them of their responsibilities under this Act, is pro-
hibited.
(5) COMPLIANCE
WITH
RESEARCH
REQUIRE-
MENTS.—A negligent or intentional action is prohib-
ited where it consists of—
(A) a disclosure for health research pur-
poses of individually identifiable health informa-
tion that—
(i) has not been approved by an insti-
tutional review board; or
(ii) does not satisfy the requirements
of section 106; or
(B) a use or disclosure of individually iden-
tifiable health information in violation of—
(i) a research protocol approved by an
institutional review board or any other re-
quirement or condition concerning such use
or disclosure established by such a review
board; or
(ii) any requirement or condition con-
cerning such use or disclosure established
by a person making, or approving, a disclo-
sure under section 106.
(6) ANONYMIZED
INFORMATION.—A use of
anonymized information, or an encryption key or
coding system used to anonymize information, in
violation of section 102, is prohibited.
(7) CIVIL PROCEEDING.—A negligent or inten-
tional disclosure of individually identifiable health in-
formation pursuant to a subpoena or discovery re-
quest related to a civil proceeding, in violation of
section 104, is prohibited.
(8) CRIMINAL PROCEEDING.—A negligent or in-
tentional disclosure of individually identifiable health
information for a criminal law enforcement purpose,
in violation of section 105, or a negligent or inten-
tional use of information obtained pursuant to such
section in violation of the section, is prohibited.
(9) SALE OR COMMERCIAL PUBLICATION.—
(A) IN GENERAL.—Subject to the excep-
tions described in subparagraph (B), an inten-
tional disclosure of individually identifiable
health information that constitutes a sale or
commercial publication of the information, is
prohibited.
(B) EXCEPTIONS.—A disclosure otherwise
prohibited under subparagraph (A) is not pro-
hibited when—
(i) the disclosure is made by an indi-
vidual whose health or health care is the
subject of the information (or an author-
ized representative of such an individual,
pursuant to section 402); or
(ii) the disclosure is made to a person
having a written authorization permitting
the disclosure that satisfies the require-
ments of section 103.
(10) FRAUD OR MISREPRESENTATION.—Use of
fraud, duress, deceit, or misrepresentation to obtain
access to individually identifiable health information
is prohibited.
SEC. 102. SPECIAL RULES FOR ANONYMIZED INFORMA-
TION.
(a) DEFINITION.—For purposes of this Act, the term
‘‘anonymized information’’ means individually identifiable
health information from which personal identifiers and
means of directly contacting any subject of the informa-
tion (including name, address, and social security num-
ber), have been removed, encrypted, or replaced with a
code, in a manner such that the identity of any such sub-
ject is not apparent from the facts contained in the infor-
mation, but may, in the case of encrypted or coded infor-
mation, be determined by a person with access to the
encryption key or coding system. Such term does not in-
clude any such encryption key or coding system.
(b) USE.—
(1) IN GENERAL.—Subject to paragraph (2), a
person may use anonymized information, or an
encryption key or coding system described in sub-
section (c)(2), for any lawful purpose, if the person,
in such use, does not—
(A) attempt to identify any individual with
respect to whom information has been removed,
encrypted, or replaced with a code; or
(B) intentionally use the anonymized infor-
mation, the key, or the coding system in any
way that results in the identification of any
such individual.
(2) EXCEPTIONS.—A use otherwise prohibited
under paragraph (1) is not prohibited when any of
the following circumstances apply:
(A) The use is by an individual whose
health or health care is the subject of the infor-
mation (or an authorized representative of such
an individual, pursuant to section 402).
(B) The use is by a person having an au-
thorization permitting the use that satisfies the
requirements of section 103.
(C) The use is for the purpose of pro-
viding, or facilitating the provision of, health
care to an individual described in subparagraph
(A).
(D) The use is for the purpose of facili-
tating payment activities related to health care
provided to an individual described in subpara-
graph (A).
(E) The use is pursuant to a specific af-
firmative authorization, or a requirement, under
State or Federal law, for legally authorized—
(i) disease or injury reporting;
(ii) public health surveillance, such as
birth and death reporting, and reporting
incidents of abuse, domestic violence, or
neglect;
(iii) public health investigation or
intervention;
(iv) management audits, financial au-
dits, or program monitoring and evalua-
tion; or
(v) licensure, certification, accredita-
tion, utilization review, quality assurance
activities, benchmarking, or outcomes man-
agement and assessment.
(F) The use is pursuant to an authoriza-
tion granted in a contract providing health care
with an encryption key or coding system described in
paragraph (2) in manner such that the combined in-
formation satisfies the requirements of section
406(8).
(2) ENCRYPTION KEY OR CODE.—For purposes
of this Act, disclosure of an encryption key or coding
system that is used to determine the identity of any
individual with respect to whom information has
been removed, encrypted, or replaced with a code, in
order to create anonymized information, shall not be
considered disclosure of individually identifiable
health information, unless it is disclosed with
anonymized information in manner such that the
combined information satisfies the requirements of
section 406(8).
(d) DECODED INFORMATION.—Formerly anonymized
information that has been manipulated to reveal a part
of the information that had been removed, encrypted, or
replaced with a code in order to render it anonymized in-
formation is individually identifiable health information
and is subject, beginning on the date of such manipula-
tion, to all of the requirements of this part relating to indi-
vidually identifiable information.
SEC. 103. GENERAL REQUIREMENTS FOR AUTHORIZATION
OF DISCLOSURE OF INFORMATION.
(a) IN GENERAL.—For purposes of section 101, an
authorization satisfies the requirements of this section if
it—
(1) is in writing;
(2) is executed by an individual whose health or
health care is the subject of the information (or an
authorized representative of such an individual, pur-
suant to section 402); and
(3) satisfies the requirements of subsection (b).
(b) REQUIREMENTS.—An authorization satisfies the
requirements in this subsection if—
(1) it includes the following:
(A) a description of the nature of the in-
formation to be disclosed;
(B) a general statement of the purposes
for which the individually identifiable health in-
formation disclosed pursuant to the authoriza-
tion may be used;
(C) a general description of the persons
who are authorized to use such information;
(D) a valid signature of an individual
whose health or health care is the subject of the
information (or an authorized representative of
such individual);
(E) the date of the signature;
(F) an expiration date upon which the au-
thorization is no longer valid; and
(G) reasonable procedures permitting such
individual or representative to revoke the au-
thorization; and
(2) in a case in which the purposes under para-
graph (1)(B) include health research, the provisions
of the authorization that relate to such research—
(A) include each of the elements described
in paragraph (1);
(B) are set out separately from the re-
maining provisions and are independent from
them; and
(C) are subject to separate revocation pro-
cedures, the use of which does not per se effect
a revocation of the remaining provisions.
(c) EFFECT OF GOOD FAITH RELIANCE ON AUTHOR-
IZATION.—A person shall not be liable, or subject to pun-
ishment under State or Federal law, for a disclosure of
individually identifiable health information, where the
disclosure—
(1) was made in good faith reliance on an au-
thorization executed by the individual that satisfies
the requirements of this section; and
(2) was consistent with the provisions of the au-
thorization.
SEC. 104. DISCLOSURE IN CIVIL PROCEEDINGS.
(a) IN GENERAL.—A person may not disclose individ-
ually identifiable health information for use in a civil law
enforcement investigation, a civil administrative action, or
a civil action brought in Federal or State court, in the
absence of—
(1) an otherwise valid discovery request, an ad-
ministrative subpoena or summons, or a judicial sub-
poena; and
(2) an order issued by the presiding judge or
official upon a demonstration, by clear and con-
vincing evidence, that the need for the information
of the person requesting the disclosure substantially
outweighs the privacy interest of each individual
whose health or health care is the subject of the in-
formation.
(b) CONSTRUCTION.—This section shall not be con-
strued to supersede any ground that may otherwise apply
under Federal or State law for an objection to the disclo-
sure of individually identifiable health information in any
civil action.
SEC. 105. DISCLOSURE FOR CRIMINAL LAW ENFORCEMENT
PURPOSES.
(a) IN GENERAL.—A person may not disclose individ-
ually identifiable health information for a criminal law en-
forcement purpose—
(1) in the absence of—
(A) a subpoena issued under the authority
of a grand jury;
(B) an administrative subpoena or sum-
mons or a judicial subpoena or warrant; or
(C) a request otherwise authorized by law
from a law enforcement agency; and
(2) in the case of a disclosure under subpara-
graph (B) or (C) of paragraph (1), in the absence
of a court order issued upon a demonstration, by
clear and convincing evidence, that the need for the
information of the person requesting the disclosure
substantially outweighs the privacy interest of each
individual whose health or health care is the subject
of the information.
(b) DESTRUCTION OR RETURN OF INFORMATION.—
When the proceeding for which individually identifiable
health information was disclosed is concluded, including
any derivative matters arising from such proceeding, the
person to whom the disclosure was made shall either de-
stroy the individually identifiable health information, or
return it to the person from whom it was obtained.
(c) REDACTIONS.—To the extent practicable, and
consistent with the requirements of due process, a criminal
law enforcement agency shall redact personally identifying
information from individually identifiable health informa-
tion prior to the public disclosure of such information in
a judicial or administrative proceeding.
(d) USE OF INFORMATION.—Individually identifiable
health information obtained by a criminal law enforcement
agency pursuant to this section may only be used for pur-
poses of a legitimate criminal law enforcement activity.
SEC. 106. DISCLOSURES FOR ARCHIVAL RESEARCH.
(a) IN GENERAL.—A person described in subsection
(b) may disclose individually identifiable health informa-
tion, that was previously created or collected by the person
and maintained by the person in an archive or other repos-
itory, to a health researcher pursuant to this subsection,
if—
(1) the disclosure is made for the purpose of
permitting the health researcher to carry out health
research that involves analysis of the information;
(2) the disclosure has been reviewed and ap-
proved, by a board, committee, or other group for-
mally designated by the person to review requests
for such information, in accordance with written
standards for confidentiality that specify permissible
and impermissible uses of such information for
health research;
(3) the person enters into a written agreement
with the health researcher that is consistent with
this Act and specifies the permissible and impermis-
sible future uses and disclosures of the information;
(4) the person provides notice to the health re-
searcher that any future use or disclosure of the in-
formation that is prohibited under this Act or the
agreement described in paragraph (3) may provide a
basis for a civil action against the researcher or may
result in other adverse consequences for the re-
searcher; and
(5) the person maintains a permanent record
documenting the scope and substance of the disclo-
sure.
(b) PERSONS DESCRIBED.—A person described in
this subsection is any of the following:
(1) A health care provider.
(2) A health plan.
(3) A public health authority.
(4) An employer.
(5) A health or life insurer.
(6) A school or university.
TITLE II—INDIVIDUALS’ RIGHTS
SEC. 201. INSPECTION AND COPYING OF HEALTH INFORMA-
TION.
(a) IN GENERAL.—Subject to subsections (b) and (c),
a person who is a health care provider, health plan, em-
ployer, health or life insurer, school, or university shall
permit an individual who is the subject of individually
identifiable health information, or the individual’s des-
ignee, to inspect and copy individually identifiable health
information concerning the individual, including records
created under section 202, that the person maintains. The
person may set forth appropriate procedures to be followed
for such inspection and copying and may require an indi-
vidual to pay reasonable fees associated with such inspec-
tion and copying and may require an individual to provide
written authorization of a provider designated by such in-
dividual through which the requested information will be
made available.
(b) EFFECT OF OTHER LAW.—
(1) 
DISCLOSURE
PROHIBITED
BY
OTHER
LAW.—A person described in subsection (a) may not
permit the inspection or copying of individually iden-
tifiable health information under such subsection, if
such inspection or copying is prohibited by any pro-
vision of law other than this Act.
(2) DISCLOSURE LIMITED BY OTHER LAW.—A
person described in subsection (a) shall limit the in-
spection or copying of individually identifiable health
information under such subsection to the extent re-
quired by, and consistent with, any limitation on
such inspection or copying in any provision of law
other than this Act that is applicable to the person.
(c) ADDITIONAL EXCEPTIONS.—A person described
in subsection (a) is not required to permit the inspection
or copying of individually identifiable health information
if any of the following exceptions apply:
(1) ENDANGERMENT
TO
LIFE
OR
SAFETY.—
The person determines that the disclosure of the in-
formation could reasonably be expected to endanger
the life or physical safety of any individual.
(2) CONFIDENTIAL SOURCE.—The information
identifies, or could reasonably lead to the identifica-
tion of, a person who provided information under a
promise of confidentiality to a health care provider
or life insurer concerning the individual who is the
subject of the information.
(3) INFORMATION COMPILED IN ANTICIPATION
OF
LITIGATION.—The 
information 
is 
compiled
principally—
(A) in the anticipation of a civil, criminal,
or administrative action or proceeding; or
(B) for use in such action or proceeding.
(4) RESEARCH
PURPOSES.—The information
was collected for or during a clinical trial monitored
by an institutional review board in which the indi-
vidual was a participant.
(d) DENIAL OF A REQUEST FOR INSPECTION OR
COPYING.—If a person described in subsection (a) denies
an individual’s request for inspection or copying pursuant
to subsection (b) or (c), the person shall inform the indi-
vidual of—
(1) the reasons for the denial of the request for
inspection or copying;
(2) any procedures for further review of the de-
nial; and
(3) the individual’s right to file with the person
a concise statement setting forth the request for in-
spection or copying.
(e) STATEMENT REGARDING REQUEST.—If an indi-
vidual has filed a statement under subsection (d)(3), the
person, in any subsequent disclosure of the portion of the
information 
requested 
under 
subsection 
(a), 
shall
include—
(1) a notation that such individual has filed a
request for inspection and that such request was de-
nied; and
(2) a concise statement of the reasons for deny-
ing the request for inspection or copying.
(f) DEADLINE.—A person described in subsection (a)
shall comply with or deny, in accordance with subsection
(d), a request for inspection or copying of individually
identifiable health information under this section not later
than 45 days after the date on which the person receives
the request.
(g) RULES GOVERNING AGENTS.—An agent of a per-
son described in subsection (a) shall not be required to
provide for the inspection and copying of individually iden-
tifiable health information, except where—
(1) the individually identifiable health informa-
tion is retained by the agent; and
(2) the agent has been asked by the person to
fulfill the requirements of this section.
(h) RULE OF CONSTRUCTION.—This section shall not
be construed to require a person described in subsection
(a) to conduct a formal, informal, or other hearing or pro-
ceeding concerning a request for inspection or copying of
individually identifiable health information.
SEC. 202. AMENDMENT OF INDIVIDUALLY IDENTIFIABLE
HEALTH INFORMATION.
(a) IN GENERAL.—Not later than 45 days after the
date on which a person who is a health care provider,
health plan, employer, health or life insurer, school, or uni-
versity receives from an individual who is a subject of indi-
vidually identifiable health information a request in writ-
ing to amend the information, the person—
(1) shall make the amendment requested;
(2) shall inform the individual of the amend-
ment that has been made; and
(3) shall make reasonable efforts to inform any
person who is identified by the individual, who is not
an officer, employer, or agent of the entity, and to
whom the unamended portion of the information was
disclosed during the preceding year, of any nontech-
nical amendment that has been made.
(b) REFUSAL TO AMEND.—If a person described in
subsection (a) refuses to make an amendment requested
by an individual under such subsection, the person shall
inform the individual of—
(1) the reasons for the refusal to make the
amendment;
(2) any procedures for further review of the re-
fusal; and
(3) the individual’s right to file with the person
a concise statement setting forth the requested
amendment and the individual’s reasons for dis-
agreeing with the refusal.
(c) STATEMENT
OF DISAGREEMENT.—If an indi-
vidual has filed a statement of disagreement with a person
under subsection (b)(3), the person, in any subsequent dis-
closure of the disputed portion of the information—
(1) shall include a notation that such individual
has filed a statement of disagreement; and
(2) may include a concise statement of the rea-
sons for not making the requested amendment.
(d) RULES GOVERNING AGENTS.—The agent of a
person described in subsection (a) shall not be required
to make amendments to individually identifiable health in-
formation, except where—
(1) the information is retained by the agent;
and
(2) the agent has been asked by such person to
fulfill the requirements of this section.
(e) REPEATED REQUESTS FOR AMENDMENTS.—If a
person described in subsection (a) receives a duplicative
request for an amendment of information as provided for
in such subsection and a statement of disagreement with
respect to the request has been filed pursuant to sub-
section (c), the person shall inform the individual of such
filing and shall not be required to carry out the procedures
required under this section.
(f) RULE OF CONSTRUCTION.—This section shall not
be construed—
(1) to require a person described in subsection
(a) to conduct a formal, informal, or other hearing
or proceeding concerning a request for an amend-
ment to individually identifiable health information;
(2) to require a person described in subsection
(a) to make an amendment with which the person
disagrees; or
(3) to require the alteration of any arrange-
ment, written agreement, or obligation with respect
to the delivery of, or payment for, health care.
SEC. 203. NOTICE OF CONFIDENTIALITY PRACTICES.
(a) PREPARATION OF WRITTEN NOTICE.—A health
care provider, health plan, health oversight agency, public
health authority, employer, health or life insurer, health
researcher, school, or university shall post or provide, in
writing and in a clear and conspicuous manner, notice of
the person’s confidentiality practices, that shall include—
(1) a description of an individual’s rights with
respect to individually identifiable health informa-
tion;
(2) the uses and disclosures of individually
identifiable health information authorized under this
Act;
(3) the procedures established by the person for
authorizing disclosures of individually identifiable
health information and for revoking such authoriza-
tions;
(4) the procedures established by the person for
the exercise of the individual’s rights; and
(5) the procedures established by the person for
providing copies of the notice.
(b) MODEL NOTICE.—The Secretary, after notice
and opportunity for public comment, shall develop and dis-
seminate model notices of confidentiality practices, for use
under this section. Use of the model notice developed by
the Secretary shall serve as a complete defense in any civil
action to an allegation that a violation of this section has
occurred.
TITLE III—ENFORCEMENT
SEC. 301. CRIMINAL PENALTIES.
(a) OFFENSE.—A person who knowingly and in viola-
tion of this Act obtains individually identifiable health in-
formation, uses such information, or discloses such infor-
mation to another person, knowing that such obtaining,
use, or disclosure is unlawful, shall be punished as pro-
vided in subsection (b).
(b) PENALTIES.—A person described in subsection
(a) shall—
(1) be fined not more than $50,000, imprisoned
not more than 1 year, or both;
(2) if the offense is committed under false pre-
tenses, be fined not more than $100,000, imprisoned
not more than 5 years, or both; and
(3) if the offense is committed with intent to
sell, transfer, or use individually identifiable health
information for commercial advantage, personal
gain, or malicious harm, be fined not more than
$250,000, imprisoned not more than 10 years, or
both.
SEC. 302. CIVIL ACTION.
(a) IN GENERAL.—Any individual whose rights under
this Act have been knowingly or negligently violated may
bring a civil action to recover such preliminary and equi-
table relief as the court determines to be appropriate.
(b) ATTORNEY’S FEES.—In the case of a civil action
brought under subsection (a) in which the plaintiff has
substantially prevailed, the court may assess against the