use, or disclosure is unlawful, shall be punished as pro-
vided in subsection (b).
(b) PENALTIES.—A person described in subsection
(a) shall—
(1) be fined not more than $50,000, imprisoned
not more than 1 year, or both;
(2) if the offense is committed under false pre-
tenses, be fined not more than $100,000, imprisoned
not more than 5 years, or both; and
(3) if the offense is committed with intent to
sell, transfer, or use individually identifiable health
information for commercial advantage, personal
gain, or malicious harm, be fined not more than
$250,000, imprisoned not more than 10 years, or
both.
SEC. 302. CIVIL ACTION.
(a) IN GENERAL.—Any individual whose rights under
this Act have been knowingly or negligently violated may
bring a civil action to recover such preliminary and equi-
table relief as the court determines to be appropriate.
(b) ATTORNEY’S FEES.—In the case of a civil action
brought under subsection (a) in which the plaintiff has
substantially prevailed, the court may assess against the
respondent a reasonable attorney’s fee and other litigation
costs and expenses (including expert fees) reasonably in-
curred.
(c) LIMITATION.—No action may be commenced
under this subsection by an individual more than 2 years
after the date on which the violation was, or should rea-
sonably have been, discovered by the individual.
(d) NO
LIABILITY
FOR
PERMISSIBLE
DISCLO-
SURES.—A person who makes a disclosure of individually
identifiable health information about an individual that is
permitted under this Act shall not be liable to the individ-
ual for such disclosure under common law.
SEC. 303. PROGRAM EXCLUSIONS.
(a) EXCLUSION FROM PARTICIPATION IN FEDERAL
AND STATE HEALTH CARE PROGRAMS.—Section 1128(b)
of the Social Security Act (42 U.S.C. 1320a–7(b)) is
amended by adding at the end the following:
‘‘(16) FAILURE LAWFULLY TO TREAT INDIVID-
UALLY IDENTIFIABLE HEALTH INFORMATION.—Any
individual or entity that the Secretary determines
has failed substantially to comply with a provision of
the Consumer Health and Research Technology
(CHART) Protection Act.’’.
(b) EXCLUSION OF PROVIDERS FROM PARTICIPA-
TION IN FEDERAL EMPLOYEES HEALTH BENEFITS PRO-
GRAM.—Section 8902a(b) of title 5, United States Code,
is amended by adding at the end the following:
‘‘(6) Any provider that the Secretary of Health
and Human Services has determined has failed sub-
stantially to comply with a provision of the Con-
sumer Health and Research Technology (CHART)
Protection Act.’’.
TITLE IV—GENERAL
PROVISIONS
SEC. 401. STANDARDS FOR ELECTRONIC DISCLOSURES.
The National Committee on Vital and Health Statis-
tics, in consultation with the National Science Foundation,
shall promulgate standards for disclosing, authorizing the
use and disclosure of, and authenticating, individually
identifiable health information in electronic form, in a
manner consistent with this Act.
SEC. 402. AUTHORIZED REPRESENTATIVES.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law, or by an
instrument recognized under law, to act as an agent, at-
torney, proxy, or other legal representative for an individ-
ual, otherwise to exercise the rights of the individual, may,
to the extent so authorized, exercise and discharge the
rights of the individual under this Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is not described in subsection (a), but is authorized
by law or by an instrument recognized under law to make
decisions about the provision of health care to an individ-
ual who is incapacitated, may exercise and discharge the
rights of the individual under this Act, to the extent nec-
essary to effectuate the terms or purposes of the grant
of authority.
(c) NO COURT DECLARATION.—If a health care pro-
vider determines that an individual, who has not been de-
clared to be legally incompetent, suffers from a medical
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right
of the individual to authorize disclosure under this Act
may be exercised and discharged in the best interest of
the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or (3) cannot be
contacted after a reasonable effort.
(d) APPLICATION TO DECEASED INDIVIDUALS.—The
provisions of this Act shall continue to apply to individ-
ually identifiable health information concerning a deceased
individual for a period of 2 years following the death of
that individual.
(e) EXERCISE OF RIGHTS ON BEHALF OF A DE-
CEASED INDIVIDUAL.—A person who is authorized by law
or by an instrument recognized under law, to act as an
executor of the estate of a deceased individual, or other-
wise to exercise the rights of the deceased individual, may,
to the extent so authorized, exercise and discharge the
rights of such deceased individual under this Act for a pe-
riod of 2 years following the death of that individual. If
no such designee has been authorized, the rights of the
deceased individual may be exercised as provided for in
subsection (c).
SEC. 403. RELATIONSHIP TO OTHER LAWS.
(a) IN GENERAL.—
(1) STATE LAW.—Except as provided in sub-
sections (b) through (f), the provisions of this Act
shall preempt any State law that directly relates to
matters covered by this Act.
(2) FEDERAL LAW.—This Act shall not be con-
strued as repealing, explicitly or implicitly, other
Federal laws or regulations relating to individually
identifiable health information or relating to an indi-
vidual’s access to health care services.
(b) PRIVILEGES.—This Act does not preempt or mod-
ify State common or statutory law to the extent such law
concerns a privilege of a witness or person in a court of
the State. This Act does not supersede or modify Federal
common or statutory law to the extent such law concerns
a privilege of a witness or person in a court of the United
States. The execution of an authorization pursuant to sec-
tion 103 may not be construed as a waiver of any such
privilege.
(c) CERTAIN DUTIES UNDER LAW.—Nothing in this
Act shall be construed to preempt, supersede, or modify
the operation of any State law that—
(1) provides for the reporting of vital statistics
such as birth or death information;
(2) requires the reporting of abuse, domestic vi-
olence, or neglect information about any individual;
(3) regulates information concerning an individ-
ual’s mental health or communicable disease status;
or