Date: 2014-01-10
Speaker: JACKSON LEE (democrat)
Chamber: H

So we have had an intense interest since the report "Records. Computers. and the Rights of Citizens" was produced in 1973. HHS is chiefly responsible for why the United States became the first Nation in the world to draft a Federal privacy law. They know what to do. They developed the Code of Fair Information practices which have five principles. one of which says there must be no personal data recordkeeping systems whose very existence is secret. that is. to not use the data of people in the wrong way. There is the CMS Policy for Privacy Act. and I offer this for the RECORD. The baseline of my point is that HHS was at the core of developing privacy. There have been no known breaches. There is no bar for CMS and HHS to tell the American public or the individual immediately. This bill will add burdensome requirements and mayit maydistract or take away from legal and lawful law enforcement investigations. I ask that we look at this together in a bipartisan manner. I believe in privacy. I hope we can work together. Mr. PALLONE. and make this what it should be. but I think the American people are protected. Mr. Speaker. I rise to speak on H.R. 3811. the Health Exchange Security and Transparency Act of 2014. I would like to commend the author of the bill for the focus on privacy. Privacy protection is a policy area that has strong bipartisan agreement. However. because H.R. 3811 did not go through regular order there was no opportunity for the Committees of jurisdiction to provide valuable input into its drafting. I would like to offer a few facts that may make it clear that this bill. although well intentioned is not necessary in its current form. The Affordable Care Act implementation of healthcare.gov is under the authority of the Department of Health and Human Services (HHS). HHS assigned the task for developing healthcare.gov to the agencys Centers for Medicare & Medicaid Services (CMS). Under the Federal Privacy Act all federal agencies must draft regulations to protect personally identifiable information under their control. The Federal Privacy Act was established by an act of Congress and concurrence of the Executive Branch to balance the Governments need to maintain personal information on Americans with the right of individuals to be protected against unwarranted invasions of their privacy. The Privacy Act came as a direct result of the work of the Church Committee following revelations that the government had routinely used records on citizens for political purposes to engage in surveillance or retaliatory activity a series of laws were passed by Congress to protect the privacy of Americans. Computer records management was of such grave concern to members of Congress following investigations into disclosures that then President Nixon had used his high office to seek out means to exact retribution against political enemies by causing harm to careers. reputations as well as financial injury through IRS audits. In 1973. a report "Records. Computers. and the Rights of Citizens" was produced by the former Federal Department of Health Education and Welfare (HEW). which today exists as two agencies one of which is the Department of Health and Human Services (HHS) established the first federal agency privacy policies for information held on Americans. HHS is chiefly responsible for why the United States became the first nation in the world to draft a federal privacy law. HHS developed the Code of Fair Information practices which later became the basis for the Federal Privacy Act. The Code of Fair Information Practices has five principles: There must be no personal data recordkeeping systems whose very existence is secret. There must be a way for a person to find out what information about the person is in a record and how it is used. There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the persons consent. There must be a way for a person to correct or amend a record of identifiable information about the person. Any organization creating. maintaining. using. or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data. The Federal Privacy Act protects all personal information managed by Federal agencies. We know that not all agencies do a good job at protecting the personal information of citizens so todays focus on privacy is relevant and important. However. our focus should be much broader and better informed regarding the work of each agency in this area. Committee hearings would have been beneficial in informing the drafters of H.R. 3811. prior to its introduction on the Floor of the House for a vote. For example. authors of the bill may have taken a different approach if it was acknowledged that the CMS has several policy documents specific to the topic of protecting personal identifiable information of medical records data: CMS Policy for Privacy Act Implementation & Breach Notification (7/23/07) Risk Management Handbook Volume III Standard 7.1 (12/6/12) Incident Handling and Breach Notification CMS Privacy Policy is written to meet obligations established by the Federal Privacy Act of 1974 (5 U.S.C.. 552a). the Computer Matching and Privacy Protection Act of 1988 (Public Law 100503) and the Department of Health and Human Services Privacy Act Regulations (45 C.F.R. Part 5b). I want to assure my colleagues that under the Federal Privacy Act all Federal agencies must "develop an effective response to [breaches] that requires disclosure of information regarding the breach to those individuals affected by it. as well as to persons and entities in a position to cooperate. either by assisting in notification to affected individuals or playing a role in preventing or minimizing harms from the breach." All agencies. which include CMS. must report all incidents involving personally identifiable information to USComputer Readiness Team or (USCERT).