The purpose of the Medical Records Confidentiality Act of 1995 is to establish uniform privacy protection for personally identifiable health information. No comprehensive protection currently exists at the federal level to guarantee the confidentiality and integrity of such information, and existing state laws are incomplete and inadequate. Under this bill, personally identifiable health information is ensured strong and consistent privacy safeguards whether the information is in paper or electronic form.

TITLE I - INDIVIDUAL'S RIGHTS

This title requires health information trustees (defined as health care providers, health care plans, and others who create, receive or use health information), to allow individuals access to any health information pertaining to the individual and to give individuals the opportunity to correct such information. Trustees must provide clear written notice to all individuals of the right to access their personally identifiable health information. The bill also requires that trustees develop safeguards to protect the confidentiality of the personally identifiable health information they maintain.

TITLE II - RESTRICTIONS ON USE AND DISCLOSURE OF PERSONALLY IDENTIFIABLE HEALTH INFORMATION

This title establishes a system in which an individual's personally identifiable health information may not be disclosed without the individual's permission except in limited circumstances (described below).

Disclosures Requiring Consent:

This title requires that trustees obtain an individual's authorization to disclose personally identifiable health information for purposes of payment or treatment. In addition, this title allows personally identifiable health information to be disclosed to an individual's next of kin, and the individual's name or general health status to be disclosed for directory information, as long as the individual has not objected to such disclosure.

Exceptions To Consent:

Personally identifiable health information may be disclosed, without the individual's consent, in the following situations:

• Emergency Circumstances: Personally identifiable health information may be disclosed in emergency circumstances when necessary to protect the health or safety of an individual from serious, imminent harm.

• Oversight: The bill provides for broad disclosure of personally identifiable health information for use in any public entity investigation or enforcement of health care fraud or abuse. This information, however, may not be used against the individual in any action unrelated to the fraud or abuse.

• Public Health: Personally identifiable health information may be disclosed to a public health authority for use in legally authorized disease or injury reports, public health surveillance, or public health investigations or interventions.

• Health Research: Personally identifiable health information may be disclosed to a health researcher only if a certified institutional review board (IRB) determines the information is necessary for the research project.

• Judicial and Administrative Purposes: Where required by the Federal Rules of Civil and Criminal Procedure, personally identifiable health information may be disclosed in cases in which an individual has placed his or her health condition at issue in a lawsuit.

• Non-Law Enforcement Subpoenas: Personally identifiable health information may be disclosed in response to a subpoena that has been issued in a civil lawsuit. The bill establishes a set of access requirements that the person requesting the subpoena must follow, and provides an opportunity for the individual who is the subject of the information to challenge the subpoena.

• Law Enforcement:Personally identifiable health information may be disclosed to a law enforcement authority pursuant to a subpoena or warrant where probable cause to believe that such information is relevant to a legitimate law enforcement inquiry has been demonstrated. The bill provides procedures for an individual who is the subject of the information to challenge the subpoena or warrant.

• Certified Health Information Services: Personally identifiable health information may be disclosed to a certified health information service for the purposes of removal of personal identifiers from the information and for the subsequent creation of nonidentifiable health information.

TITLES III & IV - REMEDIES AND PREEMPTION

• Remedies : The bill creates a private right of action for violations of this Act, and provides for civil and criminal penalties.

• Preemption: In general, the bill preempts State law. Exceptions exist in certain limited cases where the state or federal law may provide greater privacy protection.