‘Protecting Jessica Grubb’s Legacy Act'

II 116TH CONGRESS 2D SESSION S. 3374 To amend the Public Health Service Act to protect the confidentiality of substance use disorder patient records. IN THE SENATE OF THE UNITED STATES MARCH 3, 2020 Mr. MANCHIN (for himself, Mrs. CAPITO, Mr. WHITEHOUSE, Mr. CRAMER, Mrs. FEINSTEIN, Mr. JONES, Mr. MURPHY, Mr. TILLIS, Ms. COLLINS, Ms. HARRIS, Mr. CASSIDY, Ms. KLOBUCHAR, Mr. MERKLEY, and Mr. KING) introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions A BILL To amend the Public Health Service Act to protect the confidentiality of substance use disorder patient records. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘ ‘Protecting Jessica 4 Grubb’s Legacy Act’ ’’. 5 SEC. 2. CONFIDENTIALITY AND DISCLOSURE OF RECORDS 6 RELATING TO SUBSTANCE USE DISORDER. 7 (a) CONFORMING CHANGES RELATING TO SUB- 8 STANCE USE DISORDER.—Subsections (a) and (h) of sec- 9 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 3374 IS tion 543 of the Public Health Service Act (42 U.S.C. 1 290dd–2) are each amended by striking ‘‘substance 2 abuse’’ and inserting ‘‘substance use disorder’’. 3 (b) DISCLOSURES TO COVERED ENTITIES CON- 4 SISTENT WITH HIPAA.—Paragraph (1) of section 543(b) 5 of the Public Health Service Act (42 U.S.C. 290dd–2(b)) 6 is amended to read as follows: 7 ‘‘(1) CONSENT.—The following shall apply with 8 respect to the contents of any record referred to in 9 subsection (a): 10 ‘‘(A) Such contents may be used or dis- 11 closed in accordance with the prior written con- 12 sent of the patient with respect to whom such 13 record is maintained. 14 ‘‘(B) Once prior written consent of the pa- 15 tient has been obtained, such contents may be 16 used or disclosed by a covered entity, business 17 associate, or a program subject to this section 18 for purposes of treatment, payment, and health 19 care operations as permitted by the HIPAA 20 regulations. Any information so disclosed may 21 then be redisclosed in accordance with the 22 HIPAA regulations. Section 13405(c) of the 23 Health Information Technology and Clinical 24 Health Act (42 U.S.C. 17935(c)) shall apply to 25 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 3374 IS all disclosures pursuant to subsection (b)(1) of 1 this section. 2 ‘‘(C) It shall be permissible for a patient’s 3 prior written consent to be given once for all 4 such future uses or disclosures for purposes of 5 treatment, payment, and health care operations, 6 until such time as the patient revokes such con- 7 sent in writing. 8 ‘‘(D) Section 13405(a) of the Health In- 9 formation Technology and Clinical Health Act 10 (42 U.S.C. 17935(a)) shall apply to all disclo- 11 sures pursuant to subsection (b)(1) of this sec- 12 tion.’’. 13 (c) DISCLOSURES OF DE-IDENTIFIED HEALTH IN- 14 FORMATION TO PUBLIC HEALTH AUTHORITIES.—Para- 15 graph (2) of section 543(b) of the Public Health Service 16 Act (42 U.S.C. 290dd–2(b)), is amended by adding at the 17 end the following: 18 ‘‘(D) To a public health authority, so long 19 as such content meets the standards established 20 in section 164.514(b) of title 45, Code of Fed- 21 eral Regulations (or successor regulations) for 22 creating de-identified information.’’. 23 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 3374 IS (d) DEFINITIONS.—Section 543 of the Public Health 1 Service Act (42 U.S.C. 290dd–2) is amended by adding 2 at the end the following: 3 ‘‘(k) DEFINITIONS.—For purposes of this section: 4 ‘‘(1) BREACH.—The term ‘breach’ has the 5 meaning given such term for purposes of the HIPAA 6 regulations. 7 ‘‘(2) BUSINESS ASSOCIATE.—The term ‘busi- 8 ness associate’ has the meaning given such term for 9 purposes of the HIPAA regulations. 10 ‘‘(3) COVERED ENTITY.—The term ‘covered en- 11 tity’ has the meaning given such term for purposes 12 of the HIPAA regulations. 13 ‘‘(4) HEALTH CARE OPERATIONS.—The term 14 ‘health care operations’ has the meaning given such 15 term for purposes of the HIPAA regulations. 16 ‘‘(5) HIPPA REGULATIONS.—The term 17 ‘HIPAA regulations’ has the meaning given such 18 term for purposes of parts 160 and 164 of title 45, 19 Code of Federal Regulations. 20 ‘‘(6) PAYMENT.—The term ‘payment’ has the 21 meaning given such term for purposes of the HIPAA 22 regulations. 23 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 3374 IS ‘‘(7) PUBLIC HEALTH AUTHORITY.—The term 1 ‘public health authority’ has the meaning given such 2 term for purposes of the HIPAA regulations. 3 ‘‘(8) TREATMENT.—The term ‘treatment’ has 4 the meaning given such term for purposes of the 5 HIPAA regulations. 6 ‘‘(9) UNSECURED PROTECTED HEALTH INFOR- 7 MATION.—The term ‘unprotected health information’ 8 has the meaning given such term for purposes of the 9 HIPAA regulations.’’. 10 (e) USE OF RECORDS IN CRIMINAL, CIVIL, OR AD- 11 MINISTRATIVE INVESTIGATIONS, ACTIONS, OR PRO- 12 CEEDINGS.—Subsection (c) of section 543 of the Public 13 Health Service Act (42 U.S.C. 290dd–2(c)) is amended 14 to read as follows: 15 ‘‘(c) USE OF RECORDS IN CRIMINAL, CIVIL, OR AD- 16 MINISTRATIVE CONTEXTS.—Except as otherwise author- 17 ized by a court order under subsection (b)(2)(C) or by the 18 consent of the patient, a record referred to in subsection 19 (a), or testimony relaying the information contained there- 20 in, may not be disclosed or used in any civil, criminal, ad- 21 ministrative, or legislative proceedings conducted by any 22 Federal, State, or local authority, including with respect 23 to the following activities: 24 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 3374 IS ‘‘(1) Such record or testimony shall not be en- 1 tered into evidence in any criminal prosecution or 2 civil action before a Federal or State court. 3 ‘‘(2) Such record or testimony shall not form 4 part of the record for decision or otherwise be taken 5 into account in any proceeding before a Federal, 6 State, or local agency. 7 ‘‘(3) Such record or testimony shall not be used 8 by any Federal, State, or local agency for a law en- 9 forcement purpose or to conduct any law enforce- 10 ment investigation. 11 ‘‘(4) Such record or testimony shall not be used 12 in any application for a warrant.’’. 13 (f) PENALTIES.—Subsection (f) of section 543 of the 14 Public Health Service Act (42 U.S.C. 290dd–2) is amend- 15 ed to read as follows: 16 ‘‘(f) PENALTIES.—The provisions of sections 1176 17 and 1177 of the Social Security Act shall apply to a viola- 18 tion of this section to the extent and in the same manner 19 as such provisions apply to a violation of part C of title 20 XI of such Act. In applying the previous sentence— 21 ‘‘(1) the reference to ‘this subsection’ in sub- 22 section (a)(2) of such section 1176 shall be treated 23 as a reference to ‘this subsection (including as ap- 24 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 3374 IS plied pursuant to section 543(f) of the Public Health 1 Service Act)’; and 2 ‘‘(2) in subsection (b) of such section 1176— 3 ‘‘(A) each reference to ‘a penalty imposed 4 under subsection (a)’ shall be treated as a ref- 5 erence to ‘a penalty imposed under subsection 6 (a) (including as applied pursuant to section 7 543(f) of the Public Health Service Act)’; and 8 ‘‘(B) each reference to ‘no damages ob- 9 tained under subsection (d)’ shall be treated as 10 a reference to ‘no damages obtained under sub- 11 section (d) (including as applied pursuant to 12 section 543(f) of the Public Health Service 13 Act)’.’’. 14 (g) ANTIDISCRIMINATION.—Section 543 of the Public 15 Health Service Act (42 U.S.C. 290dd–2) is amended by 16 inserting after subsection (h) the following: 17 ‘‘(i) ANTIDISCRIMINATION.— 18 ‘‘(1) IN GENERAL.—No entity shall discrimi- 19 nate against an individual on the basis of informa- 20 tion received by such entity pursuant to an inad- 21 vertent or intentional disclosure of records, or infor- 22 mation contained in records, described in subsection 23 (a) in— 24 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 3374 IS ‘‘(A) admission, access to, or treatment for 1 health care; 2 ‘‘(B) hiring, firing, or terms of employ- 3 ment, or receipt of worker’s compensation; 4 ‘‘(C) the sale, rental, or continued rental of 5 housing; 6 ‘‘(D) access to Federal, State, or local 7 courts; or 8 ‘‘(E) access to, approval of, or mainte- 9 nance of social services and benefits provided or 10 funded by Federal, State, or local governments. 11 ‘‘(2) RECIPIENTS OF FEDERAL FUNDS.—No re- 12 cipient of Federal funds shall discriminate against 13 an individual on the basis of information received by 14 such recipient pursuant to an intentional or inad- 15 vertent disclosure of such records or information 16 contained in records described in subsection (a) in 17 affording access to the services provided with such 18 funds.’’. 19 (h) NOTIFICATION IN CASE OF BREACH.—Section 20 543 of the Public Health Service Act (42 U.S.C. 290dd– 21 2), as amended by subsection (g), is further amended by 22 inserting after subsection (i) the following: 23 ‘‘(j) NOTIFICATION IN CASE OF BREACH.—The pro- 24 visions of section 13402 of the HITECH Act (42 U.S.C. 25 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 3374 IS 17932) shall apply to a program or activity described in 1 subsection (a), in case of a breach of records described 2 in subsection (a), to the same extent and in the same man- 3 ner as such provisions apply to a covered entity in the 4 case of a breach of unsecured protected health informa- 5 tion.’’. 6 (i) REGULATIONS.— 7 (1) IN GENERAL.—The Secretary of Health and 8 Human Services, in consultation with appropriate 9 Federal agencies, shall make such revisions to regu- 10 lations as may be necessary for implementing and 11 enforcing the amendments made by this section, 12 such that such amendments shall apply with respect 13 to uses and disclosures of information occurring on 14 or after the date that is 12 months after the date 15 of enactment of this Act. 16 (2) EASILY UNDERSTANDABLE NOTICE OF PRI- 17 VACY PRACTICES.—Not later than 1 year after the 18 date of enactment of this Act, the Secretary of 19 Health and Human Services, in consultation with 20 appropriate legal, clinical, privacy, and civil rights 21 experts, shall update section 164.520 of title 45, 22 Code of Federal Regulations, so that covered entities 23 and entities creating or maintaining the records de- 24 scribed in subsection (a) provide notice, written in 25 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 3374 IS plain language, of privacy practices regarding pa- 1 tient records referred to in section 543(a) of the 2 Public Health Service Act (42 U.S.C. 290dd–2(a)), 3 including— 4 (A) a statement of the patient’s rights, in- 5 cluding self-pay patients, with respect to pro- 6 tected health information and a brief descrip- 7 tion of how the individual may exercise these 8 rights (as required by subsection (b)(1)(iv) of 9 such section 164.520); and 10 (B) a description of each purpose for 11 which the covered entity is permitted or re- 12 quired to use or disclose protected health infor- 13 mation without the patient’s written authoriza- 14 tion (as required by subsection (b)(2) of such 15 section 164.520). 16 (j) RULES OF CONSTRUCTION.—Nothing in this Act 17 or the amendments made by this Act shall be construed 18 to limit— 19 (1) a patient’s right, as described in section 20 164.522 of title 45, Code of Federal Regulations, or 21 any successor regulation, to request a restriction on 22 the use or disclosure of a record referred to in sec- 23 tion 543(a) of the Public Health Service Act (42 24 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 3374 IS U.S.C. 290dd–2(a)) for purposes of treatment, pay- 1 ment, or health care operations; or 2 (2) a covered entity’s choice, as described in 3 section 164.506 of title 45, Code of Federal Regula- 4 tions, or any successor regulation, to obtain the con- 5 sent of the individual to use or disclose a record re- 6 ferred to in such section 543(a) to carry out treat- 7 ment, payment, or health care operation. 8 (k) SENSE OF CONGRESS.—It is the sense of the 9 Congress that— 10 (1) any person treating a patient through a 11 program or activity with respect to which the con- 12 fidentiality requirements of section 543 of the Public 13 Health Service Act (42 U.S.C. 290dd–2) apply is en- 14 couraged to access the applicable State-based pre- 15 scription drug monitoring program when clinically 16 appropriate; 17 (2) patients have the right to request a restric- 18 tion on the use or disclosure of a record referred to 19 in section 543(a) of the Public Health Service Act 20 (42 U.S.C. 290dd–2(a)) for treatment, payment, or 21 health care operations; 22 (3) covered entities should make every reason- 23 able effort to the extent feasible to comply with a 24 VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3374.IS S3374 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 3374 IS patient’s request for a restriction regarding such use 1 or disclosure; 2 (4) for purposes of applying section 164.501 of 3 title 45, Code of Federal Regulations, the definition 4 of health care operations shall have the meaning 5 given such term in such section, except that clause 6 (v) of paragraph (6) shall not apply; and 7 (5) programs creating records referred to in 8 section 543(a) of the Public Health Service Act (42 9 U.S.C. 290dd–2(a)) should receive positive incen- 10 tives for discussing with their patients the benefits 11 to consenting to share such records. 12 Æ VerDate Sep 11 2014 20:16 Mar 05, 2020 Jkt 099200 PO [Text truncated for display. Full text available on Congress.gov.]