that is used to determine the identity of any
individual with respect to whom information has
been removed, encrypted, or replaced with a code, in
order to create anonymized information, shall not be
considered disclosure of individually identifiable
health information, unless it is disclosed with
anonymized information in manner such that the
combined information satisfies the requirements of
section 406(8).
(d) DECODED INFORMATION.—Formerly anonymized
information that has been manipulated to reveal a part
of the information that had been removed, encrypted, or
replaced with a code in order to render it anonymized in-
formation is individually identifiable health information
and is subject, beginning on the date of such manipula-
tion, to all of the requirements of this part relating to indi-
vidually identifiable information.
SEC. 103. GENERAL REQUIREMENTS FOR AUTHORIZATION
OF DISCLOSURE OF INFORMATION.
(a) IN GENERAL.—For purposes of section 101, an
authorization satisfies the requirements of this section if
it—
(1) is in writing;
(2) is executed by an individual whose health or
health care is the subject of the information (or an
authorized representative of such an individual, pur-
suant to section 402); and
(3) satisfies the requirements of subsection (b).
(b) REQUIREMENTS.—An authorization satisfies the
requirements in this subsection if—
(1) it includes the following:
(A) a general statement of the purposes
for which the individually identifiable health in-
formation disclosed pursuant to the authoriza-
tion may be used;
(B) a general description of the persons
who are authorized to use such information;
(C) a valid signature of an individual
whose health or health care is the subject of the
information (or an authorized representative of
such individual);
(D) the date of the signature;
(E) an expiration date upon which the au-
thorization is no longer valid; and
(F) reasonable procedures permitting such
individual or representative to revoke the au-
thorization; and
(2) in a case in which the purposes under para-
graph (1)(A) include health research, the provisions
of the authorization that relate to such research—
(A) include each of the elements described
in paragraph (1);
(B) are set out separately from the re-
maining provisions and are independent from
them; and
(C) are subject to separate revocation pro-
cedures, the use of which does not per se effect
a revocation of the remaining provisions.
(c) EFFECT OF GOOD FAITH RELIANCE ON AUTHOR-
IZATION.—A person shall not be liable, or subject to pun-
ishment under State or Federal law, for a disclosure of
individually identifiable health information, where the dis-
closure—
(1) was made in good faith reliance on an au-
thorization executed by the individual that satisfies
the requirements of this section; and
(2) was consistent with the provisions of the au-
thorization.
SEC. 104. DISCLOSURE IN CIVIL PROCEEDINGS.
(a) IN GENERAL.—A person may not disclose individ-
ually identifiable health information for use in a civil law
enforcement investigation, a civil administrative action, or
a civil action brought in Federal or State court, in the
absence of—
(1) an otherwise valid discovery request, an ad-
ministrative subpoena or summons, or a judicial sub-
poena; and
(2) an order issued by the presiding judge or
official upon a determination that the need for the
information of the person requesting the disclosure
substantially outweighs the privacy interest of each
individual whose health or health care is the subject
of the information.
(b) CONSTRUCTION.—This section shall not be con-
strued to supersede any ground that may otherwise apply
under Federal or State law for an objection to the disclo-
sure of individually identifiable health information in any
civil action.
SEC. 105. DISCLOSURE FOR CRIMINAL LAW ENFORCEMENT
PURPOSES.
(a) IN GENERAL.—A person may not disclose individ-
ually identifiable health information for a criminal law en-
forcement purpose—
(1) in the absence of—
(A) a subpoena issued under the authority
of a grand jury;
(B) an administrative subpoena or sum-
mons or a judicial subpoena or warrant; or
(C) a request otherwise authorized by law
from a law enforcement agency; and
(2) in the case of a disclosure under subpara-
graph (B) or (C) of paragraph (1), in the absence
of a court order issued upon a determination that
the need for the information of the person request-
ing the disclosure substantially outweighs the pri-
vacy interest of each individual whose health or
health care is the subject of the information.
(b) DESTRUCTION OR RETURN OF INFORMATION.—
When the proceeding for which individually identifiable
health information was disclosed is concluded, including
any derivative matters arising from such proceeding, the
person to whom the disclosure was made shall either de-
stroy the individually identifiable health information, or
return it to the person from whom it was obtained.
(c) REDACTIONS.—To the extent practicable, and
consistent with the requirements of due process, a criminal
law enforcement agency shall redact personally identifying
information from individually identifiable health informa-
tion prior to the public disclosure of such information in
a judicial or administrative proceeding.
(d) USE OF INFORMATION.—Individually identifiable
health information obtained by a criminal law enforcement
agency pursuant to this section may only be used for pur-
poses of a legitimate criminal law enforcement activity.
SEC. 106. DISCLOSURES FOR ARCHIVAL RESEARCH.
(a) IN GENERAL.—A person described in subsection
(b) may disclose individually identifiable health informa-
tion, that was previously created or collected by the person
and maintained by the person in an archive or other repos-
itory, to a health researcher pursuant to this subsection,
if—
(1) the disclosure is made for the purpose of
permitting the health researcher to carry out health
research that involves analysis of the information;
(2) the disclosure has been reviewed and ap-
proved, by a board, committee, or other group for-
mally designated by the person to review requests
for such information, in accordance with written
standards for confidentiality that specify permissible
and impermissible uses of such information for
health research;
(3) the person enters into a written agreement
with the health researcher that is consistent with
this Act and specifies the permissible and impermis-
sible future uses and disclosures of the information;
(4) the person provides notice to the health re-
searcher that any future use or disclosure of the in-
formation that is prohibited under this Act or the
agreement described in paragraph (3) may provide a
basis for a civil action against the researcher or may
result in other adverse consequences for the re-
searcher; and
(5) the person maintains a permanent record
documenting the scope and substance of the disclo-
sure.
(b) PERSONS DESCRIBED.—A person described in
this subsection is any of the following:
(1) A health care provider.
(2) A health plan.
(3) A public health authority.
(4) An employer.
(5) A health or life insurer.
(6) A school or university.
TITLE II—INDIVIDUALS’ RIGHTS
SEC. 201. INSPECTION AND COPYING OF HEALTH INFORMA-
TION.
(a) IN GENERAL.—Subject to subsections (b) and (c),
a person who is a health care provider, health plan, em-
ployer, health or life insurer, school, or university shall
permit an individual who is the subject of individually
identifiable health information, or the individual’s des-
ignee, to inspect and copy individually identifiable health
information concerning the individual, including records
created under section 202, that the person maintains. The
person may set forth appropriate procedures to be followed
for such inspection and copying and may require an indi-
vidual to pay reasonable fees associated with such inspec-
tion and copying and may require an individual to provide
written authorization of a provider designated by such in-
dividual through which the requested information will be
made available.
(b) EFFECT OF OTHER LAW.—
(1) 
DISCLOSURE
PROHIBITED
BY
OTHER
LAW.—A person described in subsection (a) may not
permit the inspection or copying of individually iden-
tifiable health information under such subsection, if
such inspection or copying is prohibited by any pro-
vision of law other than this Act.
(2) DISCLOSURE LIMITED BY OTHER LAW.—A
person described in subsection (a) shall limit the in-
spection or copying of individually identifiable health
information under such subsection to the extent re-
quired by, and consistent with, any limitation on
such inspection or copying in any provision of law
other than this Act that is applicable to the person.
(c) ADDITIONAL EXCEPTIONS.—A person described
in subsection (a) is not required to permit the inspection
or copying of individually identifiable health information
if any of the following exceptions apply:
(1) ENDANGERMENT
TO
LIFE
OR
SAFETY.—
The person determines that the disclosure of the in-
formation could reasonably be expected to endanger
the life or physical safety of any individual.
(2) CONFIDENTIAL SOURCE.—The information
identifies, or could reasonably lead to the identifica-
tion of, a person who provided information under a
promise of confidentiality to a health care provider
or life insurer concerning the individual who is the
subject of the information.
(3) INFORMATION COMPILED IN ANTICIPATION
OF LITIGATION.—The information is compiled prin-
cipally—
(A) in the anticipation of a civil, criminal,
or administrative action or proceeding; or
(B) for use in such action or proceeding.
(4) RESEARCH
PURPOSES.—The information
was collected for or during a clinical trial monitored
by an institutional review board in which the individ-
ual was a participant.
(d) DENIAL OF A REQUEST FOR INSPECTION OR
COPYING.—If a person described in subsection (a) denies
an individual’s request for inspection or copying pursuant
to subsection (b) or (c), the person shall inform the indi-
vidual of—
(1) the reasons for the denial of the request for
inspection or copying;
(2) any procedures for further review of the de-
nial; and
(3) the individual’s right to file with the person
a concise statement setting forth the request for in-
spection or copying.
(e) STATEMENT REGARDING REQUEST.—If an indi-
vidual has filed a statement under subsection (d)(3), the
person, in any subsequent disclosure of the portion of the
information requested under subsection (a), shall in-
clude—
(1) a notation that such individual has filed a
request for inspection and that such request was de-
nied; and
(2) a concise statement of the reasons for deny-
ing the request for inspection or copying.
(f) DEADLINE.—A person described in subsection (a)
shall comply with or deny, in accordance with subsection
(d), a request for inspection or copying of individually
identifiable health information under this section not later
than 45 days after the date on which the person receives
the request.
(g) RULES GOVERNING AGENTS.—An agent of a per-
son described in subsection (a) shall not be required to
provide for the inspection and copying of individually iden-
tifiable health information, except where—
(1) the individually identifiable health informa-
tion is retained by the agent; and
(2) the agent has been asked by the person to
fulfill the requirements of this section.
(h) RULE OF CONSTRUCTION.—This section shall not
be construed to require a person described in subsection
(a) to conduct a formal, informal, or other hearing or pro-
ceeding concerning a request for inspection or copying of
individually identifiable health information.
SEC. 202. AMENDMENT OF INDIVIDUALLY IDENTIFIABLE
HEALTH INFORMATION.
(a) IN GENERAL.—Not later than 45 days after the
date on which a person who is a health care provider,
health plan, employer, health or life insurer, school, or uni-
versity receives from an individual who is a subject of indi-
vidually identifiable health information a request in writ-
ing to amend the information, the person—
(1) shall make the amendment requested;
(2) shall inform the individual of the amend-
ment that has been made; and
(3) shall make reasonable efforts to inform any
person who is identified by the individual, who is not
an officer, employer, or agent of the entity, and to
whom the unamended portion of the information was
disclosed during the preceding year, of any nontech-
nical amendment that has been made.
(b) REFUSAL TO AMEND.—If a person described in
subsection (a) refuses to make an amendment requested
by an individual under such subsection, the person shall
inform the individual of—
(1) the reasons for the refusal to make the
amendment;
(2) any procedures for further review of the re-
fusal; and
(3) the individual’s right to file with the person
a concise statement setting forth the requested
amendment and the individual’s reasons for dis-
agreeing with the refusal.
(c) STATEMENT OF DISAGREEMENT.—If an individ-
ual has filed a statement of disagreement with a person
under subsection (b)(3), the person, in any subsequent dis-
closure of the disputed portion of the information—
(1) shall include a notation that such individual
has filed a statement of disagreement; and
(2) may include a concise statement of the rea-
sons for not making the requested amendment.
(d) RULES GOVERNING AGENTS.—The agent of a
person described in subsection (a) shall not be required
to make amendments to individually identifiable health in-
formation, except where—
(1) the information is retained by the agent;
and
(2) the agent has been asked by such person to
fulfill the requirements of this section.
(e) REPEATED REQUESTS FOR AMENDMENTS.—If a
person described in subsection (a) receives a duplicative
request for an amendment of information as provided for
in such subsection and a statement of disagreement with
respect to the request has been filed pursuant to sub-
section (c), the person shall inform the individual of such
filing and shall not be required to carry out the procedures
required under this section.
(f) RULE OF CONSTRUCTION.—This section shall not
be construed—
(1) to require a person described in subsection
(a) to conduct a formal, informal, or other hearing
or proceeding concerning a request for an amend-
ment to individually identifiable health information;
(2) to require a person described in subsection
(a) to make an amendment with which the person
disagrees; or
(3) to require the alteration of any arrange-
ment, written agreement, or obligation with respect
to the delivery of, or payment for, health care.
SEC. 203. NOTICE OF CONFIDENTIALITY PRACTICES.
(a) PREPARATION OF WRITTEN NOTICE.—A health
care provider, health plan, health oversight agency, public
health authority, employer, health or life insurer, health
researcher, school, or university shall post or provide, in
writing and in a clear and conspicuous manner, notice of
the person’s confidentiality practices, that shall include—
(1) a description of an individual’s rights with
respect to individually identifiable health informa-
tion;
(2) the uses and disclosures of individually
identifiable health information authorized under this
Act;
(3) the procedures established by the person for
authorizing disclosures of individually identifiable
health information and for revoking such authoriza-
tions;
(4) the procedures established by the person for
the exercise of the individual’s rights; and
(5) the procedures established by the person for
providing copies of the notice.
(b) MODEL NOTICE.—The Secretary, after notice
and opportunity for public comment, shall develop and dis-
seminate model notices of confidentiality practices, for use
under this section. Use of the model notice developed by
the Secretary shall serve as a complete defense in any civil
action to an allegation that a violation of this section has
occurred.
TITLE III—ENFORCEMENT
SEC. 301. CRIMINAL PENALTIES.
(a) OFFENSE.—A person who knowingly and in viola-
tion of this Act obtains individually identifiable health in-
formation, uses such information, or discloses such infor-
mation to another person, knowing that such obtaining,