text: SECTION 1. SHORT TITLE.
  
      This Act may be cited as the ``Stop Taking Our Health Privacy 
  (STOHP) Act of 2002''.
  
  SEC. 2. FINDINGS.
  
       The Congress finds as follows:
              (1) People in the United States are deeply concerned about 
          the confidentiality of their health information. According to a 
          recent survey conducted by the Princeton Survey Research 
          Associates, 1 in 6 people in the United States has done 
          something out of the ordinary to keep personal health 
          information confidential, including withholding information, 
          providing inaccurate information, or, in some cases, avoiding 
          care entirely.
              (2) Pursuant to the Health Insurance Portability and 
          Accountability Act of 1996 (Public Law 104-191; 110 Stat. 1936 
          et seq.) (commonly referred to as ``HIPAA''), the Clinton 
          Administration issued comprehensive medical privacy regulations 
          which were promulgated in final form in December 2000.
              (3) Such regulations established a sound foundation of 
          privacy protections by prohibiting the use or disclosure of an 
          individual's health information unless specifically authorized 
          by the regulations or by the individual. The regulations also 
          provided individuals with the right to be notified of the 
          privacy practices of health plans, health care providers, and 
          health care clearinghouses regarding disclosure of their health 
          information, the right to access and copy their own health 
          records, and the right to request corrections of their health 
          records, among other provisions.
              (4) Such regulations took effect in April 2001 and require 
          health care providers, health plans (other than small health 
          plans) and health care clearinghouses to comply not later than 
          April 2003.
              (5) In August 2002, the Bush Administration issued a final 
          rule that significantly weakened medical privacy protections in 
          the December 2000 medical privacy rule.
              (6) The Bush Administration undermined medical privacy 
          protections by eliminating the rule's requirement that covered 
          entities obtain patient consent before using and disclosing 
          patient health information for treatment, payment, and health 
          care operations. This change means that patients' medical 
          records can be used and disclosed without their permission for 
          a wide range of purposes including business activities that 
          have nothing to do with the treatment of a patient, such as the 
          sale or merger of a health maintenance organization. This 
          change also allows the use and disclosure of information in 
          existing medical records even though patients disclosed the 
          information with the understanding and expectation that it 
          would not be further used or disclosed without their consent. 
          The elimination of consent compromises the confidentiality at 
          the heart of physician-patient relationships, which is 
          indispensable for the delivery of high-quality, thorough care.
              (7) The Bush Administration also undermined medical privacy 
          protections by expanding the circumstances under which 
          patients' information can be shared without their knowledge or 
          consent to include activities that consumers typically consider 
          marketing. This change was accomplished by narrowing the scope 
          of activities that are regulated by the provisions of the rule 
          governing marketing. Under this change, pharmacies and other 
          providers can use a consumer's medical information without 
          consent to mail the consumer unsolicited drug product 
          recommendations, without having to disclose fees paid by drug 
          companies for sending such communications or provide the 
          consumer an opportunity to decline to receive such 
          communications in the future.
              (8) The Bush Administration further undermined medical 
          privacy protections by changing the language in the section of 
          the rule governing public health to allow the disclosure of 
          medical information without patient permission to entities 
  regulated by the Food and Drug Administration, such as pharmaceutical 
  companies and medical device manufacturers, for an expanded and broad 
  range of purposes which may include marketing campaigns. In contrast, 
  the December 2000 rule allowed nonconsensual disclosure of patient 
  health information for an exclusive list of public health related 
  activities, such as for the purpose of reporting serious side effects 
  from a prescription drug to the Food and Drug Administration.
              (9) Reversal of the Bush Administration's changes to the 
          December 2000 medical privacy rule is integral to any effort to 
          ensure medical privacy protection for consumers and preserve 
          access to high-quality health care in the United States.
              (10) Core medical privacy protections of the December 2000 
          medical privacy rule should be restored by--
                      (A) reinstating the patient consent requirement for 
                  treatment, payment, and health care operations, while 
                  ensuring that the requirement does not impede important 
                  health care activities such as filling pharmaceutical 
                  prescriptions and making referrals;
                      (B) returning to the December 2000 definition of 
                  ``marketing'' and thus ensuring that activities 
                  typically considered marketing, such as drug companies 
                  paying pharmacies to send product recommendations to 
                  patients, fall under the rule's privacy protections 
                  relating to the use of patient health information for 
                  marketing activities; and
                      (C) eliminating the broad ``public health'' 
                  exemption created by the August 2002 rule.
  
  SEC. 3. PURPOSE.
  
       The purpose of this Act is to restore patient privacy protections 
  essential for high-quality health care that were undermined by the Bush 
  Administration's August 2002 modifications of the December 2000 medical 
  privacy rule.
  
  SEC. 4. RESTORATION OF PRIVACY PROTECTIONS.
  
      (a) Consent for Uses or Disclosures To Carry Out Treatment, 
  Payment, or Health Care Operations.--
              (1) In general.--The modifications made to section 164.506 
          of title 45, Code of Federal Regulations, by the August 2002 
          medical privacy rule shall have no force or effect.
              (2) Clarification regarding instances when consent is not 
          required.--In addition to the circumstances described in the 
          December 2000 medical privacy rule, and notwithstanding any 
          provision to the contrary, such section 164.506 shall be 
          construed and applied so as to permit a health care provider to 
          use or disclose an individual's protected health information 
          without obtaining the prior consent of the individual in the 
          following circumstances:
                      (A) A health care provider may use or disclose an 
                  individual's protected health information to fill or 
                  dispense a prescription, search for drug interactions 
                  related to that prescription, and determine eligibility 
                  and obtain authorization for payment regarding that 
                  prescription, if the health care provider obtains 
                  written consent from the individual as soon as 
                  practicable.
                      (B) A health care provider may use or disclose an 
                  individual's protected health information to carry out 
                  treatment of that individual if--
                              (i) the individual and the health care 
                          provider have not had in-person communication 
                          regarding such treatment;
                              (ii) obtaining consent would be 
                          impracticable;
                              (iii) the health care provider determines, 
                          in the exercise of professional judgment, that 
                          the individual's consent is clearly inferred 
                          from the circumstances, such as an order or 
                          referral from another health care provider; and
                              (iv) the health care provider obtains 
                          written consent from the individual as soon as 
                          practicable.
      (b) Marketing.--
              (1) In general.--The modifications made by the August 2002 
          medical privacy rule to the definition of the term 
          ``marketing'' in section 164.501 of title 45, Code of Federal 
          Regulations, shall have no force or effect.
              (2) Treatment of certain communications.--The exception for 
          oral communications in paragraph (2)(i) of the definition of 
          the term ``marketing'' in section 164.501 of title 45, Code of 
          Federal Regulations, as contained in the December 2000 medical 
          privacy rule, shall have no force or effect.
              (3) Authorizations for marketing.--Section 164.508 of title 
          45, Code of Federal Regulations, shall be construed and applied 
          so as to require that, if an authorization is required for a 
          use or disclosure for marketing, the authorization shall be 
          considered invalid unless it--
                      (A) uses the term ``marketing'';
                      (B) states that the purpose of the use or 
                  disclosure involved is marketing;
                      (C) describes the specific marketing uses and 
                  disclosures authorized, including whether the protected 
                  health information involved--
                              (i) may be used for purposes internal to 
                          the covered entity;
                              (ii) may be disclosed to, and used by, a 
                          business associate of the covered entity; and
                              (iii) may be disclosed to, and used by, any 
                          person or entity other than a business 
                          associate of the covered entity; and
                      (D) states that the use or disclosure of protected 
                  health information for marketing will directly result 
                  in remuneration to the covered entity from a third 
                  party, in any case in which a covered entity expects, 
                  or reasonably should expect, that such remuneration 
                  will occur.
      (c) Public Health.--The modifications made to section 
  164.512(b)(1)(iii) of title 45, Code of Federal Regulations, by the 
  August 2002 medical privacy rule shall have no force or effect.
  
  SEC. 5. DEFINITIONS; EFFECTIVE DATE.
  
      (a) In General.--For purposes of this Act:
              (1) December 2000 medical privacy rule.--The term 
          ``December 2000 medical privacy rule'' means the final rule on 
          standards for privacy of individually identifiable health 
          information published on December 28, 2000, in the Federal 
          Register (65 Fed. Reg. 82462), including the provisions of 
          title 45, Code of Federal Regulations, revised or added by such 
          rule.
              (2) August 2002 medical privacy rule.--The term ``August 
          2002 medical privacy rule'' means the final rule, published on 
          August 14, 2002, in the Federal Register (67 Fed. Reg. 53182), 
          that modified the December 2000 medical privacy rule.
      (b) Other Terms Defined.--For purposes of this Act:
              (1) Business associate; covered entity; health care 
          provider.--The terms ``business associate'', ``covered 
          entity'', and ``health care provider'' shall have the meaning 
          given such terms in section 160.103 of title 45, Code of 
          Federal Regulations, as contained in the December 2000 medical 
          privacy rule.
              (2) Disclosure; individual, protected health information; 
          treatment; use.--The terms ``disclosure'', ``individual'', 
          ``protected health information'', ``treatment'', and ``use'' 
          shall have the meaning given such terms in section 164.501 of 
          title 45, Code of Federal Regulations, as contained in the 
          December 2000 medical privacy rule.
      (c) Effective Date; No Regulations Required.--This Act shall take 
  effect on the date of the enactment of this Act and does not require 
  the issuance of regulations.
target: Stop Taking Our Health Privacy (STOHP) Act of 2002 - Declares that modifications made by an August 14, 2002, final rule affecting medical privacy to a Code of Federal Regulations (CFR) section concerning consent for uses or disclosures to carry out treatment, payment, or health care operations shall have no force or effect. Directs that such CFR section shall be construed and applied to permit a health care provider to use or disclose an individual's protected health information without prior consent under specified circumstances, provided that the provider obtains written consent from the individual as soon as practicable.Declares that a CFR section dealing with uses and disclosures for which an authorization is required shall be construed and applied so that an authorization shall be invalid unless it meets specified criteria, including that it describes the specific marketing uses and disclosures authorized.States that the modifications made by the August 14 final rule dealing with permitted disclosures for public health activities shall have no force or effect.
feat_title: To restore standards to protect the privacy of individually identifiable health information that were weakened by the August 2002 modifications, and for other purposes.