Federal Privacy of Medical Information Act

(Reported to House from the Committee on Interstate and Foreign Commerce with amendment, H. Rept. 96-832 (part II))

Federal Privacy of Medical Information Act - States the purposes of this Act to be: (1) to establish procedures allowing patients to inspect and amend medical information about them; (2) to define the circumstances under which individually identifiable medical information may be disclosed with or without patient consent; and (3) to make it a crime to request or obtain medical information from medical care facilities under false pretenses.

=Title I: Privacy of Medical Information= - Part A - Definitions, Effect on Other Law, and Rights of Minors and Incompetents - Applies the requirements of this Act to the following medical care facilities: (1) hospitals and skilled nursing homes; (2) federally operated medical Medicaid program; (3) intermediate care facilities certified to participate in the Medicaid program; and (4) State operated facilities, as provided by State statute.

Prohibits State or local law from authorizing the disclosure of medical information which is prohibited under this Act, but allows a State to prohibit a disclosure which is permitted by this Act.

Sets forth the rights of incompetents and minors under this Act.

Part B - Rights of Inspection, Correction, and Notice, and Authorized Disclosure - Requires medical facilities to permit patients to inspect and obtain copies of their medical records. Permits a facility to: (1) comply with a request for inspection of medical information by providing for inspection of a copy of the information; (2) offer to explain or interpret such information; (3) require a written request for the inspection and copying of such information; and (4) charge reasonable inspection and copying fees. Requires a facility to answer such request within 30 days.

Declares that a facility is not required to permit inspection or copying of information if: (1) such information would cause sufficient harm to the patient so as to outweigh the desirability of permitting access; (2) the information concerns mental health treatment and the facility permits disclosure only with the patient's authorization or under compulsion of law; (3) such information relates to an individual other than the patient, disclosure would endanger the physical safety of any person, or the information could identify an individual who is a confidential source of information to a health care provider concerning the patient's condition; (4) the information is used for administrative purposes; or (5) the information is compiled solely in connection with a civil suit.

Requires a medical facility to provide the patient with a written statement of the reasons for its denial of a request for information.

Permits a patient to request in writing that a medical facility correct or supplement his or her medical records. Requires the facility to: (1) grant or deny such request within 45 days; (2) inform the patient of its reasons for denying such a request; and (3) include any statement of disagreement of the patient in his or her medical records.

Requires a medical facility to prepare a clearly understood written notice of information practices describing: (1) disclosure that may be made without a patient's written authorization; and (2) its procedures for implementing the rights and procedures provided by this title. Directs such facility to: (1) provide such information upon request; (2) post such notice in conspicuous places; (3) provide each inpatient with a written statement highlighting certain rights; (4) make reasonable efforts to inform outpatients of the existence and availability of such information; and (5) translate its notice into other languages used by individuals composing a significant percentage of the residents in its service area.

Prohibits a medical care facility from disclosing medical information: (1) to anyone other than a patient or designated representative, unless so authorized by the patient or otherwise permitted under this Act; and (2) to anyone not properly identified. Requires a facility which makes an authorized disclosure involving the recording or removal of medical information relating to research, audits, or health and safety, to maintain an accounting of the disclosure and make such accounting available to the patient upon request.

Defines the manner in which a patient may authorize disclosure of medical information. Permits a State or facility to impose additional authorization requirements. Allows a patient to amend or revoke such authorization.

Imposes a two-year limitation on the duration of open-ended patient disclosure authorizations.

Part C - Disclosure of Medical Information Without Patient Authorization - Permits a medical facility to disclose patient information without authorization: (1) to aid a facility employee in the performance of his or her duties; (2) to a medical professional in connection with the treatment of a specific patient; (3) for limited admission and health status purposes; (4) for health research, public health investigations, and auditing under specified circumstances; (5) to assist in the identification of a dead individual or alleviate emergency circumstances; (6) for legally required reporting, such as child abuse and court-ordered examinations; (7) for Secret Service and foreign intelligence purposes under certain circumstances (see next paragraph): (8) to the next of kin; (9) for specified law enforcement functions; (10) pursuant to a subpoena, summons, warrant, or search warrant; and (11) with respect to veterans' or armed service benefits and certain third party claims. Sets forth restrictions on the use of medical information by Federal grand juries.

Requires, with respect to the disclosure of medical information for health research purposes, that the person conducting the project notify the chief medical officer of the State of the determination of the institutional review board authorizing the disclosure.

Permits a facility, with respect to the disclosure of medical information for public health investigations, to seek a written certification from the person seeking the investigation.

Permits a facility, with respect to the disclosure of medical information for auditing purposes, that any certification which is relied on by the facility be accompanied by a written statement of the entity conducting the audit that the person is authorized to conduct the audit on the entity's behalf.

Requires, with respect to the disclosure of medical information for Secret Service and foreign intelligence purposes, that the Government authority provide the facility with a written certification. Prohibits information obtained by the Secret Service from being further disclosed except where necessary to fulfill the purpose for which the information was obtained. Requires, with respect to disclosure for intelligence purposes, that the certification indicate that: (1) facts or circumstances exist that reasonably indicate that the patient is or may be a foreign agent; (2) the patient is a potential source of intelligence information and the medical information is to be used to determine his or her reliability; or (3) the information is to assist in the identification of a foreign agent.

Includes among those law enforcement functions for which medical information may be disclosed without patient authorization, information needed for use in a proceeding against a medical care facility in which the Government is seeking to redress the deprivation of constitutional or statutory rights.

Directs the Attorney General to promulgate guidelines governing the use, retention, and disclosure of medical information disclosed for intelligence purposes, and to transmit such guidelines to the congressional intelligence committees.

Part D - Access Procedures, Challenge Rights, and Reporting - Sets forth different access procedures with respect to warrants, legal process for law enforcement purposes, and other legal process.

Requires a governmental authority which secures information about a person from a medical facility pursuant to a search or administrative warrant to serve a copy of the warrant upon such person within 90 days.

Prohibits a governmental authority from securing such information for law enforcement purposes unless; (1) reasonable grounds exist for believing such information is relevant to the inquiry; (2) a copy of the process has been served upon the person, together with notice of such person's right to challenge the process; and (3) ten days have passed from the date of service, or 14 days from the date of mailing, and no challenge (as provided by this Act) has been initiated or disclosure ordered by the court.

Permits the governmental authority to delay the notification requirement with respect to a law enforcement inquiry upon a finding that: (1) the governmental inquiry is lawful; (2) reasonable grounds exist to beliebe that the medical information is relevant to such inquiry; (3) the public interest in the administration of justice outweighs the individuals' privacy interest; and (4) reasonable grounds exist to believe that notifying the individual will result in endangering someone's life or safety, flight from prosecution, destruction of evidence, intimidation of witnesses, or undue judicial delay.

Authorizes an individual to challenge a governmental summons or subpena requesting medical information about such individual. Permits such individual to respond to the Government's response to such challenge if the Government raises new facts or arguments of which the patient did not have notice. Requires that the court in weighing the Government's need for the information against a patient's challenge, to consider: (1) the degree to which disclosure injuries or invades the patient's privacy; (2) the importance of the information to that inquiry; and (3) any other relevant factors. Places the burden on the individual to show that his/her privacy interest outweighs the public interest. Authorizes the court to assess attorney and related fees against the Federal authority if the challenging patient prevails.

Prohibits any person from securing information about a person from a medical facility pursuant to other summonses and subpoenas unless: (1) reasonable grounds exist for believing such information is relevant to the lawsuit or other proceeding; (2) a copy of the process has been served upon the person, together with notice of such person's right to challenge the process; and (3) ten days have passed from the date of service, or 14 days from the date of filing, and no challenge has been initiated or disclosure ordered by the court.

Requires the Director of the Administrative Office of the United States Courts to include in his annual report to Congress information regarding the number of patient challenges and delays of notice sought by the Government. Directs the Attorney General to report annually to Congress on the number of requests for medical information made for intelligence purposes.

Part E - Enforcement - Establishes maximum criminal penalties of: (1) six months' imprisonment and/or a $10,000 fine for requesting or obtaining medical information under false pretenses; and (2) 18 months' imprisonment and/or a $30,000 fine for intentionally selling such information for profit or monetary gain.

Allows a person whose rights have been violated under this Act to file a civil action for actual damages and equitable relief against: (1) the United States or governmental authority of a State which has waived its sovereign immunity where the officer or employee commits such violation while acting within the scope of employment; (2) the governmental officer or employee who commits such violation while not acting within such scope; and (3) medical facility employee who commits such violation.

Gives the Federal district courts jurisdiction over such actions, except those brought against a State government authority.

Declares any writing purporting to waive a patient's rights under this Act void as against public policy.

Makes a facility which has disclosed information after making a good faith determination that a person is properly identified, not liable to a patient who brings an action based on a violation of the proper identification requirement.

Directs the Secretary of Health and Human Services to publish a model notice of information practices (including translation into other languages ) which describe the disclosures and rights of patients required to be included in the notices of information practices required by this Act.

Requires the Secretary to report to Congress within six months of enactment on the feasibility of applying the provisions of this Act to outpatient clinics, ambulatory care facilities, or health maintenance organizations receiving Federal funds under specified programs.

=Title II: Amendment to Title 5, United States Code= - Exempts from specified provisions of the Privacy Act of 1974 medical information maintained by Federal agencies which is subject to this Act.

=Title III: Transition and Effective Dates= - Provides that medical information shall continue to be subject to this Act if the facility ceases to be a medical care facility. Sets forth effective dates.