110 HR 6345 IH: Patient-Controlled Health IT U.S. House of Representatives 2008-06-23 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.

I 110th CONGRESS 2d Session H. R. 6345 IN THE HOUSE OF REPRESENTATIVES June 23, 2008 Mr. Boustany introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committee on Ways and Means, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To establish a demonstration program to provide financial incentives to encourage the adoption and use of interactive personal health records and to encourage health information exchange networks to link clinical data to such personal health records.

1.

Short title

This Act may be cited as the Patient-Controlled Health IT Act.

2.

Personal health record (PHR) incentive demonstration program

(a)

Establishment

Not later than one year after the date of the enactment of this Act, the Secretary of Health and Human Services (in this section referred to as the Secretary) shall establish a demonstration program (in this section referred to as the demonstration program) in not more than 5 States to provide financial incentives during a 5-year period for the use of qualifying personal health records by qualifying patients and qualifying providers to— (1)provide patients (or their authorized representatives) access to and control over their personal health data so as to become healthier and more informed and engaged health care consumers; (2)make available to such qualifying providers an accurate minimum data set of patient information (as described in subsection (e)(1)(B)) at all points of care; (3)protect patient security and privacy, with respect to their health care information; (4)improve patients’ adherence to evidence-based health care guidelines, medication guidelines, preventive care, and screening protocols, thereby improving health outcomes and lowering health care costs; (5)provide patients with more accurate, timely, and appropriate information related to their health care benefits and related administrative information; (6)improve the quality and efficiency of communication between health care providers and patients; (7)create a direct communications channel to patients in the event of emergencies; (8)provide access with appropriate privacy safeguards to de-identified health care information to evaluate and advance public health and health research goals; and (9)incentivize health information exchange networks to plan for and implement methods to provide patient access to clinical data through use of personal health records. (b)

Incentive Payments

(1)

In general

Under the demonstration program, subject to paragraph (2), each qualifying provider (as defined in subsection (c)) that furnishes services to a qualifying patient (as defined in subsection (d)) and each health information exchange network (as defined in subsection (g)) shall receive an incentive payment, in accordance with this subsection, from the PHR Incentive Fund established under subsection (i). (2)

One payment for providers in same group practice

In the case of a qualifying patient who receives services during a fiscal year from more than one qualified provider in the same group practice, as defined by the Secretary, only one incentive payment under paragraph (1) for such fiscal year shall be made to such providers with respect to such patient. (3)

Amount of incentive payment

(A)

In general

Except as otherwise provided, the amount of the incentive payment under the demonstration program for a fiscal year— (i)paid to a qualifying provider shall be— (I)at least $3 for each qualifying patient not described in subclause (II); and (II)at least $5 for each qualifying patient with a covered chronic health condition described in subparagraph (C); and (ii)paid to the health information exchange network shall be at least $3 for each qualifying patient for whom such network facilitates under subsection (g)(2) access to and retrieval of clinical data into a qualifying personal health record. (B)

Authority to increase amount of incentive payments

The Secretary may increase the amount of incentive payments described in clause (i)(I), (i)(II) (including for the case of qualifying patients with more than one covered chronic health conditions described in subparagraph (C)), or (ii) of subparagraph (A) under the demonstration program for a fiscal year so long as such increase will not result in— (i)the total amount of such incentive payments under this paragraph (and the costs of other permissible uses described in subsection (i)(1) of funds in the PHR Incentive Fund under subsection (i)) for such fiscal year, exceeding (ii)the total amount of funds in such PHR Incentive Fund for such fiscal year. (C)

Covered chronic health condition described

For purposes of subparagraph (A), a covered chronic health condition is any of the following: (i)Major mental disorder. (ii)Diabetes. (iii)Heart disease. (iv)Asthma. (v)Hypertension. (vi)Cancer. The Secretary, in consultation with the United States Preventive Services Task Force convened by the Public Health Service, may add to or otherwise modify the list of covered chronic health conditions specified under this subparagraph.(D)

Authority to increase amount of incentive payments or vary incentives according to practice size and geographic location

Subject to subparagraph (B), the Secretary may increase the amount of incentive payments described in clause (i)(I) or (i)(II) of subparagraph (A) under the demonstration program (or provide additional or different incentives) for a fiscal year for qualifying providers specified by the Secretary as providers with small practices and qualifying providers located in rural areas. (4)

Publication of names of qualifying providers and patient and provider education about health information exchange

In order to assist patients in identifying health care providers that use qualifying personal health records, and to assist patients and health care providers in understanding personal health records and health information exchange networks, under the demonstration program the Secretary shall— (A)provide for outreach activities, through the use of local methods and Internet websites of the Secretary’s choosing, to provide patients residing in a State participating in the demonstration program with a list of qualifying providers who participate in the program; (B)in consultation with appropriate organizations that represent health care consumers, as well as organizations that represent health information exchange organizations, provide for activities to educate patients residing in a State participating in the demonstration program about the health and convenience benefits of qualifying personal health records and the benefits of electronic health information exchange networks; (C)provide for activities to educate qualifying providers about the patient, provider, and overall health care benefits of using qualifying personal health records and participating in electronic health information exchange networks; (D)in consultation with patient organizations, nongovernmental organizations, and other agencies specified by the Secretary, provide for activities that inform patients of the benefits and risks associated with their use of health information technology and health information exchanges, including the affect that such technology and exchanges may have on the quality of care provided; and (E)develop an interactive outreach and education plan for patients and health care providers to communicate the benefits and risks of health information technology and health information exchanges, how to evaluate and use health information tools and services, and how patients could use such technology and exchanges to participate more completely in their health care. (c)

Qualifying provider defined

For purposes of this section, the term qualifying provider means a licensed physician (or other licensed health care provider designated by the Secretary) that meets the following requirements, with respect to a qualifying patient of that provider and the qualifying personal health record of that patient: (1)The physician (or provider), or authorized representative, updates the diagnosis and medication list (including all current medications and new medications prescribed) in the QPHR after each patient encounter, if appropriate and as authorized by the patient, either by direct entry or through a data sharing arrangement using an appropriate electronic means, such as an electronic medical record, e-prescribing, or health information exchange network. (2)To the extent authorized by the patient, the physician (or provider), or authorized representative ensures that the name of the physician (or provider) is included in the QPHR of the patient on a list of health care providers who furnish services to the patient. (3)The physician (or provider), or authorized representative complies with any security and privacy standards, policies, and practices described under paragraphs (1), (2), and (3) of subsection (h). (4)The physician (or provider), or authorized representative meets other requirements as the Secretary may establish. (d)

Qualifying patient defined

For purposes of this section, the term qualifying patient means an individual— (1)for whom a qualifying personal health record has been established and is in operation under the demonstration program; and (2)who is a Medicare beneficiary or is covered under a health benefits or other plan the sponsor of which is participating as a Fund partner under subsection (i). (e)

Qualifying personal health record defined

For purposes of this section, the terms qualifying personal health record and QPHR mean a record of health care information, with respect to a patient, that meets the following requirements: (1)

Content

(A)

In general

The record— (i)shall contain at least the minimum data set of patient information described in subparagraph (B)(i); and (ii)may consist of such additional personal health information, such as family health history, symptoms, use of over-the-counter medication, diet, exercise, and other relevant health information and activities, as the patient may provide in accordance with paragraph (2)(A)(ii). (B)

Minimum data set of patient information

A minimum data set of patient information described in this paragraph, with respect to a qualifying patient and a qualifying provider authorized by the patient to access the QPHR of the patient, is a data set that is consistent with the following: (i)The data set includes— (I)laboratory results in such a format as to enable the patient and qualifying provider to retrieve, store, graph, and share the results as authorized by the patient; (II)a list of health conditions and allergies as contained in records of health providers involved in the care of the patient (in such a format as to enable the patient and qualifying provider to retrieve and store lists of current and previous health conditions and allergies of the patient); (III)diagnosis codes, with respect to treatment for such a condition or allergy, in such a format as to enable the patient and qualifying provider to retrieve and store a list of such codes; and (IV)an updated list of health providers involved in the care of the patient to enable the patient and qualifying provider to communicate information about the patient to any provider on the list, as authorized by the patient, for care coordination. (ii)The data set provides for the ability to access the results, conditions, allergies, diagnosis codes, and list described in clause (i) in layperson terms. (iii)The data set is portable and enables the patient to move the data between personal health records of the patient. (2)

Access to the record

(A)

Access rights of patient

(i)

In general

Access to the record (and each portion of the record) shall be controlled solely by the patient (or the patient’s authorized representative), with the patient (or the patient’s authorized representative) able to access the record through the Internet, print the record, copy the record to electronic media, and provide online access to authorized third parties, including health care providers, to all individually identifiable health information held in the record at any time, in accordance with this paragraph. (ii)

Addition of personal information

The patient may add personal health information to the record, except that such patient shall not alter information that is entered into the record by any qualifying provider. Such patient shall have the right to propose an amendment to information that is entered by a qualifying provider pursuant to standards prescribed by the Secretary for purposes of amending such information. (iii)

Identification of information entered by participant

Any additions or amendments made by the patient to the record shall be identified and disclosed within such record as being made by such patient. (B)

Access by authorized individuals other than patient

(i)

Authorized access only

Except as provided under subparagraphs (C) and (D), access to the record (or any portion of the record) by an individual other than the patient (or the patient’s authorized representative)— (I)may be made only if the individual is a health care provider who is authorized by the patient to access the record; (II)may be made only to the minimum data set of the patient (as described in paragraph (1)(B)) and to such other portions of the QPHR as specified by the patient; and (III)may be limited by the patient for purposes of entering information into such record, retrieving information from such record, or both. (ii)

Identification of entity that enters information

Any information that is added by a qualifying provider to the record shall be identified and disclosed within such record as being made by such provider. The record shall enable the patient to identify each individual that has been authorized by the patient to access the record, the portions of the record accessed, and the date of such access. (iii)

Notification of limited access to record

In the case that the patient (or the patient’s authorized representative) authorizes access by a health care provider to only a portion of the record and that portion does not include the complete portion of the record, an indicator shall be included in the record to alert the provider that such authorized portion is not representative of the complete record relating to medications taken by the patient. (C)

Deemed authorization for access for emergency health care

With respect to the record of the patient, the patient shall be deemed as providing authorization (in the form of affirmative consent) for health care providers to access, in connection with providing emergency care services to the patient, a limited, authenticated information set concerning the patient for emergency response purposes, unless the patient specifies that such information set (or any portion of such information set) may not be so accessed. Such limited information set shall include the minimum data set of patient information described in paragraph (1)(B) for the patient and any other information specified by the patient for such purposes. (D)

Public health analysis and research

(i)

In general

A QPHR service provider operating or administering a QPHR may provide data included in the QPHR that has been de-identified consistent with the applicable requirements of section 164.514 of title 45, Code of Federal Regulations, for public health analysis, post-market safety surveillance of prescription drugs, and for research purposes. (ii)

Required consultation to optimize public health capabilities

The Secretary shall consult with the Commissioner of the Food and Drug Administration, the Director of the National Institutes of Health, the Director of the Centers for Disease Control and Prevention, and the Administrator of the Agency for Healthcare Research and Quality to optimize the public health and post-market surveillance capabilities of QPHRs. (E)

Termination rights

(i)

In general

The record shall allow the patient (or the patient’s authorized representative) to terminate at any time during or after the period of the demonstration program— (I)the further use of the QPHR service provider operating or administering the record, including elimination of the patient’s personal health information in the control of the QPHR service provider and including in the case of a QPHR service provider that terminates its participation in the demonstration program or ceases to be a QPHR service provider; (II)the further access to the record by a qualifying provider; or (III)the further use of a health information exchange network. (ii)

Clarification

Nothing in this subparagraph shall require a health care provider to eliminate a patient’s personal health information included in the QPHR that is in a medical record maintained by the provider. (F)

Transportability

The patient’s rights to control access to the record under this paragraph shall not be affected by changes in relationships with particular providers or health plans. (3)

Security

The record shall at least meet minimum security standards, including the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. 1320d–2 note) and other such minimum standards as identified by the Secretary under subsection (h). (4)

Web-based

The record shall be web-based. (5)

Authentication

The record shall include functionality to authenticate the patient’s identity prior to the record’s use to receive electronic data of personal health information (other than actual authentication information) from third party sources, such as health information exchange networks, pharmacies, pharmacy benefit managers, laboratories, and health plans, including the Medicare program. (f)

QPHR service provider

(1)

Definition

For purposes of this section, the term QPHR service provider means an entity that— (A)operates or administers a QPHR or part of a QPHR; (B)has access to patients’ individually identifiable health information contained in the QPHR; (C)complies with any security and privacy standards, policies, and practices adopted under subsection (h); (D)not later than the date that is one year after the date of the enactment of this Act, is able to exchange standards-based clinical and patient data with other sources and users of health data, including other QPHRs and health information exchange organizations; (E)is capable of exchanging information with a health information exchange network and is capable of sharing such information between the patient involved and the health care providers of such patient and enabling patient-provider communication; and (F)meets the messaging requirements described in paragraph (2) and disclosure requirement described in paragraph (3). (2)

Messaging requirements

(A)

In general

Subject to subparagraph (B), the messaging requirements described in this paragraph, with respect to a QPHR service provider that operates or administers a QPHR, are the following: (i)

Education reminders

Subject to clause (v), the QPHR service provider shall have the capability of sending patient-specific patient education messages, reminders, and clinical messages to qualifying patients based upon data in the QPHR. (ii)

Federal reminders

Subject to clause (v), the QPHR service provider shall provide for the sending on behalf of Federal agencies of objective, accurate, patient-specific messages to qualifying patients concerning their health care or benefits. (iii)

Fund partner messages

Subject to clause (v), the QPHR service provider shall provide for the sending, on behalf of Fund partners who contribute to the Fund, appropriate patient-specific messages to qualifying patients (with whom such partners have pre-existing relationships) concerning the patients’ health care, medications, treatments, medical devices or benefits. The QPHR service provider shall not allow a Fund partner to send a message to a patient about a product or service unless that product or service has already been prescribed or recommended to the patient by a health care provider. (iv)

Patient opt-in

(I)

In general

Subject to subclause (II), the QPHR service provider shall not allow messages to be sent to a patient unless the provider has requested and received the permission of the patient (or patient’s authorized representative). (II)

Opt-out

A patient may at any time opt out of receiving messages entirely or from a particular source. (v)

Limitation on commercial solicitation

The QPHR service provider shall not allow messages to be sent to a patient unless— (I)the patient is a patient or beneficiary of the sender or source of the message, uses the sender’s or source’s product with a prescription or recommendation of a provider, or has some other health-related pre-existing relationship (as defined by the Secretary) with the sender or source, or the sender or source is a public health agency; (II)the message contains information directly related to the patient's health or health care and does not include marketing or commercial solicitations; (III)the message complies with standards adopted under subsection (h)(4); and (IV)the message clearly identifies the source of the content and the sender of the message. (vi)

Health plan notification

The QPHR service provider shall notify, no less frequently than quarterly, each Fund partner that operates a health benefit plan of the individuals who have received messages sent on behalf of the Fund partner under this section. (B)

Alternative requirements

For purposes of paragraph (1)(F), the Secretary may develop and specify requirements that a QPHR service provider may meet instead of the requirements described in subparagraph (A) so long as such requirements provide for a method and incentives for private entities to contribute to the PHR Incentive Fund. (3)

Disclosure requirement

The disclosure requirement described in this paragraph with respect to a QPHR service provider is that at the time of entering into an arrangement with an individual to operate or administer a QPHR (or part of a QPHR) of the individual, the QPHR service provider shall provide to the individual a notice of the privacy policies of the QPHR service provider, which shall be presented in a clear and understandable manner, meet such standards as specified by the Secretary of Health and Human Services and the Secretary of Commerce, and include the following: (A)

Assurances not to sell individually identifiable information

Assurances, in a form and manner specified by the Secretaries, that— (i)the QPHR service provider will not sell any individually identifiable health information of such individual and the QPHR service provider will not sell or share any such information of such individual for the purposes of marketing or decisions related to employment or financial services; and (ii)the QPHR service provider will disclose to the individual any possible secondary users of the individually identifiable health information of such individual, including business associates of the service provider who may have access to such information, and the purpose for such use or access. (B)

Fund partner information

Information identifying the Fund partners on behalf of which the QPHR service provider sends messages under paragraph (2)(C) and the types of information that would potentially be available to such Fund partners. (g)

Health information exchange network defined

For purposes of this section, the term health information exchange network means any State-based or local entity— (1)the governance of which formally involves health care consumers, employers, health plans, hospitals, and practicing clinicians; (2)which facilitates private and secure access to and retrieval of clinical data, including laboratory test results and medication-related information, to provide safer, more timely, efficient, effective, and equitable patient-centered care; (3)which meets data standards for interoperability, as specified by the Secretary; (4)which meets applicable requirements for privacy, confidentiality, and security as specified by the Secretary, including requirements and standards described in subsection (h); and (5)that provides to each patient participating in such network (at the initiation of such participation) a notice of the privacy policies and other consumer protection policies of the network, which shall be presented in a clear and understandable manner and meet such standards as specified by the Secretary of Health and Human Services and the Secretary of Commerce and include assurances, in a form and manner specified by the Secretaries, that— (A)the entity will not sell any individually identifiable health information of such individual and the entity will not sell or share any such information of such individual for the purposes of marketing or decisions related to employment or financial services; and (B)the entity will disclose to the individual any possible secondary users of the individually identifiable health information of such individual, including business associates of the service provider who may have access to such information, and the purpose for such use or access. (h)

Privacy and consumer protection standards

(1)

Security and privacy standards, policies, and practices

For purposes of the demonstration program, the security and privacy standards, policies, and practices described in this paragraph include— (A)the standards required under regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA); (B)standards to require plain language notice of patients’ rights with respect to personal health records; and (C)any additional standards specified by the Secretary to optimally protect and safeguard patient health care information, as long as such standards are consistent with the standards described in subparagraph (A). (2)

Notification of breach

(A)

In general

In accordance with the minimum criteria established under subparagraph (B), a QPHR service provider must disclose any breach of the security of individually identifiable health information contained in a QPHR to any individual whose individually identifiable health information was, or is reasonably believed to have been, acquired by an unauthorized person and to the Secretary in a manner specified by the Secretary. (B)

Minimum criteria

The Secretary, in consultation with relevant agencies and appropriate entities in the private sector, shall establish minimum criteria for which notifications of wrongful disclosures are required under subparagraph (A). (3)

Availability of individual health information in electronic form

Effective beginning on January 1, 2010, an individual who requests a copy of the individual’s individually identifiable health information pursuant to the HIPAA regulations referred to in paragraph (1) shall be entitled to receive that information in electronic form capable of being imported into a QPHR, if such information is maintained in electronic form by the entity from which the information is requested. (4)

Message standards

The Secretary shall establish minimum standards to ensure the objectivity, accuracy, and relevance of messages sent to individual patients under subsection (f)(2) from a QPHR and to protect against the use of such messages by Fund partners for commercial solicitations or marketing. Such standards shall incorporate existing standards governing communications to consumers established by the Food and Drug Administration, the Federal Trade Commission, or other Federal agencies. (i)

PHR Incentive Fund

(1)

In general

The Secretary shall establish a PHR Incentive Fund (in this section referred to as the PHR Incentive Fund or Fund). The Fund may receive contributions from Fund partners for the sole purpose of paying PHR incentives under the demonstration program, conducting the study under subsection (j), and otherwise carrying out the demonstration program. (2)

Fund partners

(A)

In general

The Secretary may enter into contracts with public or private payers, drug manufacturers, device manufacturers, or other public or private entities (in this section referred to as Fund partners) to allow the Fund to receive contributions in accordance with this subsection and other terms determined by the Secretary. (B)

Federal partners

The Secretary shall seek the involvement and contributions of the Food and Drug Administration, the Centers for Disease Control and Prevention, the Agency for Healthcare Research and Quality, and the Department of Homeland Security to maximize the effectiveness of the QPHRs in meeting the health, national security, emergency response, biosurveillance, and research goals of the Federal government in a manner consistent with this section. A Federal agency described in the previous sentence is authorized to make a contribution to the Fund to the extent provided in appropriation Acts. (C)

Partner accounts

(i)

In general

The Fund shall include an account for each Fund partner, including the Medicare program, separately accounting for each Fund partner’s contributions to the Fund. Contribution levels under subparagraph (D) shall be made to each account at the beginning of each fiscal year of the demonstration program for incentive payments under this section for services furnished during such fiscal year. Incentive payments shall be debited from each account in accordance with this subsection. (ii)

Remaining amounts

Amounts in the account of a Fund partner that are not paid in a fiscal year (before the last fiscal year of the demonstration program) shall remain available for payment from such account in the subsequent fiscal year. Amounts in the account of a Fund partner that are not paid in the last fiscal year of the demonstration program shall be refunded to the Fund partner. (D)

Contribution levels

Contribution levels to the Fund by Fund partners shall be set annually, by the Secretary, except that the contribution level for the first year shall be as follows: (i)

Medicare contribution

The Secretary shall contribute— (I)$3 for each qualifying patient described in subsection (b)(3)(A)(i)(I), with respect to a qualifying provider, who is a Medicare beneficiary for whom any PHR incentive payment may be made under subsection (b)(1) during such fiscal year to such provider; (II)$5 for each qualifying patient described in subsection (b)(3)(A)(i)(II), with respect to a qualifying provider, who is a Medicare beneficiary for whom any PHR incentive payment may be made under subsection (b)(1) during such fiscal year to such provider; and (III)$3 for each qualifying patient who is a Medicare beneficiary for whom an incentive payment may be made under subsection (b)(1) during such fiscal year to a health information exchange network. The contribution amounts described in this clause shall be transferred from the Federal Hospital Insurance Trust Fund (established under section 1817 of the Social Security Act) and from the Federal Supplementary Medical Insurance Trust Fund (established under section 1841 of such Act) in such proportion as the Secretary may specify.(ii)

Other payer contributions

Any Fund partner that is a health care payer other than the Medicare program (and is not an agency described in subparagraph (B)) shall contribute— (I)at least $3 for each qualifying patient described in subsection (b)(3)(A)(i)(I), with respect to a qualifying provider, who is covered under a health benefits or other plan the sponsor of which is the Fund partner and for whom a PHR incentive payment may be made under subsection (b)(1) during the fiscal year to such provider; (II)at least $5 for each qualifying patient described in subsection (b)(3)(A)(i)(II), with respect to a qualifying provider, who is covered under a health benefits or other plan the sponsor of which is the Fund partner and for whom a PHR incentive payment may be made under subsection (b)(1) during the fiscal year to such provider; and (III)at least $3 for each qualifying patient who is covered under a health benefits or other plan the sponsor of which is the Fund partner and for whom an incentive payment may be made under subsection (b)(1) during such fiscal year to a health information exchange network. (iii)

Messaging contributions

(I)

In general

Subject to subclause (II), the Secretary may establish contribution levels for Fund partners that employ messages sent under subsection (f)(2)(C) in the fiscal year. (II)

FDA-messaging contributions

The amount of the contribution of a drug manufacturer that is a Fund partner is equal to at least $3 for each qualifying patient for each medication adherence program for which one or more messages are sent under subsection (f)(2)(C) in the fiscal year. (E)

Debiting Fund partners’ accounts

The Medicare program’s account shall be debited for each incentive payment made under subsection (b)(1), with respect to a qualifying patient who is a Medicare beneficiary. Each other Fund partner’s account shall be debited for each incentive payment made under subsection (b)(1), with respect to a qualifying patient who is covered under a health benefits or other plan the sponsor of which is such Fund partner. Each Fund partner’s account shall be debited for messages sent under subsection (f)(2)(C) for such partner in accordance with a methodology specified by the Secretary. In the event that a Fund partner’s account does not have a sufficient balance to cover the Fund partner’s liability, the Fund partner shall make a supplemental contribution to the Fund to cover the shortfall. (F)

Limitation on benefits

Contributions by a Fund partner to the Fund shall confer no preferential access to data or information or any other benefit to the partner other than public acknowledgment under paragraph (3) and the ability to have messages sent to qualifying patients under subsection (f)(2)(C). (3)

Publication of fund contributors

The Secretary shall publish on the official public website of the Centers for Medicare & Medicaid Services a list of Fund partners that have contributed to the Fund. (j)

Study and reports

(1)

Interim report

Not later than 3 years after the initiation of the demonstration program, the Secretary shall submit to Congress a report on the following, with respect to the demonstration program: (A)The extent to which privacy protections are sufficient under the demonstration program and recommendations for any additional privacy protections that may be necessary. (B)The extent to which use of data in QPHRs by qualifying providers varies based on the size of the practice of the qualifying providers and based on whether the qualifying providers are located in a rural or urban area. (C)The effectiveness of patient and provider outreach and education efforts to increase the utilization and utility of QPHRs. (D)The measurable benefits and concerns of qualifying providers, with respect to use of QPHRs and potential adoption of personal health record technology. (2)

Study and final report

(A)

Study

At the conclusion of the demonstration program, the Secretary shall provide for a study to assess the level of patients’ use of their QPHR, the type of data transmitted by health information exchange networks, the impact of the standards used in transmitting the data, the utility of such data to health care providers in delivering patient care and to patients in managing their health (including adherence to prescribed medications and recommended preventive care), any changes in health outcomes, and any cost savings resulting from implementation of the program. The study shall include collection of aggregate data documenting the number of qualifying patients, the number of providers using the QPHR, the number of patients using the QPHR, the type of data presented in the QPHR, and other measures of the program’s effectiveness. (B)

Final report

Not later than 2 years after the last day of the demonstration program, the Secretary shall submit to Congress a report on the results of the study under paragraph (1).