priate, following the discovery by the person of a se-
curity breach. 
(2) BURDEN OF PROOF.—The person required 
to provide notification under this section shall have 
the burden of demonstrating that all notifications 
were made as required under this subtitle, including 
evidence demonstrating the necessity of any delay. 
(d) METHODS OF NOTICE.—A person described in 
subsection (a) shall provide to an individual the following 
forms of notice in the case of a security breach: 
(1) 
INDIVIDUAL
NOTICE.—Notice 
required 
under this section shall be provided in such form as 
the individual selects, including— 
(A) written notification to the last known 
home mailing address of the individual in the 
records of the person; 
(B) telephone notice to the individual per-
sonally; or 
(C) e-mail notice, if the individual has con-
sented to receive such notice and the notice is 
consistent with the provisions permitting elec-
tronic transmission of notices under section 101 
of the Electronic Signatures in Global and Na-
tional Commerce Act (15 U.S.C. 7001). 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(2) MEDIA NOTICE.—Notice shall be provided 
to prominent media outlets serving a State or juris-
diction, if the personal health information of more 
than 500 residents of such State or jurisdiction is, 
or is reasonably believed to have been, acquired by 
an unauthorized person. 
(3) NOTICE TO SECRETARY.—Notice shall be 
provided to the Secretary for health information per-
sons that have lost, stolen, disclosed, or used in an 
unauthorized manner or for an unauthorized pur-
pose the personal health information of a significant 
number of individuals. 
(e) CONTENT OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a security breach shall include, to 
the extent possible— 
(1) a description of the personal health infor-
mation that has been, or is reasonably believed to 
have been, accessed, disclosed, or otherwise used by 
an unauthorized person; 
(2) a toll-free number that the individual may 
use to contact the person described in subsection (a) 
to learn what types of personal health information 
the person maintained about that individual; and 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(3) toll-free contact telephone numbers and ad-
dresses for major credit reporting agencies. 
(f) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.— 
(1) IN GENERAL.—If a Federal law enforce-
ment agency determines that the notification re-
quired under this section would impede a criminal 
investigation or cause damage to national security, 
such notification shall be delayed upon written no-
tice from the Federal law enforcement agency to the 
person that experienced the breach. 
(2) EXTENDED DELAY OF NOTIFICATION.—If 
the notification required under subsection (a) is de-
layed pursuant to paragraph (1), a person shall give 
notice not later than 30 days after such law enforce-
ment delay was invoked unless a Federal law en-
forcement agency provides written notification that 
further delay is necessary. 
SEC. 114. TRANSPARENCY. 
(a) PUBLIC LIST OF DATA PARTNERS.— 
(1) IN GENERAL.—A health information person 
shall establish a list of data partners (as defined in 
paragraph (2)) with which such person has entered 
into a contract or relationship for the purposes of 
providing services involving any personal health in-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
formation held, used, or disclosed by the person. 
Such list and the contact information for each part-
ner shall be made publicly accessible on the Internet. 
(2) DATA PARTNER DEFINED.—In paragraph 
(1), the term ‘‘data partner’’ means a data bank, 
data warehouse, information clearinghouse, record 
locator system, or other business entity, which for 
monetary fees, dues, or on a cooperative nonprofit 
basis, engages in the practice of accessing, col-
lecting, maintaining, modifying, storing, recording, 
transmitting, destroying, or otherwise using or dis-
closing the personal health information of individ-
uals. Any person maintaining personal health infor-
mation for the purposes of making such information 
available to the individual or the health care pro-
vider, including persons furnishing free or paid per-
sonal health records, electronic health records, elec-
tronic medical records, and related products and 
services, shall be deemed to be a data partner sub-
ject to the requirements of this title. 
(b) SUBCONTRACTING
AND OUTSOURCING OVER-
SEAS.—In the event a health information person contracts 
with service providers not subject to this title, including 
service providers operating in a foreign country, such per-
son shall— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) take reasonable steps to select and retain 
third party service providers capable of maintaining 
appropriate safeguards for the security, privacy, and 
integrity of personal health information; 
(2) require by contract that such service pro-
viders implement and maintain appropriate meas-
ures designed to meet the requirements applicable to 
health information persons under this title; 
(3) be held liable for any violation of this title 
by an overseas service provider or other provider not 
subject to this title; and 
(4) in the case of a service provider operating 
in a foreign country, obtain the informed consent of 
the individual involved prior to outsourcing such in-
dividual’s personal health information to such pro-
vider. 
(c) LIST OF PERSONS.—The Secretary shall maintain 
a public list identifying health information persons that 
have lost, stolen, disclosed, or used in an unauthorized 
manner or for an unauthorized purpose the personal 
health information of 1,000 or more individuals. The list 
shall include how many individuals were affected by such 
action and be displayed on the Web site of the Department 
of Health and Human Services. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 115. RISK MANAGEMENT. 
(a) IN GENERAL.—Each health information person 
shall establish risk management and control processes to 
protect against anticipated vulnerabilities to the privacy, 
security, and integrity of personal health information that 
the person accesses, holds, uses, or discloses. 
(b) RISK ASSESSMENT.—A health information person 
shall perform annual risk assessments of procedures, sys-
tems, or networks involved in the creation, accessing, 
maintenance, retention, modification, recording, storage, 
distribution, destruction, or other use or disclosure of per-
sonal health information. Such risk assessment shall in-
clude— 
(1) identifying reasonably foreseeable internal 
and external vulnerabilities that could result in inac-
curacy or in unauthorized access, disclosure, use, or 
modification of personal health information, or of 
systems containing personal health information; 
(2) assessing the likelihood of and potential 
damage from inaccuracy or from unauthorized ac-
cess, disclosure, use, or modification of personal 
health information; 
(3) assessing the sufficiency of policies, tech-
nologies, and safeguards in place to enable compli-
ance with individuals’ informed consent to the ac-
cess, disclosure, use, or modification of their per-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
sonal health information and minimize and control 
risks from unauthorized access, disclosure, use, or 
modification of individuals’ personal health informa-
tion; and 
(4) assessing the vulnerability of personal 
health information during destruction and disposal 
of such information, including through the disposal 
or retirement of hardware. 
(c) RISK MANAGEMENT.—A health information per-
son shall establish risk management and control proce-
dures designed to control risks such as those identified 
in subsection (b). Such procedures shall include— 
(1) a means for the detection and recording of 
actual or attempted, unauthorized, fraudulent, or 
otherwise unlawful access, disclosure, transmission, 
modification, use, or loss of personal health informa-
tion; 
(2) procedures for ensuring the secure disposal 
of personal health information; 
(3) a means for limiting physical access to 
hardware, software, data storage technology, servers, 
systems, or networks by unauthorized persons in 
order to minimize the risk of information disclosure, 
modification, transmission, access, use, or loss; 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(4) providing appropriate risk management and 
control training for employees; and 
(5) carrying out annual testing of such risk 
management and control procedures. 
SEC. 116. ACCOUNTING FOR DISCLOSURES AND USE. 
(a) IN GENERAL.—A health information person shall 
establish and maintain, with respect to any personal 
health information disclosure, a record of each disclosure 
in accordance with regulations promulgated by the Sec-
retary in consultation with the Director of the Office of 
Health Information Privacy. Such record shall include the 
purpose of any disclosure and the identity of the specific 
individual executing the disclosure, as well as the person 
to which such information is disclosed. 
(b) MAINTENANCE
OF RECORD.—A record estab-
lished under subsection (a) shall be maintained for not less 
than 6 years. 
(c) ELECTRONIC RECORDS.—A health information 
person shall, to the maximum extent practicable, maintain 
an accessible electronic record concerning each access, use, 
or disclosure, whether authorized or unauthorized and 
whether successful or unsuccessful, of personal health in-
formation maintained by such person in electronic form. 
The record shall include the identities of the specific indi-
viduals (or a way to identify such individuals, or informa-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
tion helpful in determining the identities of such individ-
uals) who access or seek to gain access to, use or seek 
to use, or disclose or seek to disclose, information suffi-
cient to identify the personal health information sought 
or accessed, and other appropriate information. 
(d) ACCESS TO RECORDS.—A health information per-
son shall permit an individual who is the subject of per-
sonal health information, or the individual’s designee, to 
inspect and copy the records created in subsections (a) 
and (c). 
Subtitle C—Use and Disclosure of 
Personal Health Information 
CHAPTER 1—GENERAL RESTRICTIONS 
SEC. 121. GENERAL RULES REGARDING USE AND DISCLO-
SURE. 
(a) PROHIBITION.— 
(1) GENERAL RULE.—A person may not dis-
close, access, or use personal health information ex-
cept as authorized under this title. 
(2) RULE
OF
CONSTRUCTION.—Disclosure or 
use of health information that meets the standards 
of being de-identified health information shall not be 
construed as a disclosure or use of personal health 
information. 
(b) SCOPE OF DISCLOSURE OR USE.— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) IN GENERAL.—A disclosure or use of per-
sonal health information under this subtitle shall be 
limited to the minimum amount of information nec-
essary to accomplish the purpose for which the dis-
closure or use is made, such as the individual’s name 
and address, date of service, place of service, type of 
service, cost of service, and diagnosis. 
(2) DETERMINATION.—The determination as to 
what constitutes the minimum disclosure or use pos-
sible for purposes of paragraph (1) shall be made by 
the individual or entity holding the information. The 
minimum necessary standard is intended to be con-
sistent with, and not override, professional judgment 
and standards. 
(c) USE OR DISCLOSURE FOR PURPOSE ONLY.— 
(1) IN GENERAL.—An authorized recipient (as 
defined in paragraph (2)) of information pursuant to 
this subtitle may use or disclose such information 
solely to carry out the purpose for which the infor-
mation was disclosed, except as provided in section 
143. 
(2) AUTHORIZED
RECIPIENT
DEFINED.—In 
paragraph (1), the term ‘‘authorized recipient’’ 
means a person granted the authority by an indi-
vidual, in accordance with this title, to access, main-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
tain, retain, modify, record, store, destroy, or other-
wise use the individual’s personal health information 
through an authorized disclosure. 
(d) NO GENERAL REQUIREMENT TO DISCLOSE.— 
Nothing in this subtitle permitting the disclosure of per-
sonal health information shall be construed to require such 
disclosure. 
(e) IDENTIFICATION OF DISCLOSED INFORMATION AS 
PERSONAL HEALTH INFORMATION.—Personal health in-
formation disclosed or used pursuant to this subtitle shall 
be clearly identified and labeled as personal health infor-
mation that is subject to this title. 
(f) DISCLOSURE OR USE BY AGENTS.—An agent, 
employee, or affiliate of a health information person that 
accesses, seeks to access, obtains, discloses, uses, or re-
ceives personal health information from such person, shall 
be subject to this subtitle to the same extent as the person. 
(g) DISCLOSURE OR USE BY OTHERS.—A person re-
ceiving personal health information initially held by a per-
son described in subsection (f) shall be subject to this sub-
title to the same extent as the person described in sub-
section (f). 
(h) CREATION OF DE-IDENTIFIED INFORMATION.— 
Notwithstanding subsection (c), but subject to the other 
provisions of this section, a person described in subsection 
VerDate Aug 31 2005 
00:08 Feb 22, 2008
Jkt 069200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(f) may disclose personal health information to an em-
ployee or other agent of the person for purposes of cre-
ating de-identified information. 
(i) UNAUTHORIZED USE OR DISCLOSURE OF THE 
DECRYPTION KEY.—The unauthorized disclosure of a 
decryption key (as defined in section 171(7)) or other sec-
ondary or tertiary means for accessing personal health in-
formation shall be deemed for purposes of this subtitle to 
be a disclosure of personal health information. The unau-
thorized use of a decryption key (or other secondary or 
tertiary means for accessing personal health information) 
or de-identified health information in order to identify an 
individual is deemed for purposes of this subtitle to be dis-
closure of personal health information. 
(j) NO WAIVER.—Except as provided in this title, an 
informed consent or other authorization to disclose or use 
personally identifiable health information executed by an 
individual pursuant to this subtitle shall not be construed 
as a waiver of any rights that the individual has under 
other Federal or State laws, the rules of evidence, or com-
mon law. 
(k) OPT-IN TO NETWORK SHARING.— 
(1) IN GENERAL.—Before a health information 
person may share personal health information, 
through disclosure, access, use, or otherwise, with a 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
health information network or system, the individual 
must opt in to the sharing of such information with 
such network or system. 
(2) HEALTH INFORMATION NETWORK OR SYS-
TEM DEFINED.—In this subsection, the term ‘‘health 
information network or system’’ means an interoper-
able health information infrastructure consisting of 
health information systems and other networks that 
connect providers, consumers, and others involved in 
supporting health and health care. 
(l) DISPOSAL OF DATA.—To prevent the unauthor-
ized disclosure or use of personal health information, such 
information, when disposed of, shall be de-identified, de-
stroyed, or expunged from any electronic, paper, or other 
files and documents maintained by authorized persons to 
make such information permanently unreadable and 
undecipherable. 
(m) OBLIGATIONS
OF
UNAUTHORIZED
RECIPI-
ENTS.—A person that obtains, accesses, or receives per-
sonal health information and that is an unauthorized re-
cipient of such information may not access, maintain, re-
tain, modify, record, store, destroy, or otherwise use or 
disclose such information for any purposes, and use or dis-
closure of personal health information under such cir-
cumstances shall be deemed for purposes of this subtitle 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
an unauthorized disclosure of personal health information, 
unless the disclosure is for the purpose of informing the 
Secretary, law enforcement authorities, or Congress of the 
person’s unauthorized receipt of the personal health infor-
mation. 
SEC. 122. INFORMED CONSENT FOR DISCLOSURE OF PER-
SONAL HEALTH INFORMATION FOR TREAT-
MENT AND PAYMENT. 
(a) REQUIREMENTS
RELATING
TO
EMPLOYERS, 
HEALTH PLANS, HEALTH OR LIFE INSURERS, UNIN-
SURED AND SELF-PAY INDIVIDUALS, AND PROVIDERS.— 
(1) IN GENERAL.—An employer, health plan, 
health or life insurer, or health care provider that 
seeks to disclose personal health information in con-
nection with treatment or payment shall obtain in-
formed consent (as defined in section 171(19)) from 
the subject of such personal health information that 
satisfies the requirements of this section. A single 
consent may authorize multiple disclosures. 
(2) HEALTH PLANS, HEALTH OR LIFE INSUR-
ERS.—Every health plan or health or life insurer of-
fering enrollment to individual or nonemployer 
groups shall, at the time of enrollment in the plan 
or insurance, obtain an informed consent for the use 
and disclosure of personal health information with 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
respect to each individual who is eligible to receive 
care or benefits under the plan or insurance. 
(3) UNINSURED
AND
SELF-PAY.—An origi-
nating provider that provides health care in other 
than a network plan setting, or provides health care 
to an uninsured individual, shall obtain an informed 
consent for access to or use of personal health infor-
mation in providing health care or arranging for 
health care from other providers or seeking payment 
for the provision of health care services. 
(4) PROVIDERS.—Every health care provider 
that provides health care to an individual that has 
not been given the appropriate prior consent under 
this section, shall at the time of providing such care, 
or at such time as is practicable if services are nec-
essary prior to the opportunity to obtain consent, ob-
tain an informed consent for the use and disclosure 
of personal health information with respect to such 
individual. 
(b) REQUIREMENTS
FOR INDIVIDUAL INFORMED 
CONSENT.—To satisfy the requirements of this sub-
section, an informed consent from an individual to disclose 
the individual’s personal health information shall— 
(1) identify, by general job description or other 
functional description and by geographic location, 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
those persons that are authorized to disclose the in-
formation, including entities employed by a person 
authorized to disclose the information; 
(2) describe the specific nature of the informa-
tion to be disclosed; 
(3) identify, by general job description or other 
functional description and by geographic location, 
those persons to which the information will be dis-
closed, including entities employed by a person to 
which information is authorized to be disclosed; 
(4) describe the purpose of the disclosures; 
(5) permit the executing individual to indicate 
that a particular person or class of persons (a group 
of persons with similar roles or functions) listed on 
the informed consent is not authorized to receive 
personal health information concerning the indi-
vidual, except as provided for in subsection (c)(3); 
(6) provide the means by which an individual 
may indicate that some of the individual’s personal 
health information should be segregated and to what 
persons or classes of persons such segregated infor-
mation may be disclosed; 
(7) be subject to revocation by the individual 
and indicate that the informed consent is valid until 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
revocation by the individual or until an event or date 
specified; 
(8)(A) be in writing, dated, and signed by the 
individual; and 
(B) not have been revoked under subsection (f); 
(9) describe the procedure by which an indi-
vidual can amend an informed consent previously ob-
tained by a person; 
(10) describe the extent to which the authorized 
person will share information with sub-contracted 
persons, and the geographic location of sub-con-
tracted persons, including those operating or located 
overseas, except that the authorized person shall ob-
tain the informed consent of the individual involved 
prior to outsourcing such individual’s personal 
health information to a sub-contracted person oper-
ating or located overseas; and 
(11) describe the nature and probability of 
harm to the individual resulting from the informed 
consent for use or disclosure, consistent with the 
principle of informed consent. 
(c) LIMITATION ON INFORMED CONSENT.— 
(1) IN GENERAL.—Subject to paragraphs (2) 
and (3), a health information person that seeks in-
formed consent under this subtitle may not condition 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
the delivery of treatment or payment for services on 
the receipt of such an informed consent. 
(2) RIGHT TO REQUIRE SELF-PAYMENT.— 
(A) IN GENERAL.—If an individual has re-
fused to provide an informed consent for disclo-
sure of administrative billing information (as 
defined in subparagraph (B)) to a person and 
such informed consent is necessary for a health 
care provider to receive payment for services de-
livered, the health care provider may require 
the individual to pay from their own funds for 
the services. 
(B) ADMINISTRATIVE
BILLING
INFORMA-
TION.—In subparagraph (A), the term ‘‘admin-
istrative billing information’’ means any of the 
following forms of personal health information: 
(i) Date of service, policy, patient 
identifiers, and practitioner or facility iden-
tifiers. 
(ii) Diagnostic codes, in accordance 
with medicare billing codes, for which 
treatment is being rendered or requested. 
(iii) Complexity of service codes, indi-
cating duration of treatment. 
(iv) Total billed charges. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(3) RIGHT OF HEALTH CARE PROVIDER TO RE-
QUIRE INFORMED CONSENT FOR TREATMENT PUR-
POSES.—If a health care provider that is seeking an 
informed consent for disclosure of an individual’s 
personal health information believes that the disclo-
sure of such information is necessary so as not to 
endanger the health or treatment of the individual, 
and if the withholding of services will not endanger 
the life of the individual, the health care provider 
may condition the provision of services upon the in-
dividual’s execution of an informed consent to dis-
close personal health information to the minimum 
extent necessary. 
(4) 
INFORMED
CONSENTS
FOR
PAYMENT 
UNDER CERTAIN CIRCUMSTANCES.—If an individual 
is in a physical or mental condition such that the in-
dividual is not capable of authorizing the disclosure 
of personal health information and no other arrange-
ments have been made to pay for the health care 
services being rendered to the patient, such informa-
tion may be disclosed to a governmental authority to 
the extent necessary to determine the individual’s 
eligibility for, and to obtain, payment under a gov-
ernmental program for health care services provided 
to the patient. The information may also be dis-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
closed to another provider of health care or health 
care service plan as necessary to assist the other 
provider or health care service plan in obtaining pay-
ment for health care services rendered by that pro-
vider of health care or health care service plan to the 
patient. 
(d) MODEL INFORMED CONSENT.—The Secretary, in 
consultation with the Director of the Office of Health In-
formation Privacy, after notice and opportunity for public 
comment in accordance with section 553 of title 5, United 
States Code, shall develop and disseminate model written 
informed consents of the type described in this section, 
which represent informed consent from the subject of such 
personal health information that satisfies the require-
ments of this section, and model statements of the limita-
tions on informed consents. Any informed consent ob-
tained on a model informed consent form under this sec-
tion developed by the Secretary pursuant to the preceding 
sentence shall be deemed to satisfy the requirements for 
an informed consent under this section. 
(e) SEGREGATION OF FILES.—A health information 
person shall comply with the request of an individual who 
is the subject of personal health information— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) to hide, mask, or mark separate any type or 
amount of personal health information held by the 
person; and 
(2) to limit the use or disclosure of the seg-
regated health information within the person to 
those specifically designated by the subject of the 
personal health information. 
(f) REVOCATION OF INFORMED CONSENT.— 
(1) IN GENERAL.—An individual may revoke or 
amend in writing an informed consent under this 
section at any time, unless the disclosure that is the 
subject of the consent is required to effectuate pay-
ment for health care that has been provided to the 
individual and for which the individual has declined 
or refused to pay from the individual’s own funds. 
(2) HEALTH PLAN.—With respect to a health 
plan, the informed consent of an individual is 
deemed to be revoked at the time of the cancellation 
or non-renewal of enrollment in the health plan, ex-
cept as may be necessary to complete plan adminis-
tration and payment requirements related to the in-
dividual’s period of enrollment. 
(g) RECORD OF INDIVIDUAL’S INFORMED CONSENTS 
AND REVOCATIONS.—Each person accessing, maintaining, 
retaining, modifying, recording, storing, destroying, or 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
otherwise using personally identifiable or personal health 
information for purposes of treatment or payment shall 
maintain a record for a period of 6 years of each informed 
consent by an individual and any revocation thereof, and 
such record shall become part of the individual’s health 
record set. 
SEC. 123. INFORMED CONSENT AND AUTHORIZATION FOR 
DISCLOSURE OF PERSONAL HEALTH INFOR-
MATION OTHER THAN FOR TREATMENT OR 
PAYMENT. 
(a) IN GENERAL.—A health information person that 
seeks to disclose personal health information for a purpose 
other than treatment or payment shall obtain informed 
consent. Such consent under this section shall be separate 
from an informed consent provided under section 122. 
(b) LIMITATION
ON AUTHORIZATIONS.—A person 
subject to section 122 may not condition the delivery of 
treatment, or payment for services, on the receipt of an 
informed consent or authorization described in this sec-
tion. 
(c) MODEL INFORMED CONSENTS AND AUTHORIZA-
TIONS.—The Secretary, in consultation with the Director 
of the Office of Health Information Privacy, after notice 
and opportunity for public comment in accordance with 
section 553 of title 5, United States Code, shall develop 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
and disseminate model informed consents of the type de-
scribed in subsection (a) and written authorizations of the 
type described in subsections (d) and (e). Any consent or 
authorization obtained on a respective model form shall 
be deemed to meet the requirements under the respective 
subsection. 
(d) REQUIREMENT OF SEPARATE, ADDITIONAL AU-
THORIZATION FOR PERSONNEL DECISIONS.—A health in-
formation person subject to section 122 may not disclose 
personal health information to any employees or agents 
who are responsible for making employment, work assign-
ment, or other personnel decisions with respect to the sub-
ject of the information without a separate, additional writ-
ten authorization permitting such a disclosure. 
(e) REQUIREMENT OF SEPARATE, ADDITIONAL AU-
THORIZATION FOR MARKETING.— 
(1) IN GENERAL.—A health information person 
may not disclose personal health information for 
marketing purposes without a separate, additional 
written authorization permitting such a disclosure. 
(2) REQUIREMENTS.—In the case of a disclo-
sure of personal health information for marketing 
purposes, a separate authorization required by para-
graph (1), to be valid, shall— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(A) state that one purpose of the disclo-
sure is for ‘‘marketing’’; 
(B) state that the purpose of the use or 
disclosure involved is marketing; 
(C) describe the specific marketing uses 
and disclosures authorized, including whether 
the personal health information involved— 
(i) may be used for purposes internal 
to the person; 
(ii) may be disclosed to, and used by, 
a business associate of the person; and 
(iii) may be disclosed to, and used by, 
any person or entity other than a business 
associate of the person; and 
(D) state that the use or disclosure of per-
sonal health information for marketing will di-
rectly result in remuneration to the person from 
a third party, in any case in which a person ex-
pects, or reasonably should expect, that such re-
muneration will occur. 
(3) MARKETING DEFINED.— 
(A) IN GENERAL.—In this subsection, the 
term ‘‘marketing’’ is a communication about a 
product or service a purpose of which is to en-
courage recipients of the communication to pur-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
chase or use the product or service in return for 
direct or indirect compensation. 
(B) EXCLUSIONS.— 
(i) IN
GENERAL.—Subject to clause 
(ii), such term excludes the following ex-
ceptions: 
(I) Communications made by per-
son for the purpose of describing the 
entities participating in a provider 
network or health plan network, and 
communications made by a person for 
the purpose of describing if and the 
extent to which a product or service, 
or payment for a product or service, is 
provided by the person or included in 
a benefit plan. 
(II) Communications tailored to 
the circumstances of a particular indi-
vidual, made by a health care provider 
to an individual as part of the treat-
ment of the individual, and for the 
purpose of furthering the treatment of 
that individual. 
(III) Communications tailored to 
the circumstances of a particular indi-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
vidual and made by a health care pro-
vider or health plan to an individual 
in the course of managing or coordi-
nating the treatment of that indi-
vidual or for the purpose of directing 
or recommending to that individual al-
ternative treatments, therapies, pro-
viders, or settings of care. 
(ii) EXCEPTION.—Clause (i) shall not 
apply, and a communication shall be con-
sidered marketing, if a person receives di-
rect or indirect remuneration from a third 
party for making a written communication 
otherwise described in subclause (I), (II), 
or (III) of such clause. 
(f) REQUIREMENT TO RELEASE PERSONAL HEALTH 
INFORMATION
TO
CORONERS
AND
MEDICAL
EXAM-
INERS.— 
(1) IN GENERAL.—When a coroner or medical 
examiner or their duly appointed deputies seek per-
sonal health information for the purpose of inquiry 
into and determination of, the cause, manner, and 
circumstances of an individual’s death, the health in-
formation person shall provide that individual’s per-
sonal health information to the coroner or medical 
VerDate Aug 31 2005 
00:08 Feb 22, 2008
Jkt 069200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
examiner or to the duly appointed deputies without 
undue delay or consent by the deceased individual’s 
representative. 
(2) PRODUCTION
OF
ADDITIONAL
INFORMA-
TION.—If a coroner or medical examiner or their 
duly appointed deputies receives health information 
from a person referred to in paragraph (1), such 
health information shall remain as personal health 
information unless the health information is at-
tached to or otherwise made a part of a coroner’s or 
medical examiner’s official report, in which case it 
shall no longer be protected. 
(3) EXEMPTION.—Health information attached 
to or otherwise made a part of a coroner’s or med-
ical examiner’s official report shall be exempt from 
the provisions of this title except as provided for in 
this subsection. 
(4) REIMBURSEMENT.—A person referred to in 
paragraph (1) may request reimbursement from a 
coroner or medical examiner for the reasonable costs 
associated with inspection or copying of personal 
health information maintained, retained, or stored 
by such person. 
(g) REVOCATION OR AMENDMENT OF CONSENT OR 
AUTHORIZATION.—An individual may revoke or amend in 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
writing an informed consent or authorization under this 
section at any time. 
(h) ACTIONS.—It shall not be a violation of this title 
with respect to the disclosure of personal health informa-
tion— 
(1) if the disclosure was made based on a good 
faith reliance on the individual’s informed consent or 
authorization under this section at the time disclo-
sure was made; 
(2) in a case in which the consent or authoriza-
tion is revoked, if the disclosing person had no ac-
tual or constructive notice of the revocation; or 
(3) if the disclosure was for the purpose of pro-
tecting another individual from imminent physical 
harm and is authorized under section 141. 
(i) RECORD OF CONSENTS, AUTHORIZATIONS, AND 
REVOCATIONS.—Each person accessing, maintaining, re-
taining, modifying, recording, storing, destroying, or oth-
erwise using personally identifiable or personal health in-
formation for purposes other than treatment or payment 
shall maintain a record for a period of 6 years of each 
informed consent and authorization by an individual and 
any revocation thereof, and such record shall become part 
of the individual’s health record set. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
CHAPTER 2—EXCEPTIONS 
SEC. 131. DISCLOSURE FOR LAW ENFORCEMENT, NA-
TIONAL SECURITY, AND INTELLIGENCE PUR-
POSES. 
(a) ACCESS TO PERSONAL HEALTH INFORMATION 
FOR LAW ENFORCEMENT, NATIONAL SECURITY, AND IN-
TELLIGENCE ACTIVITIES.—A health information person, 
or a person who receives personal health information pur-
suant to section 131, may disclose personal health infor-
mation to— 
(1) an investigative or law enforcement officer 
(as defined in subsection (k)) pursuant to a warrant 
issued under the Federal Rules of Criminal Proce-
dure, an equivalent State warrant, a grand jury sub-
poena, civil subpoena, civil investigative demand, or 
a court order under limitations set forth in sub-
section (b); and 
(2) an authorized Federal official for the con-
duct of lawful intelligence, counter-intelligence, and 
other national security activities authorized by the 
National Security Act (50 U.S.C. 401 et seq.) and 
implementing authority (Executive Order 12333), or 
otherwise by law. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(b) LIMITATION ON USE AND DISCLOSURE FOR NA-
TIONAL SECURITY, INTELLIGENCE, AND OTHER LAW EN-
FORCEMENT INQUIRIES.— 
(1) IN GENERAL.—Personal health information 
about an individual that is disclosed under this sec-
tion may not be used in, or disclosed to any entity 
for use in, any administrative, civil, or criminal ac-
tion or investigation directed against the individual, 
unless the action or investigation arises out of, or is 
directly related to, the law enforcement, national se-
curity, or intelligence inquiry for which the informa-
tion was obtained. 
(2) LAW ENFORCEMENT INQUIRY DEFINED.— 
In paragraph (1), the term ‘‘law enforcement in-
quiry’’ means a lawful executive branch investigation 
or official proceeding inquiring into a violation of, or 
failure to comply with, any criminal or civil statute 
or any regulation, rule, or order issued pursuant to 
such a statute. 
(c) REDACTIONS.—To the maximum extent prac-
ticable, and consistent with the requirements of due proc-
ess, a law enforcement agency shall redact personally iden-
tifying information from personal health information prior 
to the public disclosure of such protected information in 
a judicial or administrative proceeding. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(d) EXCEPTION.—This section shall not be construed 
to limit or restrict the ability of law enforcement authori-
ties to gain information while in hot pursuit of a suspect 
or if other exigent circumstances exist. 
(e) INVESTIGATIVE OR LAW ENFORCEMENT OFFICER 
DEFINED.—In this section, the term ‘‘investigative or law 
enforcement officer’’ means any officer of the United 
States or of a State or political subdivision thereof, who 
is empowered by law to conduct investigations of, or to 
make arrests for, civil or criminal offenses, and any attor-
ney authorized by law to prosecute or participate in the 
prosecution of such offenses. 
SEC. 132. DISCLOSURE FOR PUBLIC HEALTH PURPOSES. 
(a) IN GENERAL.—A health information person may 
disclose personal health information to a public health au-
thority (as defined in section 171(24)) or other entity au-
thorized by public health law, when receipt of such infor-
mation by the authority or other entity— 
(1) relates directly to a specified public health 
purpose; 
(2) is reasonably likely to achieve such purpose; 
and 
(3) is intended for a purpose that cannot be 
achieved through the receipt or use of de-identified 
health information. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(b) PUBLIC HEALTH PROTECTION DEFINED.—For 
purposes of subsection (a), the term ‘‘public health pur-
pose’’ means a population-based activity or individual ef-
fort, authorized by law, the purpose of which is the preven-
tion of injury, disease, or premature mortality, or the pro-
motion of health, in a community, including— 
(1) assessing the health needs and status of the 
community through public health surveillance and 
epidemiological research; 
(2) implementing public health policy; 
(3) responding to public health needs and emer-
gencies; and 
(4) any other activities or efforts authorized by 
law. 
(c) LIMITATIONS.—The purpose of the disclosure de-
scribed in subsection (a) shall be of significant importance 
such that it warrants the potential effect on, or risk to, 
the privacy of individuals that the additional exposure of 
personal health information might bring. Any infringe-
ment on the right to privacy under this section shall use 
the least intrusive means that are tailored to minimize in-
trusion on the right to privacy. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 133. REPORTING OF ABUSE AND NEGLECT TO PRO-
TECTION AND ADVOCACY AGENCIES. 
Any health information person may disclose personal 
health information to a protection and advocacy agency 
established under part C of title I of the Developmental 
Disabilities Assistance and Bill of Rights Act (42 U.S.C. 
6041 et seq.) or under the Protection and Advocacy for 
Mentally Ill Individuals Act of 1986 (42 U.S.C. 10801 et 
seq.) when such person reasonably believes that an indi-
vidual who is the subject of the personal health informa-
tion is vulnerable to abuse and neglect by an entity pro-
viding health or social services to the individual. 
SEC. 134. DISCLOSURE TO NEXT OF KIN AND DIRECTORY 
INFORMATION. 
(a) NEXT OF KIN.—A health care provider, or a per-
son that receives personal health information under sec-
tion 141, may disclose personal health information about 
health care services provided to an individual to the indi-
vidual’s next of kin, or to another entity that the indi-
vidual has identified, if at the time of the treatment of 
the individual— 
(1) the individual— 
(A) has been notified of the individual’s 
right to object to such disclosure and the indi-
vidual has not objected to the disclosure; or 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(B) is in a physical or mental condition 
such that the individual is not capable of object-
ing, and there are no prior indications that the 
individual would object; and 
(2) the information disclosed is relevant to 
health care services currently being provided to that 
individual. 
(b) DIRECTORY INFORMATION.— 
(1) DISCLOSURE.— 
(A) IN GENERAL.—Except as provided in 
paragraph (2), with respect to an individual 
who is admitted as an inpatient to a health care 
facility, a person described in subsection (a) 
may disclose information described in subpara-
graph (B) about the individual to any entity if, 
at the time of the admission, the individual— 
(i) has been notified of the individ-
ual’s right to object and has not objected 
to the disclosure; or 
(ii) is in a physical or mental condi-
tion such that the individual is not capable 
of objecting and there are no prior indica-
tions that the individual would object. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(B) INFORMATION.—Information described 
in this subparagraph is information that con-
sists only of 1 or more of the following items: 
(i) The name of the individual who is 
the subject of the information. 
(ii) The general health status of the 
individual, described as critical, poor, fair, 
stable, or satisfactory or in terms denoting 
similar conditions. 
(iii) The location of the individual 
within the health care facility to which the 
individual is admitted. 
(2) EXCEPTION.—Paragraph (1)(B)(iii) shall 
not apply if disclosure of the location of the indi-
vidual would reveal specific information about the 
physical or mental condition of the individual, unless 
the individual expressly authorizes such disclosure. 
(c) DIRECTORY OR NEXT-OF-KIN INFORMATION.—A 
disclosure may not be made under this section if the dis-
closing person described in subsection (a) has reason to 
believe that the disclosure of directory or next-of-kin infor-
mation could lead to the physical or mental harm of the 
individual, unless the individual expressly authorizes such 
disclosure. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
CHAPTER 3—SPECIAL CIRCUMSTANCES 
SEC. 141. EMERGENCY CIRCUMSTANCES. 
(a) GENERAL RULE.—In the event of a threat of im-
minent physical or mental harm to the subject of personal 
health information, any person may, in order to allay or 
remedy such threat, disclose personal health information 
about such subject to a health care provider, health care 
facility, law enforcement authority, or emergency medical 
personnel, to the minimum extent necessary and only if 
determined appropriate by a health care provider. 
(b) HARM TO OTHERS.—Any person may disclose 
personal health information about the subject of the infor-
mation where— 
(1) such subject has made an identifiable threat 
of serious injury or death with respect to an identifi-
able individual or group of individuals; 
(2) the subject has the ability to carry out such 
threat; and 
(3) the release of such information is necessary 
to prevent or significantly reduce the possibility of 
such threat being carried out. 
SEC. 142. HEALTH RESEARCH. 
(a) REGULATIONS.— 
(1) IN GENERAL.—The requirements and pro-
tections provided for under part 46 of title 45, Code 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
of Federal Regulations (as in effect on the date of 
enactment of this Act), shall apply to all health re-
search. 
(2) EFFECTIVE DATE.—Paragraph (1) shall not 
take effect until the Secretary has promulgated final 
regulations to implement such paragraph. 
(b) EVALUATION.—Not later than 24 months after 
the date of the enactment of this Act, the Secretary shall 
prepare and submit to Congress detailed recommendations 
on whether informed consent should be required, and if 
so, under what circumstances, before personal health in-
formation can be used for health research. 
(c) RECOMMENDATIONS.—The recommendations re-
quired to be submitted under subsection (b) shall in-
clude— 
(1) a detailed explanation of current institu-
tional review board practices, including the extent to 
which the privacy of individuals is taken into ac-
count as a factor before allowing waivers and under 
what circumstances informed consent is being 
waived; 
(2) a list of all known breaches of health infor-
mation privacy over the past 5 years in research 
projects approved by an institutional review board; 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(3) a summary of how technology that both fa-
cilitates research and preserves privacy could be 
used to obtain informed consent and strip identi-
fying data for the purpose of research; 
(4) an analysis of State and Federal laws, med-
ical ethics, and ethics in the performance of health 
research that examines requirements for the receipt 
of informed consent; and 
(5) an analysis of the risks and benefits of al-
lowing individuals to consent or to refuse to consent, 
at the time of receiving medical treatment, to the 
possible future use of records of medical treatments 
for research studies. 
(d) CONSULTATION.—In carrying out this section, 
the Secretary shall consult with individuals who have dis-
tinguished themselves in the fields of health research, pri-
vacy, related technology including electronic consent man-
agement tools, consumer interests in health information, 
health data standards, and the provision of health services. 
(e) CONGRESSIONAL NOTICE.—Not later than 6 
months after the date on which the Secretary submits to 
Congress the recommendations required under subsection 
(b), the Secretary shall propose to implement such rec-
ommendations through regulations promulgated on the 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
record after opportunity for a hearing, and shall advise 
the Congress of such proposal. 
(f) OTHER REQUIREMENTS.— 
(1) OBLIGATIONS OF THE RECIPIENT.—A per-
son who receives personal health information pursu-
ant to this section shall remove or destroy, at the 
earliest opportunity consistent with the purposes of 
the project involved, information that would enable 
an individual to be identified, unless— 
(A) an institutional review board has de-
termined that there is a health or research jus-
tification for the retention of such identifiers; 
(B) an institutional review board has, to 
the maximum extent practicable, attempted to 
contact the individual to whom the identifiers 
relate; 
(C) upon being contacted pursuant to sub-
paragraph (B), the individual does not object to 
the retention of such identifiers; and 
(D) there is an adequate plan to protect 
the identifiers from disclosure consistent with 
this section. 
(2) PERIODIC REVIEW AND TECHNICAL ASSIST-
ANCE.— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(A) INSTITUTIONAL REVIEW BOARD.—Any 
institutional review board that authorizes re-
search under this section shall provide the Sec-
retary with the names and addresses of the in-
stitutional review board members. 
(B) TECHNICAL
ASSISTANCE.—The Sec-
retary shall provide technical assistance to insti-
tutional review boards described in this sub-
section. 
(C) MONITORING.—The Secretary shall pe-
riodically monitor institutional review boards 
described in this subsection, including with re-
spect to the privacy, security, and confiden-
tiality practices of such boards. 
(D) REPORTS.—Not later than 3 years 
after the date of enactment of this Act, the Sec-
retary shall report to Congress regarding the 
activities of institutional review boards de-
scribed in this subsection. 
(g) LIMITATION.—Nothing in this section shall be 
construed to permit personal health information that is 
received by a researcher under this section to be accessed 
for purposes other than research or as authorized by the 
individual that is the subject of such personal health infor-
mation. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 143. HEALTH OVERSIGHT FUNCTIONS. 
(a) IN GENERAL.—A health information person may 
disclose personal health information to a health oversight 
agency (as defined in section 171(16)) to enable the agen-
cy to perform a health oversight function authorized by 
law, if— 
(1) the purpose for which the disclosure is to be 
made cannot reasonably be accomplished without 
personal health information; 
(2) the purpose for which the disclosure is to be 
made is of sufficient importance to warrant the ef-
fect on, or the risk to, the privacy of the individuals 
that additional exposure of the information might 
bring; and 
(3) there is a reasonable probability that the 
purpose of the disclosure will be accomplished. 
(b) USE AND MAINTENANCE OF PERSONAL HEALTH 
INFORMATION.—A health oversight agency that receives 
personal health information under subsection (a)— 
(1) shall, to the maximum extent practicable, 
obtain the informed consent of the individual to 
whom the personal health information relates before 
using or disclosing the information; 
(2) shall secure personal health information in 
all work papers and all documents summarizing the 
health oversight activity through technological, ad-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
ministrative, and physical safeguards including cryp-
tographic-key based encryption; 
(3) shall maintain in its records only such infor-
mation about an individual as is relevant and nec-
essary to accomplish the purpose for which the per-
sonal health information was obtained; 
(4) using appropriate encryption measures, 
shall maintain such information securely and limit 
access to such information to those persons with a 
legitimate need for access to carry out the purpose 
for which the records were obtained; and 
(5) shall remove or destroy the information that 
allows subjects of personal health information to be 
identified at the earliest time at which removal or 
destruction can be accomplished, consistent with the 
purpose of the health oversight activity. 
(c) AUTHORIZATION BY A SUPERVISOR.—For pur-
poses of this section, the individual with authority to au-
thorize the oversight function involved shall provide to the 
disclosing person described in subsection (a) a statement 
that the personal health information is being sought for 
a legally authorized oversight function. 
SEC. 144. INDIVIDUAL REPRESENTATIVES. 
(a) IN GENERAL.—Except as provided in subsections 
(b) and (c), a person who is authorized by law (based on 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
grounds other than an individual’s status as a minor), or 
by an instrument recognized under law, to act as an agent, 
attorney, proxy, or other legal representative of an indi-
vidual, may, to the extent so authorized, exercise and dis-
charge the rights of the individual under this title. 
(b) HEALTH CARE POWER OF ATTORNEY.—A person 
who is authorized by law (based on grounds other than 
being a minor), or by an instrument recognized under law, 
to make decisions about the provision of health care to 
an individual who is incapacitated, may exercise and dis-
charge the rights of the individual under this title to the 
extent necessary to effectuate the terms or purposes of 
the grant of authority. 
(c) INDIVIDUALS SUFFERING FROM CERTAIN MED-
ICAL CONDITIONS.—If a physician or other health care 
provider determines that an individual, who has not been 
declared to be legally incompetent, suffers from a medical 
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right 
of the individual to access or amend the health informa-
tion and to authorize disclosure under this title may be 
exercised and discharged in the best interest of the indi-
vidual by— 
(1) a person described in subsection (b) with re-
spect to the individual; 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
by law or by an instrument recognized under law, to 
act as an executor or administrator of the estate of 
a deceased individual, or otherwise to exercise the 
rights of the deceased individual, may, to the extent 
so authorized, exercise and discharge the rights of 
such deceased individual under this title. If no such 
designee has been authorized, the rights of the de-
ceased individual may be exercised as provided for in 
subsection (c). 
(3) 
IDENTIFICATION
OF
DECEASED
INDI-
VIDUAL.—A person described in section 136(a) may 
disclose personal health information if such disclo-
sure is necessary to assist in the identification of a 
deceased individual. 
Subtitle D—Enforcement 
SEC. 151. IN GENERAL. 
(a) CIVIL PENALTY.—A health information person 
who the Secretary, in consultation with the Attorney Gen-
eral, determines has substantially and materially failed to 
comply with this title shall be subject, in addition to any 
other penalties that may be prescribed by law— 
(1) in a case in which the violation relates to 
subtitle A, B, or C, to a civil penalty of not more 
than $500 for each such violation, but not to exceed 
$5,000 in the aggregate for multiple violations; 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(2) in a case in which the violation relates to 
subtitle A, B, or C, to a civil penalty of not more 
than $10,000 for each such violation, but not to ex-
ceed $50,000 in the aggregate for multiple viola-
tions; or 
(3) in a case in which such violations have oc-
curred with such frequency as to constitute a gen-
eral business practice, to a civil penalty of not more 
than $100,000. 
(b) CIVIL ACTION BY INDIVIDUALS.— 
(1) IN GENERAL.—Any individual whose rights 
under subtitle A, B, or C have been knowingly or 
negligently violated may bring a civil action to re-
cover— 
(A) such preliminary and equitable relief 
as the court determines to be appropriate; and 
(B) the greater of compensatory damages 
or liquidated damages of $5,000. 
(2) ADDITIONAL REMEDIES.—The equitable re-
lief or damages that may be available under this sec-
tion shall be in addition to any other lawful remedy 
or award that may be available. 
SEC. 152. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) CIVIL ACTIONS.—In any case in which the attor-
ney general of a State or any State or local law enforce-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
ment agency authorized by the State attorney general or 
by State law to prosecute violations of consumer protec-
tion laws, has reason to believe that an interest of the resi-
dents of that State has been or is threatened or adversely 
affected by the engagement of a person in a practice that 
is prohibited under subtitle A, B, or C, the State or local 
law enforcement agency on behalf of the residents of the 
agency’s jurisdiction, may bring a civil action on behalf 
of the residents of the State or jurisdiction in a district 
court of the United States of appropriate jurisdiction to— 
(1) enjoin that act or practice; 
(2) enforce compliance with the respective sub-
title; or 
(3) obtain civil penalties in an amount cal-
culated by multiplying the number of violations by 
an amount not greater than $11,000. 
For purposes of civil penalties under this subsection, each 
day that a person is in violation of the requirements of 
subtitle A, B, or C shall be treated as a separate violation, 
up to a maximum civil penalty of $5,000,000. 
(b) RULE
OF CONSTRUCTION.—For purposes of 
bringing any civil action under subsection (a), nothing in 
this subtitle regarding notification shall be construed to 
prevent an attorney general of a State from exercising the 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
powers conferred on such attorney general by the laws of 
that State to— 
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(c) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in the district court of 
the United States that meets applicable require-
ments relating to venue under section 1391 of title 
28, United States Code. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
Subtitle E—Miscellaneous 
SEC. 161. OFFICE OF HEALTH INFORMATION PRIVACY. 
(a) IN GENERAL.—The Secretary shall designate an 
office within the Department of Health and Human Serv-
ices to be known as the Office of Health Information Pri-
vacy (referred to in this section as the ‘‘Office’’). The Of-
fice shall be headed by a Director, who shall be appointed 
by the Secretary. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(b) DUTIES.—The Director of the Office shall— 
(1) receive and investigate complaints of alleged 
violations of this title; 
(2) provide for the conduct of audits where ap-
propriate; 
(3) provide guidance to the Secretary on the 
implementation of this Act; 
(4) provide guidance to health care providers 
and other relevant individuals concerning the man-
ner in which to interpret and implement the privacy 
protections under this title (and the regulations pro-
mulgated under this title); 
(5) prepare and submit the report described in 
subsection (c); 
(6) consult with, and provide recommendation 
to, the Secretary concerning improvements in the 
privacy and security of personal health information 
and concerning medical privacy research needs; and 
(7) carry out any other activities determined 
appropriate by the Secretary. 
(c) STANDARDS FOR CERTIFICATION.— 
(1) ESTABLISHMENT.—Not later than 12 
months after the date of enactment of this Act, the 
Secretary, in consultation with the Director of the 
Office and the Director of the Office of Civil Rights, 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
shall establish and implement standards for health 
information technology products, including qualified 
health information technology systems (as defined in 
section 213), used to access, disclose, maintain, 
store, distribute, transmit, amend, or dispose of per-
sonal health information in a manner that protects 
the individual’s right to privacy, confidentiality, and 
security relating to that information. 
(2) STAKEHOLDER PARTICIPATION.—In estab-
lishing the standards under paragraph (1), the Sec-
retary shall ensure the participation of various 
stakeholders, including patients and consumer advo-
cates, privacy advocates, experts in information tech-
nology and information systems, and experts in 
health care. The Secretary shall ensure that these 
advocates and experts are equally represented, such 
that the stakeholder process does not result in the 
experts in information technology, information sys-
tems, and health care being disproportionately rep-
resented compared to advocates for the interests of 
consumers and privacy proponents. 
(d) REPORT ON COMPLIANCE.—Not later than Janu-
ary 1 of the first calendar year beginning more than 1 
year after the establishment of the Office under subsection 
(a), and every January 1 thereafter, the Secretary, in con-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
sultation with the Director of the Office, shall prepare and 
submit to Congress a report concerning the number of 
complaints of alleged violations of subtitle A that are re-
ceived during the year for which the report is being pre-
pared. Such report shall describe the complaints and any 
remedial action taken concerning such complaints and 
shall be made available to the public on the Internet 
website of the Department of Health and Human Services. 
SEC. 162. PROTECTION FOR WHISTLEBLOWERS. 
(a) PROHIBITION
AGAINST
DISCRIMINATION.—A 
health information person may not— 
(1) discharge, demote, suspend, threaten, har-
ass, retaliate against, or in any other manner dis-
criminate or cause any employer to discriminate 
against an employee in the terms and conditions of 
employment because of— 
(A) the refusal of the employee to engage 
in a violation of this title; or 
(B) any lawful act the employee has com-
mitted or is about to commit, or which the 
health information person perceives the em-
ployee to have committed, to provide informa-
tion or cause information to be provided, in-
cluding in the course of the employee’s routine 
job duties, to the individual’s employer or to a 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
State or Federal official relating to an actual or 
suspected violation of this title by any person, 
including an employer or an employee of an em-
ployer; or 
(2) adversely affect another person, directly or 
indirectly, because such person has exercised a right 
under this title, disclosed information relating to a 
possible violation of subtitle A, B, or C or this sec-
tion, or associated with, or assisted, an individual in 
the exercise of a right under this title. 
(b) ENFORCEMENT ACTIONS.— 
(1) IN GENERAL.— 
(A) COMPLAINT
WITH
SECRETARY
OF 
LABOR.—Any employee or former employee who 
alleges a violation of subsection (a) may seek 
relief under subsection (c), by filing a complaint 
with the Secretary of Labor. 
(B) APPELLATE
REVIEW
IN
CASE
OF 
FINAL ORDER.—Unless an employee brings an 
action in district court under subparagraph (C), 
any person adversely affected or aggrieved by a 
final order of the Secretary of Labor with re-
spect to a complaint filed under subparagraph 
(A) may obtain review of the order in the 
United States court of appeals for the circuit in 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
which the violation, with respect to which the 
order was issued, allegedly occurred or the cir-
cuit in which the complainant resided on the 
date of such violation. The petition for review 
must be filed not later than 60 days after the 
date of the issuance of the final order. The re-
view shall conform to chapter 7 of title 5, 
United States Code. The commencement of pro-
ceedings under this subparagraph shall not, un-
less ordered by the court, operate as a stay of 
the order. 
(C) DE NOVO REVIEW.—If the Secretary of 
Labor has not issued a final decision within 
180 days after the filing of the complaint, or 
within 90 days after receiving any written de-
termination, the complainant may bring an ac-
tion at law or equity for de novo review in the 
appropriate district court of the United States 
with jurisdiction, which shall have jurisdiction 
over such an action without regard to the 
amount in controversy, and which action shall, 
at the request of either party to such action, be 
tried by the court with a jury. 
(2) PROCEDURES.— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(A) IN GENERAL.—Except as provided in 
this paragraph, the complaint procedures con-
tained in section 42121(b) of title 49, United 
States Code, shall apply with respect to a com-
plaint filed under paragraph (1)(A). 
(B) EXCEPTION.—With respect to a com-
plaint filed under paragraph (1)(A), the notifi-
cation provided for under section 42121(b)(1) 
of title 49, United States Code, (as required 
under subparagraph (A)) shall be made to the 
person named in the complaint and to the em-
ployer. 
(C) BURDEN OF PROOF.—The legal bur-
dens of proof contained in section 42121(b) of 
title 49, United States Code, shall apply to any 
action brought under this subsection. 
(D) STATUTE OF LIMITATIONS.—A com-
plaint shall be filed under paragraph (1)(A) not 
later than 2 years after the date on which the 
alleged violation occurs. 
(E) CIVIL
ACTIONS
TO
ENFORCE.—If a 
person fails to comply with an order issued by 
the Secretary of Labor pursuant to the proce-
dures in section 42121(b) of title 49, United 
States Code, the Secretary shall have the au-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
thority described in section 42121(b)(5) of title 
49, United States Code, to bring a civil action 
to enforce the order in the district court of the 
United States for the judicial district in which 
the violation occurred. 
(c) REMEDIES.— 
(1) IN GENERAL.—If the Secretary of Labor or 
the district court determines that a violation of sub-
section (a) has occurred, the Secretary or court shall 
order any relief necessary to make the employee 
whole. 
(2) COMPENSATORY DAMAGES.—Relief in any 
action under such subsection shall include— 
(A) reinstatement of the employee to the 
employee’s former position with the same se-
niority status that the employee would have had 
but for the discrimination; 
(B) payment of the amount of back pay, 
with interest, to which the employee is entitled; 
and 
(C) the payment of compensation for any 
special damages sustained by the employee as a 
result of the discrimination, including litigation 
costs, expert witness fees, and reasonable attor-
ney fees. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(3) PUNITIVE DAMAGES.—Relief in any action 
under such subsection may include punitive damages 
in an amount not to exceed $250,000. 
(d) RIGHTS RETAINED BY THE EMPLOYEE.—Noth-
ing in this section shall be construed to diminish or elimi-
nate the rights, privileges, or remedies available to an em-
ployee under any Federal or State law, or under any col-
lective bargaining agreement. 
(e) LIMITATION.—The protections of this section 
shall not apply to any employee who— 
(1) deliberately causes or participates in the al-
leged violation; or 
(2) knowingly or recklessly provides materially 
false information to an individual or entity described 
in subsection (a). 
(f) DEFINITIONS.—In this section: 
(1) EMPLOY.—The term ‘‘employ’’ has the 
meaning given such term under section 3(g) of the 
Fair Labor Standards Act of 1938 (29 U.S.C. 
203(g)) for the purposes of implementing the re-
quirements of that Act (29 U.S.C. 201, et seq.). 
(2) EMPLOYEE.—The term ‘‘employee’’ means 
an individual who is employed by an employer. 
(3) EMPLOYER.—The term ‘‘employer’’ means 
any person who employs employees, including any 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
person acting directly or indirectly in the interest of 
any employer in relation to an employee and in-
cludes a public agency. 
SEC. 163. DEMONSTRATION GRANT FOR INDIVIDUALS WITH 
LIMITED ENGLISH LANGUAGE PROFICIENCY 
OR LIMITED HEALTH LITERACY. 
(a) IN GENERAL.—The Secretary shall award con-
tracts or competitive grants to eligible entities to support 
demonstration projects that are designed to improve the 
communication of information pertaining to health privacy 
rights with individuals with limited English language pro-
ficiency and limited health literacy. 
(b) PURPOSE.—It is the purpose of this section, to 
promote the cultural competency of persons that access, 
maintain, retain, modify, record, store, destroy, or other-
wise use or disclose personal health information, and to 
enable such persons to better communicate privacy proce-
dures to non-English speakers, those with limited English 
proficiency, and those with limited health literacy. 
(c) ELIGIBLE ENTITIES.—In this section, the term 
‘‘eligible entity’’ means an organization or community- 
based consortium that includes— 
(1) individuals who are representatives of orga-
nizations serving or advocating for ethnic and racial 
minorities, low income immigrant populations, and 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
others with limited English language proficiency and 
limited health literacy; 
(2) health care providers that provide care for 
ethnic and racial minorities, low income immigrant 
populations, and others with limited English lan-
guage proficiency and limited health literacy; 
(3) community leaders and leaders of commu-
nity-based organizations; and 
(4) experts and researchers in the areas of so-
cial and behavioral sciences, who have knowledge, 
training, or practical experience in health policy, ad-
vocacy, cultural and linguistic competency, or other 
relevant areas as determined by the Secretary. 
(d) APPLICATION.—An eligible entity seeking a con-
tract or grant under this section shall submit an applica-
tion to the Secretary at such time, in such manner, and 
containing such information as the Secretary may require. 
(e) USE OF FUNDS.—An eligible entity shall use 
amounts received under this section to carry out programs 
and studies designed to help identify best practices in the 
communication of privacy rights and procedures to ensure 
comprehension by individuals with limited English pro-
ficiency and limited health literacy. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 164. RELATIONSHIP TO OTHER LAWS. 
(a) FEDERAL AND STATE LAWS.—Nothing in this 
Act shall be construed as preempting, superseding, or re-
pealing, explicitly or implicitly, other Federal or State laws 
or regulations relating to personal health information or 
relating to an individual’s access to personal health infor-
mation or health care services, if such laws or regulations 
provide protections for the rights of individuals to the pri-
vacy of, and access to, their health information that is 
greater than those provided for in this Act. 
(b) PRIVILEGES.—Nothing in this Act shall be con-
strued to preempt or modify any provisions of State statu-
tory or common law to the extent that such law concerns 
a privilege of a witness or person in a court of that State. 
This Act shall not be construed to supersede or modify 
any provision of Federal statutory or common law to the 
extent such law concerns a privilege of a witness or entity 
prior to a court proceeding or in a court of the United 
States. Informed consent shall not be construed as a waiv-
er of any such privilege. 
(c) CERTAIN DUTIES UNDER LAW.—Nothing in this 
Act shall be construed to preempt, supersede, or modify 
the operation of any State law that— 
(1) provides for the reporting of vital statistics 
such as birth or death information; 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(2) requires the reporting of abuse or neglect 
information about any individual; 
(3) regulates the disclosure or reporting of in-
formation concerning an individual’s mental health; 
or 
(4) governs a minor’s rights to access personal 
health information or health care services. 
(d) HEALTH INSURANCE PORTABILITY
AND AC-
COUNTABILITY ACT.—The standards governing the pri-
vacy and security of individually identifiable health infor-
mation promulgated by the Secretary of Health and 
Human Services under sections 262(a) and 264 of the 
Health Insurance Portability and Accountability Act of 
1996 shall remain in effect to the extent that they are 
consistent with this title. The Secretary shall by rule 
amend such Federal regulations as required to make such 
regulations consistent with this title. 
SEC. 165. EFFECTIVE DATE. 
(a) EFFECTIVE DATE.—Unless specifically provided 
for otherwise, this title shall take effect on the date that 
is 12 months after the date of the promulgation of the 
regulations required under subsection (b), or 30 months 
after the date of enactment of this Act, whichever is ear-
lier. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(b) REGULATIONS.—Not later than 12 months after 
the date of enactment of this Act, or as specifically pro-
vided for otherwise, the Secretary shall promulgate regula-
tions implementing this title. 
Subtitle F—General Definitions 
SEC. 171. GENERAL DEFINITIONS. 
In this Act: 
(1) AGENT.—The term ‘‘agent’’ means a person 
that represents or acts for another person (a prin-
cipal) under a contract or relationship of agency, or 
that functions to bring about, modify, affect, accept 
performance of, or terminate, contractual obligations 
between the principal and a third person. With re-
spect to an employer, such term includes the employ-
ees of the employer. 
(2) AUTHORIZATION.—The term ‘‘authoriza-
tion’’ means the authority granted by an individual 
that is the subject of personal health information, in 
accordance with this title, for the disclosure or use 
of the individual’s personal health information. 
(3) BREACH.—The term ‘‘breach’’ means the 
unauthorized acquisition, disclosure, or loss of per-
sonal health information which compromises the se-
curity, privacy, or integrity of personal health infor-
mation maintained by or on behalf of a person. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(4) CONFIDENTIALITY.—The term ‘‘confiden-
tiality’’ means the obligations of those who receive 
information to respect the privacy interests of those 
to whom the data relate. 
(5) DE-IDENTIFIED HEALTH INFORMATION.— 
The term ‘‘de-identified health information’’ means 
any personal health information, with respect to 
which— 
(A) all personal identifiers, or other infor-
mation that may be used by itself or in com-
bination with other information which may be 
available to re-identify (as defined in section 
171(25)) the subject of the information (such 
as geographic, credit, and financial information 
and all of the identifiers enumerated at section 
164.514(b)(2) of title 45 of the Code of Federal 
Regulations (as in effect on January 1, 2008)) 
have been removed; 
(B) a good faith effort has been made to 
evaluate, minimize, and mitigate the risks of re- 
identification of the subject of such information, 
using commonly accepted scientific and statis-
tical standards and methods for minimizing risk 
of disclosure; and 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(C) there is no reasonable basis to believe 
that the information can be used to identify an 
individual. 
(6) DISCLOSE.—The term ‘‘disclose’’ means to 
release, publish, share, transfer, transmit, dissemi-
nate, show, permit access to, communicate (orally or 
otherwise), re-identify, or otherwise divulge personal 
health information to any person other than the in-
dividual who is the subject of such information. 
Such term includes the initial disclosure and any 
subsequent re-disclosure of personal health informa-
tion. 
(7) DECRYPTION KEY.—The term ‘‘decryption 
key’’ means the variable information used in or pro-
duced by a mathematical formula, code, or algo-
rithm, 
or 
any 
component 
thereof, 
used 
for 
encryption (as defined in paragraph (10)) or 
decryption of wire, electronic, or other communica-
tions or stored information. 
(8) DIRECTOR OF THE OFFICE OF HEALTH IN-
FORMATION PRIVACY.—The term ‘‘Director of the 
Office of Health Information Privacy’’ means such 
Director as appointed under section 161. 
(9) EMPLOYER.—Except as otherwise provided 
in section 164, the term ‘‘employer’’ means a person 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
that is engaged in business affecting commerce and 
that has employees. 
(10) ENCRYPTION.—The term ‘‘encryption’’— 
(A) means the protection of data in elec-
tronic form, in storage or in transit, using an 
encryption technology that has been adopted by 
an established standards setting body which 
renders such data indecipherable in the absence 
of associated cryptographic keys necessary to 
enable decryption of such data; and 
(B) includes appropriate management and 
safeguards of such cryptographic keys so as to 
protect the integrity of the encryption. 
(11) HEALTH CARE.—The term ‘‘health care’’ 
means— 
(A) preventive, diagnostic, therapeutic, re-
habilitative, maintenance, or palliative care, in-
cluding appropriate assistance with disease or 
symptom management and maintenance, coun-
seling, service, or procedure— 
(i) with respect to the physical or 
mental condition of an individual; or 
(ii) affecting the structure or function 
of the human body or any part of the 
human body, including the banking of 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
131 
local or regional health information net-
work; 
(ii) consult, as needed, with the 
Health Information Technology Resource 
Center established in section 914(d) to ac-
cess the knowledge and experience of exist-
ing initiatives regarding the successful im-
plementation and effective use of health in-
formation technology; 
(iii) agree to notify individuals if their 
personal health information is wrongfully 
disclosed; and 
(iv) take into account the input of em-
ployees and staff who are directly involved 
in patient care of such health care pro-
viders in the design and implementation 
and use of qualified health information 
technology systems; 
(E) require that health care providers re-
ceiving loans under the grant adopt the stand-
ards adopted by the Federal Government under 
section 301; 
(F) require that health care providers re-
ceiving loans under the grant implement the 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
165 
adopt the standards and implementation specifica-
tions adopted by the Federal Government under this 
section for the purpose of activities under such Fed-
eral contract. 
(3) RULE OF CONSTRUCTION.—Nothing in this 
section shall be construed to require that a private 
entity that enters into a contract with the Federal 
Government adopt the standards and implementa-
tion specifications adopted by the Federal Govern-
ment under this section with respect to activities not 
related to the contract. 
(c) COORDINATION
OF FEDERAL DATA COLLEC-
TION.—Not later than 3 years after the adoption by the 
Federal Government of a recommendation as provided for 
in section 202(c), all Federal agencies (including the Cen-
ter for Medicare & Medicaid Services) collecting health 
data in an electronic format for the purposes of quality 
reporting, surveillance, epidemiology, adverse event report-
ing, research, or for other purposes determined appro-
priate by the Secretary, shall comply with the standards 
and implementation specifications adopted under such 
subsection. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00165
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
166 
SEC. 302. ENSURING HEALTH CARE PROVIDERS PARTICI-
PATING IN THE MEDICARE PROGRAM MAY 
MAINTAIN HEALTH INFORMATION IN ELEC-
TRONIC FORM. 
Section 1871 of the Social Security Act (42 U.S.C. 
1395hh) is amended by adding at the end the following 
new subsection: 
‘‘(g)(1) Any provider of services or supplier shall be 
deemed as meeting any requirement for the maintenance 
of data in paper form under this title (whether or not for 
purposes of management, billing, reporting, reimburse-
ment, or otherwise) if the required data is maintained in 
an electronic form. 
‘‘(2) Nothing in this subsection shall be construed as 
requiring health care providers to maintain or submit data 
in electronic form.’’. 
Æ 
VerDate Aug 31 2005 
00:08 Feb 22, 2008
Jkt 069200
PO 00000
Frm 00166
Fmt 6652
Sfmt 6301
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS