(3) shall remove or destroy, at the earliest op-
portunity consistent with the purposes of the ap-
proved health research project in connection with
which the disclosure was made, information that
would enable an individual to be identified, unless a
certified institutional review board has determined
that there is a health or research justification for re-
tention of such identifiers and there is an adequate
plan to protect the identifiers from use and disclo-
sure that is inconsistent with this Act.
(c) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any health information
trustee other than a person who, with respect to the spe-
cific protected health information to be disclosed under
such subsection, received the information—
(1) pursuant to—
(A) section 118 (relating to judicial and
administrative purposes);
(B) paragraph (1), (2), (3), or (4) of sec-
tion 119(a) (relating to law enforcement); or
(C) section 120 (relating to subpoenas,
warrants, and search warrants); or
(2) while acting in whole or in part in the ca-
pacity of an officer or employee of a person de-
scribed in paragraph (1).
(d) REQUIREMENTS
FOR INSTITUTIONAL REVIEW
BOARDS.—
(1) REGULATIONS.—Not later than July 1,
1999, the Secretary, after opportunity for notice and
comment, shall promulgate regulations establishing
requirements for certified institutional review boards
under this Act. The regulations shall be based on
regulations promulgated under section 491(a) of the
Public Health Service Act and shall ensure that cer-
tified institutional review boards are qualified to as-
sess and protect the confidentiality of research sub-
jects.
(2) CERTIFICATION.—The Secretary shall cer-
tify that an institutional review board satisfies the
requirements of the regulations promulgated under
paragraph (1).
SEC. 117. EMERGENCY CIRCUMSTANCES.
(a) IN GENERAL.—A health information trustee may
disclose protected health information if the trustee be-
lieves, on reasonable grounds, that the disclosure is nec-
essary to prevent or lessen a serious and imminent threat
to the health or safety of an individual.
(b) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and related to receipt of health care or pay-
ment for health care.
SEC. 118. JUDICIAL AND ADMINISTRATIVE PURPOSES.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (d) may disclose protected health in-
formation—
(1) pursuant to the Federal Rules of Civil Pro-
cedure, the Federal Rules of Criminal Procedure, or
comparable rules of other courts or administrative
agencies in connection with litigation or proceedings
to which a protected individual who is a subject of
the information is a party and in which the individ-
ual has placed the individual’s physical or mental
condition or functional status in issue;
(2) if directed by a court in connection with a
court-ordered examination of an individual; or
(3) to assist in the identification of a dead
individual.
(b) WRITTEN STATEMENT.—A person seeking pro-
tected health information about a protected individual held
by health information trustee under—
(1) subsection (a)(1)—
(A) shall notify the protected individual or
the attorney of the protected individual of the
request for the information;
(B) shall provide the trustee with a signed
document attesting—
(i) that the protected individual is a
party to the litigation or proceedings for
which the information is sought;
(ii) that the individual has placed the
individual’s physical or mental condition or
functional status in issue; and
(iii) the date on which the protected
individual or the attorney of the protected
individual was notified under subparagraph
(A); and
(C) shall not accept any requested pro-
tected health information from the trustee until
the termination of the 10-day period beginning
on the date notice was given under subpara-
graph (A); or
(2) subsection (a)(3) shall provide the trustee
with a written statement that the information is
sought to assist in the identification of a dead indi-
vidual.
(c) USE AND DISCLOSURE.—A person to whom pro-
tected health information is disclosed under this section
may use and disclose the information only to accomplish
the purpose for which the disclosure was made.
(d) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any of the following:
(1) A health benefit plan sponsor.
(2) A health care provider.
(3) A health oversight agency.
(4) A person who, with respect to the specific
protected health information to be disclosed under
such subsection, received the information—
(A) pursuant to—
(i) section 117 (relating to emergency
circumstances); or
(ii) section 120 (relating to subpoe-
nas, warrants, and search warrants); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
SEC. 119. LAW ENFORCEMENT.
(a) IN GENERAL.—A health information trustee may
disclose protected health information to a law enforcement
agency, other than a health oversight agency—
(1) if the information is disclosed for use in an
investigation or prosecution of a health information
trustee;
(2) in connection with criminal activity commit-
ted against the trustee or an affiliated person of the
trustee or on premises controlled by the trustee; or
(3) if the information is needed to determine
whether a crime has been committed and the nature
of any crime that may have been committed (other
than a crime that may have been committed by the
protected individual who is the subject of the infor-
mation).
(b) ADDITIONAL AUTHORITY OF CERTAIN TRUST-
EES.—A health information trustee who is not a public
health authority or a health researcher may disclose pro-
tected health information to a law enforcement agency
(other than a health oversight agency)—
(1) to assist in the identification or location of
a victim, fugitive, or witness in a law enforcement
inquiry;
(2) pursuant to a law requiring the reporting of
specific health care information to law enforcement
authorities; or
(3) if the information is specific health informa-
tion described in paragraph (2) and the trustee is
operated by a Federal agency;
(c) CERTIFICATION.—Where a law enforcement agen-
cy requests a health information trustee to disclose pro-
tected health information under subsection (a) or (b)(1),
the agency shall provide the trustee with a written certifi-
cation that—
(1) is signed by a supervisory official of a rank
designated by the head of the agency;
(2) specifies the information requested; and
(3) states that the information is needed for a
lawful purpose under this section.
(d) RESTRICTIONS ON DISCLOSURE AND USE.—A
person who receives protected health information about a
protected individual through a disclosure under this sec-
tion may not use or disclose the information—
(1) in any administrative, civil, or criminal ac-
tion or investigation directed against the individual,
except an action or investigation arising out of and
directly related to the action or investigation for
which the information was obtained; and
(2) otherwise unless the use or disclosure is
necessary to fulfill the purpose for which the infor-
mation was obtained and is not prohibited by any
other provision of law.
SEC. 120. SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (g) may disclose protected health in-
formation if the disclosure is pursuant to any of the fol-
lowing:
(1) A subpoena issued under the authority of a
grand jury and the trustee is provided a written cer-
tification by the grand jury that the grand jury has
complied with the applicable access provisions of sec-
tion 131.
(2) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the trust-
ee is provided a written certification by the person
seeking the information that the person has com-
plied with the applicable access provisions of section
131 or 133(a).
(3) An administrative subpoena or warrant or
a judicial subpoena or search warrant and the dis-
closure otherwise meets the conditions of one of sec-
tions 113 through 119.
(b) AUTHORITY OF ALL TRUSTEES.—Any health in-
formation trustee may disclose protected health informa-
tion if the disclosure is pursuant to subsection (a)(3).
(c) RESTRICTIONS ON USE AND DISCLOSURE.—Pro-
tected health information about a protected individual that
is disclosed by a health information trustee pursuant to—
(1) subsection (a)(2) may not be otherwise used
or disclosed by the recipient unless the use or disclo-
sure is necessary to fulfill the purpose for which the
information was obtained; and
(2) subsection (a)(3) may not be used or dis-
closed by the recipient unless the recipient complies
with the conditions and restrictions on use and dis-
closure with which the recipient would have been re-
quired to comply if the disclosure by the trustee had
been made under the section referred to in sub-
section (a)(3) the conditions of which were met by
the disclosure.
(d) RESTRICTIONS ON GRAND JURIES.—Protected
health information that is disclosed by a health informa-
tion trustee under subsection (a)(1)—
(1) shall be returnable on a date when the
grand jury is in session and actually presented to
the grand jury;
(2) shall be used only for the purpose of consid-
ering whether to issue an indictment or report by
that grand jury, or for the purpose of prosecuting a
crime for which that indictment or report is issued,
or for a purpose authorized by rule 6(e) of the Fed-
eral Rules of Criminal Procedure or a comparable
State rule;
(3) shall be destroyed or returned to the trustee
if not used for one of the purposes specified in para-
graph (2); and
(4) shall not be maintained, or a description of
the contents of such information shall not be main-
tained, by any government authority other than in
the sealed records of the grand jury, unless such in-
formation has been used in the prosecution of a
crime for which the grand jury issued an indictment
or presentment or for a purpose authorized by rule
6(e) of the Federal Rules of Criminal Procedure or
a comparable State rule.
(e) USE IN ACTION AGAINST INDIVIDUAL.—A person
who receives protected health information about a pro-
tected individual through a disclosure under this section
may not use or disclose the information in any administra-
tive, civil, or criminal action or investigation directed
against the individual, except an action or investigation
arising out of and directly related to the inquiry for which
the information was obtained;
(f) CONSTRUCTION.—Nothing in this section shall be
construed as authority for a health information trustee to
refuse to comply with a valid administrative subpoena or
warrant or a valid judicial subpoena or search warrant
that meets the requirements of this Act.
(g) APPLICABILITY.—A health information trustee
referred to in subsection (a) is any trustee other than the
following:
(1) A public health authority.
(2) A health researcher.
Subtitle C—Access Procedures and
Challenge Rights
SEC. 131. ACCESS PROCEDURES FOR LAW ENFORCEMENT
SUBPOENAS, WARRANTS, AND SEARCH WAR-
RANTS.
(a) PROBABLE CAUSE REQUIREMENT.—A govern-
ment authority may not obtain protected health informa-
tion about a protected individual from a health informa-
tion trustee under paragraph (1) or (2) of section 120(a)
for use in a law enforcement inquiry unless there is prob-
able cause to believe that the information is relevant to
a legitimate law enforcement inquiry being conducted by
the government authority.
(b) WARRANTS AND SEARCH WARRANTS.—A govern-
ment authority that obtains protected health information
about a protected individual from a health information
trustee under circumstances described in subsection (a)
and pursuant to a warrant or search warrant shall, not
later than 30 days after the date the warrant was served
on the trustee, serve the individual with, or mail to the
last known address of the individual, a copy of the
warrant.
(c) SUBPOENAS.—Except as provided in subsection
(d), a government authority may not obtain protected
health information about a protected individual from a
health information trustee under circumstances described
in subsection (a) and pursuant to a subpoena unless a
copy of the subpoena has been served by hand delivery
upon the individual, or mailed to the last known address
of the individual, on or before the date on which the sub-
poena was served on the trustee, together with a notice
(published by the Secretary under section 135(1)) of the
individual’s right to challenge the subpoena in accordance
with section 132, and—
(1) 30 days have passed from the date of serv-
ice, or 30 days have passed from the date of mailing,
and within such time period the individual has not
initiated a challenge in accordance with section 132;
or
(2) disclosure is ordered by a court under sec-
tion 132.
(d) APPLICATION FOR DELAY.—
(1) IN GENERAL.—A government authority may
apply to an appropriate court to delay (for an initial
period of not longer than 90 days) serving a copy of
a subpoena and a notice otherwise required under
subsection (c) with respect to a law enforcement in-
quiry. The government authority may apply to the
court for extensions of the delay.
(2) REASONS FOR DELAY.—An application for
a delay, or extension of a delay, under this sub-
section shall state, with reasonable specificity, the
reasons why the delay or extension is being sought.
(3) EX PARTE ORDER.—The court shall enter
an ex parte order delaying, or extending the delay
of, the notice and an order prohibiting the trustee
from revealing the request for, or the disclosure of,
the protected health information being sought if the
court finds that—
(A) the inquiry being conducted is within
the lawful jurisdiction of the government au-
thority seeking the protected health informa-
tion;
(B) there is probable cause to believe that
the protected health information being sought is
relevant to a legitimate law enforcement inquiry
being conducted by the government authority;
(C) the government authority’s need for
the information outweighs the privacy interest
of the protected individual who is the subject of
the information; and
(D) there are reasonable grounds to believe
that receipt of a notice by the individual will re-
sult in—
(i) endangering the life or physical
safety of any individual;
(ii) flight from prosecution;
(iii) destruction of or tampering with
evidence or the information being sought;
or
(iv) intimidation of potential wit-
nesses.
(4) SERVICE
OF
APPLICATION
ON
INDIVID-
UAL.—Upon the expiration of a period of delay of
notice under this subsection, the government author-
ity shall serve upon the individual, with the service
of the subpoena and the notice, a copy of any appli-
cations filed and approved under this subsection.
SEC. 132. CHALLENGE PROCEDURES FOR LAW ENFORCE-
MENT SUBPOENAS.
(a) MOTION TO QUASH SUBPOENA.—Within 30 days
of the date of service, or 30 days of the date of mailing,
of a subpoena of a government authority seeking protected
health information about a protected individual from a
health information trustee under paragraph (1) or (2) of
section 120(a) (except a subpoena to which section 133
applies), the individual may file (without filing fee) a mo-
tion to quash the subpoena—
(1) in the case of a State judicial subpoena, in
the court which issued the subpoena;
(2) in the case of a subpoena issued under the
authority of a State that is not a State judicial sub-
poena, in a court of competent jurisdiction;
(3) in the case of a subpoena issued under the
authority of a Federal court, in any court of the
United States of competent jurisdiction; or
(4) in the case of any other subpoena issued
under the authority of the United States, in—
(A) the United States district court for the
district in which the individual resides or in
which the subpoena was issued; or
(B) another United States district court of
competent jurisdiction.
(b) COPY.—A copy of the motion shall be served by
the individual upon the government authority by delivery
of registered or certified mail.
(c) AFFIDAVITS AND SWORN DOCUMENTS.—The gov-
ernment authority may file with the court such affidavits
and other sworn documents as sustain the validity of the
subpoena. The individual may file with the court, within
5 days of the date of the authority’s filing, affidavits and
sworn documents in response to the authority’s filing. The
court, upon the request of the individual, the government
authority, or both, may proceed in camera.
(d) PROCEEDINGS AND DECISION ON MOTION.—The
court may conduct such proceedings as it deems appro-
priate to rule on the motion. All such proceedings shall
be completed, and the motion ruled on, within 10 calendar
days of the date of the government authority’s filing.
(e) EXTENSION
OF
TIME
LIMITS
FOR
GOOD
CAUSE.—The court, for good cause shown, may at any
time in its discretion enlarge the time limits established
by subsections (c) and (d).
(4) the importance of the inquiry being con-
ducted by the government authority, and the impor-
tance of the information to that inquiry; and
(5) any other factor deemed relevant by the
court.
(h) ATTORNEY’S FEES.—In the case of any motion
brought under subsection (a) in which the individual has
substantially prevailed, the court, in its discretion, may as-
sess against a government authority a reasonable attor-
ney’s fee and other litigation costs (including expert fees)
reasonably incurred.
(i) NO INTERLOCUTORY APPEAL.—A court ruling de-
nying a motion to quash under this section shall not be
deemed a final order and no interlocutory appeal may be
taken therefrom by the individual. An appeal of such a
ruling may be taken by the individual within such period
of time as is provided by law as part of any appeal from
a final order in any legal proceeding initiated against the
individual arising out of or based upon the protected
health information disclosed.
SEC. 133. ACCESS AND CHALLENGE PROCEDURES FOR
OTHER SUBPOENAS.
(a) IN GENERAL.—A person (other than a govern-
ment authority seeking protected health information under
circumstances described in section 131(a)) may not obtain
protected health information about a protected individual
from a health information trustee pursuant to a subpoena
under section 120(a)(2) unless—
(1) a copy of the subpoena has been served
upon the individual or mailed to the last known ad-
dress of the individual on or before the date on
which the subpoena was served on the trustee, to-
gether with a notice (published by the Secretary
under section 135(2)) of the individual’s right to
challenge the subpoena, in accordance with sub-
section (b); and
(2) either—
(A) 30 days have passed from the date of
service or 30 days have passed from the date of
the mailing and within such time period the in-
dividual has not initiated a challenge in accord-
ance with subsection (b); or
(B) disclosure is ordered by a court under
such subsection.
(b) MOTION TO QUASH.—Within 30 days of the date
of service or 30 days of the date of mailing of a subpoena
seeking protected health information about a protected in-
dividual from a health information trustee under sub-
section (a), the individual may file (without filing fee) in
any court of competent jurisdiction, a motion to quash the
subpoena, with a copy served on the person seeking the
information. The individual may oppose, or seek to limit,
the subpoena on any grounds that would otherwise be
available if the individual were in possession of the infor-
mation.
(c) STANDARD
FOR DECISION.—The court shall
grant an individual’s motion under subsection (b) if the
person seeking the information has not sustained the bur-
den of demonstrating that—
(1) there are reasonable grounds to believe that
the information will be relevant to a lawsuit or other
judicial or administrative proceeding; and
(2) the need of the person for the information
outweighs the privacy interest of the individual.
(d) SPECIFIC CONSIDERATIONS WITH RESPECT TO
PRIVACY INTEREST.—In determining under subsection (c)
whether the need of the person for the information out-
weighs the privacy interest of the individual, the court
shall consider—
(1) the particular purpose for which the infor-
mation was collected by the trustee;
(2) the degree to which disclosure of the infor-
mation will embarrass, injure, or invade the privacy
of the individual;
(3) the effect of the disclosure on the individ-
ual’s future health care;
(4) the importance of the information to the
lawsuit or proceeding; and
(5) any other factor deemed relevant by the
court.
(e) ATTORNEY’S FEES.—In the case of any motion
brought under subsection (b) by an individual against a
person in which the individual has substantially prevailed,
the court, in its discretion, may assess against the person
a reasonable attorney’s fee and other litigation costs (in-
cluding expert fees) reasonably incurred.
SEC. 134. CONSTRUCTION OF SUBTITLE; SUSPENSION OF
STATUTE OF LIMITATIONS.
(a) IN GENERAL.—Nothing in this subtitle shall af-
fect the right of a health information trustee to challenge
a request for protected health information. Nothing in this
subtitle shall entitle a protected individual to assert the
rights of a health information trustee.
(b) EFFECT OF MOTION ON STATUTE OF LIMITA-
TIONS.—If an individual who is the subject of protected
health information files a motion under this subtitle which
has the effect of delaying the access of a government au-
thority to such information, the period beginning on the
date such motion was filed and ending on the date on
which the motion is decided shall be excluded in computing
any period of limitations within which the government au-
thority may commence any civil or criminal action in con-
nection with which the access is sought.
SEC. 135. RESPONSIBILITIES OF SECRETARY.
Not later than July 1, 1999, the Secretary, after no-
tice and opportunity for public comment, shall develop and
disseminate brief, clear, and easily understood model
notices—
(1) for use under subsection (c) of section 131,
detailing the rights of a protected individual who
wishes to challenge, under section 132, the disclo-
sure of protected health information about the indi-
vidual under such subsection; and
(2) for use under subsection (a) of section 133,
detailing the rights of a protected individual who
wishes to challenge, under subsection (b) of such
section, the disclosure of protected health informa-
tion about the individual under such section.
Subtitle D—Miscellaneous
Provisions
SEC. 141. PAYMENT CARD AND ELECTRONIC PAYMENT
TRANSACTIONS.
(a) PAYMENT FOR HEALTH CARE THROUGH CARD
OR ELECTRONIC MEANS.—If a protected individual pays
a health information trustee for health care by presenting
a debit, credit, or other payment card or account number,
or by any other electronic payment means, the trustee may
disclose to a person described in subsection (b) only such
protected health information about the individual as is
necessary for the processing of the payment transaction
or the billing or collection of amounts charged to, debited
from, or otherwise paid by, the individual using the card,
number, or other electronic payment means.
(b) TRANSACTION PROCESSING.—A person who is a
debit, credit, or other payment card issuer, is otherwise
directly involved in the processing of payment transactions
involving such cards or other electronic payment trans-
actions, or is otherwise directly involved in the billing or
collection of amounts paid through such means, may only
use or disclose protected health information about a pro-
tected individual that has been disclosed in accordance
with subsection (a) when necessary for—
(1) the authorization, settlement, billing or col-
lection of amounts charged to, debited from, or oth-
erwise paid by, the individual using a debit, credit,
or other payment card or account number, or by
other electronic payment means;
(2) the transfer of receivables, accounts, or in-
terest therein;
(3) the audit of the credit, debit, or other pay-
ment card account information;
(4) compliance with Federal, State, or local law;
or
(5) a properly authorized civil, criminal, or reg-
ulatory investigation by Federal, State, or local au-
thorities.
SEC. 142. ACCESS TO PROTECTED HEALTH INFORMATION
OUTSIDE OF THE UNITED STATES.
(a) IN GENERAL.—Notwithstanding the provisions of
subtitle B, and except as provided in subsection (b), a
health information trustee may not permit any person who
is not in a State to have access to protected health infor-
mation about a protected individual unless one or more
of the following conditions exist:
(1) SPECIFIC AUTHORIZATION.—The individual
has specifically consented to the provision of such
access outside of the United States in an authoriza-
tion that meets the requirements of section 112.
(2) EQUIVALENT PROTECTION.—The provision
of such access is authorized under this Act and the
Secretary has determined that there are fair infor-
mation practices for protected health information in
the jurisdiction where the access will be provided
that provide protections for individuals and pro-
tected health information that are equivalent to the
protections provided for by this Act.
(3) ACCESS REQUIRED BY LAW.—The provision
of such access is required under—
(A) a Federal statute; or
(B) a treaty or other international agree-
ment applicable to the United States.
(b) EXCEPTIONS.—Subsection (a) does not apply
where the provision of access to protected health informa-
tion—
(1) is to a foreign public health authority;
(2) is authorized under section 114 (relating to
next of kin and directory information), 116 (relating
to health research), or 117 (relating to emergency
circumstances); or
(3) is necessary for the purpose of providing for
payment for health care that has been provided to
an individual.
SEC. 143. STANDARDS FOR ELECTRONIC DOCUMENTS AND
COMMUNICATIONS.
(a) STANDARDS.—Not later than July 1, 1999, the
Secretary, after notice and opportunity for public com-
ment and in consultation with appropriate private stand-
ard-setting organizations and other interested parties,
shall establish standards with respect to the creation,
transmission, receipt, and maintenance, in electronic and
magnetic form, of each type of written document specifi-
cally required or authorized under this Act. Where a sig-
nature is required under any other provision of this Act,
such standards shall provide for an electronic or magnetic
substitute that serves the functional equivalent of a signa-
ture.
(b) TREATMENT OF COMPLYING DOCUMENTS AND
COMMUNICATIONS.—An electronic or magnetic document
or communication that satisfies the standards established
under subsection (a) with respect to such document or
communication shall be treated as satisfying the require-
ments of this Act that apply to an equivalent written docu-
ment.
SEC. 144. DUTIES AND AUTHORITIES OF AFFILIATED PER-
SONS.
(a) REQUIREMENTS ON TRUSTEES.—
(1) PROVISION OF INFORMATION.—A health in-
formation trustee may provide protected health in-
formation to a person who, with respect to the trust-
ee, is an affiliated person and may permit the affili-
ated person to use such information, only for the
purpose of conducting, supporting, or facilitating an
activity that the trustee is authorized to undertake.
(2) NOTICE TO AFFILIATED PERSON.—A health
information trustee shall notify a person who, with
respect to the trustee, is an affiliated person of any
duties under this Act that the affiliated person is re-
quired to fulfill and of any authorities under this
Act that the affiliated person is authorized to exer-
cise.
(b) DUTIES OF AFFILIATED PERSONS.—
(1) IN
GENERAL.—An affiliated person shall
fulfill any duty under this Act that—
(A) the health information trustee with
whom the person has an agreement or relation-
ship described in section 3(c)(1)(C) is required
to fulfill; and
(B) the person has undertaken to fulfill
pursuant to such agreement or relationship.
(2) CONSTRUCTION
OF
OTHER
SUBTITLES.—
With respect to a duty described in paragraph (1)
that an affiliated person is required to fulfill, the
person shall be considered a health information
trustee for purposes of this Act. The person shall be
subject to subtitle E (relating to enforcement) with
respect to any such duty that the person fails to ful-
fill.
(3) EFFECT ON TRUSTEE.—An agreement or
relationship with an affiliated person does not relieve
a health information trustee of any duty or liability
under this Act.
(b) AUTHORITIES OF AFFILIATED PERSONS.—
(1) IN
GENERAL.—An affiliated person may
only exercise an authority under this Act that the
health information trustee with whom the person is
affiliated may exercise and that the person has been
given by the trustee pursuant to an agreement or re-
lationship described in section 3(c)(1)(C). With re-
spect to any such authority, the person shall be con-
sidered a health information trustee for purposes of
this Act. The person shall be subject to subtitle E
(relating to enforcement) with respect to any act
that exceeds such authority.
(2) EFFECT ON TRUSTEE.—An agreement or
relationship with an affiliated person does not affect
the authority of a health information trustee under
this Act.
SEC. 145. AGENTS AND ATTORNEYS.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law (on grounds
other than an individual’s minority), or by an instrument
recognized under law, to act as an agent, attorney, proxy,
or other legal representative for a protected individual or
the estate of a protected individual, or otherwise to exer-
cise the rights of the individual or estate, may, to the ex-
tent authorized, exercise and discharge the rights of the
individual or estate under this Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is authorized by law (on grounds other than an indi-
vidual’s minority), or by an instrument recognized under
law, to make decisions about the provision of health care
to an individual who is incapacitated may exercise and dis-
charge the rights of the individual under this Act to the
extent necessary to effectuate the terms or purposes of
the grant of authority.
(c) NO COURT DECLARATION.—If a health care pro-
vider determines that an individual, who has not been de-
clared to be legally incompetent, suffers from a medical
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right
of the individual to authorize disclosure under section 112
may be exercised and discharged in the best interest of
the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or (3) cannot be
contacted after a reasonable effort.
SEC. 146. MINORS.
(a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA-
BLE.—In the case of an individual—
(1) who is 18 years of age or older, all rights
of the individual shall be exercised by the individual,
except as provided in section 145; or
(2) who, acting alone, has the legal capacity to
apply for and obtain health care and has sought
such care, the individual shall exercise all rights of
an individual under this Act with respect to pro-
tected health information relating to such care.
(b) INDIVIDUALS UNDER 18.—Except as provided in
subsection (a)(2), in the case of an individual who is—
(1) under 14 years of age, all the individual’s
rights under this Act shall be exercised through the
parent or legal guardian of the individual; or
(2) 14, 15, 16, or 17 years of age, the right of
inspection (under section 101), the right of amend-
ment (under section 102), and the right to authorize
disclosure of protected health information (under
section 112) of the individual may be exercised ei-
ther by the individual or by the parent or legal
guardian of the individual.
SEC. 147. MAINTENANCE OF CERTAIN PROTECTED HEALTH
INFORMATION.
(a) IN GENERAL.—A State shall establish a process
under which the protected health information described in
subsection (b) that is maintained by a person described
in subsection (c) is delivered to, and maintained by, the
State or an individual or entity designated by the State.
(b) 
INFORMATION
DESCRIBED.—The 
protected
health information referred to in subsection (a) is pro-
tected health information that—
(1) is recorded in any form or medium;
(2) is created by—
(A) a health care provider; or
(B) a health benefit plan sponsor that pro-
vides benefits in the form of items and services
to enrollees and not in the form of reimburse-
ment for items and services; and
(3) relates in any way to the past, present, or
future physical or mental health or condition or
functional status of a protected individual or the
provision of health care to a protected individual.
(c) PERSONS DESCRIBED.—A person referred to in
subsection (a) is any of the following:
(1) A health care facility previously located in
the State that has closed.
(2) A professional practice previously operated
by a health care provider in the State that has
closed.
(3) A health benefit plan sponsor that—
(A) previously provided benefits in the
form of items and services to enrollees in the
State; and
(B) has ceased to do business.
Subtitle E—Enforcement
SEC. 151. CIVIL ACTIONS.
(a) IN GENERAL.—Any individual whose right under
this Act has been knowingly or negligently violated—
(1) by a health information trustee, or any
other person, who is not described in paragraph (2),
(3), (4), or (5) may maintain a civil action for actual
damages and for equitable relief against the health
information trustee or other person;
(2) by an officer or employee of the United
States while the officer or employee was acting with-
in the scope of the office or employment may main-
tain a civil action for actual damages and for equi-
table relief against the United States;
(3) by an officer or employee of any government
authority of a State that has waived its sovereign
immunity to a claim for damages resulting from a
violation of this Act while the officer or employee
was acting within the scope of the office or employ-
ment may maintain a civil action for actual damages
and for equitable relief against the State govern-
ment;
(4) by an officer or employee of a government
of a State that is not described in paragraph (3)
may maintain a civil action for actual damages and
for equitable relief against the officer or employee;
or
(5) by an officer or employee of a government
authority while the officer or employee was not act-
ing within the scope of the office or employment
may maintain a civil action for actual damages and
for equitable relief against the officer or employee.
(b) KNOWING VIOLATIONS.—Any individual entitled
to recover actual damages under this section because of
a knowing violation of a provision of this Act (other than
subsection (c) or (d) of section 111) shall be entitled to
recover the amount of the actual damages demonstrated
or $5000, whichever is greater.
(c) ACTUAL DAMAGES.—For purposes of this section,
the term ‘‘actual damages’’ includes damages paid to com-
pensate an individual for nonpecuniary losses such as
physical and mental injury as well as damages paid to
compensate for pecuniary losses.
(d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In
any action brought under this section in which the com-
plainant has prevailed because of a knowing violation of
a provision of this Act (other than subsection (c) or (d)
of section 111), the court may, in addition to any relief
awarded under subsections (a) and (b), award such puni-
tive damages as may be warranted. In such an action, the
court, in its discretion, may allow the prevailing party a
reasonable attorney’s fee (including expert fees) as part
of the costs, and the United States shall be liable for costs
the same as a private person.
(e) LIMITATION.—A civil action under this section
may not be commenced more than 2 years after the date
on which the aggrieved individual discovered the violation
or the date on which the aggrieved individual had a rea-
sonable opportunity to discover the violation, whichever oc-
curs first.
(f) INSPECTION AND AMENDMENT.—If a health in-
formation trustee has established a formal internal proce-
dure that allows an individual who has been denied inspec-
tion or amendment of protected health information to ap-
peal the denial, the individual may not maintain a civil
action in connection with the denial until the earlier of—
(1) the date the appeal procedure has been ex-
hausted; or
(2) the date that is 4 months after the date on
which the appeal procedure was initiated.
(g) NO
LIABILITY
FOR
PERMISSIBLE
DISCLO-
SURES.—A health information trustee who makes a disclo-
sure of protected health information about a protected in-
dividual that is permitted by this Act and not otherwise
prohibited by State or Federal statute shall not be liable
to the individual for the disclosure under common law.
(h) NO LIABILITY
FOR INSTITUTIONAL REVIEW
BOARD DETERMINATIONS.—If the members of a certified
institutional review board have in good faith determined
that an approved health research project is of sufficient
importance so as to outweigh the intrusion into the privacy
of an individual pursuant to section 116(a)(1), the mem-
bers, the board, and the parent institution of the board
shall not be liable to the individual as a result of such
determination.
(i) GOOD FAITH RELIANCE ON CERTIFICATION.—A
health information trustee who relies in good faith on a
certification by a government authority or other person
and discloses protected health information about an indi-
vidual in accordance with this Act shall not be liable to
the individual for such disclosure.
SEC. 152. CIVIL MONEY PENALTIES.
(a) VIOLATION.—Any health information trustee who
the Secretary determines has demonstrated a pattern or
practice of failure to comply with the provisions of this
Act shall be subject, in addition to any other penalties that
may be prescribed by law, to a civil money penalty of not
more than $10,000 for each such failure. In determining
the amount of any penalty to be assessed under the proce-
dures established under subsection (b), the Secretary shall
take into account the previous record of compliance of the
person being assessed with the applicable requirements of
this Act and the gravity of the violation.
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.—
The provisions of section 1128A of the Social Security Act
(other than subsections (a) and (b)) shall apply to the im-
position of a civil monetary penalty under this section in
the same manner as such provisions apply with respect
to the imposition of a penalty under section 1128A of such
Act.
SEC. 153. ALTERNATIVE DISPUTE RESOLUTION.
(a) IN GENERAL.—Not later than July 1, 1999, the
Secretary shall, by regulation, develop alternative dispute
resolution methods for use by individuals, health informa-
tion trustees, and other persons in resolving claims under
section 151.
(b) EFFECT ON INITIATION OF CIVIL ACTIONS.—
(1) IN GENERAL.—Subject to paragraph (2),
the regulations established under subsection (a) may
provide that an individual alleging that a right of
the individual under this Act has been violated shall
pursue at least one alternative dispute resolution
method developed under such subsection as a condi-
tion precedent to commencing a civil action under
section 151.
(2) LIMITATION.—Such regulations may not re-
quire an individual to refrain from commencing a
civil action to pursue one or more alternative dispute
resolution method for a period that is greater than
6 months.
(3) SUSPENSION
OF
STATUTE
OF
LIMITA-
TIONS.—The regulations established by the Sec-
retary under subsection (a) may provide that a pe-
riod in which an individual described in paragraph
(1) pursues (as defined by the Secretary) an alter-
native dispute resolution method under this section
shall be excluded in computing the period of limita-
tions under section 151(e).
(c) METHODS.—The methods under subsection (a)
shall include at least the following:
(1) ARBITRATION.—The use of arbitration.
(2) MEDIATION.—The use of mediation.
(3) EARLY OFFERS OF SETTLEMENT.—The use
of a process under which parties make early offers
of settlement.
(d) STANDARDS FOR ESTABLISHING METHODS.—In
developing alternative dispute resolution methods under
subsection (a), the Secretary shall ensure that the meth-
ods promote the resolution of claims in a manner that—
(1) is affordable for the parties involved;
(2) provides for timely and fair resolution of
claims; and
(3) provides for reasonably convenient access to
dispute resolution for individuals.
SEC. 154. AMENDMENTS TO CRIMINAL LAW.
(a) IN GENERAL.—Title 18, United States Code, is
amended by inserting after chapter 73 the following:
‘‘CHAPTER 74—OBTAINING PROTECTED HEALTH
INFORMATION
‘‘Sec.
‘‘1531. Definitions.
‘‘1532. Obtaining protected health information under false pretenses.
‘‘1533. Monetary gain from obtaining protected health information under false
pretenses.
‘‘1534. Knowing and unlawful obtaining of protected health information.
‘‘1535. Monetary gain from knowing and unlawful obtaining of protected health
information.
‘‘1536. Knowing and unlawful use or disclosure of protected health information.
‘‘1537. Monetary gain from knowing and unlawful sale, transfer, or use of pro-
tected health information.
‘‘§ 1531. Definitions
‘‘As used in this chapter—
‘‘(1) the term ‘health information trustee’ has
the meaning given such term in section 3(b)(5) of
the Fair Health Information Practices Act of 1997;
‘‘(2) the term ‘protected health information’ has
the meaning given such term in section 3(a)(3) of
such Act; and
‘‘(3) the term ‘protected individual’ has the
meaning given such term in section 3(a)(4) of such
Act.
‘‘§ 1532. 
Obtaining 
protected 
health 
information
under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee; or
‘‘(2) obtains from a protected individual an au-
thorization for the disclosure of protected health in-
formation about the individual maintained by a
health information trustee;
shall be fined under this title or imprisoned not more than
5 years, or both.
‘‘§ 1533. Monetary gain from obtaining protected
health information under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee with the
intent to sell, transfer, or use such information for
profit or monetary gain; or
‘‘(2) obtains from a protected individual an au-
thorization for the disclosure of protected health in-
formation about the individual maintained by a
health information trustee with the intent to sell,
transfer, or use such authorization for profit or
monetary gain;
and knowingly sells, transfers, or uses such information
or authorization for profit or monetary gain shall be fined
under this title or imprisoned not more than 10 years, or
both.
(A) a health researcher; or
(B) a person who, with respect to specific
protected health information, received the infor-
mation—
(i) pursuant to—
(I) section 117 (relating to emer-
gency circumstances);
(II) section 118 (relating to judi-
cial and administrative purposes);
(III) section 119 (relating to law
enforcement); or
(IV) section 120 (relating to sub-
poenas, warrants, and search war-
rants); or
(ii) while acting in whole or in part in
the capacity of an officer or employee of a
person described in clause (i).
(c) AUTHORIZATIONS FOR DISCLOSURES.—An au-
thorization for the disclosure of protected health informa-
tion about a protected individual that is executed by the
individual before January 1, 2000, and is recognized and
valid under State law on December 31, 1999, shall remain
valid and shall not be subject to the requirements of sec-
tion 112 until January 1, 2001, or the occurrence of the