I
105TH CONGRESS
1ST SESSION
H. R. 1815
To protect the privacy of health information in the age of genetic and
other new technologies, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JUNE 5, 1997
Mr. MCDERMOTT (for himself, Mr. NADLER, Mr. DELLUMS, Ms. LOFGREN,
Mr. RUSH, Mr. BARRETT of Wisconsin, Mrs. MINK of Hawaii, Mr.
FROST, Mr. MILLER of California, and Mr. TORRES) introduced the fol-
lowing bill; which was referred to the Committee on Commerce, and in
addition to the Committee on Government Reform and Oversight, for a
period to be subsequently determined by the Speaker, in each case for
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned
A BILL
To protect the privacy of health information in the age
of genetic and other new technologies, and for other
purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Medical Privacy in the Age of New Technologies Act of
1997’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Definitions.
TITLE I—INDIVIDUALS’ RIGHTS
Subtitle A—Review of Protected Health Information by Subjects of the
Information
Sec. 101. Inspection and copying of protected health information.
Sec. 102. Correction or amendment of protected health information.
Sec. 103. Notice of information practices.
Subtitle B—Establishment of Safeguards
Sec. 111. Establishment of safeguards.
Sec. 112. Accounting for disclosures.
Sec. 113. Prohibition against retaliation.
TITLE II—RESTRICTIONS ON USE AND DISCLOSURE
Sec. 201. General rules regarding use and disclosure.
Sec. 202. Authorizations for disclosure of protected health information for
treatment or payment.
Sec. 203. Authorizations for disclosure of protected health information for pur-
poses other than treatment or payment.
Sec. 204. Creation of nonidentifiable and coded information.
Sec. 205. Next of kin and directory information.
Sec. 206. Emergency circumstances.
Sec. 207. Oversight.
Sec. 208. Accreditation.
Sec. 209. Public health.
Sec. 210. Health research.
Sec. 211. Judicial and administrative purposes.
Sec. 212. General requirements governing subpoenas.
Sec. 213. Additional requirements for law enforcement access.
TITLE III—SANCTIONS
Subtitle A—Civil Sanctions
Sec. 301. Civil penalty.
Sec. 302. Civil action.
Subtitle B—Criminal Sanctions
Sec. 311. Wrongful disclosure of protected health information.
TITLE IV—MISCELLANEOUS
Sec. 401. Regulations.
Sec. 402. Relationship to other laws.
Sec. 403. Effective dates.
Sec. 404. Applicability.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds as follows:
(1) Health information plays a vital role in
every aspect of an individual’s life. It includes some
of the most sensitive information available about an
individual.
(2) An individual’s health information is cur-
rently accessible to many people who do not need the
information to provide health care to the individual,
often without the individual’s knowledge or consent.
(3) Individuals will be deterred from using the
health care system unless they are assured that the
confidentiality of their health information will be
respected.
(4) There exists little Federal protection of the
confidentiality of an individual’s health information.
(5) While health information often is trans-
ferred across State lines, protection of the confiden-
tiality of health information varies greatly from
State to State, with little protection in some States.
(6) New technologies increase the importance of
addressing new threats to the confidentiality of
health information. For example, technologies that
permit an individual’s health information to be com-
puterized increase the possibility of unauthorized
electronic access to the information. Technologies
that provide genetic information provide information
not just about an individual’s current health but also
about the individual’s potential future health and the
health of the individual’s relatives. This creates po-
tential new uses and abuses of genetic health infor-
mation that need to be addressed by legislation.
(7) The potential benefits from new genetic
technologies will not be realized if individuals cannot
trust that their health information is safe from un-
authorized uses.
(b) PURPOSES.—The purposes of this Act are as fol-
lows:
(1) To recognize that there is a right to privacy
with respect to health information, including genetic
information, and that this right must be protected
accordingly.
(2) To ensure that an individual’s interest in
the privacy of their health information cannot be
overridden without meaningful notice and informed
consent, except in limited circumstances where there
is a compelling public interest.
(3) To provide individuals—
(A) access to health information of which
they are the subject; and
(B) the power to challenge the accuracy
and completeness of, and amend or correct,
records containing such information.
(4) To establish a minimum Federal standard
for the protection of health information which will
promote confidentiality while allowing efficient
transfer of health information between States.
(5) To help ensure the confidentiality of com-
puterized or electronically transferred health infor-
mation.
(6) To restrict the gathering of aggregate
health information for financial gain or other pur-
poses without each subject’s knowledge or consent.
(7) To establish strong and effective remedies
for violations of this Act.
SEC. 3. DEFINITIONS.
As used in this Act:
(1) ACCREDITING BODY.—The term ‘‘accredit-
ing body’’ means a body, committee, organization, or
institution that has been authorized by law, or is
recognized by a health care regulating authority,
with 
respect 
to 
accreditation, 
licensing, 
or
credentialing of health care providers or health care
facilities.
(2) CODED HEALTH INFORMATION.—The term
‘‘coded health information’’ means any protected
health information—
(A) in which all identifying information
has been replaced by a unique identifier, and
where neither the remaining information nor
the unique identifier, on its face, identifies an
individual;
(B) which cannot easily be used or manip-
ulated in a manner that reveals the identity of
an individual; and
(C) which can only be linked or matched to
other information in a manner that reveals the
identity of an individual by a person authorized
to carry out such functions under section 204.
(3) DISCLOSE.—The term ‘‘disclose’’ when used
with respect to protected health information that is
held by a health information trustee, means to re-
lease, transfer, provide access to, or otherwise di-
vulge the information to any person other than an
individual who is the subject of the information.
Such term includes the placement of protected
health information into a computerized data base,
networked computer system, or any other electronic
or magnetic data system, that more than one person
may access by any means. Such term does not in-
clude oral communication between an individual who
is the subject of protected health information and a
health care provider delivering health care to such
individual.
(4) ELECTRONIC.—The term ‘‘electronic’’, when
used with reference to information, means—
(A) in electronic or magnetic form;
(B) in an optical storage form;
(C) computer-based;
(D) computer-associated; or
(E) in some other form that—
(i) is appropriate for non-paper-based
information processing or storage; and
(ii) exists on the date of the enact-
ment of this Act or is developed subse-
quent to such date.
(5) HEALTH CARE.—The term ‘‘health care’’
means—
(A) any sale or dispensing of a drug, de-
vice, equipment, or other item to an individual,
or for the use of an individual, pursuant to a
prescription; and
(B) any preventive, predictive, diagnostic,
therapeutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or procedure—
(i) with respect to the physical or
mental condition of an individual; or
(ii) affecting the structure or function
of the human body or any part of the
human body, including individual cells and
their components.
(6) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who, with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses
the information while acting in whole or in part in
the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by law to pro-
vide an item or service that constitutes health
care, in the ordinary course of business or prac-
tice of a profession; or
(B) a Federal or State program that di-
rectly provides items or services that constitute
health care to beneficiaries.
(7) HEALTH
INFORMATION
TRUSTEE.—The
term ‘‘health information trustee’’ means—
(A) a person who is a health care provider,
health plan, health oversight agency, public
health authority, health researcher, employer,
insurer, school, institution of higher education,
or insurance support organization, insofar as
the person creates, receives, obtains, maintains,
uses, or transmits protected health information;
or
(B) any employee, agent, or contractor of
a person described in subparagraph (A), insofar
as the employee, agent, or contractor creates,
receives, obtains, maintains, uses, or transmits
protected health information.
(8) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who—
(A) performs or oversees the performance
of an assessment, investigation, or prosecution
relating to—
(i) compliance with legal or fiscal
standards pertinent to health care fraud,
including 
fraudulent 
claims 
regarding
health care, health services or equipment,
or related activities and items; or
(ii) the protection of individuals from
harm, abuse, neglect, or exploitation; and
(B) is a public agency, acting on behalf of
a public agency, acting pursuant to a require-
ment of a public agency, or carrying out activi-
ties under a Federal or State law governing an
assessment, investigation, or prosecution de-
scribed in subparagraph (A).
(9) HEALTH PLAN.—The term ‘‘health plan’’
means any health insurance plan, including any hos-
pital or medical service plan, dental or other health
service plan or health maintenance organization
plan, or other program providing payment for health
care, whether or not funded through the purchase of
insurance.
(10) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who conducts, using
protected health information, a systematic investiga-
tion, or research development, testing, or evaluation,
to develop or contribute to scientific or medical
knowledge.
(11) INDIVIDUAL REPRESENTATIVE.—The term
‘‘individual representative’’ means any individual le-
gally empowered to make decisions concerning the
provision of health care to an individual (where the
individual lacks the legal capacity under State law to
make such decisions) or the administrator or execu-
tor of the estate of a deceased individual.
(12) INSURANCE SUPPORT ORGANIZATION.—
(A) IN
GENERAL.—Subject to subpara-
graph (B), the term ‘‘insurance support organi-
zation’’ means any person who regularly en-
gages, in whole or in part, in the practice of as-
sembling and providing information about indi-
viduals to an insurer or health plan for insur-
ance transactions, including—
(i) the furnishing of consumer reports
or investigative consumer reports to an in-
surer or health plan for use in connection
with an insurance transaction; or
(ii) the collection of personal informa-
tion from insurers, health plans, or other
insurance support organizations for the
purpose of detecting or preventing fraud or
material misrepresentation in connection
with insurance underwriting or insurance
claim activity.
(B) PERSONS
EXCLUDED.—Such term
does not include any person who is treated as
a health information trustee under any other
provision of this Act.
(13) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means an official law en-
forcement investigation or proceeding inquiring into
a violation of, or failure to comply with, any law.
(14) NONIDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘nonidentifiable health informa-
tion’’ means information that would be protected
health information, except that—
(A) it is impossible to ascertain, based on
the information, or on any codes or identifiers
related to the information, the identity of any
individual whose health or condition is the sub-
ject of the information; and
(B) it cannot be linked or matched by a
foreseeable method to any other information
that pertains to any such individual.
(15) PERSON.—The term ‘‘person’’ means any
of the following:
(A) An individual.
(B) A government.
(C) A governmental subdivision, agency or
authority.
(D) A corporation.
(E) A company.
(F) An association.
(G) A firm.
(H) A partnership.
(I) A society.
(J) An estate.
(K) A trust.
(L) A joint venture.
(M) An individual representative.
(N) Any other legal entity.
(16) PROTECTED HEALTH INFORMATION.—The
term ‘‘protected health information’’ means any in-
formation, including information derived from a bio-
logical sample from the human body and demo-
graphic information about an individual, whether
oral or recorded in any form or medium, that—
(A) is created or received by a health infor-
mation trustee or an accrediting body;
(B) relates to—
(i) the past, present, or future phys-
ical or mental health, predisposition, or
condition of an individual, or individuals
related by blood to the individual;
(ii) the provision of health care to an
individual; or
(iii) the past, present, or future pay-
ment for the provision of health care to an
individual; and
(C)(i) identifies such individual;
(ii) with respect to which there is a reason-
able basis to believe that the information can be
used to identify such individual; or
(iii) could be linked or matched by a fore-
seeable method to any other information which
pertains to such individual.
(17) 
PROTECTED
HEALTH
INFORMATION
SUBFILE.—The term ‘‘protected health information
subfile’’ means any amount of protected health in-
formation which is segregated pursuant to section
201(c).
(18) PUBLIC HEALTH AUTHORITY.—The term
‘‘public health authority’’ means an authority or in-
strumentality of the United States, a State, or a po-
litical subdivision of a State that—
(A) is charged by statute with responsibil-
ity for public health matters; and
(B) is engaged in such activities as injury
reporting, public health surveillance, and public
health investigation or intervention.
(19) 
SECRETARY.—The 
term 
‘‘Secretary’’
means the Secretary of Health and Human Services.
(20) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
(21) WRITING.—The term ‘‘writing’’ means
writing in either a paper-based or electronic form.
TITLE I—INDIVIDUALS’ RIGHTS
Subtitle A—Review of Protected
Health Information by Subjects
of the Information
SEC. 101. INSPECTION AND COPYING OF PROTECTED
HEALTH INFORMATION.
(a) IN GENERAL.—Except as provided in subsections
(b) and (h), a health information trustee shall permit an
individual who is the subject of protected health informa-
tion, or the individual’s designee, to inspect and copy pro-
tected health information concerning the individual, in-
cluding records created under section 102, that the trustee
maintains. A health information trustee may require an
individual to reimburse the trustee for the reasonable cost
of such inspection and copying.
(b) EXCEPTION.—
(1) IN GENERAL.—A health care provider who
is delivering, or has delivered, health care to an indi-
vidual who is the subject of protected health infor-
mation relating to such health care is not required
by this section to permit inspection or copying of the
information, where such inspection or copying rea-
sonably could be expected to endanger the life or
physical or mental safety of any individual.
(2) ALTERNATIVE DISCLOSURE.—In any case
where a health care provider determines that the
provider, pursuant to paragraph (1), will not permit
an individual to inspect or copy protected health in-
formation, the provider may permit inspection or
copying by the individual’s designee.
(c) DENIAL OF A REQUEST FOR INSPECTION OR
COPYING.—If a health information trustee denies a re-
quest for inspection or copying under subsection (b), the
trustee shall inform the individual in writing of—
(1) the reasons for the denial of the request;
(2) any procedures for further review of the de-
nial; and
(3) the individual’s right to file with the trust-
ee, if the individual so wishes, a concise statement
setting forth the request for inspection or copying.
(d) STATEMENT REGARDING REQUEST.—If an indi-
vidual has filed a statement under subsection (c)(3) set-
ting forth the request, the health information trustee in
any subsequent disclosure of the portion of the informa-
tion requested shall include—
(1) a copy of the individual’s statement; and
(2) a concise statement of the reasons for deny-
ing the request for inspection or copying.
(e) RULE OF CONSTRUCTION.—This section shall not
be construed to require a health information trustee to
conduct a formal, informal, or other hearing or proceeding
concerning a request for inspection or copying of protected
health information.
(f) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee shall permit inspec-
tion and copying under subsection (a) of any reasonably
segregable portion of a record after deletion of any portion
that is exempt under subsection (b).
(g) DEADLINE.—A health information trustee shall
comply with or deny, in accordance with subsection (c),
a request for inspection or copying of protected health in-
formation under this section within the 30-day period be-
ginning on the date on which the trustee receives the re-
quest.
(h) RULES GOVERNING AGENTS
AND CONTRAC-
TORS.—
(1) IN GENERAL.—A person acting in the ca-
pacity of an agent or contractor of a health care
provider, health plan, health oversight agency, public
health authority, health researcher, employer, in-
surer, school, institution of higher education, or in-
surance support organization is not responsible for
providing for the inspection or copying of protected
health information under this section, except when
the agent or contractor has been notified by their
principal that a request for inspection or copying
has been made to the principal under section (a) and
has not been denied under section (b).
(2) CODED
HEALTH
INFORMATION.—In any
case where a person acting in the capacity of an
agent or contractor of a health care provider, health
plan, health oversight agency, public health author-
ity, health researcher, employer, insurer, school, in-
stitution of higher education, or insurance support
organization is requested to provide for the inspec-
tion or copying of coded health information under
this section, the person shall inform the individual
making the request that the individual should con-
tact a person authorized under section 204 to link
or match the coded health information to reveal the
identity of the individual who is the subject of the
information.
SEC. 102. CORRECTION OR AMENDMENT OF PROTECTED
HEALTH INFORMATION.
(a) IN GENERAL.—Unless proceeding under sub-
section (b), and except as provided in subsection (f), a
health information trustee, within the 45-day period be-
ginning on the date on which the trustee receives from
an individual a written request to correct or amend pro-
tected health information about the individual—
(1) shall make the correction or amendment re-
quested;
(2) shall inform the individual of the correction
or amendment that has been made; and
(3) shall make reasonable efforts to inform any
person who is identified by the individual, and to
whom the uncorrected or unamended portion of the
information was previously disclosed, of the correc-
tion or amendment that has been made.
(b) REFUSAL TO CORRECT
OR AMEND.—If the
health information trustee refuses to make the correction
or amendment, the trustee shall inform the individual,
within the 45-day period beginning on the date on which
the trustee receives the individual’s request, of—