‘‘§ 1534. Knowing and unlawful obtaining of pro-
tected health information
‘‘Whoever knowingly obtains protected health infor-
mation from a health information trustee in violation of
the Fair Health Information Practices Act of 1997, know-
ing that such obtaining is unlawful, shall be fined under
this title or imprisoned not more than 5 years, or both.
‘‘§ 1535. Monetary gain from knowing and unlawful
obtaining of protected health information
‘‘Whoever knowingly—
‘‘(1) obtains protected health information from
a health information trustee in violation of the Fair
Health Information Practices Act of 1997, knowing
that such obtaining is unlawful and with the intent
to sell, transfer, or use such information for profit
or monetary gain; and
‘‘(2) knowingly sells, transfers, or uses such in-
formation for profit or monetary gain;
shall be fined under this title or imprisoned not more than
10 years, or both.
‘‘§ 1536. Knowing and unlawful use or disclosure of
protected health information
‘‘Whoever knowingly uses or discloses protected
health information in violation of the Fair Health Infor-
mation Practices Act of 1997, knowing that such use or
disclosure is unlawful, shall be fined under this title or
imprisoned not more than 5 years, or both.
‘‘§ 1537. Monetary gain from knowing and unlawful
sale, transfer, or use of protected health
information
‘‘Whoever knowingly sells, transfers, or uses pro-
tected health information in violation of the Fair Health
Information Practices Act of 1997, knowing that such
sale, transfer, or use is unlawful, shall be fined under this
title or imprisoned not more than 10 years, or both.’’.
(b) CLERICAL AMENDMENT.—The table of chapters
for part I of title 18, United States Code, is amended by
inserting after the item relating to chapter 73 the
following:
‘‘74. Obtaining protected health information ......................... 1531’’.
TITLE II—AMENDMENTS TO
TITLE 5, UNITED STATES CODE
SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.
(a) NEW SUBSECTION.—Section 552a of title 5,
United States Code, is amended by adding at the end the
following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is a health information trustee (as defined in sec-
tion 3(b)(5) of the Fair Health Information Practices Act
of 1997) shall promulgate rules, in accordance with the
requirements (including general notice) of subsections
(b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this
title, to exempt a system of records within the agency, to
the extent that the system of records contains protected
health information (as defined in section 3(a)(3) of such
Act), from all provisions of this section except subsections
(e)(1), (e)(2), subparagraphs (A) through (C) and (E)
through (I) of subsection (e)(4), and subsections (e)(5),
(e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.
(b) REPEAL.—Section 552a(f)(3) of title 5, United
States Code, is amended by striking ‘‘pertaining to him,’’
and all that follows through the semicolon and inserting
‘‘pertaining to the individual;’’.
TITLE 
III—REGULATIONS, 
RE-
SEARCH, 
AND 
EDUCATION;
EFFECTIVE DATES; APPLICA-
BILITY; AND RELATIONSHIP
TO OTHER LAWS
SEC. 301. REGULATIONS; RESEARCH AND EDUCATION.
(a) REGULATIONS.—Not later than July 1, 1999, the
Secretary shall prescribe regulations to carry out this Act.
(b) RESEARCH
AND TECHNICAL SUPPORT.—The
Secretary may sponsor—
(1) research relating to the privacy and security
of protected health information;
(2) the development of consent forms governing
disclosure of such information; and
(3) the development of technology to implement
standards regarding such information.
(c) EDUCATION.—The Secretary shall establish edu-
cation and awareness programs—
(1) to foster adequate security practices by
health information trustees;
(2) to train personnel of health information
trustees respecting the duties of such personnel with
respect to protected health information; and
(3) to inform individuals and employers who
purchase health care respecting their rights with re-
spect to such information.
(d) OFFICE OF INFORMATION PRIVACY.—
(1) ESTABLISHMENT.—There is established in
the Department of Health and Human Services,
within the Office of the Secretary, an Office of In-
formation Privacy. The Office of Information Pri-
vacy shall be headed by a Director, who shall also
be the Privacy Adviser of the Department of Health
and Human Services. The Director shall be the prin-
cipal adviser to the Secretary on the effect of the use
and disclosure of personally-identifiable information
on the privacy of individuals.
(2) DUTIES.—The Director of the Office of In-
formation Privacy shall—
(A) monitor and participate in the develop-
ment of regulations under this Act;
(B) monitor the implementation of this Act
within the Department of Health and Human
Services;
(C) advise the Secretary of the effects of
current activities and proposed statutory, regu-
latory, administrative, and budgetary actions on
the information privacy of individuals;
(D) monitor the implementation within the
Department of Health and Human Services of
laws and policies affecting the confidentiality of
personally-identifiable health information or
other personally-identifiable information;
(E) advise the Secretary on the implica-
tions for privacy of automated systems for the
collection, storage, analysis, or transfer of per-
sonally-identifiable health information or other
personally-identifiable information;
(F) engage in, or commission, research and
technical studies on the implications of policies
and practices for information privacy promul-
gated by the Secretary;
(G) serve as a point of contact within the
Department of Health and Human Services for
persons, such as other agencies of the Federal
Government, States, foreign governments, inter-
national organizations, privacy and consumer
advocacy organizations, businesses, nonprofit
organizations, and individuals, interested in the
effects on privacy of the collection, mainte-
nance, use, and disclosure of personally-identifi-
able health information or other personally-
identifiable information; and
(H) report from time to time to the Sec-
retary, the Congress, and the public on privacy
matters.
SEC. 302. EFFECTIVE DATES.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act, and the amendments made by this Act, shall
take effect on January 1, 2000.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—
(1) IN GENERAL.—A provision of this Act shall
take effect on the date of the enactment of this Act
if the provision—
(A) imposes a duty on the Secretary to de-
velop, establish, or promulgate regulations,
guidelines, notices, statements, or education
and awareness programs; or
(B) authorizes the Secretary to sponsor re-
search or the development of forms or tech-
nology.
(2) OFFICE OF INFORMATION PRIVACY.—Sec-
tion 301(d) (relating to the Office of Information
Privacy) shall take effect on the date of the enact-
ment of this Act.
SEC. 303. APPLICABILITY.
(a) PROTECTED HEALTH INFORMATION.—Except as
provided in subsections (b) and (c), the provisions of this
Act shall apply to any protected health information that
is received, created, used, maintained, or disclosed by a
health information trustee in a State on or after January
1, 2000, regardless of whether the information existed or
was disclosed prior to such date.
(b) EXCEPTION.—
(1) IN GENERAL.—The provisions of this Act
shall not apply to a trustee described in paragraph
(2), except with respect to protected health informa-
tion that is received by the trustee on or after Janu-
ary 1, 2000.
(2) APPLICABILITY.—A trustee referred to in
paragraph (1) is—
date or event (if any) specified in the authorization upon
which the authorization expires, whichever occurs earlier.
SEC. 304. RELATIONSHIP TO OTHER LAWS.
(a) STATE LAW.—Except as otherwise provided in
subsections (b), (c), (d), (e), and (g), a State may not es-
tablish, continue in effect, or enforce any State law to the
extent that the law is inconsistent with, or imposes addi-
tional requirements with respect to, any of the following:
(1) A duty of a health information trustee
under this Act.
(2) An authority of a health information trustee
under this Act to disclose protected health informa-
tion.
(3) A provision of subtitle C (relating to access
procedures and challenge rights), subtitle D (mis-
cellaneous provisions), or subtitle E (relating to en-
forcement).
(b) LAWS RELATING TO PUBLIC HEALTH AND MEN-
TAL HEALTH.—This Act does not preempt, supersede, or
modify the operation of any State law regarding public
health or mental health to the extent that the law prohibits
or regulates a disclosure of protected health information
that is permitted under this Act.
(c) CRIMINAL PENALTIES.—A State may establish
and enforce criminal penalties with respect to a failure to
comply with a provision of this Act.
(d) REQUIREMENTS ON STATE AGENCIES.—A State
may establish, continue in effect, and enforce any State
law to the extent that the law imposes on a judicial, legis-
lative, or executive agency of the State a requirement, lim-
itation, or procedure with respect to the use or disclosure
of protected health information that is in addition to the
requirements, limitations, and procedures imposed under
this Act.
(e) PRIVILEGES.—A privilege that a person has
under law in a court of a State or the United States or
under the rules of any agency of a State or the United
States may not be diminished, waived, or otherwise af-
fected by—
(1) the execution by a protected individual of an
authorization for disclosure of protected health in-
formation under this Act, if the authorization is exe-
cuted for the purpose of receiving health care or pro-
viding for the payment for health care; or
(2) any provision of this Act that authorizes the
disclosure of protected health information for the
purpose of receiving health care or providing for the
payment for health care.
(f) DEPARTMENT OF VETERANS AFFAIRS.—The lim-
itations on use and disclosure of protected health informa-
tion under this Act shall not be construed to prevent any
exchange of such information within and among compo-
nents of the Department of Veterans Affairs that deter-
mine eligibility for or entitlement to, or that provide, bene-
fits under laws administered by the Secretary of Veterans
Affairs.
(g) CERTAIN DUTIES UNDER STATE OR FEDERAL
LAW.—This Act shall not be construed to preempt, super-
sede, or modify the operation of any of the following:
(1) Any law that provides for the reporting of
vital statistics such as birth or death information.
(2) Any law requiring the reporting of abuse or
neglect information about any individual.
(3) Subpart II of part E of title XXVI of the
Public Health Service Act (relating to notifications
of emergency response employees of possible expo-
sure to infectious diseases).
(4) The Americans with Disabilities Act of
1990.
(5) Any Federal or State statute that estab-
lishes a privilege for records used in health profes-
sional peer review activities.
(h) SECRETARIAL AUTHORITY.—
(1) SECRETARY OF HEALTH AND HUMAN SERV-
ICES.—A provision of this Act does not preempt, su-
persede, or modify the operation of section 543 of
the Public Health Service Act, except to the extent
that the Secretary of Health and Human Services
determines through regulations promulgated by such
Secretary that the provision provides greater protec-
tion for protected health information, and the rights
of protected individuals, than is provided under such
section 543.
(2) SECRETARY
OF
VETERANS
AFFAIRS.—A
provision of this Act does not preempt, supersede, or
modify the operation of section 7332 of title 38,
United States Code, except to the extent that the
Secretary of Veterans Affairs determines through
regulations promulgated by such Secretary that the
provision provides greater protection for protected
health information, and the rights of protected indi-
viduals, than is provided under such section 7332.
Æ