(B) notice would risk destruction or un-
availability of the evidence.
(d) OBLIGATIONS OF RECIPIENT.—A person seeking
protected health information pursuant to subsection
(a)(1)—
(1) shall notify the individual or the individual’s
attorney of the request for the information;
(2) shall provide the health care provider,
health plan, health oversight agency, employer, in-
surer, health or life insurer, school or university,
agent, or other person involved with a signed docu-
ment attesting—
(A) that the individual has placed his or
her physical or mental condition at issue in liti-
gation or proceedings in which the individual is
a party; and
(B) the date on which the individual or the
individual’s attorney was notified under para-
graph (1); and
(3) shall not accept any requested protected
health information from the health care provider,
health plan, health oversight agency, employer, in-
surer, health or life insurer, school or university,
agent, or person until the termination of the 10-day
period beginning on the date notice was given under
paragraph (1).
SEC. 212. INDIVIDUAL REPRESENTATIVES.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law (based on
grounds other than an individual’s status as a minor), or
by an instrument recognized under law, to act as an agent,
attorney, proxy, or other legal representative of a individ-
ual, may, to the extent so authorized, exercise and dis-
charge the rights of the individual under this Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is authorized by law (based on grounds other than
being a minor), or by an instrument recognized under law,
to make decisions about the provision of health care to
an individual who is incapacitated, may exercise and dis-
charge the rights of the individual under this Act to the
extent necessary to effectuate the terms or purposes of
the grant of authority.
(c) NO COURT DECLARATION.—If a physician or
other health care provider determines that an individual,
who has not been declared to be legally incompetent, suf-
fers from a medical condition that prevents the individual
from acting knowingly or effectively on the individual’s
own behalf, the right of the individual to authorize disclo-
sure under this Act may be exercised and discharged in
the best interest of the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or (3) cannot be
contacted after a reasonable effort.
(d) RIGHTS OF MINORS.—
(1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA-
PABLE.—In the case of an individual—
(A) who is 18 years of age or older, all
rights of the individual under this Act shall be
exercised by the individual; or
(B) who, acting alone, can obtain a type of
health care without violating any applicable law,
and who has sought such care, the individual
shall exercise all rights of an individual under
this Act with respect to protected health infor-
mation relating to such health care.
(2) INDIVIDUALS UNDER 18.—Except as pro-
vided in paragraph (1)(B), in the case of an individ-
ual who is—
(A) under 14 years of age, all of the indi-
vidual’s rights under this Act shall be exercised
through the parent or legal guardian; or
(B) 14 through 17 years of age, the rights
of inspection and supplementation, and the
right to authorize use and disclosure of pro-
tected health information of the individual shall
be exercised by the individual, or by the parent
or legal guardian of the individual.
(e) DECEASED INDIVIDUALS.—
(1) APPLICATION OF ACT.—The provisions of
this Act shall continue to apply to protected health
information concerning a deceased individual.
(2) EXERCISE OF RIGHTS ON BEHALF OF A DE-
CEASED INDIVIDUAL.—A person who is authorized
by law or by an instrument recognized under law, to
act as an executor of the estate of a deceased indi-
vidual, or otherwise to exercise the rights of the de-
ceased individual, may, to the extent so authorized,
exercise and discharge the rights of such deceased
individual under this Act. If no such designee has
been authorized, the rights of the deceased individ-
ual may be exercised as provided for in subsection
(c).
(3) IDENTIFICATION
OF
DECEASED
INDIVID-
UAL.—A person described in section 209(a) may dis-
close protected health information if such disclosure
is necessary to assist in the identification of a de-
ceased individual.
SEC. 213. PROHIBITION AGAINST RETALIATION.
A health care provider, health researcher, health
plan, health oversight agency, employer, health or life in-
surer, school or university, person acting as an agent of
any such person, or person who receives protected health
information under section 204 may not adversely affect
another person, directly or indirectly, because such person
has exercised a right under this Act, disclosed information
relating to a possible violation of this Act, or associated
with, or assisted, a person in the exercise of a right under
this Act.
TITLE III—OFFICE OF HEALTH
INFORMATION 
PRIVACY 
OF
THE 
DEPARTMENT 
OF
HEALTH AND HUMAN SERV-
ICES
Subtitle A—Designation
SEC. 301. DESIGNATION.
(a) IN GENERAL.—The Secretary shall designate an
office within the Department of Health and Human Serv-
ices to be known as the Office of Health Information Pri-
vacy. The Office shall be headed by a Director, who shall
be appointed by the Secretary.
(b) DUTIES.—The Director of the Office of Health
Information Privacy shall—
(1) receive and investigate complaints of alleged
violations of this Act;
(2) provide for the conduct of audits where ap-
propriate;
(3) provide guidance to the Secretary in the im-
plementation of this Act;
(4) prepare and submit the report described in
subsection (c);
(5) consult with, and provide recommendation
to, the Secretary concerning improvements in the
privacy and security of protected health information
and concerning medical privacy research needs; and
(6) carry out any other activities determined
appropriate by the Secretary.
(c) REPORT ON COMPLIANCE.—Not later than Janu-
ary 1 of the first calendar year beginning more than 1
year after the establishment of the Office under subsection
(a), and every January 1 thereafter, the Director of the
Office of Health Information Privacy shall prepare and
submit to Congress a report concerning the number of
complaints of alleged violations of this Act that are re-
ceived during the year for which the report is being pre-
pared. Such report shall describe the complaints and any
remedial action taken concerning such complaints.
Subtitle B—Enforcement
CHAPTER 1—CRIMINAL PROVISIONS
SEC. 
311. 
WRONGFUL 
DISCLOSURE 
OF 
PROTECTED
HEALTH INFORMATION.
(a) IN GENERAL.—Part I of title 18, United States
Code, is amended by adding at the end the following:
‘‘CHAPTER 124—WRONGFUL DISCLOSURE
OF PROTECTED HEALTH INFORMATION
‘‘Sec.
‘‘2801. Wrongful disclosure of protected health information.
‘‘§ 2801. Wrongful disclosure of protected health in-
formation
‘‘(a) OFFENSE.—The penalties described in sub-
section (b) shall apply to a person that knowingly and
intentionally—
‘‘(1) obtains or attempts to obtain protected
health information relating to an individual in viola-
tion of title II of the Medical Information Privacy
and Security Act; or
‘‘(2) discloses or attempts to disclose protected
health information to another person in violation of
title II of the Medical Information Privacy and Se-
curity Act.
‘‘(b) PENALTIES.—A person described in subsection
(a) shall—
‘‘(1) be fined not more than $50,000, impris-
oned not more than 1 year, or both;
‘‘(2) if the offense is committed under false pre-
tenses, be fined not more than $250,000, imprisoned
not more than 5 years, or any combination of such
penalties; or
‘‘(3) if the offense is committed with the intent
to sell, transfer, or use protected health information
for commercial advantage, personal gain, or mali-
cious harm, be fined not more than $500,000, im-
prisoned not more than 10 years, excluded from par-
ticipation in any Federally funded health care pro-
grams, or any combination of such penalties.
‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per-
son described in subsection (a), the maximum penalties
described in subsection (b) shall be doubled for every sub-
sequent conviction for an offense arising out of a violation
or violations related to a set of circumstances that are dif-
ferent from those involved in the previous violation or set
of related violations described in such subsection (a).’’.
(b) CLERICAL AMENDMENT.—The table of chapters
for part I of title 18, United States Code, is amended by
inserting after the item relating to chapter 123 the follow-
ing new item:
‘‘124. Wrongful disclosure of protected health information ..................... 2801’’.
SEC. 312. DEBARMENT FOR CRIMES.
(a) PURPOSE.—The purpose of this section is to pro-
mote the prevention and deterrence of instances of inten-
tional criminal actions which violate criminal laws which
are designed to protect the privacy of protected health in-
formation in a manner consistent with this Act.
(b) DEBARMENT.—Not later than 270 days after the
date of enactment of this Act, the Attorney General, in
consultation with the Secretary, shall promulgate regula-
tions and establish procedures to permit the debarment
of health care providers, health researchers, health or life
insurers, employers, or schools or universities from receiv-
ing benefits under any Federal health programs or other
Federal procurement program if the managers or officers
of such persons are found guilty of violating section 2801
of title 18, United States Code, have civil penalties im-
posed against such officers or managers under section 321
in connection with the illegal disclosure of protected health
information, or are found guilty of making a false state-
ment or obstructing justice related to attempting to con-
ceal or concealing such illegal disclosure. Such regulations
shall take into account the need for continuity of medical
care and may provide for a delay of any debarment im-
posed under this section to take into account the medical
needs of patients.
(c) CONSULTATION.—Before publishing a proposed
rule to implement subsection (b), the Attorney General
shall consult with State law enforcement officials, health
care providers, patient privacy rights’ advocates, and other
appropriate persons, to gain additional information re-
garding the debarment of entities under subsection (b)
and the best methods to ensure the continuity of medical
care.
(d) REPORT.—The Attorney General shall annually
prepare and submit to the Committee on the Judiciary of
the House of Representatives and the Committee on the
Judiciary of the Senate a report concerning the activities
and debarment actions taken by the Attorney General
under this section.
(e) ASSISTANCE TO PREVENT CRIMINAL VIOLA-
TIONS.—The Attorney General, in cooperation with any
other appropriate individual, organization, or agency, may
provide advice, training, technical assistance, and guid-
ance regarding ways to reduce the incidence of improper
disclosure of protected health information.
(f) RELATIONSHIP TO OTHER AUTHORITIES.—A de-
barment imposed under this section shall not reduce or
diminish the authority of a Federal, State, or local govern-
mental agency or court to penalize, imprison, fine, sus-
pend, debar, or take other adverse action against a person,
in a civil, criminal, or administrative proceeding.
CHAPTER 2—CIVIL SANCTIONS
SEC. 321. CIVIL PENALTY.
(a) VIOLATION.—A health care provider, health re-
searcher, health plan, health oversight agency, public
health agency, law enforcement agency, employer, health
or life insurer, school, or university, or a person acting
as the agent of any such person, who the Secretary, in
consultation with the Attorney General, determines has
substantially and materially failed to comply with this Act
shall be subject, in addition to any other penalties that
may be prescribed by law—
(1) in a case in which the violation relates to
title I, to a civil penalty of not more than $500 for
each such violation, but not to exceed $5000 in the
aggregate for multiple violations;
(2) in a case in which the violation relates to
title II, to a civil penalty of not more than $10,000
for each such violation, but not to exceed $50,000
in the aggregate for multiple violations; or
(3) in a case in which the Secretary finds that
such violations have occurred with such frequency as
to constitute a general business practice, to a civil
penalty of not more than $100,000.
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.—
Section 1128A of the Social Security Act (42 U.S.C.
1320a–7a), other than subsections (a) and (b) and the
second sentence of subsection (f) of that section, shall
apply to the imposition of a civil, monetary, or exclusion-
ary penalty under this section in the same manner as such
provisions apply with respect to the imposition of a penalty
under section 1128A of such Act.
SEC. 322. PROCEDURES FOR IMPOSITION OF PENALTIES.
(a) INITIATION OF PROCEEDINGS.—
(1) IN GENERAL.—The Secretary, in consulta-
tion with the Attorney General, may initiate a pro-
ceeding to determine whether to impose a civil