I
106TH CONGRESS
1ST SESSION
H. R. 1057
To provide individuals with access to health information of which they are
a subject, ensure personal privacy with respect to health-care-related
information, impose criminal and civil penalties for unauthorized use
of protected health information, to provide for the strong enforcement
of these rights, and to protect States’ rights.
IN THE HOUSE OF REPRESENTATIVES
MARCH 10, 1999
Mr. MARKEY (for himself, Mr. MCDERMOTT, Mr. FROST, Ms. KAPTUR, Mr.
MOAKLEY, Ms. ROYBAL-ALLARD, Mr. NADLER, Mr. FRANK of Massachu-
setts, Mr. CROWLEY, Mr. GREEN of Texas, Mr. MCGOVERN, Mr. LU-
THER, Mr. SANDERS, Mr. MASCARA, Mr. BROWN of California, Mr. RO-
MERO-BARCELO´, Mr. DELAHUNT, Mr. DEFAZIO, Mr. CAPUANO, Mr.
STARK, Mr. STRICKLAND, and Ms. LOFGREN) introduced the following
bill; which was referred to the Committee on Commerce, and in addition
to the Committee on the Judiciary, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions
as fall within the jurisdiction of the committee concerned
A BILL
To provide individuals with access to health information of
which they are a subject, ensure personal privacy with
respect to health-care-related information, impose crimi-
nal and civil penalties for unauthorized use of protected
health information, to provide for the strong enforcement
of these rights, and to protect States’ rights.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Medical Information Privacy and Security Act’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings.
Sec. 3. Purposes.
Sec. 4. Definitions.
TITLE I—INDIVIDUALS’ RIGHTS
Subtitle A—Access to Protected Health Information by Subjects of the
Information
Sec. 101. Inspection and copying of protected health information.
Sec. 102. Supplements to protected health information.
Sec. 103. Notice of privacy practices.
Subtitle B—Establishment of Safeguards
Sec. 111. Establishment of safeguards.
Sec. 112. Accounting for disclosures.
TITLE II—RESTRICTIONS ON USE AND DISCLOSURE
Sec. 201. General rules regarding use and disclosure.
Sec. 202. Authorizations for disclosure of protected health information for
treatment and payment.
Sec. 203. Authorizations for disclosure of protected health information other
than for treatment or payment.
Sec. 204. Emergency circumstances.
Sec. 205. Public health.
Sec. 206. Protection and advocacy agencies.
Sec. 207. Oversight.
Sec. 208. Disclosure for law enforcement purposes.
Sec. 209. Next of kin and directory information.
Sec. 210. Health research.
Sec. 211. Judicial and administrative purposes.
Sec. 212. Individual representatives.
Sec. 213. Prohibition against retaliation.
TITLE III—OFFICE OF HEALTH INFORMATION PRIVACY OF THE
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Subtitle A—Designation
Sec. 301. Designation.
Subtitle B—Enforcement
CHAPTER 1—CRIMINAL PROVISIONS
Sec. 311. Wrongful disclosure of protected health information.
Sec. 312. Debarment for crimes.
CHAPTER 2—CIVIL SANCTIONS
Sec. 321. Civil penalty.
Sec. 322. Procedures for imposition of penalties.
Sec. 323. Civil action by individuals.
TITLE IV—MISCELLANEOUS
Sec. 401. Relationship to other laws.
Sec. 402. Effective date.
SEC. 2. FINDINGS.
The Congress finds as follows:
(1) Individuals have a right of privacy with re-
spect to their protected health information and
records.
(2) With respect to information about medical
care and health status, the traditional right of con-
fidentiality (between a health care provider and a
patient) is at risk.
(3) An erosion of the right of privacy may re-
duce the willingness of patients to confide in physi-
cians and other practitioners and may inhibit pa-
tients from seeking care.
(4) An individual’s privacy right means that the
individual’s consent is needed to disclose his or her
protected health information and that the individual
has a right of access to that health information.
(5) Any disclosure of protected health informa-
tion should be limited to that information or portion
of the medical record necessary to fulfill the imme-
diate and specific purpose of the disclosure.
(6) Health research often depends on access to
both identifiable and de-identified patient health in-
formation and health research is critically important
to the health and well-being of all people in the
United States.
(7) The Supreme Court found in Jaffee v.
Redmond (116 S.Ct. 1923 (1996)) that there is an
imperative need for confidence and trust between a
psychotherapist and a patient and that such trust
can only be established by an assurance of confiden-
tiality. This assurance serves the public interest by
facilitating the provision of appropriate treatment
for individuals.
(8) Section 264 of the Health Insurance Port-
ability and Accountability Act of 1996 (42 U.S.C.
1320d–2 note) establishes a deadline that Congress
enact legislation, before August 21, 1999, to protect
the privacy of protected health information.
SEC. 3. PURPOSES.
The purposes of this Act are as follows:
(1) To recognize that there is a right to privacy
with respect to health information, including genetic
information, and that this right must be protected.
(2) To create incentives to turn protected
health information into de-identified health informa-
tion, where appropriate.
(3) To designate an Office of Health Informa-
tion Privacy within the Department of Health and
Human Services to protect that right of privacy.
(4) To provide individuals with—
(A) access to health information of which
they are the subject; and
(B) the opportunity to challenge the accu-
racy and completeness of such information by
being able to file supplements to such informa-
tion.
(5) To provide individuals with the right to
limit the use and disclosure of protected health in-
formation.
(6) To establish strong and effective mecha-
nisms to protect against the unauthorized and inap-
propriate use of protected health information.
(7) To invoke the sweep of congressional pow-
ers, including the power to enforce the 14th amend-
ment, to regulate commerce, and to abrogate the im-
munity of the States under the 11th amendment, in
order to address violations of the rights of individ-
uals to privacy, to provide individuals with access to
their health information, and to prevent unauthor-
ized use of protected health information that is ge-
netic information.
(8) To establish strong and effective remedies
for violations of this Act.
(9) To protect the rights of States.
SEC. 4. DEFINITIONS.
In this Act:
(1) ADMINISTRATIVE BILLING INFORMATION.—
The term 
‘‘administrative 
billing 
information’’
means any of the following forms of protected health
information:
(A) Date of service, policy, patient identifi-
ers, and practitioner or facility identifiers.
(B) Diagnostic codes, in accordance with
medicare billing codes, for which treatment is
being rendered or requested.
(C) Complexity of service codes, indicating
duration of treatment.
(D) Total billed charges.
(2) AGENT.—The term ‘‘agent’’ means a person
who represents and acts for another person (a prin-
cipal) under a contract or relationship of agency, or
whose function is to bring about, modify, affect, ac-
cept performance of, or terminate, contractual obli-
gations between the principal and a third person.
With respect to an employer, the term includes the
employees of the employer.
(3) DE-IDENTIFIED HEALTH INFORMATION.—
(A) IN GENERAL.—The term ‘‘de-identified
health information’’ means any protected health
information, with respect to which—
(i) all personal identifiers, or other in-
formation that may be used by itself or in
combination with other information which
may be available to re-identify the subject
of the information, have been removed; and
(ii) a good faith effort to evaluate the
risks of re-identification of the subject of
such information in the context in which it
will be used or disclosed, has been made.
(B) EXAMPLES.—The term includes aggre-
gate statistics, redacted health information, in-
formation in which random or fictitious alter-
natives have been substituted for personally
identifiable information, and information in
which personally identifiable information has
been encrypted and the decryption key is main-
tained by a person otherwise authorized to have
access to such protected health information in
an identifiable format.
(4) DISCLOSE.—The term ‘‘disclose’’ means to
release, publish, share, transfer, transmit, dissemi-
nate, show, permit access to, re-identify, or other-
wise divulge protected health information to any per-
son other than the individual who is the subject of
such information. The term includes the initial dis-
closure and any subsequent redisclosure of protected
health information.
(5) DECRYPTION KEY.—The term ‘‘decryption
key’’ means the variable information used in or pro-
duced by a mathematical formula, code, or algo-
rithm, or any component thereof, used to encrypt or
decrypt wire or electronic communications or elec-
tronically stored information.
(6) EMPLOYER.—The term ‘‘employer’’ means
a person engaged in business affecting commerce
who has employees.
(7) 
ENCRYPTION.—The 
term 
‘‘encryption’’
means the scrambling of electronic or wire commu-
nications or electronically stored information using
mathematical formulas or algorithms sufficient to
preserve the confidentiality, integrity, and authentic-
ity of such communications or information.
(8) HEALTH CARE.—The term ‘‘health care’’
means—
(A) preventive, diagnostic, therapeutic, re-
habilitative, maintenance, or palliative care, in-
cluding appropriate assistance with disease or
symptom management and maintenance, coun-
seling, service, or procedure—
(i) with respect to the physical or
mental condition of an individual; or
(ii) affecting the structure or function
of the human body or any part of the
human body, including the banking of
blood, sperm, organs, or any other tissue;
and
(B) any sale or dispensing of a drug, de-
vice, equipment, or other health care related
item to an individual, or for the use of an indi-
vidual, pursuant to a prescription.
(9) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who, with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses
the information while acting in whole or in part in
the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by Federal or
State law to provide an item or service that
constitutes health care in the ordinary course of
business, or practice of a profession;
(B) a Federal or State program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee or agent of a
person described in subparagraph (A) or (B)
who is engaged in the provision of health care
or who uses health information.
(10) HEALTH
OR
LIFE
INSURER.—The term
‘‘health or life insurer’’ means a health insurance
issuer (as defined in section 9805(b)(2) of the Inter-
nal Revenue Code of 1986) or a life insurance com-
pany (as defined in section 816 of such Code) and
includes the employees and agents of such a person.
(11) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’—
(A) means a person who—
(i) performs or oversees the perform-
ance of an assessment, investigation, or
prosecution relating to compliance with
legal or fiscal standards relating to health
care fraud or fraudulent claims regarding
health care, health services or equipment,
or related activities and items; and
(ii) is a public executive branch agen-
cy, acting on behalf of a public executive
branch agency, acting pursuant to a re-
quirement of a public executive branch
agency, or carrying out activities under a
Federal or State law governing an assess-
ment, evaluation, determination, investiga-
tion, or prosecution described in clause (i);
and
(B) includes the employees and agents of
such a person.
(12) HEALTH PLAN.—The term ‘‘health plan’’
means any health insurance plan, including any hos-
pital or medical service plan, dental or other health
service plan or health maintenance organization
plan, or other program providing or arranging for
the provision of health benefits, whether or not fund-
ed through the purchase of insurance. The term in-
cludes employee welfare benefit plans and group
plans (as defined in sections 3 and 607 of the Em-
ployee Retirement Income Security Act of 1974 (29
U.S.C. 1002 and 1167)).
(13) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who, with respect to a
specific item of protected health information, re-
ceives the information—
(A) pursuant to section 210 (relating to
health research); or
(B) while acting in whole or in part in the
capacity of an officer, employee, or agent of a
person who receives the information pursuant
to such section.
(14) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means a lawful executive
branch investigation or official proceeding inquiring
into a violation of, or failure to comply with, any
criminal or civil statute or any regulation, rule, or
order issued pursuant to such a statute.
(15) OFFICE
OF
HEALTH
INFORMATION
PRI-
VACY.—The term ‘‘Office of Health Information Pri-
vacy’’ means the Office of Health Information Pri-
vacy designated under section 301.
(16) PERSON.—The term ‘‘person’’ means a
government, governmental subdivision of an execu-
tive branch agency or authority; corporation; com-
pany; association; firm; partnership; society; estate;
trust; joint venture; individual; individual represent-
ative; tribal government; and any other legal entity.
(17) PROTECTED HEALTH INFORMATION.—
(A) IN
GENERAL.—The term ‘‘protected
health information’’ means any information, in-
cluding genetic information, demographic infor-
mation, and tissue samples collected from an
individual, whether oral or recorded in any form
or medium, that—
(i) is created or received by a health
care provider, health researcher, health
plan, health oversight agency, public health
authority, employer, health or life insurer,
school or university; and
(ii)(I) relates to the past, present, or
future physical or mental health or condi-
tion of an individual (including individual
cells and their components), the provision
of health care to an individual, or the past,
present, or future payment for the provi-
sion of health care to an individual; and
(II)(aa) identifies an individual; or
(bb) with respect to which there is a
reasonable basis to believe that the infor-
mation can be used to identify an individ-
ual; and
(B) DECRYPTION
KEY.—The term ‘‘pro-
tected health information’’ includes any infor-
mation described in paragraph (5).
(18) PUBLIC HEALTH AUTHORITY.—The term
‘‘public health authority’’ means an authority or in-
strumentality of the United States, a tribal govern-
ment, a State, or a political subdivision of a State
that is—
(A) primarily responsible for public health
matters; and
(B) primarily engaged in activities such as
injury reporting, public health surveillance, and
public health investigation or intervention.
(19) RE-IDENTIFY.—The term ‘‘re-identify’’,
when used with respect to de-identified health infor-
mation, means an attempt, successful or otherwise,
to ascertain—
(A) the identity of the individual who is
the subject of such information; or
(B) the decryption key with respect to the
information (when undertaken with knowledge
that such key would allow for the identification
of the individual who is the subject of such in-
formation).
(20) SCHOOL
OR
UNIVERSITY.—The term
‘‘school or university’’ means an institution or place
for instruction or education, including an elementary
school, secondary school, or institution of higher
learning, a college, or an assemblage of colleges
united under one corporate organization or govern-
ment.
(21) 
SECRETARY.—The 
term 
‘‘Secretary’’
means the Secretary of Health and Human Services.
(22) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
(23) 
TO
THE
MAXIMUM
EXTENT
PRAC-
TICABLE.—The term ‘‘to the maximum extent prac-
ticable’’ means the level of compliance that a reason-
able person would deem technologically feasible so
long as such feasibility is periodically evaluated in
light of scientific advances.
(24) WRITING.—The term ‘‘writing’’ means
writing in either a paper-based or computer-based
form, including electronic and digital signatures.
TITLE I—INDIVIDUALS’ RIGHTS
Subtitle A—Access to Protected
Health Information by Subjects
of the Information
SEC. 101. INSPECTION AND COPYING OF PROTECTED
HEALTH INFORMATION.
(a) RIGHT OF INDIVIDUAL.—
(1) IN
GENERAL.—A health care provider,
health plan, employer, health or life insurer, school,
or university, or a person acting as the agent of any
such person, shall permit an individual who is the
subject of protected health information, or the indi-
vidual’s designee, to inspect and copy protected
health information concerning the individual, includ-
ing records created under sections 102, 112, 202,
203, 208, and 211, that such person maintains.
(2) PROCEDURES
AND
FEES.—A person de-
scribed in paragraph (1) may set forth appropriate
procedures to be followed for inspection and copying
under such paragraph and may require an individual
to pay fees associated with such inspection and copy-
ing in an amount that is not in excess of the actual
costs of providing such copying. Such fees may not
be assessed where such an assessment would have
the effect of inhibiting an individual from gaining
access to the information described in paragraph
(1).
(b) DEADLINE.—A person described in subsection
(a)(1) shall comply with a request for inspection or copy-
ing of protected health information under this section not
later than 15 business days after the date on which the
person receives the request.
(c) RULES GOVERNING AGENTS.—A person acting as
the agent of a person described in subsection (a) shall pro-
vide for the inspection and copying of protected health in-
formation if—
(1) the protected health information is retained
by the agent; and
(2) the agent has been asked by the person in-
volved to fulfill the requirements of this section.
(d) SPECIAL RULE RELATING TO ONGOING CLINICAL
TRIALS.—With respect to protected health information
that is created as part of an individual’s participation in
an ongoing clinical trial, access to the information shall
be provided consistent with the individual’s agreement to
participate in the clinical trial.
SEC. 102. SUPPLEMENTS TO PROTECTED HEALTH INFOR-
MATION.
(a) IN GENERAL.—Not later than 45 days after the
date on which a health care provider, health plan, em-
ployer, health or life insurer, school, or university, or a
person acting as the agent of any such person, receives
from an individual a request in writing to supplement pro-
tected health information concerning the individual, such
person—
(1) shall add the supplement requested to the
information;
(2) shall inform the individual that the supple-
ment has been made; and
(3) shall make reasonable efforts to inform any
person to whom the portion of the unsupplemented
information was previously disclosed, of any sub-
stantive supplement that has been made.
(b) REFUSAL TO SUPPLEMENT.—If a person de-
scribed in subsection (a) declines to make the supplement
requested under such subsection, the person shall inform
the individual in writing of—
(1) the reasons for declining to make the sup-
plement;
(2) any procedures for further review of the de-
clining of such supplement; and
(3) the individual’s right to file with the person
a concise statement setting forth the requested sup-
plement and the individual’s reasons for disagreeing
with the declining person and the individual’s right
to include a copy of this refusal in his or her health
record.
(c) STATEMENT OF DISAGREEMENT.—If an individ-
ual has filed with a person a statement of disagreement
under subsection (b)(3), the person, in any subsequent dis-
closure of the disputed portion of the information—
(1) shall include, at the individual’s request, a
copy of the individual’s statement; and
(2) may include a concise statement of the rea-
sons for not making the requested supplement.
(d) RULES GOVERNING AGENTS.—A person acting as
the agent of a person described in subsection (a) shall not
be required to make a supplement to protected health in-
formation, except where—
(1) the protected health information is retained
by the agent; and
(2) the agent has been asked by such person to
fulfill the requirements of this section.
SEC. 103. NOTICE OF PRIVACY PRACTICES.
(a) PREPARATION OF WRITTEN NOTICE.—A health
care provider, health plan, health oversight agency, public
health authority, employer, health or life insurer, school,
or university, or a person acting as the agent of any such
person, shall prepare a written notice of the privacy prac-
tices of the person that provides information with respect
to the following:
(1) The procedures for an individual to author-
ize disclosures of protected health information, and
to object to, modify, and revoke such authorizations.
(2) The right of an individual to inspect, copy,
and supplement the protected health information.
(3) The right of an individual not to have em-
ployment or the receipt of services conditioned upon
the execution by the individual of an authorization
for disclosure.
(4) A description of the categories or types of
employees, by general category or by general job de-
scription, who have access to or use of protected
health information within the person.
(5) A simple, concise description of any infor-
mation systems used to store or transmit protected
health information, including a description of any
linkages made with other electronic systems or data-
bases outside the person.
(6) The right of the individual to request seg-
regation of protected health information, and to re-
strict the use of such information by employees,
agents, and contractors of a person.
(7) The circumstances under which the infor-
mation may be used or disclosed without an author-
ization executed by the individual.
(8) A statement that an individual may elect to
pay for health care from the individual’s own funds
and information on the right of such an individual
to elect for identifying information not to be dis-
closed to anyone other than health care providers,
unless such disclosure is required by mandatory re-
porting requirements or other similar information
collection duties required by law.
(b) PROVISION
AND POSTING
OF WRITTEN NO-
TICE.—
(1) PROVISION.—A person described in sub-
section (a) shall provide a copy of the written notice
of 
privacy 
practices 
required 
under 
such
subsection—
(A) at the time an authorization is sought
for disclosure of protected health information;
and
(B) upon the request of an individual.
(2) POSTING.—A person described in subsection
(a) shall post, in a clear and conspicuous manner, a
brief summary of the privacy practices of the person.
(c) MODEL NOTICE.—The director of the Office of
Health Information Privacy, after notice and opportunity
for public comment, shall develop and disseminate model
notices of privacy practices, and model summary notices
for posting, for use under this section. Use of such a model
notice shall be deemed to satisfy the requirements of this
section.
Subtitle B—Establishment of
Safeguards
SEC. 111. ESTABLISHMENT OF SAFEGUARDS.
(a) IN GENERAL.—A health care provider, health
plan, health oversight agency, public health authority, em-
ployer, health researcher, law enforcement official, health
or life insurer, school, or university, or a person acting
as the agent of any such person, shall establish and main-
tain appropriate administrative, organizational, technical,
and physical safeguards and procedures to ensure the con-
fidentiality, security, accuracy, and integrity of protected
health information created, received, obtained, main-
tained, used, transmitted, or disposed of by such person.
(b) FACTORS TO BE CONSIDERED.—The policies and
safeguards under subsection (a) shall ensure that—
(1) protected health information is used or dis-
closed only when necessary;
(2) the categories of personnel who will have ac-
cess to protected health information are identified;
and
(3) the feasibility of limiting access to protected
health information is considered.
(c) MODEL GUIDELINES.—The Secretary, in con-
sultation with the Director of the Office of Health Infor-
mation Privacy appointed under section 301, after notice
and opportunity for public comment, shall develop and dis-
seminate model guidelines for the establishment of safe-
guards and procedures for use under this section, such
as, where appropriate, individual authentication of uses of
computer systems, access controls, audit trails, encryption,
physical security, protection of remote access points and
protection of external electronic communications, periodic
security assessments, incident reports, and sanctions. The
director shall update and disseminate the guidelines, as
appropriate, to take advantage of new technologies.
SEC. 112. ACCOUNTING FOR DISCLOSURES.
(a) IN GENERAL.—A health care provider, health
plan, health oversight agency, public health authority, em-
ployer, health researcher, law enforcement official, health
or life insurer, school, or university, or a person acting
as the agent of any such person, shall establish and main-
tain, with respect to any protected health information dis-
closure that is not related to payment or treatment, a
record of the disclosure in accordance with regulations
issued by the Secretary in consultation with the director
of the Office of Health Information Privacy.
(b) MAINTENANCE
OF RECORD.—A record estab-
lished under subsection (a) shall be maintained for not less
than 7 years.
(c) ELECTRONIC RECORDS.—A health care provider,
health plan, health oversight agency, public health author-
ity, employer, health researcher, law enforcement official,
health or life insurer, school, or university, or a person
acting as the agent of any such person, shall, to the maxi-
mum extent practicable, maintain an accessible electronic
record concerning each access, or attempt to access,
whether authorized or unauthorized, successful or unsuc-
cessful, protected health information maintained by such
person in electronic form. The record shall include the
identity of the specific individual accessing or attempting
to gain such access (or a way to identify that individual
or information helpful in determining the identity of such
individual), information sufficient to identify the protected
health information sought or accessed, and other appro-
priate information.
TITLE II—RESTRICTIONS ON
USE AND DISCLOSURE
SEC. 201. GENERAL RULES REGARDING USE AND DISCLO-
SURE.
(a) PROHIBITION.—
(1) GENERAL RULE.—A health care provider,
health plan, health oversight agency, public health
authority, employer, health researcher, law enforce-
ment official, health or life insurer, school, or univer-
sity may not disclose or use protected health infor-
mation except as authorized under this Act.
(2) RULE
OF
CONSTRUCTION.—Disclosure of
de-identified health information shall not be con-
strued as a disclosure of protected health informa-
tion.
(b) SCOPE OF DISCLOSURE.—
(1) IN
GENERAL.—A disclosure of protected
health information under this title shall be limited to
the minimum amount of information necessary to
accomplish the purpose for which the disclosure is
made.
(2) DETERMINATION.—The determination as to
what constitutes the minimum disclosure possible for
purposes of paragraph (1) shall be made by a health
care provider.
(c) USE OR DISCLOSURE FOR PURPOSE ONLY.—A
recipient of information pursuant to this title may use or
disclose such information solely to carry out the purpose
for which the information was disclosed.
(d) NO GENERAL REQUIREMENT TO DISCLOSE.—
Nothing in this title permitting the disclosure of protected
health information shall be construed to require such dis-
closure.
(e) IDENTIFICATION OF DISCLOSED INFORMATION AS
PROTECTED HEALTH INFORMATION.—Protected health
information disclosed pursuant to this title shall be clearly
identified as protected health information that is subject
to this Act.
(f) DISCLOSURE BY AGENTS.—An agent of a person
described in subsection (a)(1), who receives protected
health information from the person while acting within the
scope of the agency, shall be subject to this title to the
same extent as the person and for the duration of the pe-
riod in which the agent holds the information.
(g) CREATION OF DE-IDENTIFIED INFORMATION.—
Notwithstanding subsection (c), but subject to the other
provisions of this section, a person described in subsection
(a)(1) may disclose protected health information to an em-
ployee or other agent of the person for purposes of creat-
ing de-identified information.
(h) UNAUTHORIZED USE OR DISCLOSURE OF THE
DECRYPTION KEY.—The unauthorized disclosure of a
decryption key shall be deemed to be a disclosure of pro-
tected health information. The unauthorized use of a
decryption key or de-identified health information in order
to identify an individual is deemed to be disclosure of pro-
tected health information.
(i) NO WAIVER.—Except as provided in this Act, an
authorization to disclose personally identifiable health in-
formation executed by an individual pursuant to section
202 or 203 shall not be construed as a waiver of any rights
that the individual has under other Federal or State laws,
the rules of evidence, or common law.
(j) DEFINITIONS.—For purposes of this title:
(1) INVESTIGATIVE OR LAW ENFORCEMENT OF-
FICER.—The term ‘‘investigative or law enforcement
officer’’ means any officer of the United States or of
a State or political subdivision thereof, who is em-
powered by law to conduct investigations of, or to
make arrests for, criminal offenses, and any attor-
ney authorized by law to prosecute or participate in
the prosecution of such offenses.
(2) SEGREGATE.—The term ‘‘segregate’’ means
to place a designated subset of an individuals pro-
tected health information in a location or computer
file that is separate from the location or computer
file used to store protected health information and
where access to or use of any information so seg-
regated may be effectively limited to those persons
who are authorized by the individual to access or use
such information.
(3) SIGNED.—The term ‘‘signed’’ refers to both
signatures in ink and electronic signatures, and the
term ‘‘written’’ refers to both paper and computer-
ized formats.
SEC. 202. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION FOR TREAT-
MENT AND PAYMENT.
(a) REQUIREMENTS
RELATING
TO
EMPLOYERS,
HEALTH PLANS, HEALTH OR LIFE INSURERS, UNIN-
SURED INDIVIDUALS, AND PROVIDERS.—
(1) IN GENERAL.—To satisfy the requirement
under section 201(a)(1), an employer, health plan,
health or life insurer, or health care provider that
seeks to disclose protected health information in con-
nection with treatment or payment shall obtain an
authorization that satisfies the requirements of this
section. The authorization may be a single author-
ization.
(2) EMPLOYERS.—Every employer offering a
health plan to its employees shall, at the time of an
employee’s enrollment in the health plan, obtain a
signed, written authorization that is a legal, in-
formed authorization that satisfies the requirements
of subsection (b) concerning the use and disclosure
of protected health information for treatment or
payment with respect to each individual who is eligi-
ble to receive care under the health plan.
(3) HEALTH PLANS, HEALTH OR LIFE INSUR-
ERS.—Every health plan or health or life insurer of-
fering enrollment to individual or nonemployer
groups shall, at the time of enrollment in the plan
or insurance, obtain a signed, written authorization
that is a legal, informed authorization that satisfies
the requirements of subsection (b) concerning the
use and disclosure of protected health information
with respect to each individual who is eligible to re-
ceive care under the plan or insurance.
(4) UNINSURED.—An originating provider pro-
viding health care in other than a network plan set-
ting, or providing health care to an uninsured indi-
vidual, shall obtain a signed, written authorization
that satisfies the requirements of subsection (b) to
use protected health information in providing health
care or arranging for health care from other provid-
ers or seeking payment for the provision of health
care services.
(5) PROVIDERS.—
(A) IN GENERAL.—Every health care pro-
vider providing health care to an individual who
has not given the appropriate authorization
under this section shall, at the time of provid-
ing such care, obtain a signed, written author-
ization that is a legal, informed authorization,
that satisfies the requirements of subsection
(b), concerning the use and disclosure of pro-
tected health information with respect to such
individual.
(B) RULE OF CONSTRUCTION.—Subpara-
graph (A) shall not be construed to preclude
the provision of health care to an individual
who has not given appropriate authorization
prior to receipt of such care if—
(i) the health care provider involved
determines that such care is essential; and
(ii) the individual can reasonably be
expected to sign an authorization for such
care when appropriate.
(b) REQUIREMENTS FOR INDIVIDUAL AUTHORIZA-
TION.—To satisfy the requirements of this subsection, an
authorization to disclose protected health information—
(1) shall identify, by general job description or
other functional description, persons authorized to
disclose the information;
(2) shall describe the nature of the information
to be disclosed;
(3) shall identify, by general job description or
other functional description, persons to whom the in-
formation is to be disclosed, including individuals
employed by, or operating within, an entity to which
information is authorized to be disclosed;
(4) shall describe the purpose of the disclosures;
(5) shall permit the executing individual to indi-
cate that a particular individual listed on the author-
ization is not authorized to receive protected health
information concerning the individual, except as pro-
vided for in subsection (c)(3);
(6) shall provide the means by which an individ-
ual may indicate that some of the individual’s pro-
tected health information should be segregated and
to what persons such segregated information may be
disclosed;
(7) shall be subject to revocation by the individ-
ual and indicate that the authorization is valid until
revocation by the individual or until an event or date
specified; and
(8)(A) shall be—
(i) in writing, dated, and signed by the in-
dividual; or
(ii) in electronic form, dated and authenti-
cated by the individual using an authentication
method approved by the Secretary; and
(B) shall not have been revoked under subpara-
graph (A).
(c) LIMITATION ON AUTHORIZATIONS.—
(1) IN GENERAL.—Subject to paragraphs (2)
and (3), a person described in subsection (a) who
seeks an authorization under such subsection may
not condition the delivery of treatment or payment
for services on the receipt of such an authorization.
(2) RIGHT TO REQUIRE SELF PAYMENT.—If an
individual has refused to provide an authorization
for disclosure of administrative billing information to
a person and such authorization is necessary for a
health care provider to receive payment for services
delivered, the health care provider may require the
individual to pay from their own funds for the serv-
ices.
(3) RIGHT OF HEALTH CARE PROVIDER TO RE-
QUIRE
AUTHORIZATION
FOR
TREATMENT
PUR-
POSES.—If a health care provider that is seeking an
authorization for disclosure of an individual’s pro-
tected health information believes that the disclosure
of such information is necessary so as not to endan-
ger the health or treatment of the individual, the
health care provider may condition the provision of
services upon the execution of the authorization by
the individual.
(d) MODEL AUTHORIZATIONS.—The Secretary, after
notice and opportunity for public comment, shall develop
and disseminate model written authorizations of the type
described in this section and model statements of the limi-
tations on authorizations. Any authorization obtained on
a model authorization form under section 202 developed
by the Secretary pursuant to the preceding sentence shall
be deemed to satisfy the requirements of this section.
(e) SEGREGATION OF FILES.—A person described in
subsection (a)(1) shall comply, to the maximum extent
practicable, with the request of an individual who is the
subject of protected health information—
(1) to segregate any type or amount of pro-
tected health information, other than administrative
billing information, held by the entity; and
(2) to limit the use or disclosure of the seg-
regated health information within the entity to those
persons specifically designated by the subject of the
protected health information.
(f) REVOCATION OF AUTHORIZATION.—
(1) IN GENERAL.—An individual may in writing
revoke or amend an authorization under this section
at any time, unless the disclosure that is the subject
of the authorization is required to effectuate pay-
ment for health care that has been provided to the
individual.
(2) HEALTH PLANS.—With respect to a health
plan, the authorization of an individual is deemed to
be revoked at the time of the cancellation or non-re-
newal of enrollment in the health plan, except as
may be necessary to complete plan administration
and payment requirements related to the individual’s
period of enrollment.
(3) ACTIONS.—An individual may not maintain
an action against a person for disclosure of person-
ally identifiable health information—
(A) if the disclosure was made based on a
good faith reliance on the individual’s author-
ization under this section at the time disclosure
was made;
(B) in a case in which the authorization is
revoked, if the disclosing person had no actual
or constructive notice of the revocation; or
(C) if the disclosure was for the purpose of
protecting another individual from imminent
physical harm, and is authorized under section
204.
(g) RECORD OF INDIVIDUAL’S AUTHORIZATIONS AND
REVOCATIONS.—Each person collecting or storing person-
ally identifiable health information shall maintain a record
for a period of 7 years of each authorization of an individ-
ual and any revocation thereof, and such record shall be-
come part of the personally identifiable health information
concerning such individual.
(h) RULE OF CONSTRUCTION.—Authorizations for
the disclosure of protected health information for treat-
ment or payment shall not authorize the disclosure of such
information by an individual with the intent to sell, trans-
fer, or use protected health information for commercial ad-
vantage other than the revenues directly derived from the
provision of health care to that individual. For such disclo-
sures, a separate authorization that satisfies the require-
ments of section 203 is required.
SEC. 203. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION OTHER THAN
FOR TREATMENT OR PAYMENT.
(a) IN GENERAL.—To satisfy the requirement under
section 201(a)(1), a health care provider, health plan,
health oversight agency, public health authority, employer,
health researcher, law enforcement official, health or life
insurer, school, or university that seeks to disclose pro-
tected health information for a purpose other than treat-
ment or payment may obtain an authorization that satis-
fies the requirements of subsections (b) and (g) of section
202. Such an authorization under this section shall be sep-
arate from an authorization provided under section 202.
(b) LIMITATION ON AUTHORIZATIONS.—
(1) IN GENERAL.—A person subject to section
202 may not condition the delivery of treatment, or
payment for services, on the receipt of an authoriza-
tion described in this section.
(2) REQUIREMENT FOR SEPARATE AUTHORIZA-
TION.—A person subject to section 202 may not dis-
close protected health information to any employees
or agents who are responsible for making employ-
ment, work assignment, or other personnel decisions
with respect to the subject of the information with-
out a separate authorization permitting such a dis-
closure.
(c) MODEL AUTHORIZATIONS.—The Secretary, after
notice and opportunity for public comment, shall develop
and disseminate model written authorizations of the type
described in subsection (a). Any authorization obtained on
a model authorization form under this section developed
by the Secretary shall be deemed to meet the authorization
requirements of this section.
(d) 
REQUIREMENT
TO
RELEASE
PROTECTED
HEALTH INFORMATION TO CORONERS AND MEDICAL EX-
AMINERS.—
(1) IN GENERAL.—When a Coroner or Medical
Examiner or their duly appointed deputies seek pro-
tected health information for the purpose of inquiry
into and determination of, the cause, manner, and
circumstances of an individual’s death, the health
care provider, health plan, health oversight agency,
public health authority, employer, health researcher,
law enforcement officer, health or life insurer, school
or university involved shall provide that individual’s
protected health information to the Coroner or Medi-
cal Examiner or to the duly appointed deputies with-
out undue delay.
(2) PRODUCTION
OF
ADDITIONAL
INFORMA-
TION.—If a Coroner or Medical Examiner or their
duly appointed deputies receives health information
from an entity referred to in paragraph (1), such
health information shall remain as protected health
information unless the health information is at-
tached to or otherwise made a part of a Coroner’s
or Medical Examiner’s official report, in which case
it shall no longer be protected.
(3) EXEMPTION.—Health information attached
to or otherwise made a part of a Coroner’s or Medi-
cal Examiner’s official report, shall be exempt from
the provisions of this Act except as provided for in
this subsection.
(4) REIMBURSEMENT.—A Coroner or Medical
Examiner may require a person to reimburse their
Office for the reasonable costs associated with such
inspection or copying.
(e) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—An individual may, in writing, revoke or amend an
authorization under this section at any time.
(f) ACTIONS.—An individual may not maintain an ac-
tion against a person for disclosure of protected health
information—
(1) if the disclosure was made based on a good
faith reliance on the individual’s authorization under
this section at the time disclosure was made;
(2) in a case in which the authorization is re-
voked, if the disclosing person had no actual or con-
structive notice of the revocation; or
(3) if the disclosure was for the purpose of pro-
tecting another individual from imminent physical
harm, and is authorized under section 204.
SEC. 204. EMERGENCY CIRCUMSTANCES.
(a) GENERAL RULE.—In the event of a threat of im-
minent physical or mental harm to the subject of protected
health information, any person may, in order to allay or
remedy such threat, disclose protected health information
about such subject to a health care practitioner, health
care facility, law enforcement authority, or emergency
medical personnel.
(b) HARM TO OTHERS.—Any person may disclose
protected health information about the subject of the in-
formation where—
(1) such subject has made an identifiable threat
of serious injury or death with respect to an identifi-
able individual or group of individuals;
(2) the subject has the ability to carry out such
threat; and
(3) the release of such information is necessary
to prevent or significantly reduce the possibility of
such threat being carried out.
SEC. 205. PUBLIC HEALTH.
(a) IN GENERAL.—A health care provider, health
plan, public health authority, employer, health or life in-
surer, law enforcement official, school, or university may
disclose protected health information to a public health au-
thority or other person authorized by public health law
when receipt of such information by the authority or other
person—
(1) relates directly to a specified public health
purpose;
(2) is reasonably likely to achieve such purpose;
and
(3) is intended for a purpose that cannot be
achieved through the receipt or use of de-identified
health information.
(b) PUBLIC HEALTH PURPOSE DEFINED.—For pur-
poses of subsection (a), the term ‘‘public health purpose’’
means a population-based activity or individual effort, au-
thorized by law, aimed at the prevention of injury, disease,
or premature mortality, or the promotion of health, in a
community, including—
(1) assessing the health needs and status of the
community through public health surveillance and
epidemiological research;
(2) developing public health policy;
(3) responding to public health needs and emer-
gencies; and
(4) any other activities or efforts authorized by
law.
SEC. 206. PROTECTION AND ADVOCACY AGENCIES.
Any person who creates protected health information
or receives protected health information under this title
may disclose that information to a protection and advo-
cacy agency established under part C of title I of the De-
velopmental Disabilities Assistance and Bill of Rights Act
(42 U.S.C. 6041 et seq.) or under the Protection and Ad-
vocacy for Mentally Ill Individuals Act of 1986 (42 U.S.C.
10801 et seq.) when such agency can establish that there
is probable cause to believe that an individual who is the
subject of the protected health information is vulnerable
to abuse and neglect by an entity providing health or social
services to the individual.
SEC. 207. OVERSIGHT.
(a) IN GENERAL.—A health care provider, health
plan, employer, law enforcement official, health or life in-
surer, public health authority, health researcher, school or
university may disclose protected health information to a
health oversight agency to enable the agency to perform
a health oversight function authorized by law, if—
(1) the purpose for which the disclosure is to be
made cannot reasonably be accomplished without
protected health information;
(2) the purpose for which the disclosure is to be
made is of sufficient importance to warrant the ef-
fect on, or the risk to, the privacy of the individuals
that additional exposure of the information might
bring; and
(3) there is a reasonable probability that the
purpose of the disclosure will be accomplished.
(b) USE
AND
MAINTENANCE
OF
PROTECTED
HEALTH INFORMATION.—A health oversight agency that
receives protected health information under this section—
(1) shall rely upon a method to scramble or
otherwise safeguard, to the maximum extent prac-
ticable, the identity of the subject of the protected
health information in all work papers and all docu-
ments summarizing the health oversight activity;
(2) shall maintain in its records only such infor-
mation about an individual as is relevant and nec-
essary to accomplish the purpose for which the pro-
tected health information was obtained;
(3) shall maintain such information securely
and limit access to such information to those per-
sons with a legitimate need for access to carry out
the purpose for which the records were obtained;
and
(4) shall remove or destroy the information that
allows subjects of protected health information to be
identified at the earliest time at which removal or
destruction can be accomplished, consistent with the
purpose of the health oversight activity.
(c) USE OF PROTECTED HEALTH INFORMATION IN
JUDICIAL PROCEEDINGS.—
(1) IN GENERAL.— The disclosure and use of
protected health information in any judicial, admin-
istrative, court, or other public, proceeding or inves-
tigation relating to a health oversight activity shall
be undertaken in such a manner as to preserve the
confidentiality and privacy of individuals who are the
subject of the information, unless disclosure is re-
quired by the nature of the proceedings.
(2) LIMITING DISCLOSURE.—Whenever disclo-
sure of the identity of the subject of protected health
information is required by the nature of the proceed-
ings, or it is impracticable to redact the identity of
such individual, the agency shall request that the
presiding judicial or administrative officer enter an
order limiting the disclosure of the identity of the
subject to the extent possible, including the redact-
ing of the protected health information from publicly
disclosed or filed pleadings or records.
(d) AUTHORIZATION BY A SUPERVISOR.—For pur-
poses of this section, the individual with authority to au-
thorize the oversight function involved shall provide to the
disclosing person described in subsection (a) a statement
that the protected health information is being sought for
a legally authorized oversight function.
(e) USE IN ACTION AGAINST INDIVIDUALS.—Pro-
tected health information about an individual that is dis-
closed under this section may not be used in, or disclosed
to any person for use in, an administrative, civil, or crimi-
nal action or investigation directed against the individual,
unless the action or investigation arises out of and is di-
rectly related to—
(1) the receipt of health care or payment for
health care;
(2) a fraudulent claim related to health; or
(3) oversight of a public health authority or a
health researcher.