Increasing Notice of Foreign Outsourcing Act

Bill: 108-s-2472
Sponsor: Sen. Nelson, Bill [D-FL]
Introduced: 2004-05-20 in the Senate
Policy area: Commerce
Subjects: Administrative procedure
Business records
Civil Rights and Liberties, Minority Issues
Computer security measures
Consumer education
Consumer protection
Contractors
Contracts
Data banks
Department of Health and Human Services
Department of the Treasury
Federal Deposit Insurance Corporation
Federal Reserve System
Federal Trade Commission
Finance and Financial Sector
Financial institutions
Financial services
Financial statements
Fines (Penalties)
Foreign Trade and International Finance
Foreign corporations
Government Operations and Politics
Government paperwork
Government publicity
Health
Health care industry
Independent regulatory commissions
Information disclosure (Securities law)
Internet
Law
Medical records
National Credit Union Administration
Right of privacy
Science, Technology, Communications
Securities and Exchange Commission
Subcontractors
Subsidiary corporations
Telephone

Summary:
action_date: 2004-05-20
text: 
Increasing Notice of Foreign Outsourcing Act - Directs the Secretary of Health and Human Services (HHS) to issue regulations requiring covered entities under the Health Insurance Portability and Accountability Act of 1996 that outsource protected health information to foreign-based business associates to include in their notice of privacy protections: (1) notification of outsourcing; (2) any risks and consequences to the privacy and security of such information resulting from outsourcing; (3) additional measures the covered entity is taking to protect outsourced protected health information; and (4) certification that the covered entity has taken reasonable steps to ensure that the handling of such information will comport with applicable laws.
 
Amends the Gramm-Leach-Bliley Act to impose similar requirements on financial institutions that outsource nonpublic personal information to foreign-based businesses. 
 
Directs the Secretary of HHS, with regard to protected health information outsourced by covered entities, and the Federal banking agencies, National Credit Union Administration, Secretary of the Treasury, Securities and Exchange Commission, and Federal Trade Commission, with regard to nonpublic personal information outsourced by financial institutions, to issue regulations requiring: (1) outsourcing contracts with foreign-based businesses to contain audit provisions; and (2) such businesses and subcontractors to be contractually bound by Federal privacy standards and security safeguards. 
 
Establishes notification procedures in the event of a breach of database security involving protected health or nonpublic personal information.
 
Requires contracts with foreign call centers to include a provision requiring call center employees to disclose their physical location upon request. Imposes civil penalties for violators.


Legislative actions:
action_date: 2004-05-20
text: Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S6007-6009)
action_date: 2004-05-20
text: Sponsor introductory remarks on measure. (CR S6006-6007)
action_date: 2004-05-20
text: Introduced in Senate