I
105TH CONGRESS
1ST SESSION
H. R. 52
To establish a code of fair information practices for health information,
to amend section 552a of title 5, United States Code, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JANUARY 7, 1997
Mr. CONDIT introduced the following bill; which was referred to the Commit-
tee on Commerce, and in addition to the Committees on Government Re-
form and Oversight, and the Judiciary, for a period to be subsequently
determined by the Speaker, in each case for consideration of such provi-
sions as fall within the jurisdiction of the committee concerned
A BILL
To establish a code of fair information practices for health
information, to amend section 552a of title 5, United
States Code, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Fair Health Information Practices Act of 1997’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Definitions.
TITLE I—FAIR HEALTH INFORMATION PRACTICES
Subtitle A—Duties of Health Information Trustees
Sec. 101. Inspection of protected health information.
Sec. 102. Amendment of protected health information.
Sec. 103. Notice of information practices.
Sec. 104. Disclosure history.
Sec. 105. Security.
Subtitle B—Use and Disclosure of Protected Health Information
Sec. 111. General limitations on use and disclosure.
Sec. 112. Authorizations for disclosure of protected health information.
Sec. 113. Treatment, payment, and oversight.
Sec. 114. Next of kin and directory information.
Sec. 115. Public health.
Sec. 116. Health research.
Sec. 117. Emergency circumstances.
Sec. 118. Judicial and administrative purposes.
Sec. 119. Law enforcement.
Sec. 120. Subpoenas, warrants, and search warrants.
Subtitle C—Access Procedures and Challenge Rights
Sec. 131. Access procedures for law enforcement subpoenas, warrants, and
search warrants.
Sec. 132. Challenge procedures for law enforcement subpoenas.
Sec. 133. Access and challenge procedures for other subpoenas.
Sec. 134. Construction of subtitle; suspension of statute of limitations.
Sec. 135. Responsibilities of Secretary.
Subtitle D—Miscellaneous Provisions
Sec. 141. Payment card and electronic payment transactions.
Sec. 142. Access to protected health information outside of the United States.
Sec. 143. Standards for electronic documents and communications.
Sec. 144. Duties and authorities of affiliated persons.
Sec. 145. Agents and attorneys.
Sec. 146. Minors.
Sec. 147. Maintenance of certain protected health information.
Subtitle E—Enforcement
Sec. 151. Civil actions.
Sec. 152. Civil money penalties.
Sec. 153. Alternative dispute resolution.
Sec. 154. Amendments to criminal law.
TITLE II—AMENDMENTS TO TITLE 5, UNITED STATES CODE
Sec. 201. Amendments to title 5, United States Code.
TITLE III—REGULATIONS, RESEARCH, AND EDUCATION; EFFEC-
TIVE DATES; APPLICABILITY; AND RELATIONSHIP TO OTHER
LAWS
Sec. 301. Regulations; research and education.
Sec. 302. Effective dates.
Sec. 303. Applicability.
Sec. 304. Relationship to other laws.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds as follows:
(1) The right to privacy is a personal and fun-
damental right protected by the Constitution of the
United States.
(2) The improper use or disclosure of personally
identifiable health information about an individual
may cause significant harm to the interests of the
individual in privacy and health care, and may un-
fairly affect the ability of the individual to obtain
employment, education, insurance, credit, and other
necessities.
(3) Current legal protections for health infor-
mation vary from State to State and are inadequate
to meet the need for fair information practices
standards.
(4) The movement of individuals and health in-
formation across State lines, access to and exchange
of health information from automated data banks
and networks, and the emergence of multistate
health care providers and payors create a compelling
need for uniform Federal law, rules, and procedures
governing the use, maintenance, and disclosure of
health information.
(5) Uniform rules governing the use, mainte-
nance, and disclosure of health information are an
essential part of health care reform, are necessary to
support the computerization of health information,
and can reduce the cost of providing health services
by making the necessary transfer of health informa-
tion more efficient.
(6) An individual needs access to health infor-
mation about the individual as a matter of fairness,
to enable the individual to make informed decisions
about health care, and to correct inaccurate or in-
complete information.
(b) PURPOSES.—The purposes of this Act are as
follows:
(1) To define the rights of an individual with
respect to health information about the individual
that is created or maintained as part of the health
treatment and payment process.
(2) To define the rights and responsibilities of
a person who creates or maintains individually iden-
tifiable health information that originates or is used
in the health treatment or payment process.
(ii) a health benefit plan sponsor;
(iii) a health oversight agency; or
(iv) a public health authority;
(B) that relates in any way to the past,
present, or future physical or mental health or
condition or functional status of a protected in-
dividual, the provision of health care to a pro-
tected individual, or payment for the provision
of health care to a protected individual; and
(C) that—
(i) identifies the individual; or
(ii) with respect to which there is a
reasonable basis to believe that the infor-
mation can be used to identify the individ-
ual.
(4) PROTECTED INDIVIDUAL.—The term ‘‘pro-
tected individual’’ means an individual who, with re-
spect to a date—
(A) is living on the date; or
(B) has died within the 2-year period end-
ing on the date.
(5) USE.—The term ‘‘use’’, when used with re-
spect to protected health information that is held by
a health information trustee, means—
(A) to use, or provide access to, the infor-
mation in any manner that does not constitute
a disclosure; or
(B) any act or instance of using, or provid-
ing access, described in subparagraph (A).
(b) DEFINITIONS RELATING TO HEALTH INFORMA-
TION TRUSTEES.—For purposes of this Act:
(1) CARRIER.—The term ‘‘carrier’’ means a li-
censed insurance company, a hospital or medical
service corporation (including an existing Blue Cross
or Blue Shield organization, within the meaning of
section 833(c)(2) of the Internal Revenue Code of
1986), a health maintenance organization, or other
entity licensed or certified by a State to provide
health insurance or health benefits.
(2) 
HEALTH
BENEFIT
PLAN.—The 
term
‘‘health benefit plan’’ means—
(A) any contract of health insurance, in-
cluding any hospital or medical service policy or
certificate, hospital or medical service plan con-
tract, or health maintenance organization group
contract, that is provided by a carrier; and
(B) an employee welfare benefit plan or
other arrangement insofar as the plan or ar-
rangement provides health benefits and is fund-
ed in a manner other than through the pur-
chase of one or more policies or contracts de-
scribed in subparagraph (A).
(3) HEALTH
BENEFIT
PLAN
SPONSOR.—The
term ‘‘health benefit plan sponsor’’ means a person
who, with respect to a specific item of protected
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a carrier or other person providing a
health benefit plan, including any public entity
that provides payments for health care items
and services under a health benefit plan that
are equivalent to payments provided by a pri-
vate person under such a plan; or
(B) an officer or employee of a person de-
scribed in subparagraph (A).
(4) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who, with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses
the information while acting in whole or in part in
the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by law to pro-
vide an item or service that constitutes health
care in the ordinary course of business or prac-
tice of a profession;
(B) a Federal or State program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(5) HEALTH
INFORMATION
TRUSTEE.—The
term ‘‘health information trustee’’ means—
(A) a health care provider;
(B) a health oversight agency;
(C) a health benefit plan sponsor;
(D) a public health authority;
(E) a health researcher; or
(F) a person who, with respect to a spe-
cific item of protected health information, is not
described in subparagraphs (A) through (E) but
receives the information—
(i) pursuant to—
(I) section 117 (relating to emer-
gency circumstances);
(II) section 118 (relating to judi-
cial and administrative purposes);
(III) section 119 (relating to law
enforcement); or
(IV) section 120 (relating to sub-
poenas, warrants, and search war-
rants); or
(ii) while acting in whole or in part in
the capacity of an officer or employee of a
person described in clause (i).
(6) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
closes the information while acting in whole or in
part in the capacity of—
(A) a person who performs or oversees the
performance of an assessment, evaluation, de-
termination, or investigation relating to the li-
censing, accreditation, or certification of health
care providers;
(B) a person who—
(i) performs or oversees the perform-
ance of an audit, assessment, evaluation,
determination, or investigation relating to
the effectiveness of, compliance with, or
applicability of, legal, fiscal, medical, or
scientific standards or aspects of perform-
ance related to the delivery of, or payment
for, health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a State or Federal
statute regulating the assessment, evalua-
tion, determination, or investigation; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(7) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who, with respect to a
specific item of protected health information, re-
ceives the information—
(A) pursuant to section 116 (relating to
health research); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
(8) PUBLIC
HEALTH
AUTHORITY.—The term
‘‘public health authority’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
closes the information while acting in whole or in
part in the capacity of—
(A) an authority of the United States, a
State, or a political subdivision of a State that
is responsible for public health matters;
(B) a person acting under the direction of
such an authority; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(c) OTHER DEFINITIONS.—For purposes of this Act:
(1) AFFILIATED PERSON.—The term ‘‘affiliated
person’’ means a person who—
(A) is not a health information trustee;
(B) is a contractor, subcontractor, associ-
ate, or subsidiary of a person who is a health
information trustee; and
(C) pursuant to an agreement or other re-
lationship with such trustee, receives, creates,
uses, maintains, or discloses protected health
information.
(2) APPROVED HEALTH RESEARCH PROJECT.—
The term ‘‘approved health research project’’ means
a biomedical, epidemiological, or health services re-
search or statistics project, or a research project on
behavioral and social factors affecting health, that
has been approved by a certified institutional review
board.
(3) 
CERTIFIED
INSTITUTIONAL
REVIEW
BOARD.—The term ‘‘certified institutional review
board’’ means a board—
(A) established by an entity to review re-
search involving protected health information
and the rights of protected individuals con-
ducted at or supported by the entity;
(B) established in accordance with regula-
tions of the Secretary under section 116(d)(1);
and
(C) certified by the Secretary under section
116(d)(2).
(4) HEALTH CARE.—The term ‘‘health care’’—
(A) means—
(i) any preventive, diagnostic, thera-
peutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or proce-
dure—
(I) with respect to the physical or
mental condition, or functional status,
of an individual; or
(II) affecting the structure or
function of the human body or any
part of the human body, including
banking of blood, sperm, organs, or
any other tissue; or
(ii) any sale or dispensing of a drug,
device, equipment, or other item to an indi-
vidual, or for the use of an individual, pur-
suant to a prescription; but
(B) does not include any item or service
that is not furnished for the purpose of main-
taining or improving the health of an individual.
(5) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means a lawful investiga-
tion or official proceeding inquiring into a violation
of, or failure to comply with, any criminal or civil
statute or any regulation, rule, or order issued pur-
suant to such a statute.
(6) PERSON.—The term ‘‘person’’ includes an
authority of the United States, a State, or a political
subdivision of a State.
(7) SECRETARY.—The term ‘‘Secretary’’ means
the Secretary of Health and Human Services.
(8) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
TITLE I—FAIR HEALTH
INFORMATION PRACTICES
Subtitle A—Duties of Health
Information Trustees
SEC. 101. INSPECTION OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—Except as provided in subsection
(b), a health information trustee described in subsection
(g)—
(1) shall permit a protected individual to in-
spect any protected health information about the in-
dividual that the trustee maintains, any record with
respect to such information required under section
104, and any copy of an authorization required
under section 112 that pertains to such information;
(2) shall provide the protected individual with a
copy of the information, upon request by the individ-
ual and subject to any conditions imposed by the
trustee under subsection (d), in any form or format
requested by the individual, if the information is
readily reproducible by the trustee in such form or
format;
(3) shall permit a person who has been des-
ignated in writing by the protected individual to in-
spect the information on behalf of the individual or
to accompany the individual during the inspection;
and
(4) may offer to explain or interpret informa-
tion that is inspected or copied under this sub-
section.
(b) EXCEPTIONS.—A health information trustee is
not required by this section to permit inspection or copy-
ing of protected health information by a protected individ-
ual if any of the following conditions apply:
(1) INFORMATION ABOUT OTHERS.—The infor-
mation relates to an individual, other than the pro-
tected individual or a health care provider, and the
trustee determines in the exercise of reasonable pro-
fessional judgment that inspection or copying of the
information would cause sufficient harm to one or
both of the individuals so as to outweigh the desir-
ability of permitting access.
(2) ENDANGERMENT TO LIFE OR SAFETY.—In-
spection or copying of the information could reason-
ably be expected to endanger the life or physical
safety of an individual.
(3) CONFIDENTIAL SOURCE.—The information
identifies or could reasonably lead to the identifica-
tion of an individual (other than a health care pro-
vider) who provided information under a promise of
confidentiality to a health care provider concerning
a protected individual who is a subject of the infor-
mation.
(4) ADMINISTRATIVE PURPOSES.—The informa-
tion—
(A) is used by the trustee solely for admin-
istrative purposes and not in the provision of
health care to a protected individual who is a
subject of the information; and
(B) is not disclosed by the trustee to any
person.
(5) DUPLICATIVE INFORMATION.—The informa-
tion duplicates information available for inspection
under subsection (a).
(6) INFORMATION COMPILED IN ANTICIPATION
OF LITIGATION.—The information is compiled prin-
cipally—
(A) in anticipation of a civil, criminal, or
administrative action or proceeding; or
(B) for use in such an action or proceed-
ing.
(c) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee shall permit inspec-
tion and copying under subsection (a) of any reasonably
segregable portion of a record after deletion of any portion
that is exempt under subsection (b).
(d) CONDITIONS.—A health information trustee
may—
(1) require a written request for the inspection
and copying of protected health information under
this section; and
(2) charge a reasonable cost-based fee for—
(A) permitting inspection of information
under this section; and
(B) providing a copy of protected health
information under this section.
(e) STATEMENT OF REASONS FOR DENIAL.—If a
health information trustee denies in whole or in part a
request for inspection or copying under this section, the
trustee shall provide the protected individual who made
the request with a written statement of the reasons for
the denial.
(f) DEADLINE.—A health information trustee shall
comply with or deny a request for inspection or copying
of protected health information under this section within
the 30-day period beginning on the date the trustee re-
ceives the request.
(g) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health oversight agency; or
(4) a public health authority.
SEC. 102. AMENDMENT OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (f) shall, within the 45-day period
beginning on the date the trustee receives from a protected
individual about whom the trustee maintains protected
health information a written request that the trustee cor-
rect or amend the information, complete the duties de-
scribed in one of the following paragraphs:
(1) CORRECTION OR AMENDMENT AND NOTIFI-
CATION.—The trustee shall—
(A) make the correction or amendment re-
quested;
(B) inform the protected individual of the
amendment or correction that has been made;
(C) make reasonable efforts to inform any
person who is identified by the protected indi-
vidual, who is not an employee of the trustee,
and to whom the uncorrected or unamended
portion of the information was previously dis-
closed of the correction or amendment that has
been made; and
(D) at the request of the individual, make
reasonable efforts to inform any known source
of the uncorrected or unamended portion of the
information about the correction or amendment
that has been made.
(2) REASONS FOR REFUSAL AND REVIEW PRO-
CEDURES.—The trustee shall inform the protected
individual of—
(A) the reasons for the refusal of the trust-
ee to make the correction or amendment;
(B) any procedures for further review of
the refusal; and
(C) the individual’s right to file with the
trustee a concise statement setting forth the re-
quested correction or amendment and the indi-
vidual’s reasons for disagreeing with the refusal
of the trustee.
(b) STANDARDS
FOR
CORRECTION
OR
AMEND-
MENT.—A trustee shall correct or amend protected health
information in accordance with a request made under sub-
section (a) if the trustee determines that the information
is not accurate, relevant, timely, or complete for the pur-
poses for which the information may be used or disclosed
by the trustee.
(c) STATEMENT OF DISAGREEMENT.—After a pro-
tected individual has filed a statement of disagreement
under subsection (a)(2)(C), the trustee, in any subsequent
disclosure of the disputed portion of the information, shall
include a copy of the individual’s statement and may in-
clude a concise statement of the trustee’s reasons for not
making the requested correction or amendment.
(d) CONSTRUCTION.—This section may not be con-
strued to require a health information trustee to conduct
a hearing or proceeding concerning a request for a correc-
tion or amendment to protected health information the
trustee maintains.
(e) CORRECTION.—For purposes of subsection (a), a
correction is deemed to have been made to protected
health information when—
(1) information that is not timely, accurate, rel-
evant, or complete is clearly marked as incorrect; or
(2) supplementary correct information is made
part of the information and adequately cross-ref-
erenced.
(f) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health oversight agency; or
(4) a public health authority.
SEC. 103. NOTICE OF INFORMATION PRACTICES.
(a) PREPARATION OF NOTICE.—A health information
trustee described in subsection (d) shall prepare a written
notice of information practices describing the following:
(1) The rights under this Act of a protected in-
dividual who is the subject of protected health infor-
mation, including the right to inspect and copy such
information and the right to seek amendments to
such information, and the procedures for authorizing
disclosures of protected health information and for
revoking such authorizations.
(2) The procedures established by the trustee
for the exercise of such rights.
(3) The uses and disclosures of protected health
information that are authorized under this Act.
(b) DISSEMINATION OF NOTICE.—A health informa-
tion trustee—
(1) shall, upon request, provide any person with
a copy of the trustee’s notice of information prac-
tices (described in subsection (a)); and
(2) shall make reasonable efforts to inform per-
sons in a clear and conspicuous manner of the exist-
ence and availability of such notice.
(c) MODEL NOTICES.—Not later than July 1, 1999,
the Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate model notices of infor-
mation practices for use by health information trustees
under this section.
(d) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider; or
(3) a health oversight agency.
SEC. 104. DISCLOSURE HISTORY.
(a) IN GENERAL.—Except as provided in subsection
(b) and section 114, each health information trustee shall
(2) to protect against any reasonably antici-
pated—
(A) threats or hazards to the security or
integrity of the information; and
(B) unauthorized uses or disclosures of the
information; and
(3) otherwise ensure compliance with this Act
by the trustee and the officers and employees of the
trustee.
(b) GUIDELINES.—Not later than July 1, 1999, the
Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate guidelines for the im-
plementation of this section. The guidelines shall take into
account—
(1) the technical capabilities of record systems
used to maintain protected health information;
(2) the costs of security measures;
(3) the need for training persons who have ac-
cess to protected health information; and
(4) the value of audit trails in computerized
record systems.
Subtitle B—Use and Disclosure of
Protected Health Information
SEC. 111. GENERAL LIMITATIONS ON USE AND DISCLO-
SURE.
(a) USE.—Except as otherwise provided under this
Act, a health information trustee may use protected health
information only for a purpose—
(1) that is compatible with and directly related
to the purpose for which the information—
(A) was collected; or
(B) was received by the trustee; or
(2) for which the trustee is authorized to dis-
close the information under this Act.
(b) DISCLOSURE.—A health information trustee may
disclose protected health information only as authorized
under this Act.
(c) SCOPE OF USES AND DISCLOSURES.—
(1) IN GENERAL.—A use or disclosure of pro-
tected health information by a health information
trustee shall be limited, when practicable, to the
minimum amount of information necessary to ac-
complish the purpose for which the information is
used or disclosed.
(2) GUIDELINES.—Not later than July 1, 1999,
the Secretary, after notice and opportunity for pub-
lic comment, shall issue guidelines to implement
paragraph (1), which shall take into account the
technical capabilities of the record systems used to
maintain protected health information and the costs
of limiting use and disclosure.
(d) IDENTIFICATION OF DISCLOSED INFORMATION
AS PROTECTED INFORMATION.—Except with respect to
protected health information that is disclosed under sec-
tion 114 (relating to next of kin and directory informa-
tion), a health information trustee may disclose protected
health information only if the recipient has been notified
that the information is protected health information that
is subject to this Act.
(e) AGREEMENT TO LIMIT USE OR DISCLOSURE.—
A health information trustee who receives protected health
information from any person pursuant to a written agree-
ment to restrict use or disclosure of the information to
a greater extent than otherwise would be required under
this Act shall comply with the terms of the agreement,
except where use or disclosure of the information in viola-
tion of the agreement is required by law. A trustee who
fails to comply with the preceding sentence shall be subject
to section 151 (relating to civil actions) with respect to
such failure.
(f) NO GENERAL REQUIREMENT TO DISCLOSE.—
Nothing in this Act shall be construed to require a health
information trustee to disclose protected health informa-
tion not otherwise required to be disclosed by law.
SEC. 112. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION.
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee may disclose protected health information
pursuant to an authorization executed by the protected in-
dividual who is the subject of the information, if each of
the following requirements is satisfied:
(1) WRITING.—The authorization is in writing,
signed by the individual, and dated on the date of
such signature.
(2) SEPARATE FORM.—The authorization is not
on a form used to authorize or facilitate the provi-
sion of, or payment for, health care.
(3) TRUSTEE DESCRIBED.—The trustee is spe-
cifically named or generically described in the au-
thorization as authorized to disclose such informa-
tion.
(4) RECIPIENT
DESCRIBED.—The person to
whom the information is to be disclosed is specifi-
cally named or generically described in the author-
ization as a person to whom such information may
be disclosed.
(5) STATEMENT OF INTENDED USES AND DIS-
CLOSURES
RECEIVED.—The authorization contains
an acknowledgment that the individual has received
a statement described in subsection (b) from such
person.
(6) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is described in the authorization.
(7) AUTHORIZATION TIMELY RECEIVED.—The
authorization is received by the trustee during a pe-
riod described in subsection (c)(1).
(8) DISCLOSURE
TIMELY
MADE.—The disclo-
sure occurs during a period described in subsection
(c)(2).
(b) STATEMENT OF INTENDED USES AND DISCLO-
SURES.—
(1) IN GENERAL.—A person who wishes to re-
ceive from a health information trustee protected
health information about a protected individual pur-
suant to an authorization executed by the individual
shall supply the individual, in writing and on a form
that is distinct from the authorization, with a state-
ment of the uses for which the person intends the
information and the disclosures the person intends
to make of the information. Such statement shall be
supplied before the authorization is executed.
(2) ENFORCEMENT.—If the person uses or dis-
closes the information in a manner that is inconsist-
ent with such statement, the person shall be subject
to section 151 (relating to civil actions) with respect
to such failure, except where such use or disclosure
is required by law.
(3) MODEL STATEMENTS.—Not later than July
1, 1999, the Secretary, after notice and opportunity
for public comment, shall develop and disseminate
model statements of intended uses and disclosures of
the type described in paragraph (1).
(c) TIME LIMITATIONS ON AUTHORIZATIONS.—
(1) RECEIPT BY TRUSTEE.—For purposes of
subsection (a)(7), an authorization is timely received
if it is received by the trustee during—
(A) the 1-year period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to—
(i) a health benefit plan sponsor;
(ii) a health care provider;
(iii) a health oversight agency;
(iv) a public health authority;
(v) a health researcher; or
(vi) a person who provides counseling
or social services to individuals; or
(B) the 30-day period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to a
person other than a person described in sub-
paragraph (A).
(2) DISCLOSURE BY TRUSTEE.—For purposes
of subsection (a)(8), a disclosure is timely made if
it occurs before—
(A) the date or event (if any) specified in
the authorization upon which the authorization
expires; and
(B) the expiration of the 6-month period
beginning on the date the trustee receives the
authorization.
(d) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN
GENERAL.—A protected individual in
writing may revoke or amend an authorization de-
scribed in subsection (a), in whole or in part, at any
time, except insofar as—
(A) disclosure of protected health informa-
tion has been authorized to permit validation of
expenditures based on health condition by a
government authority; or
(B) action has been taken in reliance on
the authorization.
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
mation in reliance on an authorization that has been
revoked shall not be subject to any liability or pen-
alty under this Act if—
(A) the reliance was in good faith;
(B) the trustee had no notice of the rev-
ocation; and
(C) the disclosure was otherwise in accord-
ance with the requirements of this section.
(e) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A
health information trustee may impose requirements for
an authorization that are in addition to the requirements
in this section.
(f) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization.
(g) CONSTRUCTION.—This section may not be con-
strued—
(1) to require a health information trustee to
disclose protected health information; or
(2) to limit the right of a health information
trustee to charge a fee for the disclosure or repro-
duction of protected health information.
(h) SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.—If a health information trustee discloses pro-
tected health information pursuant to an authorization in
order to comply with an administrative subpoena or war-
rant or a judicial subpoena or search warrant, the author-
ization—
(1) shall specifically authorize the disclosure for
the purpose of permitting the trustee to comply with
the subpoena, warrant, or search warrant; and
(2) shall otherwise meet the requirements in
this section.
SEC. 113. TREATMENT, PAYMENT, AND OVERSIGHT.
(a) DISCLOSURES
BY
PLANS, PROVIDERS, AND
OVERSIGHT AGENCIES.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation to a health benefit plan sponsor, health care
provider, or health oversight agency if the disclosure is—
(1) for the purpose of providing health care and
a protected individual who is a subject of the infor-
mation has not previously objected to the disclosure
in writing;
(2) for the purpose of providing for the pay-
ment for health care furnished to an individual; or
(3) for use by a health oversight agency for a
purpose that is described in subparagraph (A) or
(B)(i) of section 3(b)(6).
(b) DISCLOSURES BY CERTAIN OTHER TRUSTEES.—
A health information trustee may disclose protected health
information to a health care provider if—
(1) the disclosure is for the purpose described
in subsection (a)(1); and
(2) the trustee—
(A) is a public health authority;
(B) received protected health information
pursuant to section 117 (relating to emergency
circumstances); or
(C) is an officer or employee of a trustee
described in subparagraph (B).
(c) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and related to receipt of health care or pay-
ment for health care.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
SEC. 114. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—A health information trustee who
is a health care provider, who received protected health
information pursuant to section 117 (relating to emer-
gency circumstances), or who is an officer or employee of
such a recipient may orally disclose protected health infor-
mation about a protected individual to the next of kin of
the individual (as defined under State law), or to a person
with whom the individual has a close personal relationship,
if—
(1) the trustee has no reason to believe that the
individual would consider the information especially
sensitive;
(2) the individual has not previously objected to
the disclosure;
(3) the disclosure is consistent with good medi-
cal or other professional practice; and
(4) the information disclosed is limited to infor-
mation about health care that is being provided to
the individual at or about the time of the disclosure.
(b) DIRECTORY INFORMATION.—
(1) IN GENERAL.—A health information trustee
who is a health care provider, who received protected
health information pursuant to section 117 (relating
to emergency circumstances), or who is an officer or
employee of such a recipient may disclose to any
person the information described in paragraph (2)
if—
(A) a protected individual who is a subject
of the information has not objected in writing
to the disclosure;
(B) the disclosure is otherwise consistent
with good medical and other professional prac-
tice; and
(C) the information does not reveal specific
information about the physical or mental condi-
tion or functional status of a protected individ-
ual or about the health care provided to a pro-
tected individual.
(2) INFORMATION
DESCRIBED.—The informa-
tion referred to in paragraph (1) is the following:
(A) The name of an individual receiving
health care from a health care provider on a
premises controlled by the provider.
(B) The location of the individual on such
premises.
(C) The general health status of the indi-
vidual, described in terms of critical, poor, fair,
stable, satisfactory, or terms denoting similar
conditions.
(c) NO DISCLOSURE RECORD REQUIRED.—A health
information trustee who discloses protected health infor-
mation under this section is not required to create and
maintain a record of the disclosure under section 104.
(d) RECIPIENTS.—A person to whom protected
health information is disclosed under this section shall not,
by reason of such disclosure, be subject to any require-
ment under this Act.
SEC. 115. PUBLIC HEALTH.
(a) IN GENERAL.—A health information trustee who
is a health care provider or a public health authority may
disclose protected health information to—
(1) a public health authority for use in legally
authorized—
(A) disease or injury reporting;
(B) public health surveillance; or
(C) public health investigation or interven-
tion; or
(2) an individual who is authorized by law to
receive the information in a public health interven-
tion.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A public
health authority who receives protected health information
about a protected individual through a disclosure under
this section may not use or disclose the information in any
administrative, civil, or criminal action or investigation di-
rected against the individual, except where the use or dis-
closure is authorized by law for protection of the public
health.
(c) INDIVIDUAL
RECIPIENTS.—An individual to
whom protected health information is disclosed under sub-
section (a)(2) shall not, by reason of such disclosure, be
subject to any requirement under this Act.
SEC. 116. HEALTH RESEARCH.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (c) may disclose protected health in-
formation to a person if—
(1) the person is conducting an approved health
research project;
(2) the information is to be used in the project;
and
(3) the project has been determined by a cer-
tified institutional review board to be—
(A) of sufficient importance so as to out-
weigh the intrusion into the privacy of the pro-
tected individual who is the subject of the infor-
mation that would result from the disclosure;
and
(B) impracticable to conduct without the
information.
(b) LIMITATIONS ON USE AND DISCLOSURE; OBLIGA-
TIONS OF RECIPIENT.—A health researcher who receives
protected health information about a protected individual
pursuant to subsection (a)—
(1) may use the information solely for purposes
of an approved health research project;
(2) may not use or disclose the information in
any administrative, civil, or criminal action or inves-
tigation directed against the individual; and
(f) STANDARD FOR DECISION.—A court may deny a
motion under subsection (a) if it finds that there is prob-
able cause to believe that the protected health information
being sought is relevant to a legitimate law enforcement
inquiry being conducted by the government authority, un-
less the court finds that the individual’s privacy interest
outweighs the government authority’s need for the infor-
mation. The individual shall have the burden of dem-
onstrating that the individual’s privacy interest outweighs
the need established by the government authority for the
information.
(g) SPECIFIC CONSIDERATIONS WITH RESPECT TO
PRIVACY INTEREST.—In determining under subsection (f)
whether an individual’s privacy interest outweighs the gov-
ernment authority’s need for the information, the court
shall consider—
(1) the particular purpose for which the infor-
mation was collected by the trustee;
(2) the degree to which disclosure of the infor-
mation will embarrass, injure, or invade the privacy
of the individual;
(3) the effect of the disclosure on the individ-
ual’s future health care;