110 HR 6357 IH: PRO(TECH)T Act of 2008
U.S. House of Representatives
2008-06-24
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.Short title; table of
contents
(a)This Act may be cited
as the Protecting Records, Optimizing
Treatment, and Easing Communication through Healthcare Technology Act of
2008
or the PRO(TECH)T Act of 2008
.
(b)The table of contents of this Act is as follows:
Sec. 1. Short title; table of contents.
Title I—Health Information Technology
Subtitle A—Promotion of Health Information
Technology
Part I—Improving health care quality, safety, and
efficiency
Sec. 101. ONCHIT; standards development and adoption; health
information technology resource center.
Title XXX—Health Information Technology and Quality
Sec. 3000. Definitions.
Subtitle A—Promotion of Health Information
Technology
Sec. 3001. Office of the National Coordinator for Health
Information Technology.
Sec. 3002. HIT Policy Committee.
Sec. 3003. HIT Standards Committee.
Sec. 3004. Process for adoption of endorsed
recommendations.
Sec. 3005. Application and use of adopted standards and
implementation specifications by Federal agencies.
Sec. 3006. Voluntary application and use of adopted standards
and implementation specifications by private entities.
Sec. 3007. Health Information Technology Resource
Center.
Sec. 102. Transitions.
Part II—Application and use of adopted health information
technology standards; reports
Sec. 111. Coordination of Federal activities with adopted
standards and implementation specifications.
Sec. 112. Application to private entities.
Sec. 113. Reports.
Subtitle B—Incentives for the Use of Health Information
Technology
Sec. 121. Grant, loan, and demonstration
programs.
Subtitle B—Incentives for the Use of Health Information
Technology
Sec. 3011. Grants and loans to facilitate the widespread
adoption of qualified health information technology.
Sec. 3012. Demonstration program to integrate information
technology into clinical education.
Title II—Testing of Health Information Technology
Sec. 201. National Institute for Standards and Technology
testing.
Sec. 202. Research and development programs.
Title III—Privacy and security provisions
Sec. 300. Definitions.
Subtitle A—Security provisions
Sec. 301. Application of security provisions and penalties to
business associates of covered entities; annual guidance on security
provisions.
Sec. 302. Notification in the case of breach.
Sec. 303. Education on Health Information Privacy and report on
compliance.
Subtitle B—Improved privacy provisions and additional security
provisions
Sec. 311. Application of penalties to business associates of
covered entities for violations of privacy contract requirements.
Sec. 312. Restrictions on certain disclosures of health
information; accounting of certain protected health information
disclosures.
Sec. 313. Conditions on certain contacts as part of health care
operations.
Sec. 314. Study on application of privacy and security
requirements to vendors of personal health records.
Sec. 315. Temporary breach notification requirement for vendors
of personal health records.
Sec. 316. Business associate contracts required for certain
entities.
Sec. 317. Guidance on implementation specification to
de-identify protected health information.
Sec. 318. GAO report on treatment disclosures.
Sec. 319. Clarification of application of wrongful disclosures
criminal penalties.
Subtitle C—Relationship to other laws; clarification;
effective date
Sec. 321. Relationship to other laws.
Sec. 322. Effective date.
<enum>I</enum><header>Health Information
Technology</header>
<subtitle id="HF3B43A85EEE64CD580B7EADA1C57BF11"><enum>A</enum><header>Promotion of
Health Information Technology</header>
<part id="HAFDDBA47DF1642B1B3698DB00064BCB2"><enum>I</enum><header>Improving health
care quality, safety, and efficiency</header>
<section id="H2DF674D530E04F76AAF2FE1D2E81DF30"><enum>101.</enum><header>ONCHIT;
standards development and adoption; health information technology resource
center</header>
<subsection id="HF6E8B5ED3FFC4252B23273A7896B0378"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">The
<act-name parsable-cite="PHSA">Public Health Service Act</act-name> (42 U.S.C.
201 et seq.) is amended by adding at the end the following:</text>
<quoted-block act-name="Public Health Service Act" id="H260EB6C4EB4C419E87E03F0042683747" style="OLC">
<title id="HECF5DE7777AD4C8A8CBED21EAB53A71"><enum>XXX</enum><header>Health
Information Technology and Quality</header>
<section id="H24CDAB763BE9467D8FB2B867E0CF6399"><enum>3000.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title:</text>
<paragraph id="H4CE1B5A5643C44D999A7A3547200A8AB"><enum>(1)</enum><header>Enterprise
integration</header><text display-inline="yes-display-inline">The term
<term>enterprise integration</term> means the electronic linkage of health care
providers, health plans, the government, and other interested parties, to
enable the electronic exchange and use of health information among all the
components in the health care infrastructure in accordance with applicable law,
and such term includes related application protocols and other related
standards.</text>
</paragraph><paragraph id="H8F6A81A6DFBC4FF68ED6582B5DC01F99"><enum>(2)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> means a
hospital, skilled nursing facility, nursing facility, home health entity,
health care clinic, Federally qualified health center, group practice (as
defined in section 1877(h)(4) of the <act-name parsable-cite="SSA">Social
Security Act</act-name>), a pharmacist, a pharmacy, a laboratory, a physician
(as defined in section 1861(r) of the <act-name parsable-cite="SSA">Social
Security Act</act-name>), a practitioner (as described in section
1842(b)(18)(C) of the <act-name parsable-cite="SSA">Social Security
Act</act-name>), a provider operated by, or under contract with, the Indian
Health Service or by an Indian tribe (as defined in the Indian
Self-Determination and Education Assistance Act), tribal organization, or urban
Indian organization (as defined in section 4 of the Indian Health Care
Improvement Act), a rural health clinic, and any other category of facility or
clinician determined appropriate by the Secretary.</text>
</paragraph><paragraph id="H4389F5138C85405C9DCAAF8B44E3E1EC"><enum>(3)</enum><header>Health
information</header><text>The term <term>health information</term> has the
meaning given such term in section 1171(4) of the <act-name parsable-cite="SSA">Social Security Act</act-name>.</text>
</paragraph><paragraph id="H951AB11FE1414822BBADAB746C16BD00"><enum>(4)</enum><header>Health
information technology</header><text display-inline="yes-display-inline">The
term <term>health information technology</term> means hardware, software,
license, right, intellectual property, equipment, or other information
technology (including new versions, upgrades, and connectivity) designed or
provided primarily for the electronic creation, maintenance, or exchange of
health information to coordinate care or improve health care quality,
efficiency, or research.</text>
</paragraph><paragraph id="HD2B37A0863284F2EAEE06C7D9194BA8"><enum>(5)</enum><header>Health
plan</header><text>The term <term>health plan</term> has the meaning given such
term in section 1171(5) of the Social Security Act.</text>
</paragraph><paragraph id="H09ED8CDC681C4919993D5B970623C525"><enum>(6)</enum><header>HIT Policy
Committee</header><text>The term <term>HIT Policy Committee</term> means such
Committee established under section 3002(a).</text>
</paragraph><paragraph display-inline="no-display-inline" id="H588C926685CB42A8876C9894C0007634"><enum>(7)</enum><header>HIT Standards
Committee</header><text>The term <term>HIT Standards Committee</term> means
such Committee established under section 3003(a).</text>
</paragraph><paragraph id="HD4EEBC7BFE4B49B586E24012BC713EAD"><enum>(8)</enum><header>Individually
identifiable health information</header><text>The term <term>individually
identifiable health information</term> has the meaning given such term in
section 1171(6) of the <act-name parsable-cite="SSA">Social Security
Act</act-name>.</text>
</paragraph><paragraph id="H707DFA694FC641BAAC01F0587A500A3"><enum>(9)</enum><header>Laboratory</header><text>The
term <term>laboratory</term> has the meaning given such term in section
353(a).</text>
</paragraph><paragraph id="H9C248516E1474A8DB1EBBE800429DA26"><enum>(10)</enum><header>National
Coordinator</header><text>The term <term>National Coordinator</term> means the
head of the Office of the National Coordinator for Health Information
Technology established under section 3001(a).</text>
</paragraph><paragraph id="H23A6928EEC9B4B5EBA663BB495B1DA8F"><enum>(11)</enum><header>Pharmacist</header><text>The
term <term>pharmacist</term> has the meaning given such term in section 804(2)
of the <act-name parsable-cite="FFDCA">Federal Food, Drug, and Cosmetic
Act</act-name>.</text>
</paragraph><paragraph id="HEA079EACE991446AAA8D17591244213B"><enum>(12)</enum><header>State</header><text>The
term <term>State</term> means each of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Northern Mariana Islands.</text>
</paragraph></section><subtitle id="H279836CD5683437097ADC0CB26012CC"><enum>A</enum><header>Promotion of Health
Information Technology</header>
<section id="H75C412B4D86548E18279C3049837732"><enum>3001.</enum><header>Office of the
National Coordinator for Health Information Technology</header>
<subsection id="HAE017703240A426F9FDE7E5B81DF5783"><enum>(a)</enum><header>Establishment</header><text>There
is established within the Department of Health and Human Services an Office of
the National Coordinator for Health Information Technology (referred to in this
section as the <quote>Office</quote>). The Office shall be headed by a National
Coordinator who shall be appointed by the Secretary and shall report directly
to the Secretary.</text>
</subsection><subsection id="HBF87E77D694F4415AD001B1B076CEB4"><enum>(b)</enum><header>Purpose</header><text>The
National Coordinator shall perform the duties under subsection (c) in a manner
consistent with the development of a nationwide interoperable health
information technology infrastructure that—</text>
<paragraph id="H1B756EE504804840B031C49EFA80BED0"><enum>(1)</enum><text>ensures that each
patient’s health information is secure and protected, in accordance with
applicable law;</text>
</paragraph><paragraph id="H50A7BDC8F8B047AD8C7782AE1640E711"><enum>(2)</enum><text>improves health
care quality, reduces medical errors, and advances the delivery of
patient-centered medical care;</text>
</paragraph><paragraph id="H45D7594DDCE749BF9F8B6D5E19A59274"><enum>(3)</enum><text>reduces health
care costs resulting from inefficiency, medical errors, inappropriate care,
duplicative care, and incomplete information;</text>
</paragraph><paragraph id="H3D361F7FE0C942DB89A815B1243642C"><enum>(4)</enum><text>ensures that
appropriate information to help guide medical decisions is available at the
time and place of care;</text>
</paragraph><paragraph id="HD530B76B86364E05A455ABA9A0E7CB2E"><enum>(5)</enum><text>ensures the
inclusion of meaningful public input in such development of such
infrastructure;</text>
</paragraph><paragraph id="H7FB698DCA89F441900002F88E96C29A1"><enum>(6)</enum><text>improves the
coordination of care and information among hospitals, laboratories, physician
offices, and other entities through an effective infrastructure for the secure
and authorized exchange of health care information;</text>
</paragraph><paragraph id="HEEE1A4BB473447FBB64116C515A52733"><enum>(7)</enum><text>improves public
health reporting and facilitates the early identification and rapid response to
public health threats and emergencies, including bioterror events and
infectious disease outbreaks;</text>
</paragraph><paragraph id="HD770A059EBEB463B8863D8133936D0A7"><enum>(8)</enum><text>facilitates health
and clinical research and health care quality;</text>
</paragraph><paragraph id="HDDDBDC76D39446DA8B3032BE3EE285D4"><enum>(9)</enum><text>promotes
prevention of chronic diseases;</text>
</paragraph><paragraph id="H82C7FC5B16524B1DB89BB06CDF17F22F"><enum>(10)</enum><text>promotes a more
effective marketplace, greater competition, greater systems analysis, increased
consumer choice, and improved outcomes in health care services; and</text>
</paragraph><paragraph id="HADC7855847684FD19341DACBE1C505E8"><enum>(11)</enum><text>improves efforts
to reduce health disparities.</text>
</paragraph></subsection><subsection id="H48D834FD52FB4D8D9FA6C9273DC4027"><enum>(c)</enum><header>Duties of the
National Coordinator</header>
<paragraph id="H4927D1C4057444CBA185D980F8E3C29"><enum>(1)</enum><header>Standards</header><text display-inline="yes-display-inline">The National Coordinator shall review and
determine whether to endorse each standard, implementation specification, and
certification criterion for the electronic exchange and use of health
information that is recommended by the HIT Standards Committee under section
3003 for purposes of adoption under section 3004(b). The Coordinator shall make
such determination, and report to the Secretary such determination, not later
than 90 days after the date the recommendation is received by the
Coordinator.</text>
</paragraph><paragraph id="H5DD78B6AD4514701A32259542BD8D7FA"><enum>(2)</enum><header>HIT policy
coordination</header><text display-inline="yes-display-inline">The National
Coordinator shall coordinate health information technology policy and programs
of the Department with those of other relevant executive branch agencies with a
goal of avoiding duplication of efforts and of helping to ensure that each
agency undertakes health information technology activities primarily within the
areas of its greatest expertise and technical capability.</text>
</paragraph><paragraph id="H9798D86654A94730A9A30052E785DFF1"><enum>(3)</enum><header>Strategic
plan</header>
<subparagraph id="H2B262E69C6894BACB4D3CDA7766FBC9"><enum>(A)</enum><header>In
general</header><text>The National Coordinator shall, in consultation with
other appropriate Federal agencies (including the National Institute of
Standards and Technology), maintain and update a strategic plan with specific
objectives, milestones, and metrics for the following:</text>
<clause id="H62E7183E7410445CA756F2B90892EF25"><enum>(i)</enum><text display-inline="yes-display-inline">The electronic exchange and use of health
information and the enterprise integration of such information.</text>
</clause><clause id="H753AA7C37A844B5894AFDC42166BC7F"><enum>(ii)</enum><text display-inline="yes-display-inline">The utilization of an electronic health
record for each person in the United States by 2014.</text>
</clause><clause id="HDDFB251335564EC9A1EC354D3533F67"><enum>(iii)</enum><text display-inline="yes-display-inline">The incorporation of privacy and security
protections for the electronic exchange of an individual’s individually
identifiable health information.</text>
</clause><clause id="H55D67C0870C44FCE910056A1491124CD"><enum>(iv)</enum><text display-inline="yes-display-inline">Ensuring security methods to ensure
appropriate authorization, electronic authentication, and encryption of health
information.</text>
</clause><clause id="H01A8764B2B214592A2B2CE307593C35B"><enum>(v)</enum><text display-inline="yes-display-inline">Specifying a framework for coordination and
flow of recommendations and policies under this subtitle among the Secretary,
the National Coordinator, the HIT Policy Committee, the HIT Standards
Committee, and other health information exchanges and other relevant
entities.</text>
</clause><clause id="H197F121A19BE433684BC38D3DB4B7199"><enum>(vi)</enum><text>Methods to foster
the public understanding of health information technology.</text>
</clause><clause id="HC79A780D195F424398B998B4A25CD500"><enum>(vii)</enum><text display-inline="yes-display-inline">Strategies to enhance the use of health
information technology in improving the quality of health care, reducing
medical errors, reducing health disparities, and in improving the continuity of
care among health care settings.</text>
</clause></subparagraph><subparagraph id="H7A5C7334EE3047C6B800F660E8011DD1"><enum>(B)</enum><header>Collaboration</header><text display-inline="yes-display-inline">The strategic plan shall be developed and
updated through collaboration of public and private interests.</text>
</subparagraph><subparagraph id="H5C59E73B2E7B4473B952C115AA656B46"><enum>(C)</enum><header>Measurable
outcome goals</header><text>The strategic plan shall include measurable outcome
goals.</text>
</subparagraph><subparagraph id="H13BD04DD5BF147FEA1CA15BA63925874"><enum>(D)</enum><header>Publication</header><text display-inline="yes-display-inline">The National Coordinator shall publish the
strategic plan, including all updates.</text>
</subparagraph></paragraph><paragraph id="H0A8306E9060D4133BA8B4B4B08FE176C"><enum>(4)</enum><header>Website</header><text display-inline="yes-display-inline">The National Coordinator shall maintain and
frequently update an Internet website on which there is posted information that
includes the following:</text>
<subparagraph commented="no" id="HAD0E7945A6C54F0FA4000004A8D0BF00"><enum>(A)</enum><text>The schedule
developed by the HIT Standards Committee under section 3003(b)(3).</text>
</subparagraph><subparagraph id="H257C5AD089CD4844962F068FAE28CBA9"><enum>(B)</enum><text>The
recommendations of the HIT Policy Committee under section 3002.</text>
</subparagraph><subparagraph id="H29125E9D850A43E5ABD919009D4294AE"><enum>(C)</enum><text>Recommendations of
the HIT Standards Committee under section 3003.</text>
</subparagraph><subparagraph id="H708AA01BC6D644E28346D2CD00FD1E17"><enum>(D)</enum><text>Sources of Federal
grant funds and technical assistance that are available to facilitate the
purchase of, or enhance the utilization of, health information technology
systems.</text>
</subparagraph><subparagraph id="H775430C1505B460BBA7491B3B7D8E5E9"><enum>(E)</enum><text>The report
prepared by the National Coordinator under paragraph (5).</text>
</subparagraph><subparagraph id="H581F5A59C3954F97A7960000E491C0EA"><enum>(F)</enum><text>The assessment by
the National Coordinator under paragraph (6).</text>
</subparagraph><subparagraph id="H27D150B289114BF78E6395CD60A5208"><enum>(G)</enum><text>The evaluation by
the National Coordinator under paragraph (7).</text>
</subparagraph><subparagraph id="H27F1441B4F224B2FA1141E00E5380025"><enum>(H)</enum><text>The annual
estimate of resources required under paragraph (8).</text>
</subparagraph></paragraph><paragraph id="H98443124FC5C45AAAFE0ABB1563E60AC"><enum>(5)</enum><header>Implementation
report</header><text display-inline="yes-display-inline">The National
Coordinator shall prepare a report that identifies lessons learned from major
public and private health care systems in their implementation of health
information technology systems, including information on whether the systems
and practices developed by such systems may be applicable to and usable in
whole or in part by other health care providers.</text>
</paragraph><paragraph id="HF20B1325B7964A57BACACCD0C4712F4E"><enum>(6)</enum><header>Assessment of
impact of HIT on communities with health disparities and uninsured,
underinsured, and medically underserved areas</header><text display-inline="yes-display-inline">The National Coordinator shall assess and
publish the impact of health information technology in communities with health
disparities and in areas that serve uninsured, underinsured, and medically
underserved individuals (including urban and rural areas) and identify
practices to increase the adoption of such technology by health care providers
in such communities.</text>
</paragraph><paragraph commented="no" id="HB80CE048C3D9481DA18FCA9F68A93606"><enum>(7)</enum><header>Evaluation of
benefits and costs of the electronic use and exchange of health
information</header><text display-inline="yes-display-inline">The National
Coordinator shall evaluate and publish evidence on the benefits and costs of
the electronic use and exchange of health information and assess to whom these
benefits and costs accrue.</text>
</paragraph><paragraph commented="no" id="H23CF130D3D514DFC843CC4EA4C40F8A9"><enum>(8)</enum><header>Resource
requirements</header><text display-inline="yes-display-inline">The National
Coordinator shall estimate and publish resources required annually to reach the
goal of utilization of an electronic health record for each person in the
United States by 2014, including the required level of Federal funding,
expectations for regional, State, and private investment, and the expected
contributions by volunteers to activities for the utilization of such
records.</text>
</paragraph><paragraph id="HCEAC21E34C6345B58537495C0130201C"><enum>(9)</enum><header>Certification</header>
<subparagraph id="H4AB10E5DBE82499D96C5BB32EC806FF4"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">The National
Coordinator, in consultation with the Director of the National Institute of
Standards and Technology, shall develop a program (either directly or by
contract) for the voluntary certification of health information technology as
being in compliance with applicable certification criteria adopted under this
subtitle. Such program shall include testing of the technology in accordance
with section 201(b) of the PRO(TECH)T Act of 2008.</text>
</subparagraph><subparagraph id="HA816B27540614EA49FA6A08CDC4B15A1"><enum>(B)</enum><header>Certification
criteria described</header><text>In this title, the term <term>certification
criteria</term> means, with respect to standards and implementation
specifications for health information technology, criteria to establish that
the technology meets such standards and implementation specifications.</text>
</subparagraph></paragraph></subsection><subsection id="H4D87F3D8B7AB4929A5EC3187A519E5B9"><enum>(d)</enum><header>Detail of
Federal Employees</header>
<paragraph id="H8D1F30BB1D5146F7A08157235605931C"><enum>(1)</enum><header>In
general</header><text>Upon the request of the National Coordinator, the head of
any Federal agency is authorized to detail, with or without reimbursement from
the Office, any of the personnel of such agency to the Office to assist it in
carrying out its duties under this section.</text>
</paragraph><paragraph id="H7291E3C6D5FA4CDD9B6FC84BA1C6C189"><enum>(2)</enum><header>Effect of
detail</header><text>Any detail of personnel under paragraph (1) shall—</text>
<subparagraph id="HB8178BC32CFE48A7A9907C7CC48FD61"><enum>(A)</enum><text>not interrupt or
otherwise affect the civil service status or privileges of the Federal
employee; and</text>
</subparagraph><subparagraph id="HBF5E049B23F54C8EB25093AB5300A32D"><enum>(B)</enum><text>be in addition to
any other staff of the Department employed by the National Coordinator.</text>
</subparagraph></paragraph><paragraph id="H7E33C736ED1545D88563D3B300AB7CE7"><enum>(3)</enum><header>Acceptance of
detailees</header><text>Notwithstanding any other provision of law, the Office
may accept detailed personnel from other Federal agencies without regard to
whether the agency described under paragraph (1) is reimbursed.</text>
</paragraph></subsection><subsection commented="no" id="H554018B7AA5944B1BF7879D981407063"><enum>(e)</enum><header>Authorization of
Appropriations</header><text>There are authorized to be appropriated to carry
out this section $66,000,000 for fiscal year 2009.</text>
</subsection></section><section display-inline="no-display-inline" id="HA916E8DF29DC4BAFABBB845F3CDC366D" section-type="subsequent-section"><enum>3002.</enum><header>HIT Policy
Committee</header>
<subsection id="H8BEDAA06B9F541858800609FC406B82C"><enum>(a)</enum><header>Establishment</header><text display-inline="yes-display-inline">There is established a HIT Policy Committee
to make policy recommendations to the National Coordinator relating to the
implementation of a nationwide health information technology infrastructure,
including implementation of the strategic plan described in section
3001(c)(3).</text>
</subsection><subsection id="HA449AC6A6787411C82194454A0D87D9B"><enum>(b)</enum><header>Duties</header>
<paragraph id="H1659B5FFD6A249048EBF91A3220069B0"><enum>(1)</enum><header>Recommendations
on health information technology infrastructure</header><text>Not later than 1
year after the date of the enactment of this title, the HIT Policy Committee
shall recommend a policy framework for the development and adoption of a
nationwide health information technology infrastructure that permits the
electronic exchange and use of health information as is consistent with the
strategic plan under section 3001(c)(3) and that includes the recommendations
under paragraph (2). Annually thereafter the Committee shall update such
recommendations and make new recommendations as appropriate.</text>
</paragraph><paragraph id="H0D90E9D6D7BC44B5B988AB43C2F35530"><enum>(2)</enum><header>Specific areas
of standard development</header>
<subparagraph id="H902C306E6A214ADEAAF24C0019449DBE"><enum>(A)</enum><header>In
general</header><text>The HIT Policy Committee shall recommend the areas in
which standards, implementation specifications, and certification criteria are
needed for the electronic exchange and use of health information for purposes
of adoption under section 3004(b) and shall recommend an order of priority for
the development, harmonization, and recognition of such standards,
specifications, and criteria among the areas so recommended. Such standards and
implementation specifications shall include named standards, architectures, and
software schemes for the authentication and security of individually
identifiable health information and other information as needed to ensure the
reproducible development of common solutions across disparate entities.</text>
</subparagraph><subparagraph id="HED9889C42DAD43C5848FB9E6C9846FC"><enum>(B)</enum><header>Areas required
for consideration</header><text>In making recommendations under subparagraph
(A), the HIT Policy Committee shall consider at least the following
areas:</text>
<clause id="H0A833DAE08A34193BA0059EBF7396382"><enum>(i)</enum><text display-inline="yes-display-inline">Technologies that protect the privacy of
health information and promote security, including for the protection from
disclosure of specific individually identifiable health information, in
accordance with applicable law, and for the use and disclosure of limited data
sets (as defined for purposes of regulations promulgated under section 264(c)
of the Health Insurance Portability and Accountability Act of 1996) of such
information.</text>
</clause><clause id="H958BE4C5293740DCB9F0E436F66B2CF4"><enum>(ii)</enum><text display-inline="yes-display-inline">A nationwide interoperable health
information technology infrastructure that permits the electronic exchange and
use of health information.</text>
</clause><clause id="H7C67912A1F5749728BE8E138BEF59755"><enum>(iii)</enum><text>The utilization
of an electronic health record for each person in the United States by
2014.</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H2799FDEC90F640468B8E44E053C85617"><enum>(C)</enum><header>Other areas for
consideration</header><text>In making recommendations under subparagraph (A),
the HIT Policy Committee may consider the following additional areas:</text>
<clause id="H9AFFC169F9164414A257F98CEBE6BFDD"><enum>(i)</enum><text>The appropriate
uses of a nationwide health information infrastructure, including for purposes
of—</text>
<subclause commented="no" id="HE5191142FC5644BCAD313B7CE12009D0"><enum>(I)</enum><text>the collection of
quality data and public reporting;</text>
</subclause><subclause commented="no" id="HDB1EFE1FFAE34962AD42C5B6B1DA95FD"><enum>(II)</enum><text>biosurveillance
and public health;</text>
</subclause><subclause commented="no" id="HB48F9F6A0554447A8F00CD2D02C40024"><enum>(III)</enum><text>medical and
clinical research; and</text>
</subclause><subclause commented="no" id="HB560D79CE7C441C1A7B9DCAB359F4F5"><enum>(IV)</enum><text>drug
safety.</text>
</subclause></clause><clause id="HF7F75BC834BA48EDBBE2C04D4FB98500"><enum>(ii)</enum><text>Self-service
technologies that facilitate the use and exchange of patient information and
reduce wait times.</text>
</clause><clause display-inline="no-display-inline" id="HDC2BEA5E982741FE936EB11FB62F262C"><enum>(iii)</enum><text>Telemedicine
technologies, in order to reduce travel requirements for patients in remote
areas.</text>
</clause><clause id="H9F8068860FCC4A63B4C5A89541FFC75F"><enum>(iv)</enum><text>Technologies that
facilitate home health care and the monitoring of patients recuperating at
home.</text>
</clause><clause id="H9C639C82047F453CB623E3001C557137"><enum>(v)</enum><text>Technologies that
help reduce medical errors.</text>
</clause><clause id="H53B462A159774D63AF93C5BA951E7CEA"><enum>(vi)</enum><text display-inline="yes-display-inline">Technologies that facilitate the continuity
of care among health settings.</text>
</clause><clause id="H44750E3283BC483CBCED65582F4C7DB6"><enum>(vii)</enum><text>Technologies
that meet the needs of diverse populations.</text>
</clause><clause id="H17668D0F0362476F85BA9D1C72D022C6"><enum>(viii)</enum><text>Any other
technology that the HIT Policy Committee finds to be among the technologies
with the greatest potential to improve the quality and efficiency of health
care.</text>
</clause></subparagraph></paragraph><paragraph id="H534EFC46C4D54248BB66B5CBBB77005B"><enum>(3)</enum><header>Forum</header><text display-inline="yes-display-inline">The HIT Policy Committee shall serve as a
forum for broad stakeholder input with specific expertise in policies relating
to the matters described in paragraphs (1) and (2).</text>
</paragraph><paragraph id="H75E6F4792BAE4AA68C00DB61A867895"><enum>(4)</enum><header>Website</header><text display-inline="yes-display-inline">The HIT Policy Committee shall develop and
maintain an Internet website on which there is posted information that includes
the following:</text>
<subparagraph id="H7B78A729D43344F7808DCA3C042D40FB"><enum>(A)</enum><text>Established
governance rules.</text>
</subparagraph><subparagraph id="HBE65FBD13816439BA4CF8DB474B7BB3D"><enum>(B)</enum><text>A business
plan.</text>
</subparagraph><subparagraph id="H9D10F34167744DAC85CF1991234FCFFF"><enum>(C)</enum><text>Meeting notices at
least 14 days prior to each meeting.</text>
</subparagraph><subparagraph id="HDC0B5502197A489395907F198B8EEB99"><enum>(D)</enum><text>Meeting agendas at
least 7 days prior to each meeting.</text>
</subparagraph><subparagraph id="H843E48965502460D00BFBEA5F7213646"><enum>(E)</enum><text>Meeting materials
at least 3 days prior to each meeting.</text>
</subparagraph></paragraph></subsection><subsection display-inline="no-display-inline" id="HCDE6F55AB3EB4AFFBCD41C83CC7D499E"><enum>(c)</enum><header>Membership</header>
<paragraph id="HC378136C5A504B508325AF400E6F709"><enum>(1)</enum><header>Appointments</header><text>The
HIT Policy Committee shall be composed of members to be appointed as
follows:</text>
<subparagraph id="HFECC875D3C2548C3AB7697E0FAD721B"><enum>(A)</enum><text>3 members shall be
appointed by the Secretary, 1 of whom shall be appointed to represent the
Department of Health and Human Services and 1 of whom shall be a public health
official.</text>
</subparagraph><subparagraph id="HC2E6DDB5E0F34993BB89DD927288DFBA"><enum>(B)</enum><text>1 member shall be
appointed by the majority leader of the Senate.</text>
</subparagraph><subparagraph id="HED4E17399EF54A2E9DC24D7E000655A5"><enum>(C)</enum><text>1 member shall be
appointed by the minority leader of the Senate.</text>
</subparagraph><subparagraph id="H1C685034EA094111A0B34C6C58D3A0AB"><enum>(D)</enum><text>1 member shall be
appointed by the Speaker of the House of Representatives.</text>
</subparagraph><subparagraph id="H1B84C1C5E95542D98D2DB2A05B8464E1"><enum>(E)</enum><text>1 member shall be
appointed by the minority leader of the House of Representatives.</text>
</subparagraph><subparagraph id="H5878600EB8024769A26FCE75BB082CE"><enum>(F)</enum><text>Such other members
as shall be appointed by the President as representatives of other relevant
Federal agencies.</text>
</subparagraph><subparagraph id="HBA8DF04538684B0D96D7E75984A2B6D"><enum>(G)</enum><text>11 members shall be
appointed by the Comptroller General of the United States of whom—</text>
<clause id="H2F882B2AA79341F2B0D168BAE4423C89"><enum>(i)</enum><text>1
member shall be an advocate for patients or consumers;</text>
</clause><clause id="HCD56DD9180F84F1892DDE275356FDAD"><enum>(ii)</enum><text>2
members shall represent health care providers, one of which shall be a
physician;</text>
</clause><clause id="HBAD08EB38FB341E790A7C8469EDF1F63"><enum>(iii)</enum><text>1 member shall
be from a labor organization representing health care workers;</text>
</clause><clause id="H55E7218012C748B78904A2A45D38D483"><enum>(iv)</enum><text>1
member shall have expertise in privacy and security;</text>
</clause><clause id="HE1B5329B833D46DEA0C431AF75328235"><enum>(v)</enum><text>1
member shall have expertise in improving the health of vulnerable
populations;</text>
</clause><clause id="HCC0B27966D954940A064DB2926EA16B5"><enum>(vi)</enum><text>1
member shall be from the research community;</text>
</clause><clause id="H9F999E8BC9054E8BB7B6A2C3FE42EA69"><enum>(vii)</enum><text>1 member shall
represent health plans or other third-party payers;</text>
</clause><clause id="HE52F3C64BA044637B9E2937512A81DB9"><enum>(viii)</enum><text>1 member shall
represent information technology vendors;</text>
</clause><clause id="H65C226B9F41347FD94B176CDFA81BB5C"><enum>(ix)</enum><text>1
member shall represent purchasers or employers; and</text>
</clause><clause id="HF7B16764797F4EB68B584B94B3FE242"><enum>(x)</enum><text>1
member shall have expertise in health care quality measurement and
reporting.</text>
</clause></subparagraph></paragraph><paragraph id="H20C46B194D874F1DB13B28D918BAA309"><enum>(2)</enum><header>National
Coordinator</header><text display-inline="yes-display-inline">The National
Coordinator shall be a member of the HIT Policy Committee and act as a liaison
among the HIT Policy Committee, the HIT Standards Committee, and the Federal
Government.</text>
</paragraph><paragraph id="H4A499DDC92634409980022BF7DD8F86D"><enum>(3)</enum><header>Chairperson and
vice chairperson</header><text>The HIT Policy Committee shall designate 1
member to serve as the chairperson and 1 member to serve as the vice
chairperson of the HIT Policy Committee.</text>
</paragraph><paragraph id="HCF424B65D3FA4046A6595ECF89D4A440"><enum>(4)</enum><header>Participation</header><text display-inline="yes-display-inline">The members of the HIT Policy Committee
appointed under paragraph (1) shall represent a balance among various sectors
of the health care system so that no single sector unduly influences the
recommendations of such Committee.</text>
</paragraph><paragraph id="HA7196380EDC5457C8468FA273975EFAB"><enum>(5)</enum><header>Terms</header>
<subparagraph id="HE5279E634DC045879146852B61F9CE82"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">The terms of members
of the HIT Policy Committee appointed under paragraph (1) shall be 3 years
except that the Comptroller General of the United States shall designate
staggered terms for the members first appointed under paragraph (1)(G).</text>
</subparagraph><subparagraph id="H27865311C3A54152B900AB2CB5A600"><enum>(B)</enum><header>Vacancies</header><text display-inline="yes-display-inline">Any member appointed to fill a vacancy in
the membership of the HIT Policy Committee that occurs prior to the expiration
of the term for which the member’s predecessor was appointed shall be appointed
only for the remainder of that term. A member may serve after the expiration of
that member’s term until a successor has been appointed. A vacancy in the HIT
Policy Committee shall be filled in the manner in which the original
appointment was made.</text>
</subparagraph></paragraph><paragraph id="H55EA615BBF624A24B3DE7EF531323CFF"><enum>(6)</enum><header>Outside
involvement</header><text display-inline="yes-display-inline">The HIT Policy
Committee shall ensure an adequate opportunity for the participation in
activities of the Committee of outside advisors, including individuals with
expertise in the development of policies for the electronic exchange and use of
health information, including in the areas of health information privacy and
security.</text>
</paragraph><paragraph id="H823C68FCC0D44E8DA8427509DB4EC500"><enum>(7)</enum><header>Quorum</header><text display-inline="yes-display-inline">Ten members of the HIT Policy Committee
shall constitute a quorum for purposes of voting, but a lesser number of
members may meet and hold hearings.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H3F674C0B396245D38391EF2323A2A6FE"><enum>(d)</enum><header>Application of
FACA</header><text>The <act-name parsable-cite="FACA">Federal Advisory
Committee Act</act-name> (5 U.S.C. App.), other than section 14 of such Act,
shall apply to the HIT Policy Committee.</text>
</subsection><subsection display-inline="no-display-inline" id="H7C52A45DB5994C959761CEFD362979D8"><enum>(e)</enum><header>Publication</header><text display-inline="yes-display-inline">The Secretary shall provide for publication
in the Federal Register and the posting on the Internet website of the Office
of the National Coordinator for Health Information Technology of all policy
recommendations made by the HIT Policy Committee under this section.</text>
</subsection></section><section id="H2A5C975A2681463BA2904B2100F400C3"><enum>3003.</enum><header>HIT Standards
Committee</header>
<subsection id="H2D65098B4AE84858A689605F9E1D3966"><enum>(a)</enum><header>Establishment</header><text display-inline="yes-display-inline">There is established a committee to be
known as the HIT Standards Committee to recommend to the National Coordinator
standards, implementation specifications, and certification criteria for the
electronic exchange and use of health information for purposes of adoption
under section 3004(b), consistent with the implementation of the strategic plan
described in section 3001(c)(3).</text>
</subsection><subsection id="HC8EFBF1A61B841A49EE7823200D59C8D"><enum>(b)</enum><header>Duties</header>
<paragraph id="H0E7CDA21D3C24314A7AE50A7E37E152"><enum>(1)</enum><header>Standard
development</header>
<subparagraph id="H771D1D6C672F456187694B82D925C652"><enum>(A)</enum><header>In
general</header><text>Beginning not later than 1 year after the date of the
enactment of this title, the HIT Standards Committee shall recommend to the
National Coordinator standards, implementation specifications, and
certification criteria described in subsection (a) that have been developed,
harmonized, or recognized by the Committee. Annually thereafter the Committee
shall update such recommendations and make new recommendations as appropriate,
including in response to a notification sent under section 3004(b)(2). Such
recommendations shall be consistent with the latest recommendations made by the
HIT Policy Committee.</text>
</subparagraph><subparagraph id="H5C0CA19A1BB646BA8B9BCDEDBDB8009"><enum>(B)</enum><header>Pilot testing of
standards and implementation specifications</header><text display-inline="yes-display-inline">In the development, harmonization, or
recognition of standards and implementation specifications, the HIT Standards
Committee, as appropriate, shall provide for the testing of such standards and
specifications by the National Institute for Standards and Technology under
section 201 of the PRO(TECH)T Act of 2008.</text>
</subparagraph><subparagraph commented="no" id="HDA19F7E660454BAEA7E7EE516F21E6CD"><enum>(C)</enum><header>Consistency</header><text>The
standards, implementation specifications, and certification criteria
recommended under this subsection shall be consistent with the standards for
information transactions and data elements adopted pursuant to section 1173 of
the Social Security Act.</text>
</subparagraph></paragraph><paragraph id="H222DC38840444FD9004BCBFE9682B62C"><enum>(2)</enum><header>Forum</header><text display-inline="yes-display-inline">The HIT Standards Committee shall serve as
a forum for the participation of a broad range of stakeholders to provide input
on the development, harmonization, and recognition of standards, implementation
specifications, and certification criteria necessary for the development and
adoption of a nationwide interoperable health information technology
infrastructure.</text>
</paragraph><paragraph commented="no" id="H84949CFA97B84ADC8F0944E41BC17000"><enum>(3)</enum><header>Schedule</header><text>Not
later than 90 days after the date of the enactment of this title, the HIT
Standards Committee shall develop a schedule for the assessment of policy
recommendations developed by the HIT Policy Committee under section 3002. The
HIT Standards Committee shall update such schedule annually. The Secretary
shall publish such schedule in the Federal Register.</text>
</paragraph><paragraph id="HCB840A223621438DBD776D00B9331CB0"><enum>(4)</enum><header>Public
input</header><text display-inline="yes-display-inline">The HIT Standards
Committee shall conduct open public meetings and develop a process to allow for
public comment on the schedule described in paragraph (3) and recommendations
described in this subsection. Under such process comments shall be submitted in
a timely manner after the date of publication of a recommendation under this
subsection.</text>
</paragraph><paragraph display-inline="no-display-inline" id="HBD2EE68F4A404F7284F0B66D511300F4"><enum>(5)</enum><header>Website</header><text display-inline="yes-display-inline">The HIT Standards Committee shall develop
and maintain an Internet website on which there is posted information that
includes the following:</text>
<subparagraph id="HE993B61944D644079361519F31ED7754"><enum>(A)</enum><text>Established
governance rules.</text>
</subparagraph><subparagraph id="HA662777F8F55481A88B10414C6C08302"><enum>(B)</enum><text>A business
plan.</text>
</subparagraph><subparagraph id="HD3702900A58E48BBB95B2DB2D41240B0"><enum>(C)</enum><text>Meeting notices at
least 14 days prior to each meeting.</text>
</subparagraph><subparagraph id="H2255A2E6E78F4DCD8400F5B208F00F5"><enum>(D)</enum><text>Meeting agendas at
least 7 days prior to each meeting.</text>
</subparagraph><subparagraph id="HC91D4621036B4EE290CF955668809CE"><enum>(E)</enum><text>Meeting materials
at least 3 days prior to each meeting.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H9BFA1182F19F406A8714B100F87967C8"><enum>(6)</enum><header>Requirement to
integrate recommendations</header><text display-inline="yes-display-inline">In
carrying out the activities under this section, the HIT Standards Committee
shall integrate the recommendations of the HIT Policy Committee.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H386C5678A8D14CB980CD93FA40339496"><enum>(c)</enum><header>Membership</header>
<paragraph id="H2362F7C7855B459CB716A2A961AD13F3"><enum>(1)</enum><header>Appointments</header><text display-inline="yes-display-inline">The HIT Standards Committee shall be
composed of members to be appointed as follows:</text>
<subparagraph id="HB13F7405948C4EAA935BD06336693B43"><enum>(A)</enum><text>2 members shall be
appointed by the Secretary.</text>
</subparagraph><subparagraph id="HF0EA2B3CAFC74BB3913100320092FF07"><enum>(B)</enum><text>1 member shall be
appointed by the majority leader of the Senate.</text>
</subparagraph><subparagraph id="H76815AF99F0A4384888456B4C2F4FEF8"><enum>(C)</enum><text>1 member shall be
appointed by the minority leader of the Senate.</text>
</subparagraph><subparagraph id="HA840272E028D4253A1C3D731BEC7F0D3"><enum>(D)</enum><text>1 member shall be
appointed by the Speaker of the House of Representatives.</text>
</subparagraph><subparagraph id="HEBBBA866A5BB44CE81A20076BF18058F"><enum>(E)</enum><text>1 member shall be
appointed by the minority leader of the House of Representatives.</text>
</subparagraph><subparagraph id="H80D107101A724B61BAA924B4BB28EB7"><enum>(F)</enum><text>9 members shall be
appointed by the Comptroller General of the United States of whom—</text>
<clause id="HC66C96B8C9FE43388C299CE838D19EEB"><enum>(i)</enum><text>1
member shall be a representative of consumer or patient organizations;</text>
</clause><clause id="H21AF3C5C798947519916732F47367099"><enum>(ii)</enum><text>1
member shall be a representative of organizations with expertise in
privacy;</text>
</clause><clause id="H6994ADD7B5C649148012B908DAF79206"><enum>(iii)</enum><text>1 member shall
be a representative of organizations with expertise in security;</text>
</clause><clause id="HC9565C1DCF534A2E99C830C94688B387"><enum>(iv)</enum><text>2
members shall be a representative of health care providers, one of which shall
be a physician;</text>
</clause><clause id="HC943AB7C8A4840D2919619F6003C037E"><enum>(v)</enum><text>1
member shall be a representative of health plans or other third party
payers;</text>
</clause><clause id="H2720C7DE260741E2B5CA223C00EF805E"><enum>(vi)</enum><text>1
member shall be a representative of information technology vendors;</text>
</clause><clause id="HB217CA90C31C46BD9D47766050FA4EBC"><enum>(vii)</enum><text>1 member shall
be a representative of purchasers or employers; and</text>
</clause><clause id="H9A9067E818A54DAA809EE8921566E2BE"><enum>(viii)</enum><text>1 member shall
be a representative of the health research community.</text>
</clause></subparagraph><subparagraph display-inline="no-display-inline" id="H7A936228E7974B209CAFDB41945FA6E1"><enum>(G)</enum><text>1 member shall be
appointed by the Director of the National Institute for Standards and
Technology.</text>
</subparagraph></paragraph><paragraph id="HFB36F4DD92964D6D91C619AD6BD8A93B"><enum>(2)</enum><header>National
coordinator</header><text display-inline="yes-display-inline">The National
Coordinator shall be a member of the HIT Standards Committee and act as a
liaison among the HIT Standards Committee, the HIT Policy Committee, and the
Federal government.</text>
</paragraph><paragraph id="H3B0C3AF53EB84CC88D9C783B114C7DB3"><enum>(3)</enum><header>Chairperson and
vice chairperson</header><text display-inline="yes-display-inline">The HIT
Standards Committee shall designate 1 member to serve as the chairperson and 1
member to serve as the vice chairperson of the Committee.</text>
</paragraph><paragraph display-inline="no-display-inline" id="H5AA3B065A3504AA6AF87E64BBDCE400"><enum>(4)</enum><header>Participation</header><text display-inline="yes-display-inline">The members of the HIT Standards Committee
appointed under paragraph (1) shall represent a balance among various sectors
of the health care system so that no single sector unduly influences the
recommendations of such Committee.</text>
</paragraph><paragraph id="H8600CCC194264482B0FEBE41BD6600"><enum>(5)</enum><header>Terms</header>
<subparagraph id="H571C12A0972641FEB694131746D7EAB5"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">The terms of members
of the HIT Standards Committee appointed under paragraph (1) shall be 3 years
except that the Comptroller General of the United States shall designate
staggered terms for the members first appointed under paragraph (1)(F).</text>
</subparagraph><subparagraph id="H10EE72BED7A44018B6BC46D76661C229"><enum>(B)</enum><header>Vacancies</header><text display-inline="yes-display-inline">Any member appointed to fill a vacancy in
the membership of the HIT Standards Committee that occurs prior to the
expiration of the term for which the member’s predecessor was appointed shall
be appointed only for the remainder of that term. A member may serve after the
expiration of that member’s term until a successor has been appointed. A
vacancy in the HIT Standards Committee shall be filled in the manner in which
the original appointment was made.</text>
</subparagraph></paragraph><paragraph id="HF9C1F05B9AE74E168EF36239DBC660B8"><enum>(6)</enum><header>Outside
involvement</header><text display-inline="yes-display-inline">The HIT Standards
Committee shall ensure an adequate opportunity for the participation in
activities of the Committee of outside advisors, including individuals with
expertise in the development of standards for the electronic exchange and use
of health information, including in the areas of health information privacy and
security.</text>
</paragraph><paragraph id="H68DEEFBE84D248EDAD72F6CB1DB9C7E"><enum>(7)</enum><header>Quorum</header><text display-inline="yes-display-inline">Eight members of the HIT Standards
Committee shall constitute a quorum for purposes of voting, but a lesser number
of members may meet and hold hearings.</text>
</paragraph></subsection><subsection id="HB69A44D44FCB422B82D14EF8D2501955"><enum>(d)</enum><header>Application of
FACA</header><text>The <act-name parsable-cite="FACA">Federal Advisory
Committee Act</act-name> (5 U.S.C. App.), other than section 14, shall apply to
the HIT Standards Committee.</text>
</subsection><subsection display-inline="no-display-inline" id="H8E7403DFB7944245945CDCE307C428F"><enum>(e)</enum><header>Publication</header><text display-inline="yes-display-inline">The Secretary shall provide for publication
in the Federal Register and the posting on the Internet website of the Office
of the National Coordinator for Health Information Technology of all
recommendations made by the HIT Standards Committee under this section.</text>
</subsection></section><section id="H60C6D8E0359B40BFAAA9B0A613223531"><enum>3004.</enum><header>Process for
adoption of endorsed recommendations</header>
<subsection id="H16723481D1DC47659483CAA5145703CA"><enum>(a)</enum><header>Review of
endorsed standards, specifications, and criteria</header><text display-inline="yes-display-inline">Not later than 90 days after the date of
receipt of standards, implementation specifications, or certification criteria
endorsed under section 3001(c), the Secretary, in consultation with
representatives of other relevant Federal agencies, shall jointly review such
standards, specifications, or criteria and shall determine whether or not to
propose adoption of such standards, specifications, or criteria.</text>
</subsection><subsection id="HE3F0A6A929D64045976E3ED5DE5DD6F3"><enum>(b)</enum><header>Determination to
adopt standards, specifications, and criteria</header><text>If the Secretary
determines—</text>
<paragraph id="H629B9A1627D140EDB7A3B72ECFCCD264"><enum>(1)</enum><text display-inline="yes-display-inline">to propose adoption of any grouping of such
standards, specifications, or criteria, the Secretary shall, through a
rulemaking process, determine whether or not to adopt such grouping of
standards, specifications, or criteria; or</text>
</paragraph><paragraph id="H4D00C2D4E5744AA7BA22AF9DC7E46DA4"><enum>(2)</enum><text display-inline="yes-display-inline">not to propose adoption of any grouping of
standards, specifications, or criteria, the Secretary shall notify the National
Coordinator and the HIT Standards Committee in writing of such determination
and the reasons for not proposing the adoption of such recommendation.</text>
</paragraph></subsection><subsection id="H86435AE4FF634FE8B87FC60004890004"><enum>(c)</enum><header>Publication</header><text>The
Secretary shall provide for publication in the Federal Register of all
determinations made by the Secretary under subsection (a).</text>
</subsection></section><section commented="no" id="HA783500A338D4EA1B84DAF75D07364DD"><enum>3005.</enum><header>Application
and use of adopted standards and implementation specifications by Federal
agencies</header><text display-inline="no-display-inline">For requirements
relating to the application and use by Federal agencies of the standards and
implementation specifications adopted under section 3004(b), see section 111 of
the PRO(TECH)T Act of 2008.</text>
</section><section id="H5278FE3B7D5B45FFA7C4488CDAD7F5A2"><enum>3006.</enum><header>Voluntary
application and use of adopted standards and implementation specifications by
private entities</header>
<subsection id="H4770FC8DD76B421491DEFFBD6398F909"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided
under section 112 of the PRO(TECH)T Act of 2008, any standard or implementation
specification adopted under section 3004(b) shall be voluntary with respect to
private entities.</text>
</subsection><subsection id="HF153A8BCFC4D4ECF8E8B417EBF00A4F2"><enum>(b)</enum><header>Rule of
construction</header><text>Nothing in this subtitle shall be construed to
require that a private entity that enters into a contract with the Federal
Government apply or use the standards and implementation specifications adopted
under section 3004(b) with respect to activities not related to the
contract.</text>
</subsection></section><section id="H084258DC96B445DB8606001CEC55DF3F"><enum>3007.</enum><header>Health
Information Technology Resource Center</header>
<subsection commented="no" id="HECAC5F6D3EE54B7D00FD68003F05E18E"><enum>(a)</enum><header>Development</header>
<paragraph commented="no" id="H2EC2E6244EB64A2686ADE1F17C545B53"><enum>(1)</enum><header>In
general</header><text>The National Coordinator shall develop a Health
Information Technology Resource Center to provide technical assistance and
develop best practices to support and accelerate efforts to adopt, implement,
and effectively use health information technology that allows for the
electronic exchange and use of information in compliance with standards,
implementation specifications, and certification criteria adopted under section
3004(b).</text>
</paragraph><paragraph commented="no" id="H771384AA75F141D986ED2287F8B89D69"><enum>(2)</enum><header>Purposes</header><text>The
purpose of the Center is to—</text>
<subparagraph commented="no" id="H86BFD11EEFC2437CA0E720DBC0F89CB5"><enum>(A)</enum><text>provide a forum
for the exchange of knowledge and experience;</text>
</subparagraph><subparagraph commented="no" id="H8E2C9433DBB44C7EA6CFD93EEF88542"><enum>(B)</enum><text>accelerate the
transfer of lessons learned from existing public and private sector
initiatives, including those currently receiving Federal financial
support;</text>
</subparagraph><subparagraph commented="no" id="H022693A2FC674E24815763C7DEF90030"><enum>(C)</enum><text>assemble, analyze,
and widely disseminate evidence and experience related to the adoption,
implementation, and effective use of health information technology that allows
for the electronic exchange and use of information;</text>
</subparagraph><subparagraph commented="no" id="H10BD74402F29409887597EF226CC7C90"><enum>(D)</enum><text display-inline="yes-display-inline">provide technical assistance for the
establishment and evaluation of regional and local health information networks
to facilitate the electronic exchange of information across health care
settings and improve the quality of health care;</text>
</subparagraph><subparagraph commented="no" id="HFAA11A14AB3848BD8D155E8B89122B37"><enum>(E)</enum><text>provide technical
assistance for the development and dissemination of solutions to barriers to
the exchange of electronic health information;</text>
</subparagraph><subparagraph id="H3647C1E425CD48C5ADDB8C7C24AAE27F"><enum>(F)</enum><text>learn about
effective strategies to adopt and utilize health information technology in
medically underserved communities;</text>
</subparagraph><subparagraph commented="no" id="H5D426E5100CC4EF8997D58A711A0D3B0"><enum>(G)</enum><text>conduct other
activities identified by the States, local or regional health information
networks, or health care stakeholders as a focus for developing and sharing
best practices; and</text>
</subparagraph><subparagraph id="H007FB2FC67C94C09A37472D2C2B1828"><enum>(H)</enum><text>provide technical
assistance to promote adoption and utilization of health information technology
by health care providers, including in medically underserved
communities.</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="HDD8757C832514AD98B80DDEE49E000B4"><enum>(b)</enum><header>Technical
Assistance Telephone Number or Website</header><text>The National Coordinator
shall establish a toll-free telephone number or Internet website to provide
health care providers with a single point of contact to—</text>
<paragraph commented="no" id="H9B5DCF78C82F4F3DB59159AF6777F8EF"><enum>(1)</enum><text>learn about
Federal grants and technical assistance services related to interoperable
health information technology;</text>
</paragraph><paragraph commented="no" id="HAFDB3372029240E499D8CA2494BC82BE"><enum>(2)</enum><text>learn about
standards, implementation specifications, and certification criteria adopted
under section 3004(b);</text>
</paragraph><paragraph commented="no" id="H637AB1DA0B5A43BBA1B43039BDC491BA"><enum>(3)</enum><text>learn about
regional and local health information networks for assistance with health
information technology; and</text>
</paragraph><paragraph commented="no" id="HF5CD3FFA7A9346F9A6BDF911514ECCEC"><enum>(4)</enum><text>disseminate
additional information determined by the National
Coordinator.</text>
</paragraph></subsection></section></subtitle>.
102.
(a)To the extent consistent with section 3001
of the Public Health Service Act, as added by section 101, all functions,
personnel, assets, liabilities, and administrative actions applicable to the
National Coordinator for Health Information Technology appointed under
Executive Order 13335 or the Office of such National Coordinator on the date
before the date of the enactment of this Act shall be transferred to the
National Coordinator appointed under section 3001(a) of such Act and the Office
of such National Coordinator as of the date of the enactment of this
Act.
(b)
(1)To the extent
consistent with sections 3002 and 3003 of the Public Health Service Act, as
added by section 101, all functions, personnel, assets, and liabilities
applicable to the American Health Information Community created in response to
Executive Order 13335 as of the day before the date of the enactment of this
Act shall be transferred to the HIT Policy Committee or the HIT Standards
Committee, established under section 3002(a) or 3003(a) of such Act, as
appropriate, as of the date of the enactment of this Act.
(2)In carrying out section 3003(b)(1)(A) of
the Public Health Service Act, as so added, until recommendations are made by
the HIT Policy Committee, recommendations of the HIT Standards Committee shall
be consistent with the most recent recommendations made by the American Health
Information Community.
(c)
(1)Nothing
in section 3001 of the Public Health Service Act, as added by section 101, or
subsection (a) shall be construed as requiring the creation of a new entity to
the extent that the Office of the National Coordinator for Health Information
Technology established pursuant to Executive Order 13335 is consistent with the
provisions of such section 3001.
(2)Nothing in sections 3002 or 3003 of the
Public Health Service Act, as added by section 101, or subsection (b) shall be
construed as requiring the creation of a new entity to the extent that the
American Health Information Community created in response to Executive Order
13335 is consistent with the provisions of such sections 3002 and 3003.
IIApplication and
use of adopted health information technology standards; reports
111.Coordination of
Federal activities with adopted standards and implementation
specifications
(a)Spending on
health information technology systemsAs each agency (as defined in the Executive
Order issued on August 22, 2006, relating to promoting quality and efficient
health care in Federal government administered or sponsored health care
programs) implements, acquires, or upgrades health information technology
systems used for the direct exchange of individually identifiable health
information between agencies and with non-Federal entities, it shall utilize,
where available, health information technology systems and products that meet
standards and implementation specifications adopted under section 3004(b) of
the Public Health Service Act, as added by section 101.
(b)Federal
information collection activitiesWith respect to a standard or
implementation specification adopted under section 3004(b) of the Public Health
Service Act, as added by section 101, the President shall take measures to
ensure that Federal activities involving the broad collection and submission of
health information are consistent with such standard or specification,
respectively, within three years after the date of such adoption.
(c)Application of
definitionsThe definitions contained in section 3000 of the
Public Health Service Act, as added by section 101, shall apply for purposes of
this part.
112.Application to
private entitiesEach agency
(as defined in such Executive Order issued on August 22, 2006, relating to
promoting quality and efficient health care in Federal government administered
or sponsored health care programs) shall require in contracts or agreements
with health care providers, health plans, or health insurance issuers that as
each provider, plan, or issuer implements, acquires, or upgrades health
information technology systems, it shall utilize, where available, health
information technology systems and products that meet standards and
implementation specifications adopted under section 3004(b) of the Public
Health Service Act, as added by section 101.
113.
(a)The Secretary of
Health and Human Services shall submit to the Committee on Health, Education,
Labor, and Pensions and the Committee on Commerce, Science, and Transportation
of the Senate and the Committee on Energy and Commerce and the Committee on
Science and Technology of the House of Representatives, on an annual basis, a
report that—
(1)describes the
specific actions that have been taken by the Federal Government and private
entities to facilitate the adoption of an interoperable nationwide system for
the electronic exchange of health information;
(2)describes barriers
to the adoption of such a nationwide system; and
(3)contains
recommendations to achieve full implementation of such a nationwide
system.
(b)Reimbursement
incentive studyThe Secretary
of Health and Human Services shall carry out, or contract with a private entity
to carry out, a study that examines methods to create efficient reimbursement
incentives for improving health care quality in Federally qualified health
centers, rural health clinics, and free clinics.
BIncentives for the
Use of Health Information Technology
121.Grant, loan,
and demonstration programsTitle XXX of the Public Health Service Act,
as added by section 101, is amended by adding at the end the following new
subtitle:
BIncentives for the
Use of Health Information Technology
3011.Grants and
loans To facilitate the widespread adoption of qualified health information
technology
(a)Competitive
grants To facilitate the widespread adoption of health information
technology
(1)The National Coordinator may award competitive grants to
eligible entities to purchase qualified health information technology.
(2)Qualified health
information technologyFor
purposes of this section, the term qualified health information
technology means health information technology that consists of
hardware, software, or the provision of support services and that—
(A)enables the protection of health
information, in accordance with applicable law;
(B)is (or is necessary for the operation of)
an electronic health records system, including the provision of decision
support and physician order entry for medications;
(C)has the ability to
allow timely and permissible access to patient information and to transmit and
exchange health information among providers, patients, or insurers; and
(D)is certified under
the program developed under section 3001(c)(9) to be in compliance with any
applicable standards and implementation specifications adopted under section
3004(b).
(3)To be eligible to receive a grant under
paragraph (1) an entity shall—
(A)submit to the National Coordinator an
application at such time and in such manner as the National Coordinator may
require, and containing—
(i)a
plan on how the entity intends to maintain and support the qualified health
information technology that would be purchased with amounts under such grant,
including the type of resources expected to be involved; and
(ii)such other
information as the National Coordinator may require;
(B)submit to the
National Coordinator a strategic plan for the electronic exchange and use of
health information;
(C)be—
(i)a
not for profit hospital or a Federally qualified health center (as defined in
section 1861(aa)(4) of the Social Security
Act);
(ii)an individual or
group practice; or
(iii)another health
care provider not described in clause (i) or (ii);
(D)demonstrate
significant financial need;
(E)agree to notify individuals in accordance
with section 302 of the PRO(TECH)T Act of 2008 if their individually
identifiable health information is accessed or acquired as a result of a
breach; and
(F)provide matching
funds in accordance with paragraph (5).
(4)Amounts received under a grant under this subsection shall
be used to facilitate the purchase of qualified health information
technology.
(5)To be eligible for a grant under this subsection an
entity shall contribute non-Federal contributions to the costs of carrying out
the activities for which the grant is awarded in an amount equal to $1 for each
$3 of Federal funds provided under the grant.
(6)Preference in
awarding grantsIn awarding grants under this subsection the
National Coordinator shall give preference to the following eligible
entities:
(A)Small health care
providers.
(B)Entities that are located in rural,
frontier, and other areas that serve uninsured, underinsured, and medically
underserved individuals (regardless of whether such area is urban, rural, or
frontier).
(C)Entities that will
link, to the extent practicable, to local or regional health information plan
or plans.
(D)Nonprofit health
care providers.
(7)Additional
sources of funding for health information technologyFunding made
available under this subsection is in addition to funding which may be used
toward the acquisition and utilization of health information technology under
other law, which includes the following:
(A)Medicaid
transformation grants under section 1903(z) of the Social Security Act.
(B)Grants or funding
available through the Agency for Healthcare Research and Quality.
(C)Grants or funding
that may be available through the Health Resources and Services Administration
for investment in health information technologies or telehealth.
(D)Grants or funding
that may be available through the Department of Agriculture’s Rural Development
Telecommunications Program for investment in telemedicine.
(b)Competitive
Grants to States and Indian tribes for the Development of Loan Programs To
Facilitate the Widespread Adoption of qualified Health Information
Technology
(1)The National
Coordinator may award competitive grants to eligible entities for the
establishment of programs for loans to health care providers to purchase
qualified health information technology.
(2)For purposes of this
subsection, the term eligible entity means a State or Indian tribe
(as defined in the Indian Self-Determination and Education Assistance Act)
that—
(A)submits to the
National Coordinator an application at such time, in such manner, and
containing such information as the National Coordinator may require;
(B)submits to the
National Coordinator a strategic plan in accordance with paragraph (4) and
provides to the National Coordinator assurances that the entity will update
such plan annually in accordance with such paragraph;
(C)provides
assurances to the National Coordinator that the entity will establish a Loan
Fund in accordance with paragraph (3);
(D)provides
assurances to the National Coordinator that the entity will not provide a loan
from the Loan Fund to a health care provider unless the provider meets each of
the conditions described in paragraph (5); and
(E)agrees to provide
matching funds in accordance with paragraph (9).
(3)For purposes of paragraph (3)(C), an eligible entity shall
establish a qualified health information technology loan fund (referred to in
this subsection as a Loan Fund
) and comply with the other
requirements contained in this section. A grant to an eligible entity under
this subsection shall be deposited in the Loan Fund established by the eligible
entity. No funds authorized by other provisions of this subtitle to be used for
other purposes specified in this subtitle shall be deposited in any Loan
Fund.
(4)
(A)For purposes of paragraph (3)(B), a strategic plan of an
eligible entity under this paragraph shall identify the intended uses of
amounts available to the Loan Fund of such entity.
(B)A
strategic plan under subparagraph (A), with respect to a Loan Fund of an
eligible entity, shall include for a year the following:
(i)A
list of the projects to be assisted through the Loan Fund during such
year.
(ii)A
description of the criteria and methods established for the distribution of
funds from the Loan Fund during the year.
(iii)A description of
the financial status of the Loan Fund as of the date of submission of the
plan.
(iv)The short-term
and long-term goals of the Loan Fund.
(5)Health care
provider conditions for receipt of loansFor purposes of
paragraph (2)(D), the conditions described in this paragraph, with respect to a
health care provider that seeks a loan from a Loan Fund established under this
subsection, are the following:
(A)The health care
provider links, to the extent practicable, to a local or regional health
information network.
(B)The health care
provider consults with the Health Information Technology Resource Center
established under section 3007 to access the knowledge and experience of
existing initiatives regarding the successful implementation and effective use
of health information technology.
(C)The health care provider agrees to notify
individuals in accordance with section 302 of the PRO(TECH)T Act of 2008 if
their individually identifiable health information is accessed or acquired as a
result of a breach.
(D)The health care provider submits to the
State or Indian tribe involved a plan on how the health care provider intends
to maintain and support the qualified health information technology that would
be purchased with such loan, including the type of resources expected to be
involved and any such other information as the State or Indian Tribe,
respectively, may require.
(6)
(A)Amounts deposited in a Loan Fund, including loan
repayments and interest earned on such amounts, shall be used only for awarding
loans or loan guarantees, or as a source of reserve and security for leveraged
loans, the proceeds of which are deposited in the Loan Fund established under
paragraph (1). Loans under this section may be used by a health care provider
to purchase qualified health information technology.
(B)Amounts
received by an eligible entity under this subsection may not be used—
(i)for the purchase
or other acquisition of any health information technology system that is not a
qualified health information technology;
(ii)to conduct
activities for which Federal funds are expended under this title; or
(iii)for any purpose
other than making loans to health care providers in accordance with this
section.
(7)Except as otherwise limited by applicable State law,
amounts deposited into a Loan Fund under this subsection may only be used for
the following:
(A)To award loans
that comply with the following:
(i)The interest rate
for each loan shall not exceed the market interest rate.
(ii)The principal and
interest payments on each loan shall commence not later than 1 year after the
date the loan was awarded, and each loan shall be fully amortized not later
than 10 years after the date of the loan.
(iii)The Loan Fund
shall be credited with all payments of principal and interest on each loan
awarded from the Loan Fund.
(B)To guarantee, or
purchase insurance for, a local obligation (all of the proceeds of which
finance a project eligible for assistance under this subsection) if the
guarantee or purchase would improve credit market access or reduce the interest
rate applicable to the obligation involved.
(C)As a source of
revenue or security for the payment of principal and interest on revenue or
general obligation bonds issued by the eligible entity if the proceeds of the
sale of the bonds will be deposited into the Loan Fund.
(D)To earn interest
on the amounts deposited into the Loan Fund.
(8)Administration of
Loan Funds
(A)Combined
financial administrationAn eligible entity may (as a convenience
and to avoid unnecessary administrative costs) combine, in accordance with
applicable State law, the financial administration of a Loan Fund established
under this subsection with the financial administration of any other revolving
fund established by the entity if otherwise not prohibited by the law under
which the Loan Fund was established.
(B)Cost of
administering fundEach eligible entity may annually use not to
exceed 4 percent of the funds provided to the entity under a grant under this
subsection to pay the reasonable costs of the administration of the programs
under this section, including the recovery of reasonable costs expended to
establish a Loan Fund which are incurred after the date of the enactment of
this title.
(C)The National Coordinator shall publish guidance and
promulgate regulations as may be necessary to carry out the provisions of this
subsection, including—
(i)provisions to
ensure that each eligible entity commits and expends funds allotted to the
entity under this subsection as efficiently as possible in accordance with this
title and applicable State laws; and
(ii)guidance to
prevent waste, fraud, and abuse.
(D)Private sector
contributions
(i)A Loan Fund established under this subsection may accept
contributions from private sector entities, except that such entities may not
specify the recipient or recipients of any loan issued under this subsection.
An eligible entity may agree to reimburse a private sector entity for any
contribution made under this subparagraph, except that the amount of such
reimbursement may not be greater than the principal amount of the contribution
made.
(ii)Availability of
informationAn eligible entity shall make publicly available the
identity of, and amount contributed by, any private sector entity under clause
(i) and may issue letters of commendation or make other awards (that have no
financial value) to any such entity.
(9)
(A)The National Coordinator may not make a grant under
paragraph (1) to an eligible entity unless the entity agrees to make available
(directly or through donations from public or private entities) non-Federal
contributions in cash to the costs of carrying out the activities for which the
grant is awarded in an amount equal to not less than $1 for each $1 of Federal
funds provided under the grant.
(B)Determination of
amount of non-federal contributionIn determining the amount of
non-Federal contributions that an eligible entity has provided pursuant to
subparagraph (A), the National Coordinator may not include any amounts provided
to the entity by the Federal Government.
(10)The
National Coordinator shall annually submit to the Committee on Health,
Education, Labor, and Pensions and the Committee on Finance of the Senate, and
the Committee on Energy and Commerce of the House of Representatives, a report
summarizing the reports received by the National Coordinator from each eligible
entity that receives a grant under this subsection.
(c)Competitive
Grants for the Implementation of Regional or Local Health Information
Technology Plans
(1)The National Coordinator may award competitive grants to
eligible entities to implement regional or local health information plans to
improve health care quality and efficiency through the electronic exchange and
use of health information.
(2)To
be eligible to receive a grant under paragraph (1) an entity shall—
(A)facilitate the
electronic exchange and use of health information within the local or regional
area and among local and regional areas;
(B)demonstrate
financial need to the National Coordinator;
(C)demonstrate that
one of its principal missions or purposes is to use information technology to
improve health care quality and efficiency;
(D)adopt bylaws,
memoranda of understanding, or other charter documents that demonstrate that
the governance structure and decisionmaking processes of such entity allow for
participation on an ongoing basis by multiple stakeholders within a community,
including—
(i)physicians (as
defined in section 1861(r) of the Social Security
Act), including physicians that provide services to low income
populations and populations that are uninsured, underinsured, and medically
underserved (including such populations in urban and rural areas);
(ii)hospitals
(including hospitals that provide services to low income and underserved
populations);
(iii)pharmacists and
pharmacies;
(iv)health
plans;
(v)health centers (as
defined in section 330(b)) and Federally qualified health centers (as defined
in section 1861(aa)(4) of the Social Security
Act);
(vi)rural health
clinics (as defined in section 1861(aa) of the Social Security Act);
(vii)patient or
consumer organizations that reflect the population to be served;
(viii)employers;
(ix)public health
agencies; and
(x)such other health
care providers or other entities, as determined appropriate by the National
Coordinator;
(E)demonstrate the
participation, to the extent practicable, of stakeholders in the electronic
exchange and use of health information within the local or regional health
information plan pursuant to subparagraph (D);
(F)adopt
nondiscrimination and conflict of interest policies that demonstrate a
commitment to open, fair, and nondiscriminatory participation in the regional
or local health information plan by all stakeholders;
(G)comply with applicable standards and
implementation specifications adopted under subtitle A of this title;
(H)prepare and submit
to the National Coordinator an application in accordance with paragraph (3);
and
(I)agree to provide
matching funds in accordance with paragraph (6).
(3)
(A)To be eligible to receive a grant under paragraph (1), an
entity shall submit to the National Coordinator an application at such time, in
such manner, and containing such information (in addition to information
required under subparagraph (B), as the National Coordinator may
require.
(B)At a minimum, an application submitted under this
paragraph shall include—
(i)clearly identified
short-term and long-term objectives of the regional or local health information
plan;
(ii)an estimate of costs of the hardware,
software, training, and other services necessary to implement the regional or
local health information plan;
(iii)a strategy that
includes initiatives to improve health care quality and efficiency;
(iv)a
plan that describes provisions to encourage the electronic exchange and use of
health information by all physicians, including single physician practices and
small physician groups, participating in the health information plan;
(v)a
plan to ensure the privacy and security of individually identifiable health
information that is consistent with applicable Federal and State law;
(vi)a
governance plan that defines the manner in which the stakeholders shall jointly
make policy and operational decisions on an ongoing basis;
(vii)a financial or
business plan that describes—
(I)the sustainability
of the plan;
(II)the financial
costs and benefits of the plan; and
(III)the entities to
which such costs and benefits will accrue;
(viii)a plan on how the entity involved intends
to maintain and support the regional or local health information plan,
including the type of resources expected to be involved; and
(ix)in the case of an
applicant that is unable to demonstrate the participation of all stakeholders
pursuant to paragraph (2)(D), the justification from the entity for any such
nonparticipation.
(4)Amounts received under a grant under paragraph (1) shall be
used to establish and implement a regional or local health information plan in
accordance with this subsection.
(5)In awarding grants under paragraph (1), the
Secretary shall give preference to eligible entities that intend to use amounts
received under a grant to establish or implement a regional or local health
information plan that encompasses communities with health disparities or areas
that serve uninsured, underinsured, and medically underserved individuals
(including urban and rural areas).
(6)
(A)The National Coordinator may not make a grant under this
subsection to an entity unless the entity agrees that, with respect to the
costs of carrying out the activities for which the grant is awarded, the entity
will make available (directly or through donations from public or private
entities) non-Federal contributions toward such costs in an amount equal to not
less than 50 percent of such costs ($1 for each $2 of Federal funds provided
under the grant).
(B)Determination of
amount contributedNon-Federal contributions required under
subparagraph (A) may be in cash or in kind, fairly evaluated, including
equipment, technology, or services. Amounts provided by the Federal Government,
or services assisted or subsidized to any significant extent by the Federal
Government, may not be included in determining the amount of such non-Federal
contributions.
(d)Not
later than 1 year after the date on which the first grant is awarded under this
section, and annually thereafter during the grant period, an entity that
receives a grant under this section shall submit to the National Coordinator a
report on the activities carried out under the grant involved. Each such report
shall include—
(1)a description of
the financial costs and benefits of the project involved and of the entities to
which such costs and benefits accrue;
(2)an analysis of the
impact of the project on health care quality and safety;
(3)a description of
any reduction in duplicative or unnecessary care as a result of the project
involved;
(4)a description of
the efforts of recipients under this section to facilitate secure patient
access to health information;
(5)an analysis of the
effectiveness of the project involved on ensuring the privacy and security of
individually identifiable health information in accordance with applicable
Federal and State law; and
(6)other information
as required by the National Coordinator.
(e)Requirement To
improve quality of care and decrease in costsThe National
Coordinator shall annually evaluate the activities conducted under this section
and shall, in awarding grants, implement the lessons learned from such
evaluation in a manner so that awards made subsequent to each such evaluation
are made in a manner that, in the determination of the National Coordinator,
will result in the greatest improvement in quality of care and decrease in
costs.
(f)An
eligible entity may only receive one non-renewable grant under subsection (a),
one non-renewable grant under subsection (b), and one non-renewable grant under
subsection (c).
(g)Small health
care providerFor purposes of this section, the term small
health care provider means a health care provider that has an average of
10 or fewer full-time equivalent employees during the period involved.
(h)Authorization of
Appropriations
(1)For the purpose of carrying out subsections (a) through
(d), there is authorized to be appropriated $115,000,000 for each of the fiscal
years 2009 through 2013.
(2)Amounts
appropriated under paragraph (1) shall remain available through fiscal year
2013.
3012.Demonstration
program to integrate information technology into clinical education
(a)The Secretary may award grants under this section to
carry out demonstration projects to develop academic curricula integrating
qualified health information technology in the clinical education of health
professionals. Such awards shall be made on a competitive basis and pursuant to
peer review.
(b)To
be eligible to receive a grant under subsection (a), an entity shall—
(1)submit to the
Secretary an application at such time, in such manner, and containing such
information as the Secretary may require;
(2)submit to the
Secretary a strategic plan for integrating qualified health information
technology in the clinical education of health professionals to reduce medical
errors and enhance health care quality;
(3)be—
(A)a school of medicine, osteopathic medicine,
dentistry, or pharmacy, or a graduate program in behavioral or mental
health;
(B)a graduate school
of nursing or physician assistant studies;
(C)a consortium of
two or more schools described in subparagraph (A) or (B); or
(D)an institution
with a graduate medical education program in medicine, osteopathic medicine,
dentistry, pharmacy, nursing, or physician assistance studies.
(4)provide for the
collection of data regarding the effectiveness of the demonstration project to
be funded under the grant in improving the safety of patients, the efficiency
of health care delivery, and in increasing the likelihood that graduates of the
grantee will adopt and incorporate qualified health information technology, in
the delivery of health care services; and
(5)provide matching
funds in accordance with subsection (d).
(c)
(1)With respect to a grant under subsection (a), an eligible
entity shall—
(A)use grant funds in
collaboration with 2 or more disciplines; and
(B)use grant funds to
integrate qualified health information technology into community-based clinical
education.
(2)An
eligible entity shall not use amounts received under a grant under subsection
(a) to purchase hardware, software, or services.
(d)
(1)The Secretary may award a grant to an entity under this
section only if the entity agrees to make available non-Federal contributions
toward the costs of the program to be funded under the grant in an amount that
is not less than $1 for each $2 of Federal funds provided under the
grant.
(2)Determination of
amount contributedNon-Federal contributions under paragraph (1)
may be in cash or in kind, fairly evaluated, including equipment or services.
Amounts provided by the Federal Government, or services assisted or subsidized
to any significant extent by the Federal Government, may not be included in
determining the amount of such contributions.
(e)The
Secretary shall take such action as may be necessary to evaluate the projects
funded under this section and publish, make available, and disseminate the
results of such evaluations on as wide a basis as is practicable.
(f)Not
later than 1 year after the date of enactment of this title, and annually
thereafter, the Secretary shall submit to the Committee on Health, Education,
Labor, and Pensions and the Committee on Finance of the Senate, and the
Committee on Energy and Commerce of the House of Representatives a report
that—
(1)describes the
specific projects established under this section; and
(2)contains
recommendations for Congress based on the evaluation conducted under subsection
(e).
(g)Authorization of
AppropriationsThere is authorized to be appropriated to carry
out this section, $10,000,000 for each of fiscal years 2009 through
2011.
(h)This
section shall not apply after September 30,
2011.
.
<enum>II</enum><header>Testing of Health
Information Technology</header>
<section id="HEABE21D37D474694A86E59D230926989"><enum>201.</enum><header>National
Institute for Standards and Technology testing</header>
<subsection id="H7B7421E0DF0545EF9DD0D0CD2C00C7FD"><enum>(a)</enum><header>Pilot testing of
standards and implementation specifications</header><text>In coordination with
the HIT Standards Committee established under section 3003 of the Public Health
Service Act, as added by section 101, with respect to the development of
standards and implementation specifications under such section, the Director of
the National Institute for Standards and Technology shall test such standards
and specifications in order to assure the efficient implementation and use of
such standards and specifications.</text>
</subsection><subsection id="H0C68E3E415BF437D92DFC88BC360B987"><enum>(b)</enum><header>Voluntary
testing program</header><text display-inline="yes-display-inline">In
coordination with the HIT Standards Committee established under section 3003 of
the Public Health Service Act, as added by section 101, with respect to the
development of standards and implementation specifications under such section,
the Director of the National Institute of Standards and Technology shall
support the establishment of a conformance testing infrastructure, including
the development of technical test beds. The development of this conformance
testing infrastructure may include a program to accredit independent,
non-Federal laboratories to perform testing.</text>
</subsection></section><section id="H8A11956F3FD84CC8AE22D4BA55812E6E"><enum>202.</enum><header>Research and
development programs</header>
<subsection id="H06716995C3174AEE9F9D75C0B0B49CE0"><enum>(a)</enum><header>Health care
Information Enterprise Integration Research Centers</header>
<paragraph id="HCC5D0AACC3EB486A8377543FB726005B"><enum>(1)</enum><header>In
general</header><text>The Director of the National Institute of Standards and
Technology, in consultation the Director of the National Science Foundation and
other appropriate Federal agencies, shall establish a program of assistance to
institutions of higher education (or consortia thereof which may include
nonprofit entities and Federal Government laboratories) to establish
multidisciplinary Centers for Health Care Information Enterprise
Integration.</text>
</paragraph><paragraph id="H2EF71407198748C1BC8B058996FC8E82"><enum>(2)</enum><header>Review;
competition</header><text>Grants shall be awarded under this subsection on a
merit-reviewed, competitive basis.</text>
</paragraph><paragraph id="HDAE9254286DF4FC0BC47608F8B922DCF"><enum>(3)</enum><header>Purpose</header><text>The
purposes of the Centers described in paragraph (1) shall be—</text>
<subparagraph id="H7B822F7CB60B4913998236C27D53FDAE"><enum>(A)</enum><text>to generate
innovative approaches to health care information enterprise integration by
conducting cutting-edge, multidisciplinary research on the systems challenges
to health care delivery; and</text>
</subparagraph><subparagraph id="H89D97542176C4A92A6DD302C3B8EA9C5"><enum>(B)</enum><text>the development
and use of health information technologies and other complementary
fields.</text>
</subparagraph></paragraph><paragraph id="H003D6252041C40E3A1D7341D4B2F2E8C"><enum>(4)</enum><header>Research
areas</header><text>Research areas may include—</text>
<subparagraph id="HCC577BD05714437D00E4F736668838A6"><enum>(A)</enum><text>interfaces between
human information and communications technology systems;</text>
</subparagraph><subparagraph id="HA432109D994B48C893B601008F53EFA9"><enum>(B)</enum><text>voice-recognition
systems;</text>
</subparagraph><subparagraph id="HE1FC159278FB4D09844CFCC332B2E46F"><enum>(C)</enum><text>software that
improves interoperability and connectivity among health information
systems;</text>
</subparagraph><subparagraph id="H4BE9444C589F47CAB55725249B841753"><enum>(D)</enum><text>software
dependability in systems critical to health care delivery;</text>
</subparagraph><subparagraph id="HF4AEAA5F65BA43EE8E161170EE476B5"><enum>(E)</enum><text>measurement of the
impact of information technologies on the quality and productivity of health
care;</text>
</subparagraph><subparagraph id="HD34B102EA8BD477D8B18DF4420956D52"><enum>(F)</enum><text>health information
enterprise management;</text>
</subparagraph><subparagraph id="H6693296274244B38882B6BFA01B629E9"><enum>(G)</enum><text>health information
technology security and integrity; and</text>
</subparagraph><subparagraph id="H4E5C853D574D4967A3564FE8F260B1C6"><enum>(H)</enum><text>relevant health
information technology to reduce medical errors.</text>
</subparagraph></paragraph><paragraph id="HC9A4E5E546E54C248C03BDB82CA413E"><enum>(5)</enum><header>Applications</header><text>An
institution of higher education (or a consortium thereof) seeking funding under
this subsection shall submit an application to the Director of the National
Institute of Standards and Technology at such time, in such manner, and
containing such information as the Director may require. The application shall
include, at a minimum, a description of—</text>
<subparagraph id="H20DD5FC796AA4290009C21A57F820751"><enum>(A)</enum><text>the research
projects that will be undertaken by the Center established pursuant to
assistance under paragraph (1) and the respective contributions of the
participating entities;</text>
</subparagraph><subparagraph id="H943CB1D5AAE446D7A41F101187DE2CD9"><enum>(B)</enum><text>how the Center
will promote active collaboration among scientists and engineers from different
disciplines, such as information technology, biologic sciences, management,
social sciences, and other appropriate disciplines;</text>
</subparagraph><subparagraph id="HDA3CA3DEC64445F2A2A210E1349E0056"><enum>(C)</enum><text>technology
transfer activities to demonstrate and diffuse the research results,
technologies, and knowledge; and</text>
</subparagraph><subparagraph id="H5CD4F76AD5884AD288A79EF50098ED34"><enum>(D)</enum><text>how the Center
will contribute to the education and training of researchers and other
professionals in fields relevant to health information enterprise
integration.</text>
</subparagraph></paragraph></subsection><subsection id="H471D527CB22C4FACB2D21886FC89A8C5"><enum>(b)</enum><header>National
Information Technology Research and Development Program</header><text>The
National High-Performance Computing Program established by section 101 of the
High-Performance Computing Act of 1991 (<external-xref legal-doc="usc" parsable-cite="usc/15/5511">15 U.S.C. 5511</external-xref>) shall coordinate
Federal research and development programs related to the development and
deployment of health information technology, including activities related
to—</text>
<paragraph id="H4C8717263B244161BAACB6DF01462FD9"><enum>(1)</enum><text>computer
infrastructure;</text>
</paragraph><paragraph id="H52BE95E055C04021B091245FC595E844"><enum>(2)</enum><text>data
security;</text>
</paragraph><paragraph id="H001589DF62704EC29720A67E85277090"><enum>(3)</enum><text>development of
large-scale, distributed, reliable computing systems;</text>
</paragraph><paragraph id="H399ECE20A6074E30862F10A350008BC4"><enum>(4)</enum><text>wired, wireless,
and hybrid high-speed networking;</text>
</paragraph><paragraph id="H2F81932E9F4B40E40000E9274CC52F2F"><enum>(5)</enum><text>development of
software and software-intensive systems;</text>
</paragraph><paragraph id="HA3858188D9CA4AB587E7F8A422C2EB6"><enum>(6)</enum><text>human-computer
interaction and information management technologies; and</text>
</paragraph><paragraph id="H3AC1142FDE464EFD8702E92B1D101561"><enum>(7)</enum><text>the social and
economic implications of information technology.</text>
</paragraph></subsection></section><enum>III</enum><header>Privacy and
security provisions</header>
<section commented="no" display-inline="no-display-inline" id="H980101B064AC472482F0A85D892957C8" section-type="subsequent-section"><enum>300.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title, except as specified
otherwise:</text>
<paragraph commented="no" id="HA12837D38C63409EBDAE93D913DA800"><enum>(1)</enum><header>Breach</header><text display-inline="yes-display-inline">The term <term>breach</term> means the
unauthorized acquisition or disclosure of protected health information which
compromises the security, privacy, or integrity of protected health information
maintained by or on behalf of a person. Such term does not include any
unintentional acquisition of such information by an employee or agent of the
covered entity or business associate involved if such acquisition was made in
good faith and within the course and scope of the employment or other
contractual relationship of such employee or agent, respectively, with the
covered entity or business associate and if such information is not further
acquired, used, or disclosed by such employee or agent.</text>
</paragraph><paragraph commented="no" id="HB771E386E58B4652007E642D84AED86E"><enum>(2)</enum><header>Business
associate</header><text display-inline="yes-display-inline">The term
<term>business associate</term> has the meaning given such term in section
160.103 of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="H59D587CD83134981AEFDDD340050D8DF"><enum>(3)</enum><header>Covered
entity</header><text display-inline="yes-display-inline">The term <term>covered
entity</term> has the meaning given such term in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45,
Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="H0F99782E98F04466A5EAF404C2CAE638"><enum>(4)</enum><header>Disclose</header><text>The
terms <term>disclose</term> and <term>disclosure</term> have the meaning given
the term <term>disclosure</term> in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45, Code of
Federal Regulations.</text>
</paragraph><paragraph commented="no" id="H6B3B165DA8624A6EB650F1DF4333F9E9"><enum>(5)</enum><header>Encryption</header><text>The
term <term>encryption</term> has the meaning given such term in section 164.304
of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HC0FC7213F90A4BC4AE8D89C5D008066E"><enum>(6)</enum><header>Health care
operations</header><text display-inline="yes-display-inline">The term
<term>health care operation</term> has the meaning given such term in section
164.501 of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HA904962957E348D2AEDA9F02C9BF7B1F"><enum>(7)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> has the
meaning given such term in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45, Code of Federal
Regulations.</text>
</paragraph><paragraph id="H9F2C4AC730264F468B72FF1B9BC1A7F3"><enum>(8)</enum><header>Personal health
record</header><text display-inline="yes-display-inline">The term
<term>personal health record</term> means an electronic record of individually
identifiable health information on an individual that is drawn from multiple
sources and that is managed, shared, and controlled by or for the
individual.</text>
</paragraph><paragraph commented="no" id="H307FDDB209844DD891E9EE10DA1BABAB"><enum>(9)</enum><header>Protected health
information</header><text display-inline="yes-display-inline">The term
<term>protected health information</term> has the meaning given such term under
<external-xref legal-doc="regulation" parsable-cite="cfr/45/160.103">section 160.103</external-xref> of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HFB7586840CF84A14936301A4A8924B2"><enum>(10)</enum><header>Secretary</header><text>The
term <term>Secretary</term> means the Secretary of Health and Human
Services.</text>
</paragraph><paragraph commented="no" id="H6B779AE58BAB46DCBA1D11F481D7D28B"><enum>(11)</enum><header>Security</header><text>The
term <term>security</term> has the meaning given such term in section 164.304
of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="H31CF3EC661D047C1AA1686CA57139DBB"><enum>(12)</enum><header>State</header><text>The
term <term>State</term> means each of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Northern Mariana Islands.</text>
</paragraph><paragraph commented="no" id="HB781C2A77444486EB053B80006B9AB48"><enum>(13)</enum><header>Use</header><text>The
term <term>use</term> has the meaning given such term in section 160.103 of
title 45, Code of Federal Regulations.</text>
</paragraph><paragraph id="HC0795F995D7446BFA3484D16D1BD0097"><enum>(14)</enum><header>Vendor of
personal health records</header><text>The term <term>vendor</term> means an
entity that offers or maintains a personal health record and that is not a
covered entity.</text>
</paragraph></section><subtitle id="H6ACD206E8E3A4A9CAED0006C5F0054B9"><enum>A</enum><header>Security
provisions</header>
<section id="H2848FB1D43024504AEF4320098B6A707"><enum>301.</enum><header>Application of
security provisions and penalties to business associates of covered entities;
annual guidance on security provisions</header>
<subsection id="HEDEB75EC4A1D4017A7CD1E5C5FBF6235"><enum>(a)</enum><header>Application of
security provisions</header><text display-inline="yes-display-inline">Sections
164.308, 164.310, and 164.312 of title 45, Code of Federal Regulations, shall
apply to a business associate of a covered entity in the same manner that such
sections apply to the covered entity.</text>
</subsection><subsection id="H53A2EB1006F442E7A0BBB99004772DAA"><enum>(b)</enum><header>Application of
civil and criminal penalties</header><text display-inline="yes-display-inline">Sections 1176 and 1177 of the Social
Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>, 1320d–6) shall apply to a business associate
of a covered entity with respect to a section applied under subsection (a) to
such business associate in the same manner that such sections apply to a
covered entity with respect to such section.</text>
</subsection><subsection id="HA922F2973FAF4FF2A9A9F1CCADF0CABC"><enum>(c)</enum><header>Annual
guidance</header><text>For the first year beginning after the date of the
enactment of this Act and annually thereafter, the Secretary of Health and
Human Services shall, in consultation with industry stakeholders, annually
issue guidance on the latest safeguard technologies for use in carrying out the
sections described in subsection (a).</text>
</subsection></section><section id="H0A63883AD2FA4374820400B007ABDD07"><enum>302.</enum><header>Notification in
the case of breach</header>
<subsection id="H8EBBFFE133D34EE0838F726C03589B58"><enum>(a)</enum><header>In
general</header><text>A covered entity that accesses, maintains, retains,
modifies, records, stores, destroys, or otherwise holds, uses, or discloses
unencrypted protected health information (as defined in subsection (h)) shall,
in the case of a breach of such information that is discovered by the covered
entity, notify each individual whose unencrypted protected health information
has been, or is reasonably believed by the covered entity to have been,
accessed or acquired as a result of such breach.</text>
</subsection><subsection id="H1FD936DB5C0D41D08706D7176ED05EE0"><enum>(b)</enum><header>Notification of
covered entity by business associate</header><text>A business associate of a
covered entity that accesses, maintains, retains, modifies, records, stores,
destroys, or otherwise holds, uses, or discloses unencrypted protected health
information shall, following the discovery of a breach of such information,
notify the covered entity of such breach. Such notice shall include the
identification of each individual whose unencrypted protected health
information has been, or is reasonably believed to have been, accessed or
acquired during such breach.</text>
</subsection><subsection id="H4F1A9F8AED704B52973303473EE5DC5"><enum>(c)</enum><header>Breaches treated
as discovered</header><text>For purposes of this section, a breach shall be
treated as discovered by a covered entity or by a business associate as of the
first day on which such breach is known to such entity or associate,
respectively, (including any person that is an employee, officer, or other
agent of such entity or associate, respectively) or should reasonably have been
known to such entity or associate (or person) to have occurred.</text>
</subsection><subsection id="HEE7A32C499B3453196FC8568FA838155"><enum>(d)</enum><header>Timeliness of
notification</header>
<paragraph id="H3532E4E999544AB6B72576C8473124E9"><enum>(1)</enum><header>In
general</header><text>All notifications required under this section shall be
made without unreasonable delay and in no case later than 60 calendar days
after the discovery of a breach by the covered entity involved (or business
associate involved in the case of a notification required under subsection
(b)).</text>
</paragraph><paragraph id="H30DF224E40C8432A95FB5FDEBDFFEEB5"><enum>(2)</enum><header>Burden of
proof</header><text>The covered entity involved (or business associate involved
in the case of a notification required under subsection (b)), shall have the
burden of demonstrating that all notifications were made as required under this
subtitle, including evidence demonstrating the necessity of any delay.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H158F3B9DF394484DB4820970FA51D782"><enum>(e)</enum><header>Methods of
notice</header>
<paragraph id="HCBCACB99BD4D4A0700A43C179857B88"><enum>(1)</enum><header>Individual
notice</header><text display-inline="yes-display-inline">Notice required under
this section to be provided to an individual, with respect to a breach, shall
be provided promptly and in the following form:</text>
<subparagraph id="H48D3284E5FCF4E00BA34028DBE2CA288"><enum>(A)</enum><text>Written
notification by first-class mail to the individual (or the next of kin of the
individual if the individual is deceased) at the last known address of the
individual or the next of kin, respectively, or, if specified as a preference
by the individual, by electronic mail. The notification may be provided in one
or more mailings as information is available.</text>
</subparagraph><subparagraph id="HC4E2C7F10B9A4DDCA7B247EA854DB009"><enum>(B)</enum><text>In the case where
there is insufficient, or out-of-date contact information that precludes direct
written (or, if specified by the individual under subparagraph (A), electronic)
notification to the individual, a substitute form of notice shall be provided,
including a conspicuous posting on the home page of the Web site of the covered
entity involved or notice in major print or broadcast media, including major
media in geographic areas where the individuals affected by the breach likely
reside. Such a notice in media will include a toll-free phone number where an
individual can learn whether or not the individual’s unencrypted protected
health information is possibly included in the breach.</text>
</subparagraph><subparagraph id="H574B842D8E1446C3893167FC1923EDEB"><enum>(C)</enum><text>In any case deemed
by the covered entity involved to require urgency because of possible imminent
misuse of unencrypted protected health information, the covered entity, in
addition to notice provided under subparagraph (A), may provide information to
individuals by telephone or other means, as appropriate.</text>
</subparagraph></paragraph><paragraph id="HCB84FCB548584404BBEB3BCA64BCBDF1"><enum>(2)</enum><header>Media
notice</header><text>Notice shall be provided to prominent media outlets
serving a State or jurisdiction, following the discovery of a breach described
in subsection (a), if the unencrypted protected health information of more than
500 residents of such State or jurisdiction is, or is reasonably believed to
have been, accessed or acquired during such breach.</text>
</paragraph><paragraph id="H486EB299D56146B198DDE72980640012"><enum>(3)</enum><header>Notice to
Secretary</header><text display-inline="yes-display-inline">Notice shall be
provided to the Secretary by covered entities of unencrypted protected health
information that has been acquired or disclosed in a breach.</text>
</paragraph><paragraph id="HFCE60C5D793A4468A543B5A940C3E8A9"><enum>(4)</enum><header>Posting on HHS
public website</header><text display-inline="yes-display-inline">The Secretary
shall make available to the public on the Internet website of the Department of
Health and Human Services a list that identifies each covered entity involved
in a breach described in subsection (a) in which the unencrypted protected
health information of more than 1,000 individuals is acquired or
disclosed.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="HEF31245DDA324BAFA86557972C70F8C0"><enum>(f)</enum><header>Content of
notification</header><text>Regardless of the method by which notice is provided
to individuals under this section, notice of a breach shall include, to the
extent possible, the following:</text>
<paragraph id="H4339B27289EF4446B35B223FC03494D"><enum>(1)</enum><text display-inline="yes-display-inline">A brief description of what happened,
including the date of the breach and the date of the discovery of the breach,
if known.</text>
</paragraph><paragraph id="HAA41DC2B6D17486FB4699616E79F094C"><enum>(2)</enum><text>A
description of the types of unencrypted protected health information that were
involved in the breach (such as full name, Social Security number, date of
birth, home address, account number, or disability code).</text>
</paragraph><paragraph id="HDC64C4DEBF8440C3BDA4568279CD75EC"><enum>(3)</enum><text>The steps
individuals should take to protect themselves from potential harm resulting
from the breach.</text>
</paragraph><paragraph id="H3D282C83B2524353A5BD761F4052A7EB"><enum>(4)</enum><text>A
brief description of what the covered entity involved is doing to investigate
the breach, to mitigate losses, and to protect against any further
breaches.</text>
</paragraph><paragraph id="H204BED9121B74A6A9DAC31753F94BBC"><enum>(5)</enum><text>Contact procedures
for individuals to ask questions or learn additional information, which shall
include a toll-free telephone number, an e-mail address, Web site, or postal
address.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H91A4E924789348E2B6B21496EFA5C2EB"><enum>(g)</enum><header>Delay of
notification authorized for law enforcement purposes</header><text display-inline="yes-display-inline">If a law enforcement official determines
that a notification, notice, or posting required under this section would
impede a criminal investigation or cause damage to national security, such
notification, notice, or posting shall be delayed in the same manner as
provided under <external-xref legal-doc="regulation" parsable-cite="cfr/45/164.528">section 164.528(a)(2)</external-xref> of title 45, Code of Federal Regulations,
in the case of a disclosure covered under such section.</text>
</subsection><subsection id="HD86514E121B84CD59D9875E5FC44676D"><enum>(h)</enum><header>Unencrypted
protected health information defined</header><text>For purposes of this
section, the term <term>unencrypted protected health information</term> means
protected health information that is not protected—</text>
<paragraph id="HB8411B5DCECB42E393065C06CA50B876"><enum>(1)</enum><text>through the use of
encryption; or</text>
</paragraph><paragraph id="H6ADA049A68E64C63898F9394AD1D7E2E"><enum>(2)</enum><text>through the use of
a technology specified by the Secretary as being at least as effective as
encryption for purposes of rendering protected health information
indecipherable without authorization.</text>
</paragraph></subsection></section><section display-inline="no-display-inline" id="H148958B0CA4D478FB315E922F68731C5" section-type="subsequent-section"><enum>303.</enum><header>Education on Health
Information Privacy and report on compliance</header>
<subsection id="HFD5F28A2A31140C3BD46D504BFD39ED9"><enum>(a)</enum><header>Regional office
privacy advisors</header><text display-inline="yes-display-inline">Not later
than 6 months after the date of the enactment of this Act, the Secretary shall
designate an individual in each regional office of the Department of Health and
Human Services to offer guidance and education to covered entities, business
associates, and individuals on their rights and responsibilities related to
Federal privacy requirements for protected health information.</text>
</subsection><subsection id="HE72C574CD9DC454FBB0059005FEED0B5"><enum>(b)</enum><header>Report on
compliance</header>
<paragraph id="H4D9F1679168F495590A0A3B420192444"><enum>(1)</enum><header>In
general</header><text>For the first year beginning after the date of the
enactment of this Act and annually thereafter, the Secretary shall prepare and
submit to Congress a report concerning complaints of alleged violations of the
provisions of sections 301 and 302, the provisions of subtitle B, and the
provisions of subparts C and E of title 45, Code of Federal Regulations that
are received by the Secretary during the year for which the report is being
prepared. Each such report shall include, with respect to such complaints
received during the year—</text>
<subparagraph id="H3BAF848701534D3100E8331E58688D64"><enum>(A)</enum><text>the number of such
complaints;</text>
</subparagraph><subparagraph id="H311FC873678A450E8C06ECDDDF2B7882"><enum>(B)</enum><text>the resolution or
disposition of such complaints;</text>
</subparagraph><subparagraph id="H0535CFFA41434743A19EC7353F0022A"><enum>(C)</enum><text>the amount of civil
money penalties imposed with respect to such complaints, as applicable;</text>
</subparagraph><subparagraph id="HBFE482DAD8E04A9E9776706C556502CE"><enum>(D)</enum><text>the number of
compliance reviews conducted and the outcome of each such review;</text>
</subparagraph><subparagraph id="HD4468AEF18DD44CCB040EC5773CF1337"><enum>(E)</enum><text>the number of
subpoenas or inquiries issued; and</text>
</subparagraph><subparagraph id="H56BC3C0D3E944E3D00EF64BA3BC96E29"><enum>(F)</enum><text>the Secretary’s
plan for improving compliance with and enforcement of such provisions for the
following year.</text>
</subparagraph></paragraph><paragraph id="HA3E3865C62414B279FB58DE691DBA0EC"><enum>(2)</enum><header>Availability to
public</header><text>Each report under paragraph (1) shall be made available to
the public on the Internet website of the Department of Health and Human
Services.</text>
</paragraph></subsection><subsection id="H308AEC58CCCB414398E1E300CD6645CB"><enum>(c)</enum><header>Education
initiative on uses of health information</header>
<paragraph id="H2A18F3CC3DD7425381AAA4DEE7E848E4"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">The Office for Civil
Rights within the Department of Health and Human Services shall develop and
maintain a multi-faceted national education initiative to enhance public
transparency regarding the uses of protected health information, including
programs to educate individuals about the potential uses of their health
information and effects of such uses. Such programs shall be conducted in a
variety of languages and present information in a clear and understandable
manner.</text>
</paragraph><paragraph id="H5B856051F43D44A88EAE1B3D83C465FC"><enum>(2)</enum><header>Authorization of
appropriations</header><text>There is authorized to be appropriated to carry
out paragraph (1), $10,000,000 for the period of fiscal years 2009 through
2013.</text>
</paragraph></subsection></section></subtitle><subtitle id="H48B518B10D11488EAC43E5BADA51C31"><enum>B</enum><header>Improved privacy
provisions and additional security provisions</header>
<section id="HF49EAB7E67454BBCAD956B9588E24EB4"><enum>311.</enum><header>Application of
penalties to business associates of covered entities for violations of privacy
contract requirements</header>
<subsection id="HE9BB020059F34FD49E1BF9F2871113C4"><enum>(a)</enum><header>Application of
contract requirements</header><text display-inline="yes-display-inline">In the
case of a business associate of a covered entity that obtains or creates
protected health information pursuant to a written contract (or other written
arrangement) described in <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.502(e)(2)</external-xref> of title 45, Code of Federal
Regulations, with such covered entity, the business associate may use and
disclose such protected health information only if such use or disclosure,
respectively, is in compliance with each applicable requirement of section
164.504(e) of such title.</text>
</subsection><subsection id="HB25F28D10A38452C004232F2CA2F10F6"><enum>(b)</enum><header>Application of
knowledge elements associated with contracts</header><text display-inline="yes-display-inline"><external-xref legal-doc="usc" parsable-cite="usc/45/164">Section 164.504(e)(1)(ii)</external-xref> of title 45, Code
of Federal Regulations, shall apply to a business associate described in
subsection (a), with respect to compliance with such subsection, in the same
manner that such section applies to a covered entity, with respect to
compliance with the standards in sections 164.502(e) and 164.504(e) of such
title, except that in applying such section 164.504(e)(1)(ii) each reference to
the business associate, with respect to a contract, shall be treated as a
reference to the covered entity involved in such contract.</text>
</subsection><subsection id="H0D43BD74AE674AECA9D7D99977CB413"><enum>(c)</enum><header>Application of
civil and criminal penalties</header><text>In the case of a business associate
that violates any provision of subsection (a) or (b), the provisions of
sections 1176 and 1177 of the Social Security Act shall apply to the business
associate with respect to such violation in the same manner as such provisions
apply to a person who violates a provision of part C of title XI of such
Act.</text>
</subsection></section><section id="H4C9DF5E3177A4A848C2DEB354B7B55AB"><enum>312.</enum><header>Restrictions on
certain disclosures of health information; accounting of certain protected
health information disclosures</header>
<subsection id="HB19AC517A0DD47D2925BF3577C1CADA9"><enum>(a)</enum><header>Requested
restrictions on certain disclosures of health information</header><text display-inline="yes-display-inline">In the case that an individual requests
under paragraph (a)(1)(i)(A) of <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.522</external-xref> of title 45, Code of Federal
Regulations, that a covered entity restrict the disclosure of the protected
health information of the individual, notwithstanding paragraph (a)(1)(ii) of
such section, the covered entity must comply with the requested restriction
if—</text>
<paragraph id="H9FD7A171BD6F46E1AA7085B9DDA15502"><enum>(1)</enum><text>except as
otherwise required by law, the disclosure is to a health plan for purposes of
carrying out payment or health care operations (and is not for purposes of
carrying out treatment); and</text>
</paragraph><paragraph id="HD48FC696A1AE43C38B965CC000D283F1"><enum>(2)</enum><text>the protected
health information pertains solely to a health care item or service for which
the health care provider involved has been paid out of pocket in full.</text>
</paragraph></subsection><subsection id="H519983932AA544ABB4DDF562E89EBBFB"><enum>(b)</enum><header>Disclosures
required To be limited to the limited data set or the minimum
necessary</header>
<paragraph id="HFBAD82AA75AC409ABEC8588B8D43C80"><enum>(1)</enum><header>In
general</header><text>A covered entity shall be treated as being in compliance
with <external-xref legal-doc="regulation" parsable-cite="cfr/45/164.502">section 164.502(b)(1)</external-xref> of title 45, Code of Federal Regulations, with
respect to the use, disclosure, or request of protected health information
described in such section, only if the covered entity makes reasonable efforts
to limit such protected health information to the limited data set (as defined
in section 164.514(e)(2) of such title) or, if needed by such entity, to the
minimum necessary to accomplish the intended purpose of such use, disclosure,
or request, respectively.</text>
</paragraph><paragraph id="HCB07F7DE5F044C449429AF3FD7FC127B"><enum>(2)</enum><header>Application of
exceptions</header><text>The exceptions described in section 164.502(b)(2) of
title 45, Code of Federal Regulations, shall apply to the requirement under
paragraph (1) as of the effective date described in section 322 in the same
manner that such exceptions apply to section 164.502(b)(1) of such title before
such date.</text>
</paragraph></subsection><subsection id="H21736D36CAF64644A2AA9579E6005FAD"><enum>(c)</enum><header>Accounting of
certain protected health information disclosures required if covered entity
uses electronic medical record</header>
<paragraph id="H697BFCF236A74528A914A99D127DA1FC"><enum>(1)</enum><header>In
General</header><text>In the case that a covered entity uses or maintains an
electronic medical record with respect to protected health information, the
exception under <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.528(a)(1)(i)</external-xref> of title 45, Code of Federal
Regulations, shall not apply to disclosures (other than oral disclosures) made
by such entity of such information.</text>
</paragraph><paragraph id="H4E6236D19FFF4B62BB7DE1A5A85B00EC"><enum>(2)</enum><header>Electronic
medical record defined</header><text>For purposes of paragraph (1), the term
<term>electronic medical record</term> means an electronic record of
individually identifiable health information on an individual that is created,
gathered, managed, and consulted by authorized clinicians and staff within a
single organization.</text>
</paragraph><paragraph id="H7221B0C7394A4C46BE2E5D00C6004751"><enum>(3)</enum><header>Effective
date</header><text>The provisions of this subsection shall apply to disclosures
made by a covered entity on or after the date specified under section
322.</text>
</paragraph></subsection><subsection commented="no" id="H5000C71216C5459E841DDF053657B6E6"><enum>(d)</enum><header>Application of
consent requirements for certain uses and disclosures by health care providers
with electronic medical records</header>
<paragraph commented="no" id="HDF5E8C5BB1334C44BBF7E6124FA44CB9"><enum>(1)</enum><header>In
general</header><text>In applying <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.506</external-xref> of title 45, Code of Federal
Regulations, in the case of a covered entity that is a health care provider,
with respect to protected health information of an individual that is used or
maintained by such entity in an electronic medical record (as defined in
subsection (c)(2)), such covered entity may not use or disclose such protected
health information for purposes of health care operations unless the covered
entity obtains the consent of the individual to disclose such information for
such purposes and any such consent shall be revocable by the individual at any
time.</text>
</paragraph><paragraph commented="no" id="H430CB752529141EA92F29F23921863A6"><enum>(2)</enum><header>Effective
date</header><text>The provisions of this subsection shall apply to disclosures
made by a covered entity on or after the date specified under section
322.</text>
</paragraph></subsection></section><section id="H4E665CA944E447A8B52E57DCAA381390"><enum>313.</enum><header>Conditions on
certain contacts as part of health care operations</header>
<subsection id="H324302C38BB94EB993D8D133A4D3F93D"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">A communication by a
covered entity or business associate that is about a product or service and
that encourages recipients of the communication to purchase or use the product
or service shall not be considered a health care operation for purposes of
subpart E of part 164 of title 45, Code of Federal Regulations, unless the
communication is made as described in subparagraph (i), (ii), or (iii) of
paragraph (1) of the definition of marketing in section 164.501 of such title.
A covered entity or business associate may not receive direct payment for any
such communication made as described in such subparagraph (i), (ii), or
(iii).</text>
</subsection><subsection id="H1BA2782EECE945399368212EE91B133B"><enum>(b)</enum><header>Effective
date</header><text display-inline="yes-display-inline">Subsection (a) shall
apply to contracting occurring on or after the effective date specified under
section 322.</text>
</subsection></section><section commented="no" id="H7EA96189470240D8B3E456403F21C4D5"><enum>314.</enum><header>Study on
application of privacy and security requirements to vendors of personal health
records</header><text display-inline="no-display-inline">Not later than one
year after the date of the enactment of this Act, the Secretary , in
consultation with the Federal Trade Commission, shall submit to Congress
recommendations—</text>
<paragraph commented="no" id="HE7EC2653CF804723837D69C7F8BB5F28"><enum>(1)</enum><text>to identify
requirements relating to security, privacy, and notification in the case of a
breach of security or privacy (including the applicability of an exemption to
notification in the case of protected health information which has been
rendered indecipherable through the use of encryption or alternative
technologies) that should be applied to vendors of personal health records and
to third party service providers that such vendors make available to
individuals with personal health records offered or maintained by such vendor,
with respect to information in such a record so offered or maintained;
and</text>
</paragraph><paragraph commented="no" id="HB42F6FD4BCE1422DA482FF74B158FF62"><enum>(2)</enum><text>to determine which
Federal government agency is best equipped to enforce such requirements
recommended to be applied to such vendors of personal health records and such
third party service providers.</text>
</paragraph></section><section id="H7A2821EE64DD403B9EF86B78BEB1E4D6"><enum>315.</enum><header>Temporary
breach notification requirement for vendors of personal health records</header>
<subsection id="H274F163B53AD4E33A44FB022854F193"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">In accordance with
subsection (c), each vendor of personal health records shall, following the
discovery of a breach of security of unencrypted individually identifiable
health information in such records maintained or offered by such vendor—</text>
<paragraph id="H0C9AA7A479D44B60A0D0810076A401A0"><enum>(1)</enum><text>notify each
individual who is a citizen or resident of the United States whose unencrypted
individually identifiable health information was acquired by an unauthorized
person as a result of such a breach of security; and</text>
</paragraph><paragraph id="HF769AA881C1E4115B8913712CB1FD9E8"><enum>(2)</enum><text>notify the Federal
Trade Commission.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="HB7689BB3332A45D2BC6872FE3EFF0673"><enum>(b)</enum><header>Notification of
vendors of personal health records by third party service
providers</header><text>A third party service provider that is made available
by a vendor of personal health records to individuals with such records
maintained or offered by such vendor and that accesses, maintains, retains,
modifies, records, stores, destroys, or otherwise holds, uses, or discloses
unencrypted individually identifiable health information in such records shall,
following the discovery of a breach of security of such information, notify
such vendor of such breach. Such notice shall include the identification of
each individual whose unencrypted individually identifiable health information
has been, or is reasonably believed to have been, accessed or acquired during
such breach.</text>
</subsection><subsection id="HBA54E9DB31B648C5A446630077EBAA5F"><enum>(c)</enum><header>Application of
requirements for timeliness, method, and content of
notifications</header><text>Subsections (c), (d), (e), and (f) of section 302
shall apply to a notification required under subsection (a) and a vendor of
personal health records and a third party service provider described in
subsection (b), with respect to a breach of security under subsection (a) of
unencrypted individually identifiable health information in such records
maintained or offered by such vendor, in the same manner that such subsections
apply to a notification required under such section and a covered entity and a
business associate of such covered entity, with respect to a breach under such
section of unencrypted protected health information held, used, or disclosed by
such covered entity.</text>
</subsection><subsection id="HAE08D1C342604605AE9D23236C7BD947"><enum>(d)</enum><header>Notification of
the Secretary</header><text>Upon receipt of a notification of a breach of
security under subsection (a)(2), the Federal Trade Commission shall notify the
Secretary of such breach.</text>
</subsection><subsection id="H865658487BBE4600A9F2F5E3EBB1ECAA"><enum>(e)</enum><header>Enforcement</header><text>A
violation of subsection (a) or (b) shall be treated as an unfair and deceptive
act or practice in violation of a regulation under section 18(a)(1)(B) of the
<act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (15
U.S.C. 57<italic>a</italic>(a)(1)(B)) regarding unfair or deceptive acts or
practices.</text>
</subsection><subsection id="HCA719B72FF6F4AD69778137FD5768568"><enum>(f)</enum><header>Definitions</header><text display-inline="yes-display-inline">For purposes of this section:</text>
<paragraph id="H6434285221374818893D5FAAB49179"><enum>(1)</enum><header>Breach of
security</header><text>The term <term>breach of security</term> means, with
respect to unencrypted individually identifiable health information of an
individual in a personal health record, acquisition of such information without
the authorization of the individual.</text>
</paragraph><paragraph id="H39D3D4CA84A2429BB687776B83560822"><enum>(2)</enum><header>Individually
identifiable health information</header><text>The term <term>individually
identifiable health information</term> has the meaning given such term in
section 1171(6) of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d">42 U.S.C. 1320d(6)</external-xref>).</text>
</paragraph><paragraph id="HF8B5AFC6A59A46C0A1AC9EA41600A3EC"><enum>(3)</enum><header>Unencrypted
individually identifiable health information</header><text>The term
<term>unencrypted individually identifiable health information</term> means
individually identifiable health information that is not protected—</text>
<subparagraph id="H94B5F7D00FA443ED003EAABE2953CDDC"><enum>(A)</enum><text>through the use of
encryption; or</text>
</subparagraph><subparagraph id="H3C048B126C00430384AA7BDE7631ED49"><enum>(B)</enum><text>through the use of
a technology specified by the Secretary as being at least as effective as
encryption for purposes of rendering individually identifiable health
information indecipherable without authorization.</text>
</subparagraph></paragraph></subsection><subsection id="H8FD8948BA0DE42168F1F6F21A6C68BBF"><enum>(g)</enum><header>Effective
date</header><text>The provisions of this section shall apply to breaches of
security occurring during the 2-year period beginning on the date of the
enactment of this Act.</text>
</subsection></section><section id="HE2F95B1AD0F54A82B7CA9E5B56E49C45"><enum>316.</enum><header>Business
associate contracts required for certain entities</header><text display-inline="no-display-inline">Each organization, with respect to a covered
entity, that provides data transmission of protected health information to such
entity and that requires access on a routine basis to such protected health
information, such as a Health Information Exchange, Regional Health Information
Organization, or E-prescribing Gateway, is required to enter into a written
contract (or other written arrangement) described in section 164.502(e)(2) of
title 45, Code of Federal Regulations, with such entity and shall be treated as
a business associate of the covered entity for purposes of section 311.</text>
</section><section id="H9009ADEDDDD14A9EA51F1CD619CBCE2"><enum>317.</enum><header>Guidance on
implementation specification to de-identify protected health
information</header><text display-inline="no-display-inline">Not later than 12
months after the date of the enactment of this Act, the Secretary shall, in
consultation with stakeholders, issue guidance on how best to implement the
requirements for the de-identification of protected health information under
<external-xref legal-doc="regulation" parsable-cite="cfr/45/164.514">section 164.514(b)</external-xref> of title 45, Code of Federal Regulations.</text>
</section><section id="HD32B969961A24352B413FC93005B0047"><enum>318.</enum><header>GAO report on
treatment disclosures</header><text display-inline="no-display-inline">Not
later than one year after the date of the enactment of this Act, the
Comptroller General of the United States shall submit to Congress a report on
the best practices related to the disclosure among health care providers of
protected health information of an individual for purposes of treatment of such
individual. Such report shall include an examination of the best practices
implemented by States and by other entities, such as health information
exchanges and regional health information organizations, including an
examination of the extent to which such best practices are successful with
respect to the quality of the resulting health care provided to the individual
and with respect to the ability of the health care provider to manage such best
practices.</text>
</section><section commented="no" id="H2A2B363EB5D44AC780782419D2038313"><enum>319.</enum><header>Clarification
of application of wrongful disclosures criminal penalties</header><text display-inline="no-display-inline">Section 1177(a) of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-6">42 U.S.C. 1320d–6(a)</external-xref>) is amended by adding at the end the following new
sentence: <quote>For purposes of the previous sentence, a person (including an
employee or other individual) shall be considered to have obtained or disclosed
individually identifiable health information in violation of this part if the
information is maintained by a covered entity (as defined in the HIPAA privacy
regulation described in section 1180(b)(3)) and the individual obtained or
disclosed such information without authorization.</quote>.</text>
</section></subtitle><subtitle id="H6C957AE581014BD5A4C099C10763FF8C"><enum>C</enum><header>Relationship to
other laws; clarification; effective date</header>
<section commented="no" display-inline="no-display-inline" id="H6839425DC9254262A8006550B11CD54" section-type="subsequent-section"><enum>321.</enum><header>Relationship to
other laws</header>
<subsection commented="no" id="HBE45E0E1A7AE4C76961CBC9CAF05F036"><enum>(a)</enum><header>Application of
HIPAA State preemption</header><text>Section 1178 of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-7">42 U.S.C. 1320d–7</external-xref>) shall apply to a provision or requirement under this title
in the same manner that such section applies to a provision or requirement
under part C of title XI of such Act or a standard or implementation
specification adopted or established under sections 1172 through 1174 of such
Act.</text>
</subsection><subsection commented="no" id="HBC05D58F06C6436EA5DF3EF25E65CD1F"><enum>(b)</enum><header>Health Insurance
Portability and Accountability Act</header><text>The standards governing the
privacy and security of individually identifiable health information
promulgated by the Secretary under sections 262(a) and 264 of the Health
Insurance Portability and Accountability Act of 1996 shall remain in effect to
the extent that they are consistent with this title. The Secretary shall by
rule amend such Federal regulations as required to make such regulations
consistent with this title.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="HEA4EBFEEB7FD49248997008F688B1106" section-type="subsequent-section"><enum>322.</enum><header>Effective
date</header><text display-inline="no-display-inline">The provisions of this
title (other than sections 301(c), 303, 314, 315, 317, 318, and 319) shall take
effect on the date that is 12 months after the date of the enactment of this
Act.</text>
</section></subtitle>