Concerns about the protection of personally identifiable information are not unique to the health care industry; however, consumers view their medical records as more "private" than other information because involuntary disclosure can affect jobs or health insurance status. EPAL is a convenient way of capturing privacy policies. This paper presents an EPAL based privacy middleware architecture called Privacy Broker which attempts to reduce privacy violation risk and enforce committed privacy policy in health information system. This paper also provides a translation of SQL queries into Authorization Request in EPAL.