[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 3374 Introduced in Senate (IS)]
<DOC>
116th CONGRESS
2d Session
S. 3374
To amend the Public Health Service Act to protect the confidentiality
of substance use disorder patient records.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 3, 2020
Mr. Manchin (for himself, Mrs. Capito, Mr. Whitehouse, Mr. Cramer, Mrs.
Feinstein, Mr. Jones, Mr. Murphy, Mr. Tillis, Ms. Collins, Ms. Harris,
Mr. Cassidy, Ms. Klobuchar, Mr. Merkley, and Mr. King) introduced the
following bill; which was read twice and referred to the Committee on
Health, Education, Labor, and Pensions
_______________________________________________________________________
A BILL
To amend the Public Health Service Act to protect the confidentiality
of substance use disorder patient records.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ```Protecting Jessica Grubb's Legacy
Act'''.
SEC. 2. CONFIDENTIALITY AND DISCLOSURE OF RECORDS RELATING TO SUBSTANCE
USE DISORDER.
(a) Conforming Changes Relating to Substance Use Disorder.--
Subsections (a) and (h) of section 543 of the Public Health Service Act
(42 U.S.C. 290dd-2) are each amended by striking ``substance abuse''
and inserting ``substance use disorder''.
(b) Disclosures to Covered Entities Consistent With HIPAA.--
Paragraph (1) of section 543(b) of the Public Health Service Act (42
U.S.C. 290dd-2(b)) is amended to read as follows:
``(1) Consent.--The following shall apply with respect to
the contents of any record referred to in subsection (a):
``(A) Such contents may be used or disclosed in
accordance with the prior written consent of the
patient with respect to whom such record is maintained.
``(B) Once prior written consent of the patient has
been obtained, such contents may be used or disclosed
by a covered entity, business associate, or a program
subject to this section for purposes of treatment,
payment, and health care operations as permitted by the
HIPAA regulations. Any information so disclosed may
then be redisclosed in accordance with the HIPAA
regulations. Section 13405(c) of the Health Information
Technology and Clinical Health Act (42 U.S.C. 17935(c))
shall apply to all disclosures pursuant to subsection
(b)(1) of this section.
``(C) It shall be permissible for a patient's prior
written consent to be given once for all such future
uses or disclosures for purposes of treatment, payment,
and health care operations, until such time as the
patient revokes such consent in writing.
``(D) Section 13405(a) of the Health Information
Technology and Clinical Health Act (42 U.S.C. 17935(a))
shall apply to all disclosures pursuant to subsection
(b)(1) of this section.''.
(c) Disclosures of De-Identified Health Information to Public
Health Authorities.--Paragraph (2) of section 543(b) of the Public
Health Service Act (42 U.S.C. 290dd-2(b)), is amended by adding at the
end the following:
``(D) To a public health authority, so long as such
content meets the standards established in section
164.514(b) of title 45, Code of Federal Regulations (or
successor regulations) for creating de-identified
information.''.
(d) Definitions.--Section 543 of the Public Health Service Act (42
U.S.C. 290dd-2) is amended by adding at the end the following:
``(k) Definitions.--For purposes of this section:
``(1) Breach.--The term `breach' has the meaning given such
term for purposes of the HIPAA regulations.
``(2) Business associate.--The term `business associate'
has the meaning given such term for purposes of the HIPAA
regulations.
``(3) Covered entity.--The term `covered entity' has the
meaning given such term for purposes of the HIPAA regulations.
``(4) Health care operations.--The term `health care
operations' has the meaning given such term for purposes of the
HIPAA regulations.
``(5) HIPPA regulations.--The term `HIPAA regulations' has
the meaning given such term for purposes of parts 160 and 164
of title 45, Code of Federal Regulations.
``(6) Payment.--The term `payment' has the meaning given
such term for purposes of the HIPAA regulations.
``(7) Public health authority.--The term `public health
authority' has the meaning given such term for purposes of the
HIPAA regulations.
``(8) Treatment.--The term `treatment' has the meaning
given such term for purposes of the HIPAA regulations.
``(9) Unsecured protected health information.--The term
`unprotected health information' has the meaning given such
term for purposes of the HIPAA regulations.''.
(e) Use of Records in Criminal, Civil, or Administrative
Investigations, Actions, or Proceedings.--Subsection (c) of section 543
of the Public Health Service Act (42 U.S.C. 290dd-2(c)) is amended to
read as follows:
``(c) Use of Records in Criminal, Civil, or Administrative
Contexts.--Except as otherwise authorized by a court order under
subsection (b)(2)(C) or by the consent of the patient, a record
referred to in subsection (a), or testimony relaying the information
contained therein, may not be disclosed or used in any civil, criminal,
administrative, or legislative proceedings conducted by any Federal,
State, or local authority, including with respect to the following
activities:
``(1) Such record or testimony shall not be entered into
evidence in any criminal prosecution or civil action before a
Federal or State court.
``(2) Such record or testimony shall not form part of the
record for decision or otherwise be taken into account in any
proceeding before a Federal, State, or local agency.
``(3) Such record or testimony shall not be used by any
Federal, State, or local agency for a law enforcement purpose
or to conduct any law enforcement investigation.
``(4) Such record or testimony shall not be used in any
application for a warrant.''.
(f) Penalties.--Subsection (f) of section 543 of the Public Health
Service Act (42 U.S.C. 290dd-2) is amended to read as follows:
``(f) Penalties.--The provisions of sections 1176 and 1177 of the
Social Security Act shall apply to a violation of this section to the
extent and in the same manner as such provisions apply to a violation
of part C of title XI of such Act. In applying the previous sentence--
``(1) the reference to `this subsection' in subsection
(a)(2) of such section 1176 shall be treated as a reference to
`this subsection (including as applied pursuant to section
543(f) of the Public Health Service Act)'; and
``(2) in subsection (b) of such section 1176--
``(A) each reference to `a penalty imposed under
subsection (a)' shall be treated as a reference to `a
penalty imposed under subsection (a) (including as
applied pursuant to section 543(f) of the Public Health
Service Act)'; and
``(B) each reference to `no damages obtained under
subsection (d)' shall be treated as a reference to `no
damages obtained under subsection (d) (including as
applied pursuant to section 543(f) of the Public Health
Service Act)'.''.
(g) Antidiscrimination.--Section 543 of the Public Health Service
Act (42 U.S.C. 290dd-2) is amended by inserting after subsection (h)
the following:
``(i) Antidiscrimination.--
``(1) In general.--No entity shall discriminate against an
individual on the basis of information received by such entity
pursuant to an inadvertent or intentional disclosure of
records, or information contained in records, described in
subsection (a) in--
``(A) admission, access to, or treatment for health
care;
``(B) hiring, firing, or terms of employment, or
receipt of worker's compensation;
``(C) the sale, rental, or continued rental of
housing;
``(D) access to Federal, State, or local courts; or
``(E) access to, approval of, or maintenance of
social services and benefits provided or funded by
Federal, State, or local governments.
``(2) Recipients of federal funds.--No recipient of Federal
funds shall discriminate against an individual on the basis of
information received by such recipient pursuant to an
intentional or inadvertent disclosure of such records or
information contained in records described in subsection (a) in
affording access to the services provided with such funds.''.
(h) Notification in Case of Breach.--Section 543 of the Public
Health Service Act (42 U.S.C. 290dd-2), as amended by subsection (g),
is further amended by inserting after subsection (i) the following:
``(j) Notification in Case of Breach.--The provisions of section
13402 of the HITECH Act (42 U.S.C. 17932) shall apply to a program or
activity described in subsection (a), in case of a breach of records
described in subsection (a), to the same extent and in the same manner
as such provisions apply to a covered entity in the case of a breach of
unsecured protected health information.''.
(i) Regulations.--
(1) In general.--The Secretary of Health and Human
Services, in consultation with appropriate Federal agencies,
shall make such revisions to regulations as may be necessary
for implementing and enforcing the amendments made by this
section, such that such amendments shall apply with respect to
uses and disclosures of information occurring on or after the
date that is 12 months after the date of enactment of this Act.
(2) Easily understandable notice of privacy practices.--Not
later than 1 year after the date of enactment of this Act, the
Secretary of Health and Human Services, in consultation with
appropriate legal, clinical, privacy, and civil rights experts,
shall update section 164.520 of title 45, Code of Federal
Regulations, so that covered entities and entities creating or
maintaining the records described in subsection (a) provide
notice, written in plain language, of privacy practices
regarding patient records referred to in section 543(a) of the
Public Health Service Act (42 U.S.C. 290dd-2(a)), including--
(A) a statement of the patient's rights, including
self-pay patients, with respect to protected health
information and a brief description of how the
individual may exercise these rights (as required by
subsection (b)(1)(iv) of such section 164.520); and
(B) a description of each purpose for which the
covered entity is permitted or required to use or
disclose protected health information without the
patient's written authorization (as required by
subsection (b)(2) of such section 164.520).
(j) Rules of Construction.--Nothing in this Act or the amendments
made by this Act shall be construed to limit--
(1) a patient's right, as described in section 164.522 of
title 45, Code of Federal Regulations, or any successor
regulation, to request a restriction on the use or disclosure
of a record referred to in section 543(a) of the Public Health
Service Act (42 U.S.C. 290dd-2(a)) for purposes of treatment,
payment, or health care operations; or
(2) a covered entity's choice, as described in section
164.506 of title 45, Code of Federal Regulations, or any
successor regulation, to obtain the consent of the individual
to use or disclose a record referred to in such section 543(a)
to carry out treatment, payment, or health care operation.
(k) Sense of Congress.--It is the sense of the Congress that--
(1) any person treating a patient through a program or
activity with respect to which the confidentiality requirements
of section 543 of the Public Health Service Act (42 U.S.C.
290dd-2) apply is encouraged to access the applicable State-
based prescription drug monitoring program when clinically
appropriate;
(2) patients have the right to request a restriction on the
use or disclosure of a record referred to in section 543(a) of
the Public Health Service Act (42 U.S.C. 290dd-2(a)) for
treatment, payment, or health care operations;
(3) covered entities should make every reasonable effort to
the extent feasible to comply with a patient's request for a
restriction regarding such use or disclosure;
(4) for purposes of applying section 164.501 of title 45,
Code of Federal Regulations, the definition of health care
operations shall have the meaning given such term in such
section, except that clause (v) of paragraph (6) shall not
apply; and
(5) programs creating records referred to in section 543(a)
of the Public Health Service Act (42 U.S.C. 290dd-2(a)) should
receive positive incentives for discussing with their patients
the benefits to consenting to share such records.
<all>