[Congressional Record Volume 151, Number 27 (Wednesday, March 9, 2005)]
[Senate]
[Pages S2385-S2387]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. NELSON of Florida:
  S. 570. A bill to amend title XVIII and XIX of the Social Security 
Act and title III of the Public Health Service Act to improve access to 
information about individuals' health care options and legal rights for 
care near the end of life, to promote advance care planning and 
decisionmaking so that individuals' wishes are known should they become 
unable to speak for themselves, to engage health care providers in 
disseminating information about and assisting in the preparation of 
advance directives, which include living wills and durable powers of 
attorney for health care, and for other purposes; read the first time.
  Mr. NELSON of Florida. Mr. President, I am introducing the 
Information Security and Protection Act. It has to do with a subject 
matter about which we have had breaking news over the course of the 
last several days, and that is identity theft.
  Two weeks ago we found out a company named ChoicePoint, a Georgia 
company, because of the conviction in a plea bargain with someone who 
had under false pretenses broken into the database of this information 
broker, had 400,000 individual records stolen and thus subject to the 
taking of the personal identity of those 400,000 people. Of those we 
know of, 10,000 of them are in my State, and I can tell you, having met 
with a group of Floridians we picked at random in the central Florida 
area I met with a week and a half ago, it has been a tale of 
extraordinarily horrific circumstances for these Americans when their 
identity was stolen to, No. 1, stop the theft, and then, No. 2, to 
reclaim their identity and to get back their identity, for example, 
with a credit card on which bills have been run up and therefore their 
credit becomes bad. Trying to get back their good name and their good 
credit has become a horrific process.
  One of the central Floridians I met with is a truckdriver who has a 
special license to drive trucks with hazardous materials. This 
particular individual is so frustrated because whenever he goes to this 
Government agency or that Government agency, they always send him to 
another one, saying we can't help you. There is someone out there with 
his identity who keeps violating traffic rules and laws all over the 
country and he keeps getting summonses to courts in States all over the 
country, and he can't get back his identity.
  That is just one example. Or take the example of the mom recently 
widowed, so her grown daughter takes over the paying of her bills, and 
because the mom has always been frugal, the daughter sees a charge on 
the credit card for $10,000 and thinks, well, my mom is suddenly going 
to start spending a little on herself. The daughter continues to pay 
these kinds of bills until she finally gets a call from a store in San 
Francisco and the clerk says, I want to see if you will approve this 
$26,000 charge for your mother. And she says, well, that is not my 
mother because my mother is not in San Francisco, she is here with me 
in Cocoa, FL right now. Fortunately, the game was up. They stopped that 
process, but that daughter had already paid $40,000 worth of bills 
thinking they were legitimate charges by her mother, and she will never 
get back that $40,000.
  These are just a couple of examples of identity theft. But now the 
problem has gotten to be so much larger because these data collectors, 
which I call information brokers, with the advance of technology are 
able to gather billions and billions of records. This particular 
company that has come to light over the last couple of weeks with the 
theft of 400,000 records--ChoicePoint is the name of the company--has 
stored, now listen to this, 17 to 19 billion--that is with a B--
records. With that amount of data, they virtually have information on 
every American. It is not just credit reports that are protected by the 
Fair Credit Reporting Act. It is Social Security numbers and driver's 
licenses. It is job applications. It is DNA tests. It is medical 
records.
  With this kind of information, centralized under the control of one 
company, if there is a penetration of the security of that company, 
then you see what the invasion of our privacy is about to cause.
  Indeed, we are going to be in a situation where no American has any 
privacy, and we are going to continue to go through this process until 
we say, enough already, and the people stand up and say: You have to 
protect our privacy.
  That is what the bill I am introducing, the Information Security and 
Protection Act, sets out to do. It is going to require legal 
safeguards, put some teeth in the law, that is going to require not 
just credit reports, which is covered by existing Federal law, but it 
is going to require these collectors of information who sell them for a 
profit-making business to have the safeguards to protect the consumers.
  Additionally, it is going to have the safeguards for the consumers so 
they can have access to those records and see if, in fact, they are 
correct, and if they are not, correct them and have a list of the 
people who are seeking the information about them.
  We had another case come to light a week ago, and that was the case 
of records that are missing. We do not know if they were destroyed, if 
they were lost, or if they were stolen, but they are the records of 
customers of the Bank of America. We are talking about 1.2 million 
customers. And, oh, by the way, some of those customers

[[Page S2386]]

are Federal employees who happen to have this particular card. It is 
the Federal travel card. This card is distributed additionally to the 
Members of the Senate.
  On that stolen or missing information is the very personal and 
private information of 60 Senators in this Chamber. Let's hope we do 
not become the victims of identity theft and that we have to go through 
all of these horrific experiences I have heard in talking with some of 
my constituents. But, in fact, we may. Until we find out what happened 
to those records of 1.2 million individuals, Federal employees, then we 
are subject to these kinds of traumas that come from identity theft.
  Today we have learned of a major breach at the Boca Raton based 
company called SizeNet. It is a part of Lexis-Nexis. Information that 
was accessed included names, addresses, Social Security and driver's 
license numbers; not the credit history, medical records, or financial 
information. This group said--and they put out a statement to the 
London Stock Exchange--that this was information on 32,000 U.S. 
citizens. It may have been accessed from one of the databases. The 
company said the breach, made on its legal and business information 
service, Lexis-Nexis, which had recently acquired this SizeNet unit, 
was being investigated by staff and U.S. law enforcement authorities. 
So here we have another 32,000 U.S. citizens who could possibly be the 
victims of identity theft.
  Are we going to do anything about it? I sure hope so, and I am 
hopeful that we are going to have the Congress start to take action on 
a bill Congressman Markey in the House, a Member of the House Commerce 
Committee, and I, a Member of the Senate Commerce Committee, have 
introduced.
  This bill requires the Federal Government to begin to regulate the 
products offered by information brokers. Under the legislation, the 
Federal Trade Commission would pass regulations that would empower 
consumers to have control over the personal information they have 
compiled in these databases. Consumers would be given, for the first 
time, the right to find out what files information brokers keep about 
them, and they would be given the right to make sure the information in 
the files is correct. They would be given the right to promptly correct 
the inaccurate information. They would be permitted to find out which 
people have asked for copies of their personal information.
  What would be the responsibility of the information broker? It would 
require the Federal Trade Commission to come up with standards to 
ensure that those brokers know to whom they are selling that consumer 
information and the purposes for which it is being used. Those 
information brokers would be required to safeguard and protect the 
privacy of the billions of consumer records they hold.
  Under present law, there is no protection unless you fall under a law 
such as the Fair Credit Reporting Act which protects consumer credit 
records. But all the amassing of this additional data is not protected 
under current law.
  This bill I am filing also allows Government law enforcers and 
consumers to bring tough legal actions against the brokers if they 
violate the new regulations that the FTC would promulgate. Then it 
clearly gives a nod to the States to pass their own laws that they 
believe are necessary to effectively regulate information brokers.
  This bill is not a catchall bill. This bill is meant to focus very 
narrowly on information brokers. It instructs the FTC to carve out 
appropriate regulatory exemptions that are in the public interest. So 
there is flexibility for the FTC to adjust to different circumstances.
  After the FTC passes its new regulations, then the FTC, in our 
oversight capacity, would be reporting back to us and specifically 
would be reporting to our committees--the Commerce Committees in both 
the House and the Senate--and then Congress would determine whether 
further statutory changes were necessary, as is the prerogative to 
adjust and adapt as circumstances change.
  I want to work with all the people who are involved in this 
situation. We do not want something that is overreaching, but were are 
getting to the point that with the advance of technology, something has 
to be done or virtually none of us will have any privacy.
  By the way, there is another reason to pass this legislation. We are 
in a new kind of war, and that war is against terrorists. The terrorist 
deals by stealth, and one way is to assume the identity of someone 
else. If we do not have the protections of all our identities, there is 
another source for the terrorist.
  What is it going to take to spur the Congress into action? I thank 
the time is here. We have three examples in the last 2 weeks--
ChoicePoint, Bank of America, and today Lexis-Nexis. I ask for the 
support of the Senate in passing the Information Protection and 
Security Act.
  Mr. President, I ask unanimous consent that the text of the bill be 
printed in the Record.
  There being no objection, the bill was ordered to be printed in the 
Record, as follows:

                                 S. 570

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

       (a) Short Title.--This Act may be cited as the ``Advance 
     Directives Education Act of 2005''.
       (b) Table of Contents.--The table of contents of this Act 
     is as follows:

Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Improvement of policies related to the use and portability of 
              advance directives.
Sec. 4. Increasing awareness of the importance of End-of-Life planning.
Sec. 5. GAO study and report on establishment of national advance 
              directive registry.
Sec. 6. Advance directives at State department of motor vehicles.

     SEC. 2. FINDINGS AND PURPOSES.

       (a) Findings.--Congress makes the following findings:
       (1) Every year 2,500,000 people die in the United States. 
     Eighty percent of those people die in institutions such as 
     hospitals, nursing homes, and other facilities. Chronic 
     illnesses, such as cancer and heart disease, account for 2 
     out of every 3 deaths.
       (2) In January 2004, a study published in the Journal of 
     the American Medical Association concluded that many people 
     dying in institutions have unmet medical, psychological, and 
     spiritual needs. Moreover, family members of decedents who 
     received care at home with hospice services were more likely 
     to report a favorable dying experience.
       (3) In 1997, the Supreme Court of the United States, in its 
     decisions in Washington v. Glucksberg and Vacco v. Quill, 
     reaffirmed the constitutional right of competent adults to 
     refuse unwanted medical treatment. In those cases, the Court 
     stressed the use of advance directives as a means of 
     safeguarding that right should those adults become incapable 
     of deciding for themselves.
       (4) A study published in 2002 estimated that the overall 
     prevalence of advance directives is between 15 and 20 percent 
     of the general population, despite the passage of the Patient 
     Self-Determination Act in 1990, which requires that health 
     care providers tell patients about advance directives.
       (5) Competent adults should complete advance care plans 
     stipulating their health care decisions in the event that 
     they become unable to speak for themselves. Through the 
     execution of advance directives, including living wills and 
     durable powers of attorney for health care according to the 
     laws of the State in which they reside, individuals can 
     protect their right to express their wishes and have them 
     respected.
       (b) Purposes.--The purposes of this Act are to improve 
     access to information about individuals' health care options 
     and legal rights for care near the end of life, to promote 
     advance care planning and decisionmaking so that individuals' 
     wishes are known should they become unable to speak for 
     themselves, to engage health care providers in disseminating 
     information about and assisting in the preparation of advance 
     directives, which include living wills and durable powers of 
     attorney for health care, and for other purposes.

     SEC. 3. IMPROVEMENT OF POLICIES RELATED TO THE USE AND 
                   PORTABILITY OF ADVANCE DIRECTIVES.

       (a) Medicare.--Section 1866(f) of the Social Security Act 
     (42 U.S.C. 1395cc(f)) is amended--
       (1) in paragraph (1)--
       (A) in subparagraph (B), by inserting ``and if presented by 
     the individual (or on behalf of the individual), to include 
     the content of such advance directive in a prominent part of 
     such record'' before the semicolon at the end;
       (B) in subparagraph (D), by striking ``and'' after the 
     semicolon at the end;
       (C) in subparagraph (E), by striking the period at the end 
     and inserting ``; and''; and
       (D) by inserting after subparagraph (E) the following new 
     subparagraph:
       ``(F) to provide each individual with the opportunity to 
     discuss issues relating to the information provided to that 
     individual pursuant to subparagraph (A) with an appropriately 
     trained professional.'';

[[Page S2387]]

       (2) in paragraph (3), by striking ``a written'' and 
     inserting ``an''; and
       (3) by adding at the end the following new paragraph:
       ``(5)(A) In addition to the requirements of paragraph (1), 
     a provider of services, Medicare Advantage organization, or 
     prepaid or eligible organization (as the case may be) shall 
     give effect to an advance directive executed outside the 
     State in which such directive is presented, even one that 
     does not appear to meet the formalities of execution, form, 
     or language required by the State in which it is presented to 
     the same extent as such provider or organization would give 
     effect to an advance directive that meets such requirements, 
     except that a provider or organization may decline to honor 
     such a directive if the provider or organization can 
     reasonably demonstrate that it is not an authentic expression 
     of the individual's wishes concerning his or her health care. 
     Nothing in this paragraph shall be construed to authorize the 
     administration of medical treatment otherwise prohibited by 
     the laws of the State in which the directive is presented.
       ``(B) The provisions of this paragraph shall preempt any 
     State law to the extent such law is inconsistent with such 
     provisions. The provisions of this paragraph shall not 
     preempt any State law that provides for greater portability, 
     more deference to a patient's wishes, or more latitude in 
     determining a patient's wishes.''.
       (b) Medicaid.--Section 1902(w) of the Social Security Act 
     (42 U.S.C. 1396a(w)) is amended--
       (1) in paragraph (1)--
       (A) in subparagraph (B)--
       (i) by striking ``in the individual's medical record'' and 
     inserting ``in a prominent part of the individual's current 
     medical record''; and
       (ii) by inserting ``and if presented by the individual (or 
     on behalf of the individual), to include the content of such 
     advance directive in a prominent part of such record'' before 
     the semicolon at the end;
       (B) in subparagraph (D), by striking ``and'' after the 
     semicolon at the end;
       (C) in subparagraph (E), by striking the period at the end 
     and inserting ``; and''; and
       (D) by inserting after subparagraph (E) the following new 
     subparagraph:
       ``(F) to provide each individual with the opportunity to 
     discuss issues relating to the information provided to that 
     individual pursuant to subparagraph (A) with an appropriately 
     trained professional.'';
       (2) in paragraph (4), by striking ``a written'' and 
     inserting ``an''; and
       (3) by adding at the end the following paragraph:
       ``(6)(A) In addition to the requirements of paragraph (1), 
     a provider or organization (as the case may be) shall give 
     effect to an advance directive executed outside the State in 
     which such directive is presented, even one that does not 
     appear to meet the formalities of execution, form, or 
     language required by the State in which it is presented to 
     the same extent as such provider or organization would give 
     effect to an advance directive that meets such requirements, 
     except that a provider or organization may decline to honor 
     such a directive if the provider or organization can 
     reasonably demonstrate that it is not an authentic expression 
     of the individual's wishes concerning his or her health care. 
     Nothing in this paragraph shall be construed to authorize the 
     administration of medical treatment otherwise prohibited by 
     the laws of the State in which the directive is presented.
       ``(B) The provisions of this paragraph shall preempt any 
     State law to the extent such law is inconsistent with such 
     provisions. The provisions of this paragraph shall not 
     preempt any State law that provides for greater portability, 
     more deference to a patient's wishes, or more latitude in 
     determining a patient's wishes.''.
       (c) Effective Dates.--
       (1) In general.--Subject to paragraph (2), the amendments 
     made by subsections (a) and (b) shall apply to provider 
     agreements and contracts entered into, renewed, or extended 
     under title XVIII of the Social Security Act (42 U.S.C. 1395 
     et seq.), and to State plans under title XIX of such Act (42 
     U.S.C. 1396 et seq.), on or after such date as the Secretary 
     of Health and Human Services specifies, but in no case may 
     such date be later than 1 year after the date of enactment of 
     this Act.
       (2) Extension of effective date for state law amendment.--
     In the case of a State plan under title XIX of the Social 
     Security Act (42 U.S.C. 1396 et seq.) which the Secretary of 
     Health and Human Services determines requires State 
     legislation in order for the plan to meet the additional 
     requirements imposed by the amendments made by subsection 
     (b), the State plan shall not be regarded as failing to 
     comply with the requirements of such title solely on the 
     basis of its failure to meet these additional requirements 
     before the first day of the first calendar quarter beginning 
     after the close of the first regular session of the State 
     legislature that begins after the date of enactment of this 
     Act. For purposes of the previous sentence, in the case of a 
     State that has a 2-year legislative session, each year of the 
     session is considered to be a separate regular session of the 
     State legislature.

     SEC. 4. INCREASING AWARENESS OF THE IMPORTANCE OF END-OF-LIFE 
                   PLANNING.

       Title III of the Public Health Service Act (42 U.S.C. 241 
     et seq.) is amended by adding at the end the following new 
     part:

``PART R--PROGRAMS TO INCREASE AWARENESS OF ADVANCE DIRECTIVE PLANNING 
                                 ISSUES

     ``SEC. 399Z-1. ADVANCE DIRECTIVE EDUCATION CAMPAIGNS AND 
                   INFORMATION CLEARINGHOUSES.

       ``The Secretary shall provide for the establishment of a 
     national, toll-free, information clearinghouse as well as 
     clearinghouses that the public may access to find out about 
     State-specific information regarding advance directive and 
     end-of-life decisions.''.

     SEC. 5. GAO STUDY AND REPORT ON ESTABLISHMENT OF NATIONAL 
                   ADVANCE DIRECTIVE REGISTRY.

       (a) Study.--The Comptroller General of the United States 
     shall conduct a study on the feasibility of a national 
     registry for advance directives, taking into consideration 
     the constraints created by the privacy provisions enacted as 
     a result of the Health Insurance Portability and 
     Accountability Act.
       (b) Report.--Not later than 18 months after the date of 
     enactment of this Act, the Comptroller General of the United 
     States shall submit to Congress a report on the study 
     conducted under subsection (a) together with recommendations 
     for such legislation and administrative action as the 
     Comptroller General of the United States determines to be 
     appropriate.

     SEC. 6. ADVANCE DIRECTIVES AT STATE DEPARTMENT OF MOTOR 
                   VEHICLES.

       Each State shall establish a program of providing 
     information on the advance directives clearinghouse 
     established pursuant to section 399Z-1 of the Public Health 
     Service Act to individuals who are residents of the State at 
     such State's department of motor vehicles. Such program shall 
     be modeled after the program of providing information 
     regarding organ donation established at the State's 
     department of motor vehicles, if such State has such an organ 
     donation program.
                                 ______