[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 323 Introduced in Senate (IS)]

<DOC>






118th CONGRESS
  1st Session
                                 S. 323

  To ensure the privacy of pregnancy termination or loss information 
        under the HIPAA privacy regulations and the HITECH Act.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                            February 9, 2023

 Ms. Hirono (for herself, Mr. Bennet, Mrs. Gillibrand, Ms. Warren, Mr. 
Wyden, Mr. Brown, Mrs. Feinstein, Ms. Cortez Masto, Ms. Duckworth, Mrs. 
 Murray, and Mr. Booker) introduced the following bill; which was read 
 twice and referred to the Committee on Health, Education, Labor, and 
                                Pensions

_______________________________________________________________________

                                 A BILL


 
  To ensure the privacy of pregnancy termination or loss information 
        under the HIPAA privacy regulations and the HITECH Act.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Secure Access for Essential 
Reproductive Health Act of 2023'' or the ``SAFER Health Act of 2023''.

SEC. 2. ENSURING THE PRIVACY OF PREGNANCY TERMINATION OR LOSS 
              INFORMATION UNDER THE HIPAA PRIVACY REGULATIONS AND THE 
              HITECH ACT.

    (a) In General.--
            (1) Prohibition on disclosure.--Subject to paragraph (2) 
        and notwithstanding any regulations promulgated pursuant to 
        section 264(c) of the Health Insurance Portability and 
        Accountability Act of 1996 (42 U.S.C. 1320d-2 note; Public Law 
        104-191), a covered entity or a business associate of a covered 
        entity may not disclose pregnancy termination or loss 
        information of an individual in Federal, State, local, or 
        Tribal proceedings, including civil, criminal, administrative, 
        legislative, or other proceedings, without the valid 
        authorization of the individual made in accordance with section 
        164.508 of title 45, Code of Federal Regulations (or a 
        successor regulation).
            (2) Exceptions.--Paragraph (1) shall not apply in the case 
        of a disclosure of pregnancy termination or loss information of 
        an individual by a covered entity or a business associate of a 
        covered entity if--
                    (A) the pregnancy termination or loss information 
                is necessary for use in defense of a professional 
                liability action or proceeding against the covered 
                entity or business associate and the pregnancy 
                termination or loss information is disclosed by--
                            (i) the covered entity or business 
                        associate to the covered entity's or business 
                        associate's attorney or professional liability 
                        insurer or insurer's agent; or
                            (ii) the authorized attorney of the covered 
                        entity or business associate to a court or body 
                        hearing the action or proceeding; or
                    (B)(i) the pregnancy termination or loss 
                information is necessary to investigate physical harm 
                to the individual by another person directly relating 
                to the loss or termination of the pregnancy; and
                    (ii) the individual is unable to provide consent 
                due to death or incapacity.
    (b) HITECH.--
            (1) Privacy exception.--The Secretary shall revise section 
        171.202 of title 45, Code of Federal Regulations, to clarify 
        that an entity's practice of not fulfilling a request to 
        access, exchange, or use electronic health information in order 
        to comply with subsection (a) shall not be considered 
        information blocking (as defined in section 171.103 of title 
        45, Code of Federal Regulations (or a successor regulation)) if 
        the information is pregnancy termination or loss information.
            (2) Greater security.--The Secretary shall revise section 
        170.401 of title 45, Code of Federal Regulations, to require 
        that as a condition of certification (as described in that 
        section), a health IT developer (as so described) shall 
        implement practices that allow for the segregation of data 
        relating to pregnancy termination or loss information to ensure 
        compliance with subsection (a).
    (c) Preemption; Modification of State Preemption Exceptions.--
            (1) Preemption.--
                    (A) In general.--This section shall preempt any 
                State law to the extent that the State law conflicts 
                with or prevents application of this section.
                    (B) Effect.--Nothing in subparagraph (A) shall be 
                construed to preempt a State law to the extent that the 
                State law provides greater privacy protections for 
                pregnancy termination or loss information than provided 
                under this section.
            (2) Modification.--The Secretary shall revise section 
        160.203 of title 45, Code of Federal Regulations, to ensure 
        that no exception to the general preemption rule stated in that 
        section applies with respect to pregnancy termination or loss 
        information other than the exception described in paragraph 
        (1)(B).
    (d) Outreach.--The Secretary shall conduct an outreach campaign to 
ensure that covered entities, business associates of covered entities, 
the public, and affected individuals are aware of the requirements of 
this section and any revisions to regulations made pursuant to this 
section.
    (e) Procedure.--
            (1) Interim final rule.--Not later than 90 days after the 
        date of enactment of this Act, the Secretary shall revise each 
        regulation as required by this section through publication of 
        an interim final rule in the Federal Register.
            (2) Final rule.--Not later than 270 days after the date on 
        which an interim final rule is published under paragraph (1), 
        the Secretary, after providing opportunity for public comment, 
        shall publish in the Federal Register a final rule with such 
        modifications as the Secretary determines appropriate.
    (f) Definitions.--In this section:
            (1) HIPAA terms.--The terms ``business associate'', 
        ``covered entity'', and ``protected health information'' have 
        the meanings given those terms in section 160.103 of title 45, 
        Code of Federal Regulations (or a successor regulation).
            (2) Pregnancy termination or loss information.--The term 
        ``pregnancy termination or loss information'' means protected 
        health information of an individual that relates to information 
        that could reveal having or seeking an abortion or care for 
        pregnancy loss, including, without limitation, any request for, 
        or receipt of, items, services, education, counseling, or 
        referrals relating to the termination or loss of a pregnancy of 
        the individual, including abortion, miscarriage, stillbirth, 
        and ectopic pregnancy.
            (3) Secretary.--The term ``Secretary'' means the Secretary 
        of Health and Human Services.
                                 <all>