this Act. The person shall be subject to subtitle E
(relating to enforcement) with respect to any act
that exceeds such authority.
(2) EFFECT ON TRUSTEE.—An agreement or
relationship with an affiliated person does not affect
the authority of a health information trustee under
this Act.
SEC. 145. AGENTS AND ATTORNEYS.
(a) IN GENERAL.—Except as provided in subsections
(b) and (c), a person who is authorized by law (on grounds
other than an individual’s minority), or by an instrument
recognized under law, to act as an agent, attorney, proxy,
or other legal representative for a protected individual or
the estate of a protected individual, or otherwise to exer-
cise the rights of the individual or estate, may, to the ex-
tent authorized, exercise and discharge the rights of the
individual or estate under this Act.
(b) HEALTH CARE POWER OF ATTORNEY.—A person
who is authorized by law (on grounds other than an indi-
vidual’s minority), or by an instrument recognized under
law, to make decisions about the provision of health care
to an individual who is incapacitated may exercise and dis-
charge the rights of the individual under this Act to the
extent necessary to effectuate the terms or purposes of
the grant of authority.
(c) NO COURT DECLARATION.—If a health care pro-
vider determines that an individual, who has not been de-
clared to be legally incompetent, suffers from a medical
condition that prevents the individual from acting know-
ingly or effectively on the individual’s own behalf, the right
of the individual to authorize disclosure under section 112
may be exercised and discharged in the best interest of
the individual by—
(1) a person described in subsection (b) with re-
spect to the individual;
(2) a person described in subsection (a) with re-
spect to the individual, but only if a person de-
scribed in paragraph (1) cannot be contacted after
a reasonable effort;
(3) the next of kin of the individual, but only
if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or
(4) the health care provider, but only if a per-
son described in paragraph (1), (2), or (3) cannot be
contacted after a reasonable effort.
SEC. 146. MINORS.
(a) INDIVIDUALS WHO ARE 18 OR LEGALLY CAPA-
BLE.—In the case of an individual—
(1) who is 18 years of age or older, all rights
of the individual shall be exercised by the individual,
except as provided in section 145; or
(2) who, acting alone, has the legal capacity to
apply for and obtain health care and has sought
such care, the individual shall exercise all rights of
an individual under this Act with respect to pro-
tected health information relating to such care.
(b) INDIVIDUALS UNDER 18.—Except as provided in
subsection (a)(2), in the case of an individual who is—
(1) under 14 years of age, all the individual’s
rights under this Act shall be exercised through the
parent or legal guardian of the individual; or
(2) 14, 15, 16, or 17 years of age, the right of
inspection (under section 101), the right of amend-
ment (under section 102), and the right to authorize
disclosure of protected health information (under
section 112) of the individual may be exercised ei-
ther by the individual or by the parent or legal
guardian of the individual.
SEC. 147. MAINTENANCE OF CERTAIN PROTECTED HEALTH
INFORMATION.
(a) IN GENERAL.—A State shall establish a process
under which the protected health information described in
subsection (b) that is maintained by a person described
in subsection (c) is delivered to, and maintained by, the
State or an individual or entity designated by the State.
(b) 
INFORMATION
DESCRIBED.—The 
protected
health information referred to in subsection (a) is pro-
tected health information that—
(1) is recorded in any form or medium;
(2) is created by—
(A) a health care provider; or
(B) a health benefit plan sponsor that pro-
vides benefits in the form of items and services
to enrollees and not in the form of reimburse-
ment for items and services; and
(3) relates in any way to the past, present, or
future physical or mental health or condition or
functional status of a protected individual or the
provision of health care to a protected individual.
(c) PERSONS DESCRIBED.—A person referred to in
subsection (a) is any of the following:
(1) A health care facility previously located in
the State that has closed.
(2) A professional practice previously operated
by a health care provider in the State that has
closed.
(3) A health benefit plan sponsor that—
(A) previously provided benefits in the
form of items and services to enrollees in the
State; and
(B) has ceased to do business.
Subtitle E—Enforcement
SEC. 151. CIVIL ACTIONS.
(a) IN GENERAL.—Any individual whose right under
this Act has been knowingly or negligently violated—
(1) by a health information trustee, or any
other person, who is not described in paragraph (2),
(3), (4), or (5) may maintain a civil action for actual
damages and for equitable relief against the health
information trustee or other person;
(2) by an officer or employee of the United
States while the officer or employee was acting with-
in the scope of the office or employment may main-
tain a civil action for actual damages and for equi-
table relief against the United States;
(3) by an officer or employee of any government
authority of a State that has waived its sovereign
immunity to a claim for damages resulting from a
violation of this Act while the officer or employee
was acting within the scope of the office or employ-
ment may maintain a civil action for actual damages
and for equitable relief against the State govern-
ment;
(4) by an officer or employee of a government
of a State that is not described in paragraph (3)
may maintain a civil action for actual damages and
for equitable relief against the officer or employee;
or
(5) by an officer or employee of a government
authority while the officer or employee was not act-
ing within the scope of the office or employment
may maintain a civil action for actual damages and
for equitable relief against the officer or employee.
(b) KNOWING VIOLATIONS.—Any individual entitled
to recover actual damages under this section because of
a knowing violation of a provision of this Act (other than
subsection (c) or (d) of section 111) shall be entitled to
recover the amount of the actual damages demonstrated
or $5000, whichever is greater.
(c) ACTUAL DAMAGES.—For purposes of this section,
the term ‘‘actual damages’’ includes damages paid to com-
pensate an individual for nonpecuniary losses such as
physical and mental injury as well as damages paid to
compensate for pecuniary losses.
(d) PUNITIVE DAMAGES; ATTORNEY’S FEES.—In
any action brought under this section in which the com-
plainant has prevailed because of a knowing violation of
a provision of this Act (other than subsection (c) or (d)
of section 111), the court may, in addition to any relief
awarded under subsections (a) and (b), award such puni-
tive damages as may be warranted. In such an action, the
court, in its discretion, may allow the prevailing party a
reasonable attorney’s fee (including expert fees) as part
of the costs, and the United States shall be liable for costs
the same as a private person.
(e) LIMITATION.—A civil action under this section
may not be commenced more than 2 years after the date
on which the aggrieved individual discovered the violation
or the date on which the aggrieved individual had a rea-
sonable opportunity to discover the violation, whichever oc-
curs first.
(f) INSPECTION AND AMENDMENT.—If a health in-
formation trustee has established a formal internal proce-
dure that allows an individual who has been denied inspec-
tion or amendment of protected health information to ap-
peal the denial, the individual may not maintain a civil
action in connection with the denial until the earlier of—
(1) the date the appeal procedure has been ex-
hausted; or
(2) the date that is 4 months after the date on
which the appeal procedure was initiated.
(g) NO
LIABILITY
FOR
PERMISSIBLE
DISCLO-
SURES.—A health information trustee who makes a disclo-
sure of protected health information about a protected in-
dividual that is permitted by this Act and not otherwise
prohibited by State or Federal statute shall not be liable
to the individual for the disclosure under common law.
(h) NO LIABILITY
FOR INSTITUTIONAL REVIEW
BOARD DETERMINATIONS.—If the members of a certified
institutional review board have in good faith determined
that an approved health research project is of sufficient
importance so as to outweigh the intrusion into the privacy
of an individual pursuant to section 116(a)(1), the mem-
bers, the board, and the parent institution of the board
shall not be liable to the individual as a result of such
determination.
(i) GOOD FAITH RELIANCE ON CERTIFICATION.—A
health information trustee who relies in good faith on a
certification by a government authority or other person
and discloses protected health information about an indi-
vidual in accordance with this Act shall not be liable to
the individual for such disclosure.
SEC. 152. CIVIL MONEY PENALTIES.
(a) VIOLATION.—Any health information trustee who
the Secretary determines has demonstrated a pattern or
practice of failure to comply with the provisions of this
Act shall be subject, in addition to any other penalties that
may be prescribed by law, to a civil money penalty of not
more than $10,000 for each such failure. In determining
the amount of any penalty to be assessed under the proce-
dures established under subsection (b), the Secretary shall
take into account the previous record of compliance of the
person being assessed with the applicable requirements of
this Act and the gravity of the violation.
(b) PROCEDURES FOR IMPOSITION OF PENALTIES.—
The provisions of section 1128A of the Social Security Act
(other than subsections (a) and (b)) shall apply to the im-
position of a civil monetary penalty under this section in
the same manner as such provisions apply with respect
to the imposition of a penalty under section 1128A of such
Act.
SEC. 153. ALTERNATIVE DISPUTE RESOLUTION.
(a) IN GENERAL.—Not later than July 1, 1996, the
Secretary shall, by regulation, develop alternative dispute
resolution methods for use by individuals, health informa-
tion trustees, and other persons in resolving claims under
section 151.
(b) EFFECT ON INITIATION OF CIVIL ACTIONS.—
(1) IN GENERAL.—Subject to paragraph (2),
the regulations established under subsection (a) may
provide that an individual alleging that a right of
the individual under this Act has been violated shall
pursue at least one alternative dispute resolution
method developed under such subsection as a condi-
tion precedent to commencing a civil action under
section 151.
(2) LIMITATION.—Such regulations may not re-
quire an individual to refrain from commencing a
civil action to pursue one or more alternative dispute
resolution method for a period that is greater than
6 months.
(3) SUSPENSION
OF
STATUTE
OF
LIMITA-
TIONS.—The regulations established by the Sec-
retary under subsection (a) may provide that a pe-
riod in which an individual described in paragraph
(1) pursues (as defined by the Secretary) an alter-
native dispute resolution method under this section
shall be excluded in computing the period of limita-
tions under section 151(e).
(c) METHODS.—The methods under subsection (a)
shall include at least the following:
(1) ARBITRATION.—The use of arbitration.
(2) MEDIATION.—The use of mediation.
(3) EARLY OFFERS OF SETTLEMENT.—The use
of a process under which parties make early offers
of settlement.
(d) STANDARDS FOR ESTABLISHING METHODS.—In
developing alternative dispute resolution methods under
subsection (a), the Secretary shall ensure that the meth-
ods promote the resolution of claims in a manner that—
(1) is affordable for the parties involved;
(2) provides for timely and fair resolution of
claims; and
(3) provides for reasonably convenient access to
dispute resolution for individuals.
SEC. 154. AMENDMENTS TO CRIMINAL LAW.
(a) IN GENERAL.—Title 18, United States Code, is
amended by inserting after chapter 89 the following:
‘‘CHAPTER 90—PROTECTED HEALTH
INFORMATION
‘‘Sec.
‘‘1831. Definitions.
‘‘1832. Obtaining protected health information under false pretenses.
‘‘1833. Monetary gain from obtaining protected health information under false
pretenses.
‘‘1834. Knowing and unlawful obtaining of protected health information.
‘‘1835. Monetary gain from knowing and unlawful obtaining of protected health
information.
‘‘1836. Knowing and unlawful use or disclosure of protected health information.
‘‘1837. Monetary gain from knowing and unlawful sale, transfer, or use of pro-
tected health information.
‘‘§ 1831. Definitions
‘‘As used in this chapter—
‘‘(1) the term ‘health information trustee’ has
the meaning given such term in section 3(b)(6) of
the Fair Health Information Practices Act of 1995;
‘‘(2) the term ‘protected health information’ has
the meaning given such term in section 3(a)(3) of
such Act; and
‘‘(3) the term ‘protected individual’ has the
meaning given such term in section 3(a)(4) of such
Act.
‘‘§ 1832. 
Obtaining 
protected 
health 
information
under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee; or
‘‘(2) obtains from a protected individual an au-
thorization for the disclosure of protected health in-
formation about the individual maintained by a
health information trustee;
shall be fined under this title or imprisoned not more than
5 years, or both.
‘‘§ 1833. Monetary gain from obtaining protected
health information under false pretenses
‘‘Whoever under false pretenses—
‘‘(1) requests or obtains protected health infor-
mation from a health information trustee with the
intent to sell, transfer, or use such information for
profit or monetary gain; or
‘‘(2) obtains from a protected individual an au-
thorization for the disclosure of protected health in-
formation about the individual maintained by a
health information trustee with the intent to sell,
transfer, or use such authorization for profit or
monetary gain;
and knowingly sells, transfers, or uses such information
or authorization for profit or monetary gain shall be fined
under this title or imprisoned not more than 10 years, or
both.
‘‘§ 1834. Knowing and unlawful obtaining of pro-
tected health information
‘‘Whoever knowingly obtains protected health infor-
mation from a health information trustee in violation of
the Fair Health Information Practices Act of 1995, know-
ing that such obtaining is unlawful, shall be fined under
this title or imprisoned not more than 5 years, or both.
‘‘§ 1835. Monetary gain from knowing and unlawful
obtaining of protected health information
‘‘Whoever knowingly—
‘‘(1) obtains protected health information from
a health information trustee in violation of the Fair
Health Information Practices Act of 1995, knowing
that such obtaining is unlawful and with the intent
to sell, transfer, or use such information for profit
or monetary gain; and
‘‘(2) knowingly sells, transfers, or uses such in-
formation for profit or monetary gain;
shall be fined under this title or imprisoned not more than
10 years, or both.
‘‘§ 1836. Knowing and unlawful use or disclosure of
protected health information
‘‘Whoever knowingly uses or discloses protected
health information in violation of the Fair Health Infor-
mation Practices Act of 1995, knowing that such use or
disclosure is unlawful, shall be fined under this title or
imprisoned not more than 5 years, or both.
‘‘§ 1837. Monetary gain from knowing and unlawful
sale, transfer, or use of protected health
information
‘‘Whoever knowingly sells, transfers, or uses pro-
tected health information in violation of the Fair Health
Information Practices Act of 1995, knowing that such
sale, transfer, or use is unlawful, shall be fined under this
title or imprisoned not more than 10 years, or both.’’.
(b) CLERICAL AMENDMENT.—The table of chapters
for part I of title 18, United States Code, is amended by
inserting after the item relating to chapter 89 the follow-
ing:
‘‘90. Protected health information .............................................. 1831’’.
TITLE II—AMENDMENTS TO
TITLE 5, UNITED STATES CODE
SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.
(a) NEW SUBSECTION.—Section 552a of title 5,
United States Code, is amended by adding at the end the
following:
‘‘(w) MEDICAL EXEMPTIONS.—The head of an agen-
cy that is a health information trustee (as defined in sec-
tion 3(b)(6) of the Fair Health Information Practices Act
of 1995) shall promulgate rules, in accordance with the
requirements (including general notice) of subsections
(b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this
title, to exempt a system of records within the agency, to
the extent that the system of records contains protected
health information (as defined in section 3(a)(3) of such
Act), from all provisions of this section except subsections
(e)(1), (e)(2), subparagraphs (A) through (C) and (E)
through (I) of subsection (e)(4), and subsections (e)(5),
(e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (q), (r), and (u).’’.
(b) REPEAL.—Section 552a(f)(3) of title 5, United
States Code, is amended by striking ‘‘pertaining to him,’’
and all that follows through the semicolon and inserting
‘‘pertaining to the individual;’’.
TITLE 
III—REGULATIONS, 
RE-
SEARCH, 
AND 
EDUCATION;
EFFECTIVE DATES; APPLICA-
BILITY; AND RELATIONSHIP
TO OTHER LAWS
SEC. 301. REGULATIONS; RESEARCH AND EDUCATION.
(a) REGULATIONS.—Not later than July 1, 1996, the
Secretary shall prescribe regulations to carry out this Act.
(b) RESEARCH
AND TECHNICAL SUPPORT.—The
Secretary may sponsor—
(1) research relating to the privacy and security
of protected health information;
(2) the development of consent forms governing
disclosure of such information; and
(3) the development of technology to implement
standards regarding such information.
(c) EDUCATION.—The Secretary shall establish edu-
cation and awareness programs—
(1) to foster adequate security practices by
health information trustees;
(2) to train personnel of health information
trustees respecting the duties of such personnel with
respect to protected health information; and
(3) to inform individuals and employers who
purchase health care respecting their rights with re-
spect to such information.
SEC. 302. EFFECTIVE DATES.
(a) IN GENERAL.—Except as provided in subsection
(b), this Act, and the amendments made by this Act, shall
take effect on January 1, 1997.
(b) PROVISIONS EFFECTIVE IMMEDIATELY.—A pro-
vision of this Act shall take effect on the date of the enact-
ment of this Act if the provision—
(1) imposes a duty on the Secretary to develop,
establish, or promulgate regulations, guidelines, no-
tices, statements, or education and awareness pro-
grams; or
(2) authorizes the Secretary to sponsor research
or the development of forms or technology.
SEC. 303. APPLICABILITY.
(a) PROTECTED HEALTH INFORMATION.—Except as
provided in subsections (b) and (c), the provisions of this
Act shall apply to any protected health information that
is received, created, used, maintained, or disclosed by a
health information trustee in a State on or after January
1, 1997, regardless of whether the information existed or
was disclosed prior to such date.
(b) EXCEPTION.—
(1) IN GENERAL.—The provisions of this Act
shall not apply to a trustee described in paragraph
(2), except with respect to protected health informa-
tion that is received by the trustee on or after Janu-
ary 1, 1997.
(2) APPLICABILITY.—A trustee referred to in
paragraph (1) is—
(A) a health researcher; or
(B) a person who, with respect to specific
protected health information, received the infor-
mation—
(i) pursuant to—
(I) section 117 (relating to emer-
gency circumstances);
(II) section 118 (relating to judi-
cial and administrative purposes);
(III) section 119 (relating to law
enforcement); or
(IV) section 120 (relating to sub-
poenas, warrants, and search war-
rants); or
(ii) while acting in whole or in part in
the capacity of an officer or employee of a
person described in clause (i).
(c) AUTHORIZATIONS FOR DISCLOSURES.—An au-
thorization for the disclosure of protected health informa-
tion about a protected individual that is executed by the
individual before January 1, 1997, and is recognized and
valid under State law on December 31, 1996, shall remain
valid and shall not be subject to the requirements of sec-
tion 112 until January 1, 1998, or the occurrence of the
date or event (if any) specified in the authorization upon
which the authorization expires, whichever occurs earlier.
SEC. 304. RELATIONSHIP TO OTHER LAWS.
(a) STATE LAW.—Except as otherwise provided in
subsections (b), (c), (d), and (f), a State may not estab-
lish, continue in effect, or enforce any State law to the
extent that the law is inconsistent with, or imposes addi-
tional requirements with respect to, any of the following:
(1) A duty of a health information trustee
under this Act.
(2) An authority of a health information trustee
under this Act to disclose protected health informa-
tion.
(3) A provision of subtitle C (relating to access
procedures and challenge rights), subtitle D (mis-
cellaneous provisions), or subtitle E (relating to en-
forcement).