264
or relating to an individual’s access to protected health
information or health care services. Nothing in this part
shall be construed to preempt, modify, or repeal a provi-
sion of Federal law to the extent that such provision re-
lates to a privilege of a witness or other person in a court
of the United States.
‘‘CIVIL PENALTIES
‘‘SEC. 1187. (a) VIOLATION.—A person who the Sec-
retary determines has substantially and materially failed
to comply with this part shall be subject, in addition to
any other penalties that may be prescribed by law—
‘‘(1) in a case in which the violation relates to
section 1181 or 1182, to a civil penalty of not more
than $500 for each such violation but not to exceed
$5,000 in the aggregate for all violations of an iden-
tical requirement or prohibition during a calendar
year;
‘‘(2) in the case in which the violation relates
to section 1183, 1184, or 1185(c), to a civil penalty
of not more than $10,000 for each such violation,
but not to exceed $50,000 in the aggregate for all
violations of an identical requirement or prohibition
during a calendar year; or
‘‘(3) in a case in which the Secretary finds that
such violations have occurred with such frequency as
265
to constitute a general business practice, to a civil
penalty of not more than $100,000.
‘‘(b) PROCEDURES
FOR
IMPOSITION
OF
PEN-
ALTIES.—Section 1128A, other than subsections (a) and
(b) and the second sentence of subsection (f) of that sec-
tion, shall apply to the imposition of a civil or monetary
penalty under this section in the same manner as such
provisions apply with respect to the imposition of a penalty
under section 1128A.
‘‘DEFINITIONS
‘‘SEC. 1188. As used in this part:
‘‘(1) AGENT.—The term ‘agent’ means a per-
son, including a contractor, who represents and acts
for another under the contract or relation of agency,
or whose function is to bring about, modify, affect,
accept performance of, or terminate contractual obli-
gations between the principal and a third person.
‘‘(2) CONDITION-SPECIFIC LIMITATIONS ON DIS-
CLOSURE.—The term ‘condition-specific limitations
on disclosure’ means State laws that prohibit the
disclosure of protected health information relating to
a health condition or disease that has been identified
by the Secretary as posing a public health threat.
‘‘(3) DISCLOSE.—The term ‘disclose’ means to
release, transfer, provide access to, or otherwise di-
vulge protected health information to any person
266
other than an individual who is the subject of such
information.
‘‘(4) EDUCATIONAL
INSTITUTION.—The term
‘educational institution’ means an institution or
place accredited or licensed for purposes of providing
for instruction or education, including an elementary
school, secondary school, or institution of higher
learning, a college, or an assemblage of colleges
united under one corporate organization or govern-
ment.
‘‘(5) EMPLOYER.—The term ‘employer’ has the
meaning given such term under section 3(5) of the
Employee Retirement Income Security Act of 1974
(29 U.S.C. 1002(5)), except that such term shall in-
clude only employers of two or more employees.
‘‘(6) HEALTH CARE.—The term ‘health care’
means—
‘‘(A) preventive, diagnostic, therapeutic,
rehabilitative, maintenance, or palliative care,
including appropriate assistance with disease or
symptom management and maintenance, coun-
seling, service, or procedure—
‘‘(i) with respect to the physical or
mental condition of an individual; or
267
‘‘(ii) affecting the structure or func-
tion of the human body or any part of the
human body, including the banking of
blood, sperm, organs, or any other tissue;
or
‘‘(B) any sale or dispensing, pursuant to a
prescription or medical order, of a drug, device,
equipment, or other health care-related item to
an individual, or for the use of an individual.
‘‘(7) HEALTH
CARE
OPERATIONS.—The term
‘health care operations’ means services, provided di-
rectly by or on behalf of a health plan or health care
provider or by its agent, for any of the following
purposes:
‘‘(A) Coordinating health care, including
health care management of the individual
through risk assessment, case management, and
disease management.
‘‘(B) Conducting quality assessment and
improvement activities, including outcomes eval-
uation, clinical guideline development and im-
provement, and health promotion.
‘‘(C) Carrying out utilization review activi-
ties, 
including 
precertification 
and
preauthorization of services, and health plan
268
rating activities, including underwriting and ex-
perience rating.
‘‘(D) Conducting or arranging for auditing
services.
‘‘(8) HEALTH
CARE
PROVIDER.—The term
‘health care provider’ means a person, who with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses
the information while acting in whole or in part in
the capacity of—
‘‘(A) a person who is licensed, certified,
registered, or otherwise authorized by Federal
or State law to provide an item or service that
constitutes health care in the ordinary course of
business, or practice of a profession;
‘‘(B) a Federal, State, or employer-spon-
sored or any other privately-sponsored program
that directly provides items or services that con-
stitute health care to beneficiaries; or
‘‘(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
‘‘(9) HEALTH
OR
LIFE
INSURER.—The term
‘health or life insurer’ means a health insurance
issuer, as defined in section 9832(b)(2) of the Inter-
269
nal Revenue Code of 1986, or a life insurance com-
pany, as defined in section 816 of such Code.
‘‘(10) HEALTH PLAN.—The term ‘health plan’
means any health insurance plan, including any hos-
pital or medical service plan, dental or other health
service plan, health maintenance organization plan,
plan offered by a provider-sponsored organization
(as defined in section 1855(d)), or other program
providing or arranging for the provision of health
benefits.
‘‘(11) 
HEALTH
RESEARCHER.—The 
term
‘health researcher’ means a person (or an officer,
employee, or agent of a person) who is engaged in
systematic investigation, including research develop-
ment, testing, data analysis, and evaluation, de-
signed to develop or contribute to generalizable
knowledge relating to basic biomedical processes,
health, health care, health care delivery, or health
care cost.
‘‘(12) NONIDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘nonidentifiable health information’
means protected health information from which per-
sonal identifiers that reveal the identity of the indi-
vidual who is the subject of such information or pro-
vide a direct means of identifying the individual
270
(such as name, address, and social security number)
have been removed, encrypted, or replaced with a
code, such that the identity of the individual is not
evident without (in the case of encrypted or coded
information) use of a key.
‘‘(13) 
ORIGINATING
PROVIDER.—The 
term
‘originating provider’, when used with respect to
protected health information, means the health care
provider who takes an action that initiates the treat-
ment episode to which that information relates, such
as prescribing a drug, ordering a diagnostic test, or
admitting an individual to a health care facility. A
hospital or nursing facility is the originating pro-
vider with respect to protected health information
created or received as part of inpatient or outpatient
treatment provided in the hospital or facility.
‘‘(14) PAYMENT ACTIVITIES.—The term ‘pay-
ment activities’ means—
‘‘(A) activities undertaken—
‘‘(i) by, or on behalf of, a health plan
to determine its responsibility for coverage
under the plan; or
‘‘(ii) by a health care provider to ob-
tain payment for items or services provided
to an individual, provided under a health
271
plan, or provided based on a determination
by the health plan of responsibility for cov-
erage under the plan; and
‘‘(B) includes the following activities, when
performed in a manner consistent with subpara-
graph (A):
‘‘(i) Billing, claims management, med-
ical data processing, other administrative
services, and actual payment.
‘‘(ii) Determinations of coverage or
adjudication of health benefit or subroga-
tion claims.
‘‘(iii) Review of health care services
with respect to coverage under a health
plan or justification of charges.
‘‘(15) PERSON.—The term ‘person’ means—
‘‘(A) a natural person;
‘‘(B) a government or governmental sub-
division, agency, or authority;
‘‘(C) a company, corporation, estate, firm,
trust, partnership, association, joint venture,
society, or joint stock company; or
‘‘(D) any other legal entity.
‘‘(16) PROTECTED
HEALTH
INFORMATION.—
The term ‘protected health information’, when used
272
with respect to an individual who is a subject of in-
formation means any information (including genetic
information) that identifies the individual, whether
oral or recorded in any form or medium, and that—
‘‘(A) is created or received by a health care
provider, health plan, health oversight agency,
public health authority, employer, health or life
insurer, or educational institution;
‘‘(B) relates to the past, present, or future
physical or mental health or condition of an in-
dividual (including individual cells and their
components);
‘‘(C) is derived from—
‘‘(i) the provision of health care to an
individual; or
‘‘(ii) payment for the provision of
health care to an individual; and
‘‘(D) is not nonidentifiable health informa-
tion.
‘‘(17) STATE.—The term ‘State’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
273
‘‘(18) 
TREATMENT.—The 
term 
‘treatment’
means the provision of health care by a health care
provider.
‘‘(19) WRITING.—The term ‘writing’ means
writing either in a paper-based, computer-based, or
electronic form, including electronic signatures.’’.
(b) ENFORCEMENT OF PROVISIONS THROUGH CON-
DITIONS ON PARTICIPATION.—
(1) PARTICIPATING
PHYSICIANS
AND
SUPPLI-
ERS.—Section 1842(h) of the Social Security Act
(42 U.S.C. 1395u(h)) is amended by adding at the
end the following:
‘‘(9) The Secretary may refuse to enter into an agree-
ment with a physician or supplier under this subsection,
or may terminate or refuse to renew such agreement, in
the event that such physician or supplier has been found
to have violated a provision of part D of title XI.’’.
(2) MEDICARE+CHOICE ORGANIZATIONS.—Sec-
tion 1852(h) of the Social Security Act (42 U.S.C.
1395w–22(h)) is amended—
(A) in the matter preceding paragraph (1),
by striking ‘‘procedures—’’ and inserting ‘‘pro-
cedures, consistent with sections 1181 through
1185—’’; and
274
(B) in paragraph (1), by striking ‘‘privacy
of any individually identifiable enrollee informa-
tion;’’ and inserting ‘‘confidentiality of pro-
tected health information concerning enroll-
ees;’’.
(3) 
MEDICARE
PROVIDERS.—Section
1866(a)(1) of the Social Security Act (42 U.S.C.
1395cc(a)(1)) is amended—
(A) by inserting a semicolon at the end of
subparagraph (R);
(B) by striking the period at the end of
subparagraph (S) and inserting ‘‘; and’’; and
(C) by inserting immediately after sub-
paragraph (S) the following new subparagraph:
‘‘(T) to comply with sections 1181 through
1184.’’.
(4) HEALTH
MAINTENANCE
ORGANIZATIONS
WITH
RISK-SHARING
CONTRACTS.—Section
1876(k)(4) of the Social Security Act (42 U.S.C.
1395mm(k)(4)) is amended by adding at the end the
following:
‘‘(E) The confidentiality and accuracy proce-
dure requirements under section 1852(h).’’.
(c) CONFORMING AMENDMENTS.—
275
(1) TITLE HEADING.—Title XI of the Social
Security Act (42 U.S.C. 1301 et seq.) is amended by
striking the title heading and inserting the following:
‘‘TITLE XI—GENERAL PROVISIONS, PEER RE-
VIEW, ADMINISTRATIVE SIMPLIFICATION,
AND CONFIDENTIALITY OF PROTECTED
HEALTH INFORMATION’’.
(2) NATIONAL
COMMITTEE
ON
VITAL
AND
HEALTH
STATISTICS.—Section 306(k)(5) of the
Public Health Service Act (42 U.S.C. 242(k)(5)) is
amended—
(A) in subparagraphs (A)(viii) and (D), by
striking ‘‘part C’’ and inserting ‘‘parts C and
D’’;
(B) in subparagraph (C), by striking
‘‘and’’ at the end;
(C) in subparagraph (D), by striking the
period at the end and inserting ‘‘; and’’; and
(D) by adding at the end the following:
‘‘(E) shall study the issues relating to section
1184 of the Social Security Act (as added by the Pa-
tient Protection Act of 1998), and, not later than 1
year after the date of the enactment of the Patient
Protection Act of 1999, shall report to the Congress
on such section.’’.
276
(d) EFFECTIVE DATE.—The amendments made by
this section shall take effect on the date that is 1 year
after the date of the enactment of this Act, except that
subsection (c)(2), and section 1183(b) of the Social Secu-
rity Act (as added by subsection (a)), shall take effect on
the date of the enactment of this Act.
SEC. 5002. STUDY AND REPORT ON EFFECT OF STATE LAW
ON HEALTH-RELATED RESEARCH.
Not later than 1 year after the date of the enactment
of this Act, the Comptroller General of the United States
shall prepare and submit to the Congress a report contain-
ing the results of a study on the effect of State laws on
health-related research subject to review by an institu-
tional review board or institutional review committee with
respect to the protection of human subjects.
SEC. 5003. STUDY AND REPORT ON STATE LAW ON PRO-
TECTED HEALTH INFORMATION.
(a) IN GENERAL.—Not later than 9 months after the
date of the enactment of this Act, the Comptroller General
of the United States shall prepare and submit to the Con-
gress a report containing the results of a study—
(1) compiling State laws on the confidentiality
of protected health information (as defined in sec-
tion 1188 of the Social Security Act, as added by
section 5001 of this Act); and
277
(2) analyzing the effect of such laws on the pro-
vision of health care and securing payment for such
care.
(b) 
MODIFICATION
OF
DEADLINE.—Section
264(c)(1) of the Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191; 110 Stat.
2033) is amended by striking ‘‘36 months after the date
of the enactment of this Act,’’ and inserting ‘‘6 months
after the date on which the Comptroller General of the
United States submits to the Congress a report under sec-
tion 5003(a) of the Patient Protection Act of 1999,’’.
SEC. 5004. PROTECTION FOR CERTAIN INFORMATION DE-
VELOPED TO REDUCE MORTALITY OR MOR-
BIDITY OR FOR IMPROVING PATIENT CARE
AND SAFETY.
(a) PROTECTION OF CERTAIN INFORMATION.—Not-
withstanding any other provision of Federal or State law,
health care response information shall be exempt from any
disclosure requirement (regardless of whether the require-
ment relates to subpoenas, discovery, introduction of evi-
dence, testimony, or any other form of disclosure), in con-
nection with a civil or administrative proceeding under
Federal or State law, to the same extent as information
developed by a health care provider with respect to any
of the following:
278
(1) Peer review.
(2) Utilization review.
(3) Quality management or improvement.
(4) Quality control.
(5) Risk management.
(6) Internal review for purposes of reducing
mortality, morbidity, or for improving patient care
or safety.
(b) NO WAIVER OF PROTECTION THROUGH INTER-
ACTION
WITH
ACCREDITING
BODY.—Notwithstanding
any other provision of Federal or State law, the protection
of health care response information from disclosure pro-
vided under subsection (a) shall not be deemed to be modi-
fied or in any way waived by—
(1) the development of such information in con-
nection with a request or requirement of an accredit-
ing body; or
(2) the transfer of such information to an ac-
crediting body.
(c) DEFINITIONS.—For purposes of this section:
(1) The term ‘‘accrediting body’’ means a na-
tional, not-for-profit organization that—
(A) accredits health care providers; and
279
(B) is recognized as an accrediting body by
statute or by a Federal or State agency that
regulates health care providers.
(2) The term ‘‘health care provider’’ has the
meaning given such term in section 1188 of the So-
cial Security Act (as added by section 5001 of this
Act).
(3) The term ‘‘health care response informa-
tion’’ means information (including any data, report,
record, memorandum, analysis, statement, or other
communication) developed by, or on behalf of, a
health care provider in response to a serious, ad-
verse, patient-related event—
(A) during the course of analyzing or
studying the event and its causes; and
(B) for purposes of—
(i) reducing mortality or morbidity; or
(ii) improving patient care or safety
(including the provider’s notification to an
accrediting body and the provider’s plans
of action in response to such event).
(5) The term ‘‘State’’ has the meaning given
such term in section 1188 of the Social Security Act
(as added by section 5001 of this Act).
Æ