1.
(a)This Act may be cited
as the Health Information Privacy and
Security Act
.
(b)The table of contents for this Act is as follows:
Sec. 1. Short
title.
Sec. 2. Purposes.
Sec. 3. Definitions.
TITLE I—Individuals' rights
Subtitle A—Rights of the subjects of protected health
information
Sec. 101. Right to privacy and security.
Sec. 102. Inspection and copying of protected health
information.
Sec. 103. Modifications to protected health
information.
Sec. 104. Notice of privacy practices.
Sec. 105. Demonstration grant.
Subtitle B—Establishment of safeguards
Sec. 111. Establishment of safeguards.
Sec. 112. Transparency.
Sec. 113. Risk management.
Sec. 114. Accounting for disclosures and use.
TITLE II—Restrictions on use and disclosure
Subtitle A—General restrictions on use and
disclosure
Sec. 201. General rules regarding use and
disclosure.
Sec. 202. Informed consent for disclosure of protected health
information for treatment and payment.
Sec. 203. Authorizations for disclosure of protected health
information other than for treatment or payment.
Sec. 204. Notification in the case of breach.
Subtitle B—Disclosure under special circumstances
Sec. 211. Emergency circumstances.
Sec. 212. Public health.
Sec. 213. Protection and advocacy agencies.
Sec. 214. Oversight.
Sec. 215. Disclosure for law enforcement, national security,
and intelligence purposes.
Sec. 216. Next of kin and directory information.
Sec. 217. Health research.
Sec. 218. Judicial and administrative purposes.
Sec. 219. Individual representatives.
TITLE III—Office of Health Information Privacy of the Department
of Health and Human Services
Subtitle A—Designation
Sec. 301. Designation.
Subtitle B—Enforcement
Chapter 1—Criminal provisions
Sec. 311. Wrongful disclosure of protected health
information.
Sec. 312. Debarment for crimes and civil
violations.
Chapter 2—Civil sanctions
Sec. 321. Civil penalty.
Sec. 322. Procedures for imposition of penalties.
Sec. 323. Civil action by individuals.
Sec. 324. Enforcement by State attorneys general.
Sec. 325. Protection for whistleblower.
TITLE IV—Miscellaneous
Sec. 401. Relationship to other laws.
Sec. 402. Effective date.
2.The purposes of this Act are as
follows:
(1)To recognize that
individuals have a right to privacy, confidentiality, and security with respect
to health information, including genetic information, and that those rights
must be protected.
(2)To create
incentives to turn protected health information into de-identified health
information, where appropriate.
(3)To designate an
Office of Health Information Privacy within the Department of Health and Human
Services to protect that right of privacy.
(4)To provide
individuals with—
(A)access to health
information of which they are the subject; and
(B)the opportunity
to challenge the accuracy and completeness of such information by being able to
file modifications to or request the deletion of such information.
(5)To provide
individuals with the right to limit the use and disclosure of protected health
information.
(6)To establish
strong and effective mechanisms to protect against the unauthorized and
inappropriate use of protected health information.
(7)To invoke the
sweep of congressional powers, including the power to enforce the 14th
amendment to the Constitution, to regulate commerce, and to abrogate the
immunity of the States under the 11th amendment to the Constitution, in order
to address violations of the rights of individuals to privacy, to provide
individuals with access to their health information, and to prevent the
unauthorized use of protected health information that is genetic
information.
(8)To establish
strong and effective remedies for violations of this Act.
(9)To protect the
rights of States.
3.In this Act:
(1)Administrative
billing informationThe term administrative billing
information means any of the following forms of protected health
information:
(A)Date of service,
policy, patient identifiers, and practitioner or facility identifiers.
(B)Diagnostic codes,
in accordance with medicare billing codes, for which treatment is being
rendered or requested.
(C)Complexity of
service codes, indicating duration of treatment.
(D)Total billed
charges.
(2)The
term agent means a person that represents or acts for another
person (a principal) under a contract or relationship of agency, or that
functions to bring about, modify, affect, accept performance of, or terminate,
contractual obligations between the principal and a third person. With respect
to an employer, the term includes the employees of the employer.
(3)The
term authorization means the authority granted by an individual
that is the subject of protected health information, in accordance with title
II, for the disclosure of the individual’s protected health information.
(4)The term authorized recipient means a
person granted the authority by an individual, in accordance with title II, to
access, maintain, retain, modify, record, store, destroy, or otherwise use the
individual’s protected health information through an authorized
disclosure.
(5)The
term breach means the unauthorized acquisition, disclosure, or
loss of protected health information which compromises the security, privacy,
or integrity of protected health information maintained by or on behalf of a
person.
(6)The
term confidentiality means the obligations of those who receive
information to respect the privacy interests of those to whom the data
relate.
(7)The term data broker means a data bank, data
warehouse, information clearinghouse, record locator system, or other business
entity, which for monetary fees, dues, or on a cooperative nonprofit basis,
engages in the practice of accessing, collecting, maintaining, modifying,
storing, recording, transmitting, destroying, or otherwise using or disclosing
the protected health information of individuals. Any person maintaining
protected health information for the purposes of making such information
available to the individual or the health care provider, including persons
furnishing free or paid personal health records, electronic health records,
electronic medical records, and related products and services, shall be deemed
to be a data broker subject to the requirements of this Act.
(8)De-identified
health information
(A)The term de-identified health information
means any protected health information, with respect to which—
(i)all
personal identifiers, or other information that may be used by itself or in
combination with other information which may be available to re-identify the
subject of the information, have been removed;
(ii)a
good faith effort has been made to evaluate, minimize, and mitigate the risks
of re-identification of the subject of such information, using commonly
accepted scientific and statistical standards and methods for minimizing risk
of disclosure; and
(iii)there is no
reasonable basis to believe that the information can be used to identify an
individual.
(B)Such
term includes aggregate statistics, redacted health information, information in
which random or fictitious alternatives have been substituted for personally
identifiable information, and information in which personally identifiable
information has been encrypted and the decryption key is maintained only by
persons otherwise authorized to have access to such protected health
information in an identifiable format.
(9)The
term disclose means to release, publish, share, transfer,
transmit, disseminate, show, permit access to, communicate (orally or
otherwise), re-identify, or otherwise divulge protected health information to
any person other than the individual who is the subject of such information.
Such term includes the initial disclosure and any subsequent redisclosure of
protected health information.
(10)The term decryption key means the variable
information used in or produced by a mathematical formula, code, or algorithm,
or any component thereof, used for encryption or decryption of wire,
electronic, or other communications or stored information.
(11)The
term employer means a person that is engaged in business affecting
commerce and that has employees.
(12)The
term encryption—
(A)means the
protection of data in electronic form, in storage or in transit, using an
encryption technology that has been adopted by an established standards setting
body which renders such data indecipherable in the absence of associated
cryptographic keys necessary to enable decryption of such data; and
(B)includes
appropriate management and safeguards of such cryptographic keys so as to
protect the integrity of the encryption.
(13)The term health care means—
(A)preventive,
diagnostic, therapeutic, rehabilitative, maintenance, or palliative care,
including appropriate assistance with disease or symptom management and
maintenance, counseling, service, or procedure—
(i)with respect to
the physical or mental condition of an individual; or
(ii)affecting the
structure or function of the human body or any part of the human body,
including the banking of blood, sperm, organs, or any other tissue.
(B)any sale or
dispensing of a drug, device, equipment, or other health care-related item to
an individual, or for the use of an individual, pursuant to a
prescription.
(14)The term health care provider means a
person that, with respect to a specific item of protected health information,
receives, accesses, maintains, retains, modifies, records, stores, destroys, or
otherwise uses or discloses the information while acting in whole or in part in
the capacity of—
(A)an entity that
is, or holds itself out to be, licensed, certified, registered, or otherwise
authorized by Federal or State law to provide an item or service that
constitutes health care in the ordinary course of business, or practice of a
profession;
(B)contractors and
other health care providers or facilities authorized to provide items or
services related to diagnosis or treatment of a health concern, including
hospitals, nursing facilities, allied health professionals, and facilities used
or maintained by allied health professionals;
(C)a Federal or
State program that directly provides items or services that constitute health
care to beneficiaries;
(D)an officer or
employee or agent of a person described in subparagraph (A) or (C) who is
engaged in the provision of health care or who uses health information;
or
(E)medical personnel
in an emergency situation, including while communicating protected health
information by radio transmission or other means.
(15)The term health or life insurer means a
health insurance issuer (as defined in section 9805(b)(2) of the Internal
Revenue Code of 1986) or a life insurance company (as defined in section 816 of
such Code) and includes the employees and agents of such a person.
(16)The term health oversight
agency—
(A)means a person
that—
(i)performs or
oversees the performance of an assessment, investigation, or prosecution
relating to compliance with legal or fiscal standards relating to health care
fraud or fraudulent claims regarding health care, health services or equipment,
or related activities and items; and
(ii)is
a public executive branch agency, acting on behalf of a public executive branch
agency, acting pursuant to a requirement of a public executive branch agency,
or carrying out activities under a Federal or State law governing an
assessment, evaluation, determination, investigation, or prosecution described
in clause (i); and
(B)includes the
employees and agents of such a person.
(17)The term health plan has the meaning given such
term for purposes of the regulations promulgated under section 264(c) of the
Health Insurance Portability and Accountability Act of 1996.
(18)The term health record set means any item,
collection, or grouping of information that includes protected health
information, such as an electronic health record, electronic medical record,
personal health record, or account of disclosure, use or access, that is
created, accessed, received, maintained, retained, modified, recorded, stored,
destroyed, or otherwise used or disclosed by a health care provider, employer,
insurer, health plan, health researcher, school or university, data broker, or
other person.
(19)The term health researcher means a person
that, with respect to a specific item of protected health information, receives
the information—
(A)pursuant to
section 217 (relating to health research); or
(B)while acting in
whole or in part in the capacity of an officer, employee, or agent of a person
that receives the information pursuant to such section.
(20)The term informed consent means the
authorization for use or disclosure of protected health information by the
individual who is the subject of such information, conditioned upon that
individual’s having been informed of the nature and probability of harm to the
individual resulting from such authorization.
(21)The term law enforcement inquiry
means a lawful executive branch investigation or official proceeding inquiring
into a violation of, or failure to comply with, any criminal or civil statute
or any regulation, rule, or order issued pursuant to such a statute.
(22)Office of
health information privacyThe term Office of Health
Information Privacy means the Office of Health Information Privacy
designated under section 301.
(23)The
term person means an entity that is a government, governmental
subdivision of an executive branch agency or authority, corporation, company,
association, firm, partnership, society, estate, trust, joint venture,
individual, individual representative, tribal government, and any other legal
entity. Such term also includes the employees, contractors, agents, and
affiliates of all legal entities described in the preceding sentence, whether
or not they are acting in the capacity of their employment, contract, agency,
or affiliation.
(24)The
term privacy means an individual's right to control the
acquisition, uses, or disclosures of his or her identifiable health
data.
(25)Protected
health information
(A)The term protected health information means
any information, including genetic information, biometric information,
demographic information, and tissue samples collected from an individual,
whether oral or recorded in any form or medium, that—
(i)is
created or received by a health care provider, health researcher, health plan,
health or life insurer, medical or health savings plan administrator, school or
university, health care clearinghouse, health oversight agency, public health
authority, employer, data broker, or other person or such person’s agent,
officer, or employee; and
(ii)(I)relates to the past,
present, or future physical or mental health or condition of an individual
(including individual cells and their components), the provision of health care
to an individual, or the past, present, or future payment for the provision of
health care to an individual; and
(II)- (aa)identifies an
individual; or
- (bb)with respect to which there is a
reasonable basis to believe that the information can be used to identify an
individual.
(B)The term protected health information includes
any information described in paragraph (8).
(26)The term public health authority means an
authority or instrumentality of the United States, a tribal government, a
State, or a political subdivision of a State that is—
(A)primarily
responsible for public health matters; and
(B)primarily engaged
in activities such as injury reporting, public health surveillance, and public
health investigation or intervention.
(27)The
term re-identify, when used with respect to de-identified health
information, means an attempt, successful or otherwise, to ascertain—
(A)the identity of
the individual who is the subject of such information; or
(B)the decryption
key with respect to the information (when undertaken with knowledge that such
key would allow for the identification of the individual who is the subject of
such information).
(28)The term school or university means an
institution or place for instruction or education, including an elementary
school, secondary school, or institution of higher education, a college, or an
assemblage of colleges united under one corporate organization or
government.
(29)The
term Secretary means the Secretary of Health and Human
Services.
(30)The
term security means physical, technological, or administrative
safeguards or tools used to protect identifiable health data from unwarranted
access or disclosure.
(31)The term security breach means the physical,
structural, or substantive compromise of the security of protected health
information, through unauthorized disclosure, use, or access, whether actual or
attempted, resulting in the acquisition, access, or use of such information by
an unauthorized person. Such term does not apply to good faith or accidental
acquisition, or disclosure of protected health information by an unauthorized
person, so long as no further use or disclosure is made by such person.
(32)The
term State includes the District of Columbia, Puerto Rico, the
Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.
(33)To the maximum
extent practicableThe term to the maximum extent
practicable means the level of compliance that a reasonable person would
deem technologically feasible so long as such feasibility is periodically
evaluated in light of scientific advances.
(34)The
term use means to create, record, collect, access, obtain, store,
maintain, amend, correct, restore, modify, supplement, identify, re-identify,
employ, apply, utilize, examine, analyze, detect, remove, destroy, dispose of,
account for, or monitor the flow of protected health information.
(35)The
term writing means writing in either a paper-based or
computer-based form, including electronic and digital signatures.
<enum>I</enum><header>Individuals'
rights</header>
<subtitle id="idE06B80C63F62412E8441651E65235EBF"><enum>A</enum><header>Rights of the
subjects of protected health information</header>
<section id="ID44b9c7f637884b4c9ab371a366f3523e"><enum>101.</enum><header>Right to
privacy and security</header>
<subsection id="ID6b28e25fdc0947fb84b217f51aab82e6"><enum>(a)</enum><header>In
general</header><text>Individuals who are the subject of protected health
information have the right to—</text>
<paragraph id="ID669cd809b1974cf6a59c3d56f3ef7b56"><enum>(1)</enum><text>privacy and
security with respect to the use and disclosure of such information;</text>
</paragraph><paragraph id="IDe2c48cf0143e4f5d89895648cac7149a"><enum>(2)</enum><text>control and
withhold protected health information of which they are the subject; and</text>
</paragraph><paragraph id="ID6eadbe24aa7643a18a34ef18a7989755"><enum>(3)</enum><text>exercise
nondisclosure and nonuse rights (referred to in this Act as
<quote>opt-out</quote>) with respect to their protected health information,
including the right to opt out of any local, regional, or nationwide health
information network or system that is used by the person.</text>
</paragraph></subsection><subsection id="id7789EBA13FFC41A9AF482B0DF86C562E"><enum>(b)</enum><header>Obligations</header><text>A
person that discloses, uses, or receives an individual’s protected health
information shall expressly recognize the right to privacy and security of such
individual with respect to the use and disclosure of such information.</text>
</subsection></section><section id="ID01a7a29c36414e4c961438e6479c6b69"><enum>102.</enum><header>Inspection and
copying of protected health information</header>
<subsection id="ID04b5601ce95043a5984019f59bcb20b8"><enum>(a)</enum><header>Right of
individual</header>
<paragraph id="IDaa7e9423ba9041e591c85c779aa9aad9"><enum>(1)</enum><header>In
general</header><text>A person, including a health care provider, health
researcher, health plan, health or life insurer, medical or health savings plan
administrator, school or university, health care clearinghouse, health
oversight agency, public health authority, employer, or data broker, or such
person’s agent, officer, employee, or affiliate, that accesses, maintains,
retains, modifies, records, stores, or otherwise holds, uses, or discloses
protected health information, shall permit an individual who is the subject of
such protected health information, or the individual's designee, to inspect and
copy the protected health information concerning the individual, including
records created under sections 102, 112, 202, 203, and 211.</text>
</paragraph><paragraph id="ID8e42f8f3e6a7426fb4d25311f540683d"><enum>(2)</enum><header>Procedures and
fees</header><text>A person described in paragraph (1) may establish
appropriate procedures to be followed for inspection and copying under such
paragraph and may require an individual to pay reasonable fees associated with
such inspection and copying in an amount that is not in excess of the actual
costs of providing such copying. Such fees may not be assessed where such an
assessment would have the effect of inhibiting an individual from gaining
access to the information described in paragraph (1).</text>
</paragraph></subsection><subsection id="ID1ea42760942e40baa234cdc198d829e9"><enum>(b)</enum><header>Deadline</header><text>A
person described in subsection (a)(1) shall comply with a request for
inspection or copying of protected health information under this section not
later than—</text>
<paragraph id="IDadd8ceef433d499db1b88d9e9afc70bf"><enum>(1)</enum><text>15 business days
after the date on which the person receives the request, if such request
requires the inspection, copying, or sending of printed materials; or</text>
</paragraph><paragraph id="ID74583cd3bea042ffacad63247aaef4df"><enum>(2)</enum><text>5 business days
after the date on which the person receives the request, or sooner if the
Secretary determines appropriate, if such request requires only the inspection,
copying, or sending of electronic or other digital materials.</text>
</paragraph></subsection><subsection id="IDb49409d61d9b48d0b40a0bce04203482"><enum>(c)</enum><header>Rules governing
agents</header><text>A person that is the agent, officer, or employee of a
person described in subsection (a) shall provide for the inspection and copying
of protected health information if—</text>
<paragraph id="IDc38b5d4388fb4767a907d7873fc300bc"><enum>(1)</enum><text>the protected
health information is retained by the person; and</text>
</paragraph><paragraph id="ID33ad1079a2a5492180ba3b565a7b0455"><enum>(2)</enum><text>the person has
been asked by the person described in subsection (a)(1) to fulfill the
requirements of this section.</text>
</paragraph></subsection><subsection id="ID1a260d1c7ad0440aa540c4de830b359a"><enum>(d)</enum><header>Special rule
relating to ongoing clinical trials</header><text>With respect to protected
health information that is created as part of an individual's participation in
an ongoing clinical trial, access to the information shall be provided
consistent with the individual's agreement to participate in the clinical
trial.</text>
</subsection></section><section id="IDfaa3480f48a74fec9690a63e93877fb0"><enum>103.</enum><header>Modifications
to protected health information</header>
<subsection id="ID67014b8b9c9e42b4a3df5e0bfbf176b7"><enum>(a)</enum><header>In
general</header><text>Not later than 15 business days, or earlier if the
Secretary determines appropriate, after the date on which a person described in
section 102(a)(1) receives from an individual a request in writing to
supplement, correct, amend, segregate, or remove protected health information
concerning the individual, such person—</text>
<paragraph id="ID289d2d00e84647d081b27d62eb91994a"><enum>(1)</enum><text>shall, subject to
subsections (b) and (c), modify the information, by adding the requested
supplement, correction, or amendment to the information, or by removing any
information that has been requested to be destroyed;</text>
</paragraph><paragraph id="IDfac13a20601b421db608dad1be09a510"><enum>(2)</enum><text>shall inform the
individual that the modification has been made; and</text>
</paragraph><paragraph id="ID8d71d1a43656408e8ffdd27d5179e7cb"><enum>(3)</enum><text>shall make
reasonable efforts to inform any person to which the portion of the unmodified
information was previously disclosed, of any substantive modification that has
been made.</text>
</paragraph></subsection><subsection id="IDdf391bd56d2846b0b7e23b22bd577981"><enum>(b)</enum><header>Refusal To
modify</header><text>If a person described in subsection (a) declines to make
the modification requested under such subsection within 15 business days after
receipt of such request, such person shall inform the individual in writing
of—</text>
<paragraph id="ID13dd2a1c1ec243cdbc8874241c5bd748"><enum>(1)</enum><text>the reasons for
declining to make the modification;</text>
</paragraph><paragraph id="ID686f9f6d08224667bee63bb113f08ea3"><enum>(2)</enum><text>any procedures
for further review of the declining of such modification; and</text>
</paragraph><paragraph id="IDd2c8f96b56ae4c2aa9adf2772720b34a"><enum>(3)</enum><text>the individual's
right to file with the person a concise statement setting forth the requested
modification and the individual's reasons for disagreeing with the declining
person and the individual's right to include a copy of this refusal in the
health record set concerning the individual.</text>
</paragraph></subsection><subsection id="ID219dcbe56193462d90e5d3e1716dfe27"><enum>(c)</enum><header>Statement of
disagreement</header><text>If an individual has filed with a person a statement
of disagreement under subsection (b)(3), the person, in any subsequent
disclosure of the disputed portion of the information—</text>
<paragraph id="ID3829862b1a174ce9b4a9a09837d896ee"><enum>(1)</enum><text>shall include, at
the individual's request, a copy of the individual's statement in the
individual's health record set; and</text>
</paragraph><paragraph id="IDa33f732d2c2a42dead68ad82239ac30e"><enum>(2)</enum><text>may include a
concise statement of the reasons for not making the requested
modification.</text>
</paragraph></subsection><subsection id="ID181bc854e86f487095a4665191c40f2e"><enum>(d)</enum><header>Rules governing
agents</header><text>A person that is the agent of a person described in
subsection (a) shall only be required to make a modification to protected
health information where—</text>
<paragraph id="ID95b2a37163014bc5bf9c7fa658c7d436"><enum>(1)</enum><text>the protected
health information is retained, distributed, used, or maintained by the agent;
and</text>
</paragraph><paragraph id="ID4fe6c1bcd877414eaba0ad3d7824c39c"><enum>(2)</enum><text>the agent has
been asked by such person to fulfill the requirements of this section.</text>
</paragraph></subsection><subsection id="ID664520cca96d4d92a6f95903294ba5bd"><enum>(e)</enum><header>Notification of
loss or corruption</header><text>Not later than 15 business days, or earlier if
the Secretary determines appropriate, after the date on which a person
described in subsection (a) discovers loss or corruption of health record sets
or protected health information under its management, or if such person has
reason to believe that its database has been compromised, such person
shall—</text>
<paragraph id="ID40406343922346129fcc1b8d912e1939"><enum>(1)</enum><text>notify
individuals whose records have been affected;</text>
</paragraph><paragraph id="IDb88f6bf1bb8147ffa16c9736086b1c54"><enum>(2)</enum><text>notify persons
and the agents of persons that receive, access, maintain, retain, modify,
record, store, destroy, or otherwise use or disclose such data; and</text>
</paragraph><paragraph id="ID2eff8a0a36944e388d9fc47fe438b59f"><enum>(3)</enum><text>repair or restore
corrupted data to the extent practicable.</text>
</paragraph></subsection></section><section id="ID8d423d98316b4e2e8ab3c23126ea1618"><enum>104.</enum><header>Notice of
privacy practices</header>
<subsection id="IDad4a83a211df4db2abb754132b3e1917"><enum>(a)</enum><header>Preparation of
written notice</header><text>A person described in section 102(a)(1) shall
prepare a written notice of the privacy practices of such person, including
information with respect to the following:</text>
<paragraph id="ID96a4841063564683b6a19f5a012760d2"><enum>(1)</enum><text>The express right
of an individual to privacy, security, and confidentiality with respect to the
electronic disclosure of such individual’s protected health information;</text>
</paragraph><paragraph id="IDbcc1a256188c460c956792699615ff7d"><enum>(2)</enum><text>The procedures
for an individual to authorize disclosures of protected health information, and
to object to, modify, and revoke such authorizations.</text>
</paragraph><paragraph id="ID7d88b5a02c0547e293390d4f50cde247"><enum>(3)</enum><text>The right of an
individual to inspect, copy, and modify that individual’s protected health
information.</text>
</paragraph><paragraph id="ID5e15011dc7184d488739467495d23752"><enum>(4)</enum><text>The right of an
individual not to have employment or the receipt of services or choice of
health plan conditioned upon the execution by the individual of an
authorization for disclosure.</text>
</paragraph><paragraph id="IDd629410e5b7c4eacb8ff5825cd332105"><enum>(5)</enum><text>A description of
the categories or types of employees, by general category or by general job
description, who have access to or use of protected health information
regarding the individual.</text>
</paragraph><paragraph id="IDefe9cc71b4044acca514b7ff99825a47"><enum>(6)</enum><text>A simple, concise
description of any information systems used to store or transmit protected
health information, including a description of any linkages made with other
networks, systems, or databases outside the person’s direct control.</text>
</paragraph><paragraph id="IDd97b0faa7955409aa2fb192d908c3253"><enum>(7)</enum><text>The right of and
procedures for an individual to request segregation of protected health
information, and to restrict the use of such information by employees, agents,
and contractors of a person.</text>
</paragraph><paragraph id="ID4acd6d162cc440f0a520eaa1e9079fa4"><enum>(8)</enum><text>The circumstances
under which the information will be, lawfully and actually, used or disclosed
without an authorization executed by the individual.</text>
</paragraph><paragraph id="ID9ea36b1caf58421985bd8a56946f387e"><enum>(9)</enum><text>A statement that,
if an individual elects to pay for health care from the individual's own funds,
that individual may elect for identifying information not to be disclosed to
anyone other than designated health care providers, unless such disclosure is
required by mandatory reporting requirements or other similar information
collection duties required by law.</text>
</paragraph><paragraph id="ID6371bba92f8e4987ae740b2d6ba07555"><enum>(10)</enum><text>The right of the
individual to have continued maintenance, distribution, or storage of that
individual’s personal health information not conditioned upon whether that
individual amends or revokes an authorization for disclosure, or requests a
modification of protected health information.</text>
</paragraph><paragraph id="IDc91cee3089a7460c8383a12c86a7e426"><enum>(11)</enum><text>The right of and
procedures for an individual to request that protected health information be
transferred to a third party person without unreasonable delay.</text>
</paragraph><paragraph id="ID0a64865495ab4739bd4cdeb2a455c24d"><enum>(12)</enum><text>The right to
prompt notification of an actual or suspected security breach of protected
health information, and how such breaches will be remedied by the
person.</text>
</paragraph><paragraph id="ID894f1e9d856e401497c54184afb3508e"><enum>(13)</enum><text>The right of an
individual to inspect and obtain a copy of records of authorized and
unauthorized disclosures as well as attempted and actual access and use by an
authorized or unauthorized person.</text>
</paragraph><paragraph id="ID960e8ead2da54ef48d839780c530a042"><enum>(14)</enum><text>The right of an
individual to exercise nondisclosure and nonuse rights (referred to in this Act
as <quote>opt-out</quote>) with respect to their protected health information,
including the right to opt out of any local, regional, or nationwide health
information network or system that is used by the person.</text>
</paragraph></subsection><subsection id="IDdd5d213189d04a339deb2ae2d72a4a44"><enum>(b)</enum><header>Provision and
posting of written notice</header>
<paragraph id="ID313e93aa9fdc49a88b02791a3a53baba"><enum>(1)</enum><header>Provision</header><text>A
person described in subsection (a) shall provide a copy of the written notice
of privacy practices required under such subsection—</text>
<subparagraph id="ID37507c44092a41b6acd213fead8e34e2"><enum>(A)</enum><text>at the time an
authorization is sought for the disclosure of protected health information;
and</text>
</subparagraph><subparagraph id="IDe2f53a9829fc422baa7979ace5e3a5cc"><enum>(B)</enum><text>upon the request
of an individual.</text>
</subparagraph></paragraph><paragraph id="ID301536b97ca0433cbbe2a2cafa413b39"><enum>(2)</enum><header>Posting</header><text>A
person described in subsection (a) shall post, in a clear and conspicuous
manner, a brief summary of the privacy practices of the person.</text>
</paragraph></subsection><subsection id="ID3dba7487759d4c438ffc4bdd900c760f"><enum>(c)</enum><header>Model
notice</header><text>The Secretary, in consultation with the Director of the
Office of Health Information Privacy appointed under section 301, after notice
and opportunity for public comment, shall develop and disseminate model notices
of privacy practices, and model summary notices for posting for use under this
section. Use of such model notice shall be deemed to satisfy the requirements
of this section.</text>
</subsection><subsection id="IDdfb6b1395e594722abd92aab30f2c5dd"><enum>(d)</enum><header>Requirement for
opt-out</header><text>A person shall not access, maintain, retain, modify,
record, store, destroy, or otherwise use or disclose an individual's protected
health information for other than treatment or payment purposes until that
individual has been given an opportunity, before the time that such information
is initially used or disclosed, to direct that such information not be used or
disclosed. The individual must be given adequate time to exercise the
nondisclosure and nonuse option (referred to as the <quote>opt-out</quote>)
through the method that is most convenient to the individual, along with an
explanation of how the individual can exercise such option.</text>
</subsection></section><section id="ID997aa7561adb4ebaaca5db4c7aa73266"><enum>105.</enum><header>Demonstration
grant</header>
<subsection id="ID3c2207493d0c4a1a89005ea52d05a654"><enum>(a)</enum><header>In
general</header><text>The Secretary shall award contracts or competitive grants
to eligible entities to support demonstration projects that are designed to
improve the communication of information pertaining to health privacy rights
with individuals with limited English language proficiency and limited health
literacy.</text>
</subsection><subsection id="ID84837799ad094aecb300221ef9ae228b"><enum>(b)</enum><header>Purpose</header><text>It
is the purpose of this section, to promote the cultural competency of persons
that access, maintain, retain, modify, record, store, destroy, or otherwise use
or disclose protected health information, and to enable such persons to better
communicate privacy procedures to non-English speakers, those with limited
English proficiency, and those with limited health literacy.</text>
</subsection><subsection id="IDe4ac7d28b92b473dae0f2b44c8c6b810"><enum>(c)</enum><header>Eligible
entities</header><text>In this section, the term <term>eligible entity</term>
means an organization or community-based consortium that includes—</text>
<paragraph id="IDdb025053fcd3434895722781470c8317"><enum>(1)</enum><text>individuals who
are representatives of organizations serving or advocating for ethnic and
racial minorities, low income immigrant populations, and others with limited
English language proficiency and limited health literacy;</text>
</paragraph><paragraph id="ID4ad690dde36c43afa9199cecbc57861f"><enum>(2)</enum><text>health care
providers that provide care for ethnic and racial minorities, low income
immigrant populations, and others with limited English language proficiency and
limited health literacy;</text>
</paragraph><paragraph id="ID1fbc6147df304a5ab090c41af778742e"><enum>(3)</enum><text>community leaders
and leaders of community-based organizations; and</text>
</paragraph><paragraph id="IDe23936924b2142968ca0097b6aea7ce3"><enum>(4)</enum><text>experts and
researchers in the areas of social and behavioral sciences, who have knowledge,
training, or practical experience in health policy, advocacy, cultural and
linguistic competency, or other relevant areas as determined by the
Secretary.</text>
</paragraph></subsection><subsection id="ID269ccf865d0848838ef10558e83bbff2"><enum>(d)</enum><header>Application</header><text>An
eligible entity seeking a contract or grant under this section shall submit an
application to the Secretary at such time, in such manner, and containing such
information as the Secretary may require.</text>
</subsection><subsection id="IDf8d6c5a34fa64bfba0bd22bbc0656437"><enum>(e)</enum><header>Use of
funds</header><text>An eligible entity shall use amounts received under this
section to carry out programs and studies designed to help identify best
practices in the communication of privacy rights and procedures to ensure
comprehension by individuals with limited English proficiency and limited
health literacy.</text>
</subsection></section></subtitle><subtitle id="idEA34ECA6A1C64BE5B8D7AC20EA6F7972"><enum>B</enum><header>Establishment of
safeguards</header>
<section id="ID400e889f5d3a4e7b94ef8108d26676b4"><enum>111.</enum><header>Establishment
of safeguards</header>
<subsection id="IDda07b1fe9a154b4aac3bbd01efe46254"><enum>(a)</enum><header>In
general</header><text>A person described in section 102(a)(1) shall establish
and maintain appropriate administrative, organizational, technical, and
physical safeguards and procedures to ensure the privacy, confidentiality,
security, accuracy, and integrity of protected health information that is
accessed, maintained, retained, modified, recorded, stored, destroyed, or
otherwise used or disclosed by such person.</text>
</subsection><subsection id="ID763ff3d3257842cbb97fb38a65d423b7"><enum>(b)</enum><header>Factors To be
considered</header><text>The policies and safeguards established under
subsection (a) shall ensure that—</text>
<paragraph id="ID5bf19f847078475cbde529964163aef3"><enum>(1)</enum><text>protected health
information is used or disclosed only with informed consent;</text>
</paragraph><paragraph id="IDad881191c4bf4ac48b7a176a23f8a29b"><enum>(2)</enum><text>the categories of
personnel who will have access to protected health information are
identified;</text>
</paragraph><paragraph id="ID47414adb4aae4d559828114f4e09d5c2"><enum>(3)</enum><text>the feasibility
of limiting access to protected health information is considered;</text>
</paragraph><paragraph id="ID46bcfefd7a964f36ac3ffaf1bc792d91"><enum>(4)</enum><text>the privacy,
security and confidentiality of protected health information is
maintained;</text>
</paragraph><paragraph id="ID44abfe9b7ce34943855134e25accefd4"><enum>(5)</enum><text>protected health
information is protected against any anticipated vulnerabilities to the
privacy, security, or integrity of such information; and</text>
</paragraph><paragraph id="IDc6b0deb1b6f944d2a5bf5409d030d3fa"><enum>(6)</enum><text>protected health
information is protected against unauthorized access, use, or misuse of such
information.</text>
</paragraph></subsection><subsection id="ID59e8268d1dfc4809b3057a2180261ea5"><enum>(c)</enum><header>Model
guidelines</header><text>The Secretary, in consultation with the Director of
the Office of Health Information Privacy appointed under section 301, after
notice and opportunity for public comment, shall develop and disseminate model
guidelines for the establishment of safeguards and procedures for use under
this section, such as, where appropriate, individual authentication of uses of
computer systems, access controls, audit trails, encryption, physical security,
protection of remote access points and protection of external electronic
communications, periodic security assessments, incident reports, and sanctions.
The Director shall update and disseminate the guidelines, as appropriate, to
take advantage of new technologies.</text>
</subsection><subsection id="IDa4ef785838214688a908a459652dae5a"><enum>(d)</enum><header>Review and
updating of safeguards</header><text>Persons subject to this Act shall monitor,
evaluate, and adjust, as appropriate, all safeguards and procedures,
concomitant with relevant changes in technology, the sensitivity of personally
identifiable information, internal or external threats to personally
identifiable information, and any changes in the contracts or business of the
person. For the purpose of reviewing and updating safeguards, the Secretary may
provide technical assistance to persons described in subsection (a), as
appropriate.</text>
</subsection></section><section id="ID8b63bbb264ba4a97b33041eaf27b083d"><enum>112.</enum><header>Transparency</header>
<subsection id="ID315a5b4ddf504bcd921a543aa7f3da4d"><enum>(a)</enum><header>Public list of
data brokers</header><text>A person described in section 102(a)(1) shall
establish a list of data brokers with which such person has entered into a
contract or relationship for the purposes of providing services involving any
protected health information. Such list and the contact information for each
broker shall be made publicly accessible on the Internet.</text>
</subsection><subsection id="ID9708d2264e8a4ba9ba529bf401c1df90"><enum>(b)</enum><header>Subcontracting
and outsourcing overseas</header><text>In the event a person subject to this
Act contracts with service providers not subject to this Act, including service
providers operating in a foreign country, such person shall—</text>
<paragraph id="IDcaa9be67c14049109ee03629a3b80178"><enum>(1)</enum><text>take reasonable
steps to select and retain third party service providers capable of maintaining
appropriate safeguards for the security, privacy, and integrity of protected
health information;</text>
</paragraph><paragraph id="IDb2cefd7078da4d3ab0b9f0901d91868c"><enum>(2)</enum><text>require by
contract that such service providers implement and maintain appropriate
measures designed to meet the requirements of persons subject to this
Act;</text>
</paragraph><paragraph id="IDf4dd365df6744974801a8de2d4bb363c"><enum>(3)</enum><text>be held liable
for any violation of this Act by an overseas service provider or other provider
not subject to this law; and</text>
</paragraph><paragraph id="id5CD04E71E3564F10A3F2ADA6FCAFAFB3"><enum>(4)</enum><text>in the case of a
service provider operating in a foreign country, obtain the informed consent of
the individual involved prior to outsourcing such individual's protected health
information to such provider.</text>
</paragraph></subsection><subsection id="ID0a02a2cf989942f28c6b2dd97f13d52d"><enum>(c)</enum><header>List of
persons</header><text>The Secretary shall maintain a public list identifying
persons described in section 102(a)(1) that have lost, stolen, disclosed or
used in an unauthorized manner or for an unauthorized purpose the protected
health information of a significant number of individuals. The list shall
include how many individuals were affected by such action.</text>
</subsection></section><section id="ID779d34ca12304ab8abd2289de3ae2b25"><enum>113.</enum><header>Risk
management</header>
<subsection id="IDf8cd3438ae9b412d8d8cc5fc2e798566"><enum>(a)</enum><header>In
general</header><text>Persons described in section 102(a)(1) that have access
to protected health information shall establish risk management and control
processes to protect against anticipated vulnerabilities to the privacy,
security, and integrity of protected health information.</text>
</subsection><subsection id="ID2d15bfb4c0e24f0cb4f9fab07b314a86"><enum>(b)</enum><header>Risk
assessment</header><text>A person described in subsection (a) shall perform
annual risk assessments of procedures, systems, or networks involved in the
creation, accessing, maintenance, retention, modification, recording, storage,
distribution, destruction, or other use or disclosure of personal health
information. Such risk assessment may include—</text>
<paragraph id="IDe9b8b70e23ee4dfd9dda630d685d3ff6"><enum>(1)</enum><text>identifying
reasonably foreseeable internal and external vulnerabilities that could result
in inaccuracy or in unauthorized access, disclosure, use, or modification of
protected health information, or of systems containing protected health
information;</text>
</paragraph><paragraph id="ID5071ffc4e297498089cf76fef844f957"><enum>(2)</enum><text>assessing the
likelihood of and potential damage from inaccuracy or from unauthorized access,
disclosure, use, or modification of protected health information;</text>
</paragraph><paragraph id="ID76e4b377ff7d42a1b348a61302a96e85"><enum>(3)</enum><text>assessing the
sufficiency of policies, technologies, and safeguards in place to minimize and
control risks from unauthorized access, disclosure, use, or modification of
protected health information; and</text>
</paragraph><paragraph id="IDf120a08f7acc401e8cbd84388cea685b"><enum>(4)</enum><text>assessing the
vulnerability of protected health information during destruction and disposal
of such information, including through the disposal or retirement of
hardware.</text>
</paragraph></subsection><subsection id="ID36cc90cfcee946eb85420acfd1427f79"><enum>(c)</enum><header>Risk
management</header><text>A person described in subsection (a) shall establish
risk management and control procedures designed to control risks such as those
identified in subsection (b). Such procedures shall include—</text>
<paragraph id="IDfabd5952e45646d38111db5f494b4a80"><enum>(1)</enum><text>a means for the
detection and recording of actual or attempted, unauthorized, fraudulent, or
otherwise unlawful access, disclosure, transmission, modification, use, or loss
of personal health information;</text>
</paragraph><paragraph id="ID010083f51c0a4431b3b2efcd2c3dcbde"><enum>(2)</enum><text>procedures for
ensuring the secure disposal of personal health information;</text>
</paragraph><paragraph id="IDcf7309557cd044468013f1328bc16e07"><enum>(3)</enum><text>a means for
limiting physical access to hardware, software, data storage technology,
servers, systems, or networks by unauthorized persons in order to minimize the
risk of information disclosure, modification, transmission, access, use, or
loss;</text>
</paragraph><paragraph id="ID3f945ad31f9e42798ba69bf239b437bd"><enum>(4)</enum><text>providing
appropriate risk management and control training for employees; and</text>
</paragraph><paragraph id="IDc772df64b0b94b778e68df61cb01b3c2"><enum>(5)</enum><text>carrying out
annual testing of such risk management and control procedures.</text>
</paragraph></subsection></section><section id="ID2303b5c6050d45439900ede8645da1b5"><enum>114.</enum><header>Accounting for
disclosures and use</header>
<subsection id="ID04d019f471dc4eff901982715e049741"><enum>(a)</enum><header>In
general</header><text>A person described in section 102(a)(1) shall establish
and maintain, with respect to any protected health information disclosure, a
record of each disclosure in accordance with regulations promulgated by the
Secretary in consultation with the Director of the Office of Health Information
Privacy. Such record shall include the purpose of any disclosure and the
identity of the specific individual executing the disclosure, as well as the
person to which such information is disclosed.</text>
</subsection><subsection id="IDf1b804beac0c464aa4774839ea54adc2"><enum>(b)</enum><header>Maintenance of
record</header><text>A record established under subsection (a) shall be
maintained for not less than 7 years.</text>
</subsection><subsection id="IDac94a9f0eeca46789ac75718f70e2e97"><enum>(c)</enum><header>Electronic
records</header><text>A person described in subsection (a) shall, to the
maximum extent practicable, maintain an accessible electronic record concerning
each access, use, or disclosure, whether authorized or unauthorized and whether
successful or unsuccessful, of protected health information maintained by such
person in electronic form. The record shall include the identities of the
specific individuals (or a way to identify such individuals, or information
helpful in determining the identities of such individuals) who access or seek
to gain access to, use or seek to use, or disclose or seek to disclose,
information sufficient to identify the protected health information sought or
accessed, and other appropriate information.</text>
</subsection><subsection id="IDb079fd4ff16d4b10b572f177bcf4fe1b"><enum>(d)</enum><header>Access to
records</header><text>A person described in subsection (a) shall permit an
individual who is the subject of protected health information, or the
individual’s designee, to inspect and copy the records created in paragraphs
(a) and (c) of this section.</text>
</subsection></section></subtitle><enum>II</enum><header>Restrictions on
use and disclosure</header>
<subtitle id="id4DA4EA89EE1C4780BF3E69B2CB66F4C1"><enum>A</enum><header>General
restrictions on use and disclosure</header>
<section id="IDb992d14f3fb64f64bc25c8f96358f810"><enum>201.</enum><header>General rules
regarding use and disclosure</header>
<subsection id="IDf36d2df2c47440c494399bc658983944"><enum>(a)</enum><header>Prohibition</header>
<paragraph id="ID0d70650a757347ec875ec1412e9ee749"><enum>(1)</enum><header>General
rule</header><text>A person may not disclose, access, or use protected health
information except as authorized under this Act.</text>
</paragraph><paragraph id="ID75a6c6d3e9844fda9f4932d91888958f"><enum>(2)</enum><header>Rule of
construction</header><text>Disclosure or use of health information that meets
the standards of being de-identified health information shall not be construed
as a disclosure or use of protected health information.</text>
</paragraph></subsection><subsection id="ID6003d996a38841be84b3d16326c9d1f0"><enum>(b)</enum><header>Scope of
disclosure or use</header>
<paragraph id="ID927c99574d0746c3a9df54b39319cdac"><enum>(1)</enum><header>In
general</header><text>A disclosure or use of protected health information under
this title shall be limited to the minimum amount of information necessary to
accomplish the purpose for which the disclosure or use is made.</text>
</paragraph><paragraph id="IDcc451d79d17249e6a445cc1c38614c6b"><enum>(2)</enum><header>Determination</header><text>The
determination as to what constitutes the minimum disclosure or use possible for
purposes of paragraph (1) shall be made by a health care provider to the extent
required by law. The minimum necessary standard is intended to be consistent
with, and not override, professional judgment and standards.</text>
</paragraph></subsection><subsection id="ID7d63f046c011418096f56fdbcc74a4db"><enum>(c)</enum><header>Use or
disclosure for purpose only</header><text>An authorized recipient of
information pursuant to this title may use or disclose such information solely
to carry out the purpose for which the information was disclosed, except as
provided in section 214.</text>
</subsection><subsection id="ID3b038aaa132549899efadef6d54e18df"><enum>(d)</enum><header>No general
requirement To disclose</header><text>Nothing in this title permitting the
disclosure of protected health information shall be construed to require such
disclosure.</text>
</subsection><subsection id="ID234d1d3e17404b2ca7822200f18e34e2"><enum>(e)</enum><header>Identification
of disclosed information as protected health
information</header><text>Protected health information disclosed or used
pursuant to this title shall be clearly identified and labeled as protected
health information that is subject to this Act.</text>
</subsection><subsection id="IDd5d1461f642e47caaf27e8d1b3bdc738"><enum>(f)</enum><header>Disclosure or
use by agents</header><text>An agent, employee, or affiliate of a person
described in section 102(a)(1) that accesses, seeks to access, obtains,
discloses, uses, or receives protected health information from such person,
shall be subject to this title to the same extent as the person.</text>
</subsection><subsection id="IDb1adb161111e4fcbbc3dee4748d3cddd"><enum>(g)</enum><header>Disclosure or
use by others</header><text>A person receiving protected health information
initially held by a person described in subsection (f) shall be subject to this
title to the same extent as the person described in subsection (f).</text>
</subsection><subsection id="ID21953dd293eb4bd69fb004a4f83ba425"><enum>(h)</enum><header>Creation of
de-identified information</header><text>Notwithstanding subsection (c), but
subject to the other provisions of this section, a person described in
subsection (f) may disclose protected health information to an employee or
other agent of the person for purposes of creating de-identified
information.</text>
</subsection><subsection id="ID1d0511800e5844ca8eac179117f957ac"><enum>(i)</enum><header>Unauthorized
use or disclosure of the decryption key</header><text>The unauthorized
disclosure of a decryption key or other secondary or tertiary means for
accessing protected health information shall be deemed to be a disclosure of
protected health information. The unauthorized use of a decryption key (or
other secondary or tertiary means for accessing protected health information)
or de-identified health information in order to identify an individual is
deemed to be disclosure of protected health information.</text>
</subsection><subsection id="ID8c6b0b1033014d4295f5a1f270de3bc3"><enum>(j)</enum><header>No
waiver</header><text>Except as provided in this Act, an authorization to
disclose or use personally identifiable health information executed by an
individual pursuant to section 202 or 203 shall not be construed as a waiver of
any rights that the individual has under other Federal or State laws, the rules
of evidence, or common law.</text>
</subsection><subsection id="ID149472136d894e03a44c6d3238d7c922"><enum>(k)</enum><header>Opt-out</header><text>A
person may not disclose, access, or use an individual’s protected health
information until that individual has been given the opportunity to opt out of
any local, regional, or nationwide health information network or system that is
used by the person.</text>
</subsection><subsection id="ID85fd168976fb43349ed9ce442eb6774a"><enum>(l)</enum><header>Disposal of
data</header><text>To prevent the unauthorized disclosure or use of protected
health information, such information, when disposed of, shall be fully
de-identified, destroyed, and expunged from any electronic, paper, or other
files and documents maintained by authorized persons.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID35d027f49b0141cfac6cc63609fbb8b8"><enum>(m)</enum><header>Obligations of
unauthorized recipients</header><text>A person that obtains, accesses, or
receives protected health information and that is an unauthorized recipient of
such information may not access, maintain, retain, modify, record, store,
destroy, or otherwise use or disclose such information for any purposes, and
use or disclosure of protected health information under such circumstances
shall be deemed an unauthorized disclosure of protected health
information.</text>
</subsection><subsection id="ID90b4063486c840c2bb583ab79fb6758d"><enum>(n)</enum><header>Definitions</header><text>In
this title:</text>
<paragraph id="ID443fb238731846149444c8e3866fa342"><enum>(1)</enum><header>Investigative
or law enforcement officer</header><text>The term <term>investigative or law
enforcement officer</term> means any officer of the United States or of a State
or political subdivision thereof, who is empowered by law to conduct
investigations of, or to make arrests for, civil or criminal offenses, and any
attorney authorized by law to prosecute or participate in the prosecution of
such offenses.</text>
</paragraph><paragraph id="IDba0e55ac57c747fc833ffd9e68589bc2"><enum>(2)</enum><header>Segregate</header><text>The
term <term>segregate</term> means to hide, mask, or mark separate a designated
subset of an individual’s protected health information, or to place such a
subset in a location that is securely separated from the location used to store
other protected health information, such that access to or use of any
information so segregated may be effectively limited to those persons that are
authorized by the individual to access or use that segregated
information.</text>
</paragraph><paragraph id="ID95f82d95d1b84af6b9f162bffafd12e1"><enum>(3)</enum><header>Signed</header><text>The
term <term>signed</term> refers to both signatures in ink and electronic
signatures, and the term <term>written</term> refers to both paper and
computerized formats.</text>
</paragraph></subsection></section><section id="ID7384ff05485a4d4a94e5873a0708d9aa"><enum>202.</enum><header>Informed
consent for disclosure of protected health information for treatment and
payment</header>
<subsection id="IDd67df17263a24f8682e868a144cba500"><enum>(a)</enum><header>Requirements
relating to employers, health plans, health or life insurers, uninsured and
self-pay individuals, and providers</header>
<paragraph id="ID019d6bc78cde49578b4dec33159bab7e"><enum>(1)</enum><header>In
general</header><text>To satisfy the requirement under section 201(b)(1), an
employer, health plan, health or life insurer, or health care provider that
seeks to disclose protected health information in connection with treatment or
payment shall obtain an authorization from the subject of such protected health
information that satisfies the requirements of this section. A single
authorization may authorize multiple disclosures.</text>
</paragraph><paragraph id="IDd7fa801fcf0040cbb7ecbe7f91ffb9fc"><enum>(2)</enum><header>Employers</header><text>Every
employer offering a health plan to its employees shall, at the time of an
employee's enrollment in the health plan, obtain a signed, written
authorization that is an authorization based on informed consent that satisfies
the requirements of subsection (b) concerning the use and disclosure of
protected health information for treatment or payment with respect to each
individual who is eligible to receive care under the health plan.</text>
</paragraph><paragraph id="ID51589026651e4dd699453d0dce74b503"><enum>(3)</enum><header>Health plans,
health or life insurers</header><text>Every health plan or health or life
insurer offering enrollment to individual or nonemployer groups shall, at the
time of enrollment in the plan or insurance, obtain a signed, written
authorization that is a legal, informed authorization that satisfies the
requirements of subsection (b) concerning the use and disclosure of protected
health information with respect to each individual who is eligible to receive
care or benefits under the plan or insurance.</text>
</paragraph><paragraph id="ID77cdc111cc6c4d0198328207560a5d64"><enum>(4)</enum><header>Uninsured and
self-pay</header><text>An originating provider that provides health care in
other than a network plan setting, or provides health care to an uninsured
individual, shall obtain a signed, written authorization that satisfies the
requirements of subsection (b) to access or use protected health information in
providing health care or arranging for health care from other providers or
seeking payment for the provision of health care services.</text>
</paragraph><paragraph id="IDb08a9f5d34d2424ea704b255facbe75c"><enum>(5)</enum><header>Providers</header>
<subparagraph id="IDd0b2b689b84c4ac8af09eb56b3191c76"><enum>(A)</enum><header>In
general</header><text>Every health care provider that provides health care to
an individual that has not been given the appropriate prior authorization under
this section, shall at the time of providing such care obtain a signed, written
authorization that is a legal, informed authorization, that satisfies the
requirements of subsection (b), concerning the use and disclosure of protected
health information with respect to such individual.</text>
</subparagraph><subparagraph id="ID0ed6e4de2eb44d248ac16c32f2aa541f"><enum>(B)</enum><header>Rule of
construction</header><text>Subparagraph (A) shall not be construed to preclude
the provision of health care to an individual who has not given appropriate
authorization prior to receipt of such care if—</text>
<clause id="ID824f5194c7834947a85b0fc87fea5e9b"><enum>(i)</enum><text>the
health care provider involved determines that such care is essential;
and</text>
</clause><clause id="IDd7f13b9c8c354a3ea177d2657955696a"><enum>(ii)</enum><text>the individual
can reasonably be expected to sign an authorization for such care when
appropriate.</text>
</clause></subparagraph></paragraph></subsection><subsection id="ID394f1b08cf934c108c1f18758122cc78"><enum>(b)</enum><header>Requirements
for individual informed consent</header><text>To satisfy the requirements of
this subsection, an authorization from an individual to disclose the
individual’s protected health information shall—</text>
<paragraph id="ID9e867525e04841f8afb22835c01e9c3e"><enum>(1)</enum><text>identify, by
general job description or other functional description and by geographic
location, those persons that are authorized to disclose the information,
including entities employed by, or operating within, a person authorized to
disclose the information;</text>
</paragraph><paragraph id="ID429dc891f77840fc982c50653ea51eb9"><enum>(2)</enum><text>describe the
nature of the information to be disclosed;</text>
</paragraph><paragraph id="ID822560dbef7640a49c9e180c296b1861"><enum>(3)</enum><text>identify, by
general job description or other functional description and by geographic
location, those persons to which the information will be disclosed, including
entities employed by, or operating within, a person to which information is
authorized to be disclosed;</text>
</paragraph><paragraph id="IDb1b7bd6eadd84e239d5c802169d2f042"><enum>(4)</enum><text>describe the
purpose of the disclosures;</text>
</paragraph><paragraph id="ID64e30853a13c48c9990af0bc3c2ce957"><enum>(5)</enum><text>permit the
executing individual to indicate that a particular person or class of persons
(a group of persons with similar roles or functions) listed on the
authorization is not authorized to receive protected health information
concerning the individual, except as provided for in subsection (c)(3);</text>
</paragraph><paragraph id="IDd20cf17604d54c6f93a7cd01e79c9704"><enum>(6)</enum><text>provide the means
by which an individual may indicate that some of the individual's protected
health information should be segregated and to what persons or classes of
persons such segregated information may be disclosed;</text>
</paragraph><paragraph id="IDe66025d5775248e185c943be97b750f0"><enum>(7)</enum><text>be subject to
revocation by the individual and indicate that the authorization is valid until
revocation by the individual or until an event or date specified;</text>
</paragraph><paragraph id="ID9a743286ccad42528459ca10264dad33"><enum>(8)</enum><subparagraph commented="no" display-inline="yes-display-inline" id="idD104544E63604DD5914D98E404B46D0C"><enum>(A)</enum><text>be—</text>
<clause id="ID19ceeabac8e643479306a65cef780938" indent="up1"><enum>(i)</enum><text>in writing, dated, and signed by
the individual; or</text>
</clause><clause id="IDfb9e84b0a7a44871be552f6be263c29c" indent="up1"><enum>(ii)</enum><text>in electronic form, dated and
authenticated by the individual using an authentication method approved by the
Secretary; and</text>
</clause></subparagraph><subparagraph id="ID154edaac5b64488a96b9f2f27ff55c20" indent="up1"><enum>(B)</enum><text>not have been revoked under
subparagraph (A);</text>
</subparagraph></paragraph><paragraph id="ID2f55117702884de0b7ca6a983e274b90"><enum>(9)</enum><text>describe the
procedure by which an individual can amend an authorization previously obtained
by a person;</text>
</paragraph><paragraph id="IDe555b34fc3dc4cbabd342aac5a23d4f6"><enum>(10)</enum><text>include a
concise description of any systems or services used for access, maintenance,
retention, modification, recording, storage, destruction, or other use of
protected health information by the authorized person, including—</text>
<subparagraph id="IDacb60b83df3d40c7bedd73df88c6f29d"><enum>(A)</enum><text>a description of
any linkages made with other systems, databases, networks, or services external
to the authorized person; and</text>
</subparagraph><subparagraph id="ID48dc7127efe646f9b9070aa6a7f50cae"><enum>(B)</enum><text>how the linkages
made with other systems, databases, networks, or services external to the
authorized person meet the privacy and security standards of the authorized
person;</text>
</subparagraph></paragraph><paragraph id="IDe4912b3ea7804d2ab23f5e52e762b2a7"><enum>(11)</enum><text>describe the
extent to which the authorized person will share information with
sub-contracted persons, and the geographic location of sub-contracted persons,
including those operating or located overseas, except that the authorized
person shall obtain the informed consent of the individual involved prior to
outsourcing such individual's protected health information to a sub-contracted
person operating or located overseas; and</text>
</paragraph><paragraph id="ID6575edb57b694f7680f6fc451b6909fb"><enum>(12)</enum><text>describe the
nature and probability of harm to the individual resulting from authorization
for use or disclosure, consistent with the principle of informed
consent.</text>
</paragraph></subsection><subsection id="ID2112d1bc6e79488fa3009171e130fe75"><enum>(c)</enum><header>Limitation on
authorizations</header>
<paragraph id="IDfa0af35ca0c44b12a69c39d7292c043d"><enum>(1)</enum><header>In
general</header><text>Subject to paragraphs (2) and (3), a person described in
section 102(a)(1) that seeks an authorization under this title may not
condition the delivery of treatment or payment for services on the receipt of
such an authorization.</text>
</paragraph><paragraph id="ID45b8ffee15df4b8bbda13401acd38a93"><enum>(2)</enum><header>Right to
require self-payment</header><text>If an individual has refused to provide an
authorization for disclosure of administrative billing information to a person
and such authorization is necessary for a health care provider to receive
payment for services delivered, the health care provider may require the
individual to pay from their own funds for the services.</text>
</paragraph><paragraph id="ID3bb4bc40e51140ae972817c197f9097d"><enum>(3)</enum><header>Right of health
care provider to require authorization for treatment purposes</header><text>If
a health care provider that is seeking an authorization for disclosure of an
individual's protected health information believes that the disclosure of such
information is necessary so as not to endanger the health or treatment of the
individual, and if the withholding of services will not endanger the life of
the individual, the health care provider may condition the provision of
services upon the individual’s execution of an authorization to disclose
personal health information to the minimum extent necessary.</text>
</paragraph><paragraph id="ID0b07f3bfde5c40da9e71f1d9198e102e"><enum>(4)</enum><header>Authorizations
for payment under certain circumstances</header><text>If an individual is in a
physical or mental condition such that the individual is not capable of
authorizing the disclosure of protected health information and no other
arrangements have been made to pay for the health care services being rendered
to the patient, such information may be disclosed to a governmental authority
to the extent necessary to determine the individual's eligibility for, and to
obtain, payment under a governmental program for health care services provided
to the patient. The information may also be disclosed to another provider of
health care or health care service plan as necessary to assist the other
provider or health care service plan in obtaining payment for health care
services rendered by that provider of health care or health care service plan
to the patient.</text>
</paragraph></subsection><subsection id="IDf958a97d2b5d485fab78bac306194758"><enum>(d)</enum><header>Model
authorizations</header><text>The Secretary, in consultation with the Director
of the Office of Health Information Privacy, after notice and opportunity for
public comment, shall develop and disseminate model written authorizations of
the type described in this section and model statements of the limitations on
authorizations. Any authorization obtained on a model authorization form under
section 202 developed by the Secretary pursuant to the preceding sentence shall
be deemed to satisfy the requirements of this section.</text>
</subsection><subsection id="ID4d016f94dd0c4bee9dff25f02d83a018"><enum>(e)</enum><header>Segregation of
files</header><text>A person described in section 102(a)(1) shall comply with
the request of an individual who is the subject of protected health
information—</text>
<paragraph id="ID474a3a266146412caa43dc24a934b57b"><enum>(1)</enum><text>to hide, mask, or
mark separate any type or amount of protected health information held by the
person; and</text>
</paragraph><paragraph id="ID95711167f19541c0bb7cff6a90ea9f61"><enum>(2)</enum><text>to limit the use
or disclosure of the segregated health information within the person to those
specifically designated by the subject of the protected health
information.</text>
</paragraph></subsection><subsection id="ID8803b9c416c04de991cf547966bce193"><enum>(f)</enum><header>Revocation of
authorization</header>
<paragraph id="ID3eb10f0697c8411a8d7d18f4228a11e1"><enum>(1)</enum><header>In
general</header><text>An individual may, electronically or in writing, revoke
or amend an authorization under this section at any time, unless the disclosure
that is the subject of the authorization is required to effectuate payment for
health care that has been provided to the individual and for which the
individual has declined or refused to pay from the individual’s own
funds.</text>
</paragraph><paragraph id="ID1451777a84ca45a59b2ebaad696c1494"><enum>(2)</enum><header>Health
plans</header><text>With respect to a health plan, the authorization of an
individual is deemed to be revoked at the time of the cancellation or
non-renewal of enrollment in the health plan, except as may be necessary to
complete plan administration and payment requirements related to the
individual's period of enrollment.</text>
</paragraph><paragraph id="ID394ede0e6afc4f7ebe802fe1e75a76e4"><enum>(3)</enum><header>Actions</header><text>An
individual may not maintain an action against a person for disclosure of
personally identifiable health information—</text>
<subparagraph id="ID5868bdd39056473b9cc5ba672105c53f"><enum>(A)</enum><text>if the disclosure
was made based on a good faith reliance on the individual's authorization under
this section at the time such disclosure was made;</text>
</subparagraph><subparagraph id="ID8fa3fe4809874a369a6863b10f54f5d8"><enum>(B)</enum><text>in a case in
which the authorization is revoked, if the disclosing person had no actual or
constructive notice of the revocation; or</text>
</subparagraph><subparagraph id="IDf37e704185124443b1da74f7ad4d908a"><enum>(C)</enum><text>if the disclosure
was for the purpose of protecting another individual from imminent physical
harm, and is authorized under section 204.</text>
</subparagraph></paragraph></subsection><subsection id="ID14600733503543c68993a62f5c0780d3"><enum>(g)</enum><header>Record of
individual's authorizations and revocations</header><text>Each person
accessing, maintaining, retaining, modifying, recording, storing, destroying,
or otherwise using personally identifiable or protected health information
shall maintain a record for a period of 7 years of each authorization by an
individual and any revocation thereof, and such record shall become part of the
individual’s health record set.</text>
</subsection><subsection id="IDa00044084f0e4664a0304e76ffff18d8"><enum>(h)</enum><header>Rule of
construction</header><text>Authorizations for the disclosure of protected
health information for treatment or payment shall not authorize the disclosure
of such information where the intent is to sell, market, transfer, or use the
protected health information for a commercial advantage other than for the
revenues directly derived from the provision of health care to that individual.
With respect to such a disclosure for a use other than for treatment or
payment, a separate authorization that satisfies the requirements of section
203 is required.</text>
</subsection></section><section id="ID321b3a4bb38e410382d9d28c60e2938d"><enum>203.</enum><header>Authorizations
for disclosure of protected health information other than for treatment or
payment</header>
<subsection id="ID9ab0c879e05645a2ad08f7fecda9e295"><enum>(a)</enum><header>In
general</header><text>To satisfy the requirement under section 201(b)(1), a
health care provider, health plan, health oversight agency, public health
authority, employer, health researcher, law enforcement official, health or
life insurer, school or university, or other person described under section
102(a)(1) that seeks to disclose protected health information for a purpose
other than treatment or payment shall obtain an authorization that satisfies
the requirements of subsections (b), (e), (f), and (g) of section 202. Such an
authorization under this section shall be separate from an authorization
provided under section 202.</text>
</subsection><subsection id="ID323016dc8fb84e7e951c73559874f80e"><enum>(b)</enum><header>Limitation on
authorizations</header>
<paragraph id="ID5ca95526549847ccad831978117de1fd"><enum>(1)</enum><header>In
general</header><text>A person subject to section 202 may not condition the
delivery of treatment, or payment for services, on the receipt of an
authorization described in this section.</text>
</paragraph><paragraph id="IDddd07136c36e48e89ef8393b14b1f7df"><enum>(2)</enum><header>Requirement for
separate authorization</header><text>A person subject to section 202 may not
disclose protected health information to any employees or agents who are
responsible for making employment, work assignment, or other personnel
decisions with respect to the subject of the information without a separate
authorization permitting such a disclosure.</text>
</paragraph></subsection><subsection id="IDb3f26970a36442aba86c99f694be83c2"><enum>(c)</enum><header>Model
authorizations</header><text>The Secretary, in consultation with the Director
of the Office of Health Information Privacy, after notice and opportunity for
public comment, shall develop and disseminate model written authorizations of
the type described in subsection (a). Any authorization obtained on a model
authorization form under this section shall be deemed to meet the authorization
requirements of this section.</text>
</subsection><subsection id="IDed62d972e8a74a53a7e5fd8f61bf8a86"><enum>(d)</enum><header>Requirement To
release protected health information to coroners and medical examiners</header>
<paragraph id="ID33271383989c4c2e99c574f2f5c223f3"><enum>(1)</enum><header>In
general</header><text>When a coroner or medical examiner or their duly
appointed deputies seek protected health information for the purpose of inquiry
into and determination of, the cause, manner, and circumstances of an
individual's death, the health care provider, health plan, health oversight
agency, public health authority, employer, health researcher, law enforcement
officer, health or life insurer, school or university, or other person involved
shall provide that individual's protected health information to the coroner or
medical examiner or to the duly appointed deputies without undue delay.</text>
</paragraph><paragraph id="IDd29decd75b7d4a088a618b2712308c55"><enum>(2)</enum><header>Production of
additional information</header><text>If a coroner or medical examiner or their
duly appointed deputies receives health information from a person referred to
in paragraph (1), such health information shall remain as protected health
information unless the health information is attached to or otherwise made a
part of a coroner's or medical examiner's official report, in which case it
shall no longer be protected.</text>
</paragraph><paragraph id="IDff6b3eb17f4c4c06b1efef8ac5698a25"><enum>(3)</enum><header>Exemption</header><text>Health
information attached to or otherwise made a part of a coroner's or medical
examiner's official report shall be exempt from the provisions of this Act
except as provided for in this subsection.</text>
</paragraph><paragraph id="IDbeb8fe6c5c1d4ac38589201751bfeb4c"><enum>(4)</enum><header>Reimbursement</header><text>A
person referred to paragraph (1) may request reimbursement from a coroner or
medical examiner for the reasonable costs associated with inspection or copying
of protected health information maintained, retained, or stored by such
person.</text>
</paragraph></subsection><subsection id="IDd29a2e1cf54b410eb47adbb09e9078a2"><enum>(e)</enum><header>Revocation or
amendment of authorization</header><text>An individual may, in writing, revoke
or amend an authorization under this section at any time.</text>
</subsection><subsection id="IDbf07c86a2833400e8a9087c050ba2371"><enum>(f)</enum><header>Actions</header><text>An
individual may not maintain an action against a person described in section
102(a)(1) for the disclosure of protected health information—</text>
<paragraph id="IDc7f6198a03544626b570d4819ab4949e"><enum>(1)</enum><text>if the disclosure
was made based on a good faith reliance on the individual's authorization under
this section at the time disclosure was made;</text>
</paragraph><paragraph id="IDa8784097a0c6446ab15192e3c730d658"><enum>(2)</enum><text>in a case in
which the authorization is revoked, if the disclosing person had no actual or
constructive notice of the revocation; or</text>
</paragraph><paragraph id="ID8baf3052cc714942956fd6c336aa3cfd"><enum>(3)</enum><text>if the disclosure
was for the purpose of protecting another individual from imminent physical
harm, and is authorized under section 204.</text>
</paragraph></subsection><subsection id="ID2b50b33ad5334569bcc7fca0cc6bb4ea"><enum>(g)</enum><header>Record of
authorizations and revocations</header><text>Each person accessing,
maintaining, retaining, modifying, recording, storing, destroying, or otherwise
using personally identifiable or protected health information for purposes
other than treatment or payment shall maintain a record for a period of 7 years
of each authorization by an individual and any revocation thereof, and such
record shall become part of the individual’s health record set.</text>
</subsection></section><section id="IDf1ad96ae3c4f4d9f859b2faffe324a73"><enum>204.</enum><header>Notification
in the case of breach</header>
<subsection id="IDd23eb686ded14d95911cafdb0bd7c822"><enum>(a)</enum><header>In
general</header><text>A person described in section 102(a)(1) that accesses,
maintains, retains, modifies, records, stores, destroys, or otherwise uses or
discloses protected health information shall, following the discovery of a
security breach of such information, notify each individual whose protected
health information has been, or is reasonably believed to have been, accessed,
or acquired during such breach.</text>
</subsection><subsection id="IDe30c9dcf061142799503a476df92fc0e"><enum>(b)</enum><header>Obligation of
owner or licensee</header>
<paragraph id="ID516bd6de628842e483f00690505921d5"><enum>(1)</enum><header>Notice to owner
or licensee</header><text>Any person engaged in interstate commerce, that uses,
accesses, transmits, stores, disposes of, or collects protected health
information that the person does not own or license shall notify the owner or
licensee of the information following the discovery of a security breach
involving such information.</text>
</paragraph><paragraph id="ID68055adc7b0041189a724841efaf6247"><enum>(2)</enum><header>Notice by
owner, licensee, or other designated third party</header><text>Nothing in this
subtitle shall be construed to prevent or abrogate an agreement between a
person required to give notice under this section and a designated third party,
including an owner or licensee of the protected health information subject to
the security breach, to provide the notifications required under subsection
(a).</text>
</paragraph><paragraph id="IDb35064c9c08d4b4fab1df364d043a664"><enum>(3)</enum><header>Person relieved
from giving notice</header><text>A person obligated to give notice under
subsection (a) shall be relieved of such obligation if an owner or licensee of
the protected health information subject to the security breach, or other
designated third party, provides such notification.</text>
</paragraph></subsection><subsection id="IDaa42d989c99a4246ad486b789c8c89c5"><enum>(c)</enum><header>Timeliness of
notification</header>
<paragraph id="ID85c0967a21c148afab1e1c80cda2fae4"><enum>(1)</enum><header>In
general</header><text>All notifications required under this section shall be
made within 15 business days, or earlier if the Secretary determines
appropriate, following the discovery by the person of a security breach.</text>
</paragraph><paragraph id="ID68d665445923473697c65110a6272fc5"><enum>(2)</enum><header>Burden of
proof</header><text>The person required to provide notification under this
section shall have the burden of demonstrating that all notifications were made
as required under this subtitle, including evidence demonstrating the necessity
of any delay.</text>
</paragraph></subsection><subsection id="ID04d6feb70da64957aa9d6ea4ef9159dd"><enum>(d)</enum><header>Methods of
notice</header><text>A person described in subsection (a) shall provide to an
individual the following forms of notice in the case of a security
breach:</text>
<paragraph id="ID8ea4955f1a5c4d05bbd0af9c260db832"><enum>(1)</enum><header>Individual
notice</header><text>Notice required under this section shall be provided in
such form as the individual selects, including—</text>
<subparagraph id="IDa73efb7b1c3e45b095d021d81bc03b6b"><enum>(A)</enum><text>written
notification to the last known home mailing address of the individual in the
records of the person;</text>
</subparagraph><subparagraph id="ID84fc5a26364a46cda91266ff9dbd7ace"><enum>(B)</enum><text>telephone notice
to the individual personally; or</text>
</subparagraph><subparagraph id="ID29d0f1003b7d4f16954b4e6fc7d84f27"><enum>(C)</enum><text>e-mail notice, if
the individual has consented to receive such notice and the notice is
consistent with the provisions permitting electronic transmission of notices
under section 101 of the Electronic Signatures in Global and National Commerce
Act (15 U.S.C. 7001).</text>
</subparagraph></paragraph><paragraph id="ID8e0e4c5b070f489487dcb09d4337f06c"><enum>(2)</enum><header>Media
notice</header><text>Notice shall be provided to prominent media outlets
serving a State or jurisdiction, if the protected health information of more
than 1,000 residents of such State or jurisdiction is, or is reasonably
believed to have been, acquired by an unauthorized person.</text>
</paragraph><paragraph id="IDd23a6a8777974deaac79a3a3b74888ed"><enum>(3)</enum><header>Notice to
secretary</header><text>Notice shall be provided to the Secretary for persons
described in section 102 (a)(1) that have lost, stolen, disclosed, or used in
an unauthorized manner or for an unauthorized purpose the protected health
information of a significant number of individuals.</text>
</paragraph></subsection><subsection id="IDf850be518756481aa4dbd7d4ee32b6a9"><enum>(e)</enum><header>Content of
notification</header><text>Regardless of the method by which notice is provided
to individuals under section 104, notice of a security breach shall include, to
the extent possible—</text>
<paragraph id="ID44f94772b9b44c558605549b82bcbea6"><enum>(1)</enum><text>a description of
the protected health information that has been, or is reasonably believed to
have been, accessed, disclosed, or otherwise used by an unauthorized
person;</text>
</paragraph><paragraph id="ID1c1d39be44ed4d678d4daadbd107bddb"><enum>(2)</enum><text>a toll-free
number that the individual may use to contact the person described in
subsection (a) to learn what types of protected health information the person
maintained about that individual; and</text>
</paragraph><paragraph id="ID7c8e8712aa1745d7ac98fa6bb46f9dd9"><enum>(3)</enum><text>toll-free contact
telephone numbers and addresses for major credit reporting agencies.</text>
</paragraph></subsection><subsection id="IDd76cb651a64043d886f4a2b3763dd449"><enum>(f)</enum><header>Delay of
notification authorized for law enforcement purposes</header>
<paragraph id="ID2ea5fbbd25e442c19922e5633c517451"><enum>(1)</enum><header>In
general</header><text>If a Federal law enforcement agency determines that the
notification required under this section would impede a criminal investigation
or cause damage to national security, such notification shall be delayed upon
written notice from the Federal law enforcement agency to the person that
experienced the breach.</text>
</paragraph><paragraph id="ID09a175862c7c4c86a2ac7410fe0891e4"><enum>(2)</enum><header>Extended delay
of notification</header><text>If the notification required under subsection (a)
is delayed pursuant to paragraph (1), a person shall give notice not later than
30 days after such law enforcement delay was invoked unless a Federal law
enforcement agency provides written notification that further delay is
necessary.</text>
</paragraph><paragraph id="ID157c1042502b4adeb0176c0ec20f6927"><enum>(3)</enum><header>Law enforcement
immunity</header><text>No cause of action shall arise in any court against any
Federal law enforcement agency for acts relating to the delay of notification
for law enforcement purposes under this subtitle.</text>
</paragraph></subsection></section></subtitle><subtitle id="id17FDF98104FB49B799E819F014A80080"><enum>B</enum><header>Disclosure under
special circumstances</header>
<section id="ID6c56e35d71684a56a570ecb7e291fd69"><enum>211.</enum><header>Emergency
circumstances</header>
<subsection id="IDb367951e90d24bde89eface5899b6b4a"><enum>(a)</enum><header>General
rule</header><text>In the event of a threat of imminent physical or mental harm
to the subject of protected health information, any person may, in order to
allay or remedy such threat, disclose protected health information about such
subject to a health care provider, health care facility, law enforcement
authority, or emergency medical personnel, to the minimum extent necessary and
only if determined appropriate by a health care provider.</text>
</subsection><subsection id="ID0b085ed5c58c4e278ce25ab034a18b08"><enum>(b)</enum><header>Harm to
others</header><text>Any person may disclose protected health information about
the subject of the information where—</text>
<paragraph id="IDef8251bf431240a4874e71f8f08c6f53"><enum>(1)</enum><text>such subject has
made an identifiable threat of serious injury or death with respect to an
identifiable individual or group of individuals;</text>
</paragraph><paragraph id="ID42b39169132e4924a9889cf8087d40cc"><enum>(2)</enum><text>the subject has
the ability to carry out such threat; and</text>
</paragraph><paragraph id="ID683ec9679b6441feb145fb57296a7a3f"><enum>(3)</enum><text>the release of
such information is necessary to prevent or significantly reduce the
possibility of such threat being carried out.</text>
</paragraph></subsection></section><section id="IDc6dd065ff6314c5ba4d82b8605675caf"><enum>212.</enum><header>Public
health</header>
<subsection id="ID2561660b655b4944bc292cef861391e4"><enum>(a)</enum><header>In
general</header><text>A health care provider, health plan, public health
authority, employer, health or life insurer, law enforcement official, school
or university, or other person described in section 102(a)(1) may disclose
protected health information to a public health authority or other entity
authorized by public health law, when receipt of such information by the
authority or other entity—</text>
<paragraph id="IDcf1d5cadaf474f7daac415c22d9d28a4"><enum>(1)</enum><text>relates directly
to a specified public health purpose;</text>
</paragraph><paragraph id="IDc54bd6884f024d2592b81199312cb41b"><enum>(2)</enum><text>is reasonably
likely to achieve such purpose; and</text>
</paragraph><paragraph id="IDa8b07fa551074c77954e41c0a60d77f0"><enum>(3)</enum><text>is intended for a
purpose that cannot be achieved through the receipt or use of de-identified
health information.</text>
</paragraph></subsection><subsection id="ID795063522558499c83f77ab10d3b910b"><enum>(b)</enum><header>Public health
protection defined</header><text>For purposes of subsection (a), the term
<term>public health protection</term> means a population-based activity or
individual effort, authorized by law, the purpose of which is the prevention of
injury, disease, or premature mortality, or the promotion of health, in a
community, including—</text>
<paragraph id="ID503b8fd6ba824aa1a5a3f341719b1577"><enum>(1)</enum><text>assessing the
health needs and status of the community through public health surveillance and
epidemiological research;</text>
</paragraph><paragraph id="IDf60910614a8e462494d5ca532a7a9a43"><enum>(2)</enum><text>implementing
public health policy;</text>
</paragraph><paragraph id="IDd40a95b6c2e44fbbba14c23edcc91cf4"><enum>(3)</enum><text>responding to
public health needs and emergencies; and</text>
</paragraph><paragraph id="ID5f97cd7c23c644ab9a4de47122378a7b"><enum>(4)</enum><text>any other
activities or efforts authorized by law.</text>
</paragraph></subsection><subsection id="IDd9db46791bed4a95b9842be995342d57"><enum>(c)</enum><header>Limitations</header><text>The
purpose of the disclosure described in subsection (a) should be of sufficient
importance to warrant the potential effect on, or risk to, the privacy of
individuals that the additional exposure of protected health information might
bring. Any infringement on the right to privacy under this section should use
the least intrusive means that are tailored to minimize intrusion on the right
to privacy.</text>
</subsection></section><section id="ID0da733fd5a3641a6a811ad8b73174f05"><enum>213.</enum><header>Protection and
advocacy agencies</header><text display-inline="no-display-inline">Any person
described in section 102(a)(1) that creates, accesses, maintains, retains,
modifies, records, stores, destroys, or otherwise uses or discloses protected
health information under this title may disclose such information to a
protection and advocacy agency established under part C of title I of the
Developmental Disabilities Assistance and Bill of Rights Act (42 U.S.C. 6041 et
seq.) or under the Protection and Advocacy for Mentally Ill Individuals Act of
1986 (42 U.S.C. 10801 et seq.) when such person can establish that there is
probable cause to believe that an individual who is the subject of the
protected health information is vulnerable to abuse and neglect by an entity
providing health or social services to the individual.</text>
</section><section id="IDf2b12cb899604120ac68c12807b2d7e4"><enum>214.</enum><header>Oversight</header>
<subsection id="ID6974b76e6ea04e3eae119f3b468cafca"><enum>(a)</enum><header>In
general</header><text>A health care provider, health plan, employer, law
enforcement official, health or life insurer, public health authority, health
researcher, school or university, or other person described in section
102(a)(1) may disclose protected health information to a health oversight
agency to enable the agency to perform a health oversight function authorized
by law, if—</text>
<paragraph id="IDe42ecd5c09e64e9c855d54c514b7405a"><enum>(1)</enum><text>the purpose for
which the disclosure is to be made cannot reasonably be accomplished without
protected health information;</text>
</paragraph><paragraph id="IDf86cc18dff5947e3bdcb1e6fb3a24d33"><enum>(2)</enum><text>the purpose for
which the disclosure is to be made is of sufficient importance to warrant the
effect on, or the risk to, the privacy of the individuals that additional
exposure of the information might bring; and</text>
</paragraph><paragraph id="IDb6769dd55dfe447c859b765fde8f3a26"><enum>(3)</enum><text>there is a
reasonable probability that the purpose of the disclosure will be
accomplished.</text>
</paragraph></subsection><subsection id="IDa7893f848d1148e78f8a7f985c589747"><enum>(b)</enum><header>Use and
maintenance of protected health information</header><text>A health oversight
agency that receives protected health information under this section—</text>
<paragraph id="ID49f03e778feb4ed3bbb17ed2989f6d47"><enum>(1)</enum><text>shall secure
protected health information in all work papers and all documents summarizing
the health oversight activity through technological, administrative, and
physical safeguards including cryptographic-key based encryption;</text>
</paragraph><paragraph id="IDf8e99e53c37a4b2888386a135cf0eca2"><enum>(2)</enum><text>shall maintain in
its records only such information about an individual as is relevant and
necessary to accomplish the purpose for which the protected health information
was obtained;</text>
</paragraph><paragraph id="ID982b4d93db7f4bb883402eb898fde152"><enum>(3)</enum><text>using appropriate
encryption measures. shall maintain such information securely and limit access
to such information to those persons with a legitimate need for access to carry
out the purpose for which the records were obtained; and</text>
</paragraph><paragraph id="ID7ca5ceb0ea214d98adee48116967a54c"><enum>(4)</enum><text>shall remove or
destroy the information that allows subjects of protected health information to
be identified at the earliest time at which removal or destruction can be
accomplished, consistent with the purpose of the health oversight
activity.</text>
</paragraph></subsection><subsection id="ID80c2465ea0e34ee9be33cc8f13bcc840"><enum>(c)</enum><header>Use of
protected health information in judicial proceedings</header>
<paragraph id="ID58c909e93e2a4ef386195d14ad32e8fe"><enum>(1)</enum><header>In
general</header><text>The disclosure and use of protected health information in
any judicial, administrative, court, or other public proceeding or
investigation relating to a health oversight activity shall be undertaken in
such a manner as to preserve the confidentiality and privacy of individuals who
are the subject of the information, unless disclosure is required by the nature
of the proceedings.</text>
</paragraph><paragraph id="IDfae3fd1ae8614a8f857b42bf478eddf2"><enum>(2)</enum><header>Limiting
disclosure</header><text>Whenever disclosure of the identity of the subject of
protected health information is required by the nature of the proceedings, or
it is impracticable to redact the identity of such individual, the agency shall
request that the presiding judicial or administrative officer enter an order
limiting the disclosure of the identity of the subject to the extent possible,
including the redacting of the protected health information from publicly
disclosed or filed pleadings or records.</text>
</paragraph></subsection><subsection id="ID4da6ac210b3a4e398d2792591ac608f5"><enum>(d)</enum><header>Authorization
by a supervisor</header><text>For purposes of this section, the individual with
authority to authorize the oversight function involved shall provide to the
disclosing person described in subsection (a) a statement that the protected
health information is being sought for a legally authorized oversight
function.</text>
</subsection><subsection id="ID3ea3f74520494abb87c101e49ae535e6"><enum>(e)</enum><header>Use in action
against individuals</header><text>Protected health information about an
individual that is disclosed under this section may not be used in, or
disclosed to any person for use in, an administrative, civil, or criminal
action or investigation directed against the individual, unless the action or
investigation arises out of and is directly related to—</text>
<paragraph id="ID3cce8e4849cc4f2d833bdcd81dabd820"><enum>(1)</enum><text>the receipt of
health care or payment for health care;</text>
</paragraph><paragraph id="ID591d300f6289417ebb5264df690f1395"><enum>(2)</enum><text>a fraudulent
claim related to health; or</text>
</paragraph><paragraph id="IDb7cb98ec0a3c4090bc7c3c018df64313"><enum>(3)</enum><text>oversight of a
public health authority or a health researcher.</text>
</paragraph></subsection></section><section id="ID6740f582c7284d029c1f36e29c015977"><enum>215.</enum><header>Disclosure for
law enforcement, national security, and intelligence purposes</header>
<subsection id="ID19ef0e8e1b7244cbb8ec30b300f1ae94"><enum>(a)</enum><header>Access to
protected health information for law enforcement, national security, and
intelligence activities</header><text>A person described in section 102(a)(1),
or a person who receives protected health information pursuant to section 211,
may disclose protected health information to—</text>
<paragraph id="id74FBACB9FA764B8DB7F74667ED76AC6E"><enum>(1)</enum><text>an investigative
or law enforcement officer pursuant to a warrant issued under the Federal Rules
of Criminal Procedure, an equivalent State warrant, a grand jury subpoena,
civil subpoena, civil investigative demand, or a court order under limitations
set forth in subsection (b); and</text>
</paragraph><paragraph id="id469DCDF1711F4CE6A6D0A9A7A1E7C785"><enum>(2)</enum><text>an authorized
Federal official for the conduct of lawful intelligence, counter-intelligence,
and other national security activities authorized by the National Security Act
(50 U.S.C. 401 et seq.) and implementing authority (Executive Order 12333), or
otherwise by law.</text>
</paragraph></subsection><subsection id="IDb7172088d6cd436d99d5a91889f65378"><enum>(b)</enum><header>Requirements
for court orders for access to protected health information</header><text>A
court order for the disclosure of protected health information under subsection
(a)(1) may be issued by any court that is a court of competent jurisdiction and
shall issue only if the investigative or law enforcement officer submits a
written application upon oath or equivalent affirmation demonstrating that
there is probable cause to believe that—</text>
<paragraph id="ID307e1739ba994309939498b3a4cbaccf"><enum>(1)</enum><text>the protected
health information sought is relevant and material to an ongoing criminal
investigation, except in the case of a State government authority, such a court
order shall not issue if prohibited by the law of such State;</text>
</paragraph><paragraph id="ID08b56b857b19428999cbc0352d263079"><enum>(2)</enum><text>the investigative
or evidentiary needs of the investigative or law enforcement officer cannot
reasonably be satisfied by de-identified health information or by any other
information; and</text>
</paragraph><paragraph id="ID1e5db9a435c4437e8f96eb358980fda2"><enum>(3)</enum><text>the law
enforcement need for the information outweighs the privacy interest of the
individual to whom the information pertains.</text>
</paragraph></subsection><subsection id="ID908b2a6cee0b40188ed6314bbee604a1"><enum>(c)</enum><header>Motions To
quash or modify</header><text>A court issuing an order pursuant to this
section, on a motion made promptly by a person described in subsection (a)(1)
may quash or modify such order if the court finds that information or records
requested are unreasonably voluminous or if compliance with such order
otherwise would cause an unreasonable burden on such entities.</text>
</subsection><subsection id="IDaa53145c661f491094b6aef5e24cb377"><enum>(d)</enum><header>Notice</header>
<paragraph id="ID9fac4f96c9d74d9bae7322da72c96b7d"><enum>(1)</enum><header>In
general</header><text>Except as provided in paragraph (2), no order for the
disclosure of protected health information about an individual may be issued by
a court under this section unless prior notice of the application for the order
has been served on the individual and the individual has been afforded an
opportunity to oppose the issuance of the order.</text>
</paragraph><paragraph id="ID021e19fe66f64ba2a4650f67d95841a1"><enum>(2)</enum><header>Notice not
required</header><text>An order for the disclosure of protected health
information about an individual may be issued without prior notice to the
individual if the court finds that notice would be impractical because—</text>
<subparagraph id="ID9390210e27654fb39fa8bd60e018812c"><enum>(A)</enum><text>the name and
address of the individual are unknown; or</text>
</subparagraph><subparagraph id="ID54967d66605d4192b6b4cc0eb828a50f"><enum>(B)</enum><text>notice would risk
destruction or unavailability of the evidence, intelligence,
counter-intelligence, or other national security information.</text>
</subparagraph></paragraph></subsection><subsection id="ID6f53d7d5fcd24678bf9630ff7a0a5ef1"><enum>(e)</enum><header>Conditions</header><text>Upon
the granting of an order for disclosure of protected health information under
this section, the court shall impose appropriate safeguards to ensure the
confidentiality of such information and to protect against unauthorized or
improper use or disclosure.</text>
</subsection><subsection id="IDb1c32e8802dc463cb0227178255b3e3f"><enum>(f)</enum><header>Limitation on
use and disclosure for national security, intelligence, and other law
enforcement inquiries</header><text>Protected health information about an
individual that is disclosed under this section may not be used in, or
disclosed to any entity for use in, any administrative, civil, or criminal
action or investigation directed against the individual, unless the action or
investigation arises out of, or is directly related to, the law enforcement,
national security, or intelligence inquiry for which the information was
obtained.</text>
</subsection><subsection id="ID26858a0ce3d34e7e9aaf99211f567919"><enum>(g)</enum><header>Destruction or
return of information</header><text>When the matter or need for which protected
health information was disclosed to an investigative or law enforcement
officer, a Federal official authorized for the conduct of lawful intelligence,
counter-intelligence, and other national security activities, or authorized
Federal official, or grand jury has concluded, including any derivative matters
arising from such matter or need, the law enforcement agency, authorized
Federal official, or grand jury shall either destroy the protected health
information, or return it to the entity from which it was obtained.</text>
</subsection><subsection id="IDc17c1ee61085411caecaa8030c26bb29"><enum>(h)</enum><header>Redactions</header><text>To
the extent practicable, and consistent with the requirements of due process, a
law enforcement agency shall redact personally identifying information from
protected health information prior to the public disclosure of such protected
information in a judicial or administrative proceeding.</text>
</subsection><subsection id="ID8fdab1b4e89c4095ac6502872d65fd4b"><enum>(i)</enum><header>Exception</header><text>This
section shall not be construed to limit or restrict the ability of law
enforcement authorities to gain information while in hot pursuit of a suspect
or if other exigent circumstances exist.</text>
</subsection></section><section id="IDa3c8e8700eae41339976daba3cd1ccb1"><enum>216.</enum><header>Next of kin
and directory information</header>
<subsection id="ID7d4ab65e5ccf4535bf2ecbe1900728b1"><enum>(a)</enum><header>Next of
kin</header><text>A health care provider, or a person that receives protected
health information under section 211, may disclose protected health information
about health care services provided to an individual to the individual's next
of kin, or to another entity that the individual has identified, if at the time
of the treatment of the individual—</text>
<paragraph id="ID72c4b7b5dc3c4becbcdc9a8ea0808f5d"><enum>(1)</enum><text>the
individual—</text>
<subparagraph id="IDc32d7fb83bdc4573818126e9017c9563"><enum>(A)</enum><text>has been notified
of the individual's right to object to such disclosure and the individual has
not objected to the disclosure; or</text>
</subparagraph><subparagraph id="ID87a357dc66af4bf4a28d0e13240ee43a"><enum>(B)</enum><text>is in a physical
or mental condition such that the individual is not capable of objecting, and
there are no prior indications that the individual would object; and</text>
</subparagraph></paragraph><paragraph id="ID69c33c3506c0470eb9869ea9f98252a3"><enum>(2)</enum><text>the information
disclosed is relevant to health care services currently being provided to that
individual.</text>
</paragraph></subsection><subsection id="ID06554de0c7d34877b6a1a18c6b0e6231"><enum>(b)</enum><header>Directory
information</header>
<paragraph id="IDccddc899314a447589edc02f5ad77e5f"><enum>(1)</enum><header>Disclosure</header>
<subparagraph id="ID9a029c5c7ccb4ad2a8633736592117d0"><enum>(A)</enum><header>In
general</header><text>Except as provided in paragraph (2), with respect to an
individual who is admitted as an inpatient to a health care facility, a person
described in subsection (a) may disclose information described in subparagraph
(B) about the individual to any entity if, at the time of the admission, the
individual—</text>
<clause id="IDdecbd57bc589430d8f401c1246505337"><enum>(i)</enum><text>has
been notified of the individual's right to object and has not objected to the
disclosure; or</text>
</clause><clause id="ID05f1fabd545142fbb09681d5a1c249d7"><enum>(ii)</enum><text>is
in a physical or mental condition such that the individual is not capable of
objecting and there are no prior indications that the individual would
object.</text>
</clause></subparagraph><subparagraph id="ID40dd84e8ed9b4b168eb85351907266ea"><enum>(B)</enum><header>Information</header><text>Information
described in this subparagraph is information that consists only of 1 or more
of the following items:</text>
<clause id="ID54b293e9c93148b8a7dfab97ef7a4039"><enum>(i)</enum><text>The
name of the individual who is the subject of the information.</text>
</clause><clause id="ID47b28cd87aef4325a94b62a3f5e34641"><enum>(ii)</enum><text>The general
health status of the individual, described as critical, poor, fair, stable, or
satisfactory or in terms denoting similar conditions.</text>
</clause><clause id="IDc10cd58ef8834b3fa075c988de90e967"><enum>(iii)</enum><text>The location of
the individual within the health care facility to which the individual is
admitted.</text>
</clause></subparagraph></paragraph><paragraph id="IDcb40547bb43c43ed8ae35b0e87d80a9b"><enum>(2)</enum><header>Exception</header><text>Paragraph
(1)(B)(iii) shall not apply if disclosure of the location of the individual
would reveal specific information about the physical or mental condition of the
individual, unless the individual expressly authorizes such disclosure.</text>
</paragraph></subsection><subsection id="ID5e7508183e8040789493e179309e7d67"><enum>(c)</enum><header>Directory or
next-of-kin information</header><text>A disclosure may not be made under this
section if the disclosing person described in subsection (a) has reason to
believe that the disclosure of directory or next-of-kin information could lead
to the physical or mental harm of the individual, unless the individual
expressly authorizes such disclosure.</text>
</subsection></section><section id="IDcc2880d4cbb548f6ae1832e522e45d19"><enum>217.</enum><header>Health
research</header>
<subsection id="ID71b3d612f2df48a5bd25d67e28bb60cb"><enum>(a)</enum><header>Regulations</header>
<paragraph id="ID25a36a7b22a94560aa4688866ab55681"><enum>(1)</enum><header>In
general</header><text>The requirements and protections provided for under part
46 of title 45, Code of Federal Regulations (as in effect on the date of
enactment of this Act), shall apply to all health research.</text>
</paragraph><paragraph id="ID179626b1904e409286511d554d3f6a46"><enum>(2)</enum><header>Effective
date</header><text>Paragraph (1) shall not take effect until the Secretary has
promulgated final regulations to implement such paragraph.</text>
</paragraph></subsection><subsection id="ID25e8f7cab17e44c6a2f4412f0033adae"><enum>(b)</enum><header>Evaluation</header><text>Not
later than 24 months after the date of enactment of this Act, the Secretary
shall prepare and submit to Congress detailed recommendations on whether
written informed consent should be required, and if so, under what
circumstances, before protected health information can be used for health
research.</text>
</subsection><subsection id="IDb170624cb04149f7b0ad757f0f4b8043"><enum>(c)</enum><header>Recommendations</header><text>The
recommendations required to be submitted under subsection (b) shall
include—</text>
<paragraph id="ID46d8703479ef4c0db4d650cbd41a637d"><enum>(1)</enum><text>a detailed
explanation of current institutional review board practices, including the
extent to which the privacy of individuals is taken into account as a factor
before allowing waivers and under what circumstances informed consent is being
waived;</text>
</paragraph><paragraph id="IDe406805fc70540099c31c35fa4e2f9dd"><enum>(2)</enum><text>a summary of how
technology could be used to strip identifying data for the purposes of
research;</text>
</paragraph><paragraph id="IDa69e2603d4c647258613972793f888c8"><enum>(3)</enum><text>an analysis of
the risks and benefits of requiring informed consent versus the waiver of
informed consent;</text>
</paragraph><paragraph id="IDd4ac3ae5743847d4b8ae343c3e7d70e6"><enum>(4)</enum><text>an analysis of
the risks and benefits of using protected health information for research
purposes other than the health research project for which such information was
obtained; and</text>
</paragraph><paragraph id="ID83f3a18c45d1469eb73788fbeda973b5"><enum>(5)</enum><text>an analysis of
the risks and benefits of allowing individuals to consent or to refuse to
consent, at the time of receiving medical treatment, to the possible future use
of records of medical treatments for research studies.</text>
</paragraph></subsection><subsection id="ID52782a2039414d50925c1f7f16df2a1a"><enum>(d)</enum><header>Consultation</header><text>In
carrying out this section, the Secretary shall consult with individuals who
have distinguished themselves in the fields of health research, privacy,
related technology, consumer interests in health information, health data
standards, and the provision of health services.</text>
</subsection><subsection id="ID5acd7705cb154b28ac87c7319eed0c59"><enum>(e)</enum><header>Congressional
notice</header><text>Not later than 6 months after the date on which the
Secretary submits to Congress the recommendations required under subsection
(b), the Secretary shall propose to implement such recommendations through
regulations promulgated on the record after opportunity for a hearing, and
shall advise the Congress of such proposal.</text>
</subsection><subsection id="ID441386028b784d93b97608db84896671"><enum>(f)</enum><header>Other
requirements</header>
<paragraph id="ID37b8f154a83449b8af157f4f1305fbe0"><enum>(1)</enum><header>Obligations of
the recipient</header><text>A person who receives protected health information
pursuant to this section shall remove or destroy, at the earliest opportunity
consistent with the purposes of the project involved, information that would
enable an individual to be identified, unless—</text>
<subparagraph id="ID5fd833e351af4f5e904c52623d92eaf3"><enum>(A)</enum><text>an institutional
review board has determined that there is a health or research justification
for the retention of such identifiers; and</text>
</subparagraph><subparagraph id="IDc3c0cd5d3d79446d9f9f10e055596f41"><enum>(B)</enum><text>there is an
adequate plan to protect the identifiers from disclosure consistent with this
section.</text>
</subparagraph></paragraph><paragraph id="ID3cfbba4d38314b1dad2d1f679a0ef75c"><enum>(2)</enum><header>Periodic review
and technical assistance</header>
<subparagraph id="IDfd75b6ff0bc84d5a9b9b05530ffc54d5"><enum>(A)</enum><header>Institutional
review board</header><text>Any institutional review board that authorizes
research under this section shall provide the Secretary with the names and
addresses of the institutional review board members.</text>
</subparagraph><subparagraph id="ID6b55aeeafdcc4207bc043f56d30da55c"><enum>(B)</enum><header>Technical
assistance</header><text>The Secretary shall provide technical assistance to
institutional review boards described in this subsection.</text>
</subparagraph><subparagraph id="IDff72f2fe5d7d43d3adb5c2158b34cd6e"><enum>(C)</enum><header>Monitoring</header><text>The
Secretary shall periodically monitor institutional review boards described in
this subsection.</text>
</subparagraph><subparagraph id="ID3550256d5e3440a69407bda9c9ddc817"><enum>(D)</enum><header>Reports</header><text>Not
later than 3 years after the date of enactment of this Act, the Secretary shall
report to Congress regarding the activities of institutional review boards
described in this subsection.</text>
</subparagraph></paragraph></subsection><subsection id="IDe54636c4b0cd4ad0a847d235f0595261"><enum>(g)</enum><header>Limitation</header><text>Nothing
in this section shall be construed to permit protected health information that
is received by a researcher under this section to be accessed for purposes
other than research or as authorized by the individual that is the subject of
such protected health information.</text>
</subsection></section><section id="IDb71c9c71dba14f14b447a9799712f826"><enum>218.</enum><header>Judicial and
administrative purposes</header>
<subsection id="ID6f470d40f3334b1ea6c01055e9e9714a"><enum>(a)</enum><header>In
general</header><text>A person described in section 102(a)(1), or a person who
receives protected health information under section 211, may disclose protected
health information—</text>
<paragraph id="ID9413a74094c643c09d85e8186881e827"><enum>(1)</enum><text>pursuant to the
standards and procedures established in the Federal Rules of Civil Procedure or
comparable rules of other courts or administrative agencies, in connection with
litigation or proceedings to which an individual who is the subject of the
information is a party and in which the individual has placed his or her
physical or mental condition at issue;</text>
</paragraph><paragraph id="IDa2de3a35bc5344b99a030918b4055ff9"><enum>(2)</enum><text>to a court, and
to others ordered by the court, if in response to a court order issued by a
court of competent jurisdiction in accordance with subsections (b) and (c);
or</text>
</paragraph><paragraph id="ID88433d738463473fb9972ae9db1db0ac"><enum>(3)</enum><text>if necessary to
present to a court an application regarding the provision of treatment of an
individual or the appointment of a guardian.</text>
</paragraph></subsection><subsection id="IDbf9874610fdb494f8bf80450afba7867"><enum>(b)</enum><header>Court orders
for access to protected health information</header><text>A court order for the
disclosure of protected health information under subsection (a) may be issued
only if the person seeking disclosure submits a written application upon oath
or equivalent affirmation demonstrating by clear and convincing evidence
that—</text>
<paragraph id="ID78e24a608d384fb3be5e5dca5bd7f4c9"><enum>(1)</enum><text>the protected
health information sought is necessary for the adjudication of a material fact
in dispute in a civil proceeding;</text>
</paragraph><paragraph id="ID30ff2bce756b450594fbc86aa762de9d"><enum>(2)</enum><text>the adjudicative
need cannot be reasonably satisfied by de-identified health information or by
any other information; and</text>
</paragraph><paragraph id="ID70bb178712e24b3f87827e9fb506697d"><enum>(3)</enum><text>the need for the
information outweighs the privacy interest of the individual to whom the
information pertains.</text>
</paragraph></subsection><subsection id="ID049ec2bed6de44b88859df6dab5d13a9"><enum>(c)</enum><header>Notice</header>
<paragraph id="IDdd304f4f82704e22b7cb143d3a54b9af"><enum>(1)</enum><header>In
general</header><text>Except as provided in paragraph (2), no order for the
disclosure of protected health information about an individual may be issued by
a court unless notice of the application for the order has been served on the
individual and the individual has been afforded an opportunity to oppose the
issuance of the order.</text>
</paragraph><paragraph id="ID7a212cae22794e04a40fe5454de20b86"><enum>(2)</enum><header>Notice not
required</header><text>An order for the disclosure of protected health
information about an individual may be issued without notice to the individual
if the court finds, by clear and convincing evidence, that notice would be
impractical because—</text>
<subparagraph id="ID3a43c04a92ab4c4fbf4292a136dbe795"><enum>(A)</enum><text>the name and
address of the individual are unknown; or</text>
</subparagraph><subparagraph id="ID588d4653ade84fd687226b55296fd1cc"><enum>(B)</enum><text>notice would risk
destruction or unavailability of the evidence.</text>
</subparagraph></paragraph></subsection><subsection id="ID42bd87707b3b4e5e937273266bebb23f"><enum>(d)</enum><header>Obligations of
recipient</header><text>A person seeking protected health information pursuant
to subsection (a)(1)—</text>
<paragraph id="IDe8070f9f46b742e483895350a4e326f7"><enum>(1)</enum><text>shall notify the
individual or the individual's attorney of the request for the
information;</text>
</paragraph><paragraph id="ID854db2e065a540aaa49071ecdf032cca"><enum>(2)</enum><text>shall provide the
health care provider, health plan, health oversight agency, employer, insurer,
health or life insurer, school or university, agent, or other person involved
with a signed document attesting—</text>
<subparagraph id="ID54c5acb746194bf397272cb955a3cf42"><enum>(A)</enum><text>that the
individual has placed his or her physical or mental condition at issue in
litigation or proceedings in which the individual is a party; and</text>
</subparagraph><subparagraph id="ID601f233421924a309371a6409fe56d1b"><enum>(B)</enum><text>the date on which
the individual or the individual's attorney was notified under paragraph (1);
and</text>
</subparagraph></paragraph><paragraph id="ID4f03cf444d7f4b5e91edcab6587d1ef8"><enum>(3)</enum><text>shall not accept
any requested protected health information from the health care provider,
health plan, health oversight agency, employer, insurer, health or life
insurer, school or university, agent, or other person until the termination of
the 10-day period beginning on the date notice was given under paragraph
(1).</text>
</paragraph></subsection></section><section id="ID0387e61da9224348ab981489bec6357a"><enum>219.</enum><header>Individual
representatives</header>
<subsection id="IDbae525a6ef7f4e58b90d07914fcb2050"><enum>(a)</enum><header>In
general</header><text>Except as provided in subsections (b) and (c), a person
who is authorized by law (based on grounds other than an individual's status as
a minor), or by an instrument recognized under law, to act as an agent,
attorney, proxy, or other legal representative of an individual, may, to the
extent so authorized, exercise and discharge the rights of the individual under
this Act.</text>
</subsection><subsection id="IDcaa508f0840c47d4b4e646dd6a540aec"><enum>(b)</enum><header>Health care
power of attorney</header><text>A person who is authorized by law (based on
grounds other than being a minor), or by an instrument recognized under law, to
make decisions about the provision of health care to an individual who is
incapacitated, may exercise and discharge the rights of the individual under
this Act to the extent necessary to effectuate the terms or purposes of the
grant of authority.</text>
</subsection><subsection id="ID5f86980b7ba741be921e9e1867e61f87"><enum>(c)</enum><header>No court
declaration</header><text>If a physician or other health care provider
determines that an individual, who has not been declared to be legally
incompetent, suffers from a medical condition that prevents the individual from
acting knowingly or effectively on the individual's own behalf, the right of
the individual to access or amend the health information and to authorize
disclosure under this Act may be exercised and discharged in the best interest
of the individual by—</text>
<paragraph id="ID014d14f7c7db4014b744c9fd8b521334"><enum>(1)</enum><text>a person
described in subsection (b) with respect to the individual;</text>
</paragraph><paragraph id="IDd9cf9f7f9ca04bf880e00edb5b0f2c80"><enum>(2)</enum><text>a person
described in subsection (a) with respect to the individual, but only if a
person described in paragraph (1) cannot be contacted after a reasonable effort
or if there is no individual who fits the description in paragraph (1);</text>
</paragraph><paragraph id="IDdc5a06fa89244628ad23cca58307221c"><enum>(3)</enum><text>the next of kin
of the individual, but only if a person described in paragraph (1) or (2)
cannot be contacted after a reasonable effort; or</text>
</paragraph><paragraph id="IDe1484dcc28ff42c3a16b26854a510acc"><enum>(4)</enum><text>the health care
provider, but only if a person described in paragraph (1), (2), or (3) cannot
be contacted after a reasonable effort.</text>
</paragraph></subsection><subsection id="IDc4a3ae356c584154abc0a2822ce9628a"><enum>(d)</enum><header>Rights of
minors</header>
<paragraph id="IDea8117038cc6438cb58d0abd01e4f7e3"><enum>(1)</enum><header>Individuals who
are 18 or legally capable</header><text>In the case of an individual—</text>
<subparagraph id="IDc38d45b192d242c08201edb41f143def"><enum>(A)</enum><text>who is 18 years
of age or older, all rights of the individual under this Act shall be exercised
by the individual; or</text>
</subparagraph><subparagraph id="IDcdfda3fffe1f448e807c1d79f41cdcd8"><enum>(B)</enum><text>who, acting
alone, can consent to health care without violating any applicable law, and who
has sought such care, the individual shall exercise all rights of an individual
under this Act with respect to protected health information relating to such
health care.</text>
</subparagraph></paragraph><paragraph id="ID3ee59ddaaa444ddc877d327f20803969"><enum>(2)</enum><header>Individuals
under 18</header><text>Except as provided in paragraph (1)(B), in the case of
an individual who is—</text>
<subparagraph id="IDfe8bbd9e5b324ca3a250270d9e9a28df"><enum>(A)</enum><text>under 14 years of
age, all of the individual's rights under this Act shall be exercised through
the parent or legal guardian; or</text>
</subparagraph><subparagraph id="IDd8961ba3e90f4cc28408e144d45fac63"><enum>(B)</enum><text>14 through 17
years of age, the rights of inspection, supplementation, and modification, and
the right to authorize use and disclosure of protected health information of
the individual shall be exercised by—</text>
<clause id="id9E1C5BDAC31D44729537785C3AE6CA77"><enum>(i)</enum><text>the
individual where no parent or legal guardian exists;</text>
</clause><clause id="idF7B1C473FC1C4699A5B5D0024C1B007C"><enum>(ii)</enum><text>the parent or
legal guardian of the individual; or</text>
</clause><clause id="id00910B55DB6C410DB19D2B3C17B7B845"><enum>(iii)</enum><text>the individual
if the parent or legal guardian determined that the individual has the sole
right the control their health information.</text>
</clause></subparagraph></paragraph></subsection><subsection id="ID4b72c15fd835428a9b5e1b9abd0032c1"><enum>(e)</enum><header>Deceased
individuals</header>
<paragraph id="IDc610b12047f54deab26381aae510afc0"><enum>(1)</enum><header>Application of
Act</header><text>The provisions of this Act shall continue to apply to
protected health information concerning a deceased individual.</text>
</paragraph><paragraph id="ID338f4b625c6d4c149d4430e81083e4db"><enum>(2)</enum><header>Exercise of
rights on behalf of a deceased individual</header><text>A person who is
authorized by law or by an instrument recognized under law, to act as an
executor or administrator of the estate of a deceased individual, or otherwise
to exercise the rights of the deceased individual, may, to the extent so
authorized, exercise and discharge the rights of such deceased individual under
this Act. If no such designee has been authorized, the rights of the deceased
individual may be exercised as provided for in subsection (c).</text>
</paragraph><paragraph id="ID31906698f6ff4abf9a833b23ef8048aa"><enum>(3)</enum><header>Identification
of deceased individual</header><text>A person described in section 216(a) may
disclose protected health information if such disclosure is necessary to assist
in the identification of a deceased individual.</text>
</paragraph></subsection></section></subtitle><enum>III</enum><header>Office of
Health Information Privacy of the Department of Health and Human
Services</header>
<subtitle id="idABA93A3D32304005B3278369E967AF2A"><enum>A</enum><header>Designation</header>
<section id="ID65446fab02fe4247a7f2a98f4b998c0c"><enum>301.</enum><header>Designation</header>
<subsection id="ID4cd1b64c187647ef821a30f9e3dfc231"><enum>(a)</enum><header>In
general</header><text>The Secretary shall designate an office within the
Department of Health and Human Services to be known as the Office of Health
Information Privacy (referred to in this section as the <quote>Office</quote>).
The Office shall be headed by a Director, who shall be appointed by the
Secretary.</text>
</subsection><subsection id="ID82b0adb95f354b019fe4ff3e61114d3b"><enum>(b)</enum><header>Duties</header><text>The
Director of the Office shall—</text>
<paragraph id="ID14c1530c6e3e4375bfe1fb0d1264db2e"><enum>(1)</enum><text>receive and
investigate complaints of alleged violations of this Act;</text>
</paragraph><paragraph id="IDa20b0b43e2bb4acd85bb3e25311e975d"><enum>(2)</enum><text>provide for the
conduct of audits where appropriate;</text>
</paragraph><paragraph id="IDfef0e4aa16eb4a1e965f925c43d5495a"><enum>(3)</enum><text>provide guidance
to the Secretary on the implementation of this Act;</text>
</paragraph><paragraph id="id758AA2267C2D484EA51903A10DED0CE7"><enum>(4)</enum><text>provide guidance
to health care providers and other relevant individuals concerning the manner
in which to interpret and implement the privacy protections under this Act (and
the regulations promulgated under this Act);</text>
</paragraph><paragraph id="ID4794e8a4b3f549b6a1a45a500cc45a11"><enum>(5)</enum><text>prepare and
submit the report described in subsection (c);</text>
</paragraph><paragraph id="IDc0df64c5ef0a423380e2a3e295d38232"><enum>(6)</enum><text>consult with, and
provide recommendation to, the Secretary concerning improvements in the privacy
and security of protected health information and concerning medical privacy
research needs; and</text>
</paragraph><paragraph id="IDfb8b95ad36c6417c92c34bbebc5fcf42"><enum>(7)</enum><text>carry out any
other activities determined appropriate by the Secretary.</text>
</paragraph></subsection><subsection id="IDb1b8c0fef5ca45c59842e50304175522"><enum>(c)</enum><header>Standards for
certification</header>
<paragraph id="idA75C859F90E444199474E3AB7AAD124D"><enum>(1)</enum><header>Establishment</header><text>Not
later than 12 months after the date of enactment of this Act, the Secretary, in
consultation with the Director of the Office and the Director of the Office of
Civil Rights, shall establish and implement standards for health information
technology products used to access, disclose, maintain, store, distribute,
transmit, amend, or dispose of protected health information in a manner that
protects the individual’s right to privacy, confidentiality, and security
relating to that information.</text>
</paragraph><paragraph id="id0A602851D44A492DB434DC39F0AFFB5B"><enum>(2)</enum><header>Stakeholder
participation</header><text>In establishing the standards under paragraph (1),
the Secretary shall ensure the participation of various stakeholders, including
patients and consumer advocates, privacy advocates, experts in information
technology and information systems, and experts in health care.</text>
</paragraph></subsection><subsection id="IDb792e56c1e75416caeb7671ac40fe44a"><enum>(d)</enum><header>Report on
compliance</header><text>Not later than January 1 of the first calendar year
beginning more than 1 year after the establishment of the Office under
subsection (a), and every January 1 thereafter, the Secretary, in consultation
with the Director of the Office, shall prepare and submit to Congress a report
concerning the number of complaints of alleged violations of this Act that are
received during the year for which the report is being prepared. Such report
shall describe the complaints and any remedial action taken concerning such
complaints and shall be made available to the public on the Internet website of
the Department of Health and Human Services.</text>
</subsection></section></subtitle><subtitle id="idF10BAC8585324A308BEFC3656FBA9652"><enum>B</enum><header>Enforcement</header>
<chapter id="id58D2BC239C474E5B8CFA848C0BE91F74"><enum>1</enum><header>Criminal
provisions</header>
<section id="ID5938a5943d4b414b8ff4f9b109cfc48f"><enum>311.</enum><header>Wrongful
disclosure of protected health information</header>
<subsection id="IDa2d758aaf92748fdb3f1733fb71a1d1e"><enum>(a)</enum><header>In
general</header><text>Part I of title 18, United States Code, is amended by
adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="id33885CEBC4DC422C8086076B849FC355" style="OLC">
<chapter id="idB044DF08907F4494AD4456020587696C"><enum>124</enum><header>Wrongful
disclosure of protected health information</header>
<section id="ID51accb5a9c2741c090f06165dd0abee0"><enum>2801.</enum><header>Wrongful
disclosure of protected health information</header>
<subsection id="ID57a49e674b4f4fb1b339ba671ee58237"><enum>(a)</enum><header>Offense</header><text>The
penalties described in subsection (b) shall apply to a person that knowingly
and intentionally—</text>
<paragraph id="IDef17e2f5e5fc4517a39245f8d01cf773"><enum>(1)</enum><text>obtains, uses, or
attempts to obtain or use protected health information relating to an
individual in violation of title II of the <short-title>Health Information Privacy and Security Act</short-title>;
or</text>
</paragraph><paragraph id="IDd4e837c3dbfd40baa78e8bf7e1ed33da"><enum>(2)</enum><text>discloses or
attempts to disclose protected health information to another person in
violation of title II of the <short-title>Health
Information Privacy and Security Act</short-title>.</text>
</paragraph></subsection><subsection id="IDb28537f577734ec89b8ca4fc82809c03"><enum>(b)</enum><header>Penalties</header><text>A
person described in subsection (a) shall—</text>
<paragraph id="ID3392a600840c4c5ca0452986da925cb8"><enum>(1)</enum><text>be fined not more
than $50,000, imprisoned not more than 1 year, or both;</text>
</paragraph><paragraph id="ID04dbbfc6017742339acda10e3d40adf5"><enum>(2)</enum><text>if the offense is
committed under false pretenses, be fined not more than $250,000 or imprisoned
not more than 5 years, or both; or</text>
</paragraph><paragraph id="IDa1804ccd581e4a3e9f8ce8f61367871e"><enum>(3)</enum><text>if the offense is
committed with the intent to sell, transfer, or use protected health
information for commercial advantage, personal gain, or malicious harm, be
fined not more than $500,000, imprisoned not more than 10 years, or any
combination of such penalties.</text>
</paragraph></subsection><subsection id="ID2350bdb5fa944b4291bd4ee47bf3eeb0"><enum>(c)</enum><header>Subsequent
offenses</header><text>In the case of a person described in subsection (a), the
maximum penalties described in subsection (b) shall be doubled for every
subsequent conviction for an offense arising out of a violation or violations
related to a set of circumstances that are different from those involved in the
previous violation or set of related violations described in such subsection
(a).</text>
</subsection></section></chapter><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="ID9883a0377c8e4207824756acf88f2876"><enum>(b)</enum><header>Clerical
amendment</header><text>The table of chapters for part I of title 18, United
States Code, is amended by inserting after the item relating to chapter 123 the
following new item:</text>
<quoted-block display-inline="no-display-inline" id="id77D2E14253E5492D86FEFB573BC45F30" style="OLC">
<toc>
<toc-entry idref="ID51accb5a9c2741c090f06165dd0abee0" level="section">Sec. 2801. Wrongful disclosure of protected health
information.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><section id="ID0bc5bddfc7ff4e299cc6600a410b3ac8"><enum>312.</enum><header>Debarment for
crimes and civil violations</header>
<subsection id="IDb27c2380c96b4848b60c471daeb8b762"><enum>(a)</enum><header>Purpose</header><text>The
purpose of this section is to prevent and deter instances of intentional
criminal actions that violate criminal laws that are designed to protect the
privacy of protected health information in a manner consistent with this
Act.</text>
</subsection><subsection id="ID3a6327514be142d7a651c02fa8681a8a"><enum>(b)</enum><header>Debarment</header><text>Not
later than 270 days after the date of enactment of this Act, the Attorney
General, in consultation with the Secretary, shall promulgate regulations and
establish procedures to permit the debarment of health care providers, health
researchers, health or life insurers, employers, or schools or universities
from receiving benefits under any Federal health program or other Federal
procurement program if the managers or officers of such persons are found
guilty of violating section 2801 of title 18, United States Code, have civil
penalties imposed against such officers or managers under section 321 in
connection with the illegal disclosure of protected health information, or are
found guilty of making a false statement or obstructing justice related to
attempting to conceal or concealing such illegal disclosure. Such regulations
shall take into account the need for continuity of medical care and may provide
for a delay of any debarment imposed under this section to take into account
the medical needs of patients.</text>
</subsection><subsection id="IDbbe738ef1d474966826eb6c8e6018627"><enum>(c)</enum><header>Consultation</header><text>Prior
to publishing a proposed rule to implement subsection (b), the Attorney General
shall consult with State law enforcement officials, health care providers,
patient privacy rights' advocates, and other appropriate persons, to gain
additional information regarding the debarment of persons under subsection (b)
and the best methods to ensure the continuity of medical care.</text>
</subsection><subsection id="ID7ca123db1d7a477f99c59c26512da09d"><enum>(d)</enum><header>Report</header><text>The
Attorney General shall annually prepare and submit to the Committee on the
Judiciary of the House of Representatives and the Committee on the Judiciary of
the Senate a report concerning the activities and debarment actions taken by
the Attorney General under this section.</text>
</subsection><subsection id="ID18a529275f544a1389ef528f32806079"><enum>(e)</enum><header>Assistance To
prevent criminal violations</header><text>The Attorney General, in cooperation
with any other appropriate individual, organization, or agency, may provide
advice, training, technical assistance, and guidance regarding ways to reduce
the incidence of improper disclosure of protected health information.</text>
</subsection><subsection id="IDdfcc9b08055249539d142a39afaa3f70"><enum>(f)</enum><header>Relationship to
other authorities</header><text>A debarment imposed under this section shall
not reduce or diminish the authority of a Federal, State, or local governmental
agency or court to penalize, imprison, fine, suspend, debar, or take other
adverse action against a person, in a civil, criminal, or administrative
proceeding.</text>
</subsection></section></chapter><chapter id="id49B4AE72A0E84AA4A303864D0CF67BC7"><enum>2</enum><header>Civil
sanctions</header>
<section id="ID18db5b36f7644d12a6e4e33039ff4a30"><enum>321.</enum><header>Civil
penalty</header><text display-inline="no-display-inline">A health care
provider, health researcher, health plan, health oversight agency, public
health agency, law enforcement agency, employer, health or life insurer, school
or university, agent or other person described in section 102(a)(1), who the
Secretary, in consultation with the Attorney General, determines has
substantially and materially failed to comply with this Act shall be subject,
in addition to any other penalties that may be prescribed by law—</text>
<paragraph id="IDff9d9e18fdcd425e9f65bc5e01edba0c"><enum>(1)</enum><text>in a case in
which the violation relates to title I, to a civil penalty of not more than
$500 for each such violation, but not to exceed $5,000 in the aggregate for
multiple violations;</text>
</paragraph><paragraph id="ID22b8f64a6fb24873bbf6c6b51ed6afa7"><enum>(2)</enum><text>in a case in
which the violation relates to title II, to a civil penalty of not more than
$10,000 for each such violation, but not to exceed $50,000 in the aggregate for
multiple violations; or</text>
</paragraph><paragraph id="ID72168e774b854d849d919ff93d75c66a"><enum>(3)</enum><text>in a case in
which such violations have occurred with such frequency as to constitute a
general business practice, to a civil penalty of not more than $100,000.</text>
</paragraph></section><section id="IDd3a49eccc31c4bd8a2e9941af8cae347"><enum>322.</enum><header>Procedures for
imposition of penalties</header>
<subsection id="ID04f0a0780d634230b522411e81c4b23f"><enum>(a)</enum><header>Initiation of
proceedings</header><text>The Attorney General, in consultation with the
Secretary, may initiate a proceeding in United States District Court to recover
a civil money penalty under section 321. The Attorney General may not initiate
an action under this section with respect to any violation described in section
321 after the expiration of the 6-year period beginning on the date on which
such violation was alleged to have occurred. The Attorney General may initiate
an action under this section by filing a complaint pursuant to Rule 4 of the
Federal Rules of Civil Procedure.</text>
</subsection><subsection id="ID65d86522a72146bcb811cbdbb0b55c93"><enum>(b)</enum><header>Scope of
penalty</header><text>In determining the amount or scope of any penalty sought
pursuant to section 321, the Attorney General shall take into account—</text>
<paragraph id="ID54185ab5e11f4c2bb46854a7123f608f"><enum>(1)</enum><text>the nature of
claims and the circumstances under which they were presented;</text>
</paragraph><paragraph id="ID7f8b8d10cb5746aab05ed068574c0588"><enum>(2)</enum><text>the degree of
culpability, history of prior offenses, and financial condition of the person
against whom the claim is brought; and</text>
</paragraph><paragraph id="ID04a7e32eafbf4c34928abaf68555b6ff"><enum>(3)</enum><text>such other
matters as justice may require.</text>
</paragraph></subsection><subsection id="IDbd8b86755c0f47ef802b642365b6fa6f"><enum>(c)</enum><header>Recovery of
penalties</header>
<paragraph id="ID909561dd6f46465d876a1b64bee8d9b5"><enum>(1)</enum><header>In
general</header><text>Civil money penalties imposed under this section may be
recovered in a civil action in the name of the United States brought in United
States district court for the district where the claim was presented, or where
the claimant resides, as determined by the Attorney General. Amounts recovered
under this section shall be paid to the United States and deposited as
miscellaneous receipts of the Treasury of the United States.</text>
</paragraph><paragraph id="ID7c364ad712644a2a83e4f95a1f91c50c"><enum>(2)</enum><header>Deduction from
amounts owing</header><text>The amount of any penalty may be deducted from any
sum then or later owing by the United States or a State to the person against
whom the penalty has been assessed.</text>
</paragraph></subsection><subsection id="IDde7bfc69a0704214bb41582c56cfeed5"><enum>(d)</enum><header>Injunctive
relief</header><text>Whenever the Attorney General in consultation with the
Secretary has reason to believe that any person has engaged, is engaging, or is
about to engage in any activity which makes the person subject to a civil
monetary penalty under section 321, the Attorney General may bring an action in
an appropriate district court of the United States (or, if applicable, a United
States court of any territory) to enjoin such activity, or to enjoin the person
from concealing, removing, encumbering, or disposing of assets which may be
required in order to pay a civil monetary penalty if any such penalty were to
be imposed or to seek other appropriate relief.</text>
</subsection><subsection id="IDc68a8998feaa41af9e28c4f611acc50d"><enum>(e)</enum><header>Agency</header><text>A
principal is jointly and severally liable with the principal's agent for
penalties under section 321 for the actions of the principal's agent acting
within the scope of the agency.</text>
</subsection></section><section id="IDd196896eb2544d80a024ede2d8e8fda8"><enum>323.</enum><header>Civil action
by individuals</header>
<subsection id="ID28f6a7c9328341ab95370070aba23637"><enum>(a)</enum><header>In
general</header><text>Any individual whose rights under this Act have been
knowingly or negligently violated may bring a civil action to recover—</text>
<paragraph id="ID7a9992cee21f40f28f7c2fdf38e3d760"><enum>(1)</enum><text>such preliminary
and equitable relief as the court determines to be appropriate; and</text>
</paragraph><paragraph id="ID2e4fcb042cc7423c93893c455c59a10e"><enum>(2)</enum><text>the greater of
compensatory damages or liquidated damages of $5,000.</text>
</paragraph></subsection><subsection id="ID7e424a4c77b14cc8a41e1ef91ae17acd"><enum>(b)</enum><header>Punitive
damages</header><text>In any action brought under this section in which the
individual has prevailed because of a knowing violation of a provision of this
Act, the court may, in addition to any relief awarded under subsection (a),
award such punitive damages as may be warranted.</text>
</subsection><subsection id="IDe33d46a0badf47b28f78acff90e4f49c"><enum>(c)</enum><header>Attorney's
fees</header><text>In the case of a civil action brought under subsection (a)
in which the individual has substantially prevailed, the court may assess
against the respondent a reasonable attorney's fee and other litigation costs
and expenses (including expert fees) reasonably incurred.</text>
</subsection><subsection id="IDff2ed5251d474bb9937263440423d9d4"><enum>(d)</enum><header>Limitation</header><text>No
action may be commenced under this section more than 3 years after the date on
which the violation was or should reasonably have been discovered.</text>
</subsection><subsection id="IDf5432c1833204f8aa393754cb136bd37"><enum>(e)</enum><header>Agency</header><text>A
principal is jointly and severally liable with the principal's agent for
damages under this section for the actions of the principal's agent acting
within the scope of the agency.</text>
</subsection><subsection id="id6331AAB01A6F458D8BCF350B0759CA17"><enum>(f)</enum><header>Venue; service
of process</header>
<paragraph id="id6C5568742E7541348D668FF5A7D218DC"><enum>(1)</enum><header>Venue</header><text>An
action shall be brought under subsection (a) in the district court of the
United States that meets applicable requirements relating to venue under
section 1391 of title 28, United States Code.</text>
</paragraph><paragraph id="id73EE2CB9E022403C85DC790D51DF85C1"><enum>(2)</enum><header>Service of
process</header><text>In an action brought under subsection (a), process may be
served in any district in which the defendant—</text>
<subparagraph id="idFC26837329C242A39B0852654BB1A9EA"><enum>(A)</enum><text>is an inhabitant;
and</text>
</subparagraph><subparagraph id="idB4A9C5B6B515427DB7491C3198ED3136"><enum>(B)</enum><text>may be
found.</text>
</subparagraph></paragraph></subsection><subsection id="ID64bc917a88e54991ae5016a2e2002cd0"><enum>(g)</enum><header>Additional
remedies</header><text>The equitable relief or damages that may be available
under this section shall be in addition to any other lawful remedy or award
that may be available.</text>
</subsection></section><section id="ID43d215941b1c4b4fb5ecfff788e08b67"><enum>324.</enum><header>Enforcement by
State attorneys general</header>
<subsection id="ID0b158cb87d0a49eda2b6579659e38b30"><enum>(a)</enum><header>In
general</header>
<paragraph id="ID77ed4d1714844a1bbda76cf51d405bef"><enum>(1)</enum><header>Civil
actions</header><text>In any case in which the attorney general of a State or
any State or local law enforcement agency authorized by the State attorney
general or by State law to prosecute violations of consumer protection laws,
has reason to believe that an interest of the residents of that State has been
or is threatened or adversely affected by the engagement of a person in a
practice that is prohibited under this subtitle, the State or local law
enforcement agency on behalf of the residents of the agency's jurisdiction, may
bring a civil action on behalf of the residents of the State or jurisdiction in
a district court of the United States of appropriate jurisdiction to—</text>
<subparagraph id="ID27763bd83bfb4ce3a722ade429a13eff"><enum>(A)</enum><text>enjoin that act
or practice;</text>
</subparagraph><subparagraph id="IDac128f47db894736a118dcbc1e03a4d8"><enum>(B)</enum><text>enforce
compliance with this subtitle; or</text>
</subparagraph><subparagraph id="ID9d994fb4f93943479e3208ebeabb6a14"><enum>(C)</enum><text>obtain civil
penalties of not more than $1,000 per day per individual whose personally
identifiable information was, or is reasonably believed to have been, accessed
or acquired by an unauthorized person, up to a maximum of $50,000 per
day.</text>
</subparagraph></paragraph><paragraph id="ID6fa4826e0ac74e02be0bc9182c4f9db4"><enum>(2)</enum><header>Notice</header>
<subparagraph id="IDee7333b7a54d4188b2cc775e78bf62f0"><enum>(A)</enum><header>In
general</header><text>Prior to filing an action under paragraph (1), the
attorney general of the State involved shall provide to the Attorney General
and Secretary—</text>
<clause id="ID8eb3d5dc868b4780923b0f1249fe24e5"><enum>(i)</enum><text>written notice of
the action; and</text>
</clause><clause id="ID10beeb11dff64193a5e20f9f2fd8a66b"><enum>(ii)</enum><text>a
copy of the complaint for the action.</text>
</clause></subparagraph><subparagraph id="ID157831deca354753b8b79e4154507f6e"><enum>(B)</enum><header>Exemption</header><text>Subparagraph
(A) shall not apply with respect to the filing of an action by a State attorney
general under this subsection, if the attorney general of a State determines
that it is not feasible to provide the notice described in this paragraph
before the filing of the action.</text>
</subparagraph><subparagraph id="ID90852e88754b47f28b0a77e3c693f5e4"><enum>(C)</enum><header>Notification
when practicable</header><text>In an action described under subparagraph (B),
the attorney general of a State shall provide the written notice and a copy of
the complaint to the Attorney General and Secretary as soon after the filing of
the complaint as practicable.</text>
</subparagraph></paragraph></subsection><subsection id="ID1b5a62f6795b498cb49a45afe44d386d"><enum>(b)</enum><header>Federal
proceedings</header><text>Upon receiving notice under subsection (a)(2), the
Attorney General in consultation with the Secretary, shall, have the right
to—</text>
<paragraph id="IDbadd57a8d91f4cafbfb9e497dae4c213"><enum>(1)</enum><text>move to stay the
action, pending the final disposition of a pending Federal proceeding or
action;</text>
</paragraph><paragraph id="ID6b7f80b9ae684ed58b223173ad1ea4ae"><enum>(2)</enum><text>intervene in an
action brought under subsection (a)(2); and</text>
</paragraph><paragraph id="IDa44148f0d63e4fd68f90b8ae9ffc2440"><enum>(3)</enum><text>file petitions
for appeal.</text>
</paragraph></subsection><subsection id="ID2a8537ad68714fa5bde2f96327673006"><enum>(c)</enum><header>Pending
proceedings</header><text>If the Attorney General has instituted a proceeding
or action for a violation of this subtitle or any regulations thereunder, no
attorney general of a State may, during the pendency of such proceeding or
action, bring an action under this subtitle against any defendant named in such
criminal proceeding or civil action for any violation that is alleged in that
proceeding or action.</text>
</subsection><subsection id="IDeaf9fe4ead574160a0a96ad83ec739ef"><enum>(d)</enum><header>Rule of
construction</header><text>For purposes of bringing any civil action under
subsection (a), nothing in this subtitle regarding notification shall be
construed to prevent an attorney general of a State from exercising the powers
conferred on such attorney general by the laws of that State to—</text>
<paragraph id="ID094dfbe4e22b4d31875888f91a538e33"><enum>(1)</enum><text>conduct
investigations;</text>
</paragraph><paragraph id="IDb2c949dfee4b4c9e92982baed2164bac"><enum>(2)</enum><text>administer oaths
or affirmations; or</text>
</paragraph><paragraph id="ID65fa1d1c2a9a428896084ccaf44743b3"><enum>(3)</enum><text>compel the
attendance of witnesses or the production of documentary and other
evidence.</text>
</paragraph></subsection><subsection id="IDc11c002c784f4970b9dbf56fcfbdb413"><enum>(e)</enum><header>Venue; service
of process</header>
<paragraph id="ID4e3a5e27005945e1a8a74fc381078cc4"><enum>(1)</enum><header>Venue</header><text>Any
action brought under subsection (a) may be brought in the district court of the
United States that meets applicable requirements relating to venue under
section 1391 of title 28, United States Code.</text>
</paragraph><paragraph id="ID6081ff790ac943e4bebd4a677aac9b15"><enum>(2)</enum><header>Service of
process</header><text>In an action brought under subsection (a), process may be
served in any district in which the defendant—</text>
<subparagraph id="ID49756dc9390e4beb96e5d7d38d7292b0"><enum>(A)</enum><text>is an inhabitant;
or</text>
</subparagraph><subparagraph id="IDe1d36540dba54ed491a32b4321bbc8fc"><enum>(B)</enum><text>may be
found.</text>
</subparagraph></paragraph></subsection></section><section id="ID9e966b054a6447a5b825b8b0589531f7"><enum>325.</enum><header>Protection for
whistleblower</header>
<subsection id="IDbb53b15f865d4c3fa9580039a65739ad"><enum>(a)</enum><header>Prohibition
against discrimination</header><text>An employer may not discharge, demote,
suspend, threaten, harass, retaliate against, or in any other manner
discriminate or cause any employer to discriminate against an employee in the
terms and conditions of employment because of any lawful act committed by the
employee to provide information or cause information to be provided to a State
or Federal official relating to an actual or suspected violation of this Act by
an employer or an employee of an employer.</text>
</subsection><subsection id="IDc03bb81e1ae4422082c8086393ab7dab"><enum>(b)</enum><header>Enforcement
actions</header>
<paragraph id="id40BE5FC61E224D34BBFCFD1A97DB5110"><enum>(1)</enum><header>In
general</header><text>Any employee or former employee who alleges discharge or
discrimination by any person in violation of subsection (a) may seek relief
under subsection (c), by—</text>
<subparagraph id="id592078BAC95A46FF8429C05FB4721DA4"><enum>(A)</enum><text>filing a
complaint with the Secretary of Labor; or</text>
</subparagraph><subparagraph id="id346D4B8CA6F8487DB0BC3FEB78105D06"><enum>(B)</enum><text>if the Secretary
has not issued a final decision within 180 days of the filing of the complaint
under subparagraph (A), and there is no showing that such delay is due to the
bad faith of the claimant, bringing an action at law or equity for de novo
review in the appropriate district court of the United States, which shall have
jurisdiction over such an action without regard to the amount in
controversy.</text>
</subparagraph></paragraph><paragraph id="ID24868a9fd45b42f9b6b2ab46577182f7"><enum>(2)</enum><header>Procedures</header>
<subparagraph id="idA4DC136C7EF049E4AD8544FC5BC7D6B1"><enum>(A)</enum><header>In
general</header><text>Except as provided in this paragraph, the complaint
procedures contained in section 42121(b) of title 49, United States Code, shall
apply with respect to a complaint filed under paragraph (1)(A).</text>
</subparagraph><subparagraph id="ID7d29eff65e9d4f6b89b3d3db21e6dd62"><enum>(B)</enum><header>Exception</header><text>With
respect to a complaint filed under paragraph (1)(A), the notification provided
for under section 42121(b)(1) of title 49, United States Code, (as required
under subparagraph (A)) shall be made to the person named in the complaint and
to the employer.</text>
</subparagraph><subparagraph id="ID928fafbe17e84a7a968792e8ac79e0c8"><enum>(C)</enum><header>Burden of
proof</header><text>The legal burdens of proof contained in section 42121(b) of
title 49, United States Code, shall apply to an action brought under paragraph
(1)(B).</text>
</subparagraph><subparagraph id="IDe870491f31d4472db143a4ddd8383fdb"><enum>(D)</enum><header>Statute of
limitations</header><text>An action shall be filed under paragraph (1)(B), not
later than 2 years after the date on which the alleged violation occurs.</text>
</subparagraph></paragraph></subsection><subsection id="IDe6bcd2c3929b4b7dbccab011703f048e"><enum>(c)</enum><header>Remedies</header>
<paragraph id="idC26846DE6EA147E9B3C53B9064725B6C"><enum>(1)</enum><header>In
general</header><text>If the district court determines in an action under
subsection (b)(1) that a violation of subsection (a) has occurred, the court
shall order any relief necessary to make the employee whole.</text>
</paragraph><paragraph id="id84A78F563F4A465DA8504FAE1E68DD66"><enum>(2)</enum><header>Compensatory
damages</header><text>Relief in any action under subsection (b)(1) shall
include—</text>
<subparagraph id="IDe5cfd49718694724b1a790deb8dabdaf"><enum>(A)</enum><text>reinstatement of
the employee to the employee's former position with the same seniority status
that the employee would have had but for the discrimination;</text>
</subparagraph><subparagraph id="ID136924d4dc744884a39a7162c4cb444a"><enum>(B)</enum><text>payment of the
amount of back pay, with interest, to which the employee is entitled;
and</text>
</subparagraph><subparagraph id="IDcc6a32516f4141a7bc0683abb0c3815a"><enum>(C)</enum><text>the payment of
compensation for any special damages sustained by the employee as a result of
the discrimination, including litigation costs, expert witness fees, and
reasonable attorney fees.</text>
</subparagraph></paragraph></subsection><subsection id="IDff381fc596b04c21bcd16e020c56f2c7"><enum>(d)</enum><header>Rights retained
by the employee</header><text>Nothing in this section shall be construed to
diminish or eliminate the rights, privileges, or remedies available to an
employee under any Federal or State law, or under any collective bargaining
agreement.</text>
</subsection><subsection id="id874F3E8AB7FD4C2EBD194FBA44C2AFBF"><enum>(e)</enum><header>Limitation</header><text>The
protections of this section shall not apply to any employee who—</text>
<paragraph id="ID84cd04d75f744c1aa78952b6a9a0d456"><enum>(1)</enum><text>deliberately
causes or participates in the alleged violation; or</text>
</paragraph><paragraph id="IDedfffb1cf66e427bb2279ead75066f2e"><enum>(2)</enum><text>knowingly or
recklessly provides materially false information to an individual or entity
described in subsection (a).</text>
</paragraph></subsection><subsection id="id0CC3C195A49A4E5194EB2489086775BE"><enum>(f)</enum><header>Definitions</header><text>In
this section:</text>
<paragraph id="IDcbd209a5124045eda29419f0dff531d8"><enum>(1)</enum><header>Employ</header><text>The
term <quote>employ</quote> has the meaning given such term under section 3(g)
of the Fair Labor Standards Act of 1938 (29 U.S.C. 203(g)) for the purposes of
implementing the requirements of that Act (29 U.S.C. 201, et seq.).</text>
</paragraph><paragraph id="id03D2468CCE6A418A9CFC46A05BE8332E"><enum>(2)</enum><header>Employee</header><text>The
term <term>employee</term> means an individual who is employed by an
employer.</text>
</paragraph><paragraph id="id45EBFE5F191842029E7F7EFF361B50F3"><enum>(3)</enum><header>Employer</header><text>The
term <term>employer</term> means any person who employs employees, including
any person acting directly or indirectly in the interest of any employer in
relation to an employee and includes a public agency.</text>
</paragraph></subsection><subsection id="id83B5A9AC7D724886B9E0BF249625574C"><enum>(g)</enum><header>General
prohibition against retaliation</header><text>A person described in section
102(a)(1), or any other person that receives protected health information under
this title, may not adversely affect another person, directly or indirectly,
because such person has exercised a right under this Act, disclosed information
relating to a possible violation of this Act, or associated with, or assisted,
an individual in the exercise of a right under this Act.</text>
</subsection></section></chapter></subtitle><enum>IV</enum><header>Miscellaneous</header>
<section id="ID3f0c8d15a276416890a59279a1a1f535"><enum>401.</enum><header>Relationship
to other laws</header>
<subsection id="ID0f7e6dfb4acc4c0680415e3e46acaa0b"><enum>(a)</enum><header>Federal and
State laws</header><text>Nothing in this Act shall be construed as preempting,
superseding, or repealing, explicitly or implicitly, other Federal or State
laws or regulations relating to protected health information or relating to an
individual's access to protected health information or health care services, if
such laws or regulations provide protections for the rights of individuals to
the privacy of, and access to, their health information that is greater than
those provided for in this Act.</text>
</subsection><subsection id="ID2ca34f63c1fc41259e9550d06dfca9f3"><enum>(b)</enum><header>Privileges</header><text>Nothing
in this Act shall be construed to preempt or modify any provisions of State
statutory or common law to the extent that such law concerns a privilege of a
witness or person in a court of that State. This Act shall not be construed to
supersede or modify any provision of Federal statutory or common law to the
extent such law concerns a privilege of a witness or entity in a court of the
United States. Authorizations pursuant to section 202 shall not be construed as
a waiver of any such privilege.</text>
</subsection><subsection id="ID6d623625227e439f88740c1ac85b78b9"><enum>(c)</enum><header>Certain duties
under law</header><text>Nothing in this Act shall be construed to preempt,
supersede, or modify the operation of any State law that—</text>
<paragraph id="ID8ee7f6136fcd4f7cbd28d5c6129ef127"><enum>(1)</enum><text>provides for the
reporting of vital statistics such as birth or death information;</text>
</paragraph><paragraph id="ID60046560eb764cd6b3bb150dc332dd31"><enum>(2)</enum><text>requires the
reporting of abuse or neglect information about any individual;</text>
</paragraph><paragraph id="IDfe72187806eb4db9a8880f451211232b"><enum>(3)</enum><text>regulates the
disclosure or reporting of information concerning an individual's mental
health; or</text>
</paragraph><paragraph id="IDced720468bd64edd86e6e3523327d816"><enum>(4)</enum><text>governs a minor's
rights to access protected health information or health care services.</text>
</paragraph></subsection><subsection id="ID03cd56c712d3449e9c95107f3839d661"><enum>(d)</enum><header>Federal Privacy
Act</header>
<paragraph id="ID1a7f913851e04653886d4c97b2a10289"><enum>(1)</enum><header>Medical
exemptions</header><text>Section 552a of title 5, United States Code, is
amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="id15E379F915FF4B0295345D066CA644EC" style="OLC">
<subsection id="ID54e0be29b87a4243a30e5a82b4622355"><enum>(w)</enum><header>Certain
protected health information</header><text>The head of an agency that is a
health care provider, health plan, health oversight agency, employer, insurer,
health or life insurer, school or university, or other entity who receives
protected health information under section 218 of the
<short-title>Health Information Privacy and Security
Act</short-title> shall promulgate rules, in accordance with the requirements
(including general notice) of subsections (b)(1), (b)(2), (b)(3), (c), (e) of
section 553 of this title, to exempt a system of records within the agency, to
the extent that the system of records contains protected health information (as
defined in section 4 of such Act), from all provisions of this section except
subsections (b)(6), (d), (e)(1), (e)(2), subparagraphs (A) through (C) and (E)
through (I) of subsection (e)(4), and subsections (e)(5), (e)(6), (e)(9),
(e)(12), (l), (n), (o), (p), (r), and
(u).</text>
</subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="IDe50c4cf99ba040b3bb67d62ed3179de8"><enum>(2)</enum><header>Technical
amendment</header><text>Section 552a(f)(3) of title 5, United States Code, is
amended by striking <quote>pertaining to him,</quote> and all that follows
through the semicolon and inserting <quote>pertaining to the
individual</quote>.</text>
</paragraph></subsection><subsection id="IDf25e6e60ed354fd48e102800d5e9081e"><enum>(e)</enum><header>Health
Insurance Portability and Accountability Act</header><text>The standards
governing the privacy and security of individually identifiable health
information promulgated by the Secretary of Health and Human Services under
sections 262(a) and 264 of the Health Insurance Portability and Accountability
Act of 1996 shall remain in effect to the extent that they are consistent with
this Act. The Secretary shall amend such Federal regulations as required to
make such regulations consistent with this Act.</text>
</subsection></section><section id="ID2d5e5101070d4c69b283e633461e660a"><enum>402.</enum><header>Effective
date</header>
<subsection id="ID4386d85e6257411d801d7cbd7c0ebe8a"><enum>(a)</enum><header>Effective
date</header><text>Unless specifically provided for otherwise, this Act shall
take effect on the date that is 12 months after the date of the promulgation of
the regulations required under subsection (b), or 30 months after the date of
enactment of this Act, whichever is earlier.</text>
</subsection><subsection id="IDcab62a12612a4ba2b5df02339150dfd4"><enum>(b)</enum><header>Regulations</header><text>Not
later than 12 months after the date of enactment of this Act, or as
specifically provided for otherwise, the Secretary shall promulgate regulations
implementing this Act.</text>
</subsection></section>