(4) governs a minor’s rights to access individ-
ually identifiable health information or health care
services.
(d) RELATIONSHIP TO CLINICAL RESEARCH AND RE-
PORTS.—This Act shall not apply to individually identifi-
able health information that is created, received, main-
tained, used, disclosed, or transmitted by any person in
connection with—
(1) any activity conducted pursuant to an inves-
tigational new drug exemption, or for which approval
of an institutional review board is required by the
Food and Drug Administration; or
(2) any record required to be maintained or re-
port required to be filed by the Food and Drug Ad-
ministration.
(e) FEDERAL PRIVACY ACT.—
(1) MEDICAL EXEMPTIONS.—Sections 552a of
title 5, United States Code, is amended by adding
at the end the following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is subject to the Consumer Health and Research
Technology (CHART) Protection Act shall promulgate
rules, in accordance with the requirements (including gen-
eral notice) of subsections (b)(1), (b)(2), (b)(3), (c), and
(e) of section 553 of this title, to exempt a system of
records within the agency, to the extent that the system
of records contains individually identifiable health infor-
mation (as defined in section 406 of such Act), from all
provisions of this section except subsections (b)(6), (d),
(e)(1), (e)(2), subparagraphs (A) and (C) and (E) through
(I) of subsection (e)(4), and subsections (e)(5), (e)(6),
(e)(9), (e)(12), (l), (n), (o), (p), (r), and (u).’’.
(2) 
TECHNICAL
AMENDMENT.—Section
552a(f)(3) of title 5, United States Code, is amend-
ed by striking ‘‘pertaining to him,’’ and all that fol-
lows through the semicolon and inserting ‘‘pertain-
ing to the individual;’’.
(f) APPLICATION
TO CERTAIN FEDERAL AGEN-
CIES.—
(1) DEPARTMENT OF DEFENSE.—
(A) EXCEPTIONS.—The Secretary of De-
fense may, by regulation, establish exceptions to
the requirements of this Act to the extent such
Secretary determines that disclosure of individ-
ually identifiable health information relating to
members of the Armed Forces from systems of
records operated by the Department of Defense
is necessary under circumstances different from
those permitted under this Act for the proper
conduct of national defense functions by mem-
bers of the Armed Forces.
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Defense may, by regu-
lation, establish for civilian employees of the
Department of Defense and employees of De-
partment of Defense contractors, limitations on
the right of such persons to revoke or amend
authorizations for disclosures under section 103
when such authorizations were provided by such
employees as a condition of employment and
the disclosure is determined necessary by the
Secretary of Defense to the proper conduct of
national defense functions by such employees.
(2) DEPARTMENT OF TRANSPORTATION.—
(A) 
EXCEPTIONS.—The 
Secretary 
of
Transportation may, with respect to members
of the Coast Guard, exercise the same powers
as the Secretary of Defense may exercise under
paragraph (1)(A).
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Transportation may,
with respect to civilian employees of the Coast
Guard and Coast Guard contractors, exercise
the same powers as the Secretary of Defense
may exercise under paragraph (1)(B).
(3) DEPARTMENT
OF
VETERANS
AFFAIRS.—
The limitations on use and disclosure of individually
identifiable health information under this Act shall
not be construed to prevent any exchange of such in-
formation within and among components of the De-
partment of Veterans Affairs that determine eligi-
bility for or entitlement to, or that provide, benefits
under laws administered by the Secretary of Veteran
Affairs.
SEC. 404. REPORTS ANALYZING IMPACT OF ACT.
(a) EFFORTS TO COMBAT FRAUD AND ABUSE.—Be-
ginning not later than 12 months after the effective date
in section 405(a), the Inspector General of the Depart-
ment of Health and Human Services shall submit to the
Committee on Ways and Means and the Committee on
Government Reform and Oversight of the House of Rep-
resentatives and the Committee on Commerce, Science,
and Transportation and the Committee on Finance of the
Senate an annual report containing the results of an an-
nual study. The study shall analyze whether this Act has
had an adverse effect on efforts to combat fraud and abuse
undertaken under title XVIII, XIX, or XXI of the Social
Security Act.
(b) HEALTH RESEARCH.—Beginning not later than
12 months after the effective date in section 405(a), the
Secretary, in consultation with the National Research
Council of the National Academy of Sciences and the In-
stitute of Medicine, shall submit to the Congress an an-
nual report containing the results of an annual study. The
study shall analyze the effect of this Act on the quality
and efficacy of health research.
(c) ADMINISTRATIVE SIMPLIFICATION.—Not later
than 12 months after the effective date in section 405(a),
the Comptroller General of the United States shall submit
to the Congress a report containing the results of a study.
The study shall analyze the effect of this Act on the imple-
mentation of subtitle F of title II of the Health Insurance
Portability and Accountability Act of 1996 and part C of
title XI of the Social Security Act.
SEC. 405. EFFECTIVE DATE.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act shall take effect on the date that is 18 months
after the date of the enactment of this Act.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro-
vision of this Act shall take effect on the date of the enact-
ment of this Act if the provision authorizes or requires
the Secretary of Defense, the Secretary of Transportation,
or the Secretary of Health and Human Services to de-
velop, establish, or promulgate regulations or model no-
tices.
(c) DEADLINE FOR REGULATIONS.—The Secretary
shall promulgate regulations implementing this Act not
later than the date that is 12 months after the date of
the enactment of this Act.
SEC. 406. DEFINITIONS.
As used in this Act:
(1) EMPLOYER.—The term ‘‘employer’’ has the
meaning given such term under section 3(5) of the
Employee Retirement Income Security Act of 1974
(29 U.S.C. 1002(5)), except that such term shall in-
clude only employers of two or more employees.
(2) HEALTH CARE.—The term ‘‘health care’’
means—
(A) preventive, diagnostic, therapeutic, re-
habilitative, maintenance, or palliative care, in-
cluding appropriate assistance with disease or
symptom management and maintenance, coun-
seling, service, or procedure—
(i) with respect to the physical or
mental condition of an individual; or
(ii) affecting the structure or function
of the human body or any part of the
human body, including the banking of
blood, sperm, organs, or any other tissue;
and
(B) any sale or dispensing of a drug, de-
vice, equipment, or other health care related
item to an individual, or for the use of an indi-
vidual, pursuant to a prescription.
(3) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person, who with re-
spect to a specific item of individually identifiable
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by Federal or
State law to provide an item or service that
constitutes health care in the ordinary course of
business, or practice of a profession;
(B) a Federal, State, employer-sponsored
or other privately sponsored program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(4) HEALTH
OR
LIFE
INSURER.—The term
‘‘health or life insurer’’ means a health insurance
issuer as defined in section 9805(b)(2) of the Inter-
nal Revenue Code of 1986 or a life insurance com-
pany as defined in section 816 of such Code.
(5) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who, with
respect to a specific item of individually identifiable
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a person who performs or oversees the
performance of an assessment, evaluation, de-
termination, or investigation, relating to the li-
censing, accreditation, or credentialing of health
care providers; or
(B) a person who—
(i) performs or oversees the perform-
ance of an audit, assessment, evaluation,
determination, or investigation relating to
the effectiveness of, compliance with, or
applicability of, legal, fiscal, medical, or
scientific standards or aspects of perform-
ance related to the delivery of, or payment
activities related to, health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a Federal or State
law governing the assessment, evaluation,
determination, investigation, or prosecution
described in subparagraph (A).
(6) HEALTH PLAN.—The term ‘‘health plan’’
means any health insurance plan, including any hos-
pital or medical service plan, dental or other health
service plan, health maintenance organization plan,
plan offered by a provider-sponsored organization
(as defined in section 1855(d) of the Social Security
Act (42 U.S.C. 1395w–25(d))), or other program
providing or arranging for the provision of health
benefits, whether or not funded through the pur-
chase of insurance.
(7) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person, or an officer, employee,
or agent of a person, who receives individually iden-
tifiable health information as part of a research
project that involves data with respect to human
subjects.
(8) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘‘individually identifiable
health information’’ means any information, includ-
ing demographic information, collected from an indi-
vidual, whether oral or recorded in any form or me-
dium, that—
(A) is created or received by a health care
provider, health plan, health oversight agency,
public health authority, employer, health or life
insurer, school or university; and
(B)(i) relates to the past, present, or fu-
ture physical or mental health or condition of
an individual (including individual cells and
their components), the provision of health care
to an individual, or the past, present, or future
payment activities related to the provision of
health care to an individual; and
(ii)(I) identifies an individual;
(II) contains personal identifiers that pro-
vide a direct means of identifying the individ-
ual; or
(III) has been provided in an encrypted
format that does not directly identify an indi-
vidual, but that provides a method for
decrypting the information.
(9) INSTITUTIONAL REVIEW BOARD.—The term
‘‘institutional review board’’ means an entity estab-
lished to review proposed health research with re-
spect to potential risks to human subjects pursuant
to Federal regulations adopted under section
1802(b) of the Public Health Service Act (42 U.S.C.
300v–1(b)).
(10) PAYMENT
ACTIVITIES.—The term ‘‘pay-
ment activities’’—
(A) means activities undertaken—
(i) by, or on behalf of, a health plan
to determine its responsibility for coverage
under the plan; or
(ii) by a health care provider to obtain
payment for items or services provided to
an individual, provided under a health plan
or provided based on a determination by
the health plan of responsibility for cov-
erage under the plan; and
(B) includes the following activities, when
performed in a manner consistent with subpara-
graph (A):
(i) Billing, claims management, medi-
cal data processing, practice management,
or other administrative services and actual
payment.
(ii) Determinations of coverage or ad-
judication of health benefit claims and sub-
rogation claims.
(iii) Review of health care services
with respect to medical necessity, coverage
under a health plan, appropriateness of
care, or justification of charges.
(11) PERSON.—The term ‘‘person’’ means a
natural person, a government, governmental subdivi-
sion, agency or authority, a company, corporation,
estate, firm, trust, partnership, association, joint
venture, society, joint stock company, or any other
legal entity.
(12) PUBLIC HEALTH AUTHORITY.—The term
‘‘public health authority’’ means an authority or in-
strumentality of the United States, a tribal govern-
ment, a State, or a political subdivision of a State
that is—
(A) primarily responsible for public health
matters; and
(B) primarily engaged in activities such as
injury reporting, public health surveillance, and
public health investigation or intervention.
(13) QUALITY
ASSURANCE
ACTIVITIES.—The
term ‘‘quality assurance activities’’ means a formal
methodology and set of activities designed to assess
the quality of health care services provided to an in-
dividual. The term includes formal review of care,
problem identification, corrective actions taken to
remedy any deficiencies, and evaluation of actions
taken. The term also includes activities undertaken
by a quality control and peer review organization (as
defined in section 1152 of the Social Security Act
(42 U.S.C. 1320c–1)).
(14) SCHOOL
OR
UNIVERSITY.—The term
‘‘school or university’’ means an institution or place
accredited or licensed for purposes of providing in-
struction or education, including an elementary
school, secondary school, or institution of higher
learning, a college, or an assemblage of colleges
united under one corporate organization or govern-
ment.
(15) 
SECRETARY.—The 
term 
‘‘Secretary’’
means the Secretary of Health and Human Services.
(16) STATE.—The term ‘‘State’’ includes the
District of Columbia, Puerto Rico, the Virgin Is-
lands, Guam, American Samoa, and the Northern
Mariana Islands.
(17) WRITING.—The term ‘‘writing’’ means
writing in either a paper-based or computer-based
form, including electronic signatures.
Æ