Fair Health Information Practices Act of 1995

.

    (a) In General.--Not later than July 1, 1996, the Secretary shall, 
by regulation, develop alternative dispute resolution methods for use 
by individuals, health information trustees, and other persons in 
resolving claims under section 151.
    (b) Effect on Initiation of Civil Actions.--
            (1) In general.--Subject to paragraph (2), the regulations 
        established under subsection (a) may provide that an individual 
        alleging that a right of the individual under this Act has been 
        violated shall pursue at least one alternative dispute 
        resolution method developed under such subsection as a 
        condition precedent to commencing a civil action under section 
        151.
            (2) Limitation.--Such regulations may not require an 
        individual to refrain from commencing a civil action to pursue 
        one or more alternative dispute resolution method for a period 
        that is greater than 6 months.
            (3) Suspension of statute of limitations.--The regulations 
        established by the Secretary under subsection (a) may provide 
        that a period in which an individual described in paragraph (1) 
        pursues (as defined by the Secretary) an alternative dispute 
        resolution method under this section shall be excluded in 
        computing the period of limitations under section 151(e).
    (c) Methods.--The methods under subsection (a) shall include at 
least the following:
            (1) Arbitration.--The use of arbitration.
            (2) Mediation.--The use of mediation.
            (3) Early offers of settlement.--The use of a process under 
        which parties make early offers of settlement.
    (d) Standards for Establishing Methods.--In developing alternative 
dispute resolution methods under subsection (a), the Secretary shall 
ensure that the methods promote the resolution of claims in a manner 
that--
            (1) is affordable for the parties involved;
            (2) provides for timely and fair resolution of claims; and
            (3) provides for reasonably convenient access to dispute 
        resolution for individuals.

SEC. 154. AMENDMENTS TO CRIMINAL LAW.

    (a) In General.--Title 18, United States Code, is amended by 
inserting after chapter 89 the following:

               ``CHAPTER 90--PROTECTED HEALTH INFORMATION

``Sec.
``1831. Definitions.
``1832. Obtaining protected health information under false pretenses.
``1833. Monetary gain from obtaining protected health information under 
                            false pretenses.
``1834. Knowing and unlawful obtaining of protected health information.
``1835. Monetary gain from knowing and unlawful obtaining of protected 
                            health information.
``1836. Knowing and unlawful use or disclosure of protected health 
                            information.
``1837. Monetary gain from knowing and unlawful sale, transfer, or use 
                            of protected health information.
``Sec. 1831. Definitions
    ``As used in this chapter--
            ``(1) the term `health information trustee' has the meaning 
        given such term in section 3(b)(6) of the Fair Health 
        Information Practices Act of 1995;
            ``(2) the term `protected health information' has the 
        meaning given such term in section 3(a)(3) of such Act; and
            ``(3) the term `protected individual' has the meaning given 
        such term in section 3(a)(4) of such Act.
``Sec. 1832. Obtaining protected health information under false 
              pretenses
    ``Whoever under false pretenses--
            ``(1) requests or obtains protected health information from 
        a health information trustee; or
            ``(2) obtains from a protected individual an authorization 
        for the disclosure of protected health information about the 
        individual maintained by a health information trustee;
shall be fined under this title or imprisoned not more than 5 years, or 
both.
``Sec. 1833. Monetary gain from obtaining protected health information 
              under false pretenses
    ``Whoever under false pretenses--
            ``(1) requests or obtains protected health information from 
        a health information trustee with the intent to sell, transfer, 
        or use such information for profit or monetary gain; or
            ``(2) obtains from a protected individual an authorization 
        for the disclosure of protected health information about the 
        individual maintained by a health information trustee with the 
        intent to sell, transfer, or use such authorization for profit 
        or monetary gain;
and knowingly sells, transfers, or uses such information or 
authorization for profit or monetary gain shall be fined under this 
title or imprisoned not more than 10 years, or both.
``Sec. 1834. Knowing and unlawful obtaining of protected health 
              information
    ``Whoever knowingly obtains protected health information from a 
health information trustee in violation of the Fair Health Information 
Practices Act of 1995, knowing that such obtaining is unlawful, shall 
be fined under this title or imprisoned not more than 5 years, or both.
``Sec. 1835. Monetary gain from knowing and unlawful obtaining of 
              protected health information
    ``Whoever knowingly--
            ``(1) obtains protected health information from a health 
        information trustee in violation of the Fair Health Information 
        Practices Act of 1995, knowing that such obtaining is unlawful 
        and with the intent to sell, transfer, or use such information 
        for profit or monetary gain; and
            ``(2) knowingly sells, transfers, or uses such information 
        for profit or monetary gain;
shall be fined under this title or imprisoned not more than 10 years, 
or both.
``Sec. 1836. Knowing and unlawful use or disclosure of protected health 
              information
    ``Whoever knowingly uses or discloses protected health information 
in violation of the Fair Health Information Practices Act of 1995, 
knowing that such use or disclosure is unlawful, shall be fined under 
this title or imprisoned not more than 5 years, or both.
``Sec. 1837. Monetary gain from knowing and unlawful sale, transfer, or 
              use of protected health information
    ``Whoever knowingly sells, transfers, or uses protected health 
information in violation of the Fair Health Information Practices Act 
of 1995, knowing that such sale, transfer, or use is unlawful, shall be 
fined under this title or imprisoned not more than 10 years, or 
both.''.
    (b) Clerical Amendment.--The table of chapters for part I of title 
18, United States Code, is amended by inserting after the item relating 
to chapter 89 the following:

``90. Protected health information..........................    1831''.

          TITLE II--AMENDMENTS TO TITLE 5, UNITED STATES CODE

SEC. 201. AMENDMENTS TO TITLE 5, UNITED STATES CODE.

    (a) New Subsection.--Section 552a of title 5, United States Code, 
is amended by adding at the end the following:

    ``(w) Medical Exemptions.--The head of an agency that is a health 
information trustee (as defined in section 3(b)(6) of the Fair Health 
Information Practices Act of 1995) shall promulgate rules, in 
accordance with the requirements (including general notice) of 
subsections (b)(1), (b)(2), (b)(3), (c), and (e) of section 553 of this 
title, to exempt a system of records within the agency, to the extent 
that the system of records contains protected health information (as 
defined in section 3(a)(3) of such Act), from all provisions of this 
section except subsections (e)(1), (e)(2), subparagraphs (A) through 
(C) and (E) through (I) of subsection (e)(4), and subsections (e)(5), 
(e)(6), (e)(9), (e)(12), (l), (n), (o), (p), (q), (r), and (u).''.
    (b) Repeal.--Section 552a(f)(3) of title 5, United States Code, is 
amended by striking ``pertaining to him,'' and all that follows through 
the semicolon and inserting ``pertaining to the individual;''.

   TITLE III--REGULATIONS, RESEARCH, AND EDUCATION; EFFECTIVE DATES; 
             APPLICABILITY; AND RELATIONSHIP TO OTHER LAWS

SEC. 301. REGULATIONS; RESEARCH AND EDUCATION.

    (a) Regulations.--Not later than July 1, 1996, the Secretary shall 
prescribe regulations to carry out this Act.
    (b) Research and Technical Support.--The Secretary may sponsor--
            (1) research relating to the privacy and security of 
        protected health information;
            (2) the development of consent forms governing disclosure 
        of such information; and
            (3) the development of technology to implement standards 
        regarding such information.
    (c) Education.--The Secretary shall establish education and 
awareness programs--
            (1) to foster adequate security practices by health 
        information trustees;
            (2) to train personnel of health information trustees 
        respecting the duties of such personnel with respect to 
        protected health information; and
            (3) to inform individuals and employers who purchase health 
        care respecting their rights with respect to such information.

SEC. 302. EFFECTIVE DATES.

    (a) In General.--Except as provided in subsection (b), this Act, 
and the amendments made by this Act, shall take effect on January 1, 
1997.
    (b) Provisions Effective Immediately.--A provision of this Act 
shall take effect on the date of the enactment of this Act if the 
provision--
            (1) imposes a duty on the Secretary to develop, establish, 
        or promulgate regulations, guidelines, notices, statements, or 
        education and awareness programs; or
            (2) authorizes the Secretary to sponsor research or the 
        development of forms or technology.

SEC. 303. APPLICABILITY.

    (a) Protected Health Information.--Except as provided in 
subsections (b) and (c), the provisions of this Act shall apply to any 
protected health information that is received, created, used, 
maintained, or disclosed by a health information trustee in a State on 
or after January 1, 1997, regardless of whether the information existed 
or was disclosed prior to such date.
    (b) Exception.--
            (1) In general.--The provisions of this Act shall not apply 
        to a trustee described in paragraph (2), except with respect to 
        protected health information that is received by the trustee on 
        or after January 1, 1997.
            (2) Applicability.--A trustee referred to in paragraph (1) 
        is--
                    (A) a health researcher; or
                    (B) a person who, with respect to specific 
                protected health information, received the 
                information--
                            (i) pursuant to--
                                    (I) section 117 (relating to 
                                emergency circumstances);
                                    (II) section 118 (relating to 
                                judicial and administrative purposes);
                                    (III) section 119 (relating to law 
                                enforcement); or
                                    (IV) section 120 (relating to 
                                subpoenas, warrants, and search 
                                warrants); or
                            (ii) while acting in whole or in part in 
                        the capacity of an officer or employee of a 
                        person described in clause (i).
    (c) Authorizations for Disclosures.--An authorization for the 
disclosure of protected health information about a protected individual 
that is executed by the individual before January 1, 1997, and is 
recognized and valid under State law on December 31, 1996, shall remain 
valid and shall not be subject to the requirements of section 112 until 
January 1, 1998, or the occurrence of the date or event (if any) 
specified in the authorization upon which the authorization expires, 
whichever occurs earlier.

SEC. 304. RELATIONSHIP TO OTHER LAWS.

    (a) State Law.--Except as otherwise provided in subsections (b), 
(c), (d), and (f), a State may not establish, continue in effect, or 
enforce any State law to the extent that the law is inconsistent with, 
or imposes additional requirements with respect to, any of the 
following:
            (1) A duty of a health information trustee under this Act.
            (2) An authority of a health information trustee under this 
        Act to disclose protected health information.
            (3) A provision of subtitle C (relating to access 
        procedures and challenge rights), subtitle D (miscellaneous 
        provisions), or subtitle E (relating to enforcement).
    (b) Laws Relating to Public Health and Mental Health.--This Act 
does not preempt, supersede, or modify the operation of any State law 
regarding public health or mental health to the extent that the law 
prohibits or regulates a disclosure of protected health information 
that is permitted under this Act.
    (c) Criminal Penalties.--A State may establish and enforce criminal 
penalties with respect to a failure to comply with a provision of this 
Act.
    (d) Privileges.--A privilege that a person has under law in a court 
of a State or the United States or under the rules of any agency of a 
State or the United States may not be diminished, waived, or otherwise 
affected by--
            (1) the execution by a protected individual of an 
        authorization for disclosure of protected health information 
        under this Act, if the authorization is executed for the 
        purpose of receiving health care or providing for the payment 
        for health care; or
            (2) any provision of this Act that authorizes the 
        disclosure of protected health information for the purpose of 
        receiving health care or providing for the payment for health 
        care.
    (e) Department of Veterans Affairs.--The limitations on use and 
disclosure of protected health information under this Act shall not be 
construed to prevent any exchange of such information within and among 
components of the Department of Veterans Affairs that determine 
eligibility for or entitlement to, or that provide, benefits under laws 
administered by the Secretary of Veterans Affairs.
    (f) Certain Duties Under State or Federal Law.--This Act shall not 
be construed to preempt, supersede, or modify the operation of any of 
the following:
            (1) Any law that provides for the reporting of vital 
        statistics such as birth or death information.
            (2) Any law requiring the reporting of abuse or neglect 
        information about any individual.
            (3) Subpart II of part E of title XXVI of the Public Health 
        Service Act (relating to notifications of emergency response 
        employees of possible exposure to infectious diseases).
            (4) The Americans with Disabilities Act of 1990.
            (5) Any Federal or State statute that establishes a 
        privilege for records used in health professional peer review 
        activities.
    (f) Secretarial Authority.--
            (1) Secretary of health and human services.--A provision of 
        this Act does not preempt, supersede, or modify the operation 
        of section 543 of the Public Health Service Act, except to the 
        extent that the Secretary of Health and Human Services 
        determines through regulations promulgated by such Secretary 
        that the provision provides greater protection for protected 
        health information, and the rights of protected individuals, 
        than is provided under such section 543.
            (2) Secretary of veterans affairs.--A provision of this Act 
        does not preempt, supersede, or modify the operation of section 
        7332 of title 38, United States Code, except to the extent that 
        the Secretary of Veterans Affairs determines through 
        regulations promulgated by such Secretary that the provision 
        provides greater protection for protected health information, 
        and the rights of protected individuals, than is provided under 
        such section 7332.
                                 
HR 435 IH----2
HR 435 IH----3
HR 435 IH----4
HR 435 IH----5
HR 435 IH----6
HR 435 IH----7

Summary: TABLE OF CONTENTS: 
     Title I:  Fair Health Information Practices 
          Subtitle A:  Duties of Health Information Trustees 
          Subtitle B:  Use and Disclosure of Protected Health 
               Information 
          Subtitle C:  Access Procedures and Challenge Rights 
          Subtitle D:  Miscellaneous Provisions 
          Subtitle E:  Enforcement 
     Title II:  Amendments to Title 5, United States Code 
     Title III:  Regulations, Research, and Education; Effective 
          Dates; Applicability; and Relationship to Other Laws 
Fair Health Information Practices Act of 1995 - 
Title I:  Fair Health Information Practices
 - 
Subtitle A:  Duties of Health Information Trustees
 - Requires, subject to stated exceptions, health care providers, health information service organizations, health oversight agencies, health benefit plan sponsors, and health researchers (health information trustees) to permit an individual (protected individual) to examine his or her own medical records (protected health information).  Excepts certain mental health or other records which may endanger the protected individual.  Sets forth provisions concerning:  (1) notice of information practices; (2) accounting for disclosures; and (3) security. 
Subtitle B:  Use and Disclosure of Protected Information
 - Sets forth the general rule that a health information trustee may use protected information only for a purpose:  (1) that is compatible with and directly related to the purpose for which the information was collected or received by the trustee; or (2) for which the trustee has received authorization to disclose such information.  Makes exceptions, if proper procedures are followed, for the following situations:  (1) next of kin and directory information; (2) public health; (3) health research; (4) emergencies; (5) judicial and administrative purposes; (6) law enforcement; (7) subpoenas, warrants, and search warrants; and (8) health information service organizations. 
Subtitle C:  Access Procedures and Challenge Rights
 - Sets forth access and challenge procedures for subpoenas, warrants, and search warrants concerning protected health information. 
Subtitle D:  Miscellaneous Provisions
 - Permits a health information trustee to disclose only such information as is necessary to process a payment when payment is made by a debit, credit, or other payment card. 
(Sec. 143) Directs the Secretary of Health and Human Services to establish electronic documents transmission, receipt, and maintenance standards. 
(Sec. 147) Directs a State to establish a process under which any created or recorded protected health information is delivered to and maintained by the State or its designated entity. 
Subtitle E:  Enforcement
 - Sets forth civil and criminal penalties for violations of this Act's provisions.  Directs the Secretary to develop alternative dispute resolution methods to resolve the civil complaints. 
Title II:  Amendments to Title 5, United Sates Code
 - Amends provisions of title 5 (Government Organization and Employees) of the United States Code concerning agency records maintained on individuals to direct the head of any agency that is a health information trustee to promulgate rules to exempt a system of records within the agency from stated provisions of title 5, to the extent that the such system contains protected health information. 
Title III:  Regulations, Research, and Education; Effective Dates; Applicability; and Relationship to Other Laws
 - Directs the Secretary to prescribe regulations to carry out this Act.  Authorizes the Secretary to sponsor research concerning protected health information.  Directs the Secretary to establish education and awareness programs concerning such information. 
(Sec. 303) Sets forth provisions concerning:  (1) the applicability of the provisions of this Act to protected health information; and (2) the relationship of the provisions of this Act to other laws.