Notifying organ procurement agencies with respect to potential organ donors

(a)

In general

Section 1138(a) of the Social Security Act (42 U.S.C. 1320b–8(a)) is amended— (1)in paragraph (1)(A)(iii)— (A)by adding and at the end; (B)by striking that such and inserting

that— (I)such

; and

(C)by adding at the end the following new subclause:

(II)subject to paragraph (4), beginning on the date that is 2 years after the date of the enactment of the Removing Burdens From Organ Donation Act, with respect to such a potential organ donor, such hospital’s designated organ procurement agency is issued an automated electronic notification and is provided electronic and remote access to the electronic health records of such potential organ donor when such electronic health records are updated to indicate that such potential organ donor is deceased or that the death of such potential organ donor is imminent, as determined in accordance with the protocol described in section 482.45(a)(1) of title 42, Code of Federal Regulations (or any successor regulation);

; and

(2)by adding at the end the following new paragraph:

(4)

Exemptions from automated EHR access requirement

(A)

Exemptions

(i)

In general

The Secretary may exempt a hospital or critical access hospital from the automated electronic notification and remote access requirement under paragraph (1)(A)(iii)(II) for a period of 3 years if the Secretary determines that meeting such requirement would result in a significant hardship, such as in the case of a hospital or critical access hospital located in a rural area without sufficient Internet access, or other exceptional circumstances demonstrated by the hospital. (ii)

Automatic exemption

The Secretary shall grant an exemption described in clause (i) to a hospital or critical access hospital for a period of 1 year if the Secretary determines that such hospital is affected by a cybersecurity attack (as defined in subparagraph (C)), or is located in an area affected by a major disaster (as defined in section 5122(2) of title 42, United States Code) or any other natural or man-made disaster, and shall notify such hospital or critical access hospital of such exemption. (iii)

Extension

The Secretary may extend an exemption granted under clause (i) or (ii) if the hospital or critical access hospital demonstrates to the satisfaction of the Secretary that such an extension is necessary. (B)

Report

Not later than 2 years after the date of the enactment of the Removing Burdens From Organ Donation Act, and not less frequently than annually thereafter, the Secretary shall submit to the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives, and to the Committee on Finance and the Committee on Health, Education, Labor, and Pensions of the Senate, a report on the number of exemptions granted under subparagraph (A) during the previous year and the reason for granting each such exemption. (C)

Cybersecurity attack defined

For purposes of subparagraph (A), the term cybersecurity attack means, with respect to a hospital or a critical access hospital, any kind of malicious activity that— (i)attempts to collect, modify, disrupt, deny, degrade, or destroy information system resources of the hospital, including the information itself; (ii)affects the confidentiality, integrity or availability of data, information, or operational technology system resources of the hospital; or (iii)poses any other threat to the information, information systems, technology, or technological capabilities of the hospital, as determined by the Secretary.

(b)

Guidance on best practices

(1)

In general

Not later than 1 year after the date of the enactment of this Act, the Secretary of Health and Human Services shall issue guidance to hospitals, critical access hospitals, organ procurement agencies, and electronic health record companies regarding best practices for complying with the automated electronic notification and remote access requirement under subclause (II) of section 1138(a)(1)(A)(iii) of the Social Security Act (42 U.S.C. 1320b–8(a)(1)(A)(iii)), as added by subsection (a). Such guidance shall be based upon the experiences of entities that have previous experience with the implementation of similar automated electronic notifications and remote access, and shall provide insights on what worked well and what did not. (2)

Explanation of changes to donors and family members

Not later than 1 year after the date of the enactment of this Act, the Secretary of Health and Human Services shall issue guidance to State health agencies (or such other State agency, department, or authority as the Governor of each State may determine appropriate) regarding best practices for explaining the automated electronic notification and remote access requirement under subclause (II) of section 1138(a)(1)(A)(iii) of the Social Security Act (42 U.S.C. 1320b–8(a)(1)(A)(iii)), as added by subsection (a), to organ donors, potential organ donors, and the family members of such donors and potential donors. (c)

GAO report and study

The Comptroller General of the United States (in this subsection referred to as the Comptroller General) shall— (1)carry out a study on the implementation of the automated electronic notification and remote access requirement under subclause (II) of section 1138(a)(1)(A)(iii) of the Social Security Act (42 U.S.C. 1320b–8(a)(1)(A)(iii)), as added by subsection (a), that takes into account— (A)the cost of implementing the automated electronic notification and remote access requirement described in such paragraph; (B)the impact of hospital location on the implementation of such requirement, including the impact of limited broadband access in rural areas, and improvements that could be made to facilitate such implementation; and (C)the reports submitted by the Secretary pursuant to paragraph (4)(B) of section 1138(a) of such Act (42 U.S.C. 1320b–8(a)), as added by subsection (a); and (2)not later than 3 years after the date of the enactment of the Removing Burdens from Organ Donation Act, submit to Congress a report on the results of the study carried out under paragraph (1) that includes— (A)an analysis of data maintained by the Department of Health and Human Services related to the outcomes of organ transplants performed after the enactment of the Removing Burdens from Organ Donation Act; (B)a review of issues related to securing patient data and the roles of the Centers for Medicare & Medicaid Services and the Health Resources and Services Administration with respect to those issues; and (C)any recommendations for further action, as appropriate.