110 HR 5442 IH: TRUST in Health Information Act of
U.S. House of Representatives
2008-02-14
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.
(a)This Act may be cited
as the Technologies for Restoring
Users’ Security and Trust in Health Information Act of
2008
or as the TRUST in Health Information Act of
2008
.
(b)The table of contents of this Act is as follows:
Sec. 1. Short title.
Sec. 2. Findings; purposes.
Title I—Health Information Privacy and Security
Sec. 100. Summary of privacy rights and security
obligations.
Subtitle A—Access to and Accuracy of Personal Health
Information
Sec. 101. Inspection and copying of personal health
information.
Sec. 102. Modifications to personal health
information.
Subtitle B—Security of Personal Health Information
Sec. 111. Notice of privacy practices.
Sec. 112. Establishment of safeguards.
Sec. 113. Notification in the case of breach.
Sec. 114. Transparency.
Sec. 115. Risk management.
Sec. 116. Accounting for disclosures and use.
Subtitle C—Use and Disclosure of Personal Health
Information
Chapter 1—General Restrictions
Sec. 121. General rules regarding use and
disclosure.
Sec. 122. Informed consent for disclosure of personal health
information for treatment and payment.
Sec. 123. Informed consent and authorization for disclosure of
personal health information other than for treatment or payment.
Chapter 2—Exceptions
Sec. 131. Disclosure for law enforcement, national security,
and intelligence purposes.
Sec. 132. Disclosure for public health purposes.
Sec. 133. Reporting of abuse and neglect to protection and
advocacy agencies.
Sec. 134. Disclosure to next of kin and directory
information.
Chapter 3—Special Circumstances
Sec. 141. Emergency circumstances.
Sec. 142. Health research.
Sec. 143. Health oversight functions.
Sec. 144. Individual representatives.
Subtitle D—Enforcement
Sec. 151. In general.
Sec. 152. Enforcement by State attorneys general.
Subtitle E—Miscellaneous
Sec. 161. Office of Health Information Privacy.
Sec. 162. Protection for whistleblowers.
Sec. 163. Demonstration grant for individuals with limited
English language proficiency or limited health literacy.
Sec. 164. Relationship to other laws.
Sec. 165. Effective date.
Subtitle F—General Definitions
Sec. 171. General definitions.
Title II—Promotion of Health Information Technology
Subtitle A—Improving the Interoperability of Health
Information Technology
Sec. 201. Office of the National Coordinator of Health
Information Technology.
Sec. 202. Partnership for Health Care Improvement.
Sec. 203. American Health Information Community
policies.
Sec. 204. Research access to health care data and reporting on
performance.
Subtitle B—Facilitating the Widespread Adoption of
Interoperable Health Information Technology
Sec. 211. Facilitating the widespread adoption of interoperable
health information technology.
Sec. 212. Demonstration program to integrate information
technology into clinical education.
Sec. 213. Qualified health information technology system
defined.
Subtitle C—Improving the Quality of Health Care
Sec. 221. Fostering development and use of health care quality
measures.
Sec. 222. Adoption and use of quality measures;
reporting.
Subtitle D—Miscellaneous Provisions
Sec. 231. Health Information Technology Resource
Center.
Sec. 232. Facilitating the provision of telehealth services
across State lines.
Subtitle E—Definitions
Sec. 241. Definitions.
Title III—Additional provisions
Sec. 301. Federal purchasing and data collection by CMS and
other Federal agencies.
Sec. 302. Ensuring health care providers participating in the
medicare program may maintain health information in electronic
form.
2.
(a)Congress
finds the following:
(1)Americans are
deeply concerned about the privacy and security of their personal information,
including their health records.
(2)In October 2007, a Harris Interactive Poll
commissioned by the Institute of Medicine found that 58 percent of respondents
indicated they do not believe Federal and State laws and organizational
practices offer sufficient protection of personal health information.
(3)In February 2007,
the Markle Foundation reported that 80 percent of individuals surveyed were
very concerned about identity theft or fraud and 77 percent were very concerned
that their medical information would be used for marketing purposes.
(4)Concerns about the
privacy and security of personal health information are fueled by the
escalating number of breaches of personal information that have occurred in
recent years and numerous reports of the inadequacy of the security of
electronic networks.
(5)According to the
Privacy Rights Clearinghouse, more than 216,000,000 data records belonging to
U.S. residents have been exposed to potential misuse as a result of security
breaches since January 2005.
(6)A nationwide interoperable health
information infrastructure can strengthen privacy, security, and
confidentiality safeguards, protecting patients’ personal health information
while also improving health care quality, safety, and affordability.
(7)In order for
individuals, health care providers, and health care payers to achieve the
benefits associated with such infrastructure, strong data privacy, security,
and confidentiality standards must be developed, adopted, and incorporated into
the health information technology infrastructure.
(8)While Executive
Order 13335 regarding interoperable health information technology issued on
April 27, 2004, called for widespread adoption of interoperable electronic
health records within 10 years, established the position of National
Coordinator of Health Information Technology, and stipulated that the plan for
the nationwide implementation of interoperable health information technology
should address privacy and security issues, adequate progress has not been made
to ensure that a strong data privacy, security, and confidentiality approach
will guide the development of this nationwide infrastructure beginning in its
initial stages and continuing throughout its formulation.
(9)According to a February 1, 2007, report of
the Government Accountability Office (GAO), the Department of Health and Human
Services and its Office of the National Coordinator of Health Information
Technology have not yet defined an overall approach for integrating
privacy-related initiatives the Department has undertaken in the area of health
information technology or addressing key privacy principles, nor has the
Department defined milestones for integrating the results of these activities
while it has moved forward with development of standards for a national
electronic health information system.
(10)All Americans
have a right to privacy, security, and confidentiality with respect to the
electronic disclosure of their personal health information, and the nationwide
implementation of interoperable health information technology should abide by,
and be consistent with, this right.
(11)Without adequate
privacy, security, and confidentiality standards, individuals will be more
likely to avoid or delay medical treatment or withhold pertinent information
from their health providers, potentially resulting in lost productivity,
increased morbidity rates, and increased costs to the health care
system.
(12)As stipulated by
the Secretary of Health and Human Services in the Final Rule for Standards for
Privacy of Individually Identifiable Health Information (45 C.F.R. parts 160
and 164), the standards contained in the Final Rule are intended to establish a
floor of privacy protection and are not designed to serve as best
practices
for the use or disclosure of personal health
information.
(13)To guide the
development, implementation, and operation of an interoperable nationwide
health information technology infrastructure, Congress should establish
specific minimum standards for the use and disclosure of individuals’ personal
health information and direct the Department of Health and Human Services to
promulgate regulations relating to personal health information that are
consistent with individuals’ right to privacy, security, and confidentiality
with respect to the electronic use or disclosure of their personal health
information, the public interest, and the purposes of this Act.
(b)The purposes of this Act are as
follows:
(1)To
recognize that individuals have a right to privacy, confidentiality, and
security with respect to health information, including genetic information, and
that those fundamental rights are rooted in the Nation’s history and medical
ethics and must be protected.
(2)To ensure that individuals are able to
exercise their right to health information privacy by requiring their consent
for the use and disclosure of their identifiable health information unless
otherwise required by law.
(3)To encourage the development of a
nationwide interoperable health information technology infrastructure that
protects individuals’ privacy, confidentiality, and security with respect to
their health information while also improving health care quality, promoting
data accuracy, reducing medical errors, and increasing the efficiency of
care.
(4)To
create incentives to turn personal health information into de-identified health
information (as defined in section 171(5)), where appropriate.
(5)To designate an
Office of Health Information Privacy within the Department of Health and Human
Services to protect individuals’ right of privacy.
(6)To
provide individuals with—
(A)access to health
information of which they are the subject;
(B)the opportunity to
challenge the accuracy and completeness of such information by being able to
file modifications to or request the deletion of such information; and
(C)the right to limit
the use and disclosure of personal health information.
(7)To
establish strong and effective mechanisms to protect against the unauthorized
and inappropriate use of personal health information and ensure that these
mechanisms safeguard this information wherever it may reside.
(8)To provide notice to individuals of
breaches of their personal health information.
(9)To invoke the
sweep of congressional powers, including the power to enforce the 14th
Amendment to the Constitution, to regulate commerce, and to abrogate the
immunity of the States under the 11th Amendment to the Constitution, in order
to address violations of the rights of individuals to privacy, to provide
individuals with access to their health information, and to prevent the
unauthorized use of personal health information that is genetic
information.
(10)To establish
strong and effective remedies for violations of this Act.
(11)To protect the
rights of States.
<enum>I</enum><header>Health Information
Privacy and Security</header>
<section id="H3D4665DC5BC64348B91F10BB0025C0C6"><enum>100.</enum><header>Summary of
privacy rights and security obligations</header>
<subsection commented="no" id="H751369192D2F42DD98EEAEFA8907C200"><enum>(a)</enum><header>Privacy
rights</header><text display-inline="yes-display-inline">In order to provide
individuals who are the subject of personal health information with privacy,
security, and control in the use and disclosure of such information, such
individuals are provided the following rights under this title:</text>
<paragraph commented="no" id="H1495108AEDDF4693AB7FEC715FEFBB7"><enum>(1)</enum><text>The right to not
have their personal health information disclosed without their informed consent
unless otherwise required by law, pursuant to subtitle C.</text>
</paragraph><paragraph commented="no" id="HCB8E03A9502C48F8B086D62E9DDE4B98"><enum>(2)</enum><text>The right to
inspect and copy their personal health information, pursuant to section
101.</text>
</paragraph><paragraph commented="no" id="H1A983EB1B4A64783941615EF3CB1D46"><enum>(3)</enum><text>The right to
correct, supplement, or remove their personal information held by a person,
pursuant to section 102.</text>
</paragraph><paragraph commented="no" id="H47B96C7F5CD24F3B009B63BE7E4477D9"><enum>(4)</enum><text>The right to
prohibit access by certain categories of persons to particularly sensitive
personal health information about individuals, such as information relating to
mental health, domestic violence, sexually transmitted diseases, and infection
with the human immunodeficiency virus (HIV), pursuant to section 122.</text>
</paragraph><paragraph commented="no" id="HC337593A53164701AAA422F00053B924"><enum>(5)</enum><text>The right to
receive notification of actual or suspected security breaches of their personal
health information, pursuant to section 113.</text>
</paragraph><paragraph commented="no" id="H68ED77B4C7DC461CBCF22FA707CC5BFE"><enum>(6)</enum><text>The right to
receive an accounting of all electronic disclosures of their personal health
information upon request, pursuant to section 116.</text>
</paragraph></subsection><subsection commented="no" id="H0785EF6699B140C199B463E01C37654D"><enum>(b)</enum><header>Security
obligations</header><text display-inline="yes-display-inline">A person that
discloses, uses, or receives an individual’s personal health information has
obligations under this title, including the following:</text>
<paragraph commented="no" id="HB36427E2592F4236A779637627307565"><enum>(1)</enum><text>The obligation to
expressly recognize the right to privacy and security of such individual with
respect to the use and disclosure of such information under subtitle B.</text>
</paragraph><paragraph commented="no" id="HB328D996A8964F60A7BC9718508C976C"><enum>(2)</enum><text>The obligation to
permit individuals who are the subject of such personal health information to
inspect and copy the personal health information concerning the individual
pursuant to section 101.</text>
</paragraph><paragraph commented="no" id="H294A264B45884934BE22544781FF2843"><enum>(3)</enum><text display-inline="yes-display-inline">The obligation to provide written
notification to an individual of the person’s privacy practices pursuant to
section 111.</text>
</paragraph><paragraph commented="no" id="HF9086D8006514143B3D5AE38A812FE3E"><enum>(4)</enum><text display-inline="yes-display-inline">The obligation to promptly notify
individuals of an actual or suspected security breach of their personal health
information pursuant to section 113.</text>
</paragraph><paragraph commented="no" id="HEB8E066556E64098BF0057BB1EF5BCC"><enum>(5)</enum><text display-inline="yes-display-inline">The obligation to establish and maintain
appropriate administrative, organizational, technical and physical safeguards
to ensure the privacy, confidentiality, security, accuracy, and integrity of
personal health information that is accessed, maintained, modified, recorded,
stored, destroyed, or otherwise used or disclosed by such person pursuant to
section 112.</text>
</paragraph><paragraph commented="no" id="H25E119C7AB9C4866B763BA5DC44EB1B0"><enum>(6)</enum><text display-inline="yes-display-inline">The obligation to make publicly available
on the Internet a list, including contact information, of each data partner
with which the person has entered into a contract or relationship to provide
services involving personal health information pursuant to section 114.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="HD6871B86AA71457B91007BCC557F1C72"><enum>(7)</enum><text display-inline="yes-display-inline">The obligation to obtain an individual’s
informed consent or authorization before using or disclosing an individual’s
personal health information pursuant to chapter 1 of subtitle C.</text>
</paragraph><paragraph commented="no" id="H730FDA619CCA46C69738D850C56FED50"><enum>(8)</enum><text display-inline="yes-display-inline">The obligation to establish and update risk
management processes to protect against vulnerabilities to the privacy and
security of individual’s personal health information pursuant to sections 112
and 114.</text>
</paragraph><paragraph commented="no" id="H43FB258C20AE40E48358F14B974C72E3"><enum>(9)</enum><text display-inline="yes-display-inline">The obligation to establish and maintain a
record of each disclosure of an individual’s personal health information
pursuant to section 116.</text>
</paragraph><paragraph commented="no" id="H129364D9ED4A4FF9ADFFABE3C1C6CAD4"><enum>(10)</enum><text display-inline="yes-display-inline">The obligation to provide individuals with
concise, comprehensive, and explicit information if seeking to use or disclose
their personal health information for marketing purposes and receive a separate
authorization from an individual before using or disclosing the information for
that purpose pursuant to section 123.</text>
</paragraph></subsection></section><subtitle id="H5F6EA76E12E44790861CC5C9622B2D20"><enum>A</enum><header>Access to and
Accuracy of Personal Health Information</header>
<section id="HCA6F6FC7BEE3415F816F85E8C54D67C2"><enum>101.</enum><header>Inspection and
copying of personal health information</header>
<subsection id="H1C1B3E97B88F4971A570D6629BBAF79"><enum>(a)</enum><header>Right of
individual</header>
<paragraph id="HA53F7334CFA94463ACBFBB73FA17927"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A health information
person (as defined in section 171(13)) shall permit an individual who is the
subject of personal health information (as defined in section 171(23)) that the
person holds, uses, or discloses, or the individual’s designee, to inspect and
copy the personal health information concerning the individual.</text>
</paragraph><paragraph id="H60C1322EF19A4CB890EB7FFEAC9D5FBF"><enum>(2)</enum><header>Procedures and
fees</header><text>A health information person may establish appropriate
procedures to be followed for inspection and copying under paragraph (1) and
may require an individual to pay reasonable fees associated with such
inspection and copying in an amount that is not in excess of the actual costs
of providing such copying. Such fees may not be assessed where such an
assessment would have the effect of inhibiting an individual from gaining
access to the information described in paragraph (1).</text>
</paragraph></subsection><subsection id="HCB5231F533E1416591F83300A0ABBDB1"><enum>(b)</enum><header>Deadline</header><text>A
health information person shall comply with a request for inspection or copying
of personal health information under this section not later than—</text>
<paragraph id="H1CDB83F1B9344DEA87B3B3E960B2C87E"><enum>(1)</enum><text>15 business days
after the date on which the person receives the request, if such request
requires the inspection, copying, or sending of printed materials; or</text>
</paragraph><paragraph id="HEAD9C887B234438C80461F79FCA5BCAE"><enum>(2)</enum><text>5
business days after the date on which the person receives the request, or
sooner if the Secretary determines appropriate, if such request requires only
the inspection, copying, or sending of electronic or other digital
materials.</text>
</paragraph></subsection><subsection id="H2FCBB44E817A4C6FB75BBFC169EC9265"><enum>(c)</enum><header>Rules governing
agents</header><text>A person that is the agent, officer, or employee of a
health information person shall provide for the inspection and copying of
personal health information if—</text>
<paragraph id="H86BFF1550C3948CD8B67AA7C8CA3216D"><enum>(1)</enum><text>the personal
health information is retained by the person; and</text>
</paragraph><paragraph id="H9A8511B7150D41BFBAD345439FEFD00"><enum>(2)</enum><text>the person has been
asked by the health information person to fulfill the requirements of this
section.</text>
</paragraph></subsection><subsection id="HC8483DA606894D06A6EC8608235DCE9C"><enum>(d)</enum><header>Special rule
relating to ongoing clinical trials</header><text>With respect to personal
health information that is created as part of an individual's voluntary
participation in an ongoing clinical trial, access to the information shall be
provided within 15 business days after the date on which the health information
person receives the request or consistent with the individual's agreement to
participate in the clinical trial, whichever is sooner.</text>
</subsection></section><section id="H6B25EAB4EF4B4F8FA7333584AC023B29"><enum>102.</enum><header>Modifications
to personal health information</header>
<subsection id="HF4112E18BA9E4E98B974153700695BF3"><enum>(a)</enum><header>In
general</header><text>Not later than 15 business days, or earlier if the
Secretary determines appropriate, after the date on which a health information
person receives from an individual a request in writing to supplement, correct,
amend, segregate, or remove personal health information that the person holds,
uses, or discloses concerning the individual, such person—</text>
<paragraph id="H495F14011F6E46F7BF87F349194E5841"><enum>(1)</enum><text>shall, subject to
subsections (b) and (c), modify the information, by adding the requested
supplement, correction, or amendment to the information, or by removing any
information that has been requested to be destroyed;</text>
</paragraph><paragraph id="H056C9318B77A409783AD1B1B80052853"><enum>(2)</enum><text>shall inform the
individual that the modification has been made; and</text>
</paragraph><paragraph id="H181FA4C55F9B41338DE4677934F931B5"><enum>(3)</enum><text>shall make
reasonable efforts to inform any person to which the portion of the unmodified
information was previously disclosed, of any substantive modification that has
been made.</text>
</paragraph></subsection><subsection id="HC48B307D1A7E4E029E1279B9D6C522F9"><enum>(b)</enum><header>Refusal To
modify</header><text>If a health information person declines to make the
modification requested under subsection (a) within 15 business days after
receipt of such request, such person shall inform the individual in writing
of—</text>
<paragraph id="H41EAD0E6337B44268729029B0262D03F"><enum>(1)</enum><text>the reasons for
declining to make the modification;</text>
</paragraph><paragraph id="HBD05DAABEAB1495D8EB2E31DCB1B88B"><enum>(2)</enum><text>any procedures for
further review of the declining of such modification; and</text>
</paragraph><paragraph id="H5AEF7B23ACAF47A08579DEF67F33868C"><enum>(3)</enum><text>the individual's
right to file with the person a concise statement setting forth the requested
modification and the individual's reasons for disagreeing with the declining
person and the individual's right to include a copy of this refusal in the
health record set (as defined in section 171(17)) concerning the
individual.</text>
</paragraph></subsection><subsection id="HA5CCB5139CCE4199BA6CCA043CF2463"><enum>(c)</enum><header>Statement of
disagreement</header><text>If an individual has filed with a health information
person a statement of disagreement under subsection (b)(3), the person, in any
subsequent disclosure of the disputed portion of the information—</text>
<paragraph id="H2E94BC461D3D426C8BB686D246EB9809"><enum>(1)</enum><text>shall include, at
the individual's request, a copy of the individual's statement in the
individual's health record set; and</text>
</paragraph><paragraph id="HC94D18320E584B3EAD3EAC2BAA940006"><enum>(2)</enum><text>may include a
concise statement of the reasons for not making the requested
modification.</text>
</paragraph></subsection><subsection id="HE26825CACE5A4684941DF993D438E9A5"><enum>(d)</enum><header>Rules governing
agents</header><text>A person that is the agent of a health information person
shall only be required to make a modification to personal health information
where—</text>
<paragraph id="H6C64C050AB814C95A804ABB56CFE5261"><enum>(1)</enum><text>the personal
health information is retained, distributed, used, or maintained by the agent;
and</text>
</paragraph><paragraph id="HADABB1687E5D4ECBB4C466052D4E00A9"><enum>(2)</enum><text>the agent has been
asked by such person to fulfill the requirements of this section.</text>
</paragraph></subsection></section></subtitle><subtitle id="H0F9BFC5854ED4944A6C2DD85DFA43E2C"><enum>B</enum><header>Security of
Personal Health Information</header>
<section id="H5A591A0310E74736876C25AB5F113B5"><enum>111.</enum><header>Notice of
privacy practices</header>
<subsection id="HCD0BA0AA81D4448DA5B438495332E922"><enum>(a)</enum><header>Preparation of
written notice</header><text>A health information person shall prepare a
written notice of the privacy practices of such person, including information
with respect to the following:</text>
<paragraph id="H0E7EEFD1C45340A38500EFE002AD63DD"><enum>(1)</enum><text>The express right
of an individual to privacy, security, and confidentiality with respect to the
disclosure of such individual’s personal health information.</text>
</paragraph><paragraph id="H46698E4CB6BA40968D3500003B00AC04"><enum>(2)</enum><text>The procedures for
an individual to exercise that right by authorizing disclosures of personal
health information, and to object to, modify, and revoke such
authorizations.</text>
</paragraph><paragraph id="HC818C419C63242ADA1707729AEDBBC98"><enum>(3)</enum><text>The right of an
individual to inspect, copy, and modify that individual’s personal health
information.</text>
</paragraph><paragraph id="H19F497529B654D998F1003994DF1731B"><enum>(4)</enum><text display-inline="yes-display-inline">The right of an individual not to have
employment or the receipt of services or choice of health plan conditioned upon
the execution by the individual of an authorization for disclosure, except as
permitted by section 122(c).</text>
</paragraph><paragraph id="H07415931674E40DAAAA506F2C042D754"><enum>(5)</enum><text display-inline="yes-display-inline">A description of—</text>
<subparagraph id="H22D85712D8C64242BABA5800C8BBA6A0"><enum>(A)</enum><text>the categories or
types of employees, by general category or by general job description, who have
access to or use of personal health information regarding the
individual;</text>
</subparagraph><subparagraph id="HFBC270E330F64320B9965852A281A806"><enum>(B)</enum><text>the right of the
individual to limit access to or use of his or her personal health information
by employees, agents, and contractors of the person; and</text>
</subparagraph><subparagraph id="HF4DA9857ED01486A813B0057B0EC0887"><enum>(C)</enum><text>the procedures for
effecting such limitations.</text>
</subparagraph></paragraph><paragraph id="HCCDDDB34429E4C41873CB5274D962E06"><enum>(6)</enum><text>A
simple, concise description of any information systems used to store or
transmit personal health information, including a description of any linkages
made with other networks, systems, or databases outside the person’s direct
control.</text>
</paragraph><paragraph id="HF166178A74214824A39D2F218227696D"><enum>(7)</enum><text>The circumstances
under which the information will be, lawfully and actually, used or disclosed
without an authorization executed by the individual.</text>
</paragraph><paragraph id="H7C8703F563DF4830002D2974361F0026"><enum>(8)</enum><text>A
statement that, if an individual elects to pay for health care from the
individual's own funds, that individual may elect for personal health
information, including any identifying information, not to be disclosed to
anyone other than designated health care providers, unless such disclosure is
required by mandatory reporting requirements or other similar information
collection duties required by law.</text>
</paragraph><paragraph id="HCAB8CE58ED4B44B2AB4985CEB7D31C28"><enum>(9)</enum><text>The right of the
individual to have continued maintenance, distribution, or storage of that
individual’s personal health information not conditioned upon whether that
individual amends or revokes an authorization for disclosure, or requests a
modification of personal health information.</text>
</paragraph><paragraph id="H8BDF1159C88E4D29B3A0BC97491106D0"><enum>(10)</enum><text>The right of and
procedures for an individual to request that personal health information be
transferred to a third party person without unreasonable delay.</text>
</paragraph><paragraph id="HF42E57A0C63648F995D8F92F41B55F4C"><enum>(11)</enum><text>The right to
prompt notification of an actual or suspected security breach of personal
health information, and how such breaches will be remedied by the
person.</text>
</paragraph><paragraph id="HCFA8D47497C0447C83F5892960C51763"><enum>(12)</enum><text>The right of an
individual to inspect and obtain a copy of records of authorized and
unauthorized disclosures as well as attempted and actual access and use by an
authorized or unauthorized person.</text>
</paragraph><paragraph id="HD45A49D0A4634EBD84924B3BE6DA69D0"><enum>(13)</enum><text>The right of an
individual to exercise nondisclosure and nonuse rights with respect to their
personal health information, including the right to opt out of any local,
regional, or nationwide health information network or system that is used by
the person.</text>
</paragraph></subsection><subsection id="HE027FCF4084B40420066D91BB87DB2AA"><enum>(b)</enum><header>Provision and
posting of written notice</header>
<paragraph id="HAFAC0F8ABE324F6DAEC075D47DA3FF96"><enum>(1)</enum><header>Provision</header><text display-inline="yes-display-inline">A health information person shall provide
in writing a copy of the notice of privacy practices required under subsection
(a)—</text>
<subparagraph id="H9A340D9514294C5D8D57AFC44E00E84B"><enum>(A)</enum><text display-inline="yes-display-inline">at the first contact between the individual
and the person; and</text>
</subparagraph><subparagraph id="HE87F3BBA9E6A4AB4BEC52E1F4049BE6"><enum>(B)</enum><text>upon the request of
an individual.</text>
</subparagraph></paragraph><paragraph id="HFED6B6D0EEDC444CA70026A8FC2ABE0"><enum>(2)</enum><header>Posting</header><text>A
health information person shall post, in a clear and conspicuous manner, a
brief summary of the privacy practices of the person.</text>
</paragraph></subsection><subsection id="H0AEAB7DA318246C6898695CA203845E0"><enum>(c)</enum><header>Model
notice</header><text>The Secretary, in consultation with the Director of the
Office of Health Information Privacy, after notice and opportunity for public
comment, shall develop and disseminate model notices of privacy practices, and
model summary notices for posting for use under this section. Use of such model
notice shall be deemed to satisfy the requirements of this section.</text>
</subsection></section><section id="H7BA631364DBB4EAA8B7D7FC2AEB93E61"><enum>112.</enum><header>Establishment
of safeguards</header>
<subsection id="H756CD74361834BDD9F05DF6EEFCB68F4"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">A health information
person shall—</text>
<paragraph id="HDFB00B2DCB6C40FA8CC725BCF73DC732"><enum>(1)</enum><text>establish and
maintain appropriate administrative, organizational, technical, and physical
safeguards and procedures to ensure the privacy, confidentiality, security,
accuracy, and integrity of personal health information that is accessed,
maintained, retained, modified, recorded, stored, destroyed, or otherwise held,
used, or disclosed by such person; and</text>
</paragraph><paragraph id="H3C635DE5170840B1BCE68E38BA6B97A7"><enum>(2)</enum><text display-inline="yes-display-inline">employ an individual whose responsibilities
include the management of the person’s information security.</text>
</paragraph></subsection><subsection id="H9B1E3254AF664E9AB5BF00311F634547"><enum>(b)</enum><header>Factors To be
considered</header><text>The policies and safeguards established under
subsection (a) shall ensure that—</text>
<paragraph id="H617F2B64EC3F42ABBE609B8FD8A5D087"><enum>(1)</enum><text>personal health
information is used or disclosed only with informed consent (as defined in
section 171(19));</text>
</paragraph><paragraph id="H2D9598E241714E0187483268AF8100AC"><enum>(2)</enum><text>the categories of
personnel who will, with the informed consent of the individual, have access to
personal health information are identified;</text>
</paragraph><paragraph id="HF814C50478F241D591B35F1483E3E5FF"><enum>(3)</enum><text>the feasibility of
limiting access to personal health information is considered;</text>
</paragraph><paragraph id="H12714F5EFED946E6A576D3E4CB37C6BA"><enum>(4)</enum><text>the privacy,
security, and confidentiality of personal health information is
maintained;</text>
</paragraph><paragraph id="H043EA926ED574E8DADDD393FD5934CF3"><enum>(5)</enum><text>personal health
information is protected against any reasonably anticipated vulnerabilities to
the privacy, security, or integrity of such information; and</text>
</paragraph><paragraph id="HA99FEF95300044768BC08163DCC5CD66"><enum>(6)</enum><text>personal health
information is protected against unauthorized access, use, or misuse of such
information.</text>
</paragraph></subsection><subsection id="HCEC8BAACC8DB485AAAA95200D9A1F4F1"><enum>(c)</enum><header>Model
guidelines</header><text display-inline="yes-display-inline">The Secretary, in
consultation with the Director of the Office of Health Information Privacy
appointed under section 161, after notice and opportunity for public comment,
in accordance with the requirements of <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/5/5">chapter 5</external-xref> of title 5, United States
Code, shall develop and disseminate model guidelines for the establishment of
safeguards and procedures for use under this section, such as, where
appropriate, individual authentication of uses of computer systems, access
controls, audit trails, encryption or any additional security methodology or
technology other than encryption which renders data in electronic form
unreadable or indecipherable, physical security, protection of remote access
points and protection of external electronic communications, periodic security
assessments, incident reports, and sanctions. The Secretary, in consultation
with the Director, shall update and disseminate the guidelines, as appropriate,
to take advantage of new technologies, so as to ensure that the guidelines
emphasize the need for stringent privacy, security, and confidentiality
safeguards and procedures.</text>
</subsection><subsection id="H6CF2C59A666B4640B083013F4624FFD4"><enum>(d)</enum><header>Review and
updating of safeguards</header><text>Persons subject to this title shall
monitor, evaluate, and adjust, as appropriate, all safeguards and procedures,
concomitant with relevant changes in technology, the sensitivity of personally
identifiable information, internal or external threats to personally
identifiable information, and any changes in the contracts or business of the
person. For the purpose of reviewing and updating safeguards, the Secretary may
provide technical assistance to health information persons, as
appropriate.</text>
</subsection></section><section id="H4AF0DCD6847F4432A2331051EE51B83F"><enum>113.</enum><header>Notification in
the case of breach</header>
<subsection id="H781AD3DE1A39471A97822C481F723182"><enum>(a)</enum><header>In
general</header><text>A health information person that accesses, maintains,
retains, modifies, records, stores, destroys, or otherwise holds, uses, or
discloses personal health information shall, following the discovery of a
security breach (as defined in section 171(28)) of such information, notify
each individual whose personal health information has been, or is reasonably
believed to have been, accessed, or acquired during such breach.</text>
</subsection><subsection id="H1619B00DDF264797A831CA9045CB71D2"><enum>(b)</enum><header>Obligation of
owner or licensee</header>
<paragraph id="HD9BC7819E02C458F94D32F03DC6B6378"><enum>(1)</enum><header>Notice to owner
or licensee</header><text>Any person engaged in interstate commerce, that uses,
accesses, transmits, stores, disposes of, or collects personal health
information that the person does not own or license shall notify the owner or
licensee of the information following the discovery of a security breach
involving such information.</text>
</paragraph><paragraph id="HF0C9DFC403AE4DF88FBE4ED095845726"><enum>(2)</enum><header>Notice by owner,
licensee, or other designated third party</header><text display-inline="yes-display-inline">Nothing in this subtitle shall be construed
to prevent or abrogate an agreement between a person required to give notice
under this section and a designated third party, including an owner or licensee
of the personal health information subject to the security breach, to provide
the notifications required under subsection (a).</text>
</paragraph><paragraph id="HF11CCFFB1CC24CB894D6EA4F8C62CBB9"><enum>(3)</enum><header>Person relieved
from giving notice</header><text>A person obligated to give notice under
subsection (a) shall be relieved of such obligation if an owner or licensee of
the personal health information subject to the security breach, or other
designated third party, provides such notification.</text>
</paragraph></subsection><subsection id="HEC187D7950D44E15933E2EE3D1F8C569"><enum>(c)</enum><header>Timeliness of
notification</header>
<paragraph id="HAF5777764F764D99A188DEEBFA7FEF39"><enum>(1)</enum><header>In
general</header><text>All notifications required under this section shall be
made within 15 business days, or earlier if the Secretary determines
appropriate, following the discovery by the person of a security breach.</text>
</paragraph><paragraph id="HD3961C631B9A4FD09C835DF8155B0016"><enum>(2)</enum><header>Burden of
proof</header><text display-inline="yes-display-inline">The person required to
provide notification under this section shall have the burden of demonstrating
that all notifications were made as required under this subtitle, including
evidence demonstrating the necessity of any delay.</text>
</paragraph></subsection><subsection id="H7BDF2D1B0B3A44BDB82F103591FEE2BA"><enum>(d)</enum><header>Methods of
notice</header><text>A person described in subsection (a) shall provide to an
individual the following forms of notice in the case of a security
breach:</text>
<paragraph id="H3CE1DD6FC1994D42A680104685F92FA5"><enum>(1)</enum><header>Individual
notice</header><text>Notice required under this section shall be provided in
such form as the individual selects, including—</text>
<subparagraph id="HF941D8D472784D5E899C0043D4ED53B2"><enum>(A)</enum><text>written
notification to the last known home mailing address of the individual in the
records of the person;</text>
</subparagraph><subparagraph id="H6A9472D8878B4CDF8841A8D840D5A2AF"><enum>(B)</enum><text>telephone notice
to the individual personally; or</text>
</subparagraph><subparagraph id="H270D7247EA6944709D31A16837894232"><enum>(C)</enum><text>e-mail notice, if
the individual has consented to receive such notice and the notice is
consistent with the provisions permitting electronic transmission of notices
under section 101 of the Electronic Signatures in Global and National Commerce
Act (<external-xref legal-doc="usc" parsable-cite="usc/15/7001">15 U.S.C. 7001</external-xref>).</text>
</subparagraph></paragraph><paragraph id="HA1959E416D4943A894310013CA7876CA"><enum>(2)</enum><header>Media
notice</header><text>Notice shall be provided to prominent media outlets
serving a State or jurisdiction, if the personal health information of more
than 500 residents of such State or jurisdiction is, or is reasonably believed
to have been, acquired by an unauthorized person.</text>
</paragraph><paragraph id="HB5E8B08DA115484597922F00D6359080"><enum>(3)</enum><header>Notice to
secretary</header><text>Notice shall be provided to the Secretary for health
information persons that have lost, stolen, disclosed, or used in an
unauthorized manner or for an unauthorized purpose the personal health
information of a significant number of individuals.</text>
</paragraph></subsection><subsection id="H31856140517A45468E60AB6F355F133C"><enum>(e)</enum><header>Content of
notification</header><text>Regardless of the method by which notice is provided
to individuals under this section, notice of a security breach shall include,
to the extent possible—</text>
<paragraph id="HC18FA4A4822C420B8384FFEA2DF7A2B0"><enum>(1)</enum><text>a
description of the personal health information that has been, or is reasonably
believed to have been, accessed, disclosed, or otherwise used by an
unauthorized person;</text>
</paragraph><paragraph id="H113D6B6E863D43E988006D5C494F9DDD"><enum>(2)</enum><text>a
toll-free number that the individual may use to contact the person described in
subsection (a) to learn what types of personal health information the person
maintained about that individual; and</text>
</paragraph><paragraph id="H3941305C2E6A4DDC890000431E7202D5"><enum>(3)</enum><text>toll-free contact
telephone numbers and addresses for major credit reporting agencies.</text>
</paragraph></subsection><subsection id="HB05F99D448224C728D2B8F078462B67C"><enum>(f)</enum><header>Delay of
notification authorized for law enforcement purposes</header>
<paragraph id="H8C2BFD4FE3E0431DAC5F9100674F6C54"><enum>(1)</enum><header>In
general</header><text>If a Federal law enforcement agency determines that the
notification required under this section would impede a criminal investigation
or cause damage to national security, such notification shall be delayed upon
written notice from the Federal law enforcement agency to the person that
experienced the breach.</text>
</paragraph><paragraph id="HAB765A852E1B40958FBC8181B0952322"><enum>(2)</enum><header>Extended delay
of notification</header><text>If the notification required under subsection (a)
is delayed pursuant to paragraph (1), a person shall give notice not later than
30 days after such law enforcement delay was invoked unless a Federal law
enforcement agency provides written notification that further delay is
necessary.</text>
</paragraph></subsection></section><section id="HF29108A81FF54BC5BA5F58A302100644"><enum>114.</enum><header>Transparency</header>
<subsection id="H8B4E197C9A3843C7ADAE3D00108F763B"><enum>(a)</enum><header>Public list of
data partners</header>
<paragraph id="H2CDDDBB09A524945B954CFE3BEA46475"><enum>(1)</enum><header>In
general</header><text>A health information person shall establish a list of
data partners (as defined in paragraph (2)) with which such person has entered
into a contract or relationship for the purposes of providing services
involving any personal health information held, used, or disclosed by the
person. Such list and the contact information for each partner shall be made
publicly accessible on the Internet.</text>
</paragraph><paragraph commented="no" id="H90E79B252C544B04B675D1D799B720DC"><enum>(2)</enum><header>Data partner
defined</header><text>In paragraph (1), the term <term>data partner</term>
means a data bank, data warehouse, information clearinghouse, record locator
system, or other business entity, which for monetary fees, dues, or on a
cooperative nonprofit basis, engages in the practice of accessing, collecting,
maintaining, modifying, storing, recording, transmitting, destroying, or
otherwise using or disclosing the personal health information of individuals.
Any person maintaining personal health information for the purposes of making
such information available to the individual or the health care provider,
including persons furnishing free or paid personal health records, electronic
health records, electronic medical records, and related products and services,
shall be deemed to be a data partner subject to the requirements of this
title.</text>
</paragraph></subsection><subsection id="H0501C27EAADA4E4DBA73D83058D31700"><enum>(b)</enum><header>Subcontracting
and outsourcing overseas</header><text>In the event a health information person
contracts with service providers not subject to this title, including service
providers operating in a foreign country, such person shall—</text>
<paragraph id="H35C6CABE04F64B7EADD5B23E376B39C0"><enum>(1)</enum><text>take reasonable
steps to select and retain third party service providers capable of maintaining
appropriate safeguards for the security, privacy, and integrity of personal
health information;</text>
</paragraph><paragraph id="H3466A7A4DE7348EFA58FA13446346173"><enum>(2)</enum><text>require by
contract that such service providers implement and maintain appropriate
measures designed to meet the requirements applicable to health information
persons under this title;</text>
</paragraph><paragraph id="HDF1C02AA104241208FE6185F4995A1C5"><enum>(3)</enum><text>be held liable for
any violation of this title by an overseas service provider or other provider
not subject to this title; and</text>
</paragraph><paragraph id="H255A83F7A1BA49FF8E20B2D4B7815D00"><enum>(4)</enum><text>in the case of a
service provider operating in a foreign country, obtain the informed consent of
the individual involved prior to outsourcing such individual's personal health
information to such provider.</text>
</paragraph></subsection><subsection id="H7EE2E79F05FD418F95FA3E50FB2F827F"><enum>(c)</enum><header>List of
persons</header><text>The Secretary shall maintain a public list identifying
health information persons that have lost, stolen, disclosed, or used in an
unauthorized manner or for an unauthorized purpose the personal health
information of 1,000 or more individuals. The list shall include how many
individuals were affected by such action and be displayed on the Web site of
the Department of Health and Human Services.</text>
</subsection></section><section id="H1BEA948007D34AC9ABF061748E65148C"><enum>115.</enum><header>Risk
management</header>
<subsection id="HE3D7B0B3FCB04BFD8B4DC5A13DDFF7F5"><enum>(a)</enum><header>In
general</header><text>Each health information person shall establish risk
management and control processes to protect against anticipated vulnerabilities
to the privacy, security, and integrity of personal health information that the
person accesses, holds, uses, or discloses.</text>
</subsection><subsection id="HFC524D7565BE43E1A6C9E6E0CC175073"><enum>(b)</enum><header>Risk
assessment</header><text>A health information person shall perform annual risk
assessments of procedures, systems, or networks involved in the creation,
accessing, maintenance, retention, modification, recording, storage,
distribution, destruction, or other use or disclosure of personal health
information. Such risk assessment shall include—</text>
<paragraph id="H21D8D1BE431A4FFBBE69C840E243082E"><enum>(1)</enum><text>identifying
reasonably foreseeable internal and external vulnerabilities that could result
in inaccuracy or in unauthorized access, disclosure, use, or modification of
personal health information, or of systems containing personal health
information;</text>
</paragraph><paragraph id="H64A227EDE41C492BA768D2F9FB84122E"><enum>(2)</enum><text>assessing the
likelihood of and potential damage from inaccuracy or from unauthorized access,
disclosure, use, or modification of personal health information;</text>
</paragraph><paragraph id="H81C7952F663F4DFEB67114A35700872B"><enum>(3)</enum><text>assessing the
sufficiency of policies, technologies, and safeguards in place to enable
compliance with individuals’ informed consent to the access, disclosure, use,
or modification of their personal health information and minimize and control
risks from unauthorized access, disclosure, use, or modification of
individuals’ personal health information; and</text>
</paragraph><paragraph id="H73800BA073EB4A4500F83FE514513489"><enum>(4)</enum><text>assessing the
vulnerability of personal health information during destruction and disposal of
such information, including through the disposal or retirement of
hardware.</text>
</paragraph></subsection><subsection id="HD0E7B1855679471489385FACF7C6DF61"><enum>(c)</enum><header>Risk
management</header><text>A health information person shall establish risk
management and control procedures designed to control risks such as those
identified in subsection (b). Such procedures shall include—</text>
<paragraph id="H536444F26F7143EEB0543F2DF9A3C622"><enum>(1)</enum><text>a
means for the detection and recording of actual or attempted, unauthorized,
fraudulent, or otherwise unlawful access, disclosure, transmission,
modification, use, or loss of personal health information;</text>
</paragraph><paragraph id="H39F891DCB19648D0B53673927FB611FD"><enum>(2)</enum><text>procedures for
ensuring the secure disposal of personal health information;</text>
</paragraph><paragraph id="H3E8C69351CFF4FA49DE97C4977A34DD"><enum>(3)</enum><text>a
means for limiting physical access to hardware, software, data storage
technology, servers, systems, or networks by unauthorized persons in order to
minimize the risk of information disclosure, modification, transmission,
access, use, or loss;</text>
</paragraph><paragraph id="H1B62E4B1165F4F869F93CF04BE612E57"><enum>(4)</enum><text>providing
appropriate risk management and control training for employees; and</text>
</paragraph><paragraph id="H1508E71E41A9434491ADC1E9FA79A250"><enum>(5)</enum><text>carrying out
annual testing of such risk management and control procedures.</text>
</paragraph></subsection></section><section id="HAB45DE3DF1C9466292A79D71222CB183"><enum>116.</enum><header>Accounting for
disclosures and use</header>
<subsection id="H4512D8AACD3C42A592645F0209D599F0"><enum>(a)</enum><header>In
general</header><text>A health information person shall establish and maintain,
with respect to any personal health information disclosure, a record of each
disclosure in accordance with regulations promulgated by the Secretary in
consultation with the Director of the Office of Health Information Privacy.
Such record shall include the purpose of any disclosure and the identity of the
specific individual executing the disclosure, as well as the person to which
such information is disclosed.</text>
</subsection><subsection id="H9B7564E4BA24471FA4A84FA1C9395B00"><enum>(b)</enum><header>Maintenance of
record</header><text>A record established under subsection (a) shall be
maintained for not less than 6 years.</text>
</subsection><subsection id="H0006B7DD13D944BA00ABE2065928DDCE"><enum>(c)</enum><header>Electronic
records</header><text display-inline="yes-display-inline">A health information
person shall, to the maximum extent practicable, maintain an accessible
electronic record concerning each access, use, or disclosure, whether
authorized or unauthorized and whether successful or unsuccessful, of personal
health information maintained by such person in electronic form. The record
shall include the identities of the specific individuals (or a way to identify
such individuals, or information helpful in determining the identities of such
individuals) who access or seek to gain access to, use or seek to use, or
disclose or seek to disclose, information sufficient to identify the personal
health information sought or accessed, and other appropriate
information.</text>
</subsection><subsection id="H67E12C01A86E46EB9DDAD100BE87A2B"><enum>(d)</enum><header>Access to
records</header><text>A health information person shall permit an individual
who is the subject of personal health information, or the individual’s
designee, to inspect and copy the records created in subsections (a) and
(c).</text>
</subsection></section></subtitle><subtitle id="H84813F974CA44E1FAE543DD3167BE363"><enum>C</enum><header>Use and Disclosure
of Personal Health Information</header>
<chapter id="H6FE952C057E041E5B95CEC096736983B"><enum>1</enum><header>General
Restrictions</header>
<section id="HA762157032A743DB8282B3451DC67C83"><enum>121.</enum><header>General rules
regarding use and disclosure</header>
<subsection id="HE6CD0CBF57ED47E6BB335DD512471B4C"><enum>(a)</enum><header>Prohibition</header>
<paragraph id="H3061011FDEA34A28ABC1917C76B9D3E5"><enum>(1)</enum><header>General
rule</header><text>A person may not disclose, access, or use personal health
information except as authorized under this title.</text>
</paragraph><paragraph id="H04FA7C6B34A246C5AEBF7EC467D83B90"><enum>(2)</enum><header>Rule of
construction</header><text>Disclosure or use of health information that meets
the standards of being de-identified health information shall not be construed
as a disclosure or use of personal health information.</text>
</paragraph></subsection><subsection id="H0C148F19FEAC4DC4A3858DAC6F06DB3"><enum>(b)</enum><header>Scope of
disclosure or use</header>
<paragraph id="HDA56A0F7E68947F3BFDF8CAA4E00BC21"><enum>(1)</enum><header>In
general</header><text>A disclosure or use of personal health information under
this subtitle shall be limited to the minimum amount of information necessary
to accomplish the purpose for which the disclosure or use is made, such as the
individual’s name and address, date of service, place of service, type of
service, cost of service, and diagnosis.</text>
</paragraph><paragraph id="HFEF0EB2E90914A70B306DE1DA3E995F6"><enum>(2)</enum><header>Determination</header><text>The
determination as to what constitutes the minimum disclosure or use possible for
purposes of paragraph (1) shall be made by the individual or entity holding the
information. The minimum necessary standard is intended to be consistent with,
and not override, professional judgment and standards.</text>
</paragraph></subsection><subsection id="HCD98C8DEAE074760B7F61EB6A61FE156"><enum>(c)</enum><header>Use or
disclosure for purpose only</header>
<paragraph id="H932176E6DAC54F44885CA5787FCFF251"><enum>(1)</enum><header>In
general</header><text>An authorized recipient (as defined in paragraph (2)) of
information pursuant to this subtitle may use or disclose such information
solely to carry out the purpose for which the information was disclosed, except
as provided in section 143.</text>
</paragraph><paragraph commented="no" id="H4BABBEB1A3A8457EB46200EAF14E00D5"><enum>(2)</enum><header>Authorized
recipient defined</header><text>In paragraph (1), the term <term>authorized
recipient</term> means a person granted the authority by an individual, in
accordance with this title, to access, maintain, retain, modify, record, store,
destroy, or otherwise use the individual’s personal health information through
an authorized disclosure.</text>
</paragraph></subsection><subsection id="H9A94158482FB486AA5F1F3345DDCEEE7"><enum>(d)</enum><header>No general
requirement To disclose</header><text display-inline="yes-display-inline">Nothing in this subtitle permitting the
disclosure of personal health information shall be construed to require such
disclosure.</text>
</subsection><subsection id="HF4DEAFF8722E4C92882DC123B1B5A1E8"><enum>(e)</enum><header>Identification
of disclosed information as personal health information</header><text display-inline="yes-display-inline">Personal health information disclosed or
used pursuant to this subtitle shall be clearly identified and labeled as
personal health information that is subject to this title.</text>
</subsection><subsection id="HA79985A17489486680DB9833C820DEE6"><enum>(f)</enum><header>Disclosure or
use by agents</header><text display-inline="yes-display-inline">An agent,
employee, or affiliate of a health information person that accesses, seeks to
access, obtains, discloses, uses, or receives personal health information from
such person, shall be subject to this subtitle to the same extent as the
person.</text>
</subsection><subsection id="HB86EABE53DF34AFAB466BBC098F3B090"><enum>(g)</enum><header>Disclosure or
use by others</header><text display-inline="yes-display-inline">A person
receiving personal health information initially held by a person described in
subsection (f) shall be subject to this subtitle to the same extent as the
person described in subsection (f).</text>
</subsection><subsection id="H96EC574779B846ABA47F2CAC086B4EBD"><enum>(h)</enum><header>Creation of
de-identified information</header><text>Notwithstanding subsection (c), but
subject to the other provisions of this section, a person described in
subsection (f) may disclose personal health information to an employee or other
agent of the person for purposes of creating de-identified information.</text>
</subsection><subsection id="H14A8E9854B494EB0BAD8A19442E0068"><enum>(i)</enum><header>Unauthorized use
or disclosure of the decryption key</header><text>The unauthorized disclosure
of a decryption key (as defined in section 171(7)) or other secondary or
tertiary means for accessing personal health information shall be deemed for
purposes of this subtitle to be a disclosure of personal health information.
The unauthorized use of a decryption key (or other secondary or tertiary means
for accessing personal health information) or de-identified health information
in order to identify an individual is deemed for purposes of this subtitle to
be disclosure of personal health information.</text>
</subsection><subsection id="H89D87EF096A1415B8C6593C3BFB057E"><enum>(j)</enum><header>No
waiver</header><text>Except as provided in this title, an informed consent or
other authorization to disclose or use personally identifiable health
information executed by an individual pursuant to this subtitle shall not be
construed as a waiver of any rights that the individual has under other Federal
or State laws, the rules of evidence, or common law.</text>
</subsection><subsection commented="no" id="HC5FA2AB9599848C9ACFB321F0028B979"><enum>(k)</enum><header>Opt-in to
network sharing</header>
<paragraph commented="no" id="H21A036CD527B45D39469C554402D192"><enum>(1)</enum><header>In
general</header><text>Before a health information person may share personal
health information, through disclosure, access, use, or otherwise, with a
health information network or system, the individual must opt in to the sharing
of such information with such network or system.</text>
</paragraph><paragraph commented="no" id="HAEEF406AF8D84A5088DCE1B46E9CBA36"><enum>(2)</enum><header>Health
information network or system defined</header><text display-inline="yes-display-inline">In this subsection, the term <quote>health
information network or system</quote> means an interoperable health information
infrastructure consisting of health information systems and other networks that
connect providers, consumers, and others involved in supporting health and
health care.</text>
</paragraph></subsection><subsection id="HE4881EA3E25D425F95C02BCD397E12C1"><enum>(l)</enum><header>Disposal of
data</header><text display-inline="yes-display-inline">To prevent the
unauthorized disclosure or use of personal health information, such
information, when disposed of, shall be de-identified, destroyed, or expunged
from any electronic, paper, or other files and documents maintained by
authorized persons to make such information permanently unreadable and
undecipherable.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="H716FCD03F4EE4B0B89343FDB2C7C14EE"><enum>(m)</enum><header>Obligations of
unauthorized recipients</header><text display-inline="yes-display-inline">A
person that obtains, accesses, or receives personal health information and that
is an unauthorized recipient of such information may not access, maintain,
retain, modify, record, store, destroy, or otherwise use or disclose such
information for any purposes, and use or disclosure of personal health
information under such circumstances shall be deemed for purposes of this
subtitle an unauthorized disclosure of personal health information, unless the
disclosure is for the purpose of informing the Secretary, law enforcement
authorities, or Congress of the person’s unauthorized receipt of the personal
health information.</text>
</subsection></section><section id="HA106887CC3B94069B11FC706C4A0D0B2"><enum>122.</enum><header>Informed
consent for disclosure of personal health information for treatment and
payment</header>
<subsection id="H894EC678BE6340ACB0F605CFCADFB566"><enum>(a)</enum><header>Requirements
relating to employers, health plans, health or life insurers, uninsured and
self-pay individuals, and providers</header>
<paragraph id="H850D7059646842468EA21D0058D7FD00"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">An employer, health
plan, health or life insurer, or health care provider that seeks to disclose
personal health information in connection with treatment or payment shall
obtain informed consent (as defined in section 171(19)) from the subject of
such personal health information that satisfies the requirements of this
section. A single consent may authorize multiple disclosures.</text>
</paragraph><paragraph id="HD6C260821B7B4FF0BF32C2323F70E7C9"><enum>(2)</enum><header>Health plans,
health or life insurers</header><text display-inline="yes-display-inline">Every
health plan or health or life insurer offering enrollment to individual or
nonemployer groups shall, at the time of enrollment in the plan or insurance,
obtain an informed consent for the use and disclosure of personal health
information with respect to each individual who is eligible to receive care or
benefits under the plan or insurance.</text>
</paragraph><paragraph id="H78E7C4D8A34E441BBEA44C00BD3C481"><enum>(3)</enum><header>Uninsured and
self-pay</header><text display-inline="yes-display-inline">An originating
provider that provides health care in other than a network plan setting, or
provides health care to an uninsured individual, shall obtain an informed
consent for access to or use of personal health information in providing health
care or arranging for health care from other providers or seeking payment for
the provision of health care services.</text>
</paragraph><paragraph id="HBE32886342CD46F0B600212D3F28FB91"><enum>(4)</enum><header>Providers</header><text display-inline="yes-display-inline">Every health care provider that provides
health care to an individual that has not been given the appropriate prior
consent under this section, shall at the time of providing such care, or at
such time as is practicable if services are necessary prior to the opportunity
to obtain consent, obtain an informed consent for the use and disclosure of
personal health information with respect to such individual.</text>
</paragraph></subsection><subsection id="H7CDF3B51D295460E846826F87C04FC40"><enum>(b)</enum><header>Requirements for
individual informed consent</header><text>To satisfy the requirements of this
subsection, an informed consent from an individual to disclose the individual’s
personal health information shall—</text>
<paragraph id="HC0C4EF343A214F818FCFA5FE0A698A3"><enum>(1)</enum><text>identify, by
general job description or other functional description and by geographic
location, those persons that are authorized to disclose the information,
including entities employed by a person authorized to disclose the
information;</text>
</paragraph><paragraph id="H15C4D7D478304F1A96406CC7C4F2FEC3"><enum>(2)</enum><text>describe the
specific nature of the information to be disclosed;</text>
</paragraph><paragraph id="H0C55D25924414FA9877F7F228D132F27"><enum>(3)</enum><text>identify, by
general job description or other functional description and by geographic
location, those persons to which the information will be disclosed, including
entities employed by a person to which information is authorized to be
disclosed;</text>
</paragraph><paragraph id="HB3F4006A072F4EFBABF205ACC535E009"><enum>(4)</enum><text>describe the
purpose of the disclosures;</text>
</paragraph><paragraph id="HECDD3C7B65B5484A8E21267F666FD7FC"><enum>(5)</enum><text>permit the
executing individual to indicate that a particular person or class of persons
(a group of persons with similar roles or functions) listed on the informed
consent is not authorized to receive personal health information concerning the
individual, except as provided for in subsection (c)(3);</text>
</paragraph><paragraph id="H26E30DB480F84FDA9ECA379685BD5C58"><enum>(6)</enum><text>provide the means
by which an individual may indicate that some of the individual's personal
health information should be segregated and to what persons or classes of
persons such segregated information may be disclosed;</text>
</paragraph><paragraph id="HAFB882A208954992AF5EB06382BF63E2"><enum>(7)</enum><text>be subject to
revocation by the individual and indicate that the informed consent is valid
until revocation by the individual or until an event or date specified;</text>
</paragraph><paragraph id="H8064AF6F670640E2ADFF73E4C8364920"><enum>(8)</enum><subparagraph commented="no" display-inline="yes-display-inline" id="H338E726D7C2D4B0698D4FD145F217E70"><enum>(A)</enum><text>be in writing, dated,
and signed by the individual; and</text>
</subparagraph><subparagraph id="H6548355D8BE24CE99B7C533BF78DD900" indent="up1"><enum>(B)</enum><text>not have been revoked under subsection
(f);</text>
</subparagraph></paragraph><paragraph id="H5DA185BEECEE4C8600F6FE56A83FE21"><enum>(9)</enum><text>describe the
procedure by which an individual can amend an informed consent previously
obtained by a person;</text>
</paragraph><paragraph id="HB5C19EC27B8947299EF69632BA4F4DD"><enum>(10)</enum><text>describe the
extent to which the authorized person will share information with
sub-contracted persons, and the geographic location of sub-contracted persons,
including those operating or located overseas, except that the authorized
person shall obtain the informed consent of the individual involved prior to
outsourcing such individual's personal health information to a sub-contracted
person operating or located overseas; and</text>
</paragraph><paragraph id="H672D2730C6F442018E6952F6740017B7"><enum>(11)</enum><text>describe the
nature and probability of harm to the individual resulting from the informed
consent for use or disclosure, consistent with the principle of informed
consent.</text>
</paragraph></subsection><subsection id="H2A4F9A6CFBC04E08BAE87603ED11813"><enum>(c)</enum><header>Limitation on
informed consent</header>
<paragraph id="H3BCAE3F45DC54A77ACB73043F936CA6E"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to paragraphs
(2) and (3), a health information person that seeks informed consent under this
subtitle may not condition the delivery of treatment or payment for services on
the receipt of such an informed consent.</text>
</paragraph><paragraph id="H95A1F72BFA7847C5867B91637249FCDD"><enum>(2)</enum><header>Right to require
self-payment</header>
<subparagraph id="H63B9A86BB6F54206AC86622CF93CA52D"><enum>(A)</enum><header>In
general</header><text>If an individual has refused to provide an informed
consent for disclosure of administrative billing information (as defined in
subparagraph (B)) to a person and such informed consent is necessary for a
health care provider to receive payment for services delivered, the health care
provider may require the individual to pay from their own funds for the
services.</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H0516FEF1501D429D96CB744400D35C37"><enum>(B)</enum><header>Administrative
billing information</header><text>In subparagraph (A), the term
<term>administrative billing information</term> means any of the following
forms of personal health information:</text>
<clause id="H5A3E8C0E3EE94A02BE02002EA704C2E0"><enum>(i)</enum><text>Date
of service, policy, patient identifiers, and practitioner or facility
identifiers.</text>
</clause><clause id="H8C18BF3A8EC24B599691136079FF2200"><enum>(ii)</enum><text>Diagnostic codes,
in accordance with medicare billing codes, for which treatment is being
rendered or requested.</text>
</clause><clause id="HDBC48007A5F84DDB985D7D125C9BB1D6"><enum>(iii)</enum><text>Complexity of
service codes, indicating duration of treatment.</text>
</clause><clause id="H5626E5458AF14AFCAC2F3DAA78D21E8"><enum>(iv)</enum><text>Total billed
charges.</text>
</clause></subparagraph></paragraph><paragraph id="HB7EFEA5232A9494CA7D085D2EF4F255E"><enum>(3)</enum><header>Right of health
care provider to require informed consent for treatment
purposes</header><text>If a health care provider that is seeking an informed
consent for disclosure of an individual's personal health information believes
that the disclosure of such information is necessary so as not to endanger the
health or treatment of the individual, and if the withholding of services will
not endanger the life of the individual, the health care provider may condition
the provision of services upon the individual’s execution of an informed
consent to disclose personal health information to the minimum extent
necessary.</text>
</paragraph><paragraph id="H0A11287DD6F14A9CAEFD54C8957000B9"><enum>(4)</enum><header>informed
consents for payment under certain circumstances</header><text>If an individual
is in a physical or mental condition such that the individual is not capable of
authorizing the disclosure of personal health information and no other
arrangements have been made to pay for the health care services being rendered
to the patient, such information may be disclosed to a governmental authority
to the extent necessary to determine the individual's eligibility for, and to
obtain, payment under a governmental program for health care services provided
to the patient. The information may also be disclosed to another provider of
health care or health care service plan as necessary to assist the other
provider or health care service plan in obtaining payment for health care
services rendered by that provider of health care or health care service plan
to the patient.</text>
</paragraph></subsection><subsection id="H59F5C80F679F47529CBA37142FFB138E"><enum>(d)</enum><header>Model informed
consent</header><text>The Secretary, in consultation with the Director of the
Office of Health Information Privacy, after notice and opportunity for public
comment in accordance with <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States Code, shall
develop and disseminate model written informed consents of the type described
in this section, which represent informed consent from the subject of such
personal health information that satisfies the requirements of this section,
and model statements of the limitations on informed consents. Any informed
consent obtained on a model informed consent form under this section developed
by the Secretary pursuant to the preceding sentence shall be deemed to satisfy
the requirements for an informed consent under this section.</text>
</subsection><subsection id="HAEF766739818486E99D129028613B017"><enum>(e)</enum><header>Segregation of
files</header><text>A health information person shall comply with the request
of an individual who is the subject of personal health information—</text>
<paragraph id="H5D7E92BA044443218824958366A6CB60"><enum>(1)</enum><text>to hide, mask, or
mark separate any type or amount of personal health information held by the
person; and</text>
</paragraph><paragraph id="HD327B150B2FA4CC294C2041FB1F5FAE6"><enum>(2)</enum><text>to limit the use
or disclosure of the segregated health information within the person to those
specifically designated by the subject of the personal health
information.</text>
</paragraph></subsection><subsection id="H814BA6B6A4034E0C91CD8187C0AD65B"><enum>(f)</enum><header>Revocation of
informed consent</header>
<paragraph id="HF742FF77C81148279587571623278464"><enum>(1)</enum><header>In
general</header><text>An individual may revoke or amend in writing an informed
consent under this section at any time, unless the disclosure that is the
subject of the consent is required to effectuate payment for health care that
has been provided to the individual and for which the individual has declined
or refused to pay from the individual’s own funds.</text>
</paragraph><paragraph id="H30D6B5F223B7438CB254B1EDE219F708"><enum>(2)</enum><header>Health
plan</header><text>With respect to a health plan, the informed consent of an
individual is deemed to be revoked at the time of the cancellation or
non-renewal of enrollment in the health plan, except as may be necessary to
complete plan administration and payment requirements related to the
individual's period of enrollment.</text>
</paragraph></subsection><subsection id="H30631F37CE2E40D69D86BCCE88325491"><enum>(g)</enum><header>Record of
individual's informed consents and revocations</header><text>Each person
accessing, maintaining, retaining, modifying, recording, storing, destroying,
or otherwise using personally identifiable or personal health information for
purposes of treatment or payment shall maintain a record for a period of 6
years of each informed consent by an individual and any revocation thereof, and
such record shall become part of the individual’s health record set.</text>
</subsection></section><section id="H66E6F58289A24382897BF678B900A9E8"><enum>123.</enum><header>Informed
consent and authorization for disclosure of personal health information other
than for treatment or payment</header>
<subsection id="HB10F05ED39884C1700ED1990242D1E4D"><enum>(a)</enum><header>In
general</header><text>A health information person that seeks to disclose
personal health information for a purpose other than treatment or payment shall
obtain informed consent. Such consent under this section shall be separate from
an informed consent provided under section 122.</text>
</subsection><subsection id="H50307159C5894A059341B8BFB9449CA3"><enum>(b)</enum><header>Limitation on
authorizations</header><text>A person subject to section 122 may not condition
the delivery of treatment, or payment for services, on the receipt of an
informed consent or authorization described in this section.</text>
</subsection><subsection id="H827AA2AD720D42138656A6AF957DA792"><enum>(c)</enum><header>Model informed
consents and authorizations</header><text>The Secretary, in consultation with
the Director of the Office of Health Information Privacy, after notice and
opportunity for public comment in accordance with <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5,
United States Code, shall develop and disseminate model informed consents of
the type described in subsection (a) and written authorizations of the type
described in subsections (d) and (e). Any consent or authorization obtained on
a respective model form shall be deemed to meet the requirements under the
respective subsection.</text>
</subsection><subsection id="H7E2470247413444094878DFD81B9CA1"><enum>(d)</enum><header>Requirement of
separate, additional authorization for personnel decisions</header><text>A
health information person subject to section 122 may not disclose personal
health information to any employees or agents who are responsible for making
employment, work assignment, or other personnel decisions with respect to the
subject of the information without a separate, additional written authorization
permitting such a disclosure.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="H6F70EEA6052B491E9D68C26BA2998C"><enum>(e)</enum><header>Requirement of
separate, additional authorization for marketing</header>
<paragraph commented="no" id="HCAB8054FB1D84E11A40152CAB468FF8B"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A health information
person may not disclose personal health information for marketing purposes
without a separate, additional written authorization permitting such a
disclosure.</text>
</paragraph><paragraph commented="no" id="H21B9D96657F94DFE86888292AFC6016"><enum>(2)</enum><header>Requirements</header><text display-inline="yes-display-inline">In the case of a disclosure of personal
health information for marketing purposes, a separate authorization required by
paragraph (1), to be valid, shall—</text>
<subparagraph commented="no" id="H858D1E4B334B4BC28E28FACE2CC7AEF5"><enum>(A)</enum><text display-inline="yes-display-inline">state that one purpose of the disclosure is
for <quote>marketing</quote>;</text>
</subparagraph><subparagraph commented="no" id="H24AB47532BB047A79810B26DF2D4131"><enum>(B)</enum><text>state that the
purpose of the use or disclosure involved is marketing;</text>
</subparagraph><subparagraph commented="no" id="HA2156FBA5FE444B69ED46510851280AA"><enum>(C)</enum><text>describe the
specific marketing uses and disclosures authorized, including whether the
personal health information involved—</text>
<clause commented="no" id="HD5559EA4675D4D80A2A8EA37BAEF5D"><enum>(i)</enum><text>may be used for
purposes internal to the person;</text>
</clause><clause commented="no" id="HD1D38BE6C78643DABE18A5765B40937D"><enum>(ii)</enum><text>may be disclosed
to, and used by, a business associate of the person; and</text>
</clause><clause commented="no" id="H5926DE8A1161469FA6A11C557E5059BC"><enum>(iii)</enum><text>may be disclosed
to, and used by, any person or entity other than a business associate of the
person; and</text>
</clause></subparagraph><subparagraph commented="no" id="H0BEEBD940A16450DA66CECE710ABB004"><enum>(D)</enum><text>state that the use
or disclosure of personal health information for marketing will directly result
in remuneration to the person from a third party, in any case in which a person
expects, or reasonably should expect, that such remuneration will occur.</text>
</subparagraph></paragraph><paragraph commented="no" id="HF645F3C2422F49FEB40074AD9B1B6718"><enum>(3)</enum><header>Marketing
defined</header>
<subparagraph id="H8F4CCDEA44EF4DD798E8CF3EDB658E17"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">In this subsection,
the term <quote>marketing</quote> is a communication about a product or service
a purpose of which is to encourage recipients of the communication to purchase
or use the product or service in return for direct or indirect
compensation.</text>
</subparagraph><subparagraph id="H5A0C31AB2D0A4A26A8C0D06354D9E92F"><enum>(B)</enum><header>Exclusions</header>
<clause id="H8992EE8F3EB74F2191565EF500F044E8"><enum>(i)</enum><header>In
general</header><text>Subject to clause (ii), such term excludes the following
exceptions:</text>
<subclause commented="no" id="H7E0989EB4ABC429FA25B08562F8240D7"><enum>(I)</enum><text display-inline="yes-display-inline">Communications made by person for the
purpose of describing the entities participating in a provider network or
health plan network, and communications made by a person for the purpose of
describing if and the extent to which a product or service, or payment for a
product or service, is provided by the person or included in a benefit
plan.</text>
</subclause><subclause commented="no" id="H8015AF4C51D54D7DB32B72128173BBBC"><enum>(II)</enum><text display-inline="yes-display-inline">Communications tailored to the
circumstances of a particular individual, made by a health care provider to an
individual as part of the treatment of the individual, and for the purpose of
furthering the treatment of that individual.</text>
</subclause><subclause commented="no" id="H9C02CC2936C143779617FF7CA9CC00B"><enum>(III)</enum><text display-inline="yes-display-inline">Communications tailored to the
circumstances of a particular individual and made by a health care provider or
health plan to an individual in the course of managing or coordinating the
treatment of that individual or for the purpose of directing or recommending to
that individual alternative treatments, therapies, providers, or settings of
care.</text>
</subclause></clause><clause id="HC9D135DC8693403F926CED35F0ACBEA"><enum>(ii)</enum><header>Exception</header><text display-inline="yes-display-inline">Clause (i) shall not apply, and a
communication shall be considered marketing, if a person receives direct or
indirect remuneration from a third party for making a written communication
otherwise described in subclause (I), (II), or (III) of such clause.</text>
</clause></subparagraph></paragraph></subsection><subsection id="HA2795D36B1E64F87BC8D3F0742991203"><enum>(f)</enum><header>Requirement To
release personal health information to coroners and medical examiners</header>
<paragraph id="H511C871ACAE04329AE641E191977D992"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">When a coroner or
medical examiner or their duly appointed deputies seek personal health
information for the purpose of inquiry into and determination of, the cause,
manner, and circumstances of an individual's death, the health information
person shall provide that individual’s personal health information to the
coroner or medical examiner or to the duly appointed deputies without undue
delay or consent by the deceased individual’s representative.</text>
</paragraph><paragraph id="H5BE4FD362DFE403E8763403E51BC6031"><enum>(2)</enum><header>Production of
additional information</header><text>If a coroner or medical examiner or their
duly appointed deputies receives health information from a person referred to
in paragraph (1), such health information shall remain as personal health
information unless the health information is attached to or otherwise made a
part of a coroner's or medical examiner's official report, in which case it
shall no longer be protected.</text>
</paragraph><paragraph id="H85CF59A152AC472BA5004D9E07C222CF"><enum>(3)</enum><header>Exemption</header><text>Health
information attached to or otherwise made a part of a coroner's or medical
examiner's official report shall be exempt from the provisions of this title
except as provided for in this subsection.</text>
</paragraph><paragraph id="HA0796ECC9B1E47C8003DE51732BDDB5"><enum>(4)</enum><header>Reimbursement</header><text>A
person referred to in paragraph (1) may request reimbursement from a coroner or
medical examiner for the reasonable costs associated with inspection or copying
of personal health information maintained, retained, or stored by such
person.</text>
</paragraph></subsection><subsection id="H92B5C6E20CEB414DB62C18E597EC0039"><enum>(g)</enum><header>Revocation or
amendment of consent or authorization</header><text>An individual may revoke or
amend in writing an informed consent or authorization under this section at any
time.</text>
</subsection><subsection id="H736B9782FFA748D180A9641B67054E5F"><enum>(h)</enum><header>Actions</header><text>It
shall not be a violation of this title with respect to the disclosure of
personal health information—</text>
<paragraph id="HC82B87D62A764B6493E739A4128E5212"><enum>(1)</enum><text>if the disclosure
was made based on a good faith reliance on the individual’s informed consent or
authorization under this section at the time disclosure was made;</text>
</paragraph><paragraph id="H226068BD2A364895BC6F099B374E6DD2"><enum>(2)</enum><text>in a case in which
the consent or authorization is revoked, if the disclosing person had no actual
or constructive notice of the revocation; or</text>
</paragraph><paragraph display-inline="no-display-inline" id="H42EB947CFFC34B11B3A66ED0E4A4ABD"><enum>(3)</enum><text>if the disclosure
was for the purpose of protecting another individual from imminent physical
harm and is authorized under section 141.</text>
</paragraph></subsection><subsection id="HA5EC898E50B344999DCB6B4FF247B140"><enum>(i)</enum><header>Record of
consents, authorizations, and revocations</header><text>Each person accessing,
maintaining, retaining, modifying, recording, storing, destroying, or otherwise
using personally identifiable or personal health information for purposes other
than treatment or payment shall maintain a record for a period of 6 years of
each informed consent and authorization by an individual and any revocation
thereof, and such record shall become part of the individual’s health record
set.</text>
</subsection></section></chapter><chapter id="H7EA4A57F28E84E08BCDEA0E912D9C021"><enum>2</enum><header>Exceptions</header>
<section id="HB78E0008FA8F4EC991A309956F9CA62"><enum>131.</enum><header>Disclosure for
law enforcement, national security, and intelligence purposes</header>
<subsection id="H3274D66B528E452D95733DEA7DAE5C44"><enum>(a)</enum><header>Access to
personal health information for law enforcement, national security, and
intelligence activities</header><text>A health information person, or a person
who receives personal health information pursuant to section 131, may disclose
personal health information to—</text>
<paragraph id="H0EDC12136A5A453D96F1EB6D1274EF2D"><enum>(1)</enum><text>an investigative
or law enforcement officer (as defined in subsection (k)) pursuant to a warrant
issued under the Federal Rules of Criminal Procedure, an equivalent State
warrant, a grand jury subpoena, civil subpoena, civil investigative demand, or
a court order under limitations set forth in subsection (b); and</text>
</paragraph><paragraph id="H3CED30F1FE574F2B9C7365E5647059C7"><enum>(2)</enum><text>an authorized
Federal official for the conduct of lawful intelligence, counter-intelligence,
and other national security activities authorized by the National Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/50/401">50 U.S.C. 401 et seq.</external-xref>) and implementing authority (Executive Order 12333), or
otherwise by law.</text>
</paragraph></subsection><subsection id="HA22F9DAA6A7B470696AC79070784EC60"><enum>(b)</enum><header>Limitation on
use and disclosure for national security, intelligence, and other law
enforcement inquiries</header>
<paragraph id="H5FA87B56157648C6ACBA8125C9C201D"><enum>(1)</enum><header>In
general</header><text>Personal health information about an individual that is
disclosed under this section may not be used in, or disclosed to any entity for
use in, any administrative, civil, or criminal action or investigation directed
against the individual, unless the action or investigation arises out of, or is
directly related to, the law enforcement, national security, or intelligence
inquiry for which the information was obtained.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="HB4CFF297BB924F2600DBF42DB31762"><enum>(2)</enum><header>Law enforcement
inquiry defined</header><text>In paragraph (1), the term <term>law enforcement
inquiry</term> means a lawful executive branch investigation or official
proceeding inquiring into a violation of, or failure to comply with, any
criminal or civil statute or any regulation, rule, or order issued pursuant to
such a statute.</text>
</paragraph></subsection><subsection id="HE1C9A456F2E94656815599EFD5D7C65"><enum>(c)</enum><header>Redactions</header><text>To
the maximum extent practicable, and consistent with the requirements of due
process, a law enforcement agency shall redact personally identifying
information from personal health information prior to the public disclosure of
such protected information in a judicial or administrative proceeding.</text>
</subsection><subsection id="HAC976AE8B5554303B7BD4E97BAC65CC"><enum>(d)</enum><header>Exception</header><text>This
section shall not be construed to limit or restrict the ability of law
enforcement authorities to gain information while in hot pursuit of a suspect
or if other exigent circumstances exist.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="H440583B451D24EEF9EF230A3B43BB60"><enum>(e)</enum><header>Investigative or
law enforcement officer defined</header><text>In this section, the term
<term>investigative or law enforcement officer</term> means any officer of the
United States or of a State or political subdivision thereof, who is empowered
by law to conduct investigations of, or to make arrests for, civil or criminal
offenses, and any attorney authorized by law to prosecute or participate in the
prosecution of such offenses.</text>
</subsection></section><section id="HA4A4AE07CEA145BAB806DC475304501D"><enum>132.</enum><header>Disclosure for
public health purposes</header>
<subsection id="HDAF174D8BF974431A4716ED531D1E946"><enum>(a)</enum><header>In
general</header><text>A health information person may disclose personal health
information to a public health authority (as defined in section 171(24)) or
other entity authorized by public health law, when receipt of such information
by the authority or other entity—</text>
<paragraph id="H3F1528CB26484B61811F7BC75B2E022C"><enum>(1)</enum><text>relates directly
to a specified public health purpose;</text>
</paragraph><paragraph id="HB4907E53D7D64231B0128D8C3788534D"><enum>(2)</enum><text>is reasonably
likely to achieve such purpose; and</text>
</paragraph><paragraph id="H80310E20CBF14F0DAB17939CF58F878"><enum>(3)</enum><text>is
intended for a purpose that cannot be achieved through the receipt or use of
de-identified health information.</text>
</paragraph></subsection><subsection id="H52FB9D296B204364848524BF913623A6"><enum>(b)</enum><header>Public health
protection defined</header><text>For purposes of subsection (a), the term
<term>public health purpose</term> means a population-based activity or
individual effort, authorized by law, the purpose of which is the prevention of
injury, disease, or premature mortality, or the promotion of health, in a
community, including—</text>
<paragraph id="H22D791D02BF94DDFA9E4EFCF736C7BFF"><enum>(1)</enum><text>assessing the
health needs and status of the community through public health surveillance and
epidemiological research;</text>
</paragraph><paragraph id="H33B1C3B8C2B240178D2455AE1821F3D6"><enum>(2)</enum><text>implementing
public health policy;</text>
</paragraph><paragraph id="HC85459EDC34C46EE82A2D2C7A7F72E5"><enum>(3)</enum><text>responding to
public health needs and emergencies; and</text>
</paragraph><paragraph id="HAF8BE47842B64B3990743ECE34897652"><enum>(4)</enum><text>any other
activities or efforts authorized by law.</text>
</paragraph></subsection><subsection id="H9BE08D1949394837A075409CFC75F4D"><enum>(c)</enum><header>Limitations</header><text>The
purpose of the disclosure described in subsection (a) shall be of significant
importance such that it warrants the potential effect on, or risk to, the
privacy of individuals that the additional exposure of personal health
information might bring. Any infringement on the right to privacy under this
section shall use the least intrusive means that are tailored to minimize
intrusion on the right to privacy.</text>
</subsection></section><section id="HB143F394A11F4260A8121953B3A02C47"><enum>133.</enum><header>Reporting of
abuse and neglect to protection and advocacy agencies</header><text display-inline="no-display-inline">Any health information person may disclose
personal health information to a protection and advocacy agency established
under part C of title I of the Developmental Disabilities Assistance and Bill
of Rights Act (<external-xref legal-doc="usc" parsable-cite="usc/42/6041">42 U.S.C. 6041 et seq.</external-xref>) or under the Protection and Advocacy for
Mentally Ill Individuals Act of 1986 (<external-xref legal-doc="usc" parsable-cite="usc/42/10801">42 U.S.C. 10801 et seq.</external-xref>) when such person
reasonably believes that an individual who is the subject of the personal
health information is vulnerable to abuse and neglect by an entity providing
health or social services to the individual.</text>
</section><section id="HABED5D18E9A1446B9B649507906D9D98"><enum>134.</enum><header>Disclosure to
next of kin and directory information</header>
<subsection id="HA6D326E4BCB442059345E5537D1D4924"><enum>(a)</enum><header>Next of
kin</header><text>A health care provider, or a person that receives personal
health information under section 141, may disclose personal health information
about health care services provided to an individual to the individual's next
of kin, or to another entity that the individual has identified, if at the time
of the treatment of the individual—</text>
<paragraph id="HB0ED0218F1594CCBA6DBEE4C70C659BC"><enum>(1)</enum><text>the
individual—</text>
<subparagraph id="H57B2736E7DED4C01A134DF000670449B"><enum>(A)</enum><text>has been notified
of the individual's right to object to such disclosure and the individual has
not objected to the disclosure; or</text>
</subparagraph><subparagraph id="HDD1F3CA13395489BB41D33B7E416A7E6"><enum>(B)</enum><text>is in a physical
or mental condition such that the individual is not capable of objecting, and
there are no prior indications that the individual would object; and</text>
</subparagraph></paragraph><paragraph id="H7E29BD6E679F45708072186EBF282356"><enum>(2)</enum><text>the information
disclosed is relevant to health care services currently being provided to that
individual.</text>
</paragraph></subsection><subsection id="H305F77FB193A43F78F951304F1FB2C96"><enum>(b)</enum><header>Directory
information</header>
<paragraph id="HFC58A5043DDF41A783CC49343491B056"><enum>(1)</enum><header>Disclosure</header>
<subparagraph id="HB36EBC5CD779491B80614EE47C0944B3"><enum>(A)</enum><header>In
general</header><text>Except as provided in paragraph (2), with respect to an
individual who is admitted as an inpatient to a health care facility, a person
described in subsection (a) may disclose information described in subparagraph
(B) about the individual to any entity if, at the time of the admission, the
individual—</text>
<clause id="HB2B416C243BA439097D453B26966FB12"><enum>(i)</enum><text>has
been notified of the individual's right to object and has not objected to the
disclosure; or</text>
</clause><clause id="HA114ED86480246EB96252EC47D11A226"><enum>(ii)</enum><text>is
in a physical or mental condition such that the individual is not capable of
objecting and there are no prior indications that the individual would
object.</text>
</clause></subparagraph><subparagraph id="H3C003579564549BB945200E700BDF5EA"><enum>(B)</enum><header>Information</header><text>Information
described in this subparagraph is information that consists only of 1 or more
of the following items:</text>
<clause id="HBC02B6F64EB94B5E87C86959933E667B"><enum>(i)</enum><text>The
name of the individual who is the subject of the information.</text>
</clause><clause id="H5F397543CA104133ABFE8500A78707C6"><enum>(ii)</enum><text>The
general health status of the individual, described as critical, poor, fair,
stable, or satisfactory or in terms denoting similar conditions.</text>
</clause><clause id="H799DEF897A5F4592A3910519006BE7E4"><enum>(iii)</enum><text>The location of
the individual within the health care facility to which the individual is
admitted.</text>
</clause></subparagraph></paragraph><paragraph id="HC417BB1073A94DED8BDF47BB00D229D1"><enum>(2)</enum><header>Exception</header><text>Paragraph
(1)(B)(iii) shall not apply if disclosure of the location of the individual
would reveal specific information about the physical or mental condition of the
individual, unless the individual expressly authorizes such disclosure.</text>
</paragraph></subsection><subsection id="HF4D32EB349714C698049DB69F8A50375"><enum>(c)</enum><header>Directory or
next-of-kin information</header><text>A disclosure may not be made under this
section if the disclosing person described in subsection (a) has reason to
believe that the disclosure of directory or next-of-kin information could lead
to the physical or mental harm of the individual, unless the individual
expressly authorizes such disclosure.</text>
</subsection></section></chapter><chapter id="HE983885723B0410B9CAAB56D0660116B"><enum>3</enum><header>Special
Circumstances</header>
<section id="H837A13E3859D4FFF95F0908287C050A4"><enum>141.</enum><header>Emergency
circumstances</header>
<subsection id="H0E1E31C342B8470A961B283EF234697D"><enum>(a)</enum><header>General
rule</header><text>In the event of a threat of imminent physical or mental harm
to the subject of personal health information, any person may, in order to
allay or remedy such threat, disclose personal health information about such
subject to a health care provider, health care facility, law enforcement
authority, or emergency medical personnel, to the minimum extent necessary and
only if determined appropriate by a health care provider.</text>
</subsection><subsection id="H22B9D46D3E834668BD09B7E3D400782F"><enum>(b)</enum><header>Harm to
others</header><text>Any person may disclose personal health information about
the subject of the information where—</text>
<paragraph id="H9AB5394C6ACB43F99F2510014C97C600"><enum>(1)</enum><text>such subject has
made an identifiable threat of serious injury or death with respect to an
identifiable individual or group of individuals;</text>
</paragraph><paragraph id="H0706065AEDC9471CBE564EAE385CBBDA"><enum>(2)</enum><text>the subject has
the ability to carry out such threat; and</text>
</paragraph><paragraph id="HA68A8D1FE493402C9B7B25B0644C1FD2"><enum>(3)</enum><text>the release of
such information is necessary to prevent or significantly reduce the
possibility of such threat being carried out.</text>
</paragraph></subsection></section><section id="H0FEC9C34BDA648339F9F94E37282505C"><enum>142.</enum><header>Health
research</header>
<subsection id="H288EC3C7CE91441BA3C99C4FE7E4E24"><enum>(a)</enum><header>Regulations</header>
<paragraph id="H5BF1DCEB23054983AE9BCED23CF1ADCE"><enum>(1)</enum><header>In
general</header><text>The requirements and protections provided for under part
46 of title 45, Code of Federal Regulations (as in effect on the date of
enactment of this Act), shall apply to all health research.</text>
</paragraph><paragraph id="HBDEF5FE4BE564A36BAF7E846CDAB0043"><enum>(2)</enum><header>Effective
date</header><text>Paragraph (1) shall not take effect until the Secretary has
promulgated final regulations to implement such paragraph.</text>
</paragraph></subsection><subsection id="H8FCF4E1D6F7B43F2A71FFAFBBE882D80"><enum>(b)</enum><header>Evaluation</header><text>Not
later than 24 months after the date of the enactment of this Act, the Secretary
shall prepare and submit to Congress detailed recommendations on whether
informed consent should be required, and if so, under what circumstances,
before personal health information can be used for health research.</text>
</subsection><subsection id="H80B7435D2E3C40D500AA60759F32A75B"><enum>(c)</enum><header>Recommendations</header><text>The
recommendations required to be submitted under subsection (b) shall
include—</text>
<paragraph id="H779B8B09C1C142EE924E356D761F4FDA"><enum>(1)</enum><text>a
detailed explanation of current institutional review board practices, including
the extent to which the privacy of individuals is taken into account as a
factor before allowing waivers and under what circumstances informed consent is
being waived;</text>
</paragraph><paragraph id="H0121B87A34FD4FF3B721598EFB968B02"><enum>(2)</enum><text display-inline="yes-display-inline">a list of all known breaches of health
information privacy over the past 5 years in research projects approved by an
institutional review board;</text>
</paragraph><paragraph id="H1DFCBBED180641D0A8EDD3F21996B1F0"><enum>(3)</enum><text display-inline="yes-display-inline">a summary of how technology that both
facilitates research and preserves privacy could be used to obtain informed
consent and strip identifying data for the purpose of research;</text>
</paragraph><paragraph id="HCD1FC9A9217843F392C100F3CE372DD0"><enum>(4)</enum><text display-inline="yes-display-inline">an analysis of State and Federal laws,
medical ethics, and ethics in the performance of health research that examines
requirements for the receipt of informed consent; and</text>
</paragraph><paragraph id="H06BBF778256D4C1EB315087B53B34242"><enum>(5)</enum><text>an analysis of the
risks and benefits of allowing individuals to consent or to refuse to consent,
at the time of receiving medical treatment, to the possible future use of
records of medical treatments for research studies.</text>
</paragraph></subsection><subsection id="HCEBA084E356B447900E6D3B38E83ED4B"><enum>(d)</enum><header>Consultation</header><text display-inline="yes-display-inline">In carrying out this section, the Secretary
shall consult with individuals who have distinguished themselves in the fields
of health research, privacy, related technology including electronic consent
management tools, consumer interests in health information, health data
standards, and the provision of health services.</text>
</subsection><subsection id="H3D651B6D985F4439B8B3CB9F5219759B"><enum>(e)</enum><header>Congressional
notice</header><text>Not later than 6 months after the date on which the
Secretary submits to Congress the recommendations required under subsection
(b), the Secretary shall propose to implement such recommendations through
regulations promulgated on the record after opportunity for a hearing, and
shall advise the Congress of such proposal.</text>
</subsection><subsection id="H16EF5C39C3C7409DB6B8EDADAF65771B"><enum>(f)</enum><header>Other
requirements</header>
<paragraph id="H9F71A3EEBDCD4DA1B579974E414D0020"><enum>(1)</enum><header>Obligations of
the recipient</header><text>A person who receives personal health information
pursuant to this section shall remove or destroy, at the earliest opportunity
consistent with the purposes of the project involved, information that would
enable an individual to be identified, unless—</text>
<subparagraph id="H9B584CB113334FAA9891739C6DA95627"><enum>(A)</enum><text>an institutional
review board has determined that there is a health or research justification
for the retention of such identifiers;</text>
</subparagraph><subparagraph id="H1E0EED7EAB254DF3ADD8F8500C6C102"><enum>(B)</enum><text display-inline="yes-display-inline">an institutional review board has, to the
maximum extent practicable, attempted to contact the individual to whom the
identifiers relate;</text>
</subparagraph><subparagraph id="HD85FCB1CE2BF40218FBD602826219C6"><enum>(C)</enum><text>upon being
contacted pursuant to subparagraph (B), the individual does not object to the
retention of such identifiers; and</text>
</subparagraph><subparagraph id="H637FA7B96D03471CAC70D65BC863710"><enum>(D)</enum><text>there is an
adequate plan to protect the identifiers from disclosure consistent with this
section.</text>
</subparagraph></paragraph><paragraph id="HCA90A3816A8F4EA9AC78C32FA6F590B8"><enum>(2)</enum><header>Periodic review
and technical assistance</header>
<subparagraph id="HE52D18044BD148CFB7B26DF04084F79C"><enum>(A)</enum><header>Institutional
review board</header><text>Any institutional review board that authorizes
research under this section shall provide the Secretary with the names and
addresses of the institutional review board members.</text>
</subparagraph><subparagraph id="H36CFB3FC577F494F98FFEE78937C85A3"><enum>(B)</enum><header>Technical
assistance</header><text>The Secretary shall provide technical assistance to
institutional review boards described in this subsection.</text>
</subparagraph><subparagraph id="H5B4297BECFA84E48ACBBC37DB0B1E249"><enum>(C)</enum><header>Monitoring</header><text display-inline="yes-display-inline">The Secretary shall periodically monitor
institutional review boards described in this subsection, including with
respect to the privacy, security, and confidentiality practices of such
boards.</text>
</subparagraph><subparagraph id="H8FDF4EECA2CE4431BD439800482218CA"><enum>(D)</enum><header>Reports</header><text>Not
later than 3 years after the date of enactment of this Act, the Secretary shall
report to Congress regarding the activities of institutional review boards
described in this subsection.</text>
</subparagraph></paragraph></subsection><subsection id="H4148E9A0F3ED453A9100DEA685636761"><enum>(g)</enum><header>Limitation</header><text>Nothing
in this section shall be construed to permit personal health information that
is received by a researcher under this section to be accessed for purposes
other than research or as authorized by the individual that is the subject of
such personal health information.</text>
</subsection></section><section id="HFA6DC5ABEE154A368081DF51399CBA3E"><enum>143.</enum><header>Health
oversight functions</header>
<subsection id="H2E3821DCF3B94A59ACF3E81B20C538E"><enum>(a)</enum><header>In
general</header><text>A health information person may disclose personal health
information to a health oversight agency (as defined in section 171(16)) to
enable the agency to perform a health oversight function authorized by law,
if—</text>
<paragraph id="H333C3342E39B4EB0A5BEB9259072A345"><enum>(1)</enum><text>the purpose for
which the disclosure is to be made cannot reasonably be accomplished without
personal health information;</text>
</paragraph><paragraph id="HD029CCB3D00A4C729286F100DC482FCC"><enum>(2)</enum><text>the purpose for
which the disclosure is to be made is of sufficient importance to warrant the
effect on, or the risk to, the privacy of the individuals that additional
exposure of the information might bring; and</text>
</paragraph><paragraph id="HFB6A62EA38244EF09E37BB32846EE55C"><enum>(3)</enum><text>there is a
reasonable probability that the purpose of the disclosure will be
accomplished.</text>
</paragraph></subsection><subsection id="H68ACCF5A129949F79C754C750028FF01"><enum>(b)</enum><header>Use and
maintenance of personal health information</header><text>A health oversight
agency that receives personal health information under subsection (a)—</text>
<paragraph id="H0DC1D86054524758A8AEF481ADB8D3DB"><enum>(1)</enum><text display-inline="yes-display-inline">shall, to the maximum extent practicable,
obtain the informed consent of the individual to whom the personal health
information relates before using or disclosing the information;</text>
</paragraph><paragraph id="HE3189385305C47068C36525420FA1E00"><enum>(2)</enum><text>shall secure
personal health information in all work papers and all documents summarizing
the health oversight activity through technological, administrative, and
physical safeguards including cryptographic-key based encryption;</text>
</paragraph><paragraph id="H30961B918A164C2D8FA38B8E34CC2520"><enum>(3)</enum><text>shall maintain in
its records only such information about an individual as is relevant and
necessary to accomplish the purpose for which the personal health information
was obtained;</text>
</paragraph><paragraph id="H4AE85CB6578D4D83B858ACA33D00B901"><enum>(4)</enum><text>using appropriate
encryption measures, shall maintain such information securely and limit access
to such information to those persons with a legitimate need for access to carry
out the purpose for which the records were obtained; and</text>
</paragraph><paragraph id="H4FA45C77D2CF4ACCB019108CE608B17E"><enum>(5)</enum><text>shall remove or
destroy the information that allows subjects of personal health information to
be identified at the earliest time at which removal or destruction can be
accomplished, consistent with the purpose of the health oversight
activity.</text>
</paragraph></subsection><subsection id="H852FD3E469D04122A81CD4905EC69773"><enum>(c)</enum><header>Authorization by
a supervisor</header><text>For purposes of this section, the individual with
authority to authorize the oversight function involved shall provide to the
disclosing person described in subsection (a) a statement that the personal
health information is being sought for a legally authorized oversight
function.</text>
</subsection></section><section id="H9FC3854B95F741F88E1276A360040424"><enum>144.</enum><header>Individual
representatives</header>
<subsection id="H12D6D79870D54E858CAAF807646DCC71"><enum>(a)</enum><header>In
general</header><text>Except as provided in subsections (b) and (c), a person
who is authorized by law (based on grounds other than an individual's status as
a minor), or by an instrument recognized under law, to act as an agent,
attorney, proxy, or other legal representative of an individual, may, to the
extent so authorized, exercise and discharge the rights of the individual under
this title.</text>
</subsection><subsection id="H8695F3F61D65498AA4B4A45619FC1BFF"><enum>(b)</enum><header>Health care
power of attorney</header><text>A person who is authorized by law (based on
grounds other than being a minor), or by an instrument recognized under law, to
make decisions about the provision of health care to an individual who is
incapacitated, may exercise and discharge the rights of the individual under
this title to the extent necessary to effectuate the terms or purposes of the
grant of authority.</text>
</subsection><subsection id="H19E2E76D056144E29EE78107A06DD109"><enum>(c)</enum><header>Individuals
suffering from certain medical conditions</header><text>If a physician or other
health care provider determines that an individual, who has not been declared
to be legally incompetent, suffers from a medical condition that prevents the
individual from acting knowingly or effectively on the individual's own behalf,
the right of the individual to access or amend the health information and to
authorize disclosure under this title may be exercised and discharged in the
best interest of the individual by—</text>
<paragraph id="H5C490ECFC45249A3B1014D47093472AA"><enum>(1)</enum><text>a
person described in subsection (b) with respect to the individual;</text>
</paragraph><paragraph id="H5E00ABF30F2A432795004C4CAD23F0A1"><enum>(2)</enum><text>a
person described in subsection (a) with respect to the individual, but only if
a person described in paragraph (1) cannot be contacted after a reasonable
effort or if there is no individual who fits the description in paragraph
(1);</text>
</paragraph><paragraph id="H4CA99FF16D87439E93B7E54CE92060FA"><enum>(3)</enum><text>the next of kin of
the individual, but only if a person described in paragraph (1) or (2) cannot
be contacted after a reasonable effort; or</text>
</paragraph><paragraph id="H28F09AEF637E4EC2A4BD00D7E9B29766"><enum>(4)</enum><text>the health care
provider, but only if a person described in paragraph (1), (2), or (3) cannot
be contacted after a reasonable effort.</text>
</paragraph></subsection><subsection id="H548E080923D24DBA9FE8A1B750E21FD3"><enum>(d)</enum><header>Rights of
minors</header>
<paragraph id="H546CBCAB01A8496198DAE1695BAF8BF"><enum>(1)</enum><header>Individuals who
are 18 or legally capable</header><text>In the case of an individual—</text>
<subparagraph id="H42A3544D49C844EFBE47E50682D96E1"><enum>(A)</enum><text>who is 18 years of
age or older, all rights of the individual under this title shall be exercised
by the individual; or</text>
</subparagraph><subparagraph id="H671892F3E57849FD96E3E636C72440A1"><enum>(B)</enum><text>who, acting alone,
can consent to health care without violating any applicable law, and who has
sought such care, the individual shall exercise all rights of an individual
under this title with respect to personal health information relating to such
health care.</text>
</subparagraph></paragraph><paragraph id="HAE13C335D78D419B8DF76B6076ECD700"><enum>(2)</enum><header>Individuals
under 18</header><text>Except as provided in paragraph (1)(B), in the case of
an individual who is—</text>
<subparagraph id="H080A143A6B1F4FD2A1A535D117B8F6D3"><enum>(A)</enum><text>under 14 years of
age, all of the individual's rights under this title shall be exercised through
the parent or legal guardian; or</text>
</subparagraph><subparagraph id="H3481ED5E46FE4805A670C1811145B7B9"><enum>(B)</enum><text>14 through 17
years of age, the rights of inspection, supplementation, and modification, and
the right to authorize use and disclosure of personal health information of the
individual shall be exercised by—</text>
<clause id="H25AB671D2F1145818B1600684C1062E1"><enum>(i)</enum><text>the
individual where no parent or legal guardian exists;</text>
</clause><clause id="H8E536AFCDD9A471FA32898E7CA85AEEC"><enum>(ii)</enum><text>the
parent or legal guardian of the individual; or</text>
</clause><clause id="HE5AECEE41C7E4081843964A101F744FE"><enum>(iii)</enum><text>the individual
if the parent or legal guardian determined that the individual has the sole
right the control their health information.</text>
</clause></subparagraph></paragraph></subsection><subsection id="H9FB84F2A58D8474AB7E70E0EAB0786C"><enum>(e)</enum><header>Deceased
individuals</header>
<paragraph id="H020FE00D122245B6897CD5238EACF93B"><enum>(1)</enum><header>Application of
Act</header><text>The provisions of this title shall continue to apply to
personal health information concerning a deceased individual.</text>
</paragraph><paragraph id="H7C59E80EFC084AE680C5B229C8A34F25"><enum>(2)</enum><header>Exercise of
rights on behalf of a deceased individual</header><text>A person who is
authorized by law or by an instrument recognized under law, to act as an
executor or administrator of the estate of a deceased individual, or otherwise
to exercise the rights of the deceased individual, may, to the extent so
authorized, exercise and discharge the rights of such deceased individual under
this title. If no such designee has been authorized, the rights of the deceased
individual may be exercised as provided for in subsection (c).</text>
</paragraph><paragraph id="HC51ABD7B7DAD4F5797549DC069C1C65"><enum>(3)</enum><header>Identification of
deceased individual</header><text>A person described in section 136(a) may
disclose personal health information if such disclosure is necessary to assist
in the identification of a deceased individual.</text>
</paragraph></subsection></section></chapter></subtitle><subtitle id="HA7E2D3B2045442E8B1CF45669CD7D178"><enum>D</enum><header>Enforcement</header>
<section id="H5AF1FEE2F7A144FD850040EF1B2CAB00"><enum>151.</enum><header>In
general</header>
<subsection id="H8DA5B3540EA341A58D6F2461FF1320D7"><enum>(a)</enum><header>Civil
penalty</header><text>A health information person who the Secretary, in
consultation with the Attorney General, determines has substantially and
materially failed to comply with this title shall be subject, in addition to
any other penalties that may be prescribed by law—</text>
<paragraph id="H1DF7AECE8F3B4AEF98B8394000CB1426"><enum>(1)</enum><text>in a case in which
the violation relates to subtitle A, B, or C, to a civil penalty of not more
than $500 for each such violation, but not to exceed $5,000 in the aggregate
for multiple violations;</text>
</paragraph><paragraph id="HB9BC5B934CEE40409D605593803D9DD1"><enum>(2)</enum><text display-inline="yes-display-inline">in a case in which the violation relates to
subtitle A, B, or C, to a civil penalty of not more than $10,000 for each such
violation, but not to exceed $50,000 in the aggregate for multiple violations;
or</text>
</paragraph><paragraph id="H1645F8C99BF84B60BAC43FE2205FDB00"><enum>(3)</enum><text>in a case in which
such violations have occurred with such frequency as to constitute a general
business practice, to a civil penalty of not more than $100,000.</text>
</paragraph></subsection><subsection id="H736F8A70C7DD4018A9B981B8460FCCF"><enum>(b)</enum><header>Civil action by
individuals</header>
<paragraph id="HAF4DEDC6F1224873A3CE7319F3BB4C91"><enum>(1)</enum><header>In
general</header><text>Any individual whose rights under subtitle A, B, or C
have been knowingly or negligently violated may bring a civil action to
recover—</text>
<subparagraph id="H00CFED8C3790439CB2499474FD513177"><enum>(A)</enum><text>such preliminary
and equitable relief as the court determines to be appropriate; and</text>
</subparagraph><subparagraph id="H129C4A09D0B741608D74A1F596750060"><enum>(B)</enum><text>the greater of
compensatory damages or liquidated damages of $5,000.</text>
</subparagraph></paragraph><paragraph id="HF15E15FB36C741AC82A821F81D624752"><enum>(2)</enum><header>Additional
remedies</header><text>The equitable relief or damages that may be available
under this section shall be in addition to any other lawful remedy or award
that may be available.</text>
</paragraph></subsection></section><section id="H6742A1A0E4144BFCA7338E060050F462"><enum>152.</enum><header>Enforcement by
State attorneys general</header>
<subsection id="H66D62A48D17F4439A5D759589400C601"><enum>(a)</enum><header>Civil
actions</header><text>In any case in which the attorney general of a State or
any State or local law enforcement agency authorized by the State attorney
general or by State law to prosecute violations of consumer protection laws,
has reason to believe that an interest of the residents of that State has been
or is threatened or adversely affected by the engagement of a person in a
practice that is prohibited under subtitle A, B, or C, the State or local law
enforcement agency on behalf of the residents of the agency's jurisdiction, may
bring a civil action on behalf of the residents of the State or jurisdiction in
a district court of the United States of appropriate jurisdiction to—</text>
<paragraph id="HEC89D753E1D24766A7CE043B5F14DC05"><enum>(1)</enum><text>enjoin that act or
practice;</text>
</paragraph><paragraph id="H614D787BE3D94AD6BE0074DEE3ECFD5"><enum>(2)</enum><text>enforce compliance
with the respective subtitle; or</text>
</paragraph><paragraph id="H7D8FFFC3772C455F8345DB51C03028A1"><enum>(3)</enum><text display-inline="yes-display-inline">obtain civil penalties in an amount
calculated by multiplying the number of violations by an amount not greater
than $11,000.</text>
</paragraph><continuation-text continuation-text-level="subsection">For
purposes of civil penalties under this subsection, each day that a person is in
violation of the requirements of subtitle A, B, or C shall be treated as a
separate violation, up to a maximum civil penalty of $5,000,000.</continuation-text></subsection><subsection id="HFC630FBB9E824CCD92E8FF31533B9079"><enum>(b)</enum><header>Rule of
construction</header><text>For purposes of bringing any civil action under
subsection (a), nothing in this subtitle regarding notification shall be
construed to prevent an attorney general of a State from exercising the powers
conferred on such attorney general by the laws of that State to—</text>
<paragraph id="HABC7AE4777EC4F1EB528D2278F9E2D7F"><enum>(1)</enum><text>conduct
investigations;</text>
</paragraph><paragraph id="H10E60EDA08FB4FD9BC00970408006950"><enum>(2)</enum><text>administer oaths
or affirmations; or</text>
</paragraph><paragraph id="HB6C7BE7C646349BA96FF76B7ABADE4F7"><enum>(3)</enum><text>compel the
attendance of witnesses or the production of documentary and other
evidence.</text>
</paragraph></subsection><subsection id="H51CEE4DFC32B4761B111F738AA166199"><enum>(c)</enum><header>Venue; service
of process</header>
<paragraph id="H7E2100D2F1EB4617A1A9008C32E9DF7"><enum>(1)</enum><header>Venue</header><text>Any
action brought under subsection (a) may be brought in the district court of the
United States that meets applicable requirements relating to venue under
<external-xref legal-doc="usc" parsable-cite="usc/28/1391">section 1391</external-xref> of title 28, United States Code.</text>
</paragraph><paragraph id="HAE21BD062453445CA500CF3E58AB17A7"><enum>(2)</enum><header>Service of
process</header><text>In an action brought under subsection (a), process may be
served in any district in which the defendant—</text>
<subparagraph id="H87C76E58D21E4388BE3107857E8CF832"><enum>(A)</enum><text>is an inhabitant;
or</text>
</subparagraph><subparagraph id="H755AAE0EDCE74C0A8570DBD7BF601BF"><enum>(B)</enum><text>may be
found.</text>
</subparagraph></paragraph></subsection></section></subtitle><subtitle id="HADAD7670D3AF4C4A8F1301F770FB2D3E"><enum>E</enum><header>Miscellaneous</header>
<section id="H13F2A1D406F54682B252715200C52B00"><enum>161.</enum><header>Office of
Health Information Privacy</header>
<subsection id="H8649BB9971D142D48635BE0071CA3EB6"><enum>(a)</enum><header>In
general</header><text>The Secretary shall designate an office within the
Department of Health and Human Services to be known as the Office of Health
Information Privacy (referred to in this section as the <quote>Office</quote>).
The Office shall be headed by a Director, who shall be appointed by the
Secretary.</text>
</subsection><subsection id="H5EE2B9F434154CCB8800CB3F87001827"><enum>(b)</enum><header>Duties</header><text>The
Director of the Office shall—</text>
<paragraph id="H53C437489B4C4363BE9114A93F71D847"><enum>(1)</enum><text>receive and
investigate complaints of alleged violations of this title;</text>
</paragraph><paragraph id="H867685FE02E745AD8619767D077C3283"><enum>(2)</enum><text>provide for the
conduct of audits where appropriate;</text>
</paragraph><paragraph id="H6C58F510F08C493CB72BC4EFBCA5A0A4"><enum>(3)</enum><text>provide guidance
to the Secretary on the implementation of this Act;</text>
</paragraph><paragraph id="H4A3664F978AE419EA1F5BC3F76F3DA8D"><enum>(4)</enum><text>provide guidance
to health care providers and other relevant individuals concerning the manner
in which to interpret and implement the privacy protections under this title
(and the regulations promulgated under this title);</text>
</paragraph><paragraph id="H554D2B30CBB140CF824B2583058F1B36"><enum>(5)</enum><text>prepare and submit
the report described in subsection (c);</text>
</paragraph><paragraph id="HAE6FFDA2692F455AA458009F6868DD2B"><enum>(6)</enum><text>consult with, and
provide recommendation to, the Secretary concerning improvements in the privacy
and security of personal health information and concerning medical privacy
research needs; and</text>
</paragraph><paragraph id="HF4909EFDDDCD4C6E9607AA2765863111"><enum>(7)</enum><text>carry out any
other activities determined appropriate by the Secretary.</text>
</paragraph></subsection><subsection id="H47399D4171FC4F70A38619E28215ED77"><enum>(c)</enum><header>Standards for
certification</header>
<paragraph id="HD2987ADF6E48432AB100E9E02119BF24"><enum>(1)</enum><header>Establishment</header><text display-inline="yes-display-inline">Not later than 12 months after the date of
enactment of this Act, the Secretary, in consultation with the Director of the
Office and the Director of the Office of Civil Rights, shall establish and
implement standards for health information technology products, including
qualified health information technology systems (as defined in section 213),
used to access, disclose, maintain, store, distribute, transmit, amend, or
dispose of personal health information in a manner that protects the
individual’s right to privacy, confidentiality, and security relating to that
information.</text>
</paragraph><paragraph id="H68F90A51389C41F782ED8B4341BAE9C"><enum>(2)</enum><header>Stakeholder
participation</header><text display-inline="yes-display-inline">In establishing
the standards under paragraph (1), the Secretary shall ensure the participation
of various stakeholders, including patients and consumer advocates, privacy
advocates, experts in information technology and information systems, and
experts in health care. The Secretary shall ensure that these advocates and
experts are equally represented, such that the stakeholder process does not
result in the experts in information technology, information systems, and
health care being disproportionately represented compared to advocates for the
interests of consumers and privacy proponents.</text>
</paragraph></subsection><subsection id="H35BA386BDE94444FAA25B8B675768744"><enum>(d)</enum><header>Report on
compliance</header><text>Not later than January 1 of the first calendar year
beginning more than 1 year after the establishment of the Office under
subsection (a), and every January 1 thereafter, the Secretary, in consultation
with the Director of the Office, shall prepare and submit to Congress a report
concerning the number of complaints of alleged violations of subtitle A that
are received during the year for which the report is being prepared. Such
report shall describe the complaints and any remedial action taken concerning
such complaints and shall be made available to the public on the Internet
website of the Department of Health and Human Services.</text>
</subsection></section><section commented="no" id="H26E1A08271394EB89193197379AC2B58"><enum>162.</enum><header>Protection for
whistleblowers</header>
<subsection commented="no" id="H249784DEA00C44C9827EB4D2BF087754"><enum>(a)</enum><header>Prohibition
against discrimination</header><text display-inline="yes-display-inline">A
health information person may not—</text>
<paragraph id="H442EE172F26F4D6FB19C9135EECD0013"><enum>(1)</enum><text>discharge, demote,
suspend, threaten, harass, retaliate against, or in any other manner
discriminate or cause any employer to discriminate against an employee in the
terms and conditions of employment because of—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="HAAE1FA9CEC8F46ED842E5633AB532C58"><enum>(A)</enum><text>the refusal of the
employee to engage in a violation of this title; or</text>
</subparagraph><subparagraph commented="no" id="HC19905ABBA234B27A58491EF8EFABC98"><enum>(B)</enum><text display-inline="yes-display-inline">any lawful act the employee has committed
or is about to commit, or which the health information person perceives the
employee to have committed, to provide information or cause information to be
provided, including in the course of the employee’s routine job duties, to the
individual’s employer or to a State or Federal official relating to an actual
or suspected violation of this title by any person, including an employer or an
employee of an employer; or</text>
</subparagraph></paragraph><paragraph id="HE965E9B65030466683CCFF97CD2F7A2"><enum>(2)</enum><text>adversely affect
another person, directly or indirectly, because such person has exercised a
right under this title, disclosed information relating to a possible violation
of subtitle A, B, or C or this section, or associated with, or assisted, an
individual in the exercise of a right under this title.</text>
</paragraph></subsection><subsection commented="no" id="H81EE88A32CFF46CA85346C335B2C0067"><enum>(b)</enum><header>Enforcement
actions</header>
<paragraph commented="no" id="HEC2BA0E142E94AA389EC77B3E44EC83"><enum>(1)</enum><header>In
general</header>
<subparagraph commented="no" id="HE8BCE3BB69DD4D89B512C00921DF5A9"><enum>(A)</enum><header>Complaint with
Secretary of Labor</header><text display-inline="yes-display-inline">Any
employee or former employee who alleges a violation of subsection (a) may seek
relief under subsection (c), by filing a complaint with the Secretary of
Labor.</text>
</subparagraph><subparagraph commented="no" id="H686F2EE7133F46D8B2B4E4D7CA5B6F00"><enum>(B)</enum><header>Appellate review
in case of final order</header><text display-inline="yes-display-inline">Unless
an employee brings an action in district court under subparagraph (C), any
person adversely affected or aggrieved by a final order of the Secretary of
Labor with respect to a complaint filed under subparagraph (A) may obtain
review of the order in the United States court of appeals for the circuit in
which the violation, with respect to which the order was issued, allegedly
occurred or the circuit in which the complainant resided on the date of such
violation. The petition for review must be filed not later than 60 days after
the date of the issuance of the final order. The review shall conform to
<external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/5/7">chapter 7</external-xref> of title 5, United States Code. The commencement of proceedings under
this subparagraph shall not, unless ordered by the court, operate as a stay of
the order.</text>
</subparagraph><subparagraph commented="no" id="H03F9CFD77126434DBE3F6B17BA364EFF"><enum>(C)</enum><header>De novo
review</header><text display-inline="yes-display-inline">If the Secretary of
Labor has not issued a final decision within 180 days after the filing of the
complaint, or within 90 days after receiving any written determination, the
complainant may bring an action at law or equity for de novo review in the
appropriate district court of the United States with jurisdiction, which shall
have jurisdiction over such an action without regard to the amount in
controversy, and which action shall, at the request of either party to such
action, be tried by the court with a jury.</text>
</subparagraph></paragraph><paragraph commented="no" id="H5087C55A559841F48BA6B427E22EA12"><enum>(2)</enum><header>Procedures</header>
<subparagraph commented="no" id="HE859BA3EE8304D6A92CF7F4CF8E3E183"><enum>(A)</enum><header>In
general</header><text>Except as provided in this paragraph, the complaint
procedures contained in <external-xref legal-doc="usc" parsable-cite="usc/49/42121">section 42121(b)</external-xref> of title 49, United States Code, shall
apply with respect to a complaint filed under paragraph (1)(A).</text>
</subparagraph><subparagraph commented="no" id="H4945B8E8B23047D2884EE010AA114EC3"><enum>(B)</enum><header>Exception</header><text>With
respect to a complaint filed under paragraph (1)(A), the notification provided
for under <external-xref legal-doc="usc" parsable-cite="usc/49/42121">section 42121(b)(1)</external-xref> of title 49, United States Code, (as required
under subparagraph (A)) shall be made to the person named in the complaint and
to the employer.</text>
</subparagraph><subparagraph commented="no" id="HF98DB891DFF74B2B93ACE2F6117583E"><enum>(C)</enum><header>Burden of
proof</header><text>The legal burdens of proof contained in section 42121(b) of
title 49, United States Code, shall apply to any action brought under this
subsection.</text>
</subparagraph><subparagraph commented="no" id="H632C40792FC54066B3874EE044B0A6CD"><enum>(D)</enum><header>Statute of
limitations</header><text>A complaint shall be filed under paragraph (1)(A) not
later than 2 years after the date on which the alleged violation occurs.</text>
</subparagraph><subparagraph commented="no" id="H6BBBCA988AC44F1385A5E6546518C8D7"><enum>(E)</enum><header>Civil actions to
enforce</header><text display-inline="yes-display-inline">If a person fails to
comply with an order issued by the Secretary of Labor pursuant to the
procedures in <external-xref legal-doc="usc" parsable-cite="usc/49/42121">section 42121(b)</external-xref> of title 49, United States Code, the Secretary
shall have the authority described in <external-xref legal-doc="usc" parsable-cite="usc/49/42121">section 42121(b)(5)</external-xref> of title 49, United
States Code, to bring a civil action to enforce the order in the district court
of the United States for the judicial district in which the violation
occurred.</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="H785306A60C2040F7A5D9E5DD8B8E53E"><enum>(c)</enum><header>Remedies</header>
<paragraph commented="no" id="HBFFBF1A0C9064DB19DC0D617C592F2AB"><enum>(1)</enum><header>In
general</header><text>If the Secretary of Labor or the district court
determines that a violation of subsection (a) has occurred, the Secretary or
court shall order any relief necessary to make the employee whole.</text>
</paragraph><paragraph commented="no" id="HA6AEC087AE5145BCAB1E60297458C2DC"><enum>(2)</enum><header>Compensatory
damages</header><text>Relief in any action under such subsection shall
include—</text>
<subparagraph commented="no" id="H204805557FEC467587F5382529743983"><enum>(A)</enum><text>reinstatement of
the employee to the employee's former position with the same seniority status
that the employee would have had but for the discrimination;</text>
</subparagraph><subparagraph commented="no" id="H36B6FE807E4C40568D0005FB58D75024"><enum>(B)</enum><text>payment of the
amount of back pay, with interest, to which the employee is entitled;
and</text>
</subparagraph><subparagraph commented="no" id="HA50BAE8ACD1D4CE4BE35C13055E12F16"><enum>(C)</enum><text>the payment of
compensation for any special damages sustained by the employee as a result of
the discrimination, including litigation costs, expert witness fees, and
reasonable attorney fees.</text>
</subparagraph></paragraph><paragraph commented="no" id="HD67E560D5E24459A9726F65380E676B5"><enum>(3)</enum><header>Punitive
damages</header><text>Relief in any action under such subsection may include
punitive damages in an amount not to exceed $250,000.</text>
</paragraph></subsection><subsection commented="no" id="HA565FC31D7814BE187A17F6B7D5631EB"><enum>(d)</enum><header>Rights retained
by the employee</header><text>Nothing in this section shall be construed to
diminish or eliminate the rights, privileges, or remedies available to an
employee under any Federal or State law, or under any collective bargaining
agreement.</text>
</subsection><subsection commented="no" id="H069859799EE34D9FADBEE62482106360"><enum>(e)</enum><header>Limitation</header><text>The
protections of this section shall not apply to any employee who—</text>
<paragraph commented="no" id="H5D50A2DD81F4430DAEF45EEA8BD7DECB"><enum>(1)</enum><text>deliberately
causes or participates in the alleged violation; or</text>
</paragraph><paragraph commented="no" id="H7106192C86FD4880BDA05815EAFB1696"><enum>(2)</enum><text>knowingly or
recklessly provides materially false information to an individual or entity
described in subsection (a).</text>
</paragraph></subsection><subsection commented="no" id="H42345D8D0996407E9EFCB5CBCDE8FB00"><enum>(f)</enum><header>Definitions</header><text>In
this section:</text>
<paragraph commented="no" id="HCE2237F0D9E047F0B58039533C9D39A3"><enum>(1)</enum><header>Employ</header><text>The
term <quote>employ</quote> has the meaning given such term under section 3(g)
of the Fair Labor Standards Act of 1938 (<external-xref legal-doc="usc" parsable-cite="usc/29/203">29 U.S.C. 203(g)</external-xref>) for the purposes of
implementing the requirements of that Act (<external-xref legal-doc="usc" parsable-cite="usc/29/201">29 U.S.C. 201</external-xref>, et seq.).</text>
</paragraph><paragraph commented="no" id="H011DA07EC8A94AB0007C4272A18E8F1B"><enum>(2)</enum><header>Employee</header><text>The
term <term>employee</term> means an individual who is employed by an
employer.</text>
</paragraph><paragraph commented="no" id="H75E0733B22984A7EA74BDAD4EC280331"><enum>(3)</enum><header>Employer</header><text>The
term <term>employer</term> means any person who employs employees, including
any person acting directly or indirectly in the interest of any employer in
relation to an employee and includes a public agency.</text>
</paragraph></subsection></section><section id="HB45D23B2135A480B002BBD0072015748"><enum>163.</enum><header>Demonstration
grant for individuals with limited English language proficiency or limited
health literacy</header>
<subsection id="HDA28293C38034352BC2F42B5F1595DFF"><enum>(a)</enum><header>In
general</header><text>The Secretary shall award contracts or competitive grants
to eligible entities to support demonstration projects that are designed to
improve the communication of information pertaining to health privacy rights
with individuals with limited English language proficiency and limited health
literacy.</text>
</subsection><subsection id="HE9F3B64E1CE942A4AD9EA92C5B8C42F3"><enum>(b)</enum><header>Purpose</header><text>It
is the purpose of this section, to promote the cultural competency of persons
that access, maintain, retain, modify, record, store, destroy, or otherwise use
or disclose personal health information, and to enable such persons to better
communicate privacy procedures to non-English speakers, those with limited
English proficiency, and those with limited health literacy.</text>
</subsection><subsection id="H9AD0A4B366984320A970D383A4B60042"><enum>(c)</enum><header>Eligible
entities</header><text>In this section, the term <term>eligible entity</term>
means an organization or community-based consortium that includes—</text>
<paragraph id="H03D9805A20F9439700A55C7039C79E00"><enum>(1)</enum><text>individuals who
are representatives of organizations serving or advocating for ethnic and
racial minorities, low income immigrant populations, and others with limited
English language proficiency and limited health literacy;</text>
</paragraph><paragraph id="HF0635B63C5754F54A64E3F476E1C1672"><enum>(2)</enum><text>health care
providers that provide care for ethnic and racial minorities, low income
immigrant populations, and others with limited English language proficiency and
limited health literacy;</text>
</paragraph><paragraph id="HB3BCD502470B471286004B2E009EBE93"><enum>(3)</enum><text>community leaders
and leaders of community-based organizations; and</text>
</paragraph><paragraph id="H394DE988722E4C63AB4D415F790877F2"><enum>(4)</enum><text>experts and
researchers in the areas of social and behavioral sciences, who have knowledge,
training, or practical experience in health policy, advocacy, cultural and
linguistic competency, or other relevant areas as determined by the
Secretary.</text>
</paragraph></subsection><subsection id="H9A7C190EF2AA4A168F6C09002B003339"><enum>(d)</enum><header>Application</header><text>An
eligible entity seeking a contract or grant under this section shall submit an
application to the Secretary at such time, in such manner, and containing such
information as the Secretary may require.</text>
</subsection><subsection id="HB54B1F2ED3804900A02CFE3771A09D27"><enum>(e)</enum><header>Use of
funds</header><text>An eligible entity shall use amounts received under this
section to carry out programs and studies designed to help identify best
practices in the communication of privacy rights and procedures to ensure
comprehension by individuals with limited English proficiency and limited
health literacy.</text>
</subsection></section><section id="H295C480C12764CA8BC213018FA4FF3BC"><enum>164.</enum><header>Relationship to
other laws</header>
<subsection id="HBA45596BA6D748BDB08B5DD11B678EAF"><enum>(a)</enum><header>Federal and
State laws</header><text>Nothing in this Act shall be construed as preempting,
superseding, or repealing, explicitly or implicitly, other Federal or State
laws or regulations relating to personal health information or relating to an
individual's access to personal health information or health care services, if
such laws or regulations provide protections for the rights of individuals to
the privacy of, and access to, their health information that is greater than
those provided for in this Act.</text>
</subsection><subsection id="H6AEE0AE2444040B0A24F5D351EDF10AA"><enum>(b)</enum><header>Privileges</header><text display-inline="yes-display-inline">Nothing in this Act shall be construed to
preempt or modify any provisions of State statutory or common law to the extent
that such law concerns a privilege of a witness or person in a court of that
State. This Act shall not be construed to supersede or modify any provision of
Federal statutory or common law to the extent such law concerns a privilege of
a witness or entity prior to a court proceeding or in a court of the United
States. Informed consent shall not be construed as a waiver of any such
privilege.</text>
</subsection><subsection id="H4D3AFE4DA98242B1836B26B900F1DFB"><enum>(c)</enum><header>Certain duties
under law</header><text>Nothing in this Act shall be construed to preempt,
supersede, or modify the operation of any State law that—</text>
<paragraph id="H69673F60002E4E6A9539C7E7D9CEB57"><enum>(1)</enum><text>provides for the
reporting of vital statistics such as birth or death information;</text>
</paragraph><paragraph id="H1609448FEB2F4F3186B8D4D64F6C83F0"><enum>(2)</enum><text>requires the
reporting of abuse or neglect information about any individual;</text>
</paragraph><paragraph id="H41C99C6CE04D416484A875E61814E37C"><enum>(3)</enum><text>regulates the
disclosure or reporting of information concerning an individual's mental
health; or</text>
</paragraph><paragraph id="HBA0465DCABBD46939EF605007CD0746B"><enum>(4)</enum><text>governs a minor's
rights to access personal health information or health care services.</text>
</paragraph></subsection><subsection id="HA62B10922C324898BCD66227717C022F"><enum>(d)</enum><header>Health Insurance
Portability and Accountability Act</header><text>The standards governing the
privacy and security of individually identifiable health information
promulgated by the Secretary of Health and Human Services under sections 262(a)
and 264 of the Health Insurance Portability and Accountability Act of 1996
shall remain in effect to the extent that they are consistent with this title.
The Secretary shall by rule amend such Federal regulations as required to make
such regulations consistent with this title.</text>
</subsection></section><section id="HEECD3395621D4C278F92CAA215CDCFC6"><enum>165.</enum><header>Effective
date</header>
<subsection id="HCAFB8C769EB548E99933D652940371D0"><enum>(a)</enum><header>Effective
date</header><text>Unless specifically provided for otherwise, this title shall
take effect on the date that is 12 months after the date of the promulgation of
the regulations required under subsection (b), or 30 months after the date of
enactment of this Act, whichever is earlier.</text>
</subsection><subsection id="H334117B8A700480C9DE7FD8E9900AF04"><enum>(b)</enum><header>Regulations</header><text>Not
later than 12 months after the date of enactment of this Act, or as
specifically provided for otherwise, the Secretary shall promulgate regulations
implementing this title.</text>
</subsection></section></subtitle><subtitle id="H037FC43A14A841D283570400C97700AF"><enum>F</enum><header>General
Definitions</header>
<section id="HB19A6E39D0BD4FD8B4839E69A59CABE9"><enum>171.</enum><header>General
definitions</header><text display-inline="no-display-inline">In this
Act:</text>
<paragraph id="HD88CE787519947C0817C05233752913D"><enum>(1)</enum><header>Agent</header><text>The
term <term>agent</term> means a person that represents or acts for another
person (a principal) under a contract or relationship of agency, or that
functions to bring about, modify, affect, accept performance of, or terminate,
contractual obligations between the principal and a third person. With respect
to an employer, such term includes the employees of the employer.</text>
</paragraph><paragraph id="HACC1026203434CE8000891DAE500009F"><enum>(2)</enum><header>Authorization</header><text>The
term <term>authorization</term> means the authority granted by an individual
that is the subject of personal health information, in accordance with this
title, for the disclosure or use of the individual’s personal health
information.</text>
</paragraph><paragraph id="HC3A1E459C0F34AB9ABA8F910DEEA1703"><enum>(3)</enum><header>Breach</header><text>The
term <term>breach</term> means the unauthorized acquisition, disclosure, or
loss of personal health information which compromises the security, privacy, or
integrity of personal health information maintained by or on behalf of a
person.</text>
</paragraph><paragraph id="H2F9062F5DE1E4775A8009C24D9D4BC9D"><enum>(4)</enum><header>Confidentiality</header><text>The
term <term>confidentiality</term> means the obligations of those who receive
information to respect the privacy interests of those to whom the data
relate.</text>
</paragraph><paragraph id="H08EC8BD40D164CA69514A5119FC03539"><enum>(5)</enum><header>De-identified
health information</header><text>The term <term>de-identified health
information</term> means any personal health information, with respect to
which—</text>
<subparagraph id="H8C7793E721C14691974599008B3360FF"><enum>(A)</enum><text>all personal
identifiers, or other information that may be used by itself or in combination
with other information which may be available to re-identify (as defined in
section 171(25)) the subject of the information (such as geographic, credit,
and financial information and all of the identifiers enumerated at section
164.514(b)(2) of title 45 of the Code of Federal Regulations (as in effect on
January 1, 2008)) have been removed;</text>
</subparagraph><subparagraph id="H833895ED0DE04144AA3C1B271F6CD88D"><enum>(B)</enum><text>a good faith
effort has been made to evaluate, minimize, and mitigate the risks of
re-identification of the subject of such information, using commonly accepted
scientific and statistical standards and methods for minimizing risk of
disclosure; and</text>
</subparagraph><subparagraph id="H711978F28B6E486481D0FC8D7F23ADC"><enum>(C)</enum><text>there is no
reasonable basis to believe that the information can be used to identify an
individual.</text>
</subparagraph></paragraph><paragraph id="H908C1F0D867941D5BF29F9E0004D3A8"><enum>(6)</enum><header>Disclose</header><text>The
term <term>disclose</term> means to release, publish, share, transfer,
transmit, disseminate, show, permit access to, communicate (orally or
otherwise), re-identify, or otherwise divulge personal health information to
any person other than the individual who is the subject of such information.
Such term includes the initial disclosure and any subsequent re-disclosure of
personal health information.</text>
</paragraph><paragraph id="H5923E18907FA4280A89B061BAD92C0D"><enum>(7)</enum><header>Decryption
key</header><text>The term <term>decryption key</term> means the variable
information used in or produced by a mathematical formula, code, or algorithm,
or any component thereof, used for encryption (as defined in paragraph (10)) or
decryption of wire, electronic, or other communications or stored
information.</text>
</paragraph><paragraph id="H2EB0D8E880B840F79C26E93D3871043E"><enum>(8)</enum><header>Director of the
Office of Health Information Privacy</header><text>The term <quote>Director of
the Office of Health Information Privacy</quote> means such Director as
appointed under section 161.</text>
</paragraph><paragraph id="H4DD98CA27347489EA57B11A871B94990"><enum>(9)</enum><header>Employer</header><text>Except
as otherwise provided in section 164, the term <term>employer</term> means a
person that is engaged in business affecting commerce and that has
employees.</text>
</paragraph><paragraph id="HBC0CB53276E14B5C95A40832EB66741"><enum>(10)</enum><header>Encryption</header><text>The
term <term>encryption</term>—</text>
<subparagraph id="H7C63E1BC113E471B80551404A7EC7564"><enum>(A)</enum><text>means the
protection of data in electronic form, in storage or in transit, using an
encryption technology that has been adopted by an established standards setting
body which renders such data indecipherable in the absence of associated
cryptographic keys necessary to enable decryption of such data; and</text>
</subparagraph><subparagraph id="H0C0EAA5B80284C059000F26437FAFBBE"><enum>(B)</enum><text>includes
appropriate management and safeguards of such cryptographic keys so as to
protect the integrity of the encryption.</text>
</subparagraph></paragraph><paragraph id="HE1CBF666748945A0BFF65148A6989F9C"><enum>(11)</enum><header>Health
care</header><text>The term <term>health care</term> means—</text>
<subparagraph id="H7E5996B66FF845A88C0188F0EFD2232D"><enum>(A)</enum><text>preventive,
diagnostic, therapeutic, rehabilitative, maintenance, or palliative care,
including appropriate assistance with disease or symptom management and
maintenance, counseling, service, or procedure—</text>
<clause id="HDDF83B0A33FB43EA8D691DC274F3679"><enum>(i)</enum><text>with
respect to the physical or mental condition of an individual; or</text>
</clause><clause id="HA5BC53FBAA484C7AA5590011E4358DC6"><enum>(ii)</enum><text>affecting the
structure or function of the human body or any part of the human body,
including the banking of blood, sperm, organs, or any other tissue; or</text>
</clause></subparagraph><subparagraph id="H7E0B3A132B724C91819B7EDDD34664C"><enum>(B)</enum><text>any sale or
dispensing of a drug, device, equipment, or other health care-related item to
an individual, or for the use of an individual, pursuant to a
prescription.</text>
</subparagraph></paragraph><paragraph id="HDA3FF3F1775D48019BEAE6FE6FAC8300"><enum>(12)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> means a
person that, with respect to a specific item of personal health information,
receives, accesses, maintains, retains, modifies, records, stores, destroys, or
otherwise uses or discloses the information while acting in whole or in part in
the capacity of—</text>
<subparagraph id="H4CD4D98D759D4BFDABB8976E02B7722E"><enum>(A)</enum><text>an entity that is,
or holds itself out to be, licensed, certified, registered, or otherwise
authorized by Federal or State law to provide an item or service that
constitutes health care in the ordinary course of business, or practice of a
profession;</text>
</subparagraph><subparagraph id="H12298344EE0747C2BC2FC8C74DE7CC62"><enum>(B)</enum><text>a contractor or
other health care provider or facility authorized to provide items or services
related to diagnosis or treatment of a health concern, including a hospital,
nursing facility, allied health professional, and a facility used or maintained
by allied health professionals;</text>
</subparagraph><subparagraph id="H88858869E699482592B8E83F3EFE38A7"><enum>(C)</enum><text>a Federal or State
program that directly provides items or services that constitute health care to
beneficiaries;</text>
</subparagraph><subparagraph id="HC1FF20F0EEB04ACF9855BAA552EE6343"><enum>(D)</enum><text>an officer or
employee or agent of a person described in subparagraph (A) or (C) who is
engaged in the provision of health care or who uses personal health
information; or</text>
</subparagraph><subparagraph id="H2F44BCCFA7C744B08D1CF300AFD07EB5"><enum>(E)</enum><text>medical personnel
in an emergency situation, including while communicating personal health
information by radio transmission or other means.</text>
</subparagraph></paragraph><paragraph id="HE79DBE0F94444BA1A111372454163F76"><enum>(13)</enum><header>Health
information person</header><text display-inline="yes-display-inline">The term
<quote>health information person</quote> means, in relation to personal health
information, a person, including a health care provider, health researcher,
health plan, health insurer, health care clearinghouse, health oversight
agency, or public health authority, or such person’s agent, officer, employee,
or affiliate, that accesses, maintains, retains, modifies, records, stores, or
otherwise holds, uses, or discloses such information.</text>
</paragraph><paragraph display-inline="no-display-inline" id="H73F3D75F5C5642A795CB4BA8FE31FFB"><enum>(14)</enum><header>Health
plan</header>
<subparagraph id="HCF235CF4A29B48A8AD86048FCFC607EE"><enum>(A)</enum><header>In
general</header><text>The term <quote>health plan</quote> means—</text>
<clause id="H029AA277DDF44ABA93BDC001F0B64CF4"><enum>(i)</enum><text display-inline="yes-display-inline">a group health plan (as defined in section
2791(a)(1) of the Public Health Service Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91">42 U.S.C. 300gg–91(a)(1)</external-xref>));</text>
</clause><clause id="H8D2AB5315AF24AA797E8DEC844219E7"><enum>(ii)</enum><text>health insurance
coverage (as such term is defined in section 2791(b)(1) of the Public Health
Service Act (<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91">42 U.S.C. 300gg–91(b)(1)</external-xref>); or</text>
</clause><clause id="HE924B00D94A746E38600E1300B5CA76"><enum>(iii)</enum><text>a
safety net health plan (as defined in subparagraph (B)).</text>
</clause></subparagraph><subparagraph id="H1E3838490B004927BEADACF8C0520789"><enum>(B)</enum><header>Safety net
health plan</header><text>For purposes of subparagraph (A)(iii), the term
<quote>safety net health plan</quote> means a managed care organization, as
defined in section 1932(a)(1)(B)(i) of the Social Security Act—</text>
<clause id="HE8D1CE297ACA412E9F03ADB2721337C"><enum>(i)</enum><text>that
is exempt from or not subject to Federal income tax, or that is owned by an
entity or entities exempt from or not subject to Federal income tax; and</text>
</clause><clause id="H88528A75D7B445F692FAFA1EEAC52C04"><enum>(ii)</enum><text>for
which not less than 75 percent of the enrolled population receives benefits
under a Federal health care program (as defined in section 1128B(f)(1) of the
Social Security Act) or a health care plan or program which is funded, in whole
or in part, by a State (other than a program for government employees).</text>
</clause></subparagraph></paragraph><paragraph id="H046E2C6560334F298C57D5E4742172D8"><enum>(15)</enum><header>Health or life
insurer</header><text>The term <term>health or life insurer</term> means a
health insurance issuer (as defined in section 9805(b)(2) of the Internal
Revenue Code of 1986) or a life insurance company (as defined in section 816 of
such Code) and includes the employees and agents of such a person.</text>
</paragraph><paragraph id="H6F52DF5B26D04B0AA0D257DDDC590833"><enum>(16)</enum><header>Health
oversight agency</header><text>The term <term>health oversight
agency</term>—</text>
<subparagraph id="H2615E9216DFD45CAA18D1B41C2EA9BC"><enum>(A)</enum><text>means a person
that—</text>
<clause id="HE372F35A92114C1E82D095599DCA8586"><enum>(i)</enum><text>performs or
oversees the performance of an assessment, investigation, or prosecution
relating to compliance with legal or fiscal standards relating to health care
fraud or fraudulent claims regarding health care, health services or equipment,
related activities and items, or the effectiveness of health privacy and
security measures; and</text>
</clause><clause id="H4E314CF4D4AB4E628CE81601B569B885"><enum>(ii)</enum><text>is
a public executive branch agency, acting on behalf of a public executive branch
agency, acting pursuant to a requirement of a public executive branch agency,
or carrying out activities under a Federal or State law governing an
assessment, evaluation, determination, investigation, or prosecution described
in clause (i); and</text>
</clause></subparagraph><subparagraph id="H2800C665DA5347E6A0F811602482B959"><enum>(B)</enum><text>includes the
employees and agents of such a person.</text>
</subparagraph></paragraph><paragraph id="H9258C605253F43FE9FC260A025679137"><enum>(17)</enum><header>Health record
set</header><text>The term <term>health record set</term> means any item,
collection, or grouping of information that includes personal health
information, such as a medical record, electronic health record, electronic
medical record, personal health record, or account of disclosure, use or
access, that is created, accessed, received, maintained, retained, modified,
recorded, stored, destroyed, or otherwise used or disclosed by a health care
provider, employer, insurer, health plan, health researcher, data partner, or
other person that relates to the health or illness of the body, mind, or genome
of an individual.</text>
</paragraph><paragraph id="HCCAD9C460C4A4461915E8F70D2A26F66"><enum>(18)</enum><header>Health
researcher</header><text>The term <term>health researcher</term> means a person
that is engaged in activities conducted for the purpose of advancing public
knowledge and, with respect to a specific item of personal health information,
receives the information—</text>
<subparagraph id="HB60EF2ECA8BF456886EDA2D500B2884F"><enum>(A)</enum><text>pursuant to
section 142 (relating to health research); or</text>
</subparagraph><subparagraph id="H61750D123EE74D66A4D27053D469CB4"><enum>(B)</enum><text>while acting in
whole or in part in the capacity of an officer, employee, or agent of a person
that receives the information pursuant to such section.</text>
</subparagraph></paragraph><paragraph commented="no" id="H4A3FD853E86F424C8BE7F2EAA490B867"><enum>(19)</enum><header>Informed
consent</header>
<subparagraph id="H68A8EE47165D4EE492F5BB8830BEDBD2"><enum>(A)</enum><header>In
general</header><text>Subject to subparagraph (B), the term <term>informed
consent</term> means the written authorization for use or disclosure of
personal health information by the individual who is the subject of such
information, conditioned upon—</text>
<clause id="HEE6309EF342A4FD1BA0066CF624E3BE5"><enum>(i)</enum><text>that
individual’s having been informed of the nature and probability of harm to the
individual resulting from such authorization; and</text>
</clause><clause id="H2A35186F2AEF4C33862794FA92942B22"><enum>(ii)</enum><text>the
authorization meeting the requirements of section 122(b).</text>
</clause></subparagraph><subparagraph id="H7E4EA317CDBB4F5CA39F558E3BE31568"><enum>(B)</enum><header>Through
inference</header><text>Informed consent may be inferred, in the absence of a
contrary indication by the individual—</text>
<clause commented="no" id="H4D351FD36D9B4004B0008BDF8DD967BF"><enum>(i)</enum><text>to the extent
necessary to provide treatment and obtain payment for health care in emergency
situations;</text>
</clause><clause commented="no" id="H6A4DBC1D77F341468ED1AAA2E7EE0045"><enum>(ii)</enum><text>to the extent
necessary to provide treatment and payment where a health care provider is
required by law to treat the individual;</text>
</clause><clause commented="no" id="HC4A0F6DE02F34699853BB7E3B52E6D6B"><enum>(iii)</enum><text>if the health
care provider is unable to obtain informed consent due to substantial barriers
to communicating with the individual and the provider reasonably infers from
the circumstances, based upon the exercise of professional judgment, that the
individual does not object to the disclosure or the disclosure is in the best
interest of the individual; and</text>
</clause><clause commented="no" id="H0E2A21BB27264CC48EA1E8168FE8DCAE"><enum>(iv)</enum><text>to the extent the
information is necessary to carry out or otherwise implement a medical or
mental health practitioner’s order or prescription for health services, medical
devices or supplies, or pharmaceuticals.</text>
</clause></subparagraph><subparagraph id="H65082DF216CF4596A427706ED9C8ADF9"><enum>(C)</enum><header>Multiple uses
and disclosures</header><text>Informed consent may authorize multiple uses or
disclosures.</text>
</subparagraph></paragraph><paragraph id="HC4BF06CD7BC243BDA53084AB87C281F9"><enum>(20)</enum><header>Office of
health information privacy</header><text>The term <term>Office of Health
Information Privacy</term> means the Office of Health Information Privacy
designated under section 161.</text>
</paragraph><paragraph id="HD84216BDEE6F489B9D06E27FBAE79BAD"><enum>(21)</enum><header>Person</header><text>The
term <term>person</term> means an entity that is a government, governmental
subdivision of an executive branch agency or authority, corporation, company,
association, firm, partnership, society, estate, trust, joint venture,
individual, individual representative, tribal government, or any other legal
entity. Such term also includes the employees, contractors, agents, and
affiliates of all legal entities described in the preceding sentence, whether
or not they are acting in the capacity of their employment, contract, agency,
or affiliation.</text>
</paragraph><paragraph id="HD0800A7716DC4C78910977002DEDB1A0"><enum>(22)</enum><header>Privacy</header><text>The
term <term>privacy</term> means an individual's right to control the
acquisition, uses, or disclosures of his or her identifiable health
data.</text>
</paragraph><paragraph id="H8508436163664CFCA7C8AEC400C4639"><enum>(23)</enum><header>Personal health
information</header>
<subparagraph id="H0233AACA7B0B4ECE9E9B8128B5014793"><enum>(A)</enum><header>In
general</header><text>The term <term>personal health information</term> means
any information, including genetic information, biometric information,
demographic information, and tissue samples collected from an individual,
whether oral or recorded in any form or medium, that—</text>
<clause id="HB540C698D4F243F684002091B83636D0"><enum>(i)</enum><text>is
created or received by a health care provider, health researcher, health plan,
health or life insurer, medical or health savings plan administrator, health
care clearinghouse, health oversight agency, public health authority, employer,
data partner, or other person or such person’s agent, officer, or employee;
and</text>
</clause><clause id="HB8759446586840EC80495244149F2CC0"><enum>(ii)</enum><subclause commented="no" display-inline="yes-display-inline" id="H4F4771019EA346C7A59B5724211D8964"><enum>(I)</enum><text>relates to the past,
present, or future physical or mental health or condition of an individual
(including individual cells and their components), the provision of health care
to an individual, or the past, present, or future payment for the provision of
health care to an individual; and</text>
</subclause><subclause id="HD4959949E14B4FEE9C6FDD01EECD1E1B" indent="up1"><enum>(II)</enum><item commented="no" display-inline="yes-display-inline" id="HB221B5D4A94D43C7B4F0B44423D5E28D"><enum>(aa)</enum><text>identifies an
individual; or</text>
</item><item id="H58B1E684F3B3466D8CA0EEA7B00711F9" indent="up1"><enum>(bb)</enum><text>with respect to which there is a
reasonable basis to believe that the information can be used to identify an
individual.</text>
</item></subclause></clause></subparagraph><subparagraph id="HD0F25AAB3DE44975886EAEC88146A2B6"><enum>(B)</enum><header>Inclusion of
decryption key</header><text>The term <quote>personal health
information</quote> includes any decryption key used for the encryption or
decryption of information described in subparagraph (A).</text>
</subparagraph></paragraph><paragraph id="H23DB4BAAB5114C4CAA81CDF223BDFA2D"><enum>(24)</enum><header>Public health
authority</header><text>The term <term>public health authority</term> means an
authority or instrumentality of the United States, a tribal government, a
State, or a political subdivision of a State that is—</text>
<subparagraph id="HAE2B444AB1724EE2970381DAD31CC880"><enum>(A)</enum><text>primarily
responsible for public health matters; and</text>
</subparagraph><subparagraph id="H196E9628E2C346B4B975E070A3EE884C"><enum>(B)</enum><text>primarily engaged
in activities such as injury reporting, public health surveillance, and public
health investigation or intervention.</text>
</subparagraph></paragraph><paragraph id="H4AA2D962CE1B418F8F5197014FD0AD00"><enum>(25)</enum><header>Re-identify</header><text>The
term <term>re-identify</term>, when used with respect to de-identified health
information, means an attempt, successful or otherwise, to ascertain—</text>
<subparagraph id="HD2D71639488E4A42A6EBA0AC270079D8"><enum>(A)</enum><text>the identity of
the individual who is the subject of such information; or</text>
</subparagraph><subparagraph id="H062C33ECDADD4C8700D1F57729481E4F"><enum>(B)</enum><text>the decryption key
with respect to the information (when undertaken with knowledge that such key
would allow for the identification of the individual who is the subject of such
information).</text>
</subparagraph></paragraph><paragraph id="H3AAF91CA6EF04E919EF5D5006521E79D"><enum>(26)</enum><header>Secretary</header><text>The
term <term>Secretary</term> means the Secretary of Health and Human
Services.</text>
</paragraph><paragraph id="HD95982C6B4F84A4A8CD658D05293DAB"><enum>(27)</enum><header>Security</header><text>The
term <term>security</term> means physical, technological, or administrative
safeguards or tools used to protect identifiable health data from unwarranted
access or disclosure.</text>
</paragraph><paragraph id="H81E17F13E6DF454F951400BC9783CB95"><enum>(28)</enum><header>Security
breach</header><text>The term <term>security breach</term> means the physical,
structural, or substantive compromise of the security of personal health
information, through unauthorized disclosure, use, or access, whether actual or
attempted, resulting in the acquisition, access, or use of such information by
an unauthorized person. Such term does not apply to good faith or accidental
acquisition, or disclosure of personal health information by an unauthorized
person, so long as no further use or disclosure is made by such person.</text>
</paragraph><paragraph commented="no" id="H37D0EC3932EA4352B01FE13DCB25DA00"><enum>(29)</enum><header>Segregate</header><text>The
term <term>segregate</term> means to hide, mask, or mark separate a designated
subset of an individual’s personal health information, or to place such a
subset in a location that is securely separated from the location used to store
other personal health information, such that access to or use of any
information so segregated may be effectively limited to those persons that are
authorized by the individual to access or use that segregated
information.</text>
</paragraph><paragraph commented="no" id="HA189534549A74A1FA7F5304FD6EE01EC"><enum>(30)</enum><header>Signed</header><text display-inline="yes-display-inline">The term <term>signed</term> refers both to
signatures in ink and to electronic signatures that are authenticated by the
individual using an authentication method approved by the Secretary.</text>
</paragraph><paragraph display-inline="no-display-inline" id="HF3BC7DBE14D64C7C8DDAF71DC5915683"><enum>(31)</enum><header>State</header><text>The
term <quote>State</quote> means each of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Northern Mariana Islands.</text>
</paragraph><paragraph commented="no" id="H38080C2E98DC49D39D97106507795F28"><enum>(32)</enum><header>To the maximum
extent practicable</header><text>The term <term>to the maximum extent
practicable</term> means the level of compliance that a reasonable person would
deem technologically feasible so long as such feasibility is periodically
evaluated in light of scientific advances.</text>
</paragraph><paragraph id="H4316B5B1EC8049148646E439454D2534"><enum>(33)</enum><header>Use</header><text>The
term <term>use</term> means to create, record, collect, access, obtain, store,
maintain, amend, correct, restore, modify, supplement, identify, re-identify,
employ, apply, utilize, examine, analyze, detect, remove, destroy, dispose of,
account for, or monitor the flow of personal health information.</text>
</paragraph><paragraph id="H8C4176A981FA45D7A5BE5C54284D804E"><enum>(34)</enum><header>Writing;
written</header><text display-inline="yes-display-inline">The terms
<term>writing</term> and <term>written</term> mean writing or written,
respectively, in either a paper-based or computer-based form, including
electronic and digital signatures.</text>
</paragraph></section></subtitle><enum>II</enum><header>Promotion of
Health Information Technology</header>
<subtitle id="H13E67C249B8B43869C8C54676D6142D9"><enum>A</enum><header>Improving the
Interoperability of Health Information Technology</header>
<section id="H901CA750ED0A4AA3B7962D4DE52C7DE8"><enum>201.</enum><header>Office of the
National Coordinator of Health Information Technology</header>
<subsection id="H8BC98FE2CFCB40F5B1FFBFD25FA4E2BF"><enum>(a)</enum><header>Establishment</header><text>There
is established within the office of the Secretary, the Office of the National
Coordinator of Health Information Technology. The National Coordinator shall be
appointed by the Secretary in consultation with the President, and shall report
directly to the Secretary.</text>
</subsection><subsection id="HC48E72BDB63D40F5AD41E2DC1E69DD5C"><enum>(b)</enum><header>Purpose</header><text>The
Office of the National Coordinator shall be responsible for—</text>
<paragraph id="H258A8A8FAA08423682AF98E423F054CC"><enum>(1)</enum><text>ensuring that key
health information technology initiatives are coordinated across programs of
the Department of Health and Human Services;</text>
</paragraph><paragraph id="HE601E9F575FB4D83A19EF04618D97EC"><enum>(2)</enum><text>ensuring that
health information technology policies and programs of the Department of Health
and Human Services are coordinated with such policies and programs of other
relevant Federal agencies (including Federal commissions and advisory
committees) with a goal of avoiding duplication of efforts and of helping to
ensure that each agency undertakes activities primarily within the areas of its
greatest expertise and technical capability;</text>
</paragraph><paragraph id="HB54E9982A8A947968CEF0085684F0355"><enum>(3)</enum><text>reviewing Federal
health information technology investments to ensure that Federal health
information technology programs are meeting the objectives of the strategic
plan published by the Office of the National Coordinator of Health Information
Technology to establish a nationwide interoperable health information
technology infrastructure;</text>
</paragraph><paragraph id="HD8E73A75562B488E87E9EC8E9255BD7"><enum>(4)</enum><text>providing comments
and advice regarding specific Federal health information technology programs,
at the request of Office of Management and Budget;</text>
</paragraph><paragraph id="H17167F9D7B8D45269F818FA4C6229F35"><enum>(5)</enum><text>enhancing the use
of health information technology to improve the quality of health care in the
prevention and management of chronic disease and to address population health;
and</text>
</paragraph><paragraph id="H8CABF7789535453BB228B46F1EC6A900"><enum>(6)</enum><text>consulting with
the Office of Health Information Privacy to ensure that key health information
technology initiatives of the Department of Health and Human Services and other
Federal agencies are consistent with the privacy, confidentiality, and security
requirements in title I.</text>
</paragraph></subsection><subsection id="H7CE70973174B4C75822FD8D7AFA53BEA"><enum>(c)</enum><header>Role With
American Health Information Community and the Partnership for Health Care
Improvement</header><text>The Office of the National Coordinator shall—</text>
<paragraph id="H471A06EB91274A529366FA8B0637DCA0"><enum>(1)</enum><text>serve as an ex
officio member of the American Health Information Community established under
section 203, and act as a liaison between the Federal Government and the
Community;</text>
</paragraph><paragraph id="H19377D3C611443A3A3E586CF4D768833"><enum>(2)</enum><text display-inline="yes-display-inline">serve as an ex officio member of the
Partnership and act as a liaison between the Federal Government and the
Partnership for Health Care Improvement (established under section 202);
and</text>
</paragraph><paragraph id="HA2038EB9A7244C0982E690FB2EA0D299"><enum>(3)</enum><text>serve as a liaison
between the Partnership and the Community.</text>
</paragraph></subsection><subsection id="H9B645D2998854C590077D141628629C9"><enum>(d)</enum><header>Reports and
Website</header><text>The Office of the National Coordinator shall—</text>
<paragraph id="H324EAB92910F48E1A9D7161F272695C0"><enum>(1)</enum><text>develop and
publish a strategic plan for implementing a nationwide interoperable health
information technology infrastructure;</text>
</paragraph><paragraph id="H729AD525ED7E46F2AB28D0C4DF81D58C"><enum>(2)</enum><text>maintain and
frequently update an Internet website that—</text>
<subparagraph id="H63CA9C9184A74CFC863C7BF001F106E"><enum>(A)</enum><text>publishes the
schedule for the assessment of standards for significant use cases;</text>
</subparagraph><subparagraph id="H3232D3A8DC75428DBCBC384514237763"><enum>(B)</enum><text>publishes the
recommendations of the American Health Information Community;</text>
</subparagraph><subparagraph id="HE6B899B010304DAA82D6CCA4191285AA"><enum>(C)</enum><text>publishes the
recommendations of the Partnership for Health Care Improvement;</text>
</subparagraph><subparagraph id="H388BA9A2B8824DE6009FE0688694EE13"><enum>(D)</enum><text>publishes quality
measures;</text>
</subparagraph><subparagraph id="H3CC4B699B1E74A96A89B82B8C9986CC2"><enum>(E)</enum><text>identifies sources
of funds that will be made available to facilitate the purchase of, or enhance
the utilization of, health information technology systems, either through
grants or technical assistance; and</text>
</subparagraph><subparagraph id="HF8BED666A31E488A8478865F415DBD39"><enum>(F)</enum><text>publishes a plan
for a transition of any functions of the Office of the National Coordinator
that should be continued after September 30, 2014;</text>
</subparagraph></paragraph><paragraph id="H29394F46EF4647BAAB2F00D6CCEF7FFA"><enum>(3)</enum><text>prepare a report
on the lessons learned from major public and private health care systems that
have implemented health information technology systems, including an
explanation of whether the systems and practices developed by such systems may
be applicable to and usable in whole or in part by other health care providers;
and</text>
</paragraph><paragraph id="H0B62EAC5732745448BA21BC3069B8BEF"><enum>(4)</enum><text>assess the impact
of health information technology in communities with health disparities and
identify practices to increase the adoption of such technology by health care
providers in such communities.</text>
</paragraph></subsection><subsection id="HB7FC64C66440493194E9BFE1C7EBD570"><enum>(e)</enum><header>Rule of
Construction</header><text>Nothing in this section shall be construed as
requiring the duplication of Federal efforts with respect to the establishment
of the Office of the National Coordinator of Health Information Technology,
regardless of whether such efforts are carried out before or after the date of
the enactment of this title.</text>
</subsection><subsection id="H2817ABE17B9D42FABFA3093EAAD38DFA"><enum>(f)</enum><header>Authorization of
Appropriations</header><text>There is authorized to be appropriated to carry
out this section, $5,000,000 for each of fiscal years 2009 and 2010.</text>
</subsection><subsection id="HF3F75816FDE8454FB3F41B2B856552B4"><enum>(g)</enum><header>Sunset</header><text>The
provisions of this section shall not apply after September 30, 2014.</text>
</subsection></section><section id="H9EDD0EB3D7A9449DBDD77F8476324242"><enum>202.</enum><header>Partnership for
Health Care Improvement</header>
<subsection id="HEB09ACA970D342518FFFA80975EA10D7"><enum>(a)</enum><header>Establishment</header>
<paragraph id="H79E0FE18784B43439564DBC6A5A18457"><enum>(1)</enum><header>In
general</header><text>There is established a public-private Partnership for
Health Care Improvement (in this title referred to as the
<quote>Partnership</quote>) to—</text>
<subparagraph id="H1184B8F9F0834289B516BC6CC686412"><enum>(A)</enum><text>provide advice to
the Secretary and the Nation and recommend specific actions to achieve a
nationwide interoperable health information technology infrastructure;</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H6F5E7CE3409D4E4D894B4DD0AE24D406"><enum>(B)</enum><text display-inline="yes-display-inline">make recommendations concerning standards,
including privacy, security, and confidentiality standards, implementation
specifications, and certification criteria for the electronic exchange of
personal health information (including for the reporting of quality data under
section 221) for adoption by the Federal Government and voluntary adoption by
private entities that are consistent with the requirements of title I;</text>
</subparagraph><subparagraph id="H910E544ACEE34899A63121EAA72B1628"><enum>(C)</enum><text display-inline="yes-display-inline">serve as a forum for the participation of a
broad range of stakeholders with specific technical expertise in the
development of standards, implementation specifications, and certification
criteria and protection of privacy and data security to provide input on the
effective implementation of health information technology systems; and</text>
</subparagraph><subparagraph id="HABF19FD24C7347B183007B9C98BA9ECC"><enum>(D)</enum><text>develop and
maintain an Internet website that—</text>
<clause id="H6AA4B357C497475C9CBE684BAF50874E"><enum>(i)</enum><text>publishes
established governance rules (including a subsequent appointment
process);</text>
</clause><clause id="H622511B2406C4815BB00C5AFAB908E06"><enum>(ii)</enum><text>publishes a
business plan;</text>
</clause><clause id="H459ABF0F6EFA4339A5E449DBFE11E94"><enum>(iii)</enum><text>publishes meeting
notices at least 14 days prior to each meeting;</text>
</clause><clause id="HB3744E2888AB48EDA095EA6C62F4614B"><enum>(iv)</enum><text>publishes meeting
agendas at least 7 days prior to each meeting; and</text>
</clause><clause id="H45FB295EDA344BE4BCBA19A8DCCF7E8"><enum>(v)</enum><text>publishes meeting
materials at least 3 days prior to each meeting.</text>
</clause></subparagraph></paragraph><paragraph id="HA9D485CFB8B24052A84D63875897A5BB"><enum>(2)</enum><header>Limitation</header><text>The
Partnership shall not meet or take any action until an advisory committee
charter has been filed with the Secretary and with the appropriate committees
of the Senate and House of Representatives for the American Health Information
Community described in section 203.</text>
</paragraph></subsection><subsection id="HA57A2E8EE9EA4F198D54B5297E3736C9"><enum>(b)</enum><header>Membership</header>
<paragraph id="H3A70806BD61F4AEDA2F4D9733176A7D8"><enum>(1)</enum><header>Members</header><text display-inline="yes-display-inline">The members of the Partnership shall
consist of the following:</text>
<subparagraph id="H2B4810FAD85647BCBA8D32B2704E15DD"><enum>(A)</enum><header>Appointed
members</header><text>The appointed members of the Partnership shall be
appointed as follows:</text>
<clause id="H19EB1275287B4BECB64358DEEF495D7C"><enum>(i)</enum><text>2
members shall be appointed by the Secretary.</text>
</clause><clause id="HE71F86DAA95B497B8596EA85173C7572"><enum>(ii)</enum><text>1
member shall be appointed by the majority leader of the Senate.</text>
</clause><clause id="HB35A6A7737604AE69FDA4BBF0216BBCC"><enum>(iii)</enum><text>1
member shall be appointed by the minority leader of the Senate.</text>
</clause><clause id="HE750B90BFB0E4B0A9BAB976E51B37633"><enum>(iv)</enum><text>1
member shall be appointed by the Speaker of the House of
Representatives.</text>
</clause><clause id="H14735F2E3B834AB9A6171C3C4F1C9804"><enum>(v)</enum><text>1
member shall be appointed by the minority leader of the House of
Representatives.</text>
</clause><clause id="H363DC9C34AD8409E8D276CD2490EA21"><enum>(vi)</enum><text>Seven members
shall be appointed by the Comptroller General of whom—</text>
<subclause id="H5234870C4F12428690471EEF203B0029"><enum>(I)</enum><text>one member shall
be a representative of consumer or patient organizations;</text>
</subclause><subclause id="H32D053D34F224AD2888F753B82973420"><enum>(II)</enum><text>one member shall
be a representative of organizations with expertise in the protection of
privacy;</text>
</subclause><subclause id="HEA7EB1428AC443D9804284A01B46C12F"><enum>(III)</enum><text>one member shall
be a representative of organizations with expertise in security;</text>
</subclause><subclause id="H136001F4FA314AE2B84BB8ECA1F5401"><enum>(IV)</enum><text>one member shall
be a representative of health care providers;</text>
</subclause><subclause id="H1610796F58E44FD19F9CBEBF18CD47FC"><enum>(V)</enum><text>one member shall
be a representative of health plans or other third party payers;</text>
</subclause><subclause id="H0A1EA8D987EB48C4B1ED923CB14ECB"><enum>(VI)</enum><text>one member shall be
a representative of information technology vendors; and</text>
</subclause><subclause id="HD71821A86C1B461A88986F0530ADAA9"><enum>(VII)</enum><text>one member shall
be a representative of purchasers or employers.</text>
</subclause></clause></subparagraph><subparagraph commented="no" id="H99A347411537478CB531746BACE4C950"><enum>(B)</enum><header>National
Coordinator</header><text>The National Coordinator shall be a member of the
Partnership and act as a liaison among the Partnership, the community, and the
Federal Government.</text>
</subparagraph></paragraph><paragraph id="H499A4E97CC6D46F795A5D924649D0000"><enum>(2)</enum><header>Chairperson and
vice chairperson</header><text>The Partnership shall designate one member to
serve as the chairperson and one member to serve as the vice chairperson of the
Partnership.</text>
</paragraph><paragraph id="H782A4F64ABB640D4941591A23EA296D7"><enum>(3)</enum><header>Participation</header><text display-inline="yes-display-inline">Members shall be appointed under paragraph
(1)(A), and the Partnership shall develop procedures for conducting its
activities, so as to ensure a balance among various sectors of the health care
system so that no single sector unduly influences the recommendations of the
Partnership.</text>
</paragraph><paragraph id="HF6DC33778D4646A7B3D9920C26C54CE"><enum>(4)</enum><header>Terms</header><text>Members
appointed under paragraph (1)(A) shall serve for 3 year terms, except that any
member appointed to fill a vacancy for an unexpired term shall be appointed for
the remainder of such term. A member may serve for not to exceed 180 days after
the expiration of such member’s term or until a successor has been
appointed.</text>
</paragraph><paragraph id="HECA399187CDE452E96EC5773D2A79566"><enum>(5)</enum><header>Outside
involvement</header><text>The Partnership shall ensure an adequate opportunity
for the participation of outside advisors, including individuals with expertise
in—</text>
<subparagraph id="H0EEEB3373A004E4E008C005DF3F0C3B8"><enum>(A)</enum><text>the protection of
personal health information privacy;</text>
</subparagraph><subparagraph id="HB54850ADF7C341FDADEC24C2F40EB8C"><enum>(B)</enum><text>personal health
information security;</text>
</subparagraph><subparagraph id="H1DC616E006694C04B2573D42481BED"><enum>(C)</enum><text>health care quality
and patient safety, including individuals with expertise in utilizing health
information technology to improve health care quality and patient
safety;</text>
</subparagraph><subparagraph id="H141BC2962E874DB5ACAF4B16F0ED3C52"><enum>(D)</enum><text>medical and
clinical research data exchange; and</text>
</subparagraph><subparagraph id="HABCDA01FCB3C493E88D6B4AF2BA401CE"><enum>(E)</enum><text>developing health
information technology standards and new health information technology.</text>
</subparagraph></paragraph><paragraph id="HC1CCF2D9380B42160030E60159E900B0"><enum>(6)</enum><header>Quorum</header><text>Two-thirds
of the members of the Partnership shall constitute a quorum for the purpose of
conducting votes.</text>
</paragraph></subsection><subsection id="HA0CC989EC7914681B9E23FE7ECDADC56"><enum>(c)</enum><header>Standards and
Implementation Specifications</header>
<paragraph id="HB4546E36AD84470F9EF5DF1D03B5C8B7"><enum>(1)</enum><header>Schedule</header><text>Not
later than 90 days after the date of enactment of this title, the Partnership
shall develop a schedule for the assessment of standards and implementation
specifications under this section. The Partnership shall update such schedule
annually. The Secretary shall publish such schedule in the Federal Register and
on the Internet website of the Department of Health and Human Services.</text>
</paragraph><paragraph id="HEBD7D7815F3F497D8194B52EF78BCBBD"><enum>(2)</enum><header>First year
recommendations</header><text>Consistent with the schedule published under
paragraph (1) and not later than 1 year after date of enactment of this title,
the Partnership shall recommend, and the Secretary shall review, such standards
and implementation specifications.</text>
</paragraph><paragraph id="HB5AFFEBF0940433187DE9C8407B06536"><enum>(3)</enum><header>Ongoing
recommendations</header><text>The Partnership shall review and modify, as
appropriate but at least annually, adopted standards and implementation
specifications and continue to recommend additional standards and
implementation specifications, consistent with the schedule published pursuant
to paragraph (1). The Secretary shall review such modifications and
recommendations.</text>
</paragraph><paragraph id="H6E99D5F2C4D44F2A9391BC8E49BE35A1"><enum>(4)</enum><header>Recognition of
private entities</header><text>The Partnership, in consultation with the
Secretary, may recognize a private entity or entities for the purpose of
developing and updating standards and implementation specifications to achieve
uniform and consistent implementation of the standards adopted by the President
under this title. Such entity or entities shall make recommendations to the
Partnership consistent with this section.</text>
</paragraph><paragraph id="H4DBE2838A57D411AAB000009FFF1F54F"><enum>(5)</enum><header>Publication</header><text>All
recommendations made by the Partnership pursuant to this section shall be
published in the Federal Register and on the Internet website of the Office of
the National Coordinator.</text>
</paragraph><paragraph id="H467205D6A78244B7ACF597484BAAAB64"><enum>(6)</enum><header>Requirement for
certain recommendations</header><text display-inline="yes-display-inline">The
Partnership may not issue any recommendation that affects an individual’s right
to health information privacy unless such recommendation receives the
affirmative support of the consumer or patient organization representative of
the Partnership appointed under subsection (b)(1)(A)(vi)(I).</text>
</paragraph><paragraph id="H893919E8AF0D45EC90A555FF60FE6420"><enum>(7)</enum><header>Pilot
testing</header><text>The Secretary may conduct, or recognize a private entity
or entities to conduct, a pilot project to test the standards and
implementation specifications developed under this section in order to provide
for the efficient implementation of the standards and implementation
specifications described in this subsection prior to issuing such
recommendations.</text>
</paragraph><paragraph id="HCA588EB24D4D45B6BDD76EF52B7D6B03"><enum>(8)</enum><header>Public
input</header><text>The Partnership shall conduct open public meetings and
develop a process to allow for public comment on the schedule and
recommendations described in this section. Such process shall ensure that such
comments will be submitted within 30 days of the publication of a
recommendation under this section.</text>
</paragraph><paragraph id="HB69D6FD2C89D454D8429DD00C8E800F9"><enum>(9)</enum><header>Federal
action</header><text display-inline="yes-display-inline">Not later than 90 days
after the issuance of a recommendation from the Partnership under this
subsection, the Secretary, in collaboration with representatives of other
relevant Federal agencies as determined appropriate by the President, shall
jointly review such recommendation. If appropriate, the President shall provide
for the adoption by the Federal Government of any standard or implementation
specification contained in such recommendation only after providing an
opportunity for public comment in accordance with <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5,
United States Code. Such determination shall be published in the Federal
Register and on the Internet website of the Office of the National Coordinator
within 30 days after such determination is made.</text>
</paragraph><paragraph id="HF7F55D13DBAE425CB330B000AC3C11DF"><enum>(10)</enum><header>Consistency</header><text display-inline="yes-display-inline">The standards and implementation
specifications described in this subsection shall be consistent with the
privacy protections in title I and the standards for information transactions
and data elements developed pursuant to the regulations promulgated under
section 264(c) of the Health Insurance Portability and Accountability Act of
1996.</text>
</paragraph></subsection><subsection id="HBAB979336FEA47498DC0D4DAC83095E1"><enum>(d)</enum><header>Certification</header>
<paragraph id="H6DD0A51630C8402393988EBBFA4BC6D"><enum>(1)</enum><header>Developing
criteria</header><text>The Partnership, in consultation with the Secretary, may
recognize a private entity or entities for the purpose of developing and
recommending to the Partnership criteria to certify that appropriate categories
of health information technology products that claim to be in compliance with
applicable standards and implementation specifications adopted under this title
have established such compliance.</text>
</paragraph><paragraph id="H6800A8D41900433CBF424C1E1EE9BAB"><enum>(2)</enum><header>Adoption of
criteria</header><text>The Secretary, based upon the recommendations of the
Partnership, shall review, and if appropriate, adopt such criteria.</text>
</paragraph><paragraph id="H25104F44E5C349FEA3CAD5BBB1BD9947"><enum>(3)</enum><header>Conducting
certification</header><text>The Secretary may recognize a private entity or
entities to conduct the certifications described under paragraph (1) using the
criteria adopted by the Secretary under this subsection.</text>
</paragraph></subsection><subsection id="H8DD3AFEBCB0D4C819EC0FC4EBABBBA82"><enum>(e)</enum><header>Rule of
Construction</header><text>Nothing in this section shall be construed as
disrupting existing activities described in subsection (c) or (d).</text>
</subsection><subsection id="H7070CEE6DC4E4F91818917421E84BA1"><enum>(f)</enum><header>Requirement to
Consider Recommendations</header><text>In carrying out the activities described
in subsections (c) and (d), the Partnership shall adopt and integrate the
recommendations of the American Health Information Community that are adopted
by the Secretary.</text>
</subsection><subsection id="HC6AB99E7BE58470584060745023C3B9B"><enum>(g)</enum><header>Authorization of
Appropriations</header><text>There are authorized to be appropriated to carry
out this section, $2,000,000 for each of the fiscal years 2009 and 2010.</text>
</subsection></section><section id="H21EC6A70D4BE4FF0BEBFF5D7919D9F36"><enum>203.</enum><header>American Health
Information Community policies</header>
<subsection id="H94E3D398C8FD46F0A470E0979C9BB959"><enum>(a)</enum><header>Establishment</header><text>There
is established a committee to be known as the American Health Information
Community (in this section referred to as the <quote>Community</quote>). The
Community shall—</text>
<paragraph id="H77399AF5509944198702E2A44C48C568"><enum>(1)</enum><text>provide advice to
the Secretary and the heads of any relevant Federal agencies concerning the
policy considerations related to health information technology;</text>
</paragraph><paragraph id="H8007225E524F418DBB99D02D4F67B31F"><enum>(2)</enum><text>not later than 1
year after the date of enactment of this title, and annually thereafter, make
recommendations concerning a policy framework for the development and adoption
of a nationwide interoperable health information technology
infrastructure;</text>
</paragraph><paragraph id="HF95DD2FC27A24BF8A3D5002ED4E043B7"><enum>(3)</enum><text>not later than 1
year after the date of enactment of this title, and annually thereafter, make
recommendation concerning national policies for adoption by the Federal
Government, and voluntary adoption by private entities, to support the
widespread adoption of health information technology, including—</text>
<subparagraph id="H2D1099886241468A0089CDAC47EE5B5"><enum>(A)</enum><text>the protection of
personal health information, including policies concerning the individual’s
ability to control the acquisition, uses, and disclosures of personal health
information;</text>
</subparagraph><subparagraph id="H46461452FD354C4BA0DA82E8361860D3"><enum>(B)</enum><text>methods to protect
personal health information from improper use and disclosures and methods to
notify patients if their personal health information is wrongfully
disclosed;</text>
</subparagraph><subparagraph id="HE6E8ACDA676E401BBC1317B158B1EFCF"><enum>(C)</enum><text>methods to
facilitate and secure access to such individual’s personal health
information;</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="HDFBAA97572EE4D0A001388F6AE9473B7"><enum>(D)</enum><text>the appropriate
uses of a nationwide personal health information infrastructure
including—</text>
<clause id="H5A69FA123D7D45EC97958D64D7D63292"><enum>(i)</enum><text>the
collection of quality data and public reporting;</text>
</clause><clause id="HC43D61D5D3B6494C9910B2007B7E4402"><enum>(ii)</enum><text>biosurveillance
and public health;</text>
</clause><clause id="H7A4ABDBD13C54807892F61D608701F63"><enum>(iii)</enum><text>medical and
clinical research; and</text>
</clause><clause id="H1F1A026EAEB64C808749CEA2921BA9FD"><enum>(iv)</enum><text>drug
safety;</text>
</clause></subparagraph><subparagraph id="H0256ACED64BA4806B5A4ED004812E6B5"><enum>(E)</enum><text>fostering the
public understanding of health information technology;</text>
</subparagraph><subparagraph id="H273D38217827419897A348D90022F4FF"><enum>(F)</enum><text>strategies to
enhance the use of health information technology in preventing and managing
chronic disease;</text>
</subparagraph><subparagraph id="HB730D64F34DF428FB9DBFA04EE1F0298"><enum>(G)</enum><text>policies to
incorporate the input of employees of health care providers in the design and
implementation of health information technology systems; and</text>
</subparagraph><subparagraph id="HD5E23A376CF64097B6C9144352E32BE"><enum>(H)</enum><text>other policies
determined to be necessary by the Community; and</text>
</subparagraph></paragraph><paragraph id="H739B0890660F4FC1831F5EF067B3BDA5"><enum>(4)</enum><text>serve as a forum
for the participation of a broad range of stakeholders to provide input on
improving the effective implementation of health information technology
systems.</text>
</paragraph><continuation-text continuation-text-level="subsection">The
Community may not make any recommendation that affects an individual’s right to
health information privacy unless the recommendation receives the affirmative
support of the consumer or patient organization representative appointed under
subsection (c)(1)(A)(viii)(I).</continuation-text></subsection><subsection id="HB19D144D2E8A45AB965C93958FC1F86"><enum>(b)</enum><header>Publication</header><text display-inline="yes-display-inline">All recommendations made by the Community
pursuant to this section shall be published in the Federal Register and on the
Internet website of the National Coordinator. The Secretary shall review all
recommendations and determine which recommendations shall be endorsed by the
Federal Government and such determination shall be published on the Internet
website of the Office of the National Coordinator after an opportunity for
public comment in accordance with <external-xref legal-doc="usc" parsable-cite="usc/5/553">section 553</external-xref> of title 5, United States
Code.</text>
</subsection><subsection id="H81BF80F9A6114488941EDD574406B3D4"><enum>(c)</enum><header>Membership</header>
<paragraph id="H9C038B54229A4E418D8D4FCC6C7992D5"><enum>(1)</enum><header>Members</header><text display-inline="yes-display-inline">The members of the Community shall consist
of the following:</text>
<subparagraph id="H54FDE1C67F3F4FCDBF1C195865685000"><enum>(A)</enum><header>Appointed
members</header><text>The appointed members of the Community shall be appointed
as follows:</text>
<clause id="HEA7ED98360154A74BD9CD4725CEA645E"><enum>(i)</enum><text>3
members shall be appointed by the Secretary, 1 of whom shall be a
representative from the Department of Health and Human Services.</text>
</clause><clause id="H5DE11D7A6371462790B2DC00652BCF00"><enum>(ii)</enum><text>1
member shall be appointed by the Secretary of Veterans Affairs who shall
represent the Department of Veterans Affairs.</text>
</clause><clause id="HDF7A99CBFFD54AA7A5058300B2D42233"><enum>(iii)</enum><text>1
member shall be appointed by the Secretary of Defense who shall represent the
Department of Defense.</text>
</clause><clause id="H0A226301F5AD4EBDB36E4FB42ED76232"><enum>(iv)</enum><text>1
member shall be appointed by the majority leader of the Senate.</text>
</clause><clause id="H0C4FBE1595F542BD9605257CA6A6C904"><enum>(v)</enum><text>1
member shall be appointed by the minority leader of the Senate.</text>
</clause><clause id="H757FE901F3E14ECC0040A689A2577C20"><enum>(vi)</enum><text>1
member shall be appointed by the Speaker of the House of
Representatives.</text>
</clause><clause id="H437E1CC941F1482D9B9C002287170013"><enum>(vii)</enum><text>1
member shall be appointed by the minority leader of the House of
Representatives.</text>
</clause><clause id="HA87474EDE3624DB88688D765A3646CB8"><enum>(viii)</enum><text>Nine members
shall be appointed by the Comptroller General of whom—</text>
<subclause id="HE7CB99A525F745CA9EB3DC393B5BE9B2"><enum>(I)</enum><text>one member shall
be advocates for patients or consumers;</text>
</subclause><subclause id="H69EA3B4322B0490A948B636671EDCF39"><enum>(II)</enum><text>one member shall
represent health care providers;</text>
</subclause><subclause id="HE7DFB4B75AB44A409FAF3D7C43425560"><enum>(III)</enum><text>one member shall
be from a labor organization representing health care workers;</text>
</subclause><subclause id="H982C8262F0AE4ED8B8BAB0B5E562892E"><enum>(IV)</enum><text>one member shall
have expertise in the protection of privacy and data security;</text>
</subclause><subclause id="HEDF6519E923C440DA185E587634857B8"><enum>(V)</enum><text>one member shall
have expertise in improving the health of vulnerable populations;</text>
</subclause><subclause id="H1DDD2325895746DC94CB8F058EB4CB9B"><enum>(VI)</enum><text>one member shall
represent health plans or other third party payers;</text>
</subclause><subclause id="HC1B95926015945D4802D8D76B4A99DC1"><enum>(VII)</enum><text>one member shall
represent information technology vendors;</text>
</subclause><subclause id="H3D8066A6FB9646D58618E94FC7AEC1FA"><enum>(VIII)</enum><text>one member
shall represent purchasers or employers; and</text>
</subclause><subclause id="HC986F00647204966AB14A2604456DEBF"><enum>(IX)</enum><text>one member shall
have expertise in health care quality measurement and reporting.</text>
</subclause></clause></subparagraph><subparagraph commented="no" id="H8199D02610DB405CBDA7439200C82898"><enum>(B)</enum><header>National
Coordinator</header><text>The National Coordinator shall be a member of the
Community and act as a liaison among the Community, the partnership, and the
Federal Government.</text>
</subparagraph></paragraph><paragraph id="H36868A94AB4C42C984AF0089B8687E00"><enum>(2)</enum><header>Chairperson and
vice chairperson</header><text>The Community shall designate one member to
serve as the chairperson and one member to serve as the vice chairperson of the
Community.</text>
</paragraph><paragraph id="H4E0256B1277D400CBAF0AE77B16CC232"><enum>(3)</enum><header>Participation</header><text>The
members of the Community appointed under paragraph (1) shall represent a
balance among various sectors of the health care system so that no single
sector unduly influences the recommendations of the Community.</text>
</paragraph><paragraph id="HECAA2CA896E64105A057BA3000C64FB2"><enum>(4)</enum><header>Terms</header>
<subparagraph id="HDF70CCD17B5A467AA870B4F0C9117800"><enum>(A)</enum><header>In
general</header><text>The terms of members of the Community shall be for 3
years except that the Comptroller General shall designate staggered terms for
the members first appointed.</text>
</subparagraph><subparagraph id="H7626B3F5132348CE8271514BF2EBF55"><enum>(B)</enum><header>Vacancies</header><text>Any
member appointed to fill a vacancy in the membership of the Community that
occurs prior to the expiration of the term for which the member’s predecessor
was appointed shall be appointed only for the remainder of that term. A member
may serve after the expiration of that member’s term until a successor has been
appointed. A vacancy in the Community shall be filled in the manner in which
the original appointment was made.</text>
</subparagraph></paragraph><paragraph id="H3891B3A710D64BFCA43064FEB8AFDA2C"><enum>(5)</enum><header>Outside
involvement</header><text>The Community shall ensure an adequate opportunity
for the participation of outside advisors, including individuals with expertise
in—</text>
<subparagraph id="H1328C5807CFA464E003D47FA4B979342"><enum>(A)</enum><text>the protection of
health information privacy and security;</text>
</subparagraph><subparagraph id="HC94A8D123968457F81F3C206D5FEB0EE"><enum>(B)</enum><text>improving the
health of vulnerable populations;</text>
</subparagraph><subparagraph id="H4351E86E4E4A4DB5B9A2F37807B9EC3"><enum>(C)</enum><text>health care quality
and patient safety, including individuals with expertise in measurement and the
use of health information technology to capture data to improve health care
quality and patient safety;</text>
</subparagraph><subparagraph id="H281756BCDEC7420B007BA5284570D1A8"><enum>(D)</enum><text display-inline="yes-display-inline">ethics, including the ethical standards of
professional medical and mental health practitioner associations;</text>
</subparagraph><subparagraph id="HEB925BE169884F8E82124EC341217164"><enum>(E)</enum><text>medical and
clinical research data exchange;</text>
</subparagraph><subparagraph id="H4D672F23EEF94FAEA4602EB869BB0741"><enum>(F)</enum><text>developing health
information technology standards and new health information technology;
and</text>
</subparagraph><subparagraph id="H1475F26868C3497AA3345C73DC05522D"><enum>(G)</enum><text>the operation of a
State or local health information network.</text>
</subparagraph></paragraph><paragraph id="H72E6EEA57DD14952B165B2A1D960105"><enum>(6)</enum><header>Quorum</header><text>Ten
members of the Community shall constitute a quorum for purposes of voting, but
a lesser number of members may meet and hold hearings.</text>
</paragraph></subsection><subsection id="H5CBA5DB43771485F803389C9D48D38EE"><enum>(d)</enum><header>Federal
Agencies</header>
<paragraph id="H88BC88CE7F4E4543902FC1C842B27074"><enum>(1)</enum><header>Staff of other
federal agencies</header><text>Upon the request of the Community, the head of
any Federal agency may detail, without reimbursement, any of the personnel of
such agency to the Community to assist in carrying out the duties of the
Community. Any such detail shall not interrupt or otherwise affect the civil
service status or privileges of the Federal employee involved.</text>
</paragraph><paragraph id="HDD6F0E3322264F2BB070B8B449D917C6"><enum>(2)</enum><header>Technical
assistance</header><text>Upon the request of the Community, the head of a
Federal agency shall provide such technical assistance to the Community as the
Community determines to be necessary to carry out its duties.</text>
</paragraph><paragraph id="H9AB30E0DF00C42FEAF432ED7BC931E77"><enum>(3)</enum><header>Other
resources</header><text>The Community shall have reasonable access to
materials, resources, statistical data, and other information from the Library
of Congress and agencies and elected representatives of the executive and
legislative branches of the Federal Government. The chairperson or vice
chairperson of the Community shall make requests for such access in writing
when necessary.</text>
</paragraph></subsection><subsection id="HF59AF8E8E33A4294B42EC9EBDE52537B"><enum>(e)</enum><header>Application of
FACA</header><text>The Federal Advisory Committee Act (5 U.S.C. App.) shall
apply to the Community, except that the term provided for under section
14(a)(2) of such Act shall be not longer than 7 years.</text>
</subsection><subsection id="H613E95D02B744A1EB800D28EF1291273"><enum>(f)</enum><header>Sunset</header><text>The
provisions of this section shall not apply after September 20, 2014.</text>
</subsection><subsection id="H75F4616CE8064611A14C47D15723D6B8"><enum>(g)</enum><header>Authorization of
Appropriations</header><text>There is authorized to be appropriated to carry
out this section, $2,000,000 for each of fiscal years 2009 and 2010.</text>
</subsection></section><section id="H5E6E91E5433241E494297259515BEFC6"><enum>204.</enum><header>Research access
to health care data and reporting on performance</header><text display-inline="no-display-inline">The Secretary shall permit researchers that
meet criteria used to evaluate the appropriateness of the release data for
research purpose (as established by the Secretary) to—</text>
<paragraph id="H825FB5C702ED4E89ACB7CF79D77507E5"><enum>(1)</enum><text>have access to all
Federal health care data; and</text>
</paragraph><paragraph id="H27326F73042A40C284417E69E2E8EF00"><enum>(2)</enum><text>report on the
performance of health care providers and suppliers, including reporting in a
provider- or supplier-identifiable format.</text>
</paragraph></section></subtitle><subtitle id="HAE85BF7640D44006A79F4EEEAEA39488"><enum>B</enum><header>Facilitating the
Widespread Adoption of Interoperable Health Information Technology</header>
<section id="HE565A3D66AA549229D00A1127F08D477"><enum>211.</enum><header>Facilitating
the widespread adoption of interoperable health information technology</header>
<subsection id="H738F1F23F1884EB2B7800644CCD3469E"><enum>(a)</enum><header>Competitive
Grants for Adoption of Technology</header>
<paragraph id="H4FC1D8B517354BB9A18297F15B814169"><enum>(1)</enum><header>In
general</header><text>The Secretary may award competitive grants to eligible
entities to facilitate the purchase and enhance the utilization of qualified
health information technology systems (as defined in section 213) to improve
the quality and efficiency of health care.</text>
</paragraph><paragraph id="HF6A5132224B1480F8757BFD5634EE51C"><enum>(2)</enum><header>Eligibility</header><text>To
be eligible to receive a grant under paragraph (1) an entity shall—</text>
<subparagraph id="H4DF6621917614024BF9D9F5145CB3306"><enum>(A)</enum><text>submit to the
Secretary an application at such time, in such manner, and containing such
information as the Secretary may require;</text>
</subparagraph><subparagraph id="H42D910367B544F4BAC4C25007FA68E55"><enum>(B)</enum><text>submit to the
Secretary a strategic plan for the implementation of data sharing and
interoperability measures;</text>
</subparagraph><subparagraph id="H95B27F259028432E903415612E3E986F"><enum>(C)</enum><text>adopt the
standards adopted by the Federal Government under section 301;</text>
</subparagraph><subparagraph id="H8C8D814A1DF84C5DB1B92D56DF02F365"><enum>(D)</enum><text>implement the
measures adopted under section 221 and report to the Secretary on such
measures;</text>
</subparagraph><subparagraph id="HE709CE3B6A904F6E94BDAF3450A9B0FA"><enum>(E)</enum><text display-inline="yes-display-inline">comply with the requirements of title
I;</text>
</subparagraph><subparagraph id="H2FF81B00B19944E992CFB05094445592"><enum>(F)</enum><text>take into account
the input of employees and staff who are directly involved in patient care of
such health care providers in the design, implementation, and use of qualified
health information technology systems;</text>
</subparagraph><subparagraph id="HD66AFC1E466D4FFF8E00462DDF3E334F"><enum>(G)</enum><text>demonstrate
significant financial need;</text>
</subparagraph><subparagraph id="H86EB04EBFA684B9893938DC6E515B1E3"><enum>(H)</enum><text>provide matching
funds in accordance with paragraph (4); and</text>
</subparagraph><subparagraph id="H54E460FEC603404CA4ACD826726B8949"><enum>(I)</enum><text>be a—</text>
<clause id="H4C5A04D6B11E4630B955B400E992D72C"><enum>(i)</enum><text>public or not for
profit hospital;</text>
</clause><clause id="HD89B626FD29D452BBA5D57B8511E8B1"><enum>(ii)</enum><text>federally
qualified health center (as defined in section 1861(aa)(4) of the Social
Security Act);</text>
</clause><clause id="HAE6784D1E0674072A6EE1BD6C9E3F22"><enum>(iii)</enum><text>individual or
group practice (or a consortium thereof); or</text>
</clause><clause id="H0E49626D04B64923B58B043723C37713"><enum>(iv)</enum><text>another health
care provider not described in clause (i) or (ii);</text>
</clause><continuation-text continuation-text-level="subparagraph">that
serves medically undeserved communities.</continuation-text></subparagraph></paragraph><paragraph id="H11906EEFC11E4A77AD63B7AD2DADBB15"><enum>(3)</enum><header>Use of
funds</header><text>Amounts received under a grant under this subsection shall
be used to—</text>
<subparagraph id="HDB7D078DB53247178638D6FB943140ED"><enum>(A)</enum><text>facilitate the
purchase of qualified health information technology systems;</text>
</subparagraph><subparagraph id="H40B2DFE59AB64CE7A76BE29DBCF1F0FF"><enum>(B)</enum><text>train personnel in
the use of such systems;</text>
</subparagraph><subparagraph id="H7816A3B0BCC24650BEFBC1D867C31B33"><enum>(C)</enum><text>enhance the
utilization of qualified health information technology systems (which may
include activities to increase the awareness among consumers of health care
privacy protections); or</text>
</subparagraph><subparagraph id="H6C1FC44CC0314EBC9844FA3CF6465347"><enum>(D)</enum><text>improve the
prevention and management of chronic disease.</text>
</subparagraph></paragraph><paragraph id="H764CCB48BEC4497500799448F9839427"><enum>(4)</enum><header>Matching
requirement</header><text>To be eligible for a grant under this subsection an
entity shall contribute non-Federal contributions to the costs of carrying out
the activities for which the grant is awarded in an amount equal to $1 for each
$3 of Federal funds provided under the grant.</text>
</paragraph><paragraph id="HE67217B3DA2E437B9F38501DA3A3F6F0"><enum>(5)</enum><header>Preference in
awarding grants</header><text>In awarding grants under this subsection the
Secretary shall give preference to—</text>
<subparagraph id="H93F66A1D7CDC48C58B4C1FD8DD5C28EB"><enum>(A)</enum><text>eligible entities
that will improve the degree to which such entity will link the qualified
health information technology system to local or regional health information
plan or plans; and</text>
</subparagraph><subparagraph id="HCA171FDE23BE40108BE4FA04AA1D49A9"><enum>(B)</enum><text>with respect to
awards made for the purpose of providing care in an outpatient medical setting,
entities that organize their practices as a patient-centered medical
home.</text>
</subparagraph></paragraph></subsection><subsection id="H5C2465546E3848F5B0308200E241FC1C"><enum>(b)</enum><header>Competitive
Grants for the Development of State Loan Programs To Facilitate the Widespread
Adoption of Health Information Technology</header>
<paragraph id="HCACAE408BFF340F2BE0109973FDEFB71"><enum>(1)</enum><header>In
general</header><text>The Secretary may award competitive grants to States for
the establishment of State programs for loans to health care providers to
facilitate the purchase and enhance the utilization of qualified health
information technology.</text>
</paragraph><paragraph id="H6DE5640E106F4195B367C1BFDB53E06"><enum>(2)</enum><header>Establishment of
fund</header><text>To be eligible to receive a competitive grant under this
subsection, a State shall establish a qualified health information technology
loan fund (referred to in this subsection as a <quote>State loan fund</quote>)
and comply with the other requirements contained in this subsection. Amounts
received under a grant under this subsection shall be deposited in the State
loan fund established by the State. No funds authorized by other provisions of
this title to be used for other purposes specified in this title shall be
deposited in any such State loan fund.</text>
</paragraph><paragraph id="H5BC0EBC0536D494FBB15BF00A5C7C91"><enum>(3)</enum><header>Eligibility</header><text>To
be eligible to receive a grant under paragraph (1) a State shall—</text>
<subparagraph id="H726481ECF9604BE08600BF92D3B07B48"><enum>(A)</enum><text>submit to the
Secretary an application at such time, in such manner, and containing such
information as the Secretary may require;</text>
</subparagraph><subparagraph id="H25B2BB2D970F470E8BE965A81D62E4C8"><enum>(B)</enum><text>submit to the
Secretary a strategic plan in accordance with paragraph (4);</text>
</subparagraph><subparagraph id="HC3BF546BF59445DF8D9E20F4EF840104"><enum>(C)</enum><text>establish a
qualified health information technology loan fund in accordance with paragraph
(2);</text>
</subparagraph><subparagraph id="H3CF32A1BCA41484E9BAD8E60005CF971"><enum>(D)</enum><text>require that
health care providers receiving loans under the grant—</text>
<clause id="H761F8C56F4014985807E3C1CCD28D6BF"><enum>(i)</enum><text>link, to the
extent practicable, the qualified health information system to a local or
regional health information network;</text>
</clause><clause id="H7BA12E9BF3594AB09487BFCF3BC4AA17"><enum>(ii)</enum><text>consult, as
needed, with the Health Information Technology Resource Center established in
section 914(d) to access the knowledge and experience of existing initiatives
regarding the successful implementation and effective use of health information
technology;</text>
</clause><clause id="H92665D9DB48644CF00F8CE7B538D94"><enum>(iii)</enum><text>agree to notify
individuals if their personal health information is wrongfully disclosed;
and</text>
</clause><clause id="H3059DA2E3B384C709CFA95094F46E380"><enum>(iv)</enum><text>take into account
the input of employees and staff who are directly involved in patient care of
such health care providers in the design and implementation and use of
qualified health information technology systems;</text>
</clause></subparagraph><subparagraph id="H6EAD924D5ECC4301B56901220022F560"><enum>(E)</enum><text>require that
health care providers receiving loans under the grant adopt the standards
adopted by the Federal Government under section 301;</text>
</subparagraph><subparagraph id="H0EBDD41195594816B487E4572C5FFDCF"><enum>(F)</enum><text>require that
health care providers receiving loans under the grant implement the measures
adopted under section 221 and report to the Secretary on such measures;
and</text>
</subparagraph><subparagraph id="H7C080E04995D44A59C58CF5E96E5F8C1"><enum>(G)</enum><text>provide matching
funds in accordance with paragraph (8).</text>
</subparagraph></paragraph><paragraph id="H7FF426E7D98C4E6FB4F653B0E4BCFAC4"><enum>(4)</enum><header>Strategic
plan</header>
<subparagraph id="HB957C28FEEDC4839A0A7CCFAE411200"><enum>(A)</enum><header>In
general</header><text>A State that receives a grant under this subsection shall
annually prepare a strategic plan that identifies the intended uses of amounts
available to the State loan fund of the State.</text>
</subparagraph><subparagraph id="H4E9B8C32F2C8451EB2BB98E19CD1BE4E"><enum>(B)</enum><header>Contents</header><text>A
strategic plan under subparagraph (A) shall include—</text>
<clause id="H8DE477CA29DE493EB820FD6F23D68589"><enum>(i)</enum><text>a
list of the projects to be assisted through the State loan fund in the first
fiscal year that begins after the date on which the plan is submitted;</text>
</clause><clause id="HCB077708D3714173A700D5F3DE5F6523"><enum>(ii)</enum><text>a
description of the criteria and methods established for the distribution of
funds from the State loan fund;</text>
</clause><clause id="HF816C2AA2F234165948950F4D747A5F3"><enum>(iii)</enum><text>a
description of the financial status of the State loan fund and the short-term
and long-term goals of the State loan fund; and</text>
</clause><clause id="HA0FE98F7E436451EA4004EF00B26B84"><enum>(iv)</enum><text>a
description of the strategies the State will use to address challenges in the
adoption of health information technology due to limited broadband
access.</text>
</clause></subparagraph></paragraph><paragraph id="H99A5A60CA81D44D687C065FCE8969109"><enum>(5)</enum><header>Use of
funds</header>
<subparagraph id="HFC7D2D180A09429D86827D38307976D5"><enum>(A)</enum><header>In
general</header><text>Amounts deposited in a State loan fund, including loan
repayments and interest earned on such amounts, shall be used only for awarding
loans or loan guarantees, or as a source of reserve and security for leveraged
loans, the proceeds of which are deposited in the State loan fund established
under paragraph (1). Loans under this section may be used by a health care
provider to—</text>
<clause id="H511233827F4F4EF0B8A338BC9E1D7919"><enum>(i)</enum><text>facilitate the
purchase of qualified health information technology systems;</text>
</clause><clause id="H17A7CD909EA84C1FA979579D56533BA9"><enum>(ii)</enum><text>enhance the
utilization of qualified health information technology systems (which may
include activities to increase the awareness among consumers of health care of
privacy protections and privacy rights); or</text>
</clause><clause id="H1AFA032DC75E4F6FA77796B243F0D632"><enum>(iii)</enum><text>train personnel
in the use of such systems.</text>
</clause></subparagraph><subparagraph id="HAB2AA618D2AB49B6A7FDC7EF6F2B6738"><enum>(B)</enum><header>Limitation</header><text>Amounts
received by a State under this subsection may not be used—</text>
<clause id="HCC570920254D4389AFB28049DB131723"><enum>(i)</enum><text>for
the purchase or other acquisition of any health information technology system
that is not a qualified health information technology system;</text>
</clause><clause id="H7479024688D2402A9CCF00331FB1DD16"><enum>(ii)</enum><text display-inline="yes-display-inline">to conduct activities for which Federal
funds are expended under this title, or the amendments made by this title;
or</text>
</clause><clause id="HB8D9E08093C642FD8483AE14B5E32669"><enum>(iii)</enum><text>for any purpose
other than making loans to eligible entities under this section.</text>
</clause></subparagraph></paragraph><paragraph id="H1965D66C02DC46B7BF4761245B7B2837"><enum>(6)</enum><header>Types of
assistance</header><text>Except as otherwise limited by applicable State law,
amounts deposited into a State loan fund under this subsection may only be used
for the following:</text>
<subparagraph id="HD4E715C94D8C4D30B289A1B174E22000"><enum>(A)</enum><text>To award loans
that comply with the following:</text>
<clause id="H9E1D279C775E4D259457C4789106E414"><enum>(i)</enum><text>The
interest rate for each loan shall be less than or equal to the market interest
rate.</text>
</clause><clause id="H6FC474D5A07E424CBB33EA40AE81C7E"><enum>(ii)</enum><text>The
principal and interest payments on each loan shall commence not later than 1
year after the date on which the loan was awarded, and each loan shall be fully
amortized not later than 10 years after such date.</text>
</clause><clause id="HD07E4BE5278342B1B62E6612D73346A6"><enum>(iii)</enum><text>The State loan
fund shall be credited with all payments of principal and interest on each loan
awarded from the fund.</text>
</clause></subparagraph><subparagraph id="HED040A8EDA4C4765AD7DE7221549655E"><enum>(B)</enum><text>To guarantee, or
purchase insurance for, a local obligation (all of the proceeds of which
finance a project eligible for assistance under this subsection) if the
guarantee or purchase would improve credit market access or reduce the interest
rate applicable to the obligation involved.</text>
</subparagraph><subparagraph id="HA666029450AF4E08BD67C41281BB8F10"><enum>(C)</enum><text>As a source of
revenue or security for the payment of principal and interest on revenue or
general obligation bonds issued by the State if the proceeds of the sale of the
bonds will be deposited into the State loan fund.</text>
</subparagraph><subparagraph id="HEE70D187C46D4818A5B776291FD0C534"><enum>(D)</enum><text>To earn interest
on the amounts deposited into the State loan fund.</text>
</subparagraph></paragraph><paragraph id="H6BA51BFD653F486AA837C1725BEC9984"><enum>(7)</enum><header>Administration
of state loan funds</header>
<subparagraph id="HC11D0B713B7C4FF8B6BB80E39F7360F8"><enum>(A)</enum><header>Combined
financial administration</header><text>A State may (as a convenience and to
avoid unnecessary administrative costs) combine, in accordance with State law,
the financial administration of a State loan fund established under this
subsection with the financial administration of any other revolving fund
established by the State if not otherwise prohibited by the law under which the
State loan fund was established.</text>
</subparagraph><subparagraph id="HB8194B72344C4ADFAE3FD21D4D3B45B"><enum>(B)</enum><header>Cost of
administering fund</header><text>Each State may annually use not to exceed 4
percent of the funds provided to the State under a grant under this subsection
to pay the reasonable costs of the administration of the programs under this
section, including the recovery of reasonable costs expended to establish a
State loan fund which are incurred after the date of enactment of this
title.</text>
</subparagraph><subparagraph id="H7CC633857CF84A66BBAF4EE0AE2C5E1C"><enum>(C)</enum><header>Guidance and
regulations</header><text>The Secretary shall publish guidance and promulgate
regulations as may be necessary to carry out the provisions of this subsection,
including—</text>
<clause id="HA5751540991B499EB7FD94CDB633A175"><enum>(i)</enum><text>provisions to
ensure that each State commits and expends funds allotted to the State under
this subsection as efficiently as possible in accordance with this title and
applicable State laws; and</text>
</clause><clause id="H2F8C1DE86F5F4FDBBC8DD9E938F5C9DA"><enum>(ii)</enum><text>guidance to
prevent waste, fraud, and abuse.</text>
</clause></subparagraph><subparagraph id="H40EC12E2AE5A4C9393B7DC3E2D8062F2"><enum>(D)</enum><header>Private sector
contributions</header>
<clause id="H64171DE220A54C8280CE86D5A2D0EE39"><enum>(i)</enum><header>In
general</header><text>A State loan fund established under this subsection may
accept contributions from private sector entities, except that such entities
may not specify the recipient or recipients of any loan issued under this
subsection.</text>
</clause><clause id="H8FA278C47E7E449000D484C7514F00B6"><enum>(ii)</enum><header>Availability of
information</header><text>A State shall make publicly available the identity
of, and amount contributed by, any private sector entity under clause (i) and
may issue letters of commendation or make other awards (that have no financial
value) to any such entity.</text>
</clause></subparagraph></paragraph><paragraph id="H35348D3F4389495A9DAE28F3585B0033"><enum>(8)</enum><header>Matching
requirements</header>
<subparagraph id="H6F48CA26ED434E1F9526F62745B6ED1F"><enum>(A)</enum><header>In
general</header><text>The Secretary may not make a grant under paragraph (1) to
a State unless the State agrees to make available (directly or through
donations from public or private entities) non-Federal contributions in cash
toward the costs of the State program to be implemented under the grant in an
amount equal to not less than $1 for each $1 of Federal funds provided under
the grant.</text>
</subparagraph><subparagraph id="H0B4512DA789E497CABA80227737F1575"><enum>(B)</enum><header>Determination of
amount of non-federal contribution</header><text>In determining the amount of
non-Federal contributions that a State has provided pursuant to subparagraph
(A), the Secretary may not include any amounts provided to the State by the
Federal Government.</text>
</subparagraph></paragraph><paragraph id="H22CF753F424A41DF80295FE2EF98F2CA"><enum>(9)</enum><header>Preference in
awarding grants</header><text>The Secretary may give a preference in awarding
grants under this subsection to States that adopt value-based purchasing
programs to improve health care quality.</text>
</paragraph><paragraph id="HA1219833842F473EBFA91BF62E237CF5"><enum>(10)</enum><header>Reports</header><text>The
Secretary shall annually submit to the Committee on Health, Education, Labor,
and Pensions and the Committee on Finance of the Senate, and the Committee on
Energy and Commerce and the Committee on Ways and Means of the House of
Representatives, a report summarizing the reports received by the Secretary
from each State that receives a grant under this subsection.</text>
</paragraph></subsection><subsection id="H58B2777929DA44A2BB1C688F96D7576E"><enum>(c)</enum><header>Competitive
Grants for the Implementation of Regional or Local Health Information
Technology Plans</header>
<paragraph id="H8004F2413AF442399334DC9724D5F3A2"><enum>(1)</enum><header>In
general</header><text>The Secretary may award competitive grants to eligible
entities to implement regional or local health information plans to improve
health care quality and efficiency through the electronic exchange of personal
health information pursuant to the standards, implementation specifications and
certification criteria, and other requirements adopted by the Secretary under
section 221.</text>
</paragraph><paragraph id="H5DA1D356EF79498FB02E2FB138CB5632"><enum>(2)</enum><header>Eligibility</header><text display-inline="yes-display-inline">To be eligible to receive a grant under
paragraph (1) an entity, which may be a health record bank or trust,
shall—</text>
<subparagraph id="H394AEE7A6B3147A98235B84466C5225B"><enum>(A)</enum><text>demonstrate
financial need to the Secretary;</text>
</subparagraph><subparagraph id="H9DD3FE24777F44F8BB4CBBC1B5DD5E5D"><enum>(B)</enum><text>demonstrate that
one of its principal missions or purposes is to use information technology to
improve health care quality and efficiency;</text>
</subparagraph><subparagraph id="HA8601CCDE7844DF4852209BEB47CBA3E"><enum>(C)</enum><text>adopt bylaws,
memoranda of understanding, or other charter documents that demonstrate that
the governance structure and decision making processes of such entity allow for
participation on an ongoing basis by multiple stakeholders within a community,
including—</text>
<clause id="H370B5076B21C4F81B43973A27C549E02"><enum>(i)</enum><text>health care
providers (including health care providers that provide services to low income
and undeserved populations);</text>
</clause><clause id="HA5B24CE5AEE445DAB15F7C4F6CB0B546"><enum>(ii)</enum><text>pharmacists or
pharmacies;</text>
</clause><clause id="H39CD13861E8040FCBF31009897467E66"><enum>(iii)</enum><text>health
plans;</text>
</clause><clause id="H4A6071A9ED3644B6AD857DA7871858D2"><enum>(iv)</enum><text>health centers
(as defined in section 330(b)) and federally qualified health centers (as
defined in section 1861(aa)(4) of the Social Security Act) and rural health
clinics (as defined in section 1861(aa) of the Social Security Act), if such
centers or clinics are present in the community served by the entity;</text>
</clause><clause id="H37E1DB1D7B7F41F29BD0F8C294CDEE04"><enum>(v)</enum><text>patient or
consumer organizations;</text>
</clause><clause id="H8533F528DD4B403EAEC3481798E47135"><enum>(vi)</enum><text>organizations
dedicated to improving the health of vulnerable populations;</text>
</clause><clause id="HBCC1CFBACB974ABDA0B7511972B15800"><enum>(vii)</enum><text>employers;</text>
</clause><clause id="H522768E268F147ADA2AEE7E364C9C1DD"><enum>(viii)</enum><text>State or local
health departments; and</text>
</clause><clause id="H59247E711FCD4994BF62F2005D24F7D"><enum>(ix)</enum><text>any
other health care providers or other entities, as determined appropriate by the
Secretary;</text>
</clause></subparagraph><subparagraph id="H84C4EF0E4EAD4AE79391355800837641"><enum>(D)</enum><text>demonstrate the
participation, to the extent practicable, of stakeholders in the electronic
exchange of personal health information within the local or regional plan
pursuant to subparagraph (C);</text>
</subparagraph><subparagraph id="H216D878529A0498A8850929600009B87"><enum>(E)</enum><text>adopt
nondiscrimination and conflict of interest policies that demonstrate a
commitment to open, fair, and nondiscriminatory participation in the health
information plan by all stakeholders;</text>
</subparagraph><subparagraph id="H990E19987BAE4E0E9BCDE6C444D7F038"><enum>(F)</enum><text>adopt the
standards adopted by the Secretary under section 301;</text>
</subparagraph><subparagraph id="H4C8F726D15204EEDB86FB6FCA7A81F67"><enum>(G)</enum><text>require that
health care providers receiving such grants—</text>
<clause id="H7C38CF93A33F4900A09B47A37E901200"><enum>(i)</enum><text>implement the
measures adopted under section 221 and report to the Secretary on such
measures; and</text>
</clause><clause id="H2A2365793C2D4594A827AD712C8E875B"><enum>(ii)</enum><text>take into account
the input of employees and staff who are directly involved in patient care of
such health care providers in the design, implementation, and use of health
information technology systems;</text>
</clause></subparagraph><subparagraph id="HDBE196EFBF174AE9B527CFE5A36C5BB1"><enum>(H)</enum><text display-inline="yes-display-inline">agree to comply with the requirements of
title I;</text>
</subparagraph><subparagraph id="H9482FEF0765C4FEEB42B008D341DFDA"><enum>(I)</enum><text>facilitate the
electronic exchange of personal health information within the local or regional
area and among local and regional areas;</text>
</subparagraph><subparagraph id="H0131D69841FC408788CBF279E39B207B"><enum>(J)</enum><text>prepare and submit
to the Secretary an application in accordance with paragraph (3);</text>
</subparagraph><subparagraph id="H2725A280774942740097E86C00BC811C"><enum>(K)</enum><text>agree to provide
matching funds in accordance with paragraph (5); and</text>
</subparagraph><subparagraph id="H011323AE703743D4A6F0EE6915C92D2C"><enum>(L)</enum><text>reduce barriers to
the implementation of health information technology by providers.</text>
</subparagraph></paragraph><paragraph id="H80F8AAEDD52E42C2A42288AEED68EF60"><enum>(3)</enum><header>Application</header>
<subparagraph id="H9683ED7EECAA416BBA6DF823EC85F6FA"><enum>(A)</enum><header>In
general</header><text>To be eligible to receive a grant under paragraph (1), an
entity shall submit to the Secretary an application at such time, in such
manner, and containing such information as the Secretary may require.</text>
</subparagraph><subparagraph id="H3FA9BAFF8D244A83BF3D6598A8902F36"><enum>(B)</enum><header>Required
information</header><text>At a minimum, an application submitted under this
paragraph shall include—</text>
<clause id="HC7B25F86020E48BBBE8CF8F73DB4F697"><enum>(i)</enum><text>clearly identified
short-term and long-term objectives of the regional or local health information
plan;</text>
</clause><clause id="H4E69D0C7AB6F4C38BA80C8B0429B6520"><enum>(ii)</enum><text>a
technology plan that complies with the standards, implementation
specifications, and certification criteria adopted under section 202(c)(6) and
that includes a descriptive and reasoned estimate of costs of the hardware,
software, training, and consulting services necessary to implement the regional
or local health information plan;</text>
</clause><clause id="H3CFCACAF604D4078AB03A30500A9EE00"><enum>(iii)</enum><text>a
strategy that includes initiatives to improve health care quality and
efficiency, including the use and reporting of health care quality measures
adopted under section 221;</text>
</clause><clause display-inline="no-display-inline" id="H0A0BA8839BBF4246A664762224DC405C"><enum>(iv)</enum><text>a plan that
describes provisions to encourage the implementation of the electronic exchange
of personal health information by all health care providers participating in
the health information plan;</text>
</clause><clause id="HC73752F6AAB340F082053011BEB6B17D"><enum>(v)</enum><text display-inline="yes-display-inline">a plan to ensure the privacy and security
of personal health information that is consistent with the requirements of
title I;</text>
</clause><clause id="HEC21F8646F794CF289C2CFD51806E69F"><enum>(vi)</enum><text>a
governance plan that defines the manner in which the stakeholders shall jointly
make policy and operational decisions on an ongoing basis;</text>
</clause><clause id="H9A27462D051B4F66B5542EC3489E96D6"><enum>(vii)</enum><text>a
financial or business plan that describes—</text>
<subclause id="HFD90F1744C954C1190AFA4FAB5E5D766"><enum>(I)</enum><text>the sustain
ability of the plan;</text>
</subclause><subclause id="H0F23D3CBD45F4DAFAE508FB4501005B"><enum>(II)</enum><text>the financial
costs and benefits of the plan; and</text>
</subclause><subclause id="H0576901DC76546B6B2519E685FDA2CDF"><enum>(III)</enum><text>the entities to
which such costs and benefits will accrue;</text>
</subclause></clause><clause id="HC1035427357F4508954633B515BB00B9"><enum>(viii)</enum><text>a
description of whether the State in which the entity resides has received a
grant under section 319D of the Public Health Service Act, alone or as a part
of a consortium, and if the State has received such a grant, how the entity
will coordinate the activities funded under such section 319D with the system
under this section; and</text>
</clause><clause id="HA2065D11B1094A5CB4D6CC81B518393E"><enum>(ix)</enum><text>in
the case of an applicant entity that is unable to demonstrate the participation
of all stakeholders pursuant to paragraph (2)(C), the justification from the
entity for any such nonparticipation.</text>
</clause></subparagraph></paragraph><paragraph id="H224E2BDC8165467D8E0065E453C0C3FB"><enum>(4)</enum><header>Use of
funds</header><text>Amounts received under a grant under paragraph (1) shall be
used to establish and implement a regional or local health information plan in
accordance with this subsection.</text>
</paragraph><paragraph id="HC94DCF51370448DB003E080900209E1E"><enum>(5)</enum><header>Matching
requirement</header>
<subparagraph id="HB063A821555E46AF8849BE5E02598351"><enum>(A)</enum><header>In
general</header><text>The Secretary may not make a grant under this subsection
to an entity unless the entity agrees that, with respect to the costs to be
incurred by the entity in carrying out the network program for which the grant
was awarded, the entity will make available (directly or through donations from
public or private entities) non-Federal contributions toward such costs in an
amount equal to not less than 50 percent of such costs ($1 for each $2 of
Federal funds provided under the grant).</text>
</subparagraph><subparagraph id="H92FA36FB624C424EB0A1B350BCB1D4A3"><enum>(B)</enum><header>Determination of
amount contributed</header><text>Non-Federal contributions required under
subparagraph (A) may be in cash or in kind, fairly evaluated, including
equipment, technology, or services. Amounts provided by the Federal Government,
or services assisted or subsidized to any significant extent by the Federal
Government, may not be included in determining the amount of such non-Federal
contributions.</text>
</subparagraph></paragraph><paragraph id="HCD7F9F5F8A184FC8823B20299B003C00"><enum>(6)</enum><header>Health record
bank or trust defined</header><text display-inline="yes-display-inline">In this
section, the term <quote>health record bank or trust</quote> means an
independent organization that provides a secure electronic repository for
storing and maintaining an individual’s lifetime health and medical records
from multiple sources and ensuring that the individual always has complete
control over who accesses their information.</text>
</paragraph></subsection><subsection id="H7B6AD4F6300049FB83E1F9325825797B"><enum>(d)</enum><header>Reports</header><text>Not
later than 1 year after the date on which the first grant is awarded under this
section, and annually thereafter during the grant period, an entity that
receives a grant under this section shall submit to the Secretary a report on
the activities carried out under the grant involved. Each such report shall
include—</text>
<paragraph id="HE2282896965548268B3FCD071D13896"><enum>(1)</enum><text>a
description of the financial costs and benefits of the project involved and of
the entities to which such costs and benefits accrue;</text>
</paragraph><paragraph id="H1E4977CD44B444A2BCAF898DAEE71EF6"><enum>(2)</enum><text>an analysis of the
impact of the project on health care quality and safety;</text>
</paragraph><paragraph id="HE452028F7F5B4D71A0A9E037B54C3277"><enum>(3)</enum><text>a
description of any reduction in duplicative or unnecessary care as a result of
the project involved; and</text>
</paragraph><paragraph id="HFDAF5485D7544BD70082C6F51CBB3EBF"><enum>(4)</enum><text>other information
as required by the Secretary.</text>
</paragraph></subsection><subsection id="HD9FDA488E0AD452DBF1D9825B0B6DE95"><enum>(e)</enum><header>Authorization of
Appropriations</header>
<paragraph id="H88C42FC0BEF94FB1B1F95BFE7318C9F"><enum>(1)</enum><header>In
general</header><text>For the purpose of carrying out this section, there is
authorized to be appropriated $139,000,000 for fiscal year 2009 and
$139,000,000 for fiscal year 2010.</text>
</paragraph><paragraph id="HFDA3BF59560C4939B2CB2F935DB9CCE7"><enum>(2)</enum><header>Availability</header><text>Amounts
appropriated under paragraph (1) shall remain available through fiscal year
2012.</text>
</paragraph></subsection></section><section id="H62743CC65A6645E19677690873A40051"><enum>212.</enum><header>Demonstration
program to integrate information technology into clinical education</header>
<subsection id="H72F3C5C0E1A74B24A3FA9BF0E65FE8A5"><enum>(a)</enum><header>In
General</header><text>The Secretary may award grants to eligible entities or
consortia under this section to carry out demonstration projects to develop
academic curricula integrating qualified health information technology systems
in the clinical education of health professionals or analyze clinical data sets
to discover quality measures. Such awards shall be made on a competitive basis
and pursuant to peer review.</text>
</subsection><subsection id="HE265924F48914858A2A6B6C9DDE09063"><enum>(b)</enum><header>Eligibility</header><text>To
be eligible to receive a grant under subsection (a), an entity or consortium
shall—</text>
<paragraph id="H88596A86193A46BD846C50A5E9596F43"><enum>(1)</enum><text>submit to the
Secretary an application at such time, in such manner, and containing such
information as the Secretary may require;</text>
</paragraph><paragraph id="HDBCE2E768CC845AAB49B43A212CA3847"><enum>(2)</enum><text>be or
include—</text>
<subparagraph id="H3E19DA6B575E46068907F49F1458DBA8"><enum>(A)</enum><text>a health
professions school;</text>
</subparagraph><subparagraph id="H815542D0F82644F78525331900572931"><enum>(B)</enum><text>a school of
nursing; or</text>
</subparagraph><subparagraph id="H2BDF582FBF084E1A96F17D37C6B771F2"><enum>(C)</enum><text>an institution
with a graduate medical education program;</text>
</subparagraph></paragraph><paragraph id="H5853BB430B5A42D300E88D4DDF00F647"><enum>(3)</enum><text>provide for the
collection of data regarding the effectiveness of the demonstration project to
be funded under the grant in improving the safety of patients and the
efficiency of health care delivery; and</text>
</paragraph><paragraph id="H06E498BB58A84B54B1A6EA6C5162F640"><enum>(4)</enum><text>provide matching
funds in accordance with subsection (d).</text>
</paragraph></subsection><subsection id="HBFFB31F329394C8E9BBB16C644C4BBA3"><enum>(c)</enum><header>Use of
Funds</header>
<paragraph id="H9ED8E24D91FE492AB2CACC443EA69767"><enum>(1)</enum><header>In
general</header><text>With respect to a grant under subsection (a), an eligible
entity or consortium shall use amounts received under the grant in
collaboration with 2 or more disciplines.</text>
</paragraph><paragraph id="H7C6AF6B6EBF7447CA5973F4C78F0E73B"><enum>(2)</enum><header>Limitation</header><text>An
eligible entity or consortium shall not award a grant under subsection (a) to
purchase hardware, software, or services.</text>
</paragraph></subsection><subsection id="HD5D8116E55C746F5BF8C6CDD873DD2DC"><enum>(d)</enum><header>Matching
Funds</header>
<paragraph id="H3BA54AEB8B4B491288E73EB2E4AA7BF1"><enum>(1)</enum><header>In
general</header><text>The Secretary may award a grant to an entity under or
consortium this section only if the entity of consortium agrees to make
available non-Federal contributions toward the costs of the program to be
funded under the grant in an amount that is not less than $1 for each $2 of
Federal funds provided under the grant.</text>
</paragraph><paragraph id="H44F1D8121E09464BA1AAA10048439FB4"><enum>(2)</enum><header>Determination of
amount contributed</header><text>Non-Federal contributions under paragraph (1)
may be in cash or in kind, fairly evaluated, including equipment or services.
Amounts provided by the Federal Government, or services assisted or subsidized
to any significant extent by the Federal Government, may not be included in
determining the amount of such contributions.</text>
</paragraph></subsection><subsection id="HA633AF15A17D47BD96C515109704A381"><enum>(e)</enum><header>Evaluation</header><text>The
Secretary shall take such action as may be necessary to evaluate the projects
funded under this section and publish, make available, and disseminate the
results of such evaluations on as wide a basis as is practicable.</text>
</subsection><subsection id="H9DD3F0C2CF314CCBB4F2A96212F85424"><enum>(f)</enum><header>Reports</header><text>Not
later than 1 year after the date of enactment of this title, and annually
thereafter, the Secretary shall submit to the Committee on Health, Education,
Labor, and Pensions and the Committee on Finance of the Senate, and the
Committee on Energy and Commerce and the Committee on Ways and Means of the
House of Representatives a report that—</text>
<paragraph id="H57580E9F5D4A4C0F80F080D3F9223B91"><enum>(1)</enum><text>describes the
specific projects established under this section; and</text>
</paragraph><paragraph id="H85414D329BC8429990A921A000C909B2"><enum>(2)</enum><text>contains
recommendations for Congress based on the evaluation conducted under subsection
(e).</text>
</paragraph></subsection><subsection id="HC6675EDB0D5240C9B1933676838D87D2"><enum>(g)</enum><header>Authorization of
Appropriations</header><text>There is authorized to be appropriated to carry
out this section, $2,000,000 for each of fiscal years 2009 and 2010.</text>
</subsection><subsection id="H84D0BACF6E04467E8639D076598FAE43"><enum>(h)</enum><header>Sunset</header><text>This
provisions of this section shall not apply after September 30, 2012.</text>
</subsection></section><section display-inline="no-display-inline" id="HAF997693B3AC4DCAB8E6C2035E2860EC"><enum>213.</enum><header>Qualified
health information technology system defined</header><text display-inline="no-display-inline">In this subtitle, the term <quote>qualified
health information technology system</quote> means a computerized system
(including hardware and software) that—</text>
<paragraph id="HAE609BAB5A5A42B3896B8C2758E855E"><enum>(1)</enum><text>safeguards the
privacy, security, and confidentiality of personal health information in
accordance with the requirements of title I;</text>
</paragraph><paragraph id="H606F5B7933784C798F775969499813CC"><enum>(2)</enum><text>maintains and
provides permitted access to health information in an electronic format;</text>
</paragraph><paragraph id="H81CCC5041B7942938F790095939B7C60"><enum>(3)</enum><text>with respect to
personal health information maintained in a designated record set, preserves an
audit trail of each individual that has gained access to such record
set;</text>
</paragraph><paragraph id="H96F034F5506F4E7DB2C502003E247F96"><enum>(4)</enum><text>incorporates
decision support to reduce medical errors and enhance health care
quality;</text>
</paragraph><paragraph id="H45333D22124D41B0B735D6D4F0C2EC44"><enum>(5)</enum><text>complies with the
standards adopted by the Federal Government under section 202;</text>
</paragraph><paragraph id="HA09D29222FC047EF8E76FFD2D3A804E9"><enum>(6)</enum><text>has the ability to
transmit and exchange information to other health information technology
systems and, to the extent feasible, public health information technology
systems; and</text>
</paragraph><paragraph id="H2F06E08D63DC4D13B98BD9CE0EFF227"><enum>(7)</enum><text>allows for the
reporting of quality measures adopted under section 221.</text>
</paragraph></section></subtitle><subtitle id="H11A632B39B704FECA59F5C000039CE1C"><enum>C</enum><header>Improving the
Quality of Health Care</header>
<section id="H70F73609D9714B2DB71EE70055FD293D"><enum>221.</enum><header>Fostering
development and use of health care quality measures</header>
<subsection id="HF8049FC24E6A44E2A34ECDD7EE2962EB"><enum>(a)</enum><header>In
General</header><text>The Secretary shall provide for the development and use
of health care quality measures (referred to in this title as <quote>quality
measures</quote>) for the purpose of measuring the quality and efficiency of
health care that patients receive.</text>
</subsection><subsection id="H9D6511382EE84E60A2FBA0B6BCAF39F"><enum>(b)</enum><header>Designation of,
and Arrangement With, Organization</header>
<paragraph id="H839209BDA9F844EC9C1D72FDBE3CE4D3"><enum>(1)</enum><header>In
general</header><text>Not later than 90 days after the date of enactment of
this title, the Secretary shall designate, and have in effect an arrangement
with, a single organization that meets the requirements of subsection (c) under
which such organization shall promote the development of quality measures and
provide the Secretary with advice and recommendations on the key elements and
priorities of a national system for healthcare performance measurement.</text>
</paragraph><paragraph id="H30EC598FC5B04C15003C1436B4F666C"><enum>(2)</enum><header>Responsibilities</header><text>The
responsibilities to be performed by the organization designated under paragraph
(1) (in this title referred to as the <quote>designated organization</quote>)
shall include—</text>
<subparagraph id="H8E1E80B3DCAF4BE4A265391BFBD513D"><enum>(A)</enum><text>establishing and
managing an integrated national strategy and process for setting priorities and
goals in establishing quality measures;</text>
</subparagraph><subparagraph id="H20D391C7BD6C4EEFB7A7A0065A037CA"><enum>(B)</enum><text>coordinating and
harmonizing the development and testing of such measures;</text>
</subparagraph><subparagraph id="H4E601C65EE7D4E35B563C47167D53758"><enum>(C)</enum><text>establishing
standards for the development and testing of such measures;</text>
</subparagraph><subparagraph id="HB4DB85B39266478898029E4575F64D5D"><enum>(D)</enum><text>endorsing national
consensus quality measures;</text>
</subparagraph><subparagraph id="HBED04ACDEFF04DB893A725E52E79694"><enum>(E)</enum><text>recommending, in
collaboration with multi-stakeholder groups, quality measures to the Secretary
for adoption and use;</text>
</subparagraph><subparagraph id="H86A80F2505CB4DBA944B3B85E66CCBCC"><enum>(F)</enum><text>promoting the
development and use of electronic health records that contain the functionality
for automated collection, aggregation, and transmission of performance
measurement information; and</text>
</subparagraph><subparagraph id="HC73BB48019C54C5CB0195551B86EA0E8"><enum>(G)</enum><text>providing
recommendations and advice to the Partnership for Health Care Improvement
regarding the integration of quality measures into the certification process
outlined under section 202 and the American Health Information Community
regarding national policies outlined under section 203.</text>
</subparagraph></paragraph></subsection><subsection id="HB52956D925A345BD9201D3741F28E73D"><enum>(c)</enum><header>Requirements
Described</header><text>The requirements described in this subsection are the
following:</text>
<paragraph id="H7AF91C7BF14D4B0594B44E28FE5C9EE9"><enum>(1)</enum><header>Private
entity</header><text>The organization shall be a private nonprofit entity that
is governed by a board of directors and an individual who is designated as
president and chief executive officer.</text>
</paragraph><paragraph id="H9F51191AACFE4AFCACA9B5BDD7C9F8EE"><enum>(2)</enum><header>Board
membership</header><text>The members of the board of directors of the entity
shall include representatives of—</text>
<subparagraph id="HCBCBABBB17D5415399C52EB5B1777DF"><enum>(A)</enum><text>health care
providers or groups representing providers;</text>
</subparagraph><subparagraph id="H71969E0D687F44FC857E437D889B5110"><enum>(B)</enum><text>health plans or
groups representing health plans;</text>
</subparagraph><subparagraph id="H88CF0E7F02A94CD1BF82959BB8F9DDD9"><enum>(C)</enum><text>patients or
consumers enrolled in such plans or groups representing individuals enrolled in
such plans;</text>
</subparagraph><subparagraph id="H49A8E6A977554A23911C0064CFB514EC"><enum>(D)</enum><text>health care
purchasers and employers or groups representing purchasers or employers;
and</text>
</subparagraph><subparagraph id="H64CB5095A1D24746A114DE91A9214515"><enum>(E)</enum><text>organizations that
develop health information technology standards and new health information
technology.</text>
</subparagraph></paragraph><paragraph id="H0BD6795933144EF086EC4B2EC6CD1157"><enum>(3)</enum><header>Other membership
requirements</header><text>The membership of the board of directors of the
entity shall be representative of individuals with experience with—</text>
<subparagraph id="HC41A101F857741E8A113F2FBFC1186D"><enum>(A)</enum><text>urban health care
issues;</text>
</subparagraph><subparagraph id="H4FDA579CD1C442380082A7E000CE6E00"><enum>(B)</enum><text>safety net health
care issues;</text>
</subparagraph><subparagraph id="HB977FA8894D54119AE1D64D052F7AC4F"><enum>(C)</enum><text>rural or frontier
health care issues;</text>
</subparagraph><subparagraph id="H98AE2AC0D2904C8F00688BC6FEDD1800"><enum>(D)</enum><text>quality and safety
issues;</text>
</subparagraph><subparagraph id="HB5F159F930034BC694581FBB12784D21"><enum>(E)</enum><text>State or local
health programs;</text>
</subparagraph><subparagraph id="H9018467F6477427AB9B8427FEF789ECB"><enum>(F)</enum><text>individuals or
entities skilled in the conduct and interpretation of biomedical, health
services, and health economics research and with expertise in outcomes and
effectiveness research and technology assessment;</text>
</subparagraph><subparagraph id="HBC5A4302E5CC49BFA51FA77035A51100"><enum>(G)</enum><text>individuals or
entities involved in the development and establishment of standards and
certification for health information technology systems and clinical data;
and</text>
</subparagraph><subparagraph id="HFCAE5F4ABDCF44CCA5EC14A920045F3"><enum>(H)</enum><text display-inline="yes-display-inline">members of the medical and mental health
professions with expertise in standards of professional ethics.</text>
</subparagraph></paragraph><paragraph id="H8A7DD1685E4C4AF281B6AC7255E245C"><enum>(4)</enum><header>Open and
transparent</header><text>With respect to matters related to the arrangement
with the Secretary under subsection (a)(1), the organization shall conduct its
business in an open and transparent manner, and provide the opportunity for
public comment and ensure a balance among disparate stakeholders, so that no
member organization unduly influences the work of the organization.</text>
</paragraph><paragraph id="H632DB9063EDA44A5AAF268A09795F069"><enum>(5)</enum><header>Voluntary
consensus standards setting organizations</header><text>The organization shall
operate as a voluntary consensus standards setting organization as defined for
purposes of section 12(d) of the National Technology Transfer and Advancement
Act of 1995 (<external-xref legal-doc="public-law" parsable-cite="pl/104/113">Public Law 104–113</external-xref>) and Office of Management and Budget Revised
Circular A–119 (published in the Federal Register on February 10, 1998).</text>
</paragraph><paragraph id="HAD868A70B39D488095F39F895EFEFB16"><enum>(6)</enum><header>Participation</header><text>If
the organization requires a fee for membership, the organization shall ensure
that such fee is not a substantial barrier to participation in the entity’s
activities related to the arrangement with the Secretary.</text>
</paragraph></subsection><subsection id="H75DA9862413C49C89ECFFA1D4FBDA36"><enum>(d)</enum><header>Requirements for
Measures</header><text>The quality measures developed under this title shall
comply with the following:</text>
<paragraph id="H16FB95A11E914CFFA242E9E01D1D0038"><enum>(1)</enum><header>Measures</header><text>The
designated organization, in promoting the development of quality measures under
this title, shall ensure that such measures—</text>
<subparagraph id="HAE8ABE53D1244F47A519B00F9BFF959"><enum>(A)</enum><text>are evidence-based,
reliable, and valid;</text>
</subparagraph><subparagraph id="HFCCC9E141D2B470AA005E91C8DC5516F"><enum>(B)</enum><text>include—</text>
<clause id="H04FCEF61611E4553B464F7BA13007D1C"><enum>(i)</enum><text>measures of
clinical processes and outcomes, patient experience, efficiency, and equity;
and</text>
</clause><clause id="H4044052E49204987A3D26D75122569D5"><enum>(ii)</enum><text>measures to
assess effectiveness, timeliness, patient self-management, patient
centeredness, and safety; and</text>
</clause></subparagraph><subparagraph id="H18AED9888C9B40AAA8381703F8A72D9D"><enum>(C)</enum><text>include measures
of underuse and overuse.</text>
</subparagraph></paragraph><paragraph id="H7A22A4D035A04DDEA02C4C60FFC6FE3F"><enum>(2)</enum><header>Priorities</header><text>In
carrying out its responsibilities under this section, the designated
organization shall ensure that priority is given to—</text>
<subparagraph id="HEF69C936561F478F9E6B8DFB5B3981F9"><enum>(A)</enum><text display-inline="yes-display-inline">measures that preserve access to quality
health care by protecting the privacy and security of personal health
information;</text>
</subparagraph><subparagraph id="H60373A61F24441B9BA455F555423904B"><enum>(B)</enum><text>measures with the
greatest potential impact for improving the performance and efficiency of
care;</text>
</subparagraph><subparagraph id="H1055FFC5E8D845F387819B28A4AD3018"><enum>(C)</enum><text>measures that may
be rapidly implemented by group health plans, health insurance issuers,
physicians, hospitals, nursing homes, long-term care providers, and other
providers;</text>
</subparagraph><subparagraph id="HB9AA9322A0B74F4900FC61B1B2B6A3E3"><enum>(D)</enum><text>measures which may
inform health care decisions made by consumers and patients;</text>
</subparagraph><subparagraph id="HD9AD6C2696114CAEB100907190F4FCC"><enum>(E)</enum><text>measures that apply
to multiple services furnished by different providers during an episode of
care;</text>
</subparagraph><subparagraph id="HC50BE9D48D18403895EEC3FCDBC53952"><enum>(F)</enum><text>measures that can
be integrated into certification process described in section 202; and</text>
</subparagraph><subparagraph id="HC2C003F5041C44A197C54F1324EF3240"><enum>(G)</enum><text>measures that may
be integrated into the decision support function of qualified health
information technology as defined by this title.</text>
</subparagraph></paragraph><paragraph id="H5509718A995343AB84C8EFEDFB00FF50"><enum>(3)</enum><header>Risk
adjustment</header><text>The designated organization, in consultation with
performance measure developers and other stakeholders, shall establish
procedures to ensure that quality measures take into account differences in
patient health status, patient characteristics, and geographic location, as
appropriate.</text>
</paragraph><paragraph id="H25B45E2839184AAABE6E5DBB73A58C6F"><enum>(4)</enum><header>Maintenance</header><text>The
designated organization, in consultation with owners and developers of quality
measures, shall require the owners or developers of quality measures to update
and enhance such measures, including the development of more accurate and
precise specifications, and retire existing outdated measures. Such updating
shall occur not more often than once during each 12-month period, except in the
case of emergency circumstances requiring a more immediate update to a
measure.</text>
</paragraph></subsection><subsection id="H3BF1ABFC9017437AA0EED862BC9747A6"><enum>(e)</enum><header>Grants for
Performance Measure Development</header><text>The Secretary, acting through the
Agency for Healthcare Research and Quality, may award grants, in amounts not to
exceed $50,000 each, to organizations to support the development and testing of
quality measures that meet the standards established by the designated
organization.</text>
</subsection></section><section id="H5E29915DB49348CDA18CCB02829993E9"><enum>222.</enum><header>Adoption and
use of quality measures; reporting</header>
<subsection id="H84B011D97405479096EE1C92190297DD"><enum>(a)</enum><header>In
General</header><text>For purposes of carrying out activities authorized or
required by this title to ensure the use of quality measures and to foster
uniformity between health care quality measures utilized by private entities,
the Secretary shall—</text>
<paragraph id="HC75D22E15B5F433184232B86009B3B4F"><enum>(1)</enum><text>select quality
measures for adoption and use, from quality measures recommended by
multi-stakeholder groups and endorsed by the designated organization;
and</text>
</paragraph><paragraph id="HABC3A40CC5F0452DA11DBA3128D96FA6"><enum>(2)</enum><text>ensure that
standards adopted under section 301 integrate the quality measures endorsed,
adopted, and utilized under this section.</text>
</paragraph></subsection><subsection id="H689C60B0D31D4D298CD7A09473A43DC6"><enum>(b)</enum><header>Relationship
With Programs Under the Social Security Act</header><text>The Secretary shall
ensure that the quality measures adopted under this section—</text>
<paragraph id="HCE7A5FDA5290430DA747BA9D0285F509"><enum>(1)</enum><text>complement quality
measures developed by the Secretary under programs administered by the
Secretary under the Social Security Act, including programs under titles XVIII,
XIX, and XXI of such Act; and</text>
</paragraph><paragraph id="H6C3A8C8F17EB4563B22CCA399DF66CC7"><enum>(2)</enum><text>do not conflict
with the needs and priorities of the programs under titles XVIII, XIX, and XXI
of such Act, as set forth by the Administrator of the Centers for Medicare
& Medicaid Services.</text>
</paragraph></subsection><subsection id="H598F0474910A4402A9719B4C84AFED48"><enum>(c)</enum><header>Reporting</header><text>The
Secretary shall implement procedures, consistent with generally accepted
standards, to enable the Department of Health and Human Services to accept the
electronic submission of data for purposes of performance measurement,
including at the provider level, using the quality measures developed,
endorsed, and adopted pursuant to this title.</text>
</subsection><subsection id="H8A680062E87B4A65BA988B2637FAE600"><enum>(d)</enum><header>Dissemination of
Information</header><text>In order to make comparative performance information
available to health care consumers, health professionals, public health
officials, oversight organizations, researchers, and other appropriate
individuals and entities, after consultation with multi-stakeholder groups, the
Secretary shall promulgate regulations to provide for the dissemination,
aggregation, and analysis of quality measures collected pursuant to this
title.</text>
</subsection></section></subtitle><subtitle id="H8F54457451924B1E85CADA9EF20964CF"><enum>D</enum><header>Miscellaneous
Provisions</header>
<section id="H55EA41F5A21A4C28969F813CB4F0474C"><enum>231.</enum><header>Health
Information Technology Resource Center</header><text display-inline="no-display-inline">Section 914 of the Public Health Service Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/299b-3">42 U.S.C. 299b–3</external-xref>) is amended by adding at the end the following:</text>
<quoted-block id="H317DA20A960944F9857E46492B3183F9" style="OLC">
<subsection id="H025C9C5CA9FE4EEBA07CB2B424F9B93"><enum>(d)</enum><header>Health
Information Technology Resource Center</header>
<paragraph id="H596383DB1A6B4D12BC1BF98DF2817D50"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">The Secretary, acting
through the Director, shall develop a Health Information Technology Resource
Center (referred to in this subsection as the <quote>Center</quote>) to provide
technical assistance and develop best practices to support and accelerate
efforts to adopt, implement, and effectively use interoperable health
information technology in compliance with sections 202 and 221 of the TRUST in
Health Information Act of 2008.</text>
</paragraph><paragraph id="HF2EB366D11364180AC406C3FACFD4F00"><enum>(2)</enum><header>Purposes</header><text>The
purposes of the Center are to—</text>
<subparagraph id="HD5BFAA203B814502B1ECFE8FCE86A3FB"><enum>(A)</enum><text>provide a forum
for the exchange of knowledge and experience;</text>
</subparagraph><subparagraph id="H13EB14DC4B2C42D4A159687541F4B33E"><enum>(B)</enum><text>accelerate the
transfer of lessons learned from existing public and private sector
initiatives, including those currently receiving Federal financial
support;</text>
</subparagraph><subparagraph id="HC26C7302A53E49B3A0085C5FF3C9A816"><enum>(C)</enum><text>assemble, analyze,
and widely disseminate evidence and experience related to the adoption,
implementation, and effective use of interoperable health information
technology;</text>
</subparagraph><subparagraph id="H5CEC6CA2FAD8413B0026E09277B267AB"><enum>(D)</enum><text>provide for the
establishment of regional and local health information networks to facilitate
the development of interoperability across health care settings and improve the
quality of health care;</text>
</subparagraph><subparagraph id="HA3056C7547E24187BC4EA70097288F84"><enum>(E)</enum><text>provide for the
development of solutions to barriers to the exchange of electronic health
information; and</text>
</subparagraph><subparagraph id="HFFE11D4AFCD24B71B6FC46DC98EC00C2"><enum>(F)</enum><text>conduct other
activities identified by the States, local, or regional health information
networks, or health care stakeholders as a focus for developing and sharing
best practices.</text>
</subparagraph></paragraph><paragraph id="H42B30B35A3AD44F9BA1FB7E850649B4B"><enum>(3)</enum><header>Support for
activities</header><text>To provide support for the activities of the Center,
the Director shall modify the requirements, if necessary, that apply to the
National Resource Center for Health Information Technology to provide the
necessary infrastructure to support the duties and activities of the Center and
facilitate information exchange across the public and private sectors.</text>
</paragraph><paragraph id="HCBE87E62D22D4FA3A638414F181DC9A7"><enum>(4)</enum><header>Rule of
construction</header><text>Nothing in this subsection shall be construed to
require the duplication of Federal efforts with respect to the establishment of
the Center, regardless of whether such efforts were carried out prior to or
after the enactment of this subsection.</text>
</paragraph></subsection><subsection id="H6FA40551F50547B1A64070D2847BBECB"><enum>(e)</enum><header>Authorization of
Appropriations</header><text>There is authorized to be appropriated, such sums
as may be necessary for each of fiscal years 2009 and 2010 to carry out this
section.</text>
</subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="HF5D7985E94F947B1ABD83125005931F6"><enum>232.</enum><header>Facilitating
the provision of telehealth services across State lines</header><text display-inline="no-display-inline">Section 330L of the Public Health Service
Act (<external-xref legal-doc="usc" parsable-cite="usc/42/254c-18">42 U.S.C. 254c–18</external-xref>) is amended to read as follows:</text>
<quoted-block id="H9075DDD62D454557A6D8CDED1478EF00" style="OLC">
<section id="H91ABD3BD6D8544E6BF64EDB100ABDD78"><enum>330L.</enum><header>Telemedicine;
incentive grants regarding coordination among states</header>
<subsection id="HCF4EDB833EC54EFDB400C9D9A0A800BB"><enum>(a)</enum><header>Facilitating the
Provision of Telehealth Services Across State Lines</header><text>The Secretary
may make grants to States that have adopted regional State reciprocity
agreements for practitioner licensure, in order to expedite the provision of
telehealth services across State lines.</text>
</subsection><subsection id="HC5CA31B9DC91405E9287624DFDE79253"><enum>(b)</enum><header>Authorization of
Appropriations</header><text>For the purpose of carrying out subsection (a),
there are authorized to be appropriated such sums as may be necessary for each
of the fiscal years 2009 and
2010.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</section></subtitle><subtitle commented="no" id="H778EC5FFFBAF43B1B06D8F41B73658B7"><enum>E</enum><header>Definitions</header>
<section commented="no" id="H6FFE55CE814A4F0681B4B2E38960993"><enum>241.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title, the following terms, defined
in section 171, have the meanings given such terms in such section: Breach ,
confidentiality, de-identified health information, disclose, Director of the
Office of Health Information Privacy, employer, health care, health care
provider, Office of Health Information Privacy, privacy, personal health
information, Secretary, security, State, and use.</text>
</section></subtitle><enum>III</enum><header>Additional
provisions</header>
<section id="H76A1451426FA44619250D73190B2D11B"><enum>301.</enum><header>Federal
purchasing and data collection by CMS and other Federal agencies</header>
<subsection id="H9758215FEF5740F49997135B213BA815"><enum>(a)</enum><header>Coordination of
Federal Spending</header>
<paragraph id="H66D255B61363442FADBE227854E4BA1F"><enum>(1)</enum><header>In
general</header><text>Not later than 1 year after the adoption by the President
of a recommendation under section 202(c)(6), the Administrator of the Center
for Medicare & Medicaid Services and the head of any other Federal agency
shall not expend Federal funds for the purchase of any new health information
technology or health information technology system for clinical care or for the
electronic retrieval, storage, or exchange of personal health information if
such technology or system is not consistent with applicable standards adopted
by the Federal Government under section 202.</text>
</paragraph><paragraph id="H7E7F2F359FD6451CB8EAB1C3A9CD601C"><enum>(2)</enum><header>Rule of
construction</header><text>Nothing in paragraph (1) shall be construed to
restrict the purchase of minor (as determined by the Secretary) hardware or
software components in order to modify, correct a deficiency in, or extend the
life of existing hardware or software.</text>
</paragraph></subsection><subsection id="HF92EECBF59CB4849B6331B7D4C3D4DBC"><enum>(b)</enum><header>Voluntary
Adoption</header>
<paragraph id="H1CC28E4C242644FAB1F4035911F7AF46"><enum>(1)</enum><header>In
general</header><text>Any standards and implementation specifications adopted
by the Federal Government under section 202(c) shall be voluntary with respect
to private entities.</text>
</paragraph><paragraph id="H3B48B4FE66A84544AEF88FBF73C2004C"><enum>(2)</enum><header>Requirement</header><text>Private
entities that enter into a contract with the Federal Government shall adopt the
standards and implementation specifications adopted by the Federal Government
under this section for the purpose of activities under such Federal
contract.</text>
</paragraph><paragraph id="H78C19485057E4491B97DF7D02EC92C23"><enum>(3)</enum><header>Rule of
construction</header><text>Nothing in this section shall be construed to
require that a private entity that enters into a contract with the Federal
Government adopt the standards and implementation specifications adopted by the
Federal Government under this section with respect to activities not related to
the contract.</text>
</paragraph></subsection><subsection id="H9F4891524627455B85DAFDF67358D1C3"><enum>(c)</enum><header>Coordination of
Federal Data Collection</header><text>Not later than 3 years after the adoption
by the Federal Government of a recommendation as provided for in section
202(c), all Federal agencies (including the Center for Medicare & Medicaid
Services) collecting health data in an electronic format for the purposes of
quality reporting, surveillance, epidemiology, adverse event reporting,
research, or for other purposes determined appropriate by the Secretary, shall
comply with the standards and implementation specifications adopted under such
subsection.</text>
</subsection></section><section id="HFBB92EADFE264B4FA01994E967841317"><enum>302.</enum><header>Ensuring health
care providers participating in the medicare program may maintain health
information in electronic form</header><text display-inline="no-display-inline">Section 1871 of the Social Security Act (42
U.S.C. 1395hh) is amended by adding at the end the following new
subsection:</text>
<quoted-block id="HEDA4E51C0763402DB658E64500603EA3" style="OLC">
<subsection id="H0F35079D96E14985A2FF07FB9F98B3EB"><enum>(g)</enum><paragraph commented="no" display-inline="yes-display-inline" id="H60B65B00E09E4ED99CFBA6002C74D189"><enum>(1)</enum><text>Any provider of services
or supplier shall be deemed as meeting any requirement for the maintenance of
data in paper form under this title (whether or not for purposes of management,
billing, reporting, reimbursement, or otherwise) if the required data is
maintained in an electronic form.</text>
</paragraph><paragraph id="HD4D46198CDCE4BFA00AAD81DF45D6700" indent="up1"><enum>(2)</enum><text>Nothing in this subsection shall be
construed as requiring health care providers to maintain or submit data in
electronic
form.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section>