II
109th CONGRESS
1st Session
S. 116
IN THE SENATE OF THE UNITED STATES
January 24, 2005
Mrs. Feinstein introduced the following bill; which was read twice and referred to the Committee on the Judiciary
A BILL
To require the consent of an individual prior to the sale and marketing of such individual’s personally identifiable information, and for other purposes.
Short title; table of contents
Short title
This Act may be cited as the Privacy Act of 2005
.
Table of contents
The table of contents of this Act is as follows:
Sec. 1. Short title; table of contents
Title I—Commercial sale and marketing of personally identifiable information
Sec. 101. Collection and distribution of personally identifiable information
Sec. 102. Enforcement
Sec. 103. Safe harbor
Sec. 104. Definitions
Sec. 105. Preemption
Sec. 106. Effective Date
Title II—Social security number misuse prevention
Sec. 201. Findings
Sec. 202. Prohibition of the display, sale, or purchase of social security numbers
Sec. 203. Application of prohibition of the display, sale, or purchase of social security numbers to public records
Sec. 204. Rulemaking authority of the Attorney General
Sec. 205. Treatment of social security numbers on government documents
Sec. 206. Limits on personal disclosure of a social security number for consumer transactions
Sec. 207. Extension of civil monetary penalties for misuse of a social security number
Sec. 208. Criminal penalties for the misuse of a social security number
Sec. 209. Civil actions and civil penalties
Sec. 210. Federal injunctive authority
Title III—Limitations on sale and sharing of nonpublic personal financial information
Sec. 301. Definition of sale
Sec. 302. Rules applicable to sale of nonpublic personal information
Sec. 303. Exceptions to disclosure prohibition
Sec. 304. Conforming amendments
Sec. 305. Regulatory authority
Sec. 306. Effective date
Title IV—Limitations on the provision of protected health information
Sec. 401. Definitions
Sec. 402. Prohibition against selling protected health information
Sec. 403. Authorization for sale or marketing of protected health information by noncovered entities
Sec. 404. Prohibition against retaliation
Sec. 405. Rule of construction
Sec. 406. Regulations
Sec. 407. Enforcement
Title V—Driver’s license privacy
Sec. 501. Driver’s license privacy
Title VI—Miscellaneous
Sec. 601. Enforcement by State Attorneys General
Sec. 602. Federal injunctive authority
Commercial sale and marketing of personally identifiable information
Collection and distribution of personally identifiable information
Prohibition
In general
It is unlawful for a commercial entity to collect personally identifiable information and disclose such information to any nonaffiliated third party for marketing purposes or sell such information to any nonaffiliated third party, unless the commercial entity provides—
notice to the individual to whom the information relates in accordance with the requirements of subsection (b); and
an opportunity for such individual to restrict the disclosure or sale of such information.
Exception
A commercial entity may collect personally identifiable information and use such information to market to potential customers such entity’s product.
Notice
In general
A notice under subsection (a) shall contain statements describing the following:
The identity of the commercial entity collecting the personally identifiable information.
The types of personally identifiable information that are being collected on the individual.
How the commercial entity may use such information.
A description of the categories of potential recipients of such personally identifiable information.
Whether the individual is required to provide personally identifiable information in order to do business with the commercial entity.
How an individual may decline to have such personally identifiable information used or sold as described in subsection (a).
Time of notice
Notice shall be conveyed prior to the sale or use of the personally identifiable information as described in subsection (a) in such a manner as to allow the individual a reasonable period of time to consider the notice and limit such sale or use.
Medium of notice
The medium for providing notice must be—
the same medium in which the personally identifiable information is or will be collected, or a medium approved by the individual; or
in the case of oral communication, notice may be conveyed orally or in writing.
Form of notice
The notice shall be clear and conspicuous.
Opt-Out
Opportunity to opt-out of sale or marketing
The opportunity provided to limit the sale of personally identifiable information to nonaffiliated third parties or the disclosure of such information for marketing purposes, shall be easy to use, accessible and available in the medium the information is collected, or in a medium approved by the individual.
Duration of limitation
An individual’s limitation on the sale or marketing of personally identifiable information shall be considered permanent, unless otherwise specified by the individual.
Revocation of consent
After an individual grants consent to the use of that individual’s personally identifiable information, the individual may revoke the consent at any time, except to the extent that the commercial entity has taken action in reliance thereon. The commercial entity shall provide the individual an opportunity to revoke consent that is easy to use, accessible, and available in the medium the information was or is collected.
Not applicable
This section shall not apply to disclosure of personally identifiable information—
that is necessary to facilitate a transaction specifically requested by the consumer;
is used for the sole purpose of facilitating this transaction; and
in which the entity receiving or obtaining such information is limited, by contract, to use such formation for the purpose of completing the transaction.
Enforcement
In general
In accordance with the provisions of this section, the Federal Trade Commission shall have the authority to enforce any violation of section 101 of this Act.
Violations
The Federal Trade Commission shall treat a violation of section 101 as a violation of a rule under section 18a(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Transfer of enforcement authority
The Federal Trade Commission shall promulgate rules in accordance with section 553 of title 5, United States Code, allowing for the transfer of enforcement authority from the Federal Trade Commission to a Federal agency regarding section 101 of this Act. The Federal Trade Commission may permit a Federal agency to enforce any violation of section 101 if such agency submits a written request to the Commission to enforce such violations and includes in such request—
a description of the entities regulated by such agency that will be subject to the provisions of section 101;
an assurance that such agency has sufficient authority over the entities to enforce violations of section 101; and
a list of proposed rules that such agency shall use in regulating such entities and enforcing section 101.
Actions by the Commission
Absent transfer of enforcement authority to a Federal agency under subsection (c), the Federal Trade Commission shall prevent any person from violating section 101 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as provided to such Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.). Any entity that violates section 101 is subject to the penalties and entitled to the privileges and immunities provided in such Act in the same manner, by the same means, and with the same jurisdiction, power, and duties under such Act.
Relationship to other laws
Commission authority
Nothing contained in this title shall be construed to limit authority provided to the Commission under any other law.
Communications Act
Nothing in section 101 requires an operator of a website to take any action that is inconsistent with the requirements of section 222 or 631 of the Communications Act of 1934 (47 U.S.C. 222 and 5551).
Other Acts
Nothing in this title is intended to affect the applicability or the enforceability of any provision of, or any amendment made by—
the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.);
title V of the Gramm-Leach-Bliley Act;
the Health Insurance Portability and Accountability Act of 1996; or
the Fair Credit Reporting Act.
Public records
Nothing in this title shall be construed to restrict commercial entities from obtaining or disclosing personally identifying information from public records.
Civil penalties
In addition to any other penalty applicable to a violation of section 101(a), a penalty of up to $25,000 may be issued for each violation.
Enforcement regarding programs
In general
A Federal agency or department providing financial assistance to any entity required to comply with section 101 of this Act shall issue regulations requiring that such entity comply with such section or forfeit some or all of such assistance. Such regulations shall prescribe sanctions for noncompliance, require that such department or agency provide notice of failure to comply with such section prior to any action being taken against such recipient, and require that a determination be made prior to any action being taken against such recipient that compliance cannot be secured by voluntary means.
Federal financial assistance
The term Federal financial assistance means assistance through a grant, cooperative agreement, loan, or contract other than a contract of insurance or guaranty.
Safe harbor
A commercial entity may not be held to have violated any provision of this title if such entity complies with self-regulatory guidelines that—
are issued by seal programs or representatives of the marketing or online industries or by any other person; and
are approved by the Federal Trade Commission, after public comment has been received on such guidelines by the Commission, as meeting the requirements of this title.
Definitions
In this title:
Commercial entity
The term commercial entity—
means any person offering products or services involving commerce—
among the several States or with 1 or more foreign nations;
in any territory of the United States or in the District of Columbia, or between any such territory and—
another such territory; or
any State or foreign nation; or
between the District of Columbia and any State, territory, or foreign nation; and
does not include—
any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45);
any financial institution that is subject to title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.); or
any group health plan, health insurance issuer, or other entity that is subject to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 201 note).
Commission
The term Commission means the Federal Trade Commission.
Individual
The term individual means a person whose personally identifying information has been, is, or will be collected by a commercial entity.
Marketing
The term marketing means to make a communication about a product or service a purpose of which is to encourage recipients of the communication to purchase or use the product or service.
Medium
The term medium means any channel or system of communication including oral, written, and online communication.
Nonaffiliated third party
The term nonaffiliated third party means any entity that is not related by common ownership or affiliated by corporate control with, the commercial entity, but does not include a joint employee of such institution.
Personally identifiable information
The term personally identifiable information means individually identifiable information about the individual that is collected including—
a first, middle, or last name, whether given at birth or adoption, assumed, or legally changed;
a home or other physical address, including the street name, zip code, and name of a city or town;
an e-mail address;
a telephone number;
a photograph or other form of visual identification;
a birth date, birth certificate number, or place of birth for that person; or
information concerning the individual that is combined with any other identifier in this paragraph.
Sale; sell; sold
The terms sale, sell, and sold, with respect to personally identifiable information, mean the exchanging of such information for any thing of value, directly or indirectly, including the licensing, bartering, or renting of such information.
Writing
The term writing means writing in either a paper-based or computer-based form, including electronic and digital signatures.
Preemption
The provisions of this title shall supersede any statutory and common law of States and their political subdivisions insofar as that law may now or hereafter relate to the—
collection and disclosure of personally identifiable information for marketing purposes; and
collection and sale of personally identifiable information.
Effective Date
This title and the amendments made by this title shall take effect 1 year after the date of enactment of this Act.
Social security number misuse prevention
Findings
Congress makes the following findings:
The inappropriate display, sale, or purchase of social security numbers has contributed to a growing range of illegal activities, including fraud, identity theft, and, in some cases, stalking and other violent crimes.
While financial institutions, health care providers, and other entities have often used social security numbers to confirm the identity of an individual, the general display to the public, sale, or purchase of these numbers has been used to commit crimes, and also can result in serious invasions of individual privacy.
The Federal Government requires virtually every individual in the United States to obtain and maintain a social security number in order to pay taxes, to qualify for social security benefits, or to seek employment. An unintended consequence of these requirements is that social security numbers have become one of the tools that can be used to facilitate crime, fraud, and invasions of the privacy of the individuals to whom the numbers are assigned. Because the Federal Government created and maintains this system, and because the Federal Government does not permit individuals to exempt themselves from those requirements, it is appropriate for the Federal Government to take steps to stem the abuse of social security numbers.
The display, sale, or purchase of social security numbers in no way facilitates uninhibited, robust, and wide-open public debate, and restrictions on such display, sale, or purchase would not affect public debate.
No one should seek to profit from the display, sale, or purchase of social security numbers in circumstances that create a substantial risk of physical, emotional, or financial harm to the individuals to whom those numbers are assigned.
Consequently, this title provides each individual that has been assigned a social security number some degree of protection from the display, sale, and purchase of that number in any circumstance that might facilitate unlawful conduct.
Prohibition of the display, sale, or purchase of social security numbers
Prohibition
In general
Chapter 47 of title 18, United States Code, is amended by inserting after section 1028 the following:
Prohibition of the display, sale, or purchase of social security numbers
Definitions
In this section:
Display
The term display means to intentionally communicate or otherwise make available (on the Internet or in any other manner) to the general public an individual’s social security number.
Person
The term person means any individual, partnership, corporation, trust, estate, cooperative, association, or any other entity.
Purchase
The term purchase means providing directly or indirectly, anything of value in exchange for a social security number.
Sale
The term sale means obtaining, directly or indirectly, anything of value in exchange for a social security number.
State
The term State means any State of the United States, the District of Columbia, Puerto Rico, the Northern Mariana Islands, the United States Virgin Islands, Guam, American Samoa, and any territory or possession of the United States.
Limitation on display
Except as provided in section 1028B, no person may display any individual’s social security number to the general public without the affirmatively expressed consent of the individual.
Limitation on sale or purchase
Except as otherwise provided in this section, no person may sell or purchase any individual’s social security number without the affirmatively expressed consent of the individual.
Prerequisites for consent
In order for consent to exist under subsection (b) or (c), the person displaying or seeking to display, selling or attempting to sell, or purchasing or attempting to purchase, an individual’s social security number shall—
inform the individual of the general purpose for which the number will be used, the types of persons to whom the number may be available, and the scope of transactions permitted by the consent; and
obtain the affirmatively expressed consent (electronically or in writing) of the individual.
Exceptions
Nothing in this section shall be construed to prohibit or limit the display, sale, or purchase of a social security number—
required, authorized, or excepted under any Federal law;
for a public health purpose, including the protection of the health or safety of an individual in an emergency situation;
for a national security purpose;
for a law enforcement purpose, including the investigation of fraud and the enforcement of a child support obligation;
if the display, sale, or purchase of the number is for a use occurring as a result of an interaction between businesses, governments, or business and government (regardless of which entity initiates the interaction), including, but not limited to—
the prevention of fraud (including fraud in protecting an employee’s right to employment benefits);
the facilitation of credit checks or the facilitation of background checks of employees, prospective employees, or volunteers;
the retrieval of other information from other businesses, commercial enterprises, government entities, or private nonprofit organizations; or
when the transmission of the number is incidental to, and in the course of, the sale, lease, franchising, or merger of all, or a portion of, a business;
if the transfer of such a number is part of a data matching program involving a Federal, State, or local agency; or
if such number is required to be submitted as part of the process for applying for any type of Federal, State, or local government benefit or program;
Limitation
Nothing in this section shall prohibit or limit the display, sale, or purchase of social security numbers as permitted under title V of the Gramm-Leach-Bliley Act, or for the purpose of affiliate sharing as permitted under the Fair Credit Reporting Act, except that no entity regulated under such Acts may make social security numbers available to the general public, as may be determined by the appropriate regulators under such Acts. For purposes of this subsection, the general public shall not include affiliates or unaffiliated third-party business entities as may be defined by the appropriate regulators.
.
Conforming amendment
The chapter analysis for chapter 47 of title 18, United States Code, is amended by inserting after the item relating to section 1028 the following:
1028A. Prohibition of the display, sale, or purchase of social security numbers.
.
Study; report
In general
The Attorney General shall conduct a study and prepare a report on all of the uses of social security numbers permitted, required, authorized, or excepted under any Federal law. The report shall include a detailed description of the uses allowed as of the date of enactment of this Act and shall evaluate whether such uses should be continued or discontinued by appropriate legislative action.
Report
Not later than 1 year after the date of enactment of this Act, the Attorney General shall report to Congress findings under this subsection. The report shall include such recommendations for legislation based on criteria the Attorney General determines to be appropriate.
Effective Date
The amendments made by this section shall take effect on the date that is 30 days after the date on which the final regulations promulgated under section 5 are published in the Federal Register.
Application of Prohibition of the display, sale, or purchase of social security numbers to public records
Public records exception
In general
Chapter 47 of title 18, United States Code (as amended by section 3(a)(1)), is amended by inserting after section 1028A the following:
Display, sale, or purchase of public records containing social security numbers
Definition
In this section, the term public record means any governmental record that is made available to the general public.
In general
Except as provided in subsections (c), (d), and (e), section 1028A shall not apply to a public record.
Public records on the Internet or in an electronic medium
In general
Section 1028A shall apply to any public record first posted onto the Internet or provided in an electronic medium by, or on behalf of a government entity after the date of enactment of this section, except as limited by the Attorney General in accordance with paragraph (2).
Exception for government entities already placing public records on the Internet or in electronic form
Not later than 60 days after the date of enactment of this section, the Attorney General shall issue regulations regarding the applicability of section 1028A to any record of a category of public records first posted onto the Internet or provided in an electronic medium by, or on behalf of a government entity prior to the date of enactment of this section. The regulations will determine which individual records within categories of records of these government entities, if any, may continue to be posted on the Internet or in electronic form after the effective date of this section. In promulgating these regulations, the Attorney General may include in the regulations a set of procedures for implementing the regulations and shall consider the following:
The cost and availability of technology available to a governmental entity to redact social security numbers from public records first provided in electronic form after the effective date of this section.
The cost or burden to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments of complying with section 1028A with respect to such records.
The benefit to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments if the Attorney General were to determine that section 1028A should apply to such records.
Harvested social security numbers
Section 1028A shall apply to any public record of a government entity which contains social security numbers extracted from other public records for the purpose of displaying or selling such numbers to the general public.
Attorney General rulemaking on paper records
In general
Not later than 60 days after the date of enactment of this section, the Attorney General shall determine the feasibility and advisability of applying section 1028A to the records listed in paragraph (2) when they appear on paper or on another nonelectronic medium. If the Attorney General deems it appropriate, the Attorney General may issue regulations applying section 1028A to such records.
List of paper and other nonelectronic records
The records listed in this paragraph are as follows:
Professional or occupational licenses.
Marriage licenses.
Birth certificates.
Death certificates.
Other short public documents that display a social security number in a routine and consistent manner on the face of the document.
Criteria for Attorney General review
In determining whether section 1028A should apply to the records listed in paragraph (2), the Attorney General shall consider the following:
The cost or burden to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments of complying with section 1028A.
The benefit to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments if the Attorney General were to determine that section 1028A should apply to such records.
.
Conforming amendment
The chapter analysis for chapter 47 of title 18, United States Code (as amended by section 202(a)(2)), is amended by inserting after the item relating to section 1028A the following:
1028B. Display, sale, or purchase of public records containing social security numbers.
.
Study and report on social security numbers in public records
Study
The Comptroller General of the United States shall conduct a study and prepare a report on social security numbers in public records. In developing the report, the Comptroller General shall consult with the Administrative Office of the United States Courts, State and local governments that store, maintain, or disseminate public records, and other stakeholders, including members of the private sector who routinely use public records that contain social security numbers.
Report
Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report on the study conducted under paragraph (1). The report shall include a detailed description of the activities and results of the study and recommendations for such legislative action as the Comptroller General considers appropriate. The report, at a minimum, shall include—
a review of the uses of social security numbers in non-federal public records;
a review of the manner in which public records are stored (with separate reviews for both paper records and electronic records);
a review of the advantages or utility of public records that contain social security numbers, including the utility for law enforcement, and for the promotion of homeland security;
a review of the disadvantages or drawbacks of public records that contain social security numbers, including criminal activity, compromised personal privacy, or threats to homeland security;
the costs and benefits for State and local governments of removing social security numbers from public records, including a review of current technologies and procedures for removing social security numbers from public records; and
an assessment of the benefits and costs to businesses, their customers, and the general public of prohibiting the display of social security numbers on public records (with separate assessments for both paper records and electronic records).
Effective Date
The prohibition with respect to electronic versions of new classes of public records under section 1028B(b) of title 18, United States Code (as added by subsection (a)(1)) shall not take effect until the date that is 60 days after the date of enactment of this Act.
Rulemaking authority of the Attorney General
In general
Except as provided in subsection (b), the Attorney General may prescribe such rules and regulations as the Attorney General deems necessary to carry out the provisions of section 1028A(e)(5) of title 18, United States Code (as added by section 202(a)(1)).
Display, sale, or purchase rulemaking with respect to interactions between businesses, governments, or business and government
In general
Not later than 1 year after the date of enactment of this Act, the Attorney General, in consultation with the Commissioner of Social Security, the Chairman of the Federal Trade Commission, and such other heads of Federal agencies as the Attorney General determines appropriate, shall conduct such rulemaking procedures in accordance with subchapter II of chapter 5 of title 5, United States Code, as are necessary to promulgate regulations to implement and clarify the uses occurring as a result of an interaction between businesses, governments, or business and government (regardless of which entity initiates the interaction) permitted under section 1028A(e)(5) of title 18, United States Code (as added by section 202(a)(1)).
Factors to be considered
In promulgating the regulations required under paragraph (1), the Attorney General shall, at a minimum, consider the following:
The benefit to a particular business, to customers of the business, and to the general public of the display, sale, or purchase of an individual’s social security number.
The costs that businesses, customers of businesses, and the general public may incur as a result of prohibitions on the display, sale, or purchase of social security numbers.
The risk that a particular business practice will promote the use of a social security number to commit fraud, deception, or crime.
The presence of adequate safeguards and procedures to prevent—
misuse of social security numbers by employees within a business; and
misappropriation of social security numbers by the general public, while permitting internal business uses of such numbers.
The presence of procedures to prevent identity thieves, stalkers, and other individuals with ill intent from posing as legitimate businesses to obtain social security numbers.
Treatment of social security numbers on government documents
Prohibition of use of social security account numbers on checks issued for payment by governmental agencies
In general
Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) is amended by adding at the end the following:
No Federal, State, or local agency may display the social security account number of any individual, or any derivative of such number, on any check issued for any payment by the Federal, State, or local agency.
.
Effective Date
The amendment made by this subsection shall apply with respect to violations of section 205(c)(2)(C)(x) of the Social Security Act (42 U.S.C. 405(c)(2)(C)(x)), as added by paragraph (1), occurring after the date that is 3 years after the date of enactment of this Act.
Prohibition of appearance of social security account numbers on Driver’s licenses or motor vehicle registration
In general
Section 205(c)(2)(C)(vi) of the Social Security Act (42 U.S.C. 405(c)(2)(C)(vi)) is amended—
by inserting
(I)
after (vi)
; and
by adding at the end the following:
An agency of a State (or political subdivision thereof), in the administration of any driver’s license or motor vehicle registration law within its jurisdiction, may not display the social security account numbers issued by the Commissioner of Social Security, or any derivative of such numbers, on the face of any driver’s license or motor vehicle registration or any other document issued by such State (or political subdivision thereof) to an individual for purposes of identification of such individual.
Nothing in this subclause shall be construed as precluding an agency of a State (or political subdivision thereof), in the administration of any driver’s license or motor vehicle registration law within its jurisdiction, from using a social security account number for an internal use or to link with the database of an agency of another State that is responsible for the administration of any driver’s license or motor vehicle registration law.
.
Effective Date
The amendments made by this subsection shall apply with respect to licenses, registrations, and other documents issued or reissued after the date that is 1 year after the date of enactment of this Act.
Prohibition of inmate access to social security account numbers
In general
Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) (as amended by subsection (b)) is amended by adding at the end the following:
No Federal, State, or local agency may employ, or enter into a contract for the use or employment of, prisoners in any capacity that would allow such prisoners access to the social security account numbers of other individuals. For purposes of this clause, the term prisoner means an individual confined in a jail, prison, or other penal institution or correctional facility pursuant to such individual’s conviction of a criminal offense.
.
Effective Date
The amendment made by this subsection shall apply with respect to employment of prisoners, or entry into contract with prisoners, after the date that is 1 year after the date of enactment of this Act.
Limits on personal disclosure of a social security number for consumer transactions
In general
Part A of title XI of the Social Security Act (42 U.S.C. 1301 et seq.) is amended by adding at the end the following:
Limits on personal disclosure of a social security number for consumer transactions
In general
A commercial entity may not require an individual to provide the individual’s social security number when purchasing a commercial good or service or deny an individual the good or service for refusing to provide that number except—
for any purpose relating to—
obtaining a consumer report for any purpose permitted under the Fair Credit Reporting Act;
a background check of the individual conducted by a landlord, lessor, employer, voluntary service agency, or other entity as determined by the Attorney General;
law enforcement; or
a Federal, State, or local law requirement; or
if the social security number is necessary to verify the identity of the consumer to effect, administer, or enforce the specific transaction requested or authorized by the consumer, or to prevent fraud.
Application of civil money penalties
A violation of this section shall be deemed to be a violation of section 1129(a)(3)(F).
Application of criminal penalties
A violation of this section shall be deemed to be a violation of section 208(a)(8).
Limitation on class actions
No class action alleging a violation of this section shall be maintained under this section by an individual or any private party in Federal or State court.
State Attorney General enforcement
In general
Civil actions
In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that is prohibited under this section, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—
enjoin that practice;
enforce compliance with such section;
obtain damages, restitution, or other compensation on behalf of residents of the State; or
obtain such other relief as the court may consider appropriate.
Notice
In general
Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Attorney General—
written notice of the action; and
a copy of the complaint for the action.
Exemption
In general
Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.
Notification
With respect to an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the same time as the State attorney general files the action.
Intervention
In general
On receiving notice under paragraph (1)(B), the Attorney General shall have the right to intervene in the action that is the subject of the notice.
Effect of intervention
If the Attorney General intervenes in the action under paragraph (1), the Attorney General shall have the right to be heard with respect to any matter that arises in that action.
Construction
For purposes of bringing any civil action under paragraph (1), nothing in this section shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to—
conduct investigations;
administer oaths or affirmations; or
compel the attendance of witnesses or the production of documentary and other evidence.
Actions by the Attorney General of the United States
In any case in which an action is instituted by or on behalf of the Attorney General for violation of a practice that is prohibited under this section, no State may, during the pendency of that action, institute an action under paragraph (1) against any defendant named in the complaint in that action for violation of that practice.
Venue; service of process
Venue
Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
Service of process
In an action brought under paragraph (1), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Sunset
This section shall not apply on or after the date that is 6 years after the effective date of this section.
.
Evaluation and report
Not later than the date that is 6 years and 6 months after the date of enactment of this Act, the Attorney General, in consultation with the chairman of the Federal Trade Commission, shall issue a report evaluating the effectiveness and efficiency of section 1150A of the Social Security Act (as added by subsection (a)) and shall make recommendations to Congress as to any legislative action determined to be necessary or advisable with respect to such section, including a recommendation regarding whether to reauthorize such section.
Effective Date
The amendment made by subsection (a) shall apply to requests to provide a social security number occurring after the date that is 1 year after the date of enactment of this Act.
Extension of civil monetary penalties for misuse of a social security number
Treatment of withholding of material facts
Civil penalties
The first sentence of section 1129(a)(1) of the Social Security Act (42 U.S.C. 1320a–8(a)(1)) is amended—
by striking
who
and inserting who—
;
by striking
makes
and all that follows through shall be subject
to
and inserting the following:
makes, or causes to be made, a statement or representation of a material fact, for use in determining any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI, that the person knows or should know is false or misleading;
makes such a statement or representation for such use with knowing disregard for the truth; or
omits from a statement or representation for such use, or otherwise withholds disclosure of, a fact which the individual knows or should know is material to the determination of any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI and the individual knows, or should know, that the statement or representation with such omission is false or misleading or that the withholding of such disclosure is misleading, shall be subject to
;
by inserting
or each receipt of such benefits while withholding disclosure of such
fact
after each such statement or representation
;
by inserting
or because of such withholding of disclosure of a material fact
after because of such statement or representation
; and
by inserting
or such a withholding of disclosure
after such a
statement or representation
.
Administrative procedure for imposing penalties
The first sentence of section 1129A(a) of the Social Security Act (42 U.S.C. 1320a–8a(a)) is amended—
by striking
who
and inserting who—
; and
by striking
makes
and all that follows through shall be subject
to
and inserting the following:
makes, or causes to be made, a statement or representation of a material fact, for use in determining any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI, that the person knows or should know is false or misleading;
makes such a statement or representation for such use with knowing disregard for the truth; or
omits from a statement or representation for such use, or otherwise withholds disclosure of, a fact which the individual knows or should know is material to the determination of any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI and the individual knows, or should know, that the statement or representation with such omission is false or misleading or that the withholding of such disclosure is misleading, shall be subject to
.
Application of civil money penalties to elements of criminal violations
Section 1129(a) of the Social Security Act (42 U.S.C. 1320a–8(a)), as amended by subsection (a)(1), is amended—
by redesignating paragraph (2) as paragraph (4);
by redesignating the last sentence of paragraph (1) as paragraph (2) and inserting such paragraph after paragraph (1); and
by inserting after paragraph (2) (as so redesignated) the following:
Any person (including an organization, agency, or other entity) who—
uses a social security account number that such person knows or should know has been assigned by the Commissioner of Social Security (in an exercise of authority under section 205(c)(2) to establish and maintain records) on the basis of false information furnished to the Commissioner by any person;
falsely represents a number to be the social security account number assigned by the Commissioner of Social Security to any individual, when such person knows or should know that such number is not the social security account number assigned by the Commissioner to such individual;
knowingly alters a social security card issued by the Commissioner of Social Security, or possesses such a card with intent to alter it;
knowingly displays, sells, or purchases a card that is, or purports to be, a card issued by the Commissioner of Social Security, or possesses such a card with intent to display, purchase, or sell it;
counterfeits a social security card, or possesses a counterfeit social security card with intent to display, sell, or purchase it;
discloses, uses, compels the disclosure of, or knowingly displays, sells, or purchases the social security account number of any person in violation of the laws of the United States;
with intent to deceive the Commissioner of Social Security as to such person’s true identity (or the true identity of any other person) furnishes or causes to be furnished false information to the Commissioner with respect to any information required by the Commissioner in connection with the establishment and maintenance of the records provided for in section 205(c)(2);
offers, for a fee, to acquire for any individual, or to assist in acquiring for any individual, an additional social security account number or a number which purports to be a social security account number; or
being an officer or employee of a Federal, State, or local agency in possession of any individual’s social security account number, willfully acts or fails to act so as to cause a violation by such agency of clause (vi)(II) or (x) of section 205(c)(2)(C), shall be subject to, in addition to any other penalties that may be prescribed by law, a civil money penalty of not more than $5,000 for each violation. Such person shall also be subject to an assessment, in lieu of damages sustained by the United States resulting from such violation, of not more than twice the amount of any benefits or payments paid as a result of such violation.
.
Clarification of treatment of recovered amounts
Section 1129(e)(2)(B) of the
Social Security Act (42 U.S.C.
1320a–8(e)(2)(B)) is amended by striking In the case of
amounts recovered arising out of a determination relating to title VIII or
XVI,
and inserting In the case of any other amounts recovered
under this section,
.
Conforming amendments
Section
1129(b)(3)(A) of the Social
Security Act (42 U.S.C.
1320a–8(b)(3)(A)) is amended by striking charging fraud
or false statements
.
Section
1129(c)(1) of the Social Security
Act (42 U.S.C. 1320a–8(c)(1))
is amended by striking and representations
and inserting
, representations, or actions
.
Section
1129(e)(1)(A) of the Social
Security Act (42 U.S.C.
1320a–8(e)(1)(A)) is amended by striking statement or
representation referred to in subsection (a) was made
and inserting
violation occurred
.
Effective dates
In general
Except as provided in paragraph (2), the amendments made by this section shall apply with respect to violations of sections 1129 and 1129A of the Social Security Act (42 U.S.C. 1320–8 and 1320a–8a), as amended by this section, committed after the date of enactment of this Act.
Violations by government agents in possession of social security numbers
Section 1129(a)(3)(I) of the Social Security Act (42 U.S.C. 1320a–8(a)(3)(I)), as added by subsection (b), shall apply with respect to violations of that section occurring on or after the effective date described in section 202(c).
Criminal penalties for the misuse of a social security number
Prohibition of wrongful use as personal identification number
No person may obtain any individual’s social security number for purposes of locating or identifying an individual with the intent to physically injure, harm, or use the identity of the individual for any illegal purpose.
Criminal sanctions
Section 208(a) of the Social Security Act (42 U.S.C. 408(a)) is amended—
in paragraph (8),
by inserting or
after the semicolon; and
by inserting after paragraph (8) the following:
except as provided in subsections (e) and (f) of section 1028A of title 18, United States Code, knowingly and willfully displays, sells, or purchases (as those terms are defined in section 1028A(a) of title 18, United States Code) any individual’s social security account number without having met the prerequisites for consent under section 1028A(d) of title 18, United States Code; or
obtains any individual’s social security number for the purpose of locating or identifying the individual with the intent to injure or to harm that individual, or to use the identity of that individual for an illegal purpose;
.
Civil actions and civil penalties
Civil action in State courts
In general
Any individual aggrieved by an act of any person in violation of this title or any amendments made by this title may, if otherwise permitted by the laws or rules of the court of a State, bring in an appropriate court of that State—
an action to enjoin such violation;
an action to recover for actual monetary loss from such a violation, or to receive up to $500 in damages for each such violation, whichever is greater; or
both such actions.
Statute of limitations
An action may be commenced under this subsection not later than the earlier of—
5 years after the date on which the alleged violation occurred; or
3 years after the date on which the alleged violation was or should have been reasonably discovered by the aggrieved individual.
Nonexclusive remedy
The remedy provided under this subsection shall be in addition to any other remedies available to the individual.
Civil penalties
In general
Any person who the Attorney General determines has violated any section of this title or of any amendments made by this title shall be subject, in addition to any other penalties that may be prescribed by law—
to a civil penalty of not more than $5,000 for each such violation; and
to a civil penalty of not more than $50,000, if the violations have occurred with such frequency as to constitute a general business practice.
Determination of violations
Any willful violation committed contemporaneously with respect to the social security numbers of 2 or more individuals by means of mail, telecommunication, or otherwise, shall be treated as a separate violation with respect to each such individual.
Enforcement procedures
The provisions of section 1128A of the Social Security Act (42 U.S.C. 1320a–7a), other than subsections (a), (b), (f), (h), (i), (j), (m), and (n) and the first sentence of subsection (c) of such section, and the provisions of subsections (d) and (e) of section 205 of such Act (42 U.S.C. 405) shall apply to a civil penalty action under this subsection in the same manner as such provisions apply to a penalty or proceeding under section 1128A(a) of such Act (42 U.S.C. 1320a–7a(a)), except that, for purposes of this paragraph, any reference in section 1128A of such Act (42 U.S.C. 1320a–7a) to the Secretary shall be deemed to be a reference to the Attorney General.
Federal injunctive authority
In addition to any other enforcement authority conferred under this title or the amendments made by this title, the Federal Government shall have injunctive authority with respect to any violation by a public entity of any provision of this title or of any amendments made by this title.
Limitations on sale and sharing of nonpublic personal financial information
Definition of sale
Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809) is amended by adding at the end the following:
Sale
The terms sale, sell, and sold, with respect to nonpublic personal information, mean the exchange of such information for any thing of value, directly or indirectly, including the licensing, bartering, or renting of such information.
.
Rules applicable to sale of nonpublic personal information
Section 502 of the Gramm-Leach-Bliley Act (15 U.S.C. 6802) is amended—
in the section
heading, by inserting sales, and other
sharing
after
disclosures
;
in subsection
(a), by striking disclose to
and inserting sell or
otherwise disclose to an affiliate or
;
in subsection (b)—
in the subsection
heading, by inserting for Disclosures to
Affiliates
before the period;
by striking
a nonaffiliated third party
each place that term appears and
inserting an affiliate
;
by striking
such third party
each place that term appears and inserting
such affiliate
;
by striking
may not disclose
and inserting may not sell or otherwise
disclose
; and
by striking paragraph (2) and inserting the following:
Exception
This subsection shall not prevent a financial institution from providing nonpublic personal information to an affiliated third party to perform services for or functions on behalf of the financial institution, including marketing of the financial institution’s own products or services, if the financial institution fully discloses the provision of such information and requires the affiliate to maintain the confidentiality of such information.
;
in subsection
(d), by striking disclose
and inserting sell or otherwise
disclose
;
by striking subsection (e);
by redesignating subsections (c) and (d) as subsections (e) and (f), respectively; and
by inserting after subsection (b) the following:
Opt in for disclosures to nonaffiliated third parties
Affirmative consent required
A financial institution may not sell or otherwise disclose nonpublic personal information to any nonaffiliated third party, unless the consumer to whom the information pertains—
has affirmatively consented to the sale or disclosure of such information; and
has not withdrawn the consent.
Exception
This subsection shall not prevent a financial institution from providing nonpublic personal information to a nonaffiliated third party to perform services for or functions on behalf of the financial institution, including marketing of the financial institution’s own products or services (subject to subsection (d) with respect to joint agreements between 2 or more financial institutions), if the financial institution fully discloses the provision of such information and enters into a contractual agreement with the nonaffiliated third party that requires that third party to maintain the confidentiality of such information.
Opt out for joint agreements
A financial institution may not sell or otherwise disclose nonpublic personal information to a nonaffiliated third party for the purpose of offering financial products or services pursuant to a joint agreement between 2 or more financial institutions, unless—
the financial institution clearly and conspicuously discloses to the consumer to whom the information pertains, in writing or in electronic form or other form permitted by the regulations prescribed under section 504, that such information may be disclosed to such nonaffiliated third party;
the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such nonaffiliated third party;
the consumer is given an explanation of how the consumer can exercise that nondisclosure option; and
the financial institution receiving the nonpublic personal information signs a written agreement obliging it—
to maintain the confidentiality of the information; and
to refrain from using, selling, or otherwise disclosing the information other than to carry out the joint offering or servicing of the financial product or financial service that is the subject of the written agreement.
.
Exceptions to disclosure prohibition
In general
Section 502 of the Gramm-Leach-Bliley Act (15 U.S.C. 6802), as amended by this title, is amended by adding at the end the following:
General exceptions
Notwithstanding any other provision of this section, this section does not prohibit—
the sale or other disclosure of nonpublic personal information to an affiliate or a nonaffiliated third party—
as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer to whom the information pertains, or in connection with—
servicing or processing a financial product or service requested or authorized by the consumer;
maintaining or servicing the account of the consumer with the financial institution, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity; or
a proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer;
with the consent or at the direction of the consumer, in accordance with applicable rules prescribed under this subtitle;
to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978; or
to law enforcement agencies (including a Federal functional regulator, the Secretary of the Treasury, with respect to subchapter II of chapter 53 of title 31, United States Code, and chapter 2 of title I of Public Law 91–508 (12 U.S.C. 1951–1959), a State insurance authority, or the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety;
the disclosure, other than the sale, of nonpublic personal information to identify or locate missing and abducted children, witnesses, criminals, and fugitives, parties to lawsuits, parents, delinquents in child support payments, organ and bone marrow donors, pension fund beneficiaries, and missing heirs; or
the disclosure, other than the sale, of nonpublic personal information—
to protect the confidentiality or security of the records of the financial institution pertaining to the consumer, the service or product, or the transaction therein;
to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
for required institutional risk control, or for resolving customer disputes or inquiries;
to persons holding a legal or beneficial interest relating to the consumer;
to persons acting in a fiduciary or representative capacity on behalf of the consumer;
to provide information to insurance rate advisory organizations, guaranty funds or agencies, applicable rating agencies of the financial institution, persons assessing the compliance of the institution with industry standards, or the attorneys, accountants, or auditors of the institution;
to a consumer reporting agency, in accordance with the Fair Credit Reporting Act or from a consumer report reported by a consumer reporting agency, as those terms are defined in that Act;
in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit;
to comply with Federal, State, or local laws, rules, or other applicable legal requirements, or with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or
to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes, as authorized by law.
Denial of service prohibited
A financial institution may not deny any consumer a financial product or a financial service as a result of the refusal by the consumer to grant consent to disclosure under this section or the exercise by the consumer of a nondisclosure option under this section, except that nothing in this subsection may be construed to prohibit a financial institution from offering incentives to elicit consumer consent to the use of his or her nonpublic personal information.
.
Repeal of regulatory exemption authority
Section 504 of the Gramm-Leach-Bliley Act (15 U.S.C. 6804) is amended—
by striking subsection (b);
by striking
(a) Regulatory
Authority.—
;
by redesignating paragraphs (1), (2), and (3) as subsections (a), (b), and (c), respectively, and moving the margins 2 ems to the left; and
by striking
paragraph (1)
and inserting subsection
(a)
.
Conforming amendments
Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is amended—
in section 503(b)(1) (15 U.S.C. 6803(b)(1))—
by inserting
affiliates and
before nonaffiliated
; and
in subparagraph
(A), by striking 502(e)
and inserting 502(g)
;
and
in section
509(3)(D) (15
U.S.C. 6809(3)(D)), by striking 502(e)(1)(C)
and
inserting 502(g)(1)(A)(iii)
.
Regulatory authority
Not later than 6 months after the date of enactment of this Act, the agencies referred to in section 504(a)(1) of the Gramm-Leach-Bliley Act (15 U.S.C. 6804(a)(1)) shall promulgate final regulations in accordance with that section 504 to carry out the amendments made by this Act.
Effective Date
This title and the amendments made by this title shall take effect 6 months after the date of enactment of this Act.
Limitations on the provision of protected health information
Definitions
In this title:
Business associate
In general
Except as provided in subparagraph (B), the term business associate means, with respect to a covered entity, a person who—
on behalf of such covered entity or of an organized health care arrangement in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of—
a function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or
any other function or activity regulated under subchapter C of title 45, Code of Federal Regulations; or
provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in section 164.501 of title 45, Code of Federal Regulations), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.
Limitations
In general
A covered entity participating in an organized health care arrangement that performs a function or activity as described by subparagraph (A)(i) for or on behalf of such organized health care arrangement, or that provides a service as described in subparagraph (A)(ii) to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement.
Limitation
A covered entity may be a business associate of another covered entity.
Covered entity
The term covered entity means—
a health plan;
a health care clearinghouse; and
a health care provider who transmits any health information in electronic form in connection with a transaction covered by parts 160 through 164 of title 45, Code of Federal Regulations.
Disclosure
The term disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.
Employer
The term employer has the meaning given that term in section 3401(d) of the Internal Revenue Code of 1986.
Group health plan
The term group health plan means an employee welfare benefit plan (as defined in section 3(1) of the Employee Retirement Income and Security Act of 1974 (29 U.S.C. 1002(1)), including insured and self-insured plans, to the extent that the plan provides medical care (as defined in section 2791(a)(2) of the Public Health Service Act, 42 U.S.C. 300gg–91(a)(2)), including items and services paid for as medical care, to employees or their dependents directly or through insurance, reimbursement, or otherwise, that—
has 50 or more participants (as defined in section 3(7) of Employee Retirement Income and Security Act of 1974, 29 U.S.C. 1002(7)); or
is administered by an entity other than the employer that established and maintains the plan.
Health care
The term health care includes, but is not limited to, the following:
Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body.
The sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
Health care clearinghouse
The term health care clearinghouse means a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and value-added networks and switches, that—
processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction; or
receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.
Health care provider
The term health care provider has the meaning given the terms provider of services and provider of medical or health services in subsections (u) and (s) of section 1861 of the Social Security Act (42 U.S.C. 1395x), respectively, and includes any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
Health information
The term health information means any information, whether oral or recorded in any form or medium, that—
is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
Health insurance issuer
The term health insurance issuer means a health insurance issuer (as defined in section 2791(b)(2) of the Public Health Service Act, 42 U.S.C. 300gg–91(b)(2)) and used in the definition of health plan in this section and includes an insurance company, insurance service, or insurance organization (including an HMO) that is licensed to engage in the business of insurance in a State and is subject to State law that regulates insurance. Such term does not include a group health plan.
Health maintenance organization
The term health maintenance organization (HMO) (as defined in section 2791(b)(3) of the Public Health Service Act, 42 U.S.C. 300gg–91 (b)(3)) and used in the definition of health plan in this section, means a federally qualified HMO, an organization recognized as an HMO under State law, or a similar organization regulated for solvency under State law in the same manner and to the same extent as such an HMO.
Health oversight agency
The term health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
Health plan
The term health plan means an individual or group plan that provides, or pays the cost of, medical care, as defined in section 2791(a)(2) of the Public Health Service Act (42 U.S.C. 300gg–91(a)(2))—
including, singly or in combination—
a group health plan;
a health insurance issuer;
an HMO;
part A or B of the medicare program under title XVIII of the Social Security Act (42 U.S.C. 1395 et seq.);
the medicaid program under title XIX of the Social Security Act (42 U.S.C. 1396 et seq.);
an issuer of a medicare supplemental policy (as defined in section 1882(g)(1) of the Social Security Act, 42 U.S.C. 1395ss(g)(1));
an issuer of a long-term care policy, excluding a nursing home fixed-indemnity policy;
an employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of 2 or more employers;
the health care program for active military personnel under title 10, United States Code;
the veterans health care program under chapter 17 of title 38, United States Code;
the Civilian Health and Medical Program of the Uniformed Services (CHAMPUS) (as defined in section 1072(4) of title 10, United States Code);
the Indian Health Service program under the Indian Health Care Improvement Act (25 U.S.C. 1601 et seq.);
the Federal Employees Health Benefits Program under chapter 89 of title 5, United States Code;
an approved State child health plan under title XXI of the Social Security Act (42 U.S.C. 1397aa et seq.), providing benefits for child health assistance that meet the requirements of section 2103 of such Act (42 U.S.C. 1397cc);
the Medicare+Choice program under part C of title XVIII of the Social Security Act (42 U.S.C. 1395w–21 et seq.);
a high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals; and
any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the Public Health Service Act (42 U.S.C. 300gg–91(a)(2)); and
excluding—
any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the Public Health Service Act (42 U.S.C. 300gg–91(c)(1)); and
a government-funded program (other than 1 listed in clause (i) through (xvi) of subparagraph (A)), whose principal purpose is other than providing, or paying the cost of, health care, or whose principal activity is the direct provision of health care to persons, or the making of grants to fund the direct provision of health care to persons.
Individually identifiable health information
The term individually identifiable health information means information that is a subset of health information, including demographic information collected from an individual, that—
is created or received by a covered entity or employer; and
relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and
identifies an individual; or
with respect to which there is a reasonable basis to believe that the information can be used to identify an individual.
Law enforcement official
The term law enforcement official means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to—
investigate or conduct an official inquiry into a potential violation of law; or
prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.
Life insurer
The term life insurer means a life insurance company (as defined in section 816 of the Internal Revenue Code of 1986), including the employees and agents of such company.
Marketing
The term marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Noncovered entity
The term noncovered entity means any person or public or private entity that is not a covered entity, including but not limited to a business associate of a covered entity, a covered entity if such covered entity is acting as a business associate, a health researcher, school or university, life insurer, employer, public health authority, health oversight agency, or law enforcement official, or any person acting as an agent of such entities or persons.
Organized health care arrangement
The term organized health care arrangement means—
a clinically integrated care setting in which individuals typically receive health care from more than 1 health care provider;
an organized system of health care in which more than 1 covered entity participates, and in which the participating covered entities—
hold themselves out to the public as participating in a joint arrangement; and
participate in joint activities including at least—
utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;
quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or
payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk;
a group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;
a group health plan and 1 or more other group health plans each of which are maintained by the same plan sponsor; or
the group health plans described in subparagraph (D) and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.
Protected health information
In general
The term protected health information means individually identifiable health information that, except as provided in subparagraph (B), is—
transmitted by electronic media;
maintained in any medium described in the definition of electronic media in section 162.103 of title 45, Code of Federal Regulations; or
transmitted or maintained in any other form or medium.
Exclusions
Such term does not include individually identifiable health information in—
education records covered by the Family Educational Rights and Privacy Act of 1974 (section 444 of the General Education Provisions Act (20 U.S.C. 1232g));
records described in subsection (a)(4)(B)(iv) of that Act; or
employment records held by a covered entity in its role as an employer.
Public health authority
The term public health authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.
School or university
The term school or university means an institution or place for instruction or education, including an elementary school, secondary school, or institution of higher learning, a college, or an assemblage of colleges united under 1 corporate organization or government.
Secretary
The term Secretary means the Secretary of Health and Human Services.
Sale; sell; sold
The terms sale, sell, and sold, with respect to protected health information, mean the exchange of such information for anything of value, directly or indirectly, including the licensing, bartering, or renting of such information.
Use
The term use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.
Writing
The term writing means writing in either a paper-based or computer-based form, including electronic and digital signatures.
Prohibition against selling protected health information
Valid authorization required
In general
A noncovered entity shall not sell the protected health information of an individual or use such information for marketing purposes without an authorization that is valid under section 403. When a noncovered entity obtains or receives authorization to sell such information, such sale must be consistent with such authorization.
No duplicate authorization required
Nothing in paragraph (1) shall be construed as requiring a noncovered entity that receives from a covered entity an authorization that is valid under section 403 to obtain a separate authorization from an individual before the sale or use of the individual’s protected health information so long as the sale or use of the information is consistent with the terms of the authorization.
Scope
A sale of protected health information as described under subsection (a) shall be limited to the minimum amount of information necessary to accomplish the purpose for which the sale is made.
Purpose
A recipient of information sold pursuant to this title may use or disclose such information solely to carry out the purpose for which the information was sold.
Not required
Nothing in this title permitting the sale of protected health information shall be construed to require such sale.
Identification of information as protected health information
Information sold pursuant to this title shall be clearly identified as protected health information.
No waiver
Except as provided in this title, an individual’s authorization to sell protected health information shall not be construed as a waiver of any rights that the individual has under other Federal or State laws, the rules of evidence, or common law.
Authorization for sale or marketing of protected health information by noncovered entities
Valid authorization
A valid authorization is a document that complies with all requirements of this section. Such authorization may include additional information not required under this section, provided that such information is not inconsistent with the requirements of this section.
Defective authorization
An authorization is not valid, if the document submitted has any of the following defects:
The expiration date has passed or the expiration event is known by the noncovered entity to have occurred.
The authorization has not been filled out completely, with respect to an element described in subsections (e) and (f).
The authorization is known by the noncovered entity to have been revoked.
The authorization lacks an element required by subsections (e) and (f).
Any material information in the authorization is known by the noncovered entity to be false.
Revocation of authorization
An individual may revoke an authorization provided under this section at any time provided that the revocation is in writing, except to the extent that the noncovered entity has taken action in reliance thereon.
Documentation
In general
A noncovered entity must document and retain any signed authorization under this section as required under paragraph (2).
Standard
A noncovered entity shall, if a communication is required by this title to be in writing, maintain such writing, or an electronic copy, as documentation.
Retention period
A noncovered entity shall retain the documentation required by this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
Content of authorization
Content
An authorization described in subsection (a) shall—
contain a description of the information to be sold that identifies such information in a specific and meaningful manner;
contain the name or other specific identification of the person, or class of persons, authorized to sell the information;
contain the name or other specific identification of the person, or class of persons, to whom the information is to be sold;
include an expiration date or an expiration event relating to the selling of such information that signifies that the authorization is valid until such date or event;
include a statement that the individual has a right to revoke the authorization in writing and the exceptions to the right to revoke, and a description of the procedure involved in such revocation;
be in writing and include the signature of the individual and the date, or if the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual; and
include a statement explaining the purpose for which such information is sold.
Plain language
The authorization shall be written in plain language.
Notice
In general
The authorization shall include a statement that the individual may—
inspect or copy the protected health information to be sold; and
refuse to sign the authorization.
Copy to the individual
A noncovered entity shall provide the individual with a copy of the signed authorization.
Model authorizations
The Secretary, after notice and opportunity for public comment, shall develop and disseminate model written authorizations of the type described in this section and model statements of the limitations on such authorizations. Any authorization obtained on a model authorization form developed by the Secretary pursuant to the preceding sentence shall be deemed to satisfy the requirements of this section.
Noncoercion
A covered entity or noncovered entity shall not condition the purchase of a product or the provision of a service to an individual based on whether such individual provides an authorization to such entity as described in this section.
Prohibition against retaliation
A noncovered entity that collects protected health information, may not adversely affect another person, directly or indirectly, because such person has exercised a right under this title, disclosed information relating to a possible violation of this title, or associated with, or assisted, a person in the exercise of a right under this title.
Rule of construction
The requirements of this title shall not be construed to impose any additional requirements or in any way alter the requirements imposed upon covered entities under parts 160 through 164 of title 45, Code of Federal Regulations.
Regulations
In general
The Secretary shall promulgate regulations implementing the provisions of this title.
Timeframe
Not later than 1 year after the date of enactment of this Act, the Secretary shall publish proposed regulations in the Federal Register. With regard to such proposed regulations, the Secretary shall provide an opportunity for submission of comments by interested persons during a period of not less than 90 days. Not later than 2 years after the date of enactment of this Act, the Secretary shall publish final regulations in the Federal Register.
Enforcement
In general
A covered entity or noncovered entity that knowingly violates section 402 shall be subject to a civil money penalty under this section.
Amount
The civil money penalty described in subsection (a) shall not exceed $100,000. In determining the amount of any penalty to be assessed, the Secretary shall take into account the previous record of compliance of the entity being assessed with the applicable provisions of this title and the gravity of the violation.
Administrative review
Opportunity for hearing
The entity assessed shall be afforded an opportunity for a hearing by the Secretary upon request made within 30 days after the date of the issuance of a notice of assessment. In such hearing the decision shall be made on the record pursuant to section 554 of title 5, United States Code. If no hearing is requested, the assessment shall constitute a final and unappealable order.
Hearing procedure
If a hearing is requested, the initial agency decision shall be made by an administrative law judge, and such decision shall become the final order unless the Secretary modifies or vacates the decision. Notice of intent to modify or vacate the decision of the administrative law judge shall be issued to the parties within 30 days after the date of the decision of the judge. A final order which takes effect under this paragraph shall be subject to review only as provided under subsection (d).
Judicial review
Filing of action for review
Any entity against whom an order imposing a civil money penalty has been entered after an agency hearing under this section may obtain review by the United States district court for any district in which such entity is located or the United States District Court for the District of Columbia by filing a notice of appeal in such court within 30 days from the date of such order, and simultaneously sending a copy of such notice by registered mail to the Secretary.
Certification of administrative record
The Secretary shall promptly certify and file in such court the record upon which the penalty was imposed.
Standard for review
The findings of the Secretary shall be set aside only if found to be unsupported by substantial evidence as provided by section 706(2)(E) of title 5, United States Code.
Appeal
Any final decision, order, or judgment of the district court concerning such review shall be subject to appeal as provided in chapter 83 of title 28 of such Code.
Failure to pay assessment; maintenance of action
Failure to pay assessment
If any entity fails to pay an assessment after it has become a final and unappealable order, or after the court has entered final judgment in favor of the Secretary, the Secretary shall refer the matter to the Attorney General who shall recover the amount assessed by action in the appropriate United States district court.
Nonreviewability
In such action the validity and appropriateness of the final order imposing the penalty shall not be subject to review.
Payment of penalties
Except as otherwise provided, penalties collected under this section shall be paid to the Secretary (or other officer) imposing the penalty and shall be available without appropriation and until expended for the purpose of enforcing the provisions with respect to which the penalty was imposed.
Driver’s license privacy
Driver’s license privacy
Section 2725 of title 18, United States Code, is amended by striking paragraphs (2) through (4) and adding the following:
person
means an individual, organization, or entity, but does not include a State or
agency thereof;
personal
information
means information that identifies an individual, including
an individual’s photograph, social security number, driver identification
number, name, address (but not the 5-digit zip code), telephone number, medical
or disability information, any physical copy of a driver’s license, birth date,
information on physical characteristics, including height, weight, sex or eye
color, or any biometric identifiers on a license, including a finger print, but
not information on vehicular accidents, driving violations, and driver’s
status;
highly
restricted personal information
means an individual’s photograph or
image, social security number, medical or disability information, any physical
copy of a driver’s license, driver identification number, birth date,
information on physical characteristics, including height, weight, sex, or eye
color, or any biometric identifiers on a license, including a finger print;
and
.
Miscellaneous
Enforcement by State Attorneys General
In general
Civil actions
In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that is prohibited under title I, II, or IV of this Act or under any amendment made by such a title, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—
enjoin that practice;
enforce compliance with such titles or such amendments;
obtain damage, restitution, or other compensation on behalf of residents of the State; or
obtain such other relief as the court may consider to be appropriate.
Notice
In general
Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Attorney General—
written notice of the action; and
a copy of the complaint for the action.
Exemption
In general
Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.
Notification
In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the same time as the State attorney general files the action.
Intervention
In general
On receiving notice under subsection (a)(2), the Attorney General shall have the right to intervene in the action that is the subject of the notice.
Effect of intervention
If the Attorney General intervenes in an action under subsection (a), the Attorney General shall have the right to be heard with respect to any matter that arises in that action.
Construction
For purposes of bringing any civil action under subsection (a), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to—
conduct investigations;
administer oaths or affirmations; or
compel the attendance of witnesses or the production of documentary and other evidence.
Actions by the Attorney General of the United States
In any case in which an action is instituted by or on behalf of the Attorney General for violation of a practice that is prohibited under title I, II, IV, or V of this Act or under any amendment made by such a title, no State may, during the pendency of that action, institute an action under subsection (a) against any defendant named in the complaint in that action for violation of that practice.
Venue; service of process
Venue
Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
Service of process
In an action brought under subsection (a), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Federal injunctive authority
In addition to any other enforcement authority conferred under this Act or under an amendment made by this Act, the Federal Government shall have injunctive authority with respect to any violation of any provision of title I, II, or IV of this Act or of any amendment made by such a title, without regard to whether a public or private entity violates such provision.