I 
108TH CONGRESS 
1ST SESSION H. R. 1709
To restore standards to protect the privacy of individually identifiable health 
information that were weakened by the August 2002 modifications, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 10, 2003
Mr. MARKEY (for himself, Mr. ROHRABACHER, Mr. WAXMAN, and Mr. DIN-
GELL) introduced the following bill; which was referred to the Committee 
on Energy and Commerce, and in addition to the Committees on Ways 
and Means, and Education and the Workforce, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To restore standards to protect the privacy of individually 
identifiable health information that were weakened by 
the August 2002 modifications, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Stop Taking Our 
Health Privacy (STOHP) Act of 2003’’. 
SEC. 2. FINDINGS. 
The Congress finds as follows:
(1) People in the United States are deeply con-
cerned about the confidentiality of their health infor-
mation. According to a survey conducted by the 
Princeton Survey Research Associates, 1 in 6 people 
in the United States has done something out of the 
ordinary to keep personal health information con-
fidential, including withholding information, pro-
viding inaccurate information, or, in some cases, 
avoiding care entirely. 
(2) Pursuant to the Health Insurance Port-
ability and Accountability Act of 1996, commonly re-
ferred to as ‘‘HIPAA’’ (Public Law 104–191; 110 
Stat. 1936 et seq.), the Department of Health and 
Human Services issued comprehensive medical pri-
vacy regulations, which were promulgated in final 
form in December 2000. 
(3) These regulations established a sound foun-
dation of privacy protections by prohibiting the use 
or disclosure of an individual’s health information 
unless specifically authorized by the regulations or 
by the individual. The regulations also required 
health care providers such as physicians and health 
clinics, health plans, and health care clearinghouses, 
which are responsible for handling transactions such 
as billing between health plans and providers, to no-
tify individuals about privacy practices regarding 
disclosure of health information. The regulations 
also provided individuals with the right to access and 
copy their own health records, and the right to re-
quest corrections of their health records, among 
other provisions. 
(4) The regulations took effect on April 14, 
2000, and required health care providers, health 
plans (other than small health plans), and health 
care clearinghouses to comply not later than April 
14, 2003. 
(5) On August 14, 2002, the Department of 
Health and Human Services issued modifications to 
the December 2000 medical privacy rule that signifi-
cantly weakened privacy protections. 
(6) These modifications eliminated the require-
ment that health care providers, health plans, and 
health care clearinghouses obtain patient consent be-
fore using or disclosing patient health information 
for treatment, payment, or health care operations. 
This change means that patients’ medical informa-
tion can be used or disclosed without their permis-
sion for a wide range of purposes, including business 
activities that have nothing to do with patient care, 
such as the sale or merger of a health maintenance
organization (HMO). This change also permits the 
use and disclosure of information in existing medical 
records even though patients disclosed the informa-
tion with the understanding and expectation that it 
would not be used or disclosed without their consent. 
The elimination of consent compromises the con-
fidentiality that is the heart of physician-patient re-
lationships and is indispensable for the delivery of 
high-quality health care. 
(7) The August 2002 modifications also under-
mined medical privacy protections by expanding the 
circumstances under which patients’ information can 
be shared without their knowledge or consent to in-
clude activities that consumers typically consider 
marketing. This change permits pharmacies and 
other providers to use consumers’ medical informa-
tion without their permission to mail them unsolic-
ited drug product recommendations. Furthermore, 
providers are not required to disclose fees paid to 
them by drug companies for sending such commu-
nications nor provide consumers with the choice to 
opt out of such future communications. 
(8) The August 2002 modifications further un-
dermined medical privacy protections by changing 
the section of the rule governing public health. The
change allows providers to disclose medical informa-
tion without patient permission to entities regulated 
by the Food and Drug Administration, such as phar-
maceutical companies and medical device manufac-
turers, for a broad range of purposes including mar-
keting campaigns. In contrast, the December 2000 
rule allowed nonconsensual disclosure of patient 
health information for a limited list of public health-
related activities, such as reporting serious side ef-
fects from a prescription drug to the Food and Drug 
Administration. 
(9) Reversal of the August 2002 modifications 
to the medical privacy rule is integral to any effort 
to ensure privacy protections for consumers’ per-
sonal health information and preserve access to 
high-quality health care in the United States. 
(10) Congress should restore core medical pri-
vacy protections of the December 2000 medical pri-
vacy rule by—
(A) reinstating the patient consent require-
ment for treatment, payment, and health care 
operations, while ensuring that the requirement 
does not impede important health care activities 
such as filling pharmaceutical prescriptions and 
making physician referrals;
(B) returning to the December 2000 defi-
nition of ‘‘marketing’’ and thus ensuring that 
activities typically considered ‘‘marketing,’’ such 
as drug companies paying pharmacies to send 
product recommendations to patients, fall under 
the rule’s privacy protections governing mar-
keting activities; and 
(C) eliminating the broad ‘‘public health’’ 
loophole created by the August 2002 rule. 
SEC. 3. PURPOSE. 
The purpose of this Act is to restore patient privacy 
protections essential for high-quality health care that were 
undermined by the August 2002 modifications of the De-
cember 2000 medical privacy rule. 
SEC. 4. RESTORATION OF PRIVACY PROTECTIONS. 
(a) CONSENT FOR USES OR DISCLOSURES TO CARRY 
OUT TREATMENT, PAYMENT, OR HEALTH CARE OPER-
ATIONS.—
(1) IN GENERAL.—The modifications made to 
section 164.506 of title 45, Code of Federal Regula-
tions, by the August 2002 medical privacy rule shall 
have no force or effect. 
(2) CLARIFICATION
REGARDING
INSTANCES 
WHEN CONSENT IS NOT REQUIRED.— In addition to 
the circumstances described in the December 2000
ment, that the individual’s consent is clear-
ly inferred from the circumstances, such as 
an order or referral from another health 
care provider; and 
(iv) the health care provider obtains 
written consent from the individual as soon 
as practicable. 
(b) MARKETING.—
(1) IN GENERAL.—The modifications made by 
the August 2002 medical privacy rule to the defini-
tion of the term ‘‘marketing’’ in section 164.501 of 
title 45, Code of Federal Regulations, shall have no 
force or effect. 
(2) TREATMENT
OF
CERTAIN
COMMUNICA-
TIONS.—The exception for oral communications in 
paragraph (2)(i) of the definition of the term ‘‘mar-
keting’’ in section 164.501 of title 45, Code of Fed-
eral Regulations, as contained in the December 2000 
medical privacy rule, shall have no force or effect. 
(3) AUTHORIZATIONS
FOR
MARKETING.—Sec-
tion 164.508 of title 45, Code of Federal Regula-
tions, shall be construed and applied so as to require 
that, if an authorization is required for a use or dis-
closure for marketing, the authorization shall be 
considered invalid unless it—
(A) uses the term ‘‘marketing’’; 
(B) states that the purpose of the use or 
disclosure involved is marketing; 
(C) describes the specific marketing uses 
and disclosures authorized, including whether 
the protected health information involved—
(i) may be used for purposes internal 
to the covered entity; 
(ii) may be disclosed to, and used by, 
a business associate of the covered entity; 
and 
(iii) may be disclosed to, and used by, 
any person or entity other than a business 
associate of the covered entity; and 
(D) states that the use or disclosure of 
protected health information for marketing will 
directly result in remuneration to the covered 
entity from a third party, in any case in which 
a covered entity expects, or reasonably should 
expect, that such remuneration will occur. 
(c) PUBLIC HEALTH.—The modifications made to 
section 164.512(b)(1)(iii) of title 45, Code of Federal Reg-
ulations, by the August 2002 medical privacy rule shall 
have no force or effect.
SEC. 5. DEFINITIONS; EFFECTIVE DATE. 
(a) IN GENERAL.—For purposes of this Act: 
(1) DECEMBER 2000 MEDICAL PRIVACY RULE.—
The term ‘‘December 2000 medical privacy rule’’ 
means the final rule on standards for privacy of in-
dividually identifiable health information published 
on December 28, 2000, in the Federal Register (65 
Fed. Reg. 82462), including the provisions of title 
45, Code of Federal Regulations, revised or added 
by such rule. 
(2) AUGUST 2002 MEDICAL PRIVACY RULE.—
The term ‘‘August 2002 medical privacy rule’’ 
means the final rule, published on August 14, 2002, 
in the Federal Register (67 Fed. Reg. 53182), that 
modified the December 2000 medical privacy rule. 
(b) OTHER TERMS DEFINED.—For purposes of this 
Act: 
(1) BUSINESS
ASSOCIATE; COVERED
ENTITY; 
HEALTH CARE PROVIDER.—The terms ‘‘business as-
sociate’’, ‘‘covered entity’’, and ‘‘health care pro-
vider’’ shall have the meaning given such terms in 
section 160.103 of title 45, Code of Federal Regula-
tions, as contained in the December 2000 medical 
privacy rule. 
(2) DISCLOSURE; 
INDIVIDUAL, 
PROTECTED 
HEALTH
INFORMATION; 
TREATMENT; 
USE.—The
terms ‘‘disclosure’’, ‘‘individual’’, ‘‘protected health 
information’’, ‘‘treatment’’, and ‘‘use’’ shall have the 
meaning given such terms in section 164.501 of title 
45, Code of Federal Regulations, as contained in the 
December 2000 medical privacy rule. 
(c) EFFECTIVE
DATE; NO
REGULATIONS
RE-
QUIRED.—This Act shall take effect on the date of the 
enactment of this Act and does not require the issuance 
of regulations.
Æ