I 
113TH CONGRESS 
1ST SESSION H. R. 3299 
To amend section 340A of the Public Health Service Act to protect the 
privacy of personally identifiable information in relation to enrollment 
activities of health insurance exchanges, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 16, 2013 
Mr. ROSS introduced the following bill; which was referred to the Committee 
on Energy and Commerce, and in addition to the Committee on Ways 
and Means, for a period to be subsequently determined by the Speaker, 
in each case for consideration of such provisions as fall within the juris-
diction of the committee concerned 
A BILL 
To amend section 340A of the Public Health Service Act 
to protect the privacy of personally identifiable informa-
tion in relation to enrollment activities of health insur-
ance exchanges, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Security Before Access 
Act of 2013’’. 
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
SEC. 2. PROTECTING THE PRIVACY OF PERSONALLY IDEN-
TIFIABLE INFORMATION IN ENROLLMENT 
ACTIVITIES 
OF 
HEALTH 
INSURANCE 
EX-
CHANGES. 
(a) IN GENERAL.—Section 340A(c) of the Public 
Health Service Act (42 U.S.C. 256a(c)) is amended by 
adding at the end the following new paragraph: 
‘‘(3) ENSURING
PRIVACY
OF
PERSONALLY 
IDENTIFIABLE
INFORMATION; 
LIABILITY; 
PEN-
ALTIES; CONSUMER OPT OUT.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
require each recipient of a grant under this sec-
tion to implement procedures specified by the 
Secretary consistent with this paragraph in 
order protect the privacy of personally identifi-
able information. 
‘‘(B) REQUIRED PROCEDURES.—The pro-
cedures specified by the Secretary under sub-
paragraph (A) shall include at least the fol-
lowing: 
‘‘(i) PROHIBITION OF ACCESS WITH-
OUT EXPLICIT CONSENT.—No certified ap-
plication counselor, health insurance navi-
gator, or non-navigator assistance per-
sonnel shall have access to personally iden-
tifiable information relating to an indi-
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
vidual without the express, witnessed, writ-
ten consent of that individual. 
‘‘(ii) REQUIRING
LICENSURE, BACK-
GROUND
CHECKS.—No such individual 
shall have access to personally identifiable 
information unless the individual— 
‘‘(I) has undergone, within 60 
days before commencing enrollment 
assistance for any consumer seeking 
coverage through health insurance ex-
changes, both a criminal background 
and fingerprint check and has a clean 
record free of criminal infractions; 
and 
‘‘(II) meets educational and li-
censure requirements that are iden-
tical or comparable to those currently 
applicable to health insurance agents 
and brokers within the State they 
seek to assist consumers with health 
insurance enrollment. 
‘‘(iii) REQUIREMENT FOR PRIOR CER-
TIFICATION OF SAFEGUARDS.—The recipi-
ent of the grant may not collect personally 
identifiable information for any reason 
VerDate Mar 15 2010 
04:53 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
until the Comptroller General of the 
United States, in agreement with the In-
spector General of the Department of 
Health and Human Services, certifies to 
Congress that such Department, along 
with any other relevant Federal agencies 
involved with health insurance assistance 
or enrollment, or collection or verification 
of personally identifiable information, have 
implemented all appropriate and necessary 
actions to safeguard both the such infor-
mation and financial information of indi-
viduals seeking enrollment in a health plan 
through an Exchange and to protect such 
individuals from fraud and abuse. 
‘‘(C) LIABILITY.—Not later than 90 days 
after the date of the enactment of this para-
graph, the Secretary— 
‘‘(i) shall issue guidance concerning 
how liability and penalties will be applied 
in instances of failure to comply with re-
quirements of this paragraph, including 
where consumer outreach and enrollment 
assistance causes harm to an individual as 
a result of misuse or negligence in protec-
VerDate Mar 15 2010 
04:53 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
tion and privacy of personally identifiable 
information; 
‘‘(ii) shall determine whether such li-
ability lies with the person (such as a navi-
gator, certified application counselor, or 
non-navigator assistance personnel) having 
direct contact with the prospective enrollee 
in enrollment assistance-related actions or 
whether liability lies with the entity that 
received Federal or Exchange-generated 
funds to carry out consumer outreach ac-
tivities; and 
‘‘(iii) shall determine whether the en-
tities identified under clause (ii) are re-
quired to obtain professional liability cov-
erage. 
‘‘(D) PENALTIES.— 
‘‘(i) CRIMINAL PENALTIES.— 
‘‘(I) Any individual or entity who, 
under this section, has possession of, 
or access to, personally identifiable in-
formation the disclosure of which is 
prohibited by this section (or section 
552a of title 5, United States Code) 
or by rules or regulations established 
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
thereunder, and who knowing that 
disclosure of the specific material is so 
prohibited, willfully discloses the ma-
terial in any manner to any person or 
entity not entitled to receive it, shall 
be guilty of a misdemeanor and fined 
not more than $5,000. 
‘‘(II) A person who commits the 
offense described under subclause (I) 
with the intent to sell, transfer, or use 
personally identifiable information for 
commercial advantage, personal gain, 
or malicious harm shall be fined not 
more than $250,000, imprisoned for 
not more than 10 years, or both. 
‘‘(III) Any person who knowingly 
and willfully requests or obtains any 
personally 
identifiable 
information 
protected under this section con-
cerning an individual under false pre-
tenses shall be guilty of a felony and 
fined not more than $100,000, impris-
oned for not more than 5 years, or 
both. 
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
‘‘(ii) POTENTIAL EXPOSURE TO TAX 
PENALTY.—Any navigator, certified appli-
cation counselor, or non-navigator assist-
ance personnel who engages in health plan 
enrollment consumer assistance activities 
under this section and who is exposed to 
consumer tax return information is poten-
tially subject to criminal liability under 
section 7213(a) of the Internal Revenue 
Code of 1986 for any instances of unau-
thorized disclosure of such information. 
‘‘(iii) DISQUALIFICATION FROM FUR-
THER ASSISTANCE.—If the Secretary de-
termines that any individual, including any 
navigator, certified application counselor, 
or non-navigator assistance personnel, has 
a criminal background or is otherwise in 
violation of this paragraph with respect to 
the requirements relating to disclosure and 
use of personally identifiable information, 
the Secretary shall permanently disqualify 
the individual from any further involve-
ment in consumer assistance activities re-
quired under this section or the Patient 
Protection and Affordable Care Act and 
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
may disqualify and rescind the Federal 
and Exchange-generated funds from the 
entity which employs or contracts with 
such an individual. 
‘‘(E) CONSUMER OPT OUT FOR LACK OF 
PRIVACY PROTECTION.—Beginning on the date 
of health insurance exchange operations for 
both individuals and businesses, no individual 
consumer shall be made responsible for failure 
to meet a requirement under the Patient Pro-
tection and Affordable Care Act (including any 
amendments made by this Act) for obtaining 
qualified health insurance coverage through an 
Exchange unless the Secretary has dem-
onstrated with reasonable certainty that effec-
tive and comprehensive protection of personally 
identifiable information, with respect to any 
health insurance enrollment activity electronic 
or otherwise, are in place prior to any consumer 
disclosure or transmission of personally identifi-
able information for health insurance enroll-
ment purposes. 
‘‘(F) PERSONALLY IDENTIFIABLE INFOR-
MATION DEFINED.—In this paragraph, the term 
‘personally identifiable information’ includes So-
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS
cial Security numbers, bank account informa-
tion, insurance records, health records, personal 
income data, and any other information deemed 
personally identifiable and sensitive in nature 
by the Federal Trade Commission, the Depart-
ment of Justice, the Social Security Adminis-
tration, the Consumer Financial Protection Bu-
reau, the President’s Task Force on Identity 
Theft, and any other relevant Federal agency, 
which is disclosed or obtained in connection 
with any health insurance enrollment activity 
conducted under this section.’’. 
(b) EFFECTIVE DATE.—The amendment made by 
subsection (a) shall take effect on the date of the enact-
ment of this Act and shall apply to grants made before, 
on, or after the date of the enactment of this Act. The 
Secretary of Health and Human Services shall provide for 
the prompt modification of such grants made before the 
date of the enactment of this Act in order to comply with 
the requirement imposed by such amendment. 
Æ 
VerDate Mar 15 2010 
01:36 Oct 17, 2013
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H3299.IH
H3299
jbell on DSK7SPTVN1PROD with BILLS