Medical Information Privacy and Security Act

TABLE OF CONTENTS: Title I: Individual's Rights Subtitle A: Access to Protected Health Information by Subjects of the Information Subtitle B: Establishment of Safeguards Title II: Restrictions on Use and Disclosure Subtitle A: General Restriction Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization Subtitle C: Special Rules Governing Disclosure Title III: Office of Health Information Privacy of the Department of Health and Human Services Subtitle A: Establishment Subtitle B: Enforcement Title IV: Miscellaneous Medical Information Privacy and Security Act - Title I: Individual's Rights - Subtitle A: Access to Protected Health Information by Subjects of the Information - Requires specified parties to permit an individual who is the subject of protected health information to: (1) inspect and copy the information; (2) request addition of a supplement (or the individual's disagreement statement); and (3) prepare and disseminate notice of privacy rights and practices. (The list of specified parties varies from provision to provision throughout this Act. The list includes, in various provisions, such individuals and entities as health care providers, health plans, health oversight agencies, public health authorities, employers, health researchers, law enforcement officials, health or life insurers, schools, universities, emergency medical personnel, and their agents.) Mandates development of model notices. Subtitle B: Establishment of Safeguards - Requires specified parties to establish safeguards to ensure the confidentiality, security, accuracy, and integrity of protected health information. Mandates development of model safeguard guidelines. Requires specified parties to establish a record of disclosures not related to payment or treatment. Title II: Restrictions on Use and Disclosure - Subtitle A: General Restriction - Prohibits specified parties from disclosing protected health information except as authorized under this title. Allows disclosure if authorized by the information subject. Mandates model written authorizations and model limitations. Provides for segregation of files on request, authorization revocation, and records of authorizations and revocations. Subtitle B: Limited Circumstances Providing for Disclosure Without Authorization - Allows any person to disclose protected health information: (1) in order to allay or remedy a threat of imminent physical or mental harm to an information subject; and (2) if there is an identifiable threat of serious injury or death to an identifiable individual or group and other requirements are met. (Sec. 212) Authorizes disclosure to: (1) a public health authority; (2) an agency charged by law to protect the health and safety of individuals if the information subject is vulnerable to abuse or neglect by an agency providing health or social services; (3) a health oversight agency; and (4) on court order, a law enforcement authority. Subtitle C: Special Rules Governing Disclosure - Regulates disclosure: (1) to next of kin; (2) in directories of individuals admitted to a facility; (3) necessary to assist in the identification of a deceased individual; and (4) relating to minors. (Sec. 222) Applies the requirements and protections of specified parts of the Code of Federal Regulations to research conducted by all research facilities using personally identifiable health information. Directs the Secretary of Health and Human Services to report to the Congress whether written informed consent should be required and, if so, under what circumstances, before personally identifiable data can be used for medical research. (Sec. 223) Allows specified parties to disclose for certain judicial and administrative purposes. (Sec. 224) Sets forth a sequence regulating who may exercise an individual's rights under this Act when the individual cannot knowingly or effectively do so, designating first a person named in a health care power of attorney, then an individual authorized by law or by an instrument recognized under law to act as the individual's representative, then next of kin, and last the health care provider, in each case moving to the next level if the person cannot be contacted after a reasonable effort. Applies this Act to deceased persons for two years after death and provides for the exercise of rights on behalf of a deceased individual. (Sec. 225) Prohibits retaliation for the exercise of rights under this Act or disclosure of information regarding a possible violation of this Act. Title III: Office of Health Information Privacy of the Department of Health and Human Services - Subtitle A: Establishment - Establishes the Office of Health Information Privacy, including in its duties receiving and investigating violation complaints and providing for the conduct of audits. Subtitle B: Enforcement - Chapter 1: Criminal Provisions - Amends the Federal criminal code to impose criminal penalties for knowingly and intentionally obtaining or disclosing protected health information in violation of title II of this Act. (Sec. 312) Mandates regulations and procedures to permit the debarment of specified parties from receiving benefits under any Federal health programs if the managers or officers are found guilty of such obtaining or disclosing. Authorizes the Attorney General to provide advice, technical assistance, and guidance to reduce improper disclosure. Chapter 2: Civil Sanctions - Imposes civil monetary penalties on specified parties if the Office determines a party has substantially and materially failed to comply with this Act. (Sec. 323) Allows any individual whose rights under this Act have been knowingly or negligently violated to bring a civil action to recover preliminary and equitable relief, compensatory (or specified liquidated) damages, punitive damages (for knowing violations), and attorney's fees. Sets a time limit for the commencement of actions. Title IV: Miscellaneous - Amends the Privacy Act of 1974 to require an agency that receives protected health information to promulgate rules to exempt a system of records within the agency from all but specified provisions of that Act.