Medical Information Privacy and Security Act
Latest action (4 Nov 1997): Introduced
What this bill does
Generate a neutral, plain-English explanation of what this bill does, who it affects and what happens next — grounded in the official text.
Official summary
TABLE OF CONTENTS: Title I: Individual's Rights Subtitle A: Access to Protected Health Information by Subjects of the Information Subtitle B: Establishment of Safeguards Title II: Restrictions on Use and Disclosure Subtitle A: General Restriction Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization Subtitle C: Special Rules Governing Disclosure Title III: Office of Health Information Privacy of the Department of Health and Human Services Subtitle A: Establishment Subtitle B: Enforcement Title IV: Miscellaneous Medical Information Privacy and Security Act - Title I: Individual's Rights - Subtitle A: Access to Protected Health Information by Subjects of the Information - Requires specified parties to permit an individual who is the subject of protected health information to: (1) inspect and copy the information; (2) request addition of a supplement (or the individual's disagreement statement); and (3) prepare and disseminate notice of privacy rights and practices. (The list of specified parties varies from provision to provision throughout this Act. The list includes, in various provisions, such individuals and entities as health care providers, health plans, health oversight agencies, public health authorities, employers, health researchers, law enforcement officials, health or life insurers, schools, universities, emergency medical personnel, and their agents.) Mandates development of model notices. Subtitle B: Establishment of Safeguards - Requires specified parties to establish safeguards to ensure the confidentiality, security, accuracy, and integrity of protected health information. Mandates development of model safeguard guidelines. Requires specified parties to establish a record of disclosures not related to payment or treatment. Title II: Restrictions on Use and Disclosure - Subtitle A: General Restriction - Prohibits specified parties from disclosing protected health information except as authorized under this title. Allows disclosure if authorized by the information subject. Mandates model written authorizations and model limitations. Provides for segregation of files on request, authorization revocation, and records of authorizations and revocations. Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization - Allows any person to disclose protected health information: (1) in order to allay or remedy a threat of imminent physical or mental harm to an information subject; and (2) if there is an identifiable threat of serious injury or death to an identifiable individual or group and other requirements are met. (Sec. 212) Authorizes disclosure to: (1) a public health authority; (2) an agency charged by law to protect the health and safety of individuals if the information subject is vulnerable to abuse or neglect by an agency providing health or social services; (3) a health oversight agency; and (4) on court order, a law enforcement authority. Subtitle C: Special Rules Governing Disclosure - Regulates disclosure: (1) to next of kin; (2) in directories of individuals admitted to a facility; (3) necessary to assist in the identification of a deceased individual; and (4) relating to minors. (Sec. 222) Applies the requirements and protections of specified parts of the Code of Federal Regulations to research conducted by all research facilities using personally identifiable health information. Directs the Secretary of Health and Human Services to report to the Congress whether written informed consent should be required and, if so, under what circumstances, before personally identifiable data can be used for medical research. (Sec. 223) Allows specified parties to disclose for certain judicial and administrative purposes. (Sec. 224) Sets forth a sequence regulating who may exercise an individual's rights under this Act when the individual cannot knowingly or effectively do so, designating first a person named in a health care power of attorney, then an individual authorized by law or by an instrument recognized under law to act as the individual's representative, then next of kin, and last the health care provider, in each case moving to the next level if the person cannot be contacted after a reasonable effort. Applies this Act to deceased persons for two years after death and provides for the exercise of rights on behalf of a deceased individual. (Sec. 225) Prohibits retaliation for the exercise of rights under this Act or disclosure of information regarding a possible violation of this Act. Title III: Office of Health Information Privacy of the Department of Health and Human Services - Subtitle A: Establishment - Establishes the Office of Health Information Privacy, including in its duties receiving and investigating violation complaints and providing for the conduct of audits. Subtitle B: Enforcement - Chapter 1: Criminal Provisions - Amends the Federal criminal code to impose criminal penalties for knowingly and intentionally obtaining or disclosing protected health information in violation of title II of this Act. (Sec. 312) Mandates regulations and procedures to permit the debarment of specified parties from receiving benefits under any Federal health programs if the managers or officers are found guilty of such obtaining or disclosing. Authorizes the Attorney General to provide advice, technical assistance, and guidance to reduce improper disclosure. Chapter 2: Civil Sanctions - Imposes civil monetary penalties on specified parties if the Office determines a party has substantially and materially failed to comply with this Act. (Sec. 323) Allows any individual whose rights under this Act have been knowingly or negligently violated to bring a civil action to recover preliminary and equitable relief, compensatory (or specified liquidated) damages, punitive damages (for knowing violations), and attorney's fees. Sets a time limit for the commencement of actions. Title IV: Miscellaneous - Amends the Privacy Act of 1974 to require an agency that receives protected health information to promulgate rules to exempt a system of records within the agency from all but specified provisions of that Act.
Common questions
- What does S. 1368 do?
- TABLE OF CONTENTS: Title I: Individual's Rights Subtitle A: Access to Protected Health Information by Subjects of the Information Subtitle B: Establishment of Safeguards Title II: Restrictions on Use and Disclosure Subtitle A: General Restriction Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization Subtitle C: Special Rules Governing Disclosure Title III: Office of Health Information Privacy of the Department of Health and Human Services Subtitle A: Establishment Subtitle B: Enforcement Title IV: Miscellaneous Medical Information Privacy and Security Act - Title I: Individual's Rights - Subtitle A: Access to Protected Health Information by Subjects of the Information - Requires specified parties to permit an individual who is the subject of protected health information to: (1) inspect and copy the information; (2) request addition of a supplement (or the individual's disagreement statement); and (3) prepare and disseminate notice of privacy rights and practices. (The list of specified parties varies from provision to provision throughout this Act. The list includes, in various provisions, such individuals and entities as health care providers, health plans, health oversight agencies, public health authorities, employers, health researchers, law enforcement officials, health or life insurers, schools, universities, emergency medical personnel, and their agents.) Mandates development of model notices. Subtitle B: Establishment of Safeguards - Requires specified parties to establish safeguards to ensure the confidentiality, security, accuracy, and integrity of protected health information. Mandates development of model safeguard guidelines. Requires specified parties to establish a record of disclosures not related to payment or treatment. Title II: Restrictions on Use and Disclosure - Subtitle A: General Restriction - Prohibits specified parties from disclosing protected health information except as authorized under this title. Allows disclosure if authorized by the information subject. Mandates model written authorizations and model limitations. Provides for segregation of files on request, authorization revocation, and records of authorizations and revocations. Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization - Allows any person to disclose protected health information: (1) in order to allay or remedy a threat of imminent physical or mental harm to an information subject; and (2) if there is an identifiable threat of serious injury or death to an identifiable individual or group and other requirements are met. (Sec. 212) Authorizes disclosure to: (1) a public health authority; (2) an agency charged by law to protect the health and safety of individuals if the information subject is vulnerable to abuse or neglect by an agency providing health or social services; (3) a health oversight agency; and (4) on court order, a law enforcement authority. Subtitle C: Special Rules Governing Disclosure - Regulates disclosure: (1) to next of kin; (2) in directories of individuals admitted to a facility; (3) necessary to assist in the identification of a deceased individual; and (4) relating to minors. (Sec. 222) Applies the requirements and protections of specified parts of the Code of Federal Regulations to research conducted by all research facilities using personally identifiable health information. Directs the Secretary of Health and Human Services to report to the Congress whether written informed consent should be required and, if so, under what circumstances, before personally identifiable data can be used for medical research. (Sec. 223) Allows specified parties to disclose for certain judicial and administrative purposes. (Sec. 224) Sets forth a sequence regulating who may exercise an individual's rights under this Act when the individual cannot knowingly or effectively do so, designating first a person named in a health care power of attorney, then an individual authorized by law or by an instrument recognized under law to act as the individual's representative, then next of kin, and last the health care provider, in each case moving to the next level if the person cannot be contacted after a reasonable effort. Applies this Act to deceased persons for two years after death and provides for the exercise of rights on behalf of a deceased individual. (Sec. 225) Prohibits retaliation for the exercise of rights under this Act or disclosure of information regarding a possible violation of this Act. Title III: Office of Health Information Privacy of the Department of Health and Human Services - Subtitle A: Establishment - Establishes the Office of Health Information Privacy, including in its duties receiving and investigating violation complaints and providing for the conduct of audits. Subtitle B: Enforcement - Chapter 1: Criminal Provisions - Amends the Federal criminal code to impose criminal penalties for knowingly and intentionally obtaining or disclosing protected health information in violation of title II of this Act. (Sec. 312) Mandates regulations and procedures to permit the debarment of specified parties from receiving benefits under any Federal health programs if the managers or officers are found guilty of such obtaining or disclosing. Authorizes the Attorney General to provide advice, technical assistance, and guidance to reduce improper disclosure. Chapter 2: Civil Sanctions - Imposes civil monetary penalties on specified parties if the Office determines a party has substantially and materially failed to comply with this Act. (Sec. 323) Allows any individual whose rights under this Act have been knowingly or negligently violated to bring a civil action to recover preliminary and equitable relief, compensatory (or specified liquidated) damages, punitive damages (for knowing violations), and attorney's fees. Sets a time limit for the commencement of actions. Title IV: Miscellaneous - Amends the Privacy Act of 1974 to require an agency that receives protected health information to promulgate rules to exempt a system of records within the agency from all but specified provisions of that Act.
- Has S. 1368 become law?
- Not yet. As of 4 Nov 1997, S. 1368 is introduced.
- Who sponsored S. 1368?
- S. 1368 was sponsored by Sen. Patrick Leahy [D-VT, 1975-2022] (Democrat-VT), with 1 cosponsor.
- What's the latest action on S. 1368?
- Introduced (4 Nov 1997).
Related bills in Health
Expressing support for the designation of September 22, 2026, as “National Hispanic Nurses Day” and recognizing the National Association of Hispanic Nurses as the leading organization representing and advocating for Hispanic nurses.
Recognizing the importance of protecting continuous Medicaid coverage for individuals undergoing active cancer treatment.
Wildland Firefighter Health and Safety Act
Expressing support for the designation of the third week of September as “Fungal Disease Awareness Week” and encouraging efforts to improve awareness, diagnosis, treatment, surveillance, and prevention of fungal diseases in the United States.
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.