386
Title II, Subtitle B
poses for which the information may be used or disclosed
by the trustee.
(c) STATEMENT OF DISAGREEMENT.—After a pro-
tected individual has filed a statement of disagreement
under subsection (a)(2)(C), the trustee, in any subsequent
disclosure of the disputed portion of the information, shall
include a copy of the individual’s statement and may in-
clude a concise statement of the trustee’s reasons for not
making the requested correction or amendment.
(d) CONSTRUCTION.—This section may not be con-
strued to require a health information trustee to conduct
a hearing or proceeding concerning a request for a correc-
tion or amendment to protected health information the
trustee maintains.
(e) CORRECTION.—For purposes of subsection (a), a
correction is deemed to have been made to protected
health information when—
(1) information that is not timely, accurate, rel-
evant, or complete is clearly marked as incorrect; or
(2) supplementary correct information is made
part of the information and adequately cross-ref-
erenced.
(f) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
387
Title II, Subtitle B
(2) a health care provider;
(3) a health information service organization;
(4) a health oversight agency; or
(5) a public health authority.
SEC. 2143. NOTICE OF INFORMATION PRACTICES.
(a) PREPARATION OF NOTICE.—A health information
trustee described in subsection (d) shall prepare a written
notice of information practices describing the following:
(1) The rights under this part of a protected in-
dividual who is the subject of protected health infor-
mation, including the right to inspect and copy such
information and the right to seek amendments to
such information, and the procedures for authorizing
disclosures of protected health information and for
revoking such authorizations.
(2) The procedures established by the trustee
for the exercise of such rights.
(3) The uses and disclosures of protected health
information that are authorized under this part.
(b) DISSEMINATION OF NOTICE.—A health informa-
tion trustee—
(1) shall, upon request, provide any person with
a copy of the trustee’s notice of information prac-
tices (described in subsection (a)); and
388
Title II, Subtitle B
(2) shall make reasonable efforts to inform per-
sons in a clear and conspicuous manner of the exist-
ence and availability of such notice.
(c) MODEL NOTICES.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate model notices of infor-
mation practices for use by health information trustees
under this section.
(d) APPLICABILITY.—This section applies to a health
information trustee who is—
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health information service organization; or
(4) a health oversight agency.
SEC. 2144. ACCOUNTING FOR DISCLOSURES.
(a) IN GENERAL.—Except as provided in subsection
(b) and section 2154, each health information trustee shall
create and maintain, with respect to any protected health
information the trustee discloses, a record of—
(1) the date and purpose of the disclosure;
(2) the name of the person to whom the disclo-
sure was made;
(3) the address of the person to whom the dis-
closure was made or the location to which the disclo-
sure was made; and
389
Title II, Subtitle B
(4) where practicable, a description of the infor-
mation disclosed.
(b) REGULATIONS.—Not later than July 1, 1996, the
Secretary shall promulgate regulations that exempt a
health information trustee from maintaining a record
under subsection (a) with respect to protected health in-
formation disclosed by the trustee for purposes of peer re-
view, licensing, certification, accreditation, and similar ac-
tivities.
SEC. 2145. SECURITY.
(a) IN GENERAL.—Each health information trustee
who receives or creates protected health information that
is subject to this part shall maintain reasonable and ap-
propriate administrative, technical, and physical safe-
guards—
(1) to ensure the integrity and confidentiality of
the information;
(2) to protect against any reasonably antici-
pated—
(A) threats or hazards to the security or
integrity of the information; and
(B) unauthorized uses or disclosures of the
information; and
390
Title II, Subtitle B
(3) otherwise ensure compliance with this part
by the trustee and the officers and employees of the
trustee.
(b) GUIDELINES.—Not later than July 1, 1996, the
Secretary, after notice and opportunity for public com-
ment, shall develop and disseminate guidelines for the im-
plementation of this section. The guidelines shall take into
account—
(1) the technical capabilities of record systems
used to maintain protected health information;
(2) the costs of security measures;
(3) the need for training persons who have ac-
cess to protected health information; and
(4) the value of audit trails in computerized
record systems.
Subpart B—Use and Disclosure of Protected Health
Information
SEC. 2151. GENERAL LIMITATIONS ON USE AND DISCLO-
SURE.
(a) USE.—Except as otherwise provided under this
part, a health information trustee may use protected
health information only for a purpose—
(1) that is compatible with and directly related
to the purpose for which the information—
(A) was collected; or
391
Title II, Subtitle B
(B) was received by the trustee; or
(2) for which the trustee is authorized to dis-
close the information under this part.
(b) DISCLOSURE.—A health information trustee may
disclose protected health information only as authorized
under this part.
(c) SCOPE OF USES AND DISCLOSURES.—
(1) IN GENERAL.—A use or disclosure of pro-
tected health information by a health information
trustee shall be limited, when practicable, to the
minimum amount of information necessary to ac-
complish the purpose for which the information is
used or disclosed.
(2) GUIDELINES.—Not later than July 1, 1996,
the Secretary, after notice and opportunity for pub-
lic comment, shall issue guidelines to implement
paragraph (1), which shall take into account the
technical capabilities of the record systems used to
maintain protected health information and the costs
of limiting use and disclosure.
(d) IDENTIFICATION OF DISCLOSED INFORMATION
AS PROTECTED INFORMATION.—Except with respect to
protected health information that is disclosed under sec-
tion 2154 (relating to next of kin and directory informa-
tion), a health information trustee may disclose protected
392
Title II, Subtitle B
health information only if the recipient has been notified
that the information is protected health information that
is subject to this part.
(e) AGREEMENT TO LIMIT USE OR DISCLOSURE.—
A health information trustee who receives protected health
information from any person pursuant to a written agree-
ment to restrict use or disclosure of the information to
a greater extent than otherwise would be required under
this part shall comply with the terms of the agreement,
except where use or disclosure of the information in viola-
tion of the agreement is required by law. A trustee who
fails to comply with the preceding sentence shall be subject
to section 2191 (relating to civil actions) with respect to
such failure.
(f) NO GENERAL REQUIREMENT TO DISCLOSE.—
Nothing in this part shall be construed to require a health
information trustee to disclose protected health informa-
tion not otherwise required to be disclosed by law.
SEC. 2152. AUTHORIZATIONS FOR DISCLOSURE OF PRO-
TECTED HEALTH INFORMATION.
(a) WRITTEN AUTHORIZATIONS.—A health informa-
tion trustee, other than a health information service orga-
nization, may disclose protected health information pursu-
ant to an authorization executed by the protected individ-
393
Title II, Subtitle B
ual who is the subject of the information, if each of the
following requirements is satisfied:
(1) WRITING.—The authorization is in writing,
signed by the individual, and dated on the date of
such signature.
(2) SEPARATE FORM.—The authorization is not
on a form used to authorize or facilitate the provi-
sion of, or payment for, health care.
(3) TRUSTEE DESCRIBED.—The trustee is spe-
cifically named or generically described in the au-
thorization as authorized to disclose such informa-
tion.
(4) RECIPIENT
DESCRIBED.—The person to
whom the information is to be disclosed is specifi-
cally named or generically described in the author-
ization as a person to whom such information may
be disclosed.
(5) STATEMENT OF INTENDED USES AND DIS-
CLOSURES
RECEIVED.—The authorization contains
an acknowledgment that the individual has received
a statement described in subsection (b) from such
person.
(6) INFORMATION
DESCRIBED.—The informa-
tion to be disclosed is described in the authorization.
394
Title II, Subtitle B
(7) AUTHORIZATION TIMELY RECEIVED.—The
authorization is received by the trustee during a pe-
riod described in subsection (c)(1).
(8) DISCLOSURE
TIMELY
MADE.—The disclo-
sure occurs during a period described in subsection
(c)(2).
(b) STATEMENT OF INTENDED USES AND DISCLO-
SURES.—
(1) IN GENERAL.—A person who wishes to re-
ceive from a health information trustee protected
health information about a protected individual pur-
suant to an authorization executed by the individual
shall supply the individual, in writing and on a form
that is distinct from the authorization, with a state-
ment of the uses for which the person intends the
information and the disclosures the person intends
to make of the information. Such statement shall be
supplied before the authorization is executed.
(2) ENFORCEMENT.—If the person uses or dis-
closes the information in a manner that is inconsist-
ent with such statement, the person shall be subject
to section 2191 (relating to civil actions) with re-
spect to such failure, except where such use or dis-
closure is required by law.
395
Title II, Subtitle B
(3) MODEL STATEMENTS.—Not later than July
1, 1996, the Secretary, after notice and opportunity
for public comment, shall develop and disseminate
model statements of intended uses and disclosures of
the type described in paragraph (1).
(c) TIME LIMITATIONS ON AUTHORIZATIONS.—
(1) RECEIPT BY TRUSTEE.—For purposes of
subsection (a)(7), an authorization is timely received
if it is received by the trustee during—
(A) the 1-year period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to—
(i) a health benefit plan sponsor;
(ii) a health care provider;
(iii) a health oversight agency;
(iv) a public health authority;
(v) a health researcher; or
(vi) a person who provides counseling
or social services to individuals; or
(B) the 30-day period beginning on the
date that the authorization is signed under sub-
section (a)(1), if the authorization permits the
disclosure of protected health information to a
396
Title II, Subtitle B
person other than a person described in sub-
paragraph (A).
(2) DISCLOSURE BY TRUSTEE.—For purposes
of subsection (a)(8), a disclosure is timely made if
it occurs before—
(A) the date or event (if any) specified in
the authorization upon which the authorization
expires; and
(B) the expiration of the 6-month period
beginning on the date the trustee receives the
authorization.
(d) REVOCATION OR AMENDMENT OF AUTHORIZA-
TION.—
(1) IN
GENERAL.—A protected individual in
writing may revoke or amend an authorization de-
scribed in subsection (a), in whole or in part, at any
time, except insofar as—
(A) disclosure of protected health informa-
tion has been authorized to permit validation of
expenditures based on health condition by a
government authority; or
(B) action has been taken in reliance on
the authorization.
(2) NOTICE OF REVOCATION.—A health infor-
mation trustee who discloses protected health infor-
397
Title II, Subtitle B
mation in reliance on an authorization that has been
revoked shall not be subject to any liability or pen-
alty under this part if—
(A) the reliance was in good faith;
(B) the trustee had no notice of the rev-
ocation; and
(C) the disclosure was otherwise in accord-
ance with the requirements of this section.
(e) ADDITIONAL REQUIREMENTS OF TRUSTEE.—A
health information trustee may impose requirements for
an authorization that are in addition to the requirements
in this section.
(f) COPY.—A health information trustee who dis-
closes protected health information pursuant to an author-
ization under this section shall maintain a copy of the au-
thorization.
(g) CONSTRUCTION.—This section may not be con-
strued—
(1) to require a health information trustee to
disclose protected health information; or
(2) to limit the right of a health information
trustee to charge a fee for the disclosure or repro-
duction of protected health information.
(h) SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.—If a health information trustee discloses pro-
398
Title II, Subtitle B
tected health information pursuant to an authorization in
order to comply with an administrative subpoena or war-
rant or a judicial subpoena or search warrant, the author-
ization—
(1) shall specifically authorize the disclosure for
the purpose of permitting the trustee to comply with
the subpoena, warrant, or search warrant; and
(2) shall otherwise meet the requirements in
this section.
SEC. 2153. TREATMENT, PAYMENT, AND OVERSIGHT.
(a) DISCLOSURES
BY
PLANS, PROVIDERS, AND
OVERSIGHT AGENCIES.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation to a health benefit plan sponsor, health care
provider, or health oversight agency if the disclosure is—
(1) for the purpose of providing health care and
a protected individual who is a subject of the infor-
mation has not previously objected to the disclosure
in writing;
(2) for the purpose of providing for the pay-
ment for health care furnished to an individual; or
(3) for use by a health oversight agency for a
purpose that is described in subparagraph (A) or
(B)(i) of section 2140(b)(7).
399
Title II, Subtitle B
(b) DISCLOSURES BY CERTAIN OTHER TRUSTEES.—
A health information trustee may disclose protected health
information to a health care provider if—
(1) the disclosure is for the purpose described
in subsection (a)(1); and
(2) the trustee—
(A) is a public health authority;
(B) received protected health information
pursuant to section 2157 (relating to emergency
circumstances); or
(C) is an officer or employee of a trustee
described in subsection (B).
(c) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and related to receipt of health care or pay-
ment for health care.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
400
Title II, Subtitle B
(4) A health information service organization.
SEC. 2154. NEXT OF KIN AND DIRECTORY INFORMATION.
(a) NEXT OF KIN.—A health information trustee who
is a health care provider, who received protected health
information pursuant to section 2157 (relating to emer-
gency circumstances), or who is an officer or employee of
such a recipient may orally disclose protected health infor-
mation about a protected individual to the next of kin of
the individual (as defined under State law), or to a person
with whom the individual has a close personal relationship,
if—
(1) the trustee has no reason to believe that the
individual would consider the information especially
sensitive;
(2) the individual has not previously objected to
the disclosure;
(3) the disclosure is consistent with good medi-
cal or other professional practice; and
(4) the information disclosed is limited to infor-
mation about health care that is being provided to
the individual at or about the time of the disclosure.
(b) DIRECTORY INFORMATION.—
(1) IN GENERAL.—A health information trustee
who is a health care provider, who received protected
health information pursuant to section 2157 (relat-
401
Title II, Subtitle B
ing to emergency circumstances), or who is an offi-
cer or employee of a such a recipient may disclose
to any person the information described in para-
graph (2) if—
(A) a protected individual who is a subject
of the information has not objected in writing
to the disclosure;
(B) the disclosure is otherwise consistent
with good medical and other professional prac-
tice; and
(C) the information does not reveal specific
information about the physical or mental condi-
tion or functional status of a protected individ-
ual or about the health care provided to a pro-
tected individual.
(2) INFORMATION
DESCRIBED.—The informa-
tion referred to in paragraph (1) is the following:
(A) The name of an individual receiving
health care from a health care provider on a
premises controlled by the provider.
(B) The location of the individual on such
premises.
(C) The general health status of the indi-
vidual, described in terms of critical, poor, fair,
402
Title II, Subtitle B
stable, satisfactory, or terms denoting similar
conditions.
(c) NO ACCOUNTING REQUIRED.—A health informa-
tion trustee who discloses protected health information
under this section is not required to maintain an account-
ing of the disclosure under section 2144.
(d) RECIPIENTS.—A person to whom protected
health information is disclosed under this section shall not,
by reason of such disclosure, be subject to any require-
ment under this part.
SEC. 2155. PUBLIC HEALTH.
(a) IN GENERAL.—A health information trustee who
is a health care provider or a public health authority may
disclose protected health information to—
(1) a public health authority for use in legally
authorized—
(A) disease or injury reporting;
(B) public health surveillance; or
(C) public health investigation or interven-
tion; or
(2) an individual who is authorized by law to
receive the information in a public health interven-
tion.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A public
health authority who receives protected health information
403
Title II, Subtitle B
about a protected individual through a disclosure under
this section may not use or disclose the information in any
administrative, civil, or criminal action or investigation di-
rected against the individual, except where the use or dis-
closure is authorized by law for protection of the public
health.
(c) INDIVIDUAL
RECIPIENTS.—An individual to
whom protected health information is disclosed under sub-
section (a)(2) shall not, by reason of such disclosure, be
subject to any requirement under this part.
SEC. 2156. HEALTH RESEARCH.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation to a person if—
(1) the person is conducting an approved health
research project;
(2) the information is to be used in the project;
and
(3) the project has been determined by a cer-
tified institutional review board to be—
(A) of sufficient importance so as to out-
weigh the intrusion into the privacy of the pro-
tected individual who is the subject of the infor-
mation that would result from the disclosure;
and
404
Title II, Subtitle B
(B) impracticable to conduct without the
information.
(b) DISCLOSURES BY HEALTH INFORMATION SERV-
ICE ORGANIZATIONS.—A health information service orga-
nization may disclose protected health information under
subsection (a) only if the certified institutional review
board referred to in subsection (a)(3) has been certified
as being qualified to make determinations under such sub-
section with respect to disclosures by such organizations.
(c) LIMITATIONS ON USE AND DISCLOSURE; OBLIGA-
TIONS OF RECIPIENT.—A health researcher who receives
protected health information about a protected individual
pursuant to subsection (a)—
(1) may use the information solely for purposes
of an approved health research project;
(2) may not use or disclose the information in
any administrative, civil, or criminal action or inves-
tigation directed against the individual; and
(3) shall remove or destroy, at the earliest op-
portunity consistent with the purposes of the ap-
proved health research project in connection with
which the disclosure was made, information that
would enable an individual to be identified, unless a
certified institutional review board has determined
that there is a health or research justification for re-
405
Title II, Subtitle B
tention of such identifiers and there is an adequate
plan to protect the identifiers from use and disclo-
sure that is inconsistent with this part.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any health information
trustee other than a person who, with respect to the spe-
cific protected health information to be disclosed under
such subsection, received the information—
(1) pursuant to—
(A) section 2158 (relating to judicial and
administrative purposes);
(B) paragraph (1), (2), or (3) of section
2159(a) (relating to law enforcement); or
(C) section 2160 (relating to subpoenas,
warrants, and search warrants); or
(2) while acting in whole or in part in the ca-
pacity of an officer or employee of a person de-
scribed in paragraph (1).
(e) REQUIREMENTS
FOR INSTITUTIONAL REVIEW
BOARDS.—
(1) REGULATIONS.—Not later than July 1,
1996, the Secretary, after opportunity for notice and
comment, shall promulgate regulations establishing
requirements for certified institutional review boards
under this part. The regulations shall be based on
406
Title II, Subtitle B
regulations promulgated under section 491(a) of the
Public Health Service Act and shall ensure that cer-
tified institutional review boards are qualified to as-
sess and protect the confidentiality of research sub-
jects. The regulations shall include specific require-
ments for certified institutional review boards that
make determinations under subsection (a)(3) with
respect to disclosures by health information service
organizations.
(2) CERTIFICATION.—The Secretary shall cer-
tify that an institutional review board satisfies the
requirements of the regulations promulgated under
paragraph (1).
SEC. 2157. EMERGENCY CIRCUMSTANCES.
(a) IN GENERAL.—A health information trustee may
disclose protected health information if the trustee be-
lieves, on reasonable grounds, that the disclosure is nec-
essary to prevent or lessen a serious and imminent threat
to the health or safety of an individual.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
407
Title II, Subtitle B
arising out of and related to receipt of health care or pay-
ment for health care.
SEC. 2158. JUDICIAL AND ADMINISTRATIVE PURPOSES.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation—
(1) pursuant to the Federal Rules of Civil Pro-
cedure, the Federal Rules of Criminal Procedure, or
comparable rules of other courts or administrative
agencies in connection with litigation or proceedings
to which a protected individual who is a subject of
the information is a party and in which the individ-
ual has placed the individual’s physical or mental
condition or functional status in issue;
(2) if directed by a court in connection with a
court-ordered examination of an individual; or
(3) to assist in the identification of a dead indi-
vidual.
(b) WRITTEN STATEMENT.—A person seeking pro-
tected health information about a protected individual held
by health information trustee under—
(1) subsection (a)(1)—
(A) shall notify the protected individual or
the attorney of the protected individual of the
request for the information;
408
Title II, Subtitle B
(B) shall provide the trustee with a signed
document attesting—
(i) that the protected individual is a
party to the litigation or proceedings for
which the information is sought;
(ii) that the individual has placed the
individual’s physical or mental condition or
functional status in issue; and
(iii) the date on which the protected
individual or the attorney of the protected
individual was notified under subparagraph
(A); and
(C) shall not accept any requested pro-
tected health information from the trustee until
the termination of the 10-day period beginning
on the date notice was given under subpara-
graph (A); or
(2) subsection (a)(3) shall provide the trustee
with a written statement that the information is
sought to assist in the identification of a dead indi-
vidual.
(c) USE AND DISCLOSURE.—A person to whom pro-
tected health information is disclosed under this section
may use and disclose the information only to accomplish
the purpose for which the disclosure was made.
409
Title II, Subtitle B
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
(4) A person who, with respect to the specific
protected health information to be disclosed under
such subsection, received the information—
(A) pursuant to—
(i) section 2157 (relating to emer-
gency circumstances); or
(ii) section 2160 (relating to subpoe-
nas, warrants, and search warrants); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
SEC. 2159. LAW ENFORCEMENT.
(a) IN GENERAL.—A health information trustee,
other than a health information service organization, may
disclose protected health information to a law enforcement
agency, other than a health oversight agency—
(1) if the information is disclosed for use in an
investigation or prosecution of a health information
trustee;
410
Title II, Subtitle B
(2) in connection with criminal activity commit-
ted against the trustee or an affiliated person of the
trustee or on premises controlled by the trustee; or
(3) if the information is needed to determine
whether a crime has been committed and the nature
of any crime that may have been committed (other
than a crime that may have been committed by the
protected individual who is the subject of the infor-
mation).
(b) ADDITIONAL AUTHORITY OF CERTAIN TRUST-
EES.—A health information trustee who is not a health
information service organization, a public health author-
ity, or a health researcher may disclose protected health
information to a law enforcement agency (other than a
health oversight agency)—
(1) to assist in the identification or location of
a victim, fugitive, or witness in a law enforcement
inquiry;
(2) pursuant to a law requiring the reporting of
specific health care information to law enforcement
authorities; or
(3) if the information is specific health informa-
tion described in paragraph (2) and the trustee is
operated by a Federal agency;
411
Title II, Subtitle B
(c) CERTIFICATION.—Where a law enforcement agen-
cy requests a health information trustee to disclose pro-
tected health information under subsection (a) or (b)(1),
the agency shall provide the trustee with a written certifi-
cation that—
(1) is signed by a supervisory official of a rank
designated by the head of the agency;
(2) specifies the information requested; and
(3) states that the information is needed for a
lawful purpose under this section.
(d) RESTRICTIONS ON DISCLOSURE AND USE.—A
person who receives protected health information about a
protected individual through a disclosure under this sec-
tion may not use or disclose the information—
(1) in any administrative, civil, or criminal ac-
tion or investigation directed against the individual,
except an action or investigation arising out of and
directly related to the action or investigation for
which the information was obtained; and
(2) otherwise unless the use or disclosure is
necessary to fulfill the purpose for which the infor-
mation was obtained and is not prohibited by any
other provision of law.
412
Title II, Subtitle B
SEC. 2160. SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (g) may disclose protected health in-
formation if the disclosure is pursuant to any of the fol-
lowing:
(1) A subpoena issued under the authority of a
grand jury and the trustee is provided a written cer-
tification by the grand jury that the grand jury has
complied with the applicable access provisions of sec-
tion 2171.
(2) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the trust-
ee is provided a written certification by the person
seeking the information that the person has com-
plied with the applicable access provisions of section
2171 or 2173(a).
(3) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the dis-
closure otherwise meets the conditions of one of sec-
tions 2153 through 2159.
(b) AUTHORITY OF ALL TRUSTEES.—Any health in-
formation trustee may disclose protected health informa-
tion if the disclosure is pursuant to subsection (a)(3).