or the Securities and Exchange Act, as applica-
ble, to the extent that such person or entity is
engaged in activities other than those permitted
under subsection (b).
(3) RULE OF CONSTRUCTION.—Nothing in this
subsection shall be deemed to exempt entities de-
scribed in paragraph (2) from the prohibition set
forth in subsection (c).
SEC. 212. INDIVIDUAL REPRESENTATIVES.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law (based on
grounds other than the individual being a minor), or by
an instrument recognized under law, to act as an agent,
attorney, proxy, or other legal representative of a pro-
tected individual, may, to the extent so authorized, exer-
cise and discharge the rights of the individual under this
Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is authorized by law (based on grounds other than
being a minor), or by an instrument recognized under law,
to make decisions about the provision of health care to
an individual who is incapacitated, may exercise and dis-
charge the rights of the individual under this Act to the
extent necessary to effectuate the terms or purposes of
the grant of authority.
(c) NO COURT DECLARATION.—If a health care pro-
vider determines that an individual, who has not been de-
clared to be legally incompetent, suffers from a medical
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right
of the individual to authorize disclosure under this Act
may be exercised and discharged in the best interest of
the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or
(5) cannot be contacted after a reasonable ef-
fort.
(d) APPLICATION TO DECEASED INDIVIDUALS.—The
provisions of this Act shall continue to prevent disclosure
of protected health information concerning a deceased in-
dividual.
(e) EXERCISE OF RIGHTS ON BEHALF OF A DE-
CEASED INDIVIDUAL.—
(1) IN GENERAL.—A person who is authorized
by law or by an instrument recognized under law, to
act as an executor of the estate of a deceased indi-
vidual, or otherwise to exercise the rights of the de-
ceased individual, may, to the extent so authorized,
exercise and discharge the rights of such deceased
individual under this Act for a period of 2 years fol-
lowing the death of such individual. If no such des-
ignee has been authorized, the rights of the deceased
individual may be exercised as provided for in sub-
section (c).
(2) INSURED INDIVIDUALS.—In the case of an
individual who is deceased and who was the insured
under an insurance policy or policies, the right to
authorize disclosure of protected health information
may be exercised by the beneficiary or beneficiaries
of such insurance policy or policies.
(f) RIGHTS OF MINORS.—The rights of minors under
this Act shall be exercised by a parent, the minor or other
person as provided under applicable state law.
SEC. 213. NO LIABILITY FOR PERMISSIBLE DISCLOSURES.
A health care provider, health plan, health oversight
agency, health researcher, employer, life insurer, school,
or university, or an agent of such persons, that makes a
disclosure of protected health information about an indi-
vidual that is permitted by this Act shall not be liable to
the individual for such disclosure under common law.
SEC. 214. SALE OF BUSINESS, MERGERS, ETC.
(a) IN GENERAL.—A health care provider, health
plan, health oversight agency, employer, life insurer,
school, or university may disclose protected health infor-
mation to a person or persons for purposes of enabling
business decisions to be made about or in connection with
the purchase, transfer, merger, or sale of a business or
businesses.
(b) NO FURTHER DISCLOSURE.—A person or per-
sons who receive protected health information under this
section shall make no further use or disclosure of such
information unless otherwise authorized under this Act.
TITLE III—SANCTIONS
Subtitle A—Criminal Provisions
SEC. 
301. 
WRONGFUL 
DISCLOSURE 
OF 
PROTECTED
HEALTH INFORMATION.
(a) IN GENERAL.—Part I of title 18, United States
Code, is amended by adding at the end the following:
‘‘CHAPTER 124—WRONGFUL DISCLOSURE
OF PROTECTED HEALTH INFORMATION
‘‘§ 2801. Wrongful disclosure of protected health in-
formation
‘‘(a) OFFENSE.—The penalties described in sub-
section (b) shall apply to a person that knowingly and
intentionally—
‘‘(1) obtains protected health information relat-
ing to an individual from a health care provider,
health plan, health oversight agency, public health
authority, employer, life insurer, health researcher,
law enforcement official, school, or university except
as provided in title II of the Medical Information
Protection Act of 2001; or
‘‘(2) discloses protected health information to
another person in a manner other than that which
is permitted under title II of the Medical Informa-
tion Protection Act of 2001.
‘‘(b) PENALTIES.—A person described in subsection
(a) shall—
‘‘(1) be fined not more than $50,000, impris-
oned not more than 1 year, or both;
‘‘(2) if the offense is committed under false pre-
tenses, be fined not more than $100,000, imprisoned
not more than 5 years, or both; or
‘‘(3) if the offense is committed with the intent
to sell, transfer, or use protected health information
for monetary gain or malicious harm, be fined not
more than $250,000, imprisoned not more than 10
years, or both.
‘‘(c) SUBSEQUENT OFFENSES.—In the case of a per-
son described in subsection (a), the maximum penalties
described in subsection (b) shall be doubled for every sub-
sequent conviction for an offense arising out of a violation
or violations related to a set of circumstances that are dif-
ferent from those involved in the previous violation or set
of related violations described in such subsection (a).’’.
(b) CLERICAL AMENDMENT.—The table of chapters
for part I of title 18, United States Code, is amended by
inserting after the item relating to chapter 123 the fol-
lowing new item:
‘‘Sec. 2801. Wrongful disclosure of protected health information.’’.
Subtitle B—Civil Sanctions
SEC. 311. CIVIL PENALTY VIOLATION.
A person who the Secretary, in consultation with the
Attorney General, determines has substantially and mate-
rially failed to comply with this Act shall be subject, in
addition to any other penalties that may be prescribed by
law—
(1) in a case in which the violation relates to
title I, to a civil penalty of not more than $500 for
each such violation, but not to exceed $5,000 in the
aggregate for multiple violations arising from the
same failure to comply with the Act;
(2) in a case in which the violation relates to
title II, to a civil penalty of not more than $10,000
for each such violation, but not to exceed $50,000
in the aggregate for multiple violations arising from
the same failure to comply with the Act; or
(3) in a case in which the Secretary finds that
such violations have occurred with such frequency as
to constitute a general business practice, to a civil
penalty of not more than $100,000.
SEC. 312. PROCEDURES FOR IMPOSITION OF PENALTIES.
(a) INITIATION OF PROCEEDINGS.—
(1) IN GENERAL.—The Secretary, in consulta-
tion with the Attorney General, may initiate a pro-
ceeding to determine whether to impose a civil
money penalty under section 311. The Secretary
may not initiate an action under this section with re-
spect to any violation described in section 311 after
the expiration of the 6-year period beginning on the
date on which such violation was alleged to have oc-
curred. The Secretary may initiate an action under
this section by serving notice of the action in any
manner authorized by Rule 4 of the Federal Rules
of Civil Procedure.
(2) NOTICE
AND
OPPORTUNITY
FOR
HEAR-
ING.—The Secretary shall not make a determination
adverse to any person under paragraph (1) until the
person has been given written notice and an oppor-
tunity for the determination to be made on the
record after a hearing at which the person is entitled
to be represented by counsel, to present witnesses,
and to cross-examine witnesses against the person.
(3) SANCTIONS
FOR
FAILURE
TO
COMPLY.—
The official conducting a hearing under this section
may sanction a person, including any party or attor-
ney, for failing to comply with an order or proce-
dure, failing to defend an action, or other mis-
conduct as would interfere with the speedy, orderly,
or fair conduct of the hearing. Such sanction shall
reasonably relate to the severity and nature of the
failure or misconduct. Such sanction may include—
(A) in the case of refusal to provide or per-
mit discovery, drawing negative factual infer-
ences or treating such refusal as an admission
by deeming the matter, or certain facts, to be
established;
(B) prohibiting a party from introducing
certain evidence or otherwise supporting a par-
ticular claim or defense;
(C) striking pleadings, in whole or in part;
(D) staying the proceedings;
(E) dismissal of the action;
(F) entering a default judgment;
(G) ordering the party or attorney to pay
attorneys’ fees and other costs caused by the
failure or misconduct; and
(H) refusing to consider any motion or
other action which is not filed in a timely man-
ner.
(b) SCOPE
OF
PENALTY.—In determining the
amount or scope of any penalty imposed pursuant to sec-
tion 311, the Secretary shall take into account—
(1) the nature of claims and the circumstances
under which they were presented;
(2) the degree of culpability, history of prior of-
fenses, and financial condition of the person pre-
senting the claims;
(3) evidence of good faith endeavor to protect
the confidentiality of protected health information;
and
(4) such other matters as justice may require.
(c) REVIEW OF DETERMINATION.—
(1) IN
GENERAL.—Any person adversely af-
fected by a determination of the Secretary under
this section may obtain a review of such determina-
tion in the United States Court of Appeals for the
circuit in which the person resides, or in which the
claim was presented, by filing in such court (within
60 days following the date the person is notified of
the determination of the Secretary) a written peti-
tion requesting that the determination be modified
or set aside.
(2) FILING OF RECORD.—A copy of the petition
filed under paragraph (1) shall be forthwith trans-
mitted by the clerk of the court to the Secretary,
and thereupon the Secretary shall file in the Court
the record in the proceeding as provided in section
2112 of title 28, United States Code. Upon such fil-
ing, the court shall have jurisdiction of the pro-
ceeding and of the question determined therein, and
shall have the power to make and enter upon the
pleadings, testimony, and proceedings set forth in
such record a decree affirming, modifying, remand-
ing for further consideration, or setting aside, in
whole or in part, the determination of the Secretary
and enforcing the same to the extent that such order
is affirmed or modified.
(3) CONSIDERATION OF OBJECTIONS.—No ob-
jection that has not been raised before the Secretary
with respect to a determination described in para-
graph (1) shall be considered by the court, unless
the failure or neglect to raise such objection shall be
excused because of extraordinary circumstances.
(4) FINDINGS.—The findings of the Secretary
with respect to questions of fact in an action under
this subsection, if supported by substantial evidence
on the record considered as a whole, shall be conclu-
sive. If any party shall apply to the court for leave
to adduce additional evidence and shall show to the
satisfaction of the court that such additional evi-
dence is material and that there were reasonable
grounds for the failure to adduce such evidence in
the hearing before the Secretary, the court may
order such additional evidence to be taken before the
Secretary and to be made a part of the record. The
Secretary may modify findings as to the facts, or
make new findings, by reason of additional evidence
so taken and filed, and shall file with the court such
modified or new findings, and such findings with re-
spect to questions of fact, if supported by substan-
tial evidence on the record considered as a whole,
and the recommendations of the Secretary, if any,
for the modification or setting aside of the original
order, shall be conclusive.
(5) EXCLUSIVE JURISDICTION.—Upon the filing
of the record with the court under paragraph (2),
the jurisdiction of the court shall be exclusive and its
judgment and decree shall be final, except that the
same shall be subject to review by the Supreme
Court of the United States, as provided for in sec-
tion 1254 of title 28, United States Code.
(d) RECOVERY OF PENALTIES.—
(1) IN
GENERAL.—Civil money penalties im-
posed under this subtitle may be compromised by
the Secretary and may be recovered in a civil action
in the name of the United States brought in United
States district court for the district where the claim
was presented, or where the claimant resides, as de-
termined by the Secretary. Amounts recovered under
this section shall be paid to the Secretary and depos-
ited as miscellaneous receipts of the Treasury of the
United States.
(2) DEDUCTION FROM AMOUNTS OWING.—The
amount of any penalty, when finally determined
under this section, or the amount agreed upon in
compromise under paragraph (1), may be deducted
from any sum then or later owing by the United
States or a State to the person against whom the
penalty has been assessed.
(e) DETERMINATION FINAL.—A determination by
the Secretary to impose a penalty under section 321 shall
be final upon the expiration of the 60-day period referred
to in subsection (c)(1). Matters that were raised or that
could have been raised in a hearing before the Secretary
or in an appeal pursuant to subsection (c) may not be
raised as a defense to a civil action by the United States
to collect a penalty under section 321.
(f) SUBPOENA AUTHORITY.—
(1) IN
GENERAL.—For the purpose of any
hearing, investigation, or other proceeding author-
ized or directed under this section, or relative to any
other matter within the jurisdiction of the Attorney
General hereunder, the Attorney General, acting
through the Secretary shall have the power to issue
subpoenas requiring the attendance and testimony of
witnesses and the production of any evidence that
relates to any matter under investigation or in ques-
tion before the Secretary. Such attendance of wit-
nesses and production of evidence at the designated
place of such hearing, investigation, or other pro-
ceeding may be required from any place in the
United States or in any Territory or possession
thereof.
(2) SERVICE.—Subpoenas of the Secretary
under paragraph (1) shall be served by anyone au-
thorized by the Secretary by delivering a copy there-
of to the individual named therein.
(3) PROOF OF SERVICE.—A verified return by
the individual serving the subpoena under this sub-
section setting forth the manner of service shall be
proof of service.
(4) FEES.—Witnesses subpoenaed under this
subsection shall be paid the same fees and mileage
as are paid witnesses in the district court of the
United States.
(5) REFUSAL TO OBEY.—In case of contumacy
by, or refusal to obey a duly served upon, any per-
son, any district court of the United States for the
judicial district in which such person charged with
contumacy or refusal to obey is found or resides or
transacts business, upon application by the Sec-
retary, shall have jurisdiction to issue an order re-
quiring such person to appear and give testimony, or
to appear and produce evidence, or both. Any failure
to obey such order of the court may be punished
by the court as contempt thereof.
(g) INJUNCTIVE RELIEF.—Whenever the Secretary
has reason to believe that any person has engaged, is en-
gaging, or is about to engage in any activity which makes
the person subject to a civil monetary penalty under sec-
tion 311, the Secretary may bring an action in an appro-
priate district court of the United States (or, if applicable,
a United States court of any territory) to enjoin such ac-
tivity, or to enjoin the person from concealing, removing,
encumbering, or disposing of assets which may be required
in order to pay a civil monetary penalty if any such pen-
alty were to be imposed or to seek other appropriate relief.
(h) AGENCY.—A principal is liable for penalties
under section 311 for the actions of the principal’s agent
acting within the scope of the agency.
SEC. 313. ENFORCEMENT BY STATE INSURANCE COMMIS-
SIONERS.
(a) STATE PENALTIES.—Subject to section 401, and
notwithstanding any other provision of this title, a state
insurance commissioner of the State of domicile of a life
insurer may exercise exclusive authority to impose any
penalties on a life insurer for violations of this Act pursu-
ant to the administrative procedures provided under that
State’s insurance laws.
(b) FAIL-SAFE FEDERAL AUTHORITY.—In the case
of a State that fails to substantially enforce the require-
ments of Title I and Title II of this Act with respect to
life insurers regulated by such State, the provisions of this
title shall apply with respect to a life insurer in the same
way that they apply to other persons subject to the Act.
TITLE IV—MISCELLANEOUS
SEC. 401. RELATIONSHIP TO OTHER LAWS.
(a) STATE AND FEDERAL LAW.—Except as provided
in this section—
(1) the provisions of this Act shall preempt any
State law that relates to matters covered by this
Act;
(2) this Act shall not be construed to preempt,
modify, repeal, or affect the interpretation of a pro-
vision of State or Federal law that relates to the dis-
closure of protected health information or any other
information about a minor to a parent or guardian
of such minor; and
(3) this Act shall not be construed as repealing,
explicitly or implicitly, other Federal laws or regula-
tions relating to protected health information or re-
lating to an individual’s access to protected health
information or health care services.
(b) RELATIONSHIP TO OTHER REGULATIONS.—This
Act is legislation described in section 264(c)(1) of the
Health Insurance Portability and Accountability Act of
1996 (Public Law 104–191; 110 Stat. 2033) and the reg-
ulations issued under such section as of December 28,
2000, shall be of no effect.
(c) PRIVILEGES.—Nothing in this Act shall be con-
strued to preempt or modify any provisions of State statu-
tory or common law to the extent that such law concerns
a privilege of a witness or person in a court of that State.
This Act shall not be construed to supersede or modify
any provision of Federal statutory or common law to the
extent such law concerns a privilege of a witness or person
in a court of the United States. Authorizations pursuant
to sections 202 and 203 shall not be construed as a waiver
of any such privilege.
(d) REPORTS
CONCERNING
FEDERAL
PRIVACY
ACT.—Not later than 1 year after the date of the enact-
ment of this Act, the head of each Federal agency shall
prepare and submit to Congress a report concerning the
effect of this Act on each such agency. Such reports shall
include recommendations for legislation to address con-
cerns relating to the Federal Privacy Act.
(e) APPLICATION
TO CERTAIN FEDERAL AGEN-
CIES.—
(1) DEPARTMENT OF DEFENSE.—
(A) EXCEPTIONS.—The Secretary of De-
fense may, by regulation, establish exceptions to
the disclosure requirements of this Act to the
extent such Secretary determines that disclo-
sure of protected health information relating to
members of the armed forces from systems of
records operated by the Department of Defense
is necessary under circumstances different from
those permitted under this Act for the proper
conduct of national defense functions by mem-
bers of the armed forces.
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Defense may, by regu-
lation, establish for civilian employees of the
Department of Defense and employees of De-
partment of Defense contractors, limitations on
the right of such persons to revoke or amend
authorizations for disclosures under section 203
when such authorizations were provided by such
employees as a condition of employment and
the disclosure is determined necessary by the
Secretary of Defense to the proper conduct of
national defense functions by such employees.
(2) DEPARTMENT OF TRANSPORTATION.——
(A) 
EXCEPTIONS.—The 
Secretary 
of
Transportation may, with respect to members
of the Coast Guard, exercise the same powers
as the Secretary of Defense may exercise under
paragraph (1)(A).
(B) APPLICATION
TO
CIVILIAN
EMPLOY-
EES.—The Secretary of Transportation may,
with respect to civilian employees of the Coast
Guard and Coast Guard contractors, exercise
the same powers as the Secretary of Defense
may exercise under paragraph (1)(B).
(3) DEPARTMENT
OF
VETERANS
AFFAIRS.—
The limitations on use and disclosure of protected
health information under this Act shall not be con-
strued to prevent any exchange of such information
within and among components of the Department of
Veterans Affairs that determine eligibility for or en-
titlement to, or that provide, benefits under laws ad-
ministered by the Secretary of Veteran Affairs.
SEC. 402. CONFORMING AMENDMENT.
Section 1171(6) of the Social Security Act (42 U.S.C.
1320d(6)) is amended to read as follows:
‘‘(6) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘individually identifiable
health information’ has the same meaning given the
term ‘protected health information’ by section 2 of
the Medical Information Protection Act of 2001.’’.
SEC. 403. STUDY BY INSTITUTE OF MEDICINE.
Not later than 2 years after the date of enactment
of this Act, the National Research Council in conjunction
with the Institute of Medicine of the National Academy
of Sciences shall conduct a study to examine research
issues relating to protected health information, such as the
quality and uniformity of institutional review boards and
their practices with respect to data management for both
researchers and institutional review boards, as well as cur-
rent and proposed protection of health information in rela-
tion to the legitimate needs of law enforcement. The Coun-
cil shall prepare and submit to Congress a report con-
cerning the results of such study.
SEC. 404. EFFECTIVE DATE.
(a) EFFECTIVE DATE.—Except as provided in sub-
section (b), this Act shall take effect on the date that is
12 months after the date on which regulations are promul-
gated as required under subsection (c).
(b) APPLICABILITY.—The provisions of this Act shall
only apply to protected health information collected and
disclosed 12 months after the date on which regulations
are promulgated as required under subsection (c).