respondent a reasonable attorney’s fee and other litigation
costs and expenses (including expert fees) reasonably in-
curred.
(c) LIMITATION.—No action may be commenced
under this subsection by an individual more than 2 years
after the date on which the violation was, or should rea-
sonably have been, discovered by the individual.
(d) NO
LIABILITY
FOR
PERMISSIBLE
DISCLO-
SURES.—A person who makes a disclosure of individually
identifiable health information about an individual that is
permitted under this Act shall not be liable to the indi-
vidual for such disclosure under common law.
SEC. 303. PROGRAM EXCLUSIONS.
(a) EXCLUSION FROM PARTICIPATION IN FEDERAL
AND STATE HEALTH CARE PROGRAMS.—Section 1128(b)
of the Social Security Act (42 U.S.C. 1320a–7(b)) is
amended by adding at the end the following:
‘‘(16) FAILURE LAWFULLY TO TREAT INDIVID-
UALLY IDENTIFIABLE HEALTH INFORMATION.—Any
individual or entity that the Secretary determines
has failed substantially to comply with a provision of
the Consumer Health and Research Technology
(CHART) Protection Act.’’.
(b) EXCLUSION OF PROVIDERS FROM PARTICIPA-
TION IN FEDERAL EMPLOYEES HEALTH BENEFITS PRO-
GRAM.—Section 8902a(b) of title 5, United States Code,
is amended by adding at the end the following:
‘‘(6) Any provider that the Secretary of Health
and Human Services has determined has failed sub-
stantially to comply with a provision of the Con-
sumer Health and Research Technology (CHART)
Protection Act.’’.
TITLE IV—GENERAL
PROVISIONS
SEC. 401. STANDARDS FOR ELECTRONIC DISCLOSURES.
The National Committee on Vital and Health Statis-
tics, in consultation with the National Science Foundation,
shall promulgate standards for disclosing, authorizing the
use and disclosure of, and authenticating, individually
identifiable health information in electronic form, in a
manner consistent with this Act.
SEC. 402. AUTHORIZED REPRESENTATIVES.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law, or by an
instrument recognized under law, to act as an agent, at-
torney, proxy, or other legal representative for an indi-
vidual, otherwise to exercise the rights of the individual,
may, to the extent so authorized, exercise and discharge
the rights of the individual under this Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is not described in subsection (a), but is authorized
by law or by an instrument recognized under law to make
decisions about the provision of health care to an indi-
vidual who is incapacitated, may exercise and discharge
the rights of the individual under this Act, to the extent
necessary to effectuate the terms or purposes of the grant
of authority.
(c) NO COURT DECLARATION.—If a health care pro-
vider determines that an individual, who has not been de-
clared to be legally incompetent, suffers from a medical
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right
of the individual to authorize disclosure under this Act
may be exercised and discharged in the best interest of
the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or (3) cannot be
contacted after a reasonable effort.
(d) APPLICATION TO DECEASED INDIVIDUALS.—The
provisions of this Act shall continue to apply to individ-
ually identifiable health information concerning a deceased
individual for a period of 2 years following the death of
that individual.
(e) EXERCISE OF RIGHTS ON BEHALF OF A DE-
CEASED INDIVIDUAL.—A person who is authorized by law
or by an instrument recognized under law, to act as an
executor of the estate of a deceased individual, or other-
wise to exercise the rights of the deceased individual, may,
to the extent so authorized, exercise and discharge the
rights of such deceased individual under this Act for a pe-
riod of 2 years following the death of that individual. If
no such designee has been authorized, the rights of the
deceased individual may be exercised as provided for in
subsection (c).
SEC. 403. RELATIONSHIP TO OTHER LAWS.
(a) IN GENERAL.—
(1) STATE LAW.—Except as provided in sub-
sections (b) through (f), the provisions of this Act
shall preempt any State law that directly relates to
matters covered by this Act.
(2) FEDERAL LAW.—This Act shall not be con-
strued as repealing, explicitly or implicitly, other
Federal laws or regulations relating to individually
identifiable health information or relating to an indi-
vidual’s access to health care services.
(b) PRIVILEGES.—This Act does not preempt or mod-
ify State common or statutory law to the extent such law
concerns a privilege of a witness or person in a court of
the State. This Act does not supersede or modify Federal
common or statutory law to the extent such law concerns
a privilege of a witness or person in a court of the United
States. The execution of an authorization pursuant to sec-
tion 103 may not be construed as a waiver of any such
privilege.
(c) CERTAIN DUTIES UNDER LAW.—Nothing in this
Act shall be construed to preempt, supersede, or modify
the operation of any State law that—
(1) provides for the reporting of vital statistics
such as birth or death information;
(2) requires the reporting of abuse, domestic vi-
olence, or neglect information about any individual;
(3) regulates information concerning an individ-
ual’s mental health or communicable disease status;
or
(4) governs a minor’s rights to access individ-
ually identifiable health information or health care
services.
(d) RELATIONSHIP TO CLINICAL RESEARCH AND RE-
PORTS.—This Act shall not apply to individually identifi-
able health information that is created, received, main-
tained, used, disclosed, or transmitted by any person in
connection with—
(1) any activity conducted pursuant to an inves-
tigational new drug exemption, or for which approval
of an institutional review board is required by the
Food and Drug Administration; or
(2) any record required to be maintained or re-
port required to be filed by the Food and Drug Ad-
ministration.
(e) FEDERAL PRIVACY ACT.—
(1) MEDICAL EXEMPTIONS.—Sections 552a of
title 5, United States Code, is amended by adding
at the end the following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is subject to the Consumer Health and Research
Technology (CHART) Protection Act shall promulgate
rules, in accordance with the requirements (including gen-
eral notice) of subsections (b)(1), (b)(2), (b)(3), (c), and
(e) of section 553 of this title, to exempt a system of
records within the agency, to the extent that the system
of records contains individually identifiable health infor-
mation (as defined in section 406 of such Act), from all
provisions of this section except subsections (b)(6), (d),
(e)(1), (e)(2), subparagraphs (A) and (C) and (E) through
(I) of subsection (e)(4), and subsections (e)(5), (e)(6),
(e)(9), (e)(12), (l), (n), (o), (p), (r), and (u).’’.
(2) 
TECHNICAL
AMENDMENT.—Section
552a(f)(3) of title 5, United States Code, is amend-
ed by striking ‘‘pertaining to him,’’ and all that fol-
lows through the semicolon and inserting ‘‘per-
taining to the individual;’’.
(f) APPLICATION
TO CERTAIN FEDERAL AGEN-
CIES.—
(1) DEPARTMENT OF DEFENSE.—
(A) EXCEPTIONS.—The Secretary of De-
fense may, by regulation, establish exceptions to
the requirements of this Act to the extent such
Secretary determines that disclosure of individ-
ually identifiable health information relating to
members of the Armed Forces from systems of
records operated by the Department of Defense
is necessary under circumstances different from
those permitted under this Act for the proper
conduct of national defense functions by mem-
bers of the Armed Forces.
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Defense may, by regu-
lation, establish for civilian employees of the
Department of Defense and employees of De-
partment of Defense contractors, limitations on
the right of such persons to revoke or amend
authorizations for disclosures under section 103
when such authorizations were provided by such
employees as a condition of employment and
the disclosure is determined necessary by the
Secretary of Defense to the proper conduct of
national defense functions by such employees.
(2) DEPARTMENT OF TRANSPORTATION.—
(A) 
EXCEPTIONS.—The 
Secretary 
of
Transportation may, with respect to members
of the Coast Guard, exercise the same powers
as the Secretary of Defense may exercise under
paragraph (1)(A).
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Transportation may,
with respect to civilian employees of the Coast
Guard and Coast Guard contractors, exercise
the same powers as the Secretary of Defense
may exercise under paragraph (1)(B).
(3) DEPARTMENT
OF
VETERANS
AFFAIRS.—
The limitations on use and disclosure of individually
identifiable health information under this Act shall
not be construed to prevent any exchange of such in-
formation within and among components of the De-
partment of Veterans Affairs that determine eligi-
bility for or entitlement to, or that provide, benefits
under laws administered by the Secretary of Veteran
Affairs.
SEC. 404. REPORTS ANALYZING IMPACT OF ACT.
(a) EFFORTS TO COMBAT FRAUD AND ABUSE.—Be-
ginning not later than 12 months after the effective date
in section 405(a), the Inspector General of the Depart-
ment of Health and Human Services shall submit to the
Committee on Ways and Means and the Committee on
Government Reform and Oversight of the House of Rep-
resentatives and the Committee on Commerce, Science,
and Transportation and the Committee on Finance of the
Senate an annual report containing the results of an an-
nual study. The study shall analyze whether this Act has
had an adverse effect on efforts to combat fraud and abuse
undertaken under title XVIII, XIX, or XXI of the Social
Security Act.
(b) HEALTH RESEARCH.—Beginning not later than
12 months after the effective date in section 405(a), the
Secretary, in consultation with the National Research
Council of the National Academy of Sciences and the In-
stitute of Medicine, shall submit to the Congress an an-
nual report containing the results of an annual study. The
study shall analyze the effect of this Act on the quality
and efficacy of health research.
(c) ADMINISTRATIVE SIMPLIFICATION.—Not later
than 12 months after the effective date in section 405(a),
the Comptroller General of the United States shall submit
to the Congress a report containing the results of a study.
The study shall analyze the effect of this Act on the imple-
mentation of subtitle F of title II of the Health Insurance
Portability and Accountability Act of 1996 and part C of
title XI of the Social Security Act.
SEC. 405. EFFECTIVE DATE.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act shall take effect on the date that is 18 months
after the date of the enactment of this Act.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro-
vision of this Act shall take effect on the date of the enact-
ment of this Act if the provision authorizes or requires
the Secretary of Defense, the Secretary of Transportation,
or the Secretary of Health and Human Services to de-
velop, establish, or promulgate regulations or model no-
tices.
(c) DEADLINE FOR REGULATIONS.—The Secretary
shall promulgate regulations implementing this Act not
later than the date that is 12 months after the date of
the enactment of this Act.
SEC. 406. DEFINITIONS.
As used in this Act:
(1) ARCHIVE.—The term ‘‘archive’’—
(A) means a repository of collected infor-
mation or material; and
(B) includes a tissue, blood, organ, or
sperm bank.
(2) EMPLOYER.—The term ‘‘employer’’ has the
meaning given such term under section 3(5) of the
Employee Retirement Income Security Act of 1974
(29 U.S.C. 1002(5)), except that such term shall in-
clude only employers of two or more employees.
(3) HEALTH CARE.—The term ‘‘health care’’
means—
(A) preventive, diagnostic, therapeutic, re-
habilitative, maintenance, or palliative care, in-
cluding appropriate assistance with disease or
symptom management and maintenance, coun-
seling, service, or procedure—
(i) with respect to the physical or
mental condition of an individual; or
(ii) affecting the structure or function
of the human body or any part of the
human body, including the banking of
blood, sperm, organs, or any other tissue;
and
(B) any sale or dispensing of a drug, de-
vice, equipment, or other health care related
item to an individual, or for the use of an indi-
vidual, pursuant to a prescription.
(4) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person, who with re-
spect to a specific item of individually identifiable
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by Federal or
State law to provide an item or service that
constitutes health care in the ordinary course of
business, or practice of a profession;
(B) a Federal, State, employer-sponsored
or other privately sponsored program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(5) HEALTH
OR
LIFE
INSURER.—The term
‘‘health or life insurer’’ means a health insurance
issuer as defined in section 9805(b)(2) of the Inter-
nal Revenue Code of 1986 or a life insurance com-
pany as defined in section 816 of such Code.
(6) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who, with
respect to a specific item of individually identifiable
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a person who performs or oversees the
performance of an assessment, evaluation, de-
termination, or investigation, relating to the li-
censing, accreditation, or credentialing of health
care providers; or
(B) a person who—
(i) performs or oversees the perform-
ance of an audit, assessment, evaluation,
determination, or investigation relating to
the effectiveness of, compliance with, or
applicability of, legal, fiscal, medical, or
scientific standards or aspects of perform-
ance related to the delivery of, or payment
activities related to, health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or car-
rying out activities under a Federal or
State law governing the assessment, eval-
uation, determination, investigation, or
prosecution described in subparagraph (A).
(7) HEALTH PLAN.—The term ‘‘health plan’’
means any health insurance issuer, health insurance
plan, including any hospital or medical service plan,
dental or other health service plan or health mainte-
nance organization plan, provider sponsored organi-
zation, or other program providing or arranging for
the provision of health benefits. Such term does not
include any policy, plan or program to the extent
that it provides, arranges or administers health ben-
efits pursuant to a program of workers compensa-
tion or automobile insurance.
(8) HEALTH
RESEARCH
AND
HEALTH
RE-
SEARCHER.—
(A) 
HEALTH
RESEARCH.—The 
term
‘‘health research’’ means a systematic investiga-
tion of health (including basic biological proc-
esses and structures), health care, or its deliv-
ery and financing, including research develop-
ment, testing and evaluation, designed to de-
velop or contribute to generalizable knowledge
concerning human health, health care, or health
care delivery.
(B) HEALTH
RESEARCHER.—The term
‘‘health researcher’’ means a person involved in
health research, or an officer, employee, or
agent of such person, who receives individually
identifiable health information as part of a re-
search project that involves data with respect to
human subjects.
(9) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘‘individually identifiable
health information’’ means any information, includ-
ing demographic information, collected from an indi-
vidual, whether oral or recorded in any form or me-
dium, that—
(A) is created or received by a health care
provider, health plan, health oversight agency,
public health authority, employer, health or life
insurer, school or university; and
(B)(i) relates to the past, present, or fu-
ture physical or mental health or condition of
an individual (including individual cells and
their components), the provision of health care
to an individual, or the past, present, or future
payment activities related to the provision of
health care to an individual; and
(ii)(I) identifies an individual;
(II) contains personal identifiers that pro-
vide a direct means of identifying the indi-
vidual; or
(III) has been provided in an encrypted
format that does not directly identify an indi-
vidual, but that provides a method for
decrypting the information which might reason-
ably be used by the recipient with the intent to
identify an individual.
(10) INSTITUTIONAL
REVIEW
BOARD.—The
term ‘‘institutional review board’’ means an entity—
(A) established to review proposed health
research with respect to potential risks to
human subjects pursuant to Federal regulations
adopted under section 1802(b) of the Public
Health Service Act (42 U.S.C. 300v–1(b)); and
(B) that satisfies the requirements of the
policy set forth in 45 C.F.R. § 46.107 (or any
successor to such policy).
(11) PAYMENT
ACTIVITIES.—The term ‘‘pay-
ment activities’’—
(A) means activities undertaken—
(i) by, or on behalf of, a health plan
to determine its responsibility for coverage
under the plan; or
(ii) by a health care provider to obtain
payment for items or services provided to
an individual, provided under a health plan
or provided based on a determination by
the health plan of responsibility for cov-
erage under the plan; and
(B) includes the following activities, when
performed in a manner consistent with subpara-
graph (A):
(i) Billing, claims management, med-
ical data processing, practice management,
or other administrative services and actual
payment.
(ii) Determinations of coverage or ad-
judication of health benefit claims and sub-
rogation claims.
(iii) Review of health care services
with respect to medical necessity, coverage
under a health plan, appropriateness of
care, or justification of charges.
(12) PERSON.—The term ‘‘person’’ means a
natural person, a government, governmental subdivi-
sion, agency or authority, a company, corporation,
estate, firm, trust, partnership, association, joint
venture, society, joint stock company, or any other
legal entity.
(13) PUBLIC HEALTH AUTHORITY.—The term
‘‘public health authority’’ means an authority or in-
strumentality of the United States, a tribal govern-
ment, a State, or a political subdivision of a State
that is—
(A) primarily responsible for public health
matters; and
(B) primarily engaged in activities such as
injury reporting, public health surveillance, and
public health investigation or intervention.
(14) QUALITY
ASSURANCE
ACTIVITIES.—The
term ‘‘quality assurance activities’’ means a formal