I 
106TH CONGRESS 
1ST SESSION H. R. 2878 
To protect the privacy of health information in the age of genetic and 
other new technologies, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 15, 1999 
Mr. MCDERMOTT (for himself, Mr. STARK, Mr. RUSH, Mr. ROMERO- 
BARCELO´, Mrs. MINK of Hawaii, Mr. FROST, Mr. NADLER, Ms. SLAUGH-
TER, Mr. LEWIS of Georgia, Mr. FRANK of Massachusetts, Mr. HINCHEY, 
and Mr. WEINER) introduced the following bill; which was referred to the 
Committee on Commerce, and in addition to the Committee on Govern-
ment Reform, for a period to be subsequently determined by the Speaker, 
in each case for consideration of such provisions as fall within the juris-
diction of the committee concerned 
A BILL 
To protect the privacy of health information in the age 
of genetic and other new technologies, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Medical Privacy in the Age of New Technologies Act of 
1999’’. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Findings and purposes. 
Sec. 3. Definitions. 
TITLE I—INDIVIDUALS’ RIGHTS 
Subtitle A—Review of Protected Health Information by Subjects of the 
Information 
Sec. 101. Inspection and copying of protected health information. 
Sec. 102. Correction or amendment of protected health information. 
Sec. 103. Notice of information practices. 
Subtitle B—Establishment of Safeguards 
Sec. 111. Establishment of safeguards. 
Sec. 112. Accounting for disclosures. 
Sec. 113. Prohibition against retaliation. 
TITLE II—RESTRICTIONS ON USE AND DISCLOSURE 
Sec. 201. General rules regarding use and disclosure. 
Sec. 202. Authorizations for disclosure of protected health information for 
treatment or payment. 
Sec. 203. Authorizations for disclosure of protected health information for pur-
poses other than treatment or payment. 
Sec. 204. Creation of nonidentifiable and coded information. 
Sec. 205. Next of kin and directory information. 
Sec. 206. Emergency circumstances. 
Sec. 207. Oversight. 
Sec. 208. Accreditation. 
Sec. 209. Public health. 
Sec. 210. Health research. 
Sec. 211. Judicial and administrative purposes. 
Sec. 212. General requirements governing subpoenas. 
Sec. 213. Additional requirements for law enforcement access. 
TITLE III—SANCTIONS 
Subtitle A—Civil Sanctions 
Sec. 301. Civil penalty. 
Sec. 302. Civil action. 
Subtitle B—Criminal Sanctions 
Sec. 311. Wrongful disclosure of protected health information. 
TITLE IV—MISCELLANEOUS 
Sec. 401. Regulations. 
Sec. 402. Relationship to other laws. 
Sec. 403. Effective dates. 
Sec. 404. Applicability. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(B) the power to challenge the accuracy 
and completeness of, and amend or correct, 
records containing such information. 
(4) To establish a minimum Federal standard 
for the protection of health information which will 
promote confidentiality while allowing efficient 
transfer of health information between States. 
(5) To help ensure the confidentiality of com-
puterized or electronically transferred health infor-
mation. 
(6) To restrict the gathering of aggregate 
health information for financial gain or other pur-
poses without each subject’s knowledge or consent. 
(7) To establish strong and effective remedies 
for violations of this Act. 
SEC. 3. DEFINITIONS. 
As used in this Act: 
(1) ACCREDITING
BODY.—The term ‘‘accred-
iting body’’ means a body, committee, organization, 
or institution that has been authorized by law, or is 
recognized by a health care regulating authority, 
with 
respect 
to 
accreditation, 
licensing, 
or 
credentialing of health care providers or health care 
facilities. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(2) CODED HEALTH INFORMATION.—The term 
‘‘coded health information’’ means any protected 
health information— 
(A) in which all identifying information 
has been replaced by a unique identifier, and 
where neither the remaining information nor 
the unique identifier, on its face, identifies an 
individual; 
(B) which cannot easily be used or manip-
ulated in a manner that reveals the identity of 
an individual; and 
(C) which can only be linked or matched to 
other information in a manner that reveals the 
identity of an individual by a person authorized 
to carry out such functions under section 204. 
(3) DISCLOSE.—The term ‘‘disclose’’ when used 
with respect to protected health information that is 
held by a health information trustee, means to re-
lease, transfer, provide access to, or otherwise di-
vulge the information to any person other than an 
individual who is the subject of the information. 
Such term includes the placement of protected 
health information into a computerized data base, 
networked computer system, or any other electronic 
or magnetic data system, that more than one person 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
may access by any means. Such term does not in-
clude oral communication between an individual who 
is the subject of protected health information and a 
health care provider delivering health care to such 
individual. 
(4) ELECTRONIC.—The term ‘‘electronic’’, when 
used with reference to information, means— 
(A) in electronic or magnetic form; 
(B) in an optical storage form; 
(C) computer-based; 
(D) computer-associated; or 
(E) in some other form that— 
(i) is appropriate for non-paper-based 
information processing or storage; and 
(ii) exists on the date of the enact-
ment of this Act or is developed subse-
quent to such date. 
(5) HEALTH CARE.—The term ‘‘health care’’ 
means— 
(A) any sale or dispensing of a drug, de-
vice, equipment, or other item to an individual, 
or for the use of an individual, pursuant to a 
prescription; and 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(B) any preventive, predictive, diagnostic, 
therapeutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or procedure— 
(i) with respect to the physical or 
mental condition of an individual; or 
(ii) affecting the structure or function 
of the human body or any part of the 
human body, including individual cells and 
their components. 
(6) HEALTH
CARE
PROVIDER.—The term 
‘‘health care provider’’ means a person who, with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses 
the information while acting in whole or in part in 
the capacity of— 
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by law to pro-
vide an item or service that constitutes health 
care, in the ordinary course of business or prac-
tice of a profession; or 
(B) a Federal or State program that di-
rectly provides items or services that constitute 
health care to beneficiaries. 
(7) HEALTH
INFORMATION
TRUSTEE.—The 
term ‘‘health information trustee’’ means— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(A) a person who is a health care provider, 
health plan, health oversight agency, public 
health authority, health researcher, employer, 
insurer, school, institution of higher education, 
or insurance support organization, insofar as 
the person creates, receives, obtains, maintains, 
uses, or transmits protected health information; 
or 
(B) any employee, agent, or contractor of 
a person described in subparagraph (A), insofar 
as the employee, agent, or contractor creates, 
receives, obtains, maintains, uses, or transmits 
protected health information. 
(8) HEALTH OVERSIGHT AGENCY.—The term 
‘‘health oversight agency’’ means a person who— 
(A) performs or oversees the performance 
of an assessment, investigation, or prosecution 
relating to— 
(i) compliance with legal or fiscal 
standards pertinent to health care fraud, 
including 
fraudulent 
claims 
regarding 
health care, health services or equipment, 
or related activities and items; or 
(ii) the protection of individuals from 
harm, abuse, neglect, or exploitation; and 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(B) is a public agency, acting on behalf of 
a public agency, acting pursuant to a require-
ment of a public agency, or carrying out activi-
ties under a Federal or State law governing an 
assessment, investigation, or prosecution de-
scribed in subparagraph (A). 
(9) HEALTH PLAN.—The term ‘‘health plan’’ 
means any health insurance plan, including any hos-
pital or medical service plan, dental or other health 
service plan or health maintenance organization 
plan, or other program providing payment for health 
care, whether or not funded through the purchase of 
insurance. 
(10) HEALTH RESEARCHER.—The term ‘‘health 
researcher’’ means a person who conducts, using 
protected health information, a systematic investiga-
tion, or research development, testing, or evaluation, 
to develop or contribute to scientific or medical 
knowledge. 
(11) INDIVIDUAL REPRESENTATIVE.—The term 
‘‘individual representative’’ means any individual le-
gally empowered to make decisions concerning the 
provision of health care to an individual (where the 
individual lacks the legal capacity under State law to 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
make such decisions) or the administrator or execu-
tor of the estate of a deceased individual. 
(12) INSURANCE SUPPORT ORGANIZATION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), the term ‘‘insurance support organi-
zation’’ means any person who regularly en-
gages, in whole or in part, in the practice of as-
sembling and providing information about indi-
viduals to an insurer or health plan for insur-
ance transactions, including— 
(i) the furnishing of consumer reports 
or investigative consumer reports to an in-
surer or health plan for use in connection 
with an insurance transaction; or 
(ii) the collection of personal informa-
tion from insurers, health plans, or other 
insurance support organizations for the 
purpose of detecting or preventing fraud or 
material misrepresentation in connection 
with insurance underwriting or insurance 
claim activity. 
(B) PERSONS
EXCLUDED.—Such term 
does not include any person who is treated as 
a health information trustee under any other 
provision of this Act. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(13) LAW ENFORCEMENT INQUIRY.—The term 
‘‘law enforcement inquiry’’ means an official law en-
forcement investigation or proceeding inquiring into 
a violation of, or failure to comply with, any law. 
(14) NONIDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘nonidentifiable health informa-
tion’’ means information that would be protected 
health information, except that— 
(A) it is impossible to ascertain, based on 
the information, or on any codes or identifiers 
related to the information, the identity of any 
individual whose health or condition is the sub-
ject of the information; and 
(B) it cannot be linked or matched by a 
foreseeable method to any other information 
that pertains to any such individual. 
(15) PERSON.—The term ‘‘person’’ means any 
of the following: 
(A) An individual. 
(B) A government. 
(C) A governmental subdivision, agency or 
authority. 
(D) A corporation. 
(E) A company. 
(F) An association. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(G) A firm. 
(H) A partnership. 
(I) A society. 
(J) An estate. 
(K) A trust. 
(L) A joint venture. 
(M) An individual representative. 
(N) Any other legal entity. 
(16) PROTECTED HEALTH INFORMATION.—The 
term ‘‘protected health information’’ means any in-
formation, including information derived from a bio-
logical sample from the human body and demo-
graphic information about an individual, whether 
oral or recorded in any form or medium, that— 
(A) is created or received by a health infor-
mation trustee or an accrediting body; 
(B) relates to— 
(i) the past, present, or future phys-
ical or mental health, predisposition, or 
condition of an individual, or individuals 
related by blood to the individual; 
(ii) the provision of health care to an 
individual; or 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(iii) the past, present, or future pay-
ment for the provision of health care to an 
individual; and 
(C)(i) identifies such individual; 
(ii) with respect to which there is a reason-
able basis to believe that the information can be 
used to identify such individual; or 
(iii) could be linked or matched by a fore-
seeable method to any other information which 
pertains to such individual. 
(17) 
PROTECTED
HEALTH
INFORMATION 
SUBFILE.—The term ‘‘protected health information 
subfile’’ means any amount of protected health in-
formation which is segregated pursuant to section 
201(c). 
(18) PUBLIC HEALTH AUTHORITY.—The term 
‘‘public health authority’’ means an authority or in-
strumentality of the United States, a State, or a po-
litical subdivision of a State that— 
(A) is charged by statute with responsi-
bility for public health matters; and 
(B) is engaged in such activities as injury 
reporting, public health surveillance, and public 
health investigation or intervention. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(19) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Health and Human Services. 
(20) STATE.—The term ‘‘State’’ includes the 
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern 
Mariana Islands. 
(21) WRITING.—The term ‘‘writing’’ means 
writing in either a paper-based or electronic form. 
TITLE I—INDIVIDUALS’ RIGHTS 
Subtitle A—Review of Protected 
Health Information by Subjects 
of the Information 
SEC. 101. INSPECTION AND COPYING OF PROTECTED 
HEALTH INFORMATION. 
(a) IN GENERAL.—Except as provided in subsections 
(b) and (h), a health information trustee shall permit an 
individual who is the subject of protected health informa-
tion, or the individual’s designee, to inspect and copy pro-
tected health information concerning the individual, in-
cluding records created under section 102, that the trustee 
maintains. A health information trustee may require an 
individual to reimburse the trustee for the reasonable cost 
of such inspection and copying. 
(b) EXCEPTION.— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(1) IN GENERAL.—A health care provider who 
is delivering, or has delivered, health care to an indi-
vidual who is the subject of protected health infor-
mation relating to such health care is not required 
by this section to permit inspection or copying of the 
information, where such inspection or copying rea-
sonably could be expected to endanger the life or 
physical or mental safety of any individual. 
(2) ALTERNATIVE DISCLOSURE.—In any case 
where a health care provider determines that the 
provider, pursuant to paragraph (1), will not permit 
an individual to inspect or copy protected health in-
formation, the provider may permit inspection or 
copying by the individual’s designee. 
(c) DENIAL OF A REQUEST FOR INSPECTION OR 
COPYING.—If a health information trustee denies a re-
quest for inspection or copying under subsection (b), the 
trustee shall inform the individual in writing of— 
(1) the reasons for the denial of the request; 
(2) any procedures for further review of the de-
nial; and 
(3) the individual’s right to file with the trust-
ee, if the individual so wishes, a concise statement 
setting forth the request for inspection or copying. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(d) STATEMENT REGARDING REQUEST.—If an indi-
vidual has filed a statement under subsection (c)(3) set-
ting forth the request, the health information trustee in 
any subsequent disclosure of the portion of the informa-
tion requested shall include— 
(1) a copy of the individual’s statement; and 
(2) a concise statement of the reasons for deny-
ing the request for inspection or copying. 
(e) RULE OF CONSTRUCTION.—This section shall not 
be construed to require a health information trustee to 
conduct a formal, informal, or other hearing or proceeding 
concerning a request for inspection or copying of protected 
health information. 
(f) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee shall permit inspec-
tion and copying under subsection (a) of any reasonably 
segregable portion of a record after deletion of any portion 
that is exempt under subsection (b). 
(g) DEADLINE.—A health information trustee shall 
comply with or deny, in accordance with subsection (c), 
a request for inspection or copying of protected health in-
formation under this section within the 30-day period be-
ginning on the date on which the trustee receives the re-
quest. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(h) RULES GOVERNING AGENTS
AND CONTRAC-
TORS.— 
(1) IN GENERAL.—A person acting in the ca-
pacity of an agent or contractor of a health care 
provider, health plan, health oversight agency, public 
health authority, health researcher, employer, in-
surer, school, institution of higher education, or in-
surance support organization is not responsible for 
providing for the inspection or copying of protected 
health information under this section, except when 
the agent or contractor has been notified by their 
principal that a request for inspection or copying 
has been made to the principal under section (a) and 
has not been denied under section (b). 
(2) CODED
HEALTH
INFORMATION.—In any 
case where a person acting in the capacity of an 
agent or contractor of a health care provider, health 
plan, health oversight agency, public health author-
ity, health researcher, employer, insurer, school, in-
stitution of higher education, or insurance support 
organization is requested to provide for the inspec-
tion or copying of coded health information under 
this section, the person shall inform the individual 
making the request that the individual should con-
tact a person authorized under section 204 to link 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
or match the coded health information to reveal the 
identity of the individual who is the subject of the 
information. 
SEC. 102. CORRECTION OR AMENDMENT OF PROTECTED 
HEALTH INFORMATION. 
(a) IN GENERAL.—Unless proceeding under sub-
section (b), and except as provided in subsection (f), a 
health information trustee, within the 45-day period be-
ginning on the date on which the trustee receives from 
an individual a written request to correct or amend pro-
tected health information about the individual— 
(1) shall make the correction or amendment re-
quested; 
(2) shall inform the individual of the correction 
or amendment that has been made; and 
(3) shall make reasonable efforts to inform any 
person who is identified by the individual, and to 
whom the uncorrected or unamended portion of the 
information was previously disclosed, of the correc-
tion or amendment that has been made. 
(b) REFUSAL TO CORRECT
OR AMEND.—If the 
health information trustee refuses to make the correction 
or amendment, the trustee shall inform the individual, 
within the 45-day period beginning on the date on which 
the trustee receives the individual’s request, of— 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(1) the reasons for the refusal to make the cor-
rection or amendment; 
(2) any procedures for further review of the re-
fusal; and 
(3) the individual’s right to file with the trust-
ee, if the individual so wishes, a concise statement 
setting forth the requested correction or amendment 
and the individual’s reasons for disagreeing with the 
refusal. 
(c) STATEMENT
OF DISAGREEMENT.—If an indi-
vidual has filed a statement of disagreement under sub-
section (b)(3), the health information trustee in any subse-
quent disclosure of the disputed portion of the informa-
tion— 
(1) shall include a copy of the individual’s 
statement; and 
(2) shall include a concise statement of the rea-
sons for not making the requested correction or 
amendment. 
(d) RULE OF CONSTRUCTION.—This section shall not 
be construed to require a health information trustee to 
conduct a formal, informal, or other hearing or proceeding 
concerning a request for a correction or amendment to 
protected health information. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(e) CORRECTION.—For purposes of subsection (a), a 
correction is deemed to have been made to protected 
health information when information that has been dis-
puted by an individual has been corrected, clearly marked 
as incorrect, or supplemented by correct information. 
(f) RULES GOVERNING AGENTS
AND CONTRAC-
TORS.—A person acting in the capacity of an agent or con-
tractor of a health care provider, health plan, health over-
sight agency, public health authority, health researcher, 
employer, insurer, school, institution of higher education, 
or insurance support organization is not authorized to 
make corrections or amendments to protected health infor-
mation received from their principal, except when the 
agent or contractor has been asked by the principal to ful-
fill the principal’s obligations under this section. 
SEC. 103. NOTICE OF INFORMATION PRACTICES. 
(a) PREPARATION OF WRITTEN NOTICE.—A health 
information trustee shall prepare and provide, in accord-
ance with subsection (b), a written notice containing the 
following: 
(1) INDIVIDUALS’ RIGHTS.—A description of 
the following rights of an individual who is a subject 
of protected health information maintained by the 
trustee: 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(A) The right of the individual to request 
segregation of protected health information, and 
to restrict the use of such information by em-
ployees, agents, and contractors of the trustee, 
under section 201(c). 
(B) The right of the individual to inspect, 
copy, amend, and correct the protected health 
information under sections 101 and 102. 
(C) The right of the individual to object to 
the disclosure of the information to next of kin 
or in directory information under section 205. 
(D) The circumstances under which the in-
formation may be used or disclosed without an 
authorization executed by the individual. 
(E) The right of the individual not to have 
employment or the receipt of services condi-
tioned upon the execution by the individual of 
an authorization for disclosure or use for any 
purpose other than treatment or payment. 
(F) The procedures the individual must 
follow in order to exercise the foregoing rights. 
(2) TRUSTEE INFORMATION PRACTICES.—A de-
scription of the trustee’s health information prac-
tices, including the safeguards and practices used to 
protect such information. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
(b) AVAILABILITY
OF NOTICE
TO SUBJECTS.—A 
health information trustee shall provide a copy of a notice 
prepared under this section to an individual who is a sub-
ject of protected health information— 
(1) along with any request for authorization to 
use or disclose the information created pursuant to 
section 202 or 203 and presented by the trustee to 
the individual for execution; 
(2) at the first practicable opportunity after the 
trustee uses or discloses the information without an 
authorization executed by the individual; 
(3) at the first practicable opportunity after a 
health information trustee commences the collection 
of the information; or 
(4) when the individual requests to inspect, 
copy, correct, or amend their protected health infor-
mation pursuant to section 101 or 102. 
Subtitle B—Establishment of 
Safeguards 
SEC. 111. ESTABLISHMENT OF SAFEGUARDS. 
(a) IN GENERAL.—A health information trustee shall 
establish and maintain appropriate administrative, tech-
nical, and physical safeguards to ensure the confiden-
tiality, security, accuracy, and integrity of protected health 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
information created, received, obtained, maintained, used 
or transmitted by the trustee. 
(b) SAFEGUARDS FOR ELECTRONIC INFORMATION.— 
(1) APPLICATION AND CONSTRUCTION.— 
(A) APPLICATION.—This subsection ap-
plies only with respect to protected health infor-
mation that is electronic. 
(B) CONSTRUCTION.—Nothing in this Act 
shall be construed to require that protected 
health information be created, received, main-
tained, used, or disclosed in electronic form. 
(2) REQUIREMENTS FOR ELECTRONIC MAINTE-
NANCE, USE, AND
DISCLOSURE.—The Secretary 
shall develop, and by regulation impose on health in-
formation trustees, requirements for the electronic 
maintenance, use, and disclosure of protected health 
information. Such requirements shall include the fol-
lowing: 
(A) CONTROL OF ACCESS TO PROTECTED 
HEALTH INFORMATION.— 
(i) IN GENERAL.—A health informa-
tion trustee shall implement controls with 
respect to access to electronic protected 
health information. The trustee may grant 
a request by any person for access to such 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
information for use by the health informa-
tion trustee, or for disclosure to another 
health information trustee, only after 
verifying that— 
(I) the person making the re-
quest can prove their identity; and 
(II) the proposed use of the pro-
tected health information, or the re-
quested 
disclosure, 
is 
authorized 
under this Act. 
(ii) AUTHENTICATION
OF
IDENTITY 
OF
REQUESTERS.—A health information 
trustee shall use a method of verification 
to verify the identity of persons requesting 
access to electronic protected health infor-
mation. A health information trustee who 
issues a device that verifies the identity of 
a person making a request for information 
for purposes of this clause shall instruct 
the person in the proper care and use of 
the device and shall require the person to 
protect the device from misuse. Any system 
used by a health information trustee to 
maintain verification information collected 
under this clause shall prevent the disclo-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
sure of such verification information to any 
person other than a person who is specifi-
cally authorized to receive such informa-
tion. 
(B) ACCESS FOR USE BY HEALTH INFOR-
MATION TRUSTEE.—A health information trust-
ee shall limit the persons who may use pro-
tected health information created or maintained 
by the trustee in electronic form to persons spe-
cifically authorized by the trustee to use such 
information consistent with this Act. 
(C) DISCLOSURE TO OTHERS.— 
(i) PROTECTION
OF
REQUESTS
FOR 
DISCLOSURE
AND
RESPONSES.—A health 
information trustee who requests, using 
electronic means, to receive protected 
health information, or who responds, using 
electronic means, to such a request, shall 
implement procedures to prevent the inter-
ception of such request or response by per-
sons who are not authorized to intercept it. 
(ii) IDENTIFICATION OF SUBJECT.—A 
health information trustee who receives, 
using electronic means, a request for pro-
tected health information from another 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
health information trustee may not provide 
such information in response to the request 
unless the request contains sufficient de-
tails to uniquely identify one individual 
who is the subject of the request. 
(D) AUDIT TRAIL.— 
(i) ACCESS
TO
INFORMATION
MAIN-
TAINED
BY
OTHERS.—A health informa-
tion trustee shall maintain an electronic 
record concerning each attempt that is 
made by the trustee, whether authorized or 
unauthorized, successful or unsuccessful, 
to access protected health information that 
is maintained by any other health informa-
tion trustee in electronic form. The record 
shall include the identity of the specific in-
dividual attempting to gain such access 
and information sufficient to identify the 
information sought. 
(ii) ACCESS TO INFORMATION MAIN-
TAINED BY THE TRUSTEE.—A health in-
formation trustee shall maintain an elec-
tronic record concerning each attempt that 
is made by the trustee, or by any other 
person, whether authorized or unauthor-
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
ized, successful or unsuccessful, to access 
protected health information maintained by 
the trustee in electronic form. The record 
shall include the identity of the specific in-
dividual attempting to gain such access 
and information sufficient to identify the 
information sought. 
(3) REVIEW
OF
REQUIREMENTS.—The Sec-
retary from time to time shall review the require-
ments developed and imposed under paragraph (2), 
to determine whether technological advances or other 
factors make necessary changes to the requirements. 
If the Secretary determines that such changes are 
necessary, the Secretary shall make them. 
SEC. 112. ACCOUNTING FOR DISCLOSURES. 
(a) IN GENERAL.— 
(1) PERSONS NOT ACTING AS AGENTS OR CON-
TRACTORS.—Except as provided in paragraph (2), a 
health information trustee shall create and maintain, 
with respect to any protected health information dis-
closure made by the trustee that is not related to 
treatment, a record of the disclosure in accordance 
with regulations promulgated by the Secretary. 
(2) AGENTS
AND
CONTRACTORS.—A person 
acting in the capacity of an agent or contractor of 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS
a health care provider, health plan, health oversight 
agency, public health authority, health researcher, 
employer, insurer, school, institution of higher edu-
cation, or insurance support organization shall cre-
ate and maintain, with respect to any protected 
health information disclosure made by the person 
that is authorized under one of section 202, 203, 
204, or 206 through 213, a record of the disclosure 
in accordance with regulations promulgated by the 
Secretary. 
(b) RECORD OF DISCLOSURE PART OF PROTECTED 
HEALTH INFORMATION.—A record created and main-
tained under subsection (a) shall be maintained as pro-
tected health information for not less than 7 years. 
SEC. 113. PROHIBITION AGAINST RETALIATION. 
A health information trustee may not adversely affect 
another person, directly or indirectly, because such person 
has exercised a right under this Act, disclosed information 
relating to a possible violation of this Act, or associated 
with, or assisted a person in the exercise of a right under 
this Act. 
VerDate Aug 31 2005 
11:43 May 08, 2006
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\PICKUP\H2878.IH
H2878
erjones on PROD1PC71 with BILLS