A bill to provide individuals with access to health information of which they are a subject, ensure personal privacy with respect to health-care-related information, impose criminal and civil penalties for unauthorized use of protected health information, to provide for the strong enforcement of these rights, and to protect States' rights.
Subtitle B: Establishment of Safeguards - Requires specified parties to establish safeguards to ensure the confidentiality, security, accuracy, and integrity of protected health information. Mandates development of model safeguard guidelines. Requires specified parties to establish a record of disclosures not related to payment or treatment.
Title II: Restrictions on Use and Disclosure - Prohibits specified parties from disclosing protected health information, except as authorized under this title. Allows disclosure if authorized by the information subject. Mandates model written authorizations and model limitations. Provides for segregation of files on request, authorization revocation, and records of authorizations and revocations.
(Sec. 203) Sets forth rules governing authorizations for disclosure of protected information for purposes other than for treatment or payment. Mandates model authorizations.
(Sec. 204) Allows any person to disclose protected health information: (1) in order to allay or remedy a threat of imminent physical or mental harm to an information subject; and (2) if there is an identifiable threat of serious injury or death to an identifiable individual or group and other requirements are met.
(Sec. 205) Authorizes disclosure to: (1) a public health authority; (2) certain protection and advocacy agencies if an individual is vulnerable to abuse or neglect by an agency providing health or social services; (3) a health oversight agency, under specified circumstances; and (4) on court order, a law enforcement authority.
(Sec. 209) Regulates disclosure: (1) to next of kin; and (2) in directories of individuals admitted to a facility.
(Sec. 210) Applies the requirements and protections of specified parts of the Code of Federal Regulations to research conducted by all research facilities using personally identifiable health information. Directs the Secretary of Health and Human Services to report to the Congress whether written informed consent should be required and, if so, under what circumstances, before personally identifiable data can be used for medical research.
(Sec. 211) Allows specified parties to disclose for certain judicial and administrative purposes.
(Sec. 212) Sets forth a sequence regulating who may exercise an individual's rights under this Act when the individual cannot knowingly or effectively do so, designating first a person named in a health care power of attorney, then an individual authorized by law or by an instrument recognized under law to act as the individual's representative, then next of kin, and last the health care provider, in each case moving to the next level if the person cannot be contacted after a reasonable effort. Sets forth provisions concerning: (1) the rights of minors; and (2) deceased individuals.
(Sec. 213) Prohibits retaliation for the exercise of rights under this Act or disclosure of information regarding a possible violation of this Act.
Title III: Office of Health Information Privacy of the Department of Health and Human Services - Subtitle A: Designation - Establishes the Office of Health Information Privacy, including in its duties receiving and investigating violation complaints and providing for the conduct of audits.
Subtitle B: Enforcement - Chapter 1: Criminal Provisions - Amends the Federal criminal code to impose criminal penalties for knowingly and intentionally obtaining or disclosing protected health information in violation of title II of this Act.
(Sec. 312) Mandates regulations and procedures to permit the debarment of specified parties from receiving benefits under any Federal health programs if the managers or officers are found guilty of such obtaining or disclosing. Authorizes the Attorney General to provide advice, technical assistance, and guidance to reduce improper disclosure.
Chapter 2: Civil Sanctions - Imposes civil monetary penalties on specified parties if the Office determines a party has substantially and materially failed to comply with this Act.
(Sec. 323) Allows any individual whose rights under this Act have been knowingly or negligently violated to bring a civil action to recover preliminary and equitable relief, compensatory (or specified liquidated) damages, punitive damages (for knowing violations), and attorney's fees. Sets a time limit for the commencement of actions.
Title IV: Miscellaneous - Amends the Privacy Act of 1974 to require an agency that receives protected health information to promulgate rules to exempt a system of records within the agency from all but specified provisions of that Act.
Introduced in Senate
Sponsor introductory remarks on measure. (CR S2506-2507)
Read twice and referred to the Committee on HELP.
Sponsor introductory remarks on measure. (CR S11779)
checking server…
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line