Title V, SEC. 5120. HEALTH INFORMATION SYSTEM PRIVACY STANDARDS. (a) Health Information System Standards. Not later than 2 years after the date of the enactment of this Act, the National Health Board shall promulgate standards respecting the privacy of individually identifiable health information that is in the health information system described in part 1 of this subtitle. Such standards shall include standards concerning safeguards for the security of such information. The Board shall develop and periodically revise the standards in consultation with (1) Federal agencies that (A) collect health care information; (B) oversee the collection of information or records management by other Federal agencies; (C) directly provide health care services; (D) provide for payments for health care services; or (E) enforce a provision of this Act or any Act amended by this Act; (2) the National Quality Management Council established under section 5002; (3) participating States; (4) regional alliances and corporate alliances; (5) health plans; and (6) representatives of consumers of health care. (b) Information Covered. The standards established under subsection (a) shall apply to individually identifiable health information collected for or by, reported to or by, or the dissemination of which is regulated by, the National Health Board under section 5101. (c) Principles. The standards established under subsection (a) shall incorporate the following principles: (1) Unauthorized Disclosure. All disclosures of individually identifiable health information by an individual or entity shall be unauthorized unless (A) the disclosure is by the enrollee identified in the information or whose identity can be associated with the information; (B) the disclosure is authorized by such enrollee in writing in a manner prescribed by the Board; (C) the disclosure is to Federal, State, or local law enforcement agencies for the purpose of enforcing this Act or an Act amended by this Act; or (D) the disclosure otherwise is consistent with this Act and specific criteria governing disclosure established by the Board. (2) Minimal disclosure. All disclosures of individually identifiable health information shall be restricted to the minimum amount of information necessary to accomplish the purpose for which the information is being disclosed. (3) Risk adjustment. No individually identifiable health information may be provided by a health plan to a regional alliance or a corporate alliance for the purpose of setting premiums based on risk adjustment factors. (4) Required safeguards. Any individual or entity who maintains, uses, or disseminates individually identifiable health information shall implement administrative, technical, and physical safeguards for the security of such information. (5) Right to know. An enrollee (or an enrollee representative of the enrollee) has the right to know (A) whether any individual or entity uses or maintains individually identifiable health information concerning the enrollee; and (B) for what purposes the information may be used or maintained. (6) Right to access. Subject to appropriate procedures, an enrollee (or an enrollee representative of the enrollee) has the right, with respect to individually identifiable health information concerning the enrollee that is recorded in any form or medium (A) to see such information; (B) to copy such information; and (C) to have a notation made with or in such information of any amendment or correction of such information requested by the enrollee or enrollee representative. (7) Right to notice. An enrollee and an enrollee representative have the right to receive a written statement concerning (A) the purposes for which individually identifiable health information provided to a health care provider, a health plan, a regional alliance, a corporate alliance, or the National Health Board may be used or disclosed by, or disclosed to, any individual or entity; and (B) the right of access described in paragraph (6). (8) Use of Unique Identifier. When individually identifiable health information concerning an enrollee is required to accomplish the purpose for which information is being transmitted between or among the National Health Board, regional and corporate alliances, health plans, and health care providers, the transmissions shall use the unique identifier number provided to the enrollee pursuant to section 5104 in lieu of the name of the enrollee. (9) Use for Employment Decisions. Individually identifiable health care information may not be used in making employment decisions.