[Congressional Record Volume 151, Number 27 (Wednesday, March 9, 2005)]
[Senate]
[Pages S2385-S2387]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
By Mr. NELSON of Florida:
S. 570. A bill to amend title XVIII and XIX of the Social Security
Act and title III of the Public Health Service Act to improve access to
information about individuals' health care options and legal rights for
care near the end of life, to promote advance care planning and
decisionmaking so that individuals' wishes are known should they become
unable to speak for themselves, to engage health care providers in
disseminating information about and assisting in the preparation of
advance directives, which include living wills and durable powers of
attorney for health care, and for other purposes; read the first time.
Mr. NELSON of Florida. Mr. President, I am introducing the
Information Security and Protection Act. It has to do with a subject
matter about which we have had breaking news over the course of the
last several days, and that is identity theft.
Two weeks ago we found out a company named ChoicePoint, a Georgia
company, because of the conviction in a plea bargain with someone who
had under false pretenses broken into the database of this information
broker, had 400,000 individual records stolen and thus subject to the
taking of the personal identity of those 400,000 people. Of those we
know of, 10,000 of them are in my State, and I can tell you, having met
with a group of Floridians we picked at random in the central Florida
area I met with a week and a half ago, it has been a tale of
extraordinarily horrific circumstances for these Americans when their
identity was stolen to, No. 1, stop the theft, and then, No. 2, to
reclaim their identity and to get back their identity, for example,
with a credit card on which bills have been run up and therefore their
credit becomes bad. Trying to get back their good name and their good
credit has become a horrific process.
One of the central Floridians I met with is a truckdriver who has a
special license to drive trucks with hazardous materials. This
particular individual is so frustrated because whenever he goes to this
Government agency or that Government agency, they always send him to
another one, saying we can't help you. There is someone out there with
his identity who keeps violating traffic rules and laws all over the
country and he keeps getting summonses to courts in States all over the
country, and he can't get back his identity.
That is just one example. Or take the example of the mom recently
widowed, so her grown daughter takes over the paying of her bills, and
because the mom has always been frugal, the daughter sees a charge on
the credit card for $10,000 and thinks, well, my mom is suddenly going
to start spending a little on herself. The daughter continues to pay
these kinds of bills until she finally gets a call from a store in San
Francisco and the clerk says, I want to see if you will approve this
$26,000 charge for your mother. And she says, well, that is not my
mother because my mother is not in San Francisco, she is here with me
in Cocoa, FL right now. Fortunately, the game was up. They stopped that
process, but that daughter had already paid $40,000 worth of bills
thinking they were legitimate charges by her mother, and she will never
get back that $40,000.
These are just a couple of examples of identity theft. But now the
problem has gotten to be so much larger because these data collectors,
which I call information brokers, with the advance of technology are
able to gather billions and billions of records. This particular
company that has come to light over the last couple of weeks with the
theft of 400,000 records--ChoicePoint is the name of the company--has
stored, now listen to this, 17 to 19 billion--that is with a B--
records. With that amount of data, they virtually have information on
every American. It is not just credit reports that are protected by the
Fair Credit Reporting Act. It is Social Security numbers and driver's
licenses. It is job applications. It is DNA tests. It is medical
records.
With this kind of information, centralized under the control of one
company, if there is a penetration of the security of that company,
then you see what the invasion of our privacy is about to cause.
Indeed, we are going to be in a situation where no American has any
privacy, and we are going to continue to go through this process until
we say, enough already, and the people stand up and say: You have to
protect our privacy.
That is what the bill I am introducing, the Information Security and
Protection Act, sets out to do. It is going to require legal
safeguards, put some teeth in the law, that is going to require not
just credit reports, which is covered by existing Federal law, but it
is going to require these collectors of information who sell them for a
profit-making business to have the safeguards to protect the consumers.
Additionally, it is going to have the safeguards for the consumers so
they can have access to those records and see if, in fact, they are
correct, and if they are not, correct them and have a list of the
people who are seeking the information about them.
We had another case come to light a week ago, and that was the case
of records that are missing. We do not know if they were destroyed, if
they were lost, or if they were stolen, but they are the records of
customers of the Bank of America. We are talking about 1.2 million
customers. And, oh, by the way, some of those customers
[[Page S2386]]
are Federal employees who happen to have this particular card. It is
the Federal travel card. This card is distributed additionally to the
Members of the Senate.
On that stolen or missing information is the very personal and
private information of 60 Senators in this Chamber. Let's hope we do
not become the victims of identity theft and that we have to go through
all of these horrific experiences I have heard in talking with some of
my constituents. But, in fact, we may. Until we find out what happened
to those records of 1.2 million individuals, Federal employees, then we
are subject to these kinds of traumas that come from identity theft.
Today we have learned of a major breach at the Boca Raton based
company called SizeNet. It is a part of Lexis-Nexis. Information that
was accessed included names, addresses, Social Security and driver's
license numbers; not the credit history, medical records, or financial
information. This group said--and they put out a statement to the
London Stock Exchange--that this was information on 32,000 U.S.
citizens. It may have been accessed from one of the databases. The
company said the breach, made on its legal and business information
service, Lexis-Nexis, which had recently acquired this SizeNet unit,
was being investigated by staff and U.S. law enforcement authorities.
So here we have another 32,000 U.S. citizens who could possibly be the
victims of identity theft.
Are we going to do anything about it? I sure hope so, and I am
hopeful that we are going to have the Congress start to take action on
a bill Congressman Markey in the House, a Member of the House Commerce
Committee, and I, a Member of the Senate Commerce Committee, have
introduced.
This bill requires the Federal Government to begin to regulate the
products offered by information brokers. Under the legislation, the
Federal Trade Commission would pass regulations that would empower
consumers to have control over the personal information they have
compiled in these databases. Consumers would be given, for the first
time, the right to find out what files information brokers keep about
them, and they would be given the right to make sure the information in
the files is correct. They would be given the right to promptly correct
the inaccurate information. They would be permitted to find out which
people have asked for copies of their personal information.
What would be the responsibility of the information broker? It would
require the Federal Trade Commission to come up with standards to
ensure that those brokers know to whom they are selling that consumer
information and the purposes for which it is being used. Those
information brokers would be required to safeguard and protect the
privacy of the billions of consumer records they hold.
Under present law, there is no protection unless you fall under a law
such as the Fair Credit Reporting Act which protects consumer credit
records. But all the amassing of this additional data is not protected
under current law.
This bill I am filing also allows Government law enforcers and
consumers to bring tough legal actions against the brokers if they
violate the new regulations that the FTC would promulgate. Then it
clearly gives a nod to the States to pass their own laws that they
believe are necessary to effectively regulate information brokers.
This bill is not a catchall bill. This bill is meant to focus very
narrowly on information brokers. It instructs the FTC to carve out
appropriate regulatory exemptions that are in the public interest. So
there is flexibility for the FTC to adjust to different circumstances.
After the FTC passes its new regulations, then the FTC, in our
oversight capacity, would be reporting back to us and specifically
would be reporting to our committees--the Commerce Committees in both
the House and the Senate--and then Congress would determine whether
further statutory changes were necessary, as is the prerogative to
adjust and adapt as circumstances change.
I want to work with all the people who are involved in this
situation. We do not want something that is overreaching, but were are
getting to the point that with the advance of technology, something has
to be done or virtually none of us will have any privacy.
By the way, there is another reason to pass this legislation. We are
in a new kind of war, and that war is against terrorists. The terrorist
deals by stealth, and one way is to assume the identity of someone
else. If we do not have the protections of all our identities, there is
another source for the terrorist.
What is it going to take to spur the Congress into action? I thank
the time is here. We have three examples in the last 2 weeks--
ChoicePoint, Bank of America, and today Lexis-Nexis. I ask for the
support of the Senate in passing the Information Protection and
Security Act.
Mr. President, I ask unanimous consent that the text of the bill be
printed in the Record.
There being no objection, the bill was ordered to be printed in the
Record, as follows:
S. 570
Be it enacted by the Senate and House of Representatives of
the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Advance
Directives Education Act of 2005''.
(b) Table of Contents.--The table of contents of this Act
is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Improvement of policies related to the use and portability of
advance directives.
Sec. 4. Increasing awareness of the importance of End-of-Life planning.
Sec. 5. GAO study and report on establishment of national advance
directive registry.
Sec. 6. Advance directives at State department of motor vehicles.
SEC. 2. FINDINGS AND PURPOSES.
(a) Findings.--Congress makes the following findings:
(1) Every year 2,500,000 people die in the United States.
Eighty percent of those people die in institutions such as
hospitals, nursing homes, and other facilities. Chronic
illnesses, such as cancer and heart disease, account for 2
out of every 3 deaths.
(2) In January 2004, a study published in the Journal of
the American Medical Association concluded that many people
dying in institutions have unmet medical, psychological, and
spiritual needs. Moreover, family members of decedents who
received care at home with hospice services were more likely
to report a favorable dying experience.
(3) In 1997, the Supreme Court of the United States, in its
decisions in Washington v. Glucksberg and Vacco v. Quill,
reaffirmed the constitutional right of competent adults to
refuse unwanted medical treatment. In those cases, the Court
stressed the use of advance directives as a means of
safeguarding that right should those adults become incapable
of deciding for themselves.
(4) A study published in 2002 estimated that the overall
prevalence of advance directives is between 15 and 20 percent
of the general population, despite the passage of the Patient
Self-Determination Act in 1990, which requires that health
care providers tell patients about advance directives.
(5) Competent adults should complete advance care plans
stipulating their health care decisions in the event that
they become unable to speak for themselves. Through the
execution of advance directives, including living wills and
durable powers of attorney for health care according to the
laws of the State in which they reside, individuals can
protect their right to express their wishes and have them
respected.
(b) Purposes.--The purposes of this Act are to improve
access to information about individuals' health care options
and legal rights for care near the end of life, to promote
advance care planning and decisionmaking so that individuals'
wishes are known should they become unable to speak for
themselves, to engage health care providers in disseminating
information about and assisting in the preparation of advance
directives, which include living wills and durable powers of
attorney for health care, and for other purposes.
SEC. 3. IMPROVEMENT OF POLICIES RELATED TO THE USE AND
PORTABILITY OF ADVANCE DIRECTIVES.
(a) Medicare.--Section 1866(f) of the Social Security Act
(42 U.S.C. 1395cc(f)) is amended--
(1) in paragraph (1)--
(A) in subparagraph (B), by inserting ``and if presented by
the individual (or on behalf of the individual), to include
the content of such advance directive in a prominent part of
such record'' before the semicolon at the end;
(B) in subparagraph (D), by striking ``and'' after the
semicolon at the end;
(C) in subparagraph (E), by striking the period at the end
and inserting ``; and''; and
(D) by inserting after subparagraph (E) the following new
subparagraph:
``(F) to provide each individual with the opportunity to
discuss issues relating to the information provided to that
individual pursuant to subparagraph (A) with an appropriately
trained professional.'';
[[Page S2387]]
(2) in paragraph (3), by striking ``a written'' and
inserting ``an''; and
(3) by adding at the end the following new paragraph:
``(5)(A) In addition to the requirements of paragraph (1),
a provider of services, Medicare Advantage organization, or
prepaid or eligible organization (as the case may be) shall
give effect to an advance directive executed outside the
State in which such directive is presented, even one that
does not appear to meet the formalities of execution, form,
or language required by the State in which it is presented to
the same extent as such provider or organization would give
effect to an advance directive that meets such requirements,
except that a provider or organization may decline to honor
such a directive if the provider or organization can
reasonably demonstrate that it is not an authentic expression
of the individual's wishes concerning his or her health care.
Nothing in this paragraph shall be construed to authorize the
administration of medical treatment otherwise prohibited by
the laws of the State in which the directive is presented.
``(B) The provisions of this paragraph shall preempt any
State law to the extent such law is inconsistent with such
provisions. The provisions of this paragraph shall not
preempt any State law that provides for greater portability,
more deference to a patient's wishes, or more latitude in
determining a patient's wishes.''.
(b) Medicaid.--Section 1902(w) of the Social Security Act
(42 U.S.C. 1396a(w)) is amended--
(1) in paragraph (1)--
(A) in subparagraph (B)--
(i) by striking ``in the individual's medical record'' and
inserting ``in a prominent part of the individual's current
medical record''; and
(ii) by inserting ``and if presented by the individual (or
on behalf of the individual), to include the content of such
advance directive in a prominent part of such record'' before
the semicolon at the end;
(B) in subparagraph (D), by striking ``and'' after the
semicolon at the end;
(C) in subparagraph (E), by striking the period at the end
and inserting ``; and''; and
(D) by inserting after subparagraph (E) the following new
subparagraph:
``(F) to provide each individual with the opportunity to
discuss issues relating to the information provided to that
individual pursuant to subparagraph (A) with an appropriately
trained professional.'';
(2) in paragraph (4), by striking ``a written'' and
inserting ``an''; and
(3) by adding at the end the following paragraph:
``(6)(A) In addition to the requirements of paragraph (1),
a provider or organization (as the case may be) shall give
effect to an advance directive executed outside the State in
which such directive is presented, even one that does not
appear to meet the formalities of execution, form, or
language required by the State in which it is presented to
the same extent as such provider or organization would give
effect to an advance directive that meets such requirements,
except that a provider or organization may decline to honor
such a directive if the provider or organization can
reasonably demonstrate that it is not an authentic expression
of the individual's wishes concerning his or her health care.
Nothing in this paragraph shall be construed to authorize the
administration of medical treatment otherwise prohibited by
the laws of the State in which the directive is presented.
``(B) The provisions of this paragraph shall preempt any
State law to the extent such law is inconsistent with such
provisions. The provisions of this paragraph shall not
preempt any State law that provides for greater portability,
more deference to a patient's wishes, or more latitude in
determining a patient's wishes.''.
(c) Effective Dates.--
(1) In general.--Subject to paragraph (2), the amendments
made by subsections (a) and (b) shall apply to provider
agreements and contracts entered into, renewed, or extended
under title XVIII of the Social Security Act (42 U.S.C. 1395
et seq.), and to State plans under title XIX of such Act (42
U.S.C. 1396 et seq.), on or after such date as the Secretary
of Health and Human Services specifies, but in no case may
such date be later than 1 year after the date of enactment of
this Act.
(2) Extension of effective date for state law amendment.--
In the case of a State plan under title XIX of the Social
Security Act (42 U.S.C. 1396 et seq.) which the Secretary of
Health and Human Services determines requires State
legislation in order for the plan to meet the additional
requirements imposed by the amendments made by subsection
(b), the State plan shall not be regarded as failing to
comply with the requirements of such title solely on the
basis of its failure to meet these additional requirements
before the first day of the first calendar quarter beginning
after the close of the first regular session of the State
legislature that begins after the date of enactment of this
Act. For purposes of the previous sentence, in the case of a
State that has a 2-year legislative session, each year of the
session is considered to be a separate regular session of the
State legislature.
SEC. 4. INCREASING AWARENESS OF THE IMPORTANCE OF END-OF-LIFE
PLANNING.
Title III of the Public Health Service Act (42 U.S.C. 241
et seq.) is amended by adding at the end the following new
part:
``PART R--PROGRAMS TO INCREASE AWARENESS OF ADVANCE DIRECTIVE PLANNING
ISSUES
``SEC. 399Z-1. ADVANCE DIRECTIVE EDUCATION CAMPAIGNS AND
INFORMATION CLEARINGHOUSES.
``The Secretary shall provide for the establishment of a
national, toll-free, information clearinghouse as well as
clearinghouses that the public may access to find out about
State-specific information regarding advance directive and
end-of-life decisions.''.
SEC. 5. GAO STUDY AND REPORT ON ESTABLISHMENT OF NATIONAL
ADVANCE DIRECTIVE REGISTRY.
(a) Study.--The Comptroller General of the United States
shall conduct a study on the feasibility of a national
registry for advance directives, taking into consideration
the constraints created by the privacy provisions enacted as
a result of the Health Insurance Portability and
Accountability Act.
(b) Report.--Not later than 18 months after the date of
enactment of this Act, the Comptroller General of the United
States shall submit to Congress a report on the study
conducted under subsection (a) together with recommendations
for such legislation and administrative action as the
Comptroller General of the United States determines to be
appropriate.
SEC. 6. ADVANCE DIRECTIVES AT STATE DEPARTMENT OF MOTOR
VEHICLES.
Each State shall establish a program of providing
information on the advance directives clearinghouse
established pursuant to section 399Z-1 of the Public Health
Service Act to individuals who are residents of the State at
such State's department of motor vehicles. Such program shall
be modeled after the program of providing information
regarding organ donation established at the State's
department of motor vehicles, if such State has such an organ
donation program.
______