TABLE OF CONTENTS:

• Title I: Protection of Health Insurance
• Title II: Rights of Protected Individuals
• Title III: Permissible Disclosures of Protected Health Information
• Title IV: Miscellaneous Provisions
• Title V: General Provisions

Health Information Privacy Act - Title I: Protection of Health Information - Provides that use of protected health information by health information custodians (HICs) shall protect the reasonable expectation of privacy of protected individuals and shall be in accordance with fair information practices. Sets restrictions on such use and on disclosure. Requires an HIC to limit use of protected health information to the minimum amount and duration necessary to accomplish the use. Establishes the following: (1) standards for authorizations for use and disclosure; and (2) safeguards against misuse and prohibited disclosures, requiring an HIC to consider providing additional protections for mental health and other especially sensitive protected health information, as appropriate.

Title II: Rights of Protected Individuals - Grants protected individuals the right to the following: (1) a reasonable opportunity to inspect and copy protected health information maintained by an HIC; (2) a reasonable opportunity to correct or amend protected health information maintained by an HIC; (3) a reasonable opportunity to review a history of the disclosures of protected health information about the individual made by an HIC: and (4) notice of the information practices of HICs and a reasonable opportunity to seek limitations on the use and disclosure of protected health information in addition to the limitations provided in such practices.

Title III: Permissible Disclosures of Protected Health Information - Allows an HIC to disclose protected health information, without obtaining an authorization under title I of this Act, for the purpose of providing health care to an individual or paying for health care so provided. Prohibits HIC disclosure without such authorization to a health care payer, however, of protected health information created or received in the course of providing such care to an individual who pays for it himself or herself.

(Sec. 302) Permits an HIC to disclose protected health information for the purpose of health oversight, without obtaining such an authorization.

Requires the Secretary to permit an HIC to disclose protected health information to Federal, State, and local agencies (or affiliated persons) authorized by law to investigate, regulate, enforce laws relating to, or license, certify, or accredit persons engaged in, the provision of, or payment for, health care.

(Sec. 303) Authorizes an HIC to disclose protected health information without obtaining such an authorization: (1) to a public health authority for public health purposes in disease or injury reporting, surveillance, or investigation or intervention; and (2) for health research.

(Sec. 304) Requires the Secretary to promulgate regulations that, among other things, and at a minimum require a person conducting health research to remove or destroy personal identifiers at the earliest opportunity consistent with the purpose of the research, unless it is determined otherwise that there is a health or research justification for retention of such identifiers and that they will be protected from improper use and disclosure.

(Sec. 305) Authorizes an HIC to disclose protected health information to a law enforcement official for an appropriate inquiry if such official complies with the Fourth Amendment to the U.S. Constitution.

(Sec. 306) Sets forth provisions on judicial or administrative proceedings and disclosure of protected health information.

(Sec. 307) Authorizes other specified disclosures without authorization, such as where it is necessary to prevent or lessen a serious threat to an individual's health or safety.

(Sec. 308) Authorizes an HIC who receives protected health information through a disclosure under this title to redisclose it to carry out the purposes for which the information was disclosed to the HIC.

Prohibits protected health information received by an HIC through a disclosure under this title from being disclosed to any person for use in any administrative, civil, or criminal action or investigation directed against the protected individual who is the subject of the information, except under specified conditions.

Title IV: Miscellaneous Provisions - Outlines various provisions pertaining to: (1) minors; (2) individuals exercising power of attorney to act for protected individuals; (3) deceased individuals; (4) obtaining or disclosing protected health information from an HIC or an affiliated person under false pretenses; (5) prohibiting on-the-job retaliation against an individual for reporting to a governmental agency conditions that may constitute a violation of this Act; and (6) mental health and other especially sensitive information (allowing the Secretary to limit an individual's access to his or her mental health information under certain conditions).

(Sec. 405) Provides that nothing in this Act shall be construed to preempt, supersede, or modify the operation of the recent legally recognized psychotherapist-patient privilege.

(Sec. 406) Requires the Secretary to promulgate regulations to ensure the reasonable expectation of privacy of protected individuals in protected health information is maintained when HICs cease operations.

(Sec. 407) Amends the Federal Privacy Act of 1974 to generally conform with the amendments made by this Act.

Title V: General Provisions - Directs the Secretary to promulgate implementing regulations for this Act, including, at the Secretary's discretion, any necessary to protect the privacy of individually identifiable health information that is not protected health information.

(Sec. 501) Authorizes the Secretary to: (1) sponsor or carry out research and development activities related to the protection of the privacy of individually identifiable health information; (2) sponsor or carry out activities to inform protected individuals of their rights, or other persons of their rights or responsibilities, under this Act; and (3) hold hearings, administer oaths, and perform a variety of other specified tasks to ensure compliance with this Act or otherwise further its purposes.

(Sec. 502) Outlines enforcement provisions, from allowing the Secretary to bring an action in an appropriate court to enjoin a violation of this Act, to providing for civil money and criminal penalties as well as civil actions.

(Sec. 503) Provides that this Act shall not preempt, supersede, or modify the operation of: (1) any Federal, State, or local law that provides greater protection of protected health information or more rights to protected individuals regarding such information; or (2) any law that provides for the reporting of vital statistics such as birth or death information, that requires the reporting of abuse or neglect information or other information relating to violence against an individual, and other specified laws such as the Americans with Disabilities Act of 1990.