Section 1 Short title
This Act may be cited as the “Patient Privacy and Caregiver Awareness Act of 2023”.
Patient Privacy and Caregiver Awareness Act of 2023
A BILL
To direct the Secretary of Health and Human Services to modify the HIPAA privacy regulation with respect to the disclosure of certain protected health information.
Sec. 2 Modification of HIPAA privacy regulation
In general— Not later than 1 year after the date of the enactment of this section, the Secretary of Health and Human Services shall revise the HIPAA privacy regulation to require that, if an individual (or a personal representative of the individual or another person responsible for the care of the individual) provides consent in accordance with such regulation for a covered entity to use or disclose any protected health information of the individual that is related to a mental health condition or a substance use disorder—
the authorization with respect to such use or disclosure shall have an expiration date that is not less than 2 years after the date on which such consent is provided; and
the covered entity shall provide the individual (and, in the case that such consent is provided by a personal representative or another person responsible for the care of the individual, such personal representative or person so responsible) with written notice of the expiration of such authorization not later than the date that is 30 days before such expiration date.
Definitions— In this section, the following definitions apply:
HIPAA privacy regulation— The term HIPAA privacy regulation has the meaning given such term in section 1180(b)(3) of the Social Security Act (42 U.S.C. 1320d–9(b)(3)).
HIPAA terms— The terms authorization, covered entity, and protected health information have the meanings given such terms for purposes of the HIPAA privacy regulation.