110 HR 6898 IH: Health-e Information Technology
U.S. House of Representatives
2008-09-15
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.Short title; table of
contents
(a)This Act may be cited
as the Health-e Information Technology
Act of 2008
.
(b)The table of contents for this Act is as follows:
Sec. 1. Short title; table of contents.
Title I—Promotion of Health Information Technology
Subtitle A—Improving health care quality, safety, and
efficiency
Sec. 101. ONCHIT; standards development and adoption; health
information technology resource center.
Title XXX—Health Information Technology and Quality
Sec. 3000. Definitions.
Subtitle A—Promotion of Health Information
Technology
Sec. 3001. Office of the National Coordinator for Health
Information Technology.
Sec. 3002. HIT Advisory Committee.
Sec. 3003. Process for adoption of recommended standards and
guidance.
Sec. 3004. Application and use of adopted standards by Federal
agencies.
Sec. 3005. Voluntary application and use of adopted standards
by private entities.
Sec. 3006. Health Information Technology Resource
Center.
Sec. 102. Transitions.
Subtitle B—Application and use of adopted health information
technology standards; reports
Sec. 111. Coordination of Federal activities with adopted
standards.
Sec. 112. Application to private entities.
Sec. 113. Annual reports.
Title II—Testing of Health Information Technology
Sec. 201. National Institute for Standards and Technology
testing.
Title III—Incentives for adoption of health information
technology
Subtitle A—Medicare program
Sec. 301. Incentives for eligible professionals.
Sec. 302. Incentives for hospitals.
Sec. 303. Incentives for certain Medicare Advantage
plans.
Subtitle B—Other incentives for the Implementation and Use of
Health Information Technology
Sec. 311. Grant, loan, and demonstration
programs.
Subtitle B—Incentives for the Use of Health Information
Technology
Sec. 3011. Grants and loans to facilitate the widespread
adoption of qualified health information technology.
Sec. 3012. Demonstration program to integrate information
technology into clinical education.
Title IV—Privacy and security provisions
Sec. 400. Definitions.
Subtitle A—Improved privacy provisions and security
provisions
Sec. 401. Application of security provisions and penalties to
business associates of covered entities; annual guidance on privacy and
security provisions.
Sec. 402. Notification in the case of breach.
Sec. 403. Education on health information privacy and report on
compliance.
Sec. 404. Application of penalties to business associates of
covered entities for violations of privacy contract requirements.
Sec. 405. Restrictions on certain uses and disclosures and
sales of health information; accounting of certain protected health information
disclosures; access to certain information in electronic format.
Sec. 406. Limitations on certain activities as part of health
care operations.
Sec. 407. Study and report on application of privacy and
security requirements to non-HIPAA covered entities.
Sec. 408. Temporary breach notification requirement for vendors
of personal health records and other non-HIPAA covered entities.
Sec. 409. Business associate contracts required for certain
entities; other provisions related to business associate contracts.
Sec. 410. Guidance on implementation specification to
de-identify protected health information.
Sec. 411. GAO report on treatment, payment, and health care
operations uses and disclosures.
Sec. 412. Clarification of application of wrongful disclosures
criminal penalties.
Sec. 413. Improved enforcement.
Sec. 414. Audits.
Sec. 415. Technical amendment.
Subtitle B—Chief Privacy Officer of ONCHIT; Standards and
guidance recommendations related to privacy and security
Sec. 421. Chief Privacy Officer of the Office of the National
Coordinator .
Sec. 422. Additional standards and guidance recommendations
related to privacy and security.
Subtitle C—Relationship to other laws; regulatory references;
effective date
Sec. 431. Relationship to other laws.
Sec. 432. Regulatory references.
Sec. 433. Effective date.
<enum>I</enum><header>Promotion of
Health Information Technology</header>
<subtitle id="H03E302B0CED2462E90D5618EC61159E0"><enum>A</enum><header>Improving health
care quality, safety, and efficiency</header>
<section id="H1437B9E7EEBE4B06BAB1EA78B649486E"><enum>101.</enum><header>ONCHIT;
standards development and adoption; health information technology resource
center</header>
<subsection id="H78FDE71B8A0145E28C842B569FB7745B"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">The
<act-name parsable-cite="PHSA">Public Health Service Act</act-name> (42 U.S.C.
201 et seq.) is amended by adding at the end the following:</text>
<quoted-block act-name="Public Health Service Act" id="HD9D5559A24E342E3B9FE62578FA222B6" style="OLC">
<title id="H878FDED3649C47A0837D1F07A4EADBAF"><enum>XXX</enum><header>Health
Information Technology and Quality</header>
<section id="H4E92083D4DEE4B53872DBA2F709FF235"><enum>3000.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title:</text>
<paragraph id="H704DEF0D844E4E6983D0534C1E431B45"><enum>(1)</enum><header>Electronic
health record</header><text display-inline="yes-display-inline">The term
<quote>electronic health record</quote> means an electronic record of
health-related information on an individual that is created, managed, and
consulted by authorized health care clinicians and staff of one or more
organizations, that conforms to standards adopted under section 3003(a), and is
made accessible electronically to other health care organizations and other
authorized users.</text>
</paragraph><paragraph id="H8D6D6641089542D88431C6CABFA964B0"><enum>(2)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> means a
hospital, skilled nursing facility, nursing facility, home health entity,
health care clinic, Federally qualified health center, group practice (as
defined in section 1877(h)(4) of the <act-name parsable-cite="SSA">Social
Security Act</act-name>), a pharmacist, a pharmacy, a laboratory, a physician
(as defined in section 1861(r)) of the <act-name parsable-cite="SSA">Social
Security Act</act-name>), a practitioner (as described in section
1842(b)(18)(C) of the <act-name parsable-cite="SSA">Social Security
Act</act-name>), a provider operated by, or under contract with, the Indian
Health Service or by an Indian tribe (as defined in the Indian
Self-Determination and Education Assistance Act), tribal organization, or urban
Indian organization (as defined in section 4 of the Indian Health Care
Improvement Act), a rural health clinic, and any other category of facility or
clinician determined appropriate by the Secretary.</text>
</paragraph><paragraph id="HD1AC3DA81ADD413097405074839E1F11"><enum>(3)</enum><header>Health
information</header><text>The term <term>health information</term> has the
meaning given such term in section 1171(4) of the <act-name parsable-cite="SSA">Social Security Act</act-name>.</text>
</paragraph><paragraph id="HEB0A69A054744FC8868F62FD87342D8D"><enum>(4)</enum><header>Health
information technology</header><text display-inline="yes-display-inline">The
term <term>health information technology</term> means hardware, software,
integrated technologies and related licenses, intellectual property, upgrades,
and packaged solutions sold as services that are specifically designed for use
by health care entities for the electronic creation, maintenance, or exchange
of health information.</text>
</paragraph><paragraph id="H0790C8FDAD9F4DD4A500F7A6EB9D536C"><enum>(5)</enum><header>Health
plan</header><text>The term <term>health plan</term> has the meaning given such
term in section 1171(5) of the Social Security Act.</text>
</paragraph><paragraph id="H422FD30F4F3C49C8A5E16D3282A93600"><enum>(6)</enum><header>HIT Advisory
Committee</header><text>The term <term>HIT Advisory Committee</term> means such
Committee established under section 3002(a).</text>
</paragraph><paragraph id="HA1B84328479245ECAABE00274D38736F"><enum>(7)</enum><header>Individually
identifiable health information</header><text>The term <term>individually
identifiable health information</term> has the meaning given such term in
section 1171(6) of the <act-name parsable-cite="SSA">Social Security
Act</act-name>.</text>
</paragraph><paragraph id="H79AEFA4C5C7749B087BDD2C43196F8F"><enum>(8)</enum><header>Laboratory</header><text>The
term <term>laboratory</term> has the meaning given such term in section
353(a).</text>
</paragraph><paragraph id="HCE4A48C2D24540F19B042EBBF0B9367C"><enum>(9)</enum><header>National
Coordinator</header><text>The term <term>National Coordinator</term> means the
head of the Office of the National Coordinator for Health Information
Technology established under section 3001(a).</text>
</paragraph><paragraph id="HECA69BA3ADA144718B50B4A3FE1B03F4"><enum>(10)</enum><header>Pharmacist</header><text>The
term <term>pharmacist</term> has the meaning given such term in section 804(2)
of the <act-name parsable-cite="FFDCA">Federal Food, Drug, and Cosmetic
Act</act-name>.</text>
</paragraph><paragraph id="HBBB67574611045FA8C7500001FE2D6E"><enum>(11)</enum><header>State</header><text>The
term <term>State</term> means each of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Northern Mariana Islands.</text>
</paragraph></section><subtitle id="H66F2513514734C2D981632E590C085F2"><enum>A</enum><header>Promotion of
Health Information Technology</header>
<section id="HC52CBB6CF66740EAB2700038F44D7C8E"><enum>3001.</enum><header>Office of the
National Coordinator for Health Information Technology</header>
<subsection id="H4B28641638C74423B9766DA54E6D7F3C"><enum>(a)</enum><header>Establishment</header><text>There
is established within the Department of Health and Human Services an Office of
the National Coordinator for Health Information Technology (referred to in this
section as the <quote>Office</quote>). The Office shall be headed by a National
Coordinator who shall be appointed by the Secretary and shall report directly
to the Secretary.</text>
</subsection><subsection id="HA84F62C6AC1E4DE0B51FAC189130F456"><enum>(b)</enum><header>Purpose</header><text>The
National Coordinator shall perform the duties under subsection (c) in a manner
consistent with the development of a nationwide health information technology
infrastructure that allows for the electronic use and exchange of information
and that—</text>
<paragraph id="HD1BF755B8AC24589813E56CDF14F8F58"><enum>(1)</enum><text>ensures that each
patient’s health information is secure and protected, in accordance with
applicable law;</text>
</paragraph><paragraph id="HC8CD2D804EEF47D5AB45738986641859"><enum>(2)</enum><text>improves health
care quality, reduces medical errors, and advances the delivery of
patient-centered medical care;</text>
</paragraph><paragraph id="HDB69D8893A524B0095E454EAC729D4B9"><enum>(3)</enum><text>reduces health
care costs resulting from inefficiency, medical errors, inappropriate care,
duplicative care, and incomplete information;</text>
</paragraph><paragraph id="H6AF1BFD50582451FA686164F83FE73F5"><enum>(4)</enum><text>ensures that
appropriate information to help guide medical decisions is available at the
time and place of care;</text>
</paragraph><paragraph id="H026913F6E7474F41A83F09004FD659F"><enum>(5)</enum><text>ensures the
inclusion of meaningful public input in such development of such
infrastructure;</text>
</paragraph><paragraph id="H22F57575CECB404FB9E91147989E936D"><enum>(6)</enum><text>improves the
coordination of care and information among hospitals, laboratories, physician
offices, and other entities through an effective infrastructure for the secure
and authorized exchange of health care information;</text>
</paragraph><paragraph id="H32250A104B534B938D18038E454B9FC5"><enum>(7)</enum><text>improves public
health reporting and facilitates the early identification and rapid response to
public health threats and emergencies, including bioterror events and
infectious disease outbreaks;</text>
</paragraph><paragraph id="HA4914761DACB43B18601E378ABA009F1"><enum>(8)</enum><text>facilitates health
and clinical research and health care quality;</text>
</paragraph><paragraph id="H04C42D1FE0AB472598DA6463538E17F"><enum>(9)</enum><text>promotes prevention
of chronic diseases;</text>
</paragraph><paragraph id="H83A90CD312EB4B18B9525222B252A1DC"><enum>(10)</enum><text>promotes a more
effective marketplace, greater competition, greater systems analysis, increased
consumer choice, and improved outcomes in health care services; and</text>
</paragraph><paragraph id="H677A507C96A2437AB3B8A09343F4739F"><enum>(11)</enum><text>improves efforts
to reduce health disparities.</text>
</paragraph></subsection><subsection id="HF5E52BADCE2A40609E68EA119FC109C9"><enum>(c)</enum><header>Duties of the
National Coordinator</header>
<paragraph id="H8281469FC0044C468C3056919F509EC8"><enum>(1)</enum><header>HIT policy
coordination</header><text display-inline="yes-display-inline">The National
Coordinator shall coordinate health information technology policy and programs
within the Department and with those of other relevant executive branch
agencies with a goal of avoiding duplication of efforts and of helping to
ensure that each agency undertakes health information technology activities
primarily within the areas of its greatest expertise and technical
capability.</text>
</paragraph><paragraph id="H27AD2A58652F42CDA47D5B5EA357ACAD"><enum>(2)</enum><header>Standards,
guidance</header>
<subparagraph id="H64C6D962827D4D02AAC7D7BCF36DD36F"><enum>(A)</enum><header>Development and
recommendations of standards and guidance</header>
<clause id="H02290E8385A247159812D6004DE95CEB"><enum>(i)</enum><header>In
general</header>
<subclause id="H9E0806CBCB9344EEA8237607BDC217E"><enum>(I)</enum><header>Initial
implementation</header><text>The National Coordinator shall, in consultation
with the HIT Advisory Committee under section 3002 and consistent with the
implementation of the strategic plan under paragraph (6), develop and recommend
to the Secretary standards and guidance (which may include best practices), as
applicable, for each of the categories described in clauses (iii), (iv), and
(v). In accordance with the previous sentence, the National Coordinator shall
ensure that an initial set of appropriate standards is developed and
recommended to the Secretary under this subclause by such time as to enable the
Secretary to adopt such an initial set in accordance with section
3003(b).</text>
</subclause><subclause id="HF77E1EF10A3E4163BEF36FC1680089F8"><enum>(II)</enum><header>Biennial
updating</header><text display-inline="yes-display-inline">Biennially
thereafter the National Coordinator, in consultation with the HIT Advisory
Committee, shall update such recommendations and make new recommendations as
appropriate, including in response to a notification sent under section
3003(a)(2).</text>
</subclause></clause><clause id="H49482243AECA49BD8368307B21C9F1EC"><enum>(ii)</enum><header>Coordination
among categories</header><text display-inline="yes-display-inline">The National
Coordinator shall coordinate the development, recommendations, and updating
among the categories so described to take into account the interdependence of
standards and guidance among such categories.</text>
</clause><clause id="H508DAA642CE3464398156BD100CDEEF2"><enum>(iii)</enum><header>Technical
interoperability category</header>
<subclause id="HDF2B9FDBC8A74553AD01FF53E3DDC27"><enum>(I)</enum><header>In
general</header><text>The category described in this clause is the category for
technical interoperability to provide for the electronic exchange and use of
health information.</text>
</subclause><subclause id="HBA79549EF6E747D0A4F9BC2C16B6D2ED"><enum>(II)</enum><header>Application to
different levels of interoperability</header><text display-inline="yes-display-inline">In developing recommendations respecting
the category described in this clause, the National Coordinator shall initially
use the different levels of interoperability (as described on pages 6 though 8
of GAO report 08–954 titled <quote>Electronic Health Records: DOD and VA Have
Increased Sharing of Health Information, but More Work Remains</quote> and
provide for the development and recommendations of different standards and
guidance for each of such different levels.</text>
</subclause></clause><clause id="H76FE1D419F2D40FDA4946760F6B17AD"><enum>(iv)</enum><header>Privacy and
security category</header><text display-inline="yes-display-inline">The
category described in this clause is the category for privacy and security to
ensure the secure exchange of protected health information, in accordance with
title IV of the Health-e Information Technology Act of 2008 including the
amendments made by such title.</text>
</clause><clause id="HD4556ABE871042BAA59327115005B41C"><enum>(v)</enum><header>Clinical and
quality category</header>
<subclause id="HC4E6EE2C25C84E798BA91928D52D7B31"><enum>(I)</enum><header>In
general</header><text display-inline="yes-display-inline">The category
described in this clause is the category for clinical and quality
functionalities of health information technology and strategies to enhance the
use of such technology including for the following purposes:</text>
<item id="H3825E41CDF434CBDAFA93F0073928884"><enum>(aa)</enum><text>To
improve the quality of health care, such as through the reduction of medical
errors, using electronic provider order entry and clinical decision support
systems.</text>
</item><item id="H34BEC6FA294D41B0A79C92172F1FD21F"><enum>(bb)</enum><text>To
facilitate patient-centered care, such as through improved patient-provider
communication through secure electronic messaging, and improved patient
support.</text>
</item><item id="H64AF2A5CA5BA49C88F5FB1846EF29D5"><enum>(cc)</enum><text>To
reduce health disparities.</text>
</item><item id="H153A4AC6FC744677AF9BF405125222C8"><enum>(dd)</enum><text>To
improve population health, such as through the use of registries and automated
quality reporting and performance measures.</text>
</item><item id="H9E8320F83A1241D7946B4643FA595505"><enum>(ee)</enum><text>To
improve the continuity of care among health care settings.</text>
</item></subclause><subclause id="H5BD539452F384E8F8EACA6F365EB0098"><enum>(II)</enum><header>Requirements</header><text>In
developing recommendations respecting the category described in this clause,
the National Coordinator shall ensure the following:</text>
<item id="HD7C6EF94830745A1A062D3229FD1B27C"><enum>(aa)</enum><text>Information is
collected and transmitted in a manner that is reliable, accurate, and
unambiguous and based on a uniform provider data set, including a set of
comprehensive data elements.</text>
</item><item id="H5845DB809E7949C9004D8E5C3CF91519"><enum>(bb)</enum><text>Information is
communicated in a manner to promote coordination of health care, applying
appropriate data filtering for the situation.</text>
</item><item id="H2BF93457290841F28E2251BD9408FE5F"><enum>(cc)</enum><text>Practices
optimize for continuous improvement, advancement of research and education, and
population disease management.</text>
</item><item id="H8708373FCAE24D17B9FA8EC734BCA411"><enum>(dd)</enum><text display-inline="yes-display-inline">Sensitive protected health information may
be segmented, with the goal of minimizing the reluctance of patients to seek
care (or disclose information about a condition) because of privacy concerns
involving sensitive protected health information, while maximizing patient
safety and clinical utility of the information.</text>
</item></subclause></clause></subparagraph><subparagraph id="HA55196454B0A4CF984B89F27538FA5FF"><enum>(B)</enum><header>Incorporation of
current CCHIT certification criteria</header><text>In developing and
recommending standards and guidance under subparagraph (A), the National
Coordinator shall, to the maximum extent appropriate, incorporate the
ambulatory and inpatient functionality certification criteria that have been
adopted by the Certification Commission for Health Information Technology as of
the date of the enactment of this title. Nothing in this paragraph shall be
construed as preventing the National Coordinator from incorporating into such
recommendations such certification criteria as such Commission is in the
process of adopting as of such date.</text>
</subparagraph><subparagraph id="H17039078E8894262984F80602224B484"><enum>(C)</enum><header>Provider and
setting specific</header><text>Recommendations made under subparagraph (A) may
be established in a provider-specific and setting-specific manner and in a
manner such that they apply to a broad variety of providers, including
physicians, hospitals, and other health care providers and to a broad variety
of settings, including for health information technology systems that are
hospital-based and for such systems that are office-based.</text>
</subparagraph><subparagraph id="HA65D699F52934B44986CA0E9472C9EDB"><enum>(D)</enum><header>Pilot testing of
standards and implementation specifications</header><text display-inline="yes-display-inline">In the development of standards under this
paragraph, the National Coordinator, as appropriate, shall provide for the
testing of such standards in collaboration with the National Institute for
Standards and Technology under section 201 of the Health-e Information
Technology Act of 2008.</text>
</subparagraph><subparagraph commented="no" id="H282ACA10B727406B84D288005D4194E6"><enum>(E)</enum><header>Consistency with
privacy and security requirements</header><text>The standards recommended under
this paragraph shall be consistent with applicable privacy and security
standards and requirements adopted pursuant to section 1173 of the Social
Security Act, to title IV of the Health-e Information Technology Act of 2008,
or otherwise.</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="HAA26F8150DA14A7F98EA10088E00B290"><enum>(F)</enum><header>Public
input</header><text display-inline="yes-display-inline">The National
Coordinator shall conduct open public meetings and develop a process to allow
for public comment on the recommendations made under this paragraph. Under such
process comments shall be submitted in a timely manner after the date of
publication of a recommendation under this paragraph.</text>
</subparagraph><subparagraph id="HAA94D3F7836B42AE9DB3CC12B8F8E359"><enum>(G)</enum><header>Publication</header><text display-inline="yes-display-inline">The Secretary shall provide for publication
in the Federal Register and the posting on the Internet website of the Office
of the National Coordinator for Health Information Technology of all
recommendations made by the National Coordinator under this paragraph.</text>
</subparagraph></paragraph><paragraph id="HC4135587FE404431BAF1DA805459F276"><enum>(3)</enum><header>Certification</header><text display-inline="yes-display-inline">The National Coordinator, in consultation
with the Director of the National Institute of Standards and Technology and
other relevant Federal agencies, shall develop a program (either directly or by
contract) for the voluntary certification (and periodic recertification) of
health information technology systems (and components of such systems) as being
in compliance with all applicable standards (for each category described in
paragraph (2)(A)) that are adopted under this subtitle. Such program shall
include testing of the technology in accordance with section 201(b) of the
Health-e Information Technology Act of 2008.</text>
</paragraph><paragraph id="H971011805E834A3EB73602DD5BBE2386"><enum>(4)</enum><header>Federal open
source health IT system</header>
<subparagraph id="HF148307869FD443783FAD76DF924E56D"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">The National
Coordinator shall provide for coordinating the development, routine updating,
and provision of an open source health information technology system that is
either new or based on an open source health information technology system,
such as VistA, that is in existence as of the date of the enactment of this
title and that is in compliance with all applicable standards (for each
category described in paragraph (2)(A)) that are adopted under this subtitle.
The National Coordinator shall make such system publicly available for use,
after appropriate pilot testing, as soon as practicable but not later than 9
months after the date of the adoption by the Secretary of the initial set of
standards and guidance under section 3003(c).</text>
</subparagraph><subparagraph id="HB89423CB31A94F4281BA829176031228"><enum>(B)</enum><header>Consortium</header><text>In
order to carry out subparagraph (A), the National Coordinator shall establish,
not later than 6 months after the date of the enactment of this section, a
consortium comprised of individuals with technical, clinical, and legal
expertise open source health information technology. The Secretary, through
agencies with the Department, shall provide assistance to the consortium in
conducting its activities under this paragraph.</text>
</subparagraph><subparagraph id="H75BBCBA58F8345B9BE86AEF9250969D7"><enum>(C)</enum><header>Authorization to
charge nominal fee</header><text>The National Coordinator may impose a nominal
fee for the adoption by a health care provider of the health information
technology system developed or approved under subparagraph (A). Such fee shall
take into account the circumstances of smaller providers and providers located
in rural or other medically underserved areas.</text>
</subparagraph><subparagraph id="HB6DA5DE2B0F94EED82A5E7456402AD23"><enum>(D)</enum><header>Open source
defined</header><text>In this paragraph, the term <quote>open source</quote>
has the meaning given such term by the Open Source Initiative.</text>
</subparagraph></paragraph><paragraph id="H2F4ECAE0D1F44F998F11C4E300A4B26D"><enum>(5)</enum><header>Nationwide
health information network</header><text>The National Coordinator shall
facilitate the development and expansion of sub-national health information
organizations and the coordination of such organizations in order to provide
for the nationwide electronic exchange of health information among such
organizations that ensures that appropriate information is available at the
time and place of care and enables the aggregation of health information for
research and public health purposes.</text>
</paragraph><paragraph id="H2677A87DCB97447BBA1FC577BC96E8FB"><enum>(6)</enum><header>Strategic
plan</header>
<subparagraph id="H98DED68147274FA9B127C66D17339CFE"><enum>(A)</enum><header>In
general</header><text>Not later than 12 months after the date of the enactment
of this title, the National Coordinator shall, in consultation with other
appropriate Federal agencies (including the National Institute of Standards and
Technology), develop and maintain a strategic plan with specific objectives,
milestones, and metrics for each strategic plan area described in subparagraph
(B). The National Coordinator shall, in consultation with such other
appropriate Federal agencies, annually update such strategic plan.</text>
</subparagraph><subparagraph id="HB3C6246DFECA4C9A8E5FDC994D3B41A9"><enum>(B)</enum><header>Strategic plan
areas required</header><text>The strategic plan areas include at least the
following:</text>
<clause id="HE2AEA21CE35E4812A22DAA407C373284"><enum>(i)</enum><text display-inline="yes-display-inline">The establishment of recommendations for
and development of standards and guidance for each category under paragraph
(2)(A), including recommendations described in section 422 of the Health-e
Information Technology Act of 2008, and the adoption of standards so
recommended, including the process of updating of such standards and
guidance.</text>
</clause><clause id="H82DB6B1B07944AADAE00E7DF00CEC263"><enum>(ii)</enum><text display-inline="yes-display-inline">The development of the certification
program under paragraph (3) and the establishment and maintenance of a list of
health information technology systems (and components of such systems) that
have been certified under such program.</text>
</clause><clause id="H270EBC3D8EE64B5486EA43386E8179FC"><enum>(iii)</enum><text>The development
of a Federal open source health IT system in accordance with paragraph
(4).</text>
</clause><clause id="HBD9A77D6ECD94315A410CA15F37C8E8E"><enum>(iv)</enum><text display-inline="yes-display-inline">The widespread utilization of electronic
health records in the United States and the establishment of a nationwide
health information network described in paragraph (5).</text>
</clause><clause id="H0C2C941B69B74E53A2D860014F59BA11"><enum>(v)</enum><text display-inline="yes-display-inline">Specifying a framework for the coordination
and flow of recommendations and policies under this subtitle among the
Secretary, the National Coordinator, the HIT Policy Committee, health
information exchanges, and other relevant entities.</text>
</clause><clause id="H3EEFA233B2C14F878281D188E4E183D"><enum>(vi)</enum><text>Methods to foster
the public understanding of health information technology and related privacy
and security laws.</text>
</clause><clause id="H13911EF36C9E433AB167609335FB8622"><enum>(vii)</enum><text>The availability
of technical assistance and training for health care providers in the
implementation and utilization of health information technology systems.</text>
</clause></subparagraph><subparagraph id="H8B0AD41A76414AEAB878EC8676B595B6"><enum>(C)</enum><header>Collaboration</header><text display-inline="yes-display-inline">The strategic plan shall be developed and
updated through collaboration of public and private interests.</text>
</subparagraph><subparagraph id="H311F67A1357846DFA71E332EAB4F4C82"><enum>(D)</enum><header>Measurable
outcome goals</header><text>The strategic plan shall include measurable outcome
goals including timeframes for such goals.</text>
</subparagraph><subparagraph id="H0AC3B2509CC24086B4E997C01FDE1BBD"><enum>(E)</enum><header>Publication</header><text display-inline="yes-display-inline">The National Coordinator shall publish the
strategic plan, including all updates.</text>
</subparagraph></paragraph><paragraph id="H48EA91DA04924B9EA939AEC541FC15"><enum>(7)</enum><header>Implementation
reports</header><text display-inline="yes-display-inline">Not later than 12
months after the date of publication of the strategic plan under paragraph (6)
and annually thereafter, the National Coordinator shall submit to the Secretary
a report that identifies the progress achieved with respect to the objectives,
milestones, and metrics identified in such strategic plan for each strategic
plan area described in paragraph (6)(B).</text>
</paragraph><paragraph commented="no" id="HFB6228A7AB9E47B890FD211446B4186E"><enum>(8)</enum><header>Assessment of
impact of HIT on communities with health disparities and uninsured,
underinsured, and medically underserved areas</header><text display-inline="yes-display-inline">The National Coordinator shall assess and
publish the impact of health information technology in communities with health
disparities and in areas that serve uninsured, underinsured, and medically
underserved individuals (including urban and rural areas) and identify
practices to increase the adoption of such technology by health care providers
in such communities.</text>
</paragraph><paragraph id="H1C0E591546E148DEB6D6188128718FCF"><enum>(9)</enum><header>Website</header><text display-inline="yes-display-inline">The National Coordinator shall maintain and
frequently update an Internet website on which there is posted information that
includes the following:</text>
<subparagraph id="HB98A1DC80DE9416EA0057200B999ECC8"><enum>(A)</enum><text>Recommendations
made by the National Coordinator under paragraph (2)(A).</text>
</subparagraph><subparagraph id="H1ECDD8F403D14A28B8779377B753E00"><enum>(B)</enum><text>The standards and
guidance adopted by the Secretary under section 3003(a).</text>
</subparagraph><subparagraph id="H2BFC681327FE4890898C6EAA7B4E4175"><enum>(C)</enum><text>Sources of Federal
grant funds and technical assistance that are available to facilitate the
purchase of, or enhance the utilization of, health information technology
systems.</text>
</subparagraph><subparagraph id="H62AAD1CF043F4178811D14B3B0848DE3"><enum>(D)</enum><text>The reports
prepared by the National Coordinator under paragraph (7).</text>
</subparagraph><subparagraph id="HA7488511F5B04A07B4E5ECCC8127ACD2"><enum>(E)</enum><text>The assessment by
the National Coordinator under paragraph (8).</text>
</subparagraph></paragraph></subsection><subsection id="H21EA9B2FAB014D4C999EAECA6D00B351"><enum>(d)</enum><header>Staff</header>
<paragraph id="H9572205C35EA486EB504D921575600EB"><enum>(1)</enum><header>In
general</header><text>The National Coordinator may appoint personnel to the
Office as the National Coordinator considers appropriate. Such personnel shall
have the requisite skills needed to develop and make recommendations in each of
the categories described in clauses (iii), (iv), and (v) of subsection
(c)(2)(A).</text>
</paragraph><paragraph id="H1E39DEE696434EB192D4818E11A7F30"><enum>(2)</enum><header>Detail of Federal
Employees</header>
<subparagraph id="HF86B27F4EA684C1391668F8FA1006707"><enum>(A)</enum><header>In
general</header><text>Upon the request of the National Coordinator, the head of
any Federal agency is authorized to detail, with or without reimbursement from
the Office, any of the personnel of such agency to the Office to assist it in
carrying out its duties under this section.</text>
</subparagraph><subparagraph id="H55B515FAD7A248ED86194B998291904D"><enum>(B)</enum><header>Effect of
detail</header><text>Any detail of personnel under subparagraph (A)
shall—</text>
<clause id="H2BF4131F078347A099E8DD80DF1CDE8E"><enum>(i)</enum><text>not interrupt or
otherwise affect the civil service status or privileges of the Federal
employee; and</text>
</clause><clause id="H85CC349BAD9946EFA2A7E854A35CBCC2"><enum>(ii)</enum><text>be in addition to
any other staff of the Department employed by the National Coordinator.</text>
</clause></subparagraph><subparagraph id="H9E6D2A44066449C298D0A9F7E5B36DB1"><enum>(C)</enum><header>Acceptance of
detailees</header><text>Notwithstanding any other provision of law, the Office
may accept detailed personnel from other Federal agencies without regard to
whether the agency described under subparagraph (A) is reimbursed.</text>
</subparagraph></paragraph><paragraph commented="no" id="HAEF0B4018B3246B18838157C84F1BA08"><enum>(3)</enum><header>Temporary and
intermittent services</header><text display-inline="yes-display-inline">The
National Coordinator may procure temporary and intermittent services under
<external-xref legal-doc="usc" parsable-cite="usc/5/3109">section 3109(b)</external-xref> of title 5, United States Code to the extent that such services
cannot adequately be provided by any personnel appointed or detailed under
paragraph (1) or (2), respectively.</text>
</paragraph></subsection><subsection commented="no" id="H29BE0EB2BCD6483395F078D25D74BB34"><enum>(e)</enum><header>Funding</header>
<paragraph id="HF80C2E6241694B2FB411B0A00FBF216"><enum>(1)</enum><header>Authorization of
appropriations</header><text>There are authorized to be appropriated to carry
out this section such sums as may be necessary for each of the fiscal years
2009 through 2013.</text>
</paragraph><paragraph id="HDC17E7BCFD0240368420DFD2BF5EC00"><enum>(2)</enum><header>DHHS agency
contributions</header><text>In addition to amounts authorized under paragraph
(1), for purposes of carrying out this section, for each of the fiscal years
2009 through 2013 there shall be transferred to the National Coordinator from
the amount appropriated for the fiscal year to each agency within the
Department an amount that is equal to 1 percent of the amount appropriated to
the agency for the fiscal year to carry out health information technology
activities.</text>
</paragraph><paragraph id="HEF91F8D77EF349BA832E72DD75131701"><enum>(3)</enum><header>Open source
product licensing fee</header><text>In addition to amounts authorized under
paragraph (1) and transferred under paragraph (2), any fees collected under
subsection (c)(4)(B) shall be available to the National Coordinator for
purposes of carrying out this section.</text>
</paragraph></subsection></section><section display-inline="no-display-inline" id="H1E0EA9F4690B4206A3FC4CCBF98C7EB" section-type="subsequent-section"><enum>3002.</enum><header>HIT Advisory
Committee</header>
<subsection id="H776749506196487BBB56E4B5EDAC00ED"><enum>(a)</enum><header>Establishment</header><text display-inline="yes-display-inline">There is established a HIT Advisory
Committee to make recommendations to and advise the National Coordinator with
respect to all of the duties of the National Coordinator described in section
3001(c).</text>
</subsection><subsection id="H6EFBFFFB8D3C4993BC9B6F01920224B2"><enum>(b)</enum><header>Additional
duties</header>
<paragraph id="H32B41436E0AF486C9833DC4E5EBCAC4E"><enum>(1)</enum><header>Forum</header><text display-inline="yes-display-inline">The HIT Advisory Committee shall serve as a
forum for broad stakeholder input with specific expertise necessary to advise
the National Coordinator for purposes of carrying out the duties of the
National Coordinator described in section 3001(c), including expertise related
to the categories described in paragraph (2)(A) of such section.</text>
</paragraph><paragraph id="H8A7A81FFC11C4C1AA3B7CA1D24A04E26"><enum>(2)</enum><header>Website</header><text display-inline="yes-display-inline">The HIT Advisory Committee shall develop
and maintain an Internet website on which there is posted information that
includes the following:</text>
<subparagraph id="H2505429C52C949BDB365C956EFB110DB"><enum>(A)</enum><text>Established
governance rules.</text>
</subparagraph><subparagraph id="H9945C3994D954225A58C34EA4B9C284"><enum>(B)</enum><text>A business
plan.</text>
</subparagraph><subparagraph id="H6E96FDCE122C4767A034492B6F6EF440"><enum>(C)</enum><text>Meeting notices at
least 14 days prior to each meeting.</text>
</subparagraph><subparagraph id="H62E1C368949E46DDB4696213F006D164"><enum>(D)</enum><text>Meeting agendas at
least 7 days prior to each meeting.</text>
</subparagraph><subparagraph id="HE18E010E2EB3432582A34AE3426C672"><enum>(E)</enum><text>Meeting materials
at least 3 days prior to each meeting.</text>
</subparagraph></paragraph></subsection><subsection display-inline="no-display-inline" id="H97DB14661A054BEAAE3DE134138BC09D"><enum>(c)</enum><header>Membership</header>
<paragraph id="H9E82E55E031D4A9FBC0217ABD7733802"><enum>(1)</enum><header>Appointments</header><text>The
HIT Advisory Committee shall be composed of members to be appointed as
follows:</text>
<subparagraph id="H2FF52DF903CE4B95949EA64E13BA006E"><enum>(A)</enum><text>Such members as
shall be appointed by the Secretary, from the Department of Health and Human
Services as representatives of agencies within the Department, including from
the Agency for Healthcare Research and Quality, the Centers for Disease Control
and Prevention, the Centers of Medicare & Medicaid Services, the Health
Resources and Services Administration, and the Indian Health Service.</text>
</subparagraph><subparagraph id="H3EDF4470BDAA44288CE7106FF745EABB"><enum>(B)</enum><text>1 member shall be
appointed by the majority leader of the Senate.</text>
</subparagraph><subparagraph id="HBD594211E70142E3B6007F59E08D5693"><enum>(C)</enum><text>1 member shall be
appointed by the minority leader of the Senate.</text>
</subparagraph><subparagraph id="HB010AC0D1C6F4C2BACED14BFF2350783"><enum>(D)</enum><text>1 member shall be
appointed by the Speaker of the House of Representatives.</text>
</subparagraph><subparagraph id="HEEE2BE1095604A90B68891009BF79609"><enum>(E)</enum><text>1 member shall be
appointed by the minority leader of the House of Representatives.</text>
</subparagraph><subparagraph id="H503D7D4358304ABAB3503FF47DA2C52B"><enum>(F)</enum><text>Such other members
as shall be appointed by the President as representatives of other relevant
Federal agencies, such as the Department of Veterans Affairs, the National
Institute of Standards and Technology, and the Department of Defense.</text>
</subparagraph><subparagraph id="H9D184F9060D14EF68DB7C974DFCD00A4"><enum>(G)</enum><text>12 members shall
be appointed by the Comptroller General of the United States of whom—</text>
<clause id="H4BDFB2A50807402DA02168A1A84ED69D"><enum>(i)</enum><text>1
member shall be an advocate for patients or consumers;</text>
</clause><clause id="HAB8B79AFC45843879CB992DBECE929BC"><enum>(ii)</enum><text>2
members shall represent health care providers, one of which shall be a
physician;</text>
</clause><clause id="H4C380B69278143BB8B117617695E5625"><enum>(iii)</enum><text>1 member shall
be from a labor organization representing health care workers;</text>
</clause><clause id="HB9F74429719347509DE5B547948E78A7"><enum>(iv)</enum><text>1
member shall have expertise in privacy and security;</text>
</clause><clause id="H48EC0F3FE6974AA98033C2862169FE4B"><enum>(v)</enum><text>1
member shall have expertise in improving the health of vulnerable
populations;</text>
</clause><clause id="H45FFE83036EF4DC683D9FE2B67F55B14"><enum>(vi)</enum><text>1
member shall be from the health research community;</text>
</clause><clause id="HB0ABEF484E104C13A1949020519B4161"><enum>(vii)</enum><text>1 member shall
represent health plans or other third-party payers;</text>
</clause><clause id="H5BEABEC54BF54BE4A4C0B57568A8C9C0"><enum>(viii)</enum><text>1 member shall
represent information technology vendors;</text>
</clause><clause id="H36DD63A144094D0E93448C84B558827B"><enum>(ix)</enum><text>1
member shall represent purchasers or employers;</text>
</clause><clause id="H50EDFA00F21A4542851C4D1B74C5DF1"><enum>(x)</enum><text>1
member shall have expertise in health care quality measurement and reporting;
and</text>
</clause><clause id="H89C31B62C9044224A7A824CDAC178708"><enum>(xi)</enum><text>1
member shall have expertise in open source health information technology
systems.</text>
</clause><continuation-text continuation-text-level="subparagraph">In no
case may the total number of members appointed under subparagraphs (A) and (F)
exceed 10.</continuation-text></subparagraph></paragraph><paragraph id="H86CDC122983E4408B4E7B15591BD391C"><enum>(2)</enum><header>National
Coordinator</header><text display-inline="yes-display-inline">The National
Coordinator shall be a member of the HIT Advisory Committee and act as a
liaison between the Committee and agencies of the Federal Government.</text>
</paragraph><paragraph id="H7B8097B9839D439198CC302DE14EBC4"><enum>(3)</enum><header>Chairperson and
vice chairperson</header><text display-inline="yes-display-inline">The HIT
Advisory Committee shall designate 1 member to serve as the chairperson and 1
member to serve as the vice chairperson of the HIT Advisory Committee, such
that one is a representative of the public sector and one is a representative
from the private sector.</text>
</paragraph><paragraph id="HC1C680886DCE4189AA6FB5F0BB428CE6"><enum>(4)</enum><header>Participation</header><text display-inline="yes-display-inline">The members of the HIT Advisory Committee
appointed under paragraph (1) shall represent a balance among various sectors
of the health care system so that no single sector unduly influences the
recommendations of such Committee.</text>
</paragraph><paragraph id="H4B8903FB317B42EB9E8D6B8F964F5792"><enum>(5)</enum><header>Authorized use
of task forces and work groups</header><text display-inline="yes-display-inline">The National Coordinator, in consultation
with the chairperson and vice chairperson of the HIT Advisory Committee, may
convene task forces or working groups as necessary to carry out the duties of
the Committee.</text>
</paragraph><paragraph id="H8A46E28A3D5F4481932E1813C4B015CC"><enum>(6)</enum><header>Compensation</header><text display-inline="yes-display-inline">Subject to the availability of
appropriations, while serving on the business of the HIT Advisory Committee
(including traveltime), a member of the Committee who is not a Federal employee
shall be entitled to compensation at the per diem equivalent of the rate
provided for level IV of the Executive Schedule under <external-xref legal-doc="usc" parsable-cite="usc/5/5315">section 5315</external-xref> of title 5,
United States Code; and while so serving away from home and the member's
regular place of business, a member may be allowed travel expenses, as
authorized by the Chairman of the Committee.</text>
</paragraph><paragraph id="HB98B63E8DD80485C86612296D9ABCF96"><enum>(7)</enum><header>Terms</header>
<subparagraph id="H4F593CA7C0EA4A069511BD5DEB07D486"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">The terms of members
of the HIT Advisory Committee appointed under paragraph (1) shall be 3 years
except that the Comptroller General of the United States shall designate
staggered terms for the members first appointed under paragraph (1)(G).</text>
</subparagraph><subparagraph id="H4E3755D490134BD7B11733EAA740E2DC"><enum>(B)</enum><header>Vacancies</header><text display-inline="yes-display-inline">Any member appointed to fill a vacancy in
the membership of the HIT Advisory Committee that occurs prior to the
expiration of the term for which the member’s predecessor was appointed shall
be appointed only for the remainder of that term. A member may serve after the
expiration of that member’s term until a successor has been appointed. A
vacancy in the HIT Advisory Committee shall be filled in the manner in which
the original appointment was made.</text>
</subparagraph></paragraph><paragraph id="HD468A2800BBD4975858DB43253CD7E6E"><enum>(8)</enum><header>Outside
involvement</header><text display-inline="yes-display-inline">The HIT Advisory
Committee shall ensure an adequate opportunity for the participation in
activities of the Committee of outside advisors, including individuals with
expertise in the development of policies for the electronic exchange and use of
health information, including in the areas of health information privacy and
security.</text>
</paragraph><paragraph id="HC445674F3CA94B8B9627C0CABB094101"><enum>(9)</enum><header>Quorum</header><text display-inline="yes-display-inline">Ten members of the HIT Advisory Committee
shall constitute a quorum for purposes of voting, but a lesser number of
members may meet and hold hearings.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H95142DEB932143A0B89DF770F026A24F"><enum>(d)</enum><header>Application of
FACA</header><text>The <act-name parsable-cite="FACA">Federal Advisory
Committee Act</act-name> (5 U.S.C. App.), other than section 14 of such Act,
shall apply to the HIT Advisory Committee.</text>
</subsection><subsection display-inline="no-display-inline" id="H3DE38C60AB674B99957F00BF14A2B8C3"><enum>(e)</enum><header>Publication</header><text display-inline="yes-display-inline">The Secretary shall provide for publication
in the Federal Register and the posting on the Internet website of the Office
of the National Coordinator for Health Information Technology of all policy
recommendations made by the HIT Advisory Committee under this section.</text>
</subsection></section><section id="H310B255522D645D9A52B644230C76C07"><enum>3003.</enum><header>Process for
adoption of recommended standards and guidance</header>
<subsection id="H04FF8FCF31D04B25B26400691BFB681"><enum>(a)</enum><header>In
general</header>
<paragraph id="HAAAC5FAEDAC64CD9AF630073005CF23F"><enum>(1)</enum><header>Standards</header><text display-inline="yes-display-inline">Not later than 9 months after the date of
receipt of a recommendation under section 3001(c)(2) from the National
Coordinator for any grouping of standards for purposes of certifying health
information technology under the certification program under section
3001(c)(3), the Secretary shall, through a rulemaking process and after
consideration of public comments, determine whether or not to adopt such
grouping of standards.</text>
</paragraph><paragraph id="HFC02E798475149DFABF92184E19661D8"><enum>(2)</enum><header><?xm-replace_text "?>Guidance</header><text>Not
later than 9 months after the date of receipt of a recommendation under section
3001(c)(2) from the National Coordinator for any guidance, the Secretary shall,
through the applicable administrative process that includes public notice in
the Federal Register and opportunity for public comment, determine whether or
not to adopt such guidance.</text>
</paragraph></subsection><subsection id="H143F94AB9F0845C59D831C08372FB602"><enum>(b)</enum><header>Initial
standards</header><text display-inline="yes-display-inline">Not later than
September 30, 2011, the Secretary shall, through a rulemaking process and after
consideration of public comments, adopt the initial set of standards
recommended from the National Coordinator pursuant to the second sentence under
section 3001(c)(2). Such initial set of standards shall include, at a minimum,
technical standards for de-identifying health information and for immutable
audit trails.</text>
</subsection><subsection id="HB2C65F1A1B844D0BA488DC8F963939CD"><enum>(c)</enum><header>Publication</header><text display-inline="yes-display-inline">Not later than 30 days after the Secretary
makes a determination under subsection (a), the Secretary shall provide for
publication in the Federal Register, and on the Internet website maintained by
the National Coordinator in accordance with section 3001(c)(9), of such
determination.</text>
</subsection></section><section commented="no" id="H55507AB8558245E1AC2BE968FE3CC36B"><enum>3004.</enum><header>Application
and use of adopted standards by Federal agencies</header><text display-inline="no-display-inline">For requirements relating to the application
and use by Federal agencies of the standards adopted under section 3003(a), see
section 111 of the Health-e Information Technology Act of 2008.</text>
</section><section id="HB82D3E2A53AC4151A536DD9ED65384B5"><enum>3005.</enum><header>Voluntary
application and use of adopted standards by private entities</header>
<subsection id="HA19F35AC265342AAB71CB45152C72195"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided
under section 112 of the Health-e Information Technology Act of 2008, any
standard adopted under section 3003(a) shall be voluntary with respect to
private entities.</text>
</subsection><subsection id="HB5A2D2FA9B224038886DDB26C8D2AE44"><enum>(b)</enum><header>Rule of
construction</header><text display-inline="yes-display-inline">Nothing in this
subtitle shall be construed to require that a private entity that enters into a
contract with the Federal Government apply or use the standards adopted under
section 3003(a) with respect to activities not related to the contract. The
previous sentence shall not affect any other provision of law, such as part C
of title XI of the Social Security Act, title III of the Health-e Information
Technology Act of 2008, or regulations promulgated to carry out section 264(c)
of the Health Insurance Portability and Accountability Act of 1996, that
requires the application or use of such a standard.</text>
</subsection></section><section id="H102BF386E649438CBA48E5FEF19C1A4"><enum>3006.</enum><header>Health
Information Technology Resource Center</header>
<subsection commented="no" id="H63C0F9524E004D748BBCADD493493E52"><enum>(a)</enum><header>Development</header>
<paragraph commented="no" id="HB44846A26D034A13A3DA231024DED08B"><enum>(1)</enum><header>In
general</header><text>The National Coordinator shall develop a Health
Information Technology Resource Center to provide technical assistance and
develop best practices to support and accelerate efforts to adopt, implement,
and effectively use health information technology that allows for the
electronic exchange and use of information in compliance with standards and any
guidance adopted under section 3003(a), including for purposes of each of the
categories described in such section 3001(c)(2).</text>
</paragraph><paragraph commented="no" id="H338FF41DD74C48BBA6B22A39457DFDE"><enum>(2)</enum><header>Purposes</header><text>The
purpose of the Center is to—</text>
<subparagraph commented="no" id="H3A21D021E16445158C366F2622048E4C"><enum>(A)</enum><text>provide a forum
for the exchange of knowledge and experience;</text>
</subparagraph><subparagraph commented="no" id="H1AF86C55B99B4670912B1B0722858B68"><enum>(B)</enum><text>accelerate the
transfer of lessons learned from existing public and private sector
initiatives, including those currently receiving Federal financial
support;</text>
</subparagraph><subparagraph commented="no" id="HB815FDD06D6940ABA8CCF51654119D73"><enum>(C)</enum><text>assemble, analyze,
and widely disseminate evidence and experience related to the adoption,
implementation, and effective use of health information technology that allows
for the electronic exchange and use of information;</text>
</subparagraph><subparagraph commented="no" id="H6B062907FA714629963E07872EB9E273"><enum>(D)</enum><text display-inline="yes-display-inline">provide technical assistance for the
establishment and evaluation of regional and local health information networks
to facilitate the electronic exchange of information across health care
settings and improve the quality of health care;</text>
</subparagraph><subparagraph commented="no" id="H1F57CA8370794A28A0D6005F79493B81"><enum>(E)</enum><text>provide technical
assistance for the development and dissemination of solutions to barriers to
the exchange of electronic health information;</text>
</subparagraph><subparagraph id="HF705538E6C4448289000740694B9F16D"><enum>(F)</enum><text>learn about
effective strategies to adopt and utilize health information technology in
medically underserved communities;</text>
</subparagraph><subparagraph commented="no" id="H2EA99D50C1A84473A403A87D66798FD9"><enum>(G)</enum><text>conduct other
activities identified by the States, local or regional health information
networks, or health care stakeholders as a focus for developing and sharing
best practices; and</text>
</subparagraph><subparagraph id="H5A26604C196E462EBAAE8117CF311C9F"><enum>(H)</enum><text>provide technical
assistance to promote adoption and utilization of health information technology
by health care providers, including in medically underserved
communities.</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="HD7A2A38E97944AB0BB92A30631B44828"><enum>(b)</enum><header>Technical
Assistance Telephone Number or Website</header><text>The National Coordinator
shall establish a toll-free telephone number or Internet website to provide
health care providers with a single point of contact to—</text>
<paragraph commented="no" id="HBAE42D47E6444DDEAC497708F84C2500"><enum>(1)</enum><text>learn about
Federal grants and technical assistance services related to the electronic
exchange and use of health information;</text>
</paragraph><paragraph commented="no" id="HC6EE9ABC7FBE45D1B1F52F25ECDB4C3E"><enum>(2)</enum><text>learn about
standards adopted under section 3003(a);</text>
</paragraph><paragraph commented="no" id="H35173CCC7A76413AAFE5165474B8D782"><enum>(3)</enum><text>learn about
regional and local health information networks for assistance with health
information technology; and</text>
</paragraph><paragraph commented="no" id="H587633FE0C114189B823298FD6B97700"><enum>(4)</enum><text>disseminate
additional information determined by the National
Coordinator.</text>
</paragraph></subsection></section></subtitle>.
102.
(a)To the extent consistent with section 3001
of the Public Health Service Act, as added by section 101, all functions,
personnel, assets, liabilities, and administrative actions applicable to the
National Coordinator for Health Information Technology appointed under
Executive Order 13335 or the Office of such National Coordinator on the date
before the date of the enactment of this Act shall be transferred to the
National Coordinator appointed under section 3001(a) of such Act and the Office
of such National Coordinator as of the date of the enactment of this
Act.
(b)To the extent consistent with section 3002
of the Public Health Service Act, as added by section 101, all functions,
personnel, assets, and liabilities applicable to the American Health
Information Community created in response to Executive Order 13335 as of the
day before the date of the enactment of this Act shall be transferred to the
HIT Advisory Committee, established under section 3002(a)of such Act, as
appropriate, as of the date of the enactment of this Act.
(c)
(1)Nothing
in section 3001 of the Public Health Service Act, as added by section 101, or
subsection (a) shall be construed as requiring the creation of a new entity to
the extent that the Office of the National Coordinator for Health Information
Technology established pursuant to Executive Order 13335 is consistent with the
provisions of such section 3001.
(2)Nothing in section 3002 of the Public
Health Service Act, as added by section 101, or subsection (b) shall be
construed as requiring the creation of a new entity to the extent that the
American Health Information Community created in response to Executive Order
13335 is consistent with the provisions of such section 3002.
BApplication and
use of adopted health information technology standards; reports
111.Coordination of
Federal activities with adopted standards
(a)Spending on
health information technology systemsAs each agency (as defined in the Executive
Order issued on August 22, 2006, relating to promoting quality and efficient
health care in Federal government administered or sponsored health care
programs) implements, acquires, or upgrades health information technology
systems used for the direct exchange of individually identifiable health
information between agencies and with non-Federal entities, it shall utilize,
where available, health information technology systems and products that meet
standards adopted under section 3003(a) of the Public Health Service Act, as
added by section 101.
(b)Federal
information collection activitiesWith respect to a standard adopted under
section 3003(a) of the Public Health Service Act, as added by section 101, the
President shall take measures to ensure that Federal activities involving the
broad collection and submission of health information are consistent with such
standard within three years after the date of such adoption.
(c)Application of
definitionsThe definitions contained in section 3000 of the
Public Health Service Act, as added by section 101, shall apply for purposes of
this part.
112.Application to
private entitiesEach agency
(as defined in such Executive Order issued on August 22, 2006, relating to
promoting quality and efficient health care in Federal government administered
or sponsored health care programs) shall require in contracts or agreements
with health care providers, health plans, or health insurance issuers that as
each provider, plan, or issuer implements, acquires, or upgrades health
information technology systems, it shall utilize, where available, health
information technology systems and products that meet standards adopted under
section 3003(a) of the Public Health Service Act, as added by section
101.
113.Not later than 2 years
after the date of the enactment of this Act and annually thereafter, the
Secretary of Health and Human Services shall submit to the Committee on
Finance, the Committee on Health, Education, Labor, and Pensions and the
Committee on Commerce, Science, and Transportation of the Senate and the
Committee on Ways and Means, the Committee on Energy and Commerce, and the
Committee on Science and Technology of the House of Representatives a report
that—
(1)describes the specific actions that have
been taken by the Federal Government and private entities to facilitate the
adoption of a nationwide system for the electronic use and exchange of health
information, including information from the implementation reports submitted
under section 3001(c)(7) of the Public Health Service Act, as added by section
101;
(2)describes barriers
to the adoption of such a nationwide system; and
(3)contains
recommendations to achieve full implementation of such a nationwide
system.
<enum>II</enum><header>Testing of Health
Information Technology</header>
<section id="H11D870A2EABD4D2381F4E7C192DF3026"><enum>201.</enum><header>National
Institute for Standards and Technology testing</header>
<subsection id="H46532C1FC51E4F018B47789D7EB782CB"><enum>(a)</enum><header>Pilot testing of
standards and implementation specifications</header><text>In coordination with
the Office of the National Coordinator of Health Information Technology
established under section 3001 of the Public Health Service Act, as added by
section 101, with respect to the development of standards under such section,
the Director of the National Institute for Standards and Technology shall test
such standards in order to assure the efficient implementation and use of such
standards.</text>
</subsection><subsection id="H88076F2E91EA424DA4B979061DB30058"><enum>(b)</enum><header>Voluntary
testing program</header><text display-inline="yes-display-inline">In
coordination with the Office of the National Coordinator of Health Information
Technology established under section 3001 of the Public Health Service Act, as
added by section 101, with respect to the development of standards under such
section, the Director of the National Institute of Standards and Technology
shall support the establishment of a conformance testing infrastructure,
including the development of technical test beds. The development of this
conformance testing infrastructure may include a program to accredit
independent, non-Federal laboratories to perform testing.</text>
</subsection></section><enum>III</enum><header>Incentives for
adoption of health information technology</header>
<subtitle id="H850D7D10CF9841A7BB1DD53EDDCEE952"><enum>A</enum><header>Medicare
program</header>
<section id="H29A5C40E509E4F4BAA89F4588370EFB0"><enum>301.</enum><header>Incentives for
eligible professionals</header>
<subsection id="H39CF630B6A404FB6894DC0FB512F626F"><enum>(a)</enum><header>Incentive
payments</header><text display-inline="yes-display-inline">Section 1848 of the
Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-4">42 U.S.C. 1395w–4</external-xref>) is amended by adding at the end the
following new subsection:</text>
<quoted-block display-inline="no-display-inline" id="HD3C6797F1D1E4451A678D214C938F96" style="OLC">
<subsection id="H63B61721D86044A58748E14454BE8F1C"><enum>(o)</enum><header>Incentives for
adoption and meaningful use of certified health information technology
system</header>
<paragraph id="HE3CEBA74A5C149B99603D114AECA300"><enum>(1)</enum><header>Incentive
payments</header>
<subparagraph id="H3069461CADE9458A927394B6AFB21156"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to
subparagraphs (B), (C), and (D), with respect to covered professional services
furnished by an eligible professional during a reporting period during the
first calendar year beginning after the date specified under subparagraph
(B)(iv) (or, if sooner, 2013) or any subsequent year (before 2017), if the
eligible professional is a meaningful HIT user for the reporting period (as
determined under paragraph (2), in addition to the amount otherwise paid under
this part, there also shall be paid to the eligible professional (or to an
employer or facility in the cases described in clause (A) of section
1842(b)(6)) or, in the case of a group practice under paragraph (2)(D), to the
group practice, from the Federal Supplementary Medical Insurance Trust Fund
established under section 1841 an amount equal to 75 percent of the Secretary’s
estimate (based on claims submitted not later than 2 months after the end of
the reporting period) of the allowed charges under this part for all such
covered professional services furnished by the eligible professional (or, in
the case of a group practice under paragraph (2)(D), by the group practice)
during the reporting period.</text>
</subparagraph><subparagraph id="HF0343CD7139F4824B75084ED877566D8"><enum>(B)</enum><header>Limitations on
amounts of incentive payments</header>
<clause id="HC121434489F04574808C3DC6B465B97D"><enum>(i)</enum><header>In
general</header><text>In no case shall the amount of the incentive payment
provided under this paragraph exceed the applicable amount specified in clause
(ii) with respect to any eligible professional.</text>
</clause><clause display-inline="no-display-inline" id="HF7F0186E98AE44CA9039C52B7698F248"><enum>(ii)</enum><header>Amount</header><text>Subject
to clauses (iii) and (iv), the applicable amount specified in this clause is as
follows:</text>
<subclause id="H14F3608912CB4CC08D4395BB1968A746"><enum>(I)</enum><text>For the first
calendar year beginning after the date specified in clause (iv) or, if sooner,
for 2013, $15,000.</text>
</subclause><subclause id="H9EFD9871A6C74373A3C3FCF548777500"><enum>(II)</enum><text>For the calendar
year following the year specified in subclause (I), $12,000.</text>
</subclause><subclause id="H51D44CF5C21A497582E943EBA746273B"><enum>(III)</enum><text>For the calendar
year following the year specified in subclause (II), $8,000.</text>
</subclause><subclause id="HF66FA7DE1236455B886E90673304134C"><enum>(IV)</enum><text>For the calendar
year following the year specified in subclause (III), $4,000.</text>
</subclause><subclause id="H4C4A4517A26C4CBB9E83FC4150CAF835"><enum>(V)</enum><text>For the calendar
year following the year specified in subclause (IV), $2,000.</text>
</subclause></clause><clause id="H391699E7A5B94096819F7E988C04E7C"><enum>(iii)</enum><header>Pro-ration for
partial year professionals</header><text>In the case of an eligible
professional who is a meaningful HIT user for only a portion of a reporting
period for reasons such as the professional did not provide services for which
payment is made under this part for the entire period or the professional
initiated the use of health information technology during the period, the
Secretary may pro-rate the applicable amount specified under clause (ii) to
reflect the portion of the period during which the professional was a
meaningful HIT user.</text>
</clause><clause id="H79084A74BF964612BB3CE216B9553C4"><enum>(iv)</enum><header>Date
specified</header><text display-inline="yes-display-inline">The date specified
in this subclause is the date on which the open source health information
technology system under section 3001(c)(4) of the Public Health Service Act is
first made publicly available.</text>
</clause></subparagraph><subparagraph id="HCE54B8F16B1F40C3AAB0C2CE1CB7828B"><enum>(C)</enum><header>Non-application
to hospital-based eligible professionals</header>
<clause id="HF2E9D7D4334441EC9E45F0B8645B04B1"><enum>(i)</enum><header>In
general</header><text>No payment may be made under subparagraph (A) in the case
of hospital-based eligible professionals.</text>
</clause><clause id="HA27CE1C1FF7E4997A080F866E861578E"><enum>(ii)</enum><header>Hospital-based
eligible professional</header><text display-inline="yes-display-inline">For
purposes of clause (i), the term <quote>hospital-based eligible
professional</quote> means an eligible professional, such as a pathologist or
anesthesiologist, who furnishes items and services principally in a hospital
setting and through the use of the facilities and equipment, including computer
equipment, of the hospital.</text>
</clause></subparagraph><subparagraph id="HA7AB3F713E084B5598E8A115E46D3D4D"><enum>(D)</enum><header>Form of
payment</header><text>The payment under this subsection for a reporting period
may be in the form of a single consolidated payment or in the form of such
periodic installments as the Secretary may specify.</text>
</subparagraph></paragraph><paragraph display-inline="no-display-inline" id="HAD4ED90917274CCF8949DF968F9D6CE4"><enum>(2)</enum><header>Meaningful HIT
user</header>
<subparagraph id="H177A78900C584FEABB9F21AEA1FD12F9"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">For purposes of
paragraph (1), an eligible professional shall be treated as a meaningful HIT
user for a reporting period for a year if the eligible professional
demonstrates to the satisfaction of the Secretary that the professional is
meaningfully using a certified health information technology system during the
reporting period, as demonstrated in accordance with applicable measures
established under subparagraph (B).</text>
</subparagraph><subparagraph id="HA3E8E9FCD11844208DA117EC1249E4B"><enum>(B)</enum><header>Measures for
meaningful use</header><text>The Secretary shall establish measures under which
an eligible professional may demonstrate meaningful use of a certified health
information technology system for a reporting period. Such measures may
include—</text>
<clause id="HC5FEF03C2A3242E5B3F7C67C84006928"><enum>(i)</enum><text>self-certification
of operational use of such a system;</text>
</clause><clause id="H504ED5DF56F34767BF59C928AEDAD53"><enum>(ii)</enum><text display-inline="yes-display-inline">the submission (or ability to submit), in a
form and manner specified by the Secretary, of such information on clinical
measures and data (that does not include individually identifiable health
information) from such system that indicates a meaningful utilization of such a
system during the period; and</text>
</clause><clause id="HD948B10D2F804945BBBD21F923DE1E77"><enum>(iii)</enum><text>such other means
as the Secretary may specify.</text>
</clause><continuation-text continuation-text-level="subparagraph">The
Secretary may establish and apply different measures based on the stage of
implementation or adoption of the certified health information technology
system involved.</continuation-text></subparagraph><subparagraph commented="no" id="HBEB7998899824BCC99D92971705D8D4F"><enum>(C)</enum><header>Use of part D
data</header><text>Notwithstanding sections 1860D–15(d)(2)(B) and
1860D–15(f)(2), the Secretary may use data regarding drug claims submitted for
purposes of section 1860D–15 that are necessary for purposes of subparagraph
(B)(ii).</text>
</subparagraph><subparagraph id="H5516B48BFEA24AB992FBC393BF5F7074"><enum>(D)</enum><header>Satisfactory
measures for group practices</header>
<clause id="HC4C49D2C3DCB4565A9A0032F4D1EEA5"><enum>(i)</enum><header>In
general</header><text>Not later than January 1, 2013, the Secretary shall
provide for a method of applying the measures established under subparagraph
(B) or revised under subparagraph (F) to eligible professionals in a group
practice (as defined by the Secretary).</text>
</clause><clause id="H8FC397DC75A64AF7B5CD4D4567428B48"><enum>(ii)</enum><header>Statistical
sampling model</header><text>In the case that the Secretary provides for a
method under clause (i), the method may provide for the use of a statistical
sampling model to submit data on measures, such as the model used under the
Physician Group Practice demonstration project under section 1866A.</text>
</clause><clause id="H457A74C1A70B466D9BAE128198C60910"><enum>(iii)</enum><header>No double
payments</header><text>Payments for a reporting period to a group practice
under this paragraph by reason of the method under clause (i) shall be in lieu
of the payments that would otherwise be made under this paragraph to eligible
professionals in the group practice for being a meaningful HIT user during such
period.</text>
</clause></subparagraph><subparagraph id="HAE04B9A0D0614441A3B316A02C935FCC"><enum>(E)</enum><header>Authority to
revise measures</header><text>The Secretary may periodically revise the
measures established under subparagraph (B) with respect to demonstrating
meaningful use of a certified health information technology system.</text>
</subparagraph></paragraph><paragraph display-inline="no-display-inline" id="H8ECD13E839B74A3AA24D30661007E3D6"><enum>(3)</enum><header>Application</header>
<subparagraph id="H0057D56312C645E3B3EE63C63D006B78"><enum>(A)</enum><header>Physician
reporting system rules</header><text>Paragraphs (5), (6),and (8) of subsection
(k) shall apply for purposes of this subsection in the same manner as they
apply for purposes of such subsection.</text>
</subparagraph><subparagraph commented="no" id="H660A8C507BE342BBAB2721B842586CC7"><enum>(B)</enum><header>Coordination
with other bonus payments</header><text>The provisions of this subsection shall
not be taken into account in applying subsections (m) and (u) of section 1833
and any payment under such subsections shall not be taken into account in
computing allowable charges under this subsection.</text>
</subparagraph><subparagraph id="HBD50DC59246445F1B0E4570865B3FD96"><enum>(C)</enum><header>Limitations on
review</header><text display-inline="yes-display-inline">There shall be no
administrative or judicial review under 1869, section 1878, or otherwise
of—</text>
<clause id="HC828E7B66CB3474597518424C9B6DA11"><enum>(i)</enum><text>the determination
of measures applicable to services furnished by eligible professionals under
this subsection;</text>
</clause><clause id="H128846E036C34BEF9F115F00BDF20005"><enum>(ii)</enum><text>the determination
of a meaningful HIT user under paragraph (2)(A), a limitation under paragraph
(1)(B), and the exception under subsection (a)(7)(B); and</text>
</clause><clause id="H658815DBDD354EBF00D39B9036DCC791"><enum>(iii)</enum><text>the
determination of any incentive payment under this subsection and the payment
adjustment under subsection (a)(7)(A).</text>
</clause></subparagraph><subparagraph id="H682A5EAC8A2745D5AEE838BF046B5091"><enum>(D)</enum><header>Posting on
website</header><text>The Secretary shall post on the Internet website of the
Centers for Medicare & Medicaid Services, in an easily understandable
format, a list of the names, business addresses, and business phone numbers of
the eligible professionals (or, in the case of reporting under paragraph
(2)(D), the group practices) who are meaningful HIT users.</text>
</subparagraph></paragraph><paragraph id="H71864A70AC3742E9978DA6D758F1C08"><enum>(4)</enum><header>Definitions</header><text>For
purposes of this subsection:</text>
<subparagraph id="H43C0188F04F447CEBEE1BBD69E190352"><enum>(A)</enum><header>Certified health
information technology system</header><text>The term <quote>certified health
information technology system</quote> means, with respect to an eligible
professional and a reporting period for a year, a health information technology
system (as defined in section 3000 of the Public Health Service Act) that has a
current certification under section 3001(c)(3) of such Act as satisfying all
interoperability standards, privacy and security standards, and clinical and
quality functions adopted under section 3003(a) of such Act that are applicable
to the eligible professional.</text>
</subparagraph><subparagraph id="HE4C6FD30B284428400D991DA991E5838"><enum>(B)</enum><header>Covered
professional services</header><text>The term <quote>covered professional
services</quote> has the meaning given such term in subsection (k)(3).</text>
</subparagraph><subparagraph id="H9AB794EC3E144EE8A89C4843D4556F6E"><enum>(C)</enum><header>Eligible
professional</header><text display-inline="yes-display-inline">The term
<term>eligible professional</term> means a physician, as defined in section
1861(r)(1).</text>
</subparagraph><subparagraph id="H72EFC3F89875465A866534ED17D7128D"><enum>(D)</enum><header>Reporting
period</header><text display-inline="yes-display-inline">The term
<term>reporting period</term> means any period, with respect to a calendar
year, as specified by the
Secretary.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H3FA759CCF0D3459D9DA3EE3572CF82A5"><enum>(b)</enum><header>Incentive
payment adjustment</header><text>Section 1848(a) of the Social Security Act (42
U.S.C. 1395w–4(a)) is amended by adding at the end the following new
paragraph:</text>
<quoted-block display-inline="no-display-inline" id="H5A25DD7817D64B9B97B9743E41555DE0" style="OLC">
<paragraph id="HEBC432F3D40E46CE9247B37BCEC59BFF"><enum>(7)</enum><header>Incentives for
meaningful use of health information technology systems</header>
<subparagraph id="HB1497D5E1CC84198B3FF6C336BB13992"><enum>(A)</enum><header>Adjustment</header>
<clause id="H00ACBE53A46646DEB00052AD67EE2015"><enum>(i)</enum><header>In
general</header><text>Subject to subparagraph (B), with respect to covered
professional services furnished by an eligible professional during 2016 or any
subsequent year, if the eligible professional is not a meaningful HIT user for
a reporting period for the year (as determined under subsection (o)(2)), the
fee schedule amount for such services furnished by such professional during the
year (including the fee schedule amount for purposes of determining a payment
based on such amount) shall be equal to the applicable percent of the fee
schedule amount that would otherwise apply to such services under this
subsection (determined after application of paragraph (3) but without regard to
this paragraph).</text>
</clause><clause id="H43ED2A91E9314FA7A7FF116CB0511C38"><enum>(ii)</enum><header>Applicable
percent</header><text>For purposes of clause (i), the term <term>applicable
percent</term> means—</text>
<subclause id="HDBD997DF177C4C74AD98FFBDB54305B"><enum>(I)</enum><text>for 2016, 99
percent;</text>
</subclause><subclause id="H3866239431E74E07AECC6B99719964CE"><enum>(II)</enum><text>for 2017, 98.5
percent;</text>
</subclause><subclause id="H99C97830A7CD45C49BAC7D963408B7A"><enum>(III)</enum><text>for 2018, 98
percent;</text>
</subclause><subclause id="H4A44AD19DEBA4234ACC4570787EDAC63"><enum>(IV)</enum><text>for 2019, 97.5
percent; and</text>
</subclause><subclause id="HC8BFC7786A62492A8185862C506D0800"><enum>(V)</enum><text>for 2020 and each
subsequent year, 97 percent.</text>
</subclause></clause></subparagraph><subparagraph display-inline="no-display-inline" id="HE0BE6F3E94E040D1BEA63DF979522295"><enum>(B)</enum><header>Significant
hardship exception</header><text>The Secretary may, on a case-by-case basis,
exempt an eligible professional from the application of the payment adjustment
under subparagraph (A) if the Secretary determines, subject to annual renewal,
that compliance with the requirement for being a meaningful HIT user would
result in a significant hardship, such as in the case of an eligible
professional who practices in a rural area without sufficient Internet access.
In no case may an eligible professional be granted an exemption under this
subparagraph for more than 5 years.</text>
</subparagraph><subparagraph id="H1771CEC2584A497F00D8CF5F9CACEE41"><enum>(C)</enum><header>Application of
physician reporting system rules</header><text>Paragraphs (5), (6), and (8) of
subsection (k) shall apply for purposes of this paragraph in the same manner as
they apply for purposes of such subsection.</text>
</subparagraph><subparagraph id="H19403AF07F5D4D9FBACD20019B98432D"><enum>(D)</enum><header>Non-application
to hospital-based eligible professionals</header><text>No payment adjustment
may be made under subparagraph (A) in the case of hospital-based eligible
professionals (as defined in subsection (o)(1)(C)(ii)).</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H438C8FBACFB0444BA746D3C4069471F"><enum>(E)</enum><header>Definitions</header><text>For
purposes of this paragraph:</text>
<clause id="H627336F1E0F64A91A27CE575E8F18EFE"><enum>(i)</enum><header>Covered
professional services</header><text>The term <quote>covered professional
services</quote> has the meaning given such term in subsection (k)(3).</text>
</clause><clause id="HF8DFC50ED96943348CCCB91B3FC600DD"><enum>(ii)</enum><header>Eligible
professional</header><text>The term <quote>eligible professional</quote> means
a physician, as defined in section 1861(r)(1).</text>
</clause><clause id="H82FC1543EBDA4823A07D648D255C0079"><enum>(iii)</enum><header>Reporting
period</header><text>The term <term>reporting period</term> means, with respect
to a year, a period specified by the
Secretary.</text>
</clause></subparagraph></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HBA90A41DEFE1437E90DBE383851F8BAC"><enum>(c)</enum><header>Conforming
amendments to e-prescribing</header>
<paragraph id="H49A3A98087594111A763136E00561EF2"><enum>(1)</enum><text>Section
1848(a)(5)(A)(ii)(III) of the Social Security Act (42 U.S.C.
1395w–4(a)(5)(A)(ii)(III)) is amended by striking <quote>and each subsequent
year</quote> and inserting <quote>and 2015</quote>.</text>
</paragraph><paragraph id="HCC3F5F2A26FC44018E4C04E990DA13D"><enum>(2)</enum><text>Section 1848(m)(2)
of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-4">42 U.S.C. 1395w–4(m)(2)</external-xref>) is amended—</text>
<subparagraph id="H01FD685A4DAC4D7CB1B9AA858C9B7F6C"><enum>(A)</enum><text>in subparagraph
(A), by striking <quote>For 2009</quote> and inserting <quote>Subject to
subparagraph (D), for 2009</quote>; and</text>
</subparagraph><subparagraph id="HDF6B155282004011B4997F7F26E9F19"><enum>(B)</enum><text>by adding at the
end the following new subparagraph:</text>
<quoted-block display-inline="no-display-inline" id="H7AD0DCAC5A9B4621A9C9A0A594556DE8" style="OLC">
<subparagraph id="H8262B6E0422B47E48FD6FC238E474E34"><enum>(D)</enum><header>Limitation with
respect to health information technology incentive payments</header><text display-inline="yes-display-inline">The provisions of this paragraph shall not
apply to an eligible professional (or, in the case of a group practice under
paragraph (3)(C), to the group practice) if, for the reporting period the
eligible professional (or group practice) receives an incentive payment under
subsection (o)(1)(A) with respect to a certified health information system (as
defined in subsection (o)(4)(A)) that has the capability of electronic
prescribing.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph></subsection><subsection id="H5F15E0D8EA074752AD855D3CBBCB4BB"><enum>(d)</enum><header>GAO study and
report</header>
<paragraph id="H14EF82AB23804C05819601D1D11C2BC5"><enum>(1)</enum><header>Study</header><text display-inline="yes-display-inline">The Comptroller General of the United
States shall conduct a study to determine the extent to which and manner in
which payment incentives (such as under title XVIII or XIX of the Social
Security Act) and other funding for purposes of implementing and using health
information technology should be made available to health care providers who
are receiving minimal or no payment incentives or other funding under this Act,
under title XVIII or XIX of the Social Security Act, or otherwise, for such
purposes. Such study shall include an examination of—</text>
<subparagraph id="H878F96BF0F554048BA289DDEA64BA2F8"><enum>(A)</enum><text>the adoption rates
of certified health information technology systems by such health care
providers;</text>
</subparagraph><subparagraph id="H2F74E63DE6D64246A6E500E11F007682"><enum>(B)</enum><text>the clinical
utility of such systems by such health care providers;</text>
</subparagraph><subparagraph id="H12545E178BE0481CAF1716729978647B"><enum>(C)</enum><text>whether the
services furnished by such health care providers are appropriate for or would
benefit from the use of such systems;</text>
</subparagraph><subparagraph id="H975473A5A229405EA995884BF8D4A902"><enum>(D)</enum><text>the extent to
which such health care providers work in settings that might otherwise receive
an incentive payment or other funding under this Act, title XVIII or XIX of the
Social Security Act, or otherwise;</text>
</subparagraph><subparagraph id="H83DFC40A29DE44ADB90914FE67FDC161"><enum>(E)</enum><text>the potential
costs and the potential benefits of making payment incentives and other funding
available to such health care providers; and</text>
</subparagraph><subparagraph id="H2C514BE1FE754A43B6A6627830745112"><enum>(F)</enum><text>any other issues
the Comptroller General deems to be appropriate.</text>
</subparagraph></paragraph><paragraph id="HFC5A4FC7F7BA45D6A316962716E101D"><enum>(2)</enum><header>Report</header><text display-inline="yes-display-inline">Not later than June 30, 2010, the
Comptroller General shall submit to Congress a report on the findings and
conclusions of the study conducted under paragraph (1).</text>
</paragraph></subsection></section><section display-inline="no-display-inline" id="HD74AB4CA05A949A89D38564E606F9195" section-type="subsequent-section"><enum>302.</enum><header>Incentives for
hospitals</header>
<subsection id="HBCC0FA9BCA534B49B104BF9F53E597E0"><enum>(a)</enum><header>Incentive
payment</header><text display-inline="yes-display-inline">Section 1886 of the
Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395ww">42 U.S.C. 1395ww</external-xref>) is amended by adding at the end the
following new subsection:</text>
<quoted-block display-inline="no-display-inline" id="H821E2A9EEE1A44EB9E3B334400F7EAAD" style="OLC">
<subsection display-inline="no-display-inline" id="H088E7AC729234B6F9B31E9A7F70320D4"><enum>(o)</enum><header>Incentives for
adoption and meaningful use of certified health information technology
systems</header>
<paragraph id="H6EC5C7CD78B64EE19B5CD5AAAB5DF5DC"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to the
succeeding provisions of this subsection, with respect to inpatient hospital
services furnished by an eligible hospital during the first fiscal year
beginning after the date specified in paragraph (6) (or, if sooner, fiscal year
2013) or any subsequent fiscal year (before fiscal year 2017), if the eligible
hospital is a meaningful HIT user for the fiscal year (as determined under
paragraph (3)), in addition to the amount otherwise paid under this section,
there also shall be paid to the eligible hospital, from the Federal Hospital
Insurance Trust Fund established under section 1817, an amount equal to the
applicable amount specified in paragraph (2)(A) for such fiscal year.</text>
</paragraph><paragraph display-inline="no-display-inline" id="H8A3ABFCA128542618700463119522EE6"><enum>(2)</enum><header>Payment
amount</header>
<subparagraph id="H5D5E94FEDDB94509B1FD25F9A1A6F76D"><enum>(A)</enum><header>In
general</header><text>Subject to subparagraph (F), the applicable amount
specified in this subparagraph for an eligible hospital for a fiscal year is
equal to the product of the following:</text>
<clause id="H3566FD1F098843F88D0603E7BB10F4AD"><enum>(i)</enum><header>Initial
amount</header><text>The sum of—</text>
<subclause id="H152DE43BD02043FAAD57D4962F006FE6"><enum>(I)</enum><text>the base amount
specified in subparagraph (B); plus</text>
</subclause><subclause id="H361D120BFD09445C809C002269F4BBC5"><enum>(II)</enum><text display-inline="yes-display-inline">the discharge related amount specified in
subparagraph (C) for a period selected by the Secretary with respect to such
fiscal year.</text>
</subclause></clause><clause id="HDBE2F26DD0334405B2F0AED8CB8924FF"><enum>(ii)</enum><header>Medicare
share</header><text display-inline="yes-display-inline">The Medicare share as
specified in subparagraph (D) for the hospital for a period selected by the
Secretary with respect to such fiscal year.</text>
</clause><clause id="HB31B106D9DA24C969D5C723D263D3DC9"><enum>(iii)</enum><header>Transition
factor</header><text>The transition factor specified in subparagraph (E) for
the fiscal year.</text>
</clause></subparagraph><subparagraph id="H1AB4CEC2C1EC46FABBB3A17D437B44"><enum>(B)</enum><header>Base
amount</header><text>The base amount specified in this subparagraph is
$1,000,000.</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H617AAD31ADD648DAB7EEDE6E8F9E2C24"><enum>(C)</enum><header>Discharge
related amount</header><text>The discharge related amount specified in this
subparagraph for a period shall be determined as the sum of the amount, based
upon total discharges (regardless of any source of payment) for the period, for
each discharge up to the 13,800th discharge as follows:</text>
<clause id="H1AE2B78FD4C74D938B687B73A0238EE9"><enum>(i)</enum><text>For the 1150th
through the 9,200nd discharge, $200.</text>
</clause><clause id="H0ACA95383CF7430299009301D33876C1"><enum>(ii)</enum><text display-inline="yes-display-inline">For the 9,201st through the 13,800th
discharge, 50 percent of the amount specified in clause (i).</text>
</clause></subparagraph><subparagraph id="H86C5188807294F7C8801A429D972C718"><enum>(D)</enum><header>Medicare
share</header><text>The Medicare share specified under this subparagraph for a
hospital for a period is equal to the fraction—</text>
<clause id="HBB3FBBFEFC2A4B78930088CF984C2D19"><enum>(i)</enum><text>the numerator of
which is the sum (for the period and with respect to the hospital) of—</text>
<subclause id="H76F766CDD4A84DC7B6EB50055C7309C1"><enum>(I)</enum><text display-inline="yes-display-inline">the number of inpatient-bed-days (as
established by the Secretary) which are attributable to individuals with
respect to whom payment may be made under part A; and</text>
</subclause><subclause id="H977F0227C3524FEF8DAC149D9000FD01"><enum>(II)</enum><text display-inline="yes-display-inline">the number of inpatient-bed-days (as so
established) which are attributable to individuals who are enrolled under a
risk-sharing contract with an eligible organization under section 1876 and who
are entitled to part A or with a Medicare Advantage organization under part C;
and</text>
</subclause></clause><clause id="HFF9DA0557B6E464F80C6DCA23DE1B0DE"><enum>(ii)</enum><text>the denominator
of which is the product of—</text>
<subclause id="H344A0B6F6CE8419D8C0100ECA717711"><enum>(I)</enum><text>the total number of
inpatient-bed-days with respect to the hospital during the period; and</text>
</subclause><subclause id="HC4ED39F68EEC448788746EFA811F106C"><enum>(II)</enum><text>the total amount
of the hospital’s charges during the period, not including any charges that are
attributable to charity care (as such term is used for purposes of hospital
cost reporting under this title), divided by the total amount of the hospital’s
charges during the period.</text>
</subclause></clause></subparagraph><subparagraph id="H3AAA9C09F07B48858DEC9098C0886221"><enum>(E)</enum><header>Transition
factor specified</header><text>The transition factor specified in this
subparagraph is as follows:</text>
<clause id="H978E167C87C64222B7114DD8DCAAF929"><enum>(i)</enum><text>For the first
fiscal year beginning after the date specified in paragraph (6) (or, of sooner,
fiscal year 2013), 1.</text>
</clause><clause id="HD5BA7AECCED845C298008EFEE0A9006F"><enum>(ii)</enum><text display-inline="yes-display-inline">For the fiscal year following the fiscal
year specified in clause (i), <fraction>3/4</fraction>.</text>
</clause><clause id="HAD4E1D3946C34AB39587AE140069667B"><enum>(iii)</enum><text display-inline="yes-display-inline">For the fiscal year following the fiscal
year specified in clause (ii), <fraction>½</fraction>.</text>
</clause><clause id="H5D1B3E785AB3418B9FCA77DED08C00"><enum>(iv)</enum><text>For
the fiscal year following the fiscal year specified in clause (iii),
<fraction>1/4</fraction>.</text>
</clause></subparagraph><subparagraph id="H420C556447DC4742AB8DBFC0D1DD571F"><enum>(F)</enum><header>Limitations</header>
<clause id="H480E974257154B8DBAD684E1FBA02BD9"><enum>(i)</enum><header>Pro-ration for
partial year hospitals</header><text>In the case of an eligible hospital that
is a meaningful HIT user for only a portion of a fiscal year for reasons such
as the hospital did not provide services for which payment is made under this
section for a portion of the fiscal year or the hospital changed the use of
health information technology during the fiscal year, the Secretary may
pro-rate the applicable amount specified under subparagraph (A) to reflect the
portion of the fiscal year during which the hospital was a meaningful HIT
user.</text>
</clause><clause id="H72A50E47953E451E8E542D7715572114"><enum>(ii)</enum><header>Form of
payment</header><text>The payment under this subsection for a fiscal year may
be in the form of a single consolidated payment or in the form of such periodic
installments as the Secretary may specify.</text>
</clause><continuation-text continuation-text-level="subparagraph">There
shall be no incentive payment under this subsection, or payment adjustment
under subsection (b)(3)(B)(ix), for a fiscal year in the case of an eligible
hospital for which the sum of the inpatient-bed days described in subclauses
(I) and (II) of subparagraph (D)(i), for a period specified by the Secretary
with respect to such fiscal year, is an amount that is less than 1,000.</continuation-text></subparagraph></paragraph><paragraph display-inline="no-display-inline" id="HA7035BD17E0344CCBFA427E1FBD9ED21"><enum>(3)</enum><header>Meaningful HIT
user</header>
<subparagraph id="H20044645F56B48859C957D5297E0958E"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">For purposes of
paragraph (1), an eligible hospital shall be treated as a meaningful HIT user
for a fiscal year if the eligible hospital demonstrates to the satisfaction of
the Secretary that the hospital is meaningfully using a certified health
information technology system with respect to such fiscal year, as demonstrated
in accordance with applicable measures established under subparagraph
(B).</text>
</subparagraph><subparagraph id="H770883B223654BD0B98B36F848BDD300"><enum>(B)</enum><header>Standards for
meaningful use</header><text>The Secretary shall establish measures under which
an eligible hospital may demonstrate meaningful use of a certified health
information technology system for a fiscal year. Such measures may
include—</text>
<clause id="HE8DD09D2E5E54326AD78F158957CF8C6"><enum>(i)</enum><text>self-certification
of operational use of such a system;</text>
</clause><clause id="H93337E5BC7714A05AF34F4414371C18C"><enum>(ii)</enum><text>the submission
(or ability to submit), in a form and manner specified by the Secretary (which
may include the manner used for purposes of subsection (b)(3)(B)(viii)), of
such information on clinical measures and data (that does not include
individually identifiable health information) from such system that indicates a
meaningful utilization of such a system during the year; and</text>
</clause><clause id="H17ACB19F1158426E8824F5D5817FA3C8"><enum>(iii)</enum><text>such other means
as the Secretary may specify.</text>
</clause><continuation-text continuation-text-level="subparagraph">The
Secretary may establish and apply different measures based on the stage of
implementation or adoption of the certified health information technology
system involved or based on the characteristics (such as size) of the
hospital.</continuation-text></subparagraph><subparagraph id="H0B622B8DCDD74AAABA0062034CBF49A6"><enum>(C)</enum><header>Authority to
revise measures</header><text>The Secretary may periodically revise the
measures established under subparagraph (B) with respect to demonstrating
meaningful use of a certified health information technology system.</text>
</subparagraph></paragraph><paragraph display-inline="no-display-inline" id="H60D089AE17794D5392B49BD0E33EF668"><enum>(4)</enum><header>Application</header>
<subparagraph id="H510956D93A92469600B7E26E973365D"><enum>(A)</enum><header>Limitations on
review</header><text display-inline="yes-display-inline">There shall be no
administrative or judicial review under 1869, section 1878, or otherwise
of—</text>
<clause id="H5364359445814C46AF67C6D8A616FD49"><enum>(i)</enum><text>the determination
of measures applicable to services furnished by eligible hospitals under this
subsection;</text>
</clause><clause id="HBD5571D47BF64AE8923889E3FA49E1D"><enum>(ii)</enum><text>the determination
of a meaningful HIT user under paragraph (3)(A) and the exception under
subsection (b)(3)(B)(ix)(III); and</text>
</clause><clause id="H9D02D88203A74501BF6ECD11EE6290C8"><enum>(iii)</enum><text>the
determination of any incentive payment under this subsection and the payment
adjustment under subsection (b)(3)(B)(ix).</text>
</clause></subparagraph><subparagraph commented="no" id="H23148D3555D34DD38EE88E599566E48F"><enum>(B)</enum><header>Posting on
website</header><text>The Secretary shall post on the Internet website of the
Centers for Medicare & Medicaid Services, in an easily understandable
format, a list of the names of the eligible hospitals that are meaningful HIT
users and other relevant data as determined appropriate by the Secretary. The
Secretary shall ensure that a hospital has the opportunity to review the other
relevant data that are to be made public with respect to the hospital prior to
such data being made public.</text>
</subparagraph></paragraph><paragraph commented="no" id="H839DEA74B59348058C253821A9005BCD"><enum>(5)</enum><header>Application to
certain MA hospitals</header><text display-inline="yes-display-inline">Notwithstanding section 1851(i)(1), an
eligible hospital that is under common corporate governance with a qualifying
MA organization (as defined in section 1853(l)(5)) and that serves individuals
enrolled under a plan offered by such organization shall be eligible for an
incentive payment under this subsection in the same manner as an eligible
hospital that is not under such common corporate governance with a qualifying
MA organization.</text>
</paragraph><paragraph id="H37C973D038C744D7A3CC6CD2BBB296B9"><enum>(6)</enum><header>Date
specified</header><text>The date specified in this paragraph is the date on
which the open source health information technology system under section
3001(c)(4) of the Public Health Service Act is first made publicly
available.</text>
</paragraph><paragraph display-inline="no-display-inline" id="H3B99416480224D849B177F8EB55BF8E2"><enum>(7)</enum><header>Definitions</header><text>For
purposes of this subsection and subsection (b)(3)(B)(ix):</text>
<subparagraph display-inline="no-display-inline" id="H4D815AAD94DA45E6AB6E67BC061EADE"><enum>(A)</enum><header>Certified health
information technology system</header><text>The term <quote>certified health
information technology system</quote> means, with respect to an eligible
hospital and a fiscal year, a health information technology system (as defined
in section 3000 of the Public Health Service Act) that has a current
certification under section 3001(c)(3) of such Act as satisfying all
interoperability standards, privacy and security standards, and clinical and
quality functions adopted under section 3003(a) of such Act as of a date
specified by the Secretary with respect to such fiscal year that are applicable
to the eligible hospital.</text>
</subparagraph><subparagraph id="HE8E343757D87462C9200EC8B6379FD00"><enum>(B)</enum><header>Eligible
hospital</header><text display-inline="yes-display-inline">The term
<quote>eligible hospital</quote> means a subsection (d)
hospital.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HA37D0892FBD14541AC748487021F7FD1"><enum>(b)</enum><header>Incentive market
basket adjustment</header><text display-inline="yes-display-inline">Section
1886(b)(3)(B) of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395ww">42 U.S.C. 1395ww(b)(3)(B)</external-xref>) is
amended—</text>
<paragraph id="H14112A44C3F44922B34015156CCCE9F4"><enum>(1)</enum><text>in clause
(viii)(I), by inserting <quote>(or, beginning with fiscal year 2016, by
one-half)</quote> after <quote>2.0 percentage points</quote>; and</text>
</paragraph><paragraph id="H7F11B249B099492787E6676B7D00D521"><enum>(2)</enum><text>by adding at the
end the following new clause:</text>
<quoted-block display-inline="no-display-inline" id="H22C719EAC57C4E0CA3994FA142CEBD4D" style="OLC">
<clause id="H197273A0AF2542CAB5E300F807C28493" indent="up3"><enum>(ix)</enum><subclause commented="no" display-inline="yes-display-inline" id="H1B70979A05E940E0A5CE4263E6009FC1"><enum>(I)</enum><text>Subject to the third
sentence of subsection (o)(2)(F), for purposes of clause (i) for fiscal year
2016 and each subsequent fiscal year, in the case of a subsection (d) hospital
that is not a meaningful HIT user (as defined in subsection (o)(3)) with
respect to such fiscal year, one-half of the applicable percentage increase
otherwise applicable under clause (i) for such fiscal year shall be reduced by
25 percent for fiscal year 2016, 50 percent for fiscal year 2017, 75 percent
for fiscal year 2018, and 100 percent for fiscal year 2019 and each subsequent
fiscal year. Such reduction shall apply only with respect to the fiscal year
involved and the Secretary shall not take into account such reduction in
computing the applicable percentage increase under clause (i) for a subsequent
fiscal year.</text>
</subclause><subclause commented="no" id="H5D9CEB86CBA44A57AD17BB35524900DC" indent="up1"><enum>(II)</enum><text display-inline="yes-display-inline">The Secretary may, on a case-by-case basis,
exempt a subsection (d) hospital from the application of subclause (I) with
respect to a fiscal year if the Secretary determines, subject to annual
renewal, that requiring such hospital to be a meaningful HIT user during such
fiscal year would result in a significant hardship, such as in the case of a
hospital in a rural area without sufficient Internet access. In no case may a
hospital be granted an exemption under this subclause for more than 5
years.</text>
</subclause></clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection commented="no" id="HB0632C3A25DC4FA19DBFF1D2AE535809"><enum>(c)</enum><header>Conforming
amendment</header><text>Section 1851(i)(1) of such Act (42 U.S.C.
1395w–21(i)(1)) is amended by striking <quote>and 1886(h)(3)(D)</quote> and
inserting <quote>1886(h)(3)(D), and 1886(o)(6)</quote>.</text>
</subsection><subsection id="HB4F89CB11FDA4A1FBBC995EA2712895F"><enum>(d)</enum><header>GAO study and
report</header>
<paragraph id="HFB68D310B92345EE00D6144882F1BF00"><enum>(1)</enum><header>Study</header><text display-inline="yes-display-inline">The Comptroller General of the United
States shall conduct a study to determine the extent to which and manner in
which payment incentives (such as under title XVIII or XIX of the Social
Security Act) and other funding for purposes of implementing and using health
information technology should be made available to health care settings that
are receiving minimal or no payments or other funding under this Act, title
XVIII or XIX of the Social Security Act, or otherwise, for such purposes. Such
health care settings may include skilled nursing facilities, home health
agencies, hospice programs, laboratories, federally qualified health centers,
and pediatric hospitals. Such study shall include an examination of—</text>
<subparagraph id="HF5FC9CD1A335478FA4ABD598E0AF3F1C"><enum>(A)</enum><text>the adoption rates
of certified health information technology systems at such settings;</text>
</subparagraph><subparagraph id="HFE06140DC23842A1B3C5453D70AFFD40"><enum>(B)</enum><text>the clinical
utility of such systems at such settings;</text>
</subparagraph><subparagraph id="H0E80C285980E4E0AAD1383F7A259DCAB"><enum>(C)</enum><text>whether the
services furnished at such settings are appropriate for or would benefit from
the use of such systems;</text>
</subparagraph><subparagraph id="H34DEA40A3C674740A1AC43106EB99151"><enum>(D)</enum><text>the potential
costs and the potential benefits of providing such settings with incentive
payments and other funding for such purposes; and</text>
</subparagraph><subparagraph id="H5032533F422C45448319D5F1F1C1BBD8"><enum>(E)</enum><text>any other issues
the Comptroller General deems to be appropriate.</text>
</subparagraph></paragraph><paragraph id="HC333E439454E4C6FBF2377008C00AF7E"><enum>(2)</enum><header>Report</header><text display-inline="yes-display-inline">Not later than June 30, 2010, the
Comptroller General shall submit to Congress a report on the findings and
conclusions of the study conducted under paragraph (1).</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="H08C0D17CAB404E748208B1965F77C38F" section-type="subsequent-section"><enum>303.</enum><header>Incentives for
certain Medicare Advantage plans</header>
<subsection commented="no" id="H4A9F578983AE4C2C8CF648F3FB1F4DEB"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 1853 of the
Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-23">42 U.S.C. 1395w–23</external-xref>) is amended—</text>
<paragraph commented="no" id="H1D6F4CAC27FF4D12933DF5BD804CC56C"><enum>(1)</enum><text>in subsection
(a)(1)(A), by striking <quote>and (i)</quote> and inserting <quote>(i), and
(l)</quote>; and</text>
</paragraph><paragraph commented="no" id="H28AB6A241D5D4E4496534C46ED1325BC"><enum>(2)</enum><text>by adding at the
end the following new subsections:</text>
<quoted-block display-inline="no-display-inline" id="HAF9891DF0B8244619257C6EFC231F456" style="OLC">
<subsection commented="no" id="HFA91D74925BA415EAC9892C4454B431B"><enum>(l)</enum><header>Application of
eligible professional incentives for certain MA organizations To implement
certified health information technology systems</header>
<paragraph commented="no" id="H1CEE5E9B914F48E1B4201D71A8992236"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to paragraphs
(3) and (4), in the case of a qualifying MA organization, the provisions of
sections 1848(o) and 1848(a)(7) shall apply with respect to eligible
professionals described in paragraph (2) of the organization who the
organization attests under section 1854(a)(1)(A)(iv) to be meaningful HIT users
under in a similar manner as they apply to eligible professionals in a group
practice under such sections.</text>
</paragraph><paragraph id="H2FD5848E7AFA4F33B118102FE3C05827"><enum>(2)</enum><header>Eligible
professionals described</header><text display-inline="yes-display-inline">With
respect to a qualifying MA organization, eligible professionals described in
this paragraph are eligible professionals (as defined for purposes of section
1848(o)) who—</text>
<subparagraph id="HBC97F4C28801489391A3970876C1F788"><enum>(A)</enum><text>are employed by
the organization or are employed by or partners of an entity that, through
contract with the organization, provides its services predominantly or
exclusively to enrollees of such organization; and</text>
</subparagraph><subparagraph id="HEFA868F6F1084DE38801A26D6E28224B"><enum>(B)</enum><text>furnish, on
average, at least 20 hours per week of professional services.</text>
</subparagraph></paragraph><paragraph id="H3AB2F33223F44D039241355941E0F1A1"><enum>(3)</enum><header>Incentive
payments</header><text>In applying section 1848(o) under paragraph (1), instead
of the additional payment amount under subparagraph (A) of section 1848(o)(1),
there shall be substituted the maximum amount permitted under such section
multiplied by the medicare share (as determined by the Secretary). Such
medicare share for an organization shall be determined in a manner so as to
result in the same aggregate payments to the organization as would be paid
under section 1848(o) to the eligible professionals described in paragraph
(2)(A) for services furnished under part B of this title.</text>
</paragraph><paragraph id="H8D104032DE5247B69021A8352713356C"><enum>(4)</enum><header>Payment
adjustment</header>
<subparagraph id="H6D0FC3BFE04E488184F50090823795A9"><enum>(A)</enum><header>In
general</header><text>In applying section 1848(a)(7) under paragraph (1),
instead of the payment adjustment being an applicable percent of the fee
schedule amount for a year under such section, the payment adjustment under
paragraph (1) shall be equal to the percent specified in subparagraph (B) for
such year of the payment amount otherwise provided under this section for the
year.</text>
</subparagraph><subparagraph id="H9F53C69E6C5B49969D20E60124D09D6"><enum>(B)</enum><header>Specified
percent</header><text>The percent specified under this subparagraph for—</text>
<clause id="HFBA2BCA819DF467F8BD28C89006EF94B"><enum>(i)</enum><text>2016 is 99.6
percent;</text>
</clause><clause id="HA4222F09662B48D2B715A80091EEED00"><enum>(ii)</enum><text>2017 is 99.2
percent;</text>
</clause><clause id="HE04D8090B52C4B9690415330C860B2C4"><enum>(iii)</enum><text>2018 is 98.8
percent; and</text>
</clause><clause id="H84CFA3EC26754CAE819C15F3CA934226"><enum>(iv)</enum><text>2019 and each
subsequent year is 98.4 percent.</text>
</clause></subparagraph></paragraph><paragraph commented="no" id="H4F5327D75FC44A19A59EBBA3879E0027"><enum>(5)</enum><header>Qualifying MA
organization defined</header><text>In this subsection and subsection (m), the
term <quote>qualifying MA organization</quote> means an organization that is
organized as a health maintenance organization (as defined in section
2791(b)(3) of the Public Health Service Act) that offers one or more MA plans
under which the physicians furnishing physicians’ services under such a plan
are predominantly either employees of the organization or are employees or
partners of an entity that, through contract with the organization, provides
its services predominantly or exclusively to enrollees of such
organization.</text>
</paragraph></subsection><subsection id="H7493A8154C9A4C549D1388DBEAF54E68"><enum>(m)</enum><header>Eligible
hospital incentives for certain MA organizations To implement certified health
information technology systems</header>
<paragraph commented="no" id="HD9F0F7AF6441455C00659FB0181C22B7"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to paragraph
(3), in the case of a qualifying MA organization (as defined in section
1853(l)(5)), if, according to the attestation of the organization submitted
under section 1854(a)(1)(A)(iv) for a year, one or more eligible hospitals (as
defined in section 1886(o)(7)(B)) that are under common corporate governance
with such organization and that serve individuals enrolled under a plan offered
by such organization are not meaningful HIT users (as defined in section
1886(o)(3) with respect to a year, the payment amount payable under this
section for such organization for such year shall be—</text>
<subparagraph id="HF76E50C970784FC28EE43134ADCB78ED"><enum>(A)</enum><text>reduced by a
percent specified by the Secretary for such year; or</text>
</subparagraph><subparagraph id="HD1FB19AA419148AE9935D2B6E1F9C9BE"><enum>(B)</enum><text>in the case the
Secretary is not able to specify reductions under subparagraph (A) because of
insufficient encounter data or other appropriate date, the amount that is equal
to the percent specified under paragraph (2) of the payment amount otherwise
provided under this section to the organization for the year.</text>
</subparagraph><continuation-text continuation-text-level="paragraph">Reductions
specified by the Secretary under subparagraph (A) shall be determined in a
manner so as to result in the same aggregate reductions to the organization as
would be applied under section 1886(b)(3)(B)(ix) to all such eligible hospitals
under common corporate governance with such organization if payment for
inpatient services furnished by such hospitals was payable under part A instead
of this part.</continuation-text></paragraph><paragraph id="H08FC570CF9B248A7AB00591B47DFF29C"><enum>(2)</enum><header>Alternative
percent specified</header><text>The percent specified under this paragraph
for—</text>
<subparagraph id="H80B48FCD329D415DBE216F1B499E5895"><enum>(A)</enum><text>2016 is 99.95
percent;</text>
</subparagraph><subparagraph id="H0DE52C9615EE4E118BF00EE881FDC43"><enum>(B)</enum><text>2017 is 99.90
percent;</text>
</subparagraph><subparagraph id="HF60A5133BFFF4129A5C8B1A641A8A67F"><enum>(C)</enum><text>2018 is 99.85
percent; and</text>
</subparagraph><subparagraph id="HB4EE0D043A0540B58D54B058CEF6CF46"><enum>(D)</enum><text>2019 and each
subsequent year is 99.80 percent.</text>
</subparagraph></paragraph><paragraph id="H35956F4EA59947E1A22D564E380200DD"><enum>(3)</enum><header>Limitation</header><text>In
no case may the application of subsection (l) and this subsection with respect
to a year result in a payment amount payable under this section for a
qualifying MA organization for the year that is less than the amount that is
equal to the percent specified under paragraph (4) of the payment amount that
would otherwise be provided under this section to the organization for the year
without regard to subsection (l) and this subsection.</text>
</paragraph><paragraph id="HFD8A681F243E4BB59B479D249700F552"><enum>(4)</enum><header>Specified
percent</header><text>The percent specified under this paragraph for—</text>
<subparagraph id="HBC01EE54792C44E898E9801598D95B5"><enum>(A)</enum><text>2016 is 99
percent;</text>
</subparagraph><subparagraph id="H6B66202412524545B06BFEA9CC47AF92"><enum>(B)</enum><text>2017 is 98
percent;</text>
</subparagraph><subparagraph id="HA8DCBAC864FA48E08D42F179CA008466"><enum>(C)</enum><text>2018 is 97
percent; and</text>
</subparagraph><subparagraph id="H71D16CDC781B4C5080E2F7E19000092"><enum>(D)</enum><text>2019 and each
subsequent year is 96
percent.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="HE29C1D590244465C9CC9EDB174D81C6D"><enum>(b)</enum><header>Meaningful HIT
user attestation with bids</header><text>Section 1854(a)(1)(A) of the Social
Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-24">42 U.S.C. 1395w–24(a)(1)(A)</external-xref>) is amended by adding at the end the
following new clause:</text>
<quoted-block display-inline="no-display-inline" id="H433B14564C70447886ADB59F15F3D6F1" style="OLC">
<clause id="H8B95AFDA4B6B4ED4ACAFCCA9C676E85"><enum>(iv)</enum><text display-inline="yes-display-inline">An attestation identifying whether each
eligible professional described in section 1853(l)(2) with respect to such
organization is a meaningful HIT user (as defined in section 1848(o)(3)) for
the year and whether each eligible hospital described in section 1853(m)(1),
with respect to such organization, is a meaningful HIT user (as defined in
section 1886(o)(3)) for the
year.</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection commented="no" id="HAA4627D3AFC44925B0E656814DD2447D"><enum>(c)</enum><header>HIT incentive
payments exempt from benchmark determinations</header><text display-inline="yes-display-inline">Section 1853(c) of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-23">42 U.S.C. 1395w–23(c)</external-xref>) is amended—</text>
<paragraph id="H2F24EF0C3C6B463780B7BD8DD969FBA4"><enum>(1)</enum><text>in paragraph
(1)(D)(i), by striking <quote>section 1886(h)</quote> and inserting
<quote>sections 1848(o), 1886(h), and 1886(o)</quote>; and</text>
</paragraph><paragraph id="H769A9521D377435CA7EBE86EC5F45A4"><enum>(2)</enum><text>in
paragraph (6)(A), by inserting after <quote>under part B,</quote> the
following: <quote>excluding expenditures attributable to sections 1848(o) and
1886(o)</quote>.</text>
</paragraph></subsection><subsection id="H1A00D990B966458AA882BD835362EE4"><enum>(d)</enum><header>Conforming
amendment</header><text display-inline="yes-display-inline">Section 1853(f) of
such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-23">42 U.S.C. 1395w–23(f)</external-xref>) is amended by inserting <quote>and for
payments under subsection (l)</quote> after <quote>with the
organization</quote>.</text>
</subsection></section></subtitle><subtitle id="HCFE52A996B4542C19168C5763DBD9876"><enum>B</enum><header>Other incentives
for the Implementation and Use of Health Information Technology</header>
<section id="H47E500ABB3FF4E959C99444821C113A5"><enum>311.</enum><header>Grant, loan,
and demonstration programs</header><text display-inline="no-display-inline">Title XXX of the Public Health Service Act,
as added by section 101, is amended by adding at the end the following new
subtitle:</text>
<quoted-block display-inline="no-display-inline" id="H878DBBFAAEF74D6F0078188178195012" style="OLC">
<subtitle id="HEA71155C46C64E0A96E4F7A886F8775E"><enum>B</enum><header>Incentives for the
Use of Health Information Technology</header>
<section id="H56DE4CE59D9C448AA85F32972EC7D013"><enum>3011.</enum><header>Grants and
loans to facilitate the widespread adoption of qualified health information
technology</header>
<subsection id="H47F986753E314310BE9FEF9985C27FAB"><enum>(a)</enum><header>Competitive
grants To facilitate the widespread adoption of health information
technology</header>
<paragraph id="HDA62AFADE8FC44C9AD1E6796A7DA177D"><enum>(1)</enum><header>In
general</header><text>The National Coordinator may award competitive grants to
eligible entities to purchase qualified health information technology.</text>
</paragraph><paragraph display-inline="no-display-inline" id="H70D8708073234B7287B7FB03D6BDE959"><enum>(2)</enum><header>Qualified health
information technology</header><text display-inline="yes-display-inline">For
purposes of this section, the term <term>qualified health information
technology</term> means health information technology that consists of
hardware, software, or the provision of support services and that—</text>
<subparagraph id="HA8CB21D052E8428AA48B332E30EF57B"><enum>(A)</enum><text display-inline="yes-display-inline">enables the protection of health
information, in accordance with applicable law;</text>
</subparagraph><subparagraph id="H0CDF7B8DFDD34361B244FDCD572900FB"><enum>(B)</enum><text display-inline="yes-display-inline">is (or is necessary for the operation of)
an electronic health records system, including the provision of decision
support and physician order entry for medications;</text>
</subparagraph><subparagraph id="H9E9CEDD0E89544F293457C5D0147E680"><enum>(C)</enum><text>has the ability to
allow timely and permissible access to patient information and to transmit and
exchange health information among providers, patients, or insurers; and</text>
</subparagraph><subparagraph id="H8A22628EDEBD4955B98FC1D41900DD5"><enum>(D)</enum><text>is certified under
the program developed under section 3001(c)(3) to be in compliance with any
applicable standards adopted under section 3003(a).</text>
</subparagraph></paragraph><paragraph id="HF229F4C30E694087B7F5B483FB2F2D02"><enum>(3)</enum><header>Eligibility</header><text display-inline="yes-display-inline">To be eligible to receive a grant under
paragraph (1) an entity shall—</text>
<subparagraph id="HDA59EDF379814E089422AE984BED146D"><enum>(A)</enum><text display-inline="yes-display-inline">submit to the National Coordinator an
application at such time and in such manner as the National Coordinator may
require, and containing—</text>
<clause id="HB5A925244F7E4FB99B708B5EC6BFFFC"><enum>(i)</enum><text>a
plan on how the entity intends to maintain and support the qualified health
information technology that would be purchased with amounts under such grant,
including the type of resources expected to be involved; and</text>
</clause><clause id="H47FE6A7082DB49CBB4487285DFC1F245"><enum>(ii)</enum><text>such other
information as the National Coordinator may require;</text>
</clause></subparagraph><subparagraph id="H165469CBC8DB4916B50055C69E00E2F3"><enum>(B)</enum><text>submit to the
National Coordinator a plan for how qualified health information technology
purchased by the entity will result in the electronic exchange and use of
health information;</text>
</subparagraph><subparagraph id="H3B3354638EB4498381EF5999BD000100"><enum>(C)</enum><text>be—</text>
<clause id="H033D42D8D0D742C598BF2E3EC1F160AD"><enum>(i)</enum><text>a
not for profit hospital or a Federally qualified health center (as defined in
section 1861(aa)(4) of the <act-name parsable-cite="SSA">Social Security
Act</act-name>);</text>
</clause><clause id="H1C2525BEB5AC4381AB5E31FD91412982"><enum>(ii)</enum><text>an individual or
group practice; or</text>
</clause><clause id="HF96E8D46A65445D0903DED488C193E50"><enum>(iii)</enum><text>another health
care provider, such as a rural health clinic, not described in clause (i) or
(ii);</text>
</clause></subparagraph><subparagraph id="HDAF9636A0DF74E7EB98D9EC4C0D13559"><enum>(D)</enum><text>demonstrate
significant financial need;</text>
</subparagraph><subparagraph id="H1BF9301BB1434772BB85E28100B680B3"><enum>(E)</enum><text display-inline="yes-display-inline">agree to notify individuals in accordance
with section 402 of the Health-e Information Technology Act of 2008 (relating
to notifications in the case of breaches);</text>
</subparagraph><subparagraph id="HA6FEBB5E98C74C4AA979E4AF3B2DEED6"><enum>(F)</enum><text>provide matching
funds in accordance with paragraph (5);</text>
</subparagraph><subparagraph id="H743100A98D5C408C00C78EF324421006"><enum>(G)</enum><text display-inline="yes-display-inline">consult with the Health Information
Technology Resource Center established under section 3006 to access the
knowledge and experience of existing initiatives regarding the successful
implementation and effective use of health information technology; and</text>
</subparagraph><subparagraph id="H6FFA74395E2249BF8756F7BAEFA5AF54"><enum>(H)</enum><text display-inline="yes-display-inline">link, to the extent practicable, to one or
more local or regional health information plans.</text>
</subparagraph></paragraph><paragraph id="H3457081A372443DA87CCFADAE902FDC7"><enum>(4)</enum><header>Use of
funds</header><text>Amounts received under a grant under this subsection shall
be used to facilitate the purchase of qualified health information
technology.</text>
</paragraph><paragraph id="H002F5C2FD346421F9BB463A2D09EE7D0"><enum>(5)</enum><header>Matching
requirement</header><text>To be eligible for a grant under this subsection an
entity shall contribute non-Federal contributions to the costs of carrying out
the activities for which the grant is awarded in an amount equal to $1 for each
$3 of Federal funds provided under the grant.</text>
</paragraph><paragraph id="H8E62B6422564468EB086A65A28F74A5"><enum>(6)</enum><header>Preference in
awarding grants</header>
<subparagraph id="H2BC819EFCD334DBEAA23B72416F5FAD"><enum>(A)</enum><header>In
general</header><text>In awarding grants under this subsection the National
Coordinator shall give preference to the following eligible entities:</text>
<clause id="H74FB89DE12DE492ABEA53C8F8D756860"><enum>(i)</enum><text>Small health care
providers.</text>
</clause><clause id="H5325A354B9F94FE1A72CC86EDED1FE57"><enum>(ii)</enum><text display-inline="yes-display-inline">Entities that are located in rural and
other areas that serve uninsured, underinsured, and medically underserved
individuals (regardless of whether such area is urban or rural).</text>
</clause><clause id="H804CF51FCF1F42F6A9434E55BC88B469"><enum>(iii)</enum><text>Nonprofit health
care providers.</text>
</clause><clause id="HA09354A211984A3688D00EB444600EE"><enum>(iv)</enum><text>Health care
providers (such as children’s hospitals, pediatricians,
obstetrician-gynecologists, and hospitals that serve uninsured, underinsured,
and medically underserved individuals and that have limited Medicare patient
loads) that have not received any funds, or have received a minimal amount of
funds, under sections 1848(o) and 1886(o) of the Social Security Act.</text>
</clause></subparagraph><subparagraph id="H095829669C4043B8AB607E6367678326"><enum>(B)</enum><header>Consideration</header><text display-inline="yes-display-inline">In awarding grants to entities under this
subsection, the National Coordinator shall take into account the amount of
funds provided to such entities under other laws, including under sections
1848(o) and 1886(o) of the Social Security Act.</text>
</subparagraph></paragraph><paragraph id="H8F76C09AF2A144180062A0BEF2B06370"><enum>(7)</enum><header>Additional
sources of funding for health information technology</header><text>Funding made
available under this subsection is in addition to funding which may be used
toward the acquisition and utilization of health information technology under
other law, which includes the following:</text>
<subparagraph id="H53F7ED2A20FB4DFA951C0060C1BC1240"><enum>(A)</enum><text>Medicaid
transformation grants under section 1903(z) of the Social Security Act.</text>
</subparagraph><subparagraph id="H8DC444335C4E429788B72921D4A0F7B"><enum>(B)</enum><text>Grants or funding
available through the Agency for Healthcare Research and Quality.</text>
</subparagraph><subparagraph id="HE80AB5BC0DFC4587A2C5D3DABFE7471B"><enum>(C)</enum><text>Grants or funding
that may be available through the Health Resources and Services Administration
for investment in health information technologies or telehealth.</text>
</subparagraph><subparagraph id="HB08CDB50203C4F2F89A6F550C34EADCA"><enum>(D)</enum><text>Grants or funding
that may be available through the Department of Agriculture’s Rural Development
Telecommunications Program for investment in telemedicine.</text>
</subparagraph><subparagraph id="H48880C81DC4446AA86A1696E3B985CCA"><enum>(E)</enum><text>Sections 1848(o)
and 1886(o) of the Social Security Act.</text>
</subparagraph></paragraph></subsection><subsection id="H1C4B807D622D4C6B88C190FD504CC5B1"><enum>(b)</enum><header>Competitive
Grants to States and Indian tribes for the Development of Loan Programs To
Facilitate the Widespread Adoption of qualified Health Information
Technology</header>
<paragraph id="HF1B30D2AE53F42F8BEF8E7FD5BDC2831"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">The National
Coordinator may award competitive grants to eligible entities for the
establishment of programs for loans to health care providers to purchase
qualified health information technology.</text>
</paragraph><paragraph id="H2BD721170ACA45878899D6C32BBF30F2"><enum>(2)</enum><header>Eligible entity
defined</header><text display-inline="yes-display-inline">For purposes of this
subsection, the term <term>eligible entity</term> means a State or Indian tribe
(as defined in the Indian Self-Determination and Education Assistance Act)
that—</text>
<subparagraph id="H3F7C480E3EEE4319A2144DEA23F66BC"><enum>(A)</enum><text>submits to the
National Coordinator an application at such time, in such manner, and
containing such information as the National Coordinator may require;</text>
</subparagraph><subparagraph id="H7EAD2BA35112453FB0C9A94B539C4736"><enum>(B)</enum><text>submits to the
National Coordinator a strategic plan in accordance with paragraph (4) and
provides to the National Coordinator assurances that the entity will update
such plan annually in accordance with such paragraph;</text>
</subparagraph><subparagraph commented="no" id="H6FEDC4E551AE432BB36D7FE4AFE10544"><enum>(C)</enum><text>provides
assurances to the National Coordinator that the entity will establish a Loan
Fund in accordance with paragraph (3);</text>
</subparagraph><subparagraph commented="no" id="H872FFCD0DE1543BC90689E00C0BB005E"><enum>(D)</enum><text>provides
assurances to the National Coordinator that the entity will not provide a loan
from the Loan Fund to a health care provider unless the provider meets each of
the conditions described in paragraph (5); and</text>
</subparagraph><subparagraph id="HA71E4A41F6124D1D9614BF9D4077433D"><enum>(E)</enum><text>agrees to provide
matching funds in accordance with paragraph (9).</text>
</subparagraph></paragraph><paragraph id="HCD84D951B27E40D5B8BB671B7D0748B1"><enum>(3)</enum><header>Establishment of
fund</header><text>For purposes of paragraph (2)(C), an eligible entity shall
establish a qualified health information technology loan fund (referred to in
this subsection as a <quote>Loan Fund</quote>) and comply with the other
requirements contained in this section. A grant to an eligible entity under
this subsection shall be deposited in the Loan Fund established by the eligible
entity. No funds authorized by other provisions of this subtitle to be used for
other purposes specified in this subtitle shall be deposited in any Loan
Fund.</text>
</paragraph><paragraph id="H98C2A92547654B4A87DA088DA9324362"><enum>(4)</enum><header>Strategic
plan</header>
<subparagraph id="H10370FDA270C4DB7953BBC37541013DA"><enum>(A)</enum><header>In
general</header><text>For purposes of paragraph (2)(B), a strategic plan of an
eligible entity under this paragraph shall identify the intended uses of
amounts available to the Loan Fund of such entity.</text>
</subparagraph><subparagraph display-inline="no-display-inline" id="H3AF0C28A3CC04AE2BE3D7DA5D8F9468"><enum>(B)</enum><header>Contents</header><text>A
strategic plan under subparagraph (A), with respect to a Loan Fund of an
eligible entity, shall include for a year the following:</text>
<clause id="H8F8736356A1946569DDE8E125B4C4522"><enum>(i)</enum><text>A
list of the projects to be assisted through the Loan Fund during such
year.</text>
</clause><clause id="HE2B777F030BB4CDD910509C4F9CD957"><enum>(ii)</enum><text>A
description of the criteria and methods established for the distribution of
funds from the Loan Fund during the year.</text>
</clause><clause id="H63703B66C90D4EE8B461FD1C8865D43B"><enum>(iii)</enum><text>A description of
the financial status of the Loan Fund as of the date of submission of the
plan.</text>
</clause><clause id="HD1276D336B9449B2A2BC194E4C6D5162"><enum>(iv)</enum><text>The short-term
and long-term goals of the Loan Fund.</text>
</clause></subparagraph></paragraph><paragraph id="H758396A1BECF496EBE40059D6E115E02"><enum>(5)</enum><header>Health care
provider conditions for receipt of loans</header><text>For purposes of
paragraph (2)(D), the conditions described in this paragraph, with respect to a
health care provider that seeks a loan from a Loan Fund established under this
subsection, are the following:</text>
<subparagraph commented="no" id="H8894725B439D4E72A6E046EF1E6B417D"><enum>(A)</enum><text>The health care
provider links, to the extent practicable, to one or more local or regional
health information networks.</text>
</subparagraph><subparagraph commented="no" id="H65226512414A49D0A328A1A9D5C3992C"><enum>(B)</enum><text>The health care
provider consults with the Health Information Technology Resource Center
established under section 3006 to access the knowledge and experience of
existing initiatives regarding the successful implementation and effective use
of health information technology.</text>
</subparagraph><subparagraph commented="no" id="HA3BE5D1B16FD46CB85E2E569B6D6EBF5"><enum>(C)</enum><text display-inline="yes-display-inline">The health care provider agrees to notify
individuals in accordance with section 402 of the Health-e Information
Technology Act of 2008 (relating to notifications in the case of
breaches).</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H1E2558803A2B41D0BA0054E183560171"><enum>(D)</enum><text display-inline="yes-display-inline">The health care provider submits to the
State or Indian tribe involved a plan on how the health care provider intends
to maintain and support the qualified health information technology that would
be purchased with such loan, including the type of resources expected to be
involved and any such other information as the State or Indian Tribe,
respectively, may require.</text>
</subparagraph></paragraph><paragraph id="HA7AF8026725D4ACD97DDA5F94FB4CD10"><enum>(6)</enum><header>Use of
funds</header>
<subparagraph id="H9C7241D883CB4205891491B86511234"><enum>(A)</enum><header>In
general</header><text>Amounts deposited in a Loan Fund, including loan
repayments and interest earned on such amounts, shall be used only for awarding
loans or loan guarantees, making reimbursements described in paragraph
(8)(D)(I), or as a source of reserve and security for leveraged loans, the
proceeds of which are deposited in the Loan Fund established under paragraph
(1). Loans under this section may be used by a health care provider to purchase
qualified health information technology.</text>
</subparagraph><subparagraph id="H9671E4B322CB413B9DF553EC7546D8DE"><enum>(B)</enum><header>Limitation</header><text>Amounts
received by an eligible entity under this subsection may not be used—</text>
<clause id="HFED4553479BD44309CB4CA8DB6058355"><enum>(i)</enum><text>for the purchase
or other acquisition of any health information technology system that is not a
qualified health information technology; or</text>
</clause><clause id="H73317DE95D9B41A88497CE53D024AAF3"><enum>(ii)</enum><text>to conduct
activities for which Federal funds are expended under this title.</text>
</clause></subparagraph></paragraph><paragraph id="H48DF10DEC7D64BF993C8B0E6D386B9DF"><enum>(7)</enum><header>Types of
assistance</header><text>Except as otherwise limited by applicable State law,
amounts deposited into a Loan Fund under this subsection may only be used for
the following:</text>
<subparagraph id="H07E696762B2E4D9000872432D9D882E8"><enum>(A)</enum><text>To award loans
that comply with the following:</text>
<clause id="H5483559DC0604A73B655008981A57DE4"><enum>(i)</enum><text>The interest rate
for each loan shall not exceed the market interest rate.</text>
</clause><clause id="H7475E6B87BDD48ABBC1E00135B97E6FC"><enum>(ii)</enum><text>The principal and
interest payments on each loan shall commence not later than 1 year after the
date the loan was awarded, and each loan shall be fully amortized not later
than 10 years after the date of the loan.</text>
</clause><clause id="H8EF1C4C9CF8641CF939F22187E147E6C"><enum>(iii)</enum><text>The Loan Fund
shall be credited with all payments of principal and interest on each loan
awarded from the Loan Fund.</text>
</clause></subparagraph><subparagraph id="H3E8B6C1398A34315B1D0D27C668E77B0"><enum>(B)</enum><text>To guarantee, or
purchase insurance for, a local obligation (all of the proceeds of which
finance a project eligible for assistance under this subsection) if the
guarantee or purchase would improve credit market access or reduce the interest
rate applicable to the obligation involved.</text>
</subparagraph><subparagraph id="HC0676225A042463C80A751C1FF807CC7"><enum>(C)</enum><text>As a source of
revenue or security for the payment of principal and interest on revenue or
general obligation bonds issued by the eligible entity if the proceeds of the
sale of the bonds will be deposited into the Loan Fund.</text>
</subparagraph><subparagraph id="HD393D6074CB748ABA93BB4AAE38D83EB"><enum>(D)</enum><text>To earn interest
on the amounts deposited into the Loan Fund.</text>
</subparagraph><subparagraph id="H670C62FEBF8D4CD49590E0112613A8D5"><enum>(E)</enum><text>To make
reimbursements described in paragraph (8)(D)(I).</text>
</subparagraph></paragraph><paragraph id="H7288C829D6BB4E58A6B1789790EC70F8"><enum>(8)</enum><header>Administration
of Loan Funds</header>
<subparagraph id="H02D5727F40134B038E70366EF7150702"><enum>(A)</enum><header>Combined
financial administration</header><text>An eligible entity may (as a convenience
and to avoid unnecessary administrative costs) combine, in accordance with
applicable State law, the financial administration of a Loan Fund established
under this subsection with the financial administration of any other revolving
fund established by the entity if otherwise not prohibited by the law under
which the Loan Fund was established.</text>
</subparagraph><subparagraph id="HA22FBAEFD31847249E31385FA97387DB"><enum>(B)</enum><header>Cost of
administering fund</header><text>Each eligible entity may annually use not to
exceed 4 percent of the funds provided to the entity under a grant under this
subsection to pay the reasonable costs of the administration of the programs
under this section, including the recovery of reasonable costs expended to
establish a Loan Fund which are incurred after the date of the enactment of
this title.</text>
</subparagraph><subparagraph id="H622F581FD8D64B2CA6F205EC4E681677"><enum>(C)</enum><header>Guidance and
regulations</header><text>The National Coordinator shall publish guidance and
promulgate regulations as may be necessary to carry out the provisions of this
subsection, including—</text>
<clause id="H4DB322EA275E4DC79C33FC06CF968CF9"><enum>(i)</enum><text>provisions to
ensure that each eligible entity commits and expends funds allotted to the
entity under this subsection as efficiently as possible in accordance with this
title and applicable State laws; and</text>
</clause><clause id="H4895181B1D7043E6AE129CA4AD993B11"><enum>(ii)</enum><text>guidance to
prevent waste, fraud, and abuse.</text>
</clause></subparagraph><subparagraph commented="no" id="H8AC68B3DF5E44EEC9614860078141200"><enum>(D)</enum><header>Private sector
contributions</header>
<clause commented="no" id="H5D5A88884F964C1B83A7AF76C6326BE6"><enum>(i)</enum><header>In
general</header><text>A Loan Fund established under this subsection may accept
contributions from private sector entities, except that such entities may not
specify the recipient or recipients of any loan issued under this subsection.
An eligible entity may agree to reimburse a private sector entity for any
contribution made under this subparagraph, except that the amount of such
reimbursement may not be greater than the principal amount of the contribution
made.</text>
</clause><clause commented="no" id="H405BE9E1FCD7492CA749B25017AE98B5"><enum>(ii)</enum><header>Availability of
information</header><text>An eligible entity shall make publicly available the
identity of, and amount contributed by, any private sector entity under clause
(i) and may issue letters of commendation or make other awards (that have no
financial value) to any such entity.</text>
</clause></subparagraph></paragraph><paragraph id="HC9DF5FA3004B49BD90DC00002D531000"><enum>(9)</enum><header>Matching
requirements</header>
<subparagraph id="H4ABCE359CEB44FBDA1ADE17256DE39E3"><enum>(A)</enum><header>In
general</header><text>The National Coordinator may not make a grant under
paragraph (1) to an eligible entity unless the entity agrees to make available
(directly or through donations from public or private entities) non-Federal
contributions in cash to the costs of carrying out the activities for which the
grant is awarded in an amount equal to not less than $1 for each $1 of Federal
funds provided under the grant.</text>
</subparagraph><subparagraph id="H8D4C909BDD5A4A3F865107FDB54ADA"><enum>(B)</enum><header>Determination of
amount of non-federal contribution</header><text>In determining the amount of
non-Federal contributions that an eligible entity has provided pursuant to
subparagraph (A), the National Coordinator may not include any amounts provided
to the entity by the Federal Government.</text>
</subparagraph></paragraph><paragraph id="HEF50FAA9775A4B67A0A819157300F9E1"><enum>(10)</enum><header>Reports</header><text>The
National Coordinator shall annually submit to the Committee on Health,
Education, Labor, and Pensions and the Committee on Finance of the Senate, and
the Committees on Energy and Commerce and Ways and Means of the House of
Representatives, a report summarizing the reports received by the National
Coordinator from each eligible entity that receives a grant under this
subsection.</text>
</paragraph></subsection><subsection id="HD89D7526882D4AF2B00096611D798526"><enum>(c)</enum><header>Competitive
Grants for the Implementation of Regional or Local Health Information
Technology Plans</header>
<paragraph id="H6558E79526214A9DB1C4182E9FD26528"><enum>(1)</enum><header>In
general</header><text>The National Coordinator may award competitive grants to
eligible entities to implement regional or local health information plans to
improve health care quality and efficiency through the electronic exchange and
use of health information.</text>
</paragraph><paragraph id="H0B22EA8DF2C74835836D43008C920015"><enum>(2)</enum><header>Eligibility</header><text>To
be eligible to receive a grant under paragraph (1) an entity shall—</text>
<subparagraph id="H7151D0BCAE2E4869B038EDD6DCFD0042"><enum>(A)</enum><text>facilitate the
electronic exchange and use of health information within the local or regional
area and among local and regional areas;</text>
</subparagraph><subparagraph id="H0FD3FE678E044018983E4612201DB777"><enum>(B)</enum><text>demonstrate
financial need to the National Coordinator;</text>
</subparagraph><subparagraph id="H96F5F50B2A5F4AFE9E4EEDF9518228D4"><enum>(C)</enum><text>demonstrate that
one of its principal missions or purposes is to use information technology to
improve health care quality and efficiency;</text>
</subparagraph><subparagraph id="HCD42976B506B4E3AA45170DFE5009803"><enum>(D)</enum><text>adopt bylaws,
memoranda of understanding, or other charter documents that demonstrate that
the governance structure and decisionmaking processes of such entity allow for
participation on an ongoing basis by multiple stakeholders within a community,
including—</text>
<clause id="H89069E569A8C4F40990029E46887B0BE"><enum>(i)</enum><text>physicians (as
defined in section 1861(r)) of the <act-name parsable-cite="SSA">Social
Security Act</act-name>), including physicians that provide services to low
income populations and populations that are uninsured, underinsured, and
medically underserved (including such populations in urban and rural
areas);</text>
</clause><clause id="H647CF4C0922F4C2CB08D6F879D3BC134"><enum>(ii)</enum><text>other health care
providers, such as hospitals that serve uninsured, underinsured, and medically
underserved individuals;</text>
</clause><clause id="HB0B327E0B4F54BBE94007E8B05696E70"><enum>(iii)</enum><text>patient or
consumer organizations that reflect the population to be served;</text>
</clause><clause id="HD92AF1FB04334D7493FFA1FE17CF6C02"><enum>(iv)</enum><text>employers;</text>
</clause><clause id="H2450046C0BFB4221953C5BD8C14BBC09"><enum>(v)</enum><text>public health
agencies; and</text>
</clause><clause id="H3CC790FD93D34DDE964F76E6629319E"><enum>(vi)</enum><text>such other
entities, as determined appropriate by the National Coordinator;</text>
</clause></subparagraph><subparagraph id="H4CF42F7912EE4DD5A26DF3BC6DB4E5B5"><enum>(E)</enum><text>demonstrate the
participation, to the extent practicable, of stakeholders in the electronic
exchange and use of health information within the local or regional health
information plan pursuant to subparagraph (D);</text>
</subparagraph><subparagraph id="H10F2F0C7E00946098F98F19EB2A5DFED"><enum>(F)</enum><text>adopt
nondiscrimination and conflict of interest policies that demonstrate a
commitment to open, fair, and nondiscriminatory participation in the regional
or local health information plan by all stakeholders;</text>
</subparagraph><subparagraph id="H2BCBAF229FC54BB68D12AFBCD9BAB9BB"><enum>(G)</enum><text display-inline="yes-display-inline">comply with applicable standards adopted
under section 3003(a);</text>
</subparagraph><subparagraph id="HF0A20A10180645999C64E028CD76EE1F"><enum>(H)</enum><text>prepare and submit
to the National Coordinator an application in accordance with paragraph (3);
and</text>
</subparagraph><subparagraph id="HD15806E8CA004B239912F8796CFFA452"><enum>(I)</enum><text>agree to provide
matching funds in accordance with paragraph (6).</text>
</subparagraph></paragraph><paragraph id="HDE5934ADB17544808D1F17009E3BA529"><enum>(3)</enum><header>Application</header>
<subparagraph id="H3FB19DB24BD84D0F9004008C9300D85F"><enum>(A)</enum><header>In
general</header><text>To be eligible to receive a grant under paragraph (1), an
entity shall submit to the National Coordinator an application at such time, in
such manner, and containing such information (in addition to information
required under subparagraph (B)), as the National Coordinator may
require.</text>
</subparagraph><subparagraph id="HAEF26F26E33843A3008FBA361BC37D8E"><enum>(B)</enum><header>Required
information</header><text>At a minimum, an application submitted under this
paragraph shall include—</text>
<clause id="H00D5E60232464DB780F97796853F5BD5"><enum>(i)</enum><text>clearly identified
short-term and long-term objectives of the regional or local health information
plan;</text>
</clause><clause id="H5710C5A162D34FCEABD3CCC3C714D783"><enum>(ii)</enum><text display-inline="yes-display-inline">an estimate of costs of the hardware,
software, training, and other services necessary to implement the regional or
local health information plan;</text>
</clause><clause id="H3E84EA051C88476FADE7A600A8FC2C00"><enum>(iii)</enum><text>a strategy that
includes initiatives to improve health care quality and efficiency;</text>
</clause><clause id="H36614E6D67FE4D8C83BAFA9F947055EA"><enum>(iv)</enum><text>a
plan that describes provisions to encourage the electronic exchange and use of
health information by all physicians, including single physician practices and
small physician groups, participating in the health information plan;</text>
</clause><clause id="H9AB8A036901549DA8E048FE9961F27EA"><enum>(v)</enum><text>a
plan to ensure the privacy and security of individually identifiable health
information that is consistent with applicable Federal and State law;</text>
</clause><clause id="HD7D8E8CC674442CA8686E808CDEA4374"><enum>(vi)</enum><text>a
governance plan that defines the manner in which the stakeholders shall jointly
make policy and operational decisions on an ongoing basis;</text>
</clause><clause id="H422FEBBE5A614A45AA899921CBF77D23"><enum>(vii)</enum><text>a financial or
business plan that describes—</text>
<subclause id="H5E43BD505A66428CB930DAD4719236A3"><enum>(I)</enum><text>the sustainability
of the plan;</text>
</subclause><subclause id="H4BADD570B0A44AAC84C1BE7D5244D94"><enum>(II)</enum><text>the financial
costs and benefits of the plan; and</text>
</subclause><subclause id="H401E3C2A4B334D05AEC2312C96CBEE59"><enum>(III)</enum><text>the entities to
which such costs and benefits will accrue;</text>
</subclause></clause><clause commented="no" id="H8CD3BA15898441A68060D1F8FF424456"><enum>(viii)</enum><text display-inline="yes-display-inline">a plan on how the entity involved intends
to maintain and support the regional or local health information plan,
including the type of resources expected to be involved; and</text>
</clause><clause id="HB9613B323875415995D7694EBD4E39CF"><enum>(ix)</enum><text>in the case of an
applicant that is unable to demonstrate the participation of all stakeholders
pursuant to paragraph (2)(D), the justification from the entity for any such
nonparticipation.</text>
</clause></subparagraph></paragraph><paragraph id="H2E821A8741194C23B058D559923D0041"><enum>(4)</enum><header>Use of
funds</header><text>Amounts received under a grant under paragraph (1) shall be
used to establish and implement a regional or local health information plan in
accordance with this subsection.</text>
</paragraph><paragraph id="HBECC4186B8CB473183EE48D04ED2E577"><enum>(5)</enum><header>Preference</header><text display-inline="yes-display-inline">In awarding grants under paragraph (1), the
Secretary shall give preference to eligible entities that intend to use amounts
received under a grant to establish or implement a regional or local health
information plan that encompasses communities with health disparities or areas
that serve uninsured, underinsured, and medically underserved individuals
(including urban and rural areas).</text>
</paragraph><paragraph id="H6745BAD7840846FDB3B45273AF0060EA"><enum>(6)</enum><header>Matching
requirement</header>
<subparagraph id="H21F227D301A549D8B84BB6C4BC0070E2"><enum>(A)</enum><header>In
general</header><text>The National Coordinator may not make a grant under this
subsection to an entity unless the entity agrees that, with respect to the
costs of carrying out the activities for which the grant is awarded, the entity
will make available (directly or through donations from public or private
entities) non-Federal contributions toward such costs in an amount equal to not
less than 50 percent of such costs ($1 for each $2 of Federal funds provided
under the grant).</text>
</subparagraph><subparagraph id="H9932ED339FB347E0AA25E1141F9FD9D8"><enum>(B)</enum><header>Determination of
amount contributed</header><text>Non-Federal contributions required under
subparagraph (A) may be in cash or in kind, fairly evaluated, including
equipment, technology, or services. Amounts provided by the Federal Government,
or services assisted or subsidized to any significant extent by the Federal
Government, may not be included in determining the amount of such non-Federal
contributions.</text>
</subparagraph></paragraph></subsection><subsection id="H816B58C65C8E4A2D96FD869DD37575CF"><enum>(d)</enum><header>Reports</header><text>Not
later than 1 year after the date on which the first grant is awarded under this
section, and annually thereafter during the grant period, an entity that
receives a grant under this section shall submit to the National Coordinator a
report on the activities carried out under the grant involved. Each such report
shall include—</text>
<paragraph id="H321845AB6C394E2EAF7170A9E12D9D16"><enum>(1)</enum><text>a description of
the financial costs and benefits of the project involved and of the entities to
which such costs and benefits accrue;</text>
</paragraph><paragraph id="H93856AF32E08415DAB14781BB5004ECB"><enum>(2)</enum><text>an analysis of the
impact of the project on health care quality and safety;</text>
</paragraph><paragraph id="H42A8C2E80A154D6E814E642F299C9147"><enum>(3)</enum><text>a description of
any reduction in duplicative or unnecessary care as a result of the project
involved;</text>
</paragraph><paragraph id="H945529CCD7EB42F58BB8C432EA9EBBC8"><enum>(4)</enum><text>a description of
the efforts of recipients under this section to facilitate secure patient
access to health information;</text>
</paragraph><paragraph id="H6B0903C5796F4AACBB10DC0474487181"><enum>(5)</enum><text>an analysis of the
effectiveness of the project involved on ensuring the privacy and security of
individually identifiable health information in accordance with applicable
Federal and State law; and</text>
</paragraph><paragraph id="H9E1C1FADBFDB4B6496C2DCB0E19D6679"><enum>(6)</enum><text>other information
as required by the National Coordinator.</text>
</paragraph></subsection><subsection id="H50F99BCF830540E88F5B5E4D1FBC85CA"><enum>(e)</enum><header>Requirement To
improve quality of care and decrease in costs</header><text>The National
Coordinator shall annually evaluate the activities conducted under this section
and shall, in awarding grants, implement the lessons learned from such
evaluation in a manner so that awards made subsequent to each such evaluation
are made in a manner that, in the determination of the National Coordinator,
will result in the greatest improvement in quality of care and decrease in
costs.</text>
</subsection><subsection id="H08D548C6D0A4424D879EF81B8CDC7D16"><enum>(f)</enum><header>Limitation</header><text>An
eligible entity may only receive one non-renewable grant under subsection (a),
one non-renewable grant under subsection (b), and one non-renewable grant under
subsection (c).</text>
</subsection><subsection id="HEBA99C0C3D2C4F9FB8D82712DF60BAC7"><enum>(g)</enum><header>Small health
care provider</header><text>For purposes of this section, the term <term>small
health care provider</term> means a health care provider that has an average of
10 or fewer full-time equivalent employees during the period involved.</text>
</subsection><subsection id="H6FE301E4F9714697A88C4DA892A92BEE"><enum>(h)</enum><header>Authorization of
Appropriations</header>
<paragraph id="H1492E210D68A474E8180D83DDA3D3100"><enum>(1)</enum><header>In
general</header><text>For the purpose of carrying out subsections (a) through
(d), there is authorized to be appropriated $115,000,000 for each of the fiscal
years 2009 through 2013.</text>
</paragraph><paragraph id="HCC7C96CB611740FFA87D00735CC8B3ED"><enum>(2)</enum><header>Availability</header><text>Amounts
appropriated under paragraph (1) shall remain available through fiscal year
2013.</text>
</paragraph></subsection></section><section id="H9B882D0B998D4D01B55B1EDED52800D9"><enum>3012.</enum><header>Demonstration
program to integrate information technology into clinical education</header>
<subsection id="HF19173DCFCD54B7D80FA4E9602231F31"><enum>(a)</enum><header>In
General</header><text>The Secretary may award grants under this section to
carry out demonstration projects to develop academic curricula integrating
qualified health information technology in the clinical education of health
professionals. Such awards shall be made on a competitive basis and pursuant to
peer review.</text>
</subsection><subsection id="H2E4167FF333047669146042061182961"><enum>(b)</enum><header>Eligibility</header><text>To
be eligible to receive a grant under subsection (a), an entity shall—</text>
<paragraph id="HC44D009F3D434CD0AB6561F9923771BE"><enum>(1)</enum><text>submit to the
Secretary an application at such time, in such manner, and containing such
information as the Secretary may require;</text>
</paragraph><paragraph id="HF935DDD083D74FA288D6BBDDD8CDEF1"><enum>(2)</enum><text>submit to the
Secretary a strategic plan for integrating qualified health information
technology in the clinical education of health professionals to reduce medical
errors and enhance health care quality;</text>
</paragraph><paragraph id="H9E08B94F380F4DA3AAE8FB33918B3577"><enum>(3)</enum><text>be—</text>
<subparagraph id="H333C5CC2F0FC4C949684AB613AA46F4"><enum>(A)</enum><text display-inline="yes-display-inline">a school of medicine, osteopathic medicine,
dentistry, or pharmacy, a graduate program in behavioral or mental health, or
any other graduate health professions school;</text>
</subparagraph><subparagraph id="H986A57FD3D4648C88EF255599B30F74C"><enum>(B)</enum><text>a graduate school
of nursing or physician assistant studies;</text>
</subparagraph><subparagraph id="H817B3865562248FA8DE4F5A1CD5796EE"><enum>(C)</enum><text>a consortium of
two or more schools described in subparagraph (A) or (B); or</text>
</subparagraph><subparagraph id="HF9414C2386DE41919BF924315852F083"><enum>(D)</enum><text>an institution
with a graduate medical education program in medicine, osteopathic medicine,
dentistry, pharmacy, nursing, or physician assistance studies;</text>
</subparagraph></paragraph><paragraph id="H09C619F0CCA74B3481A64F7CB1BA53CE"><enum>(4)</enum><text>provide for the
collection of data regarding the effectiveness of the demonstration project to
be funded under the grant in improving the safety of patients, the efficiency
of health care delivery, and in increasing the likelihood that graduates of the
grantee will adopt and incorporate qualified health information technology, in
the delivery of health care services; and</text>
</paragraph><paragraph id="H2B36EE6ED7054028B845E886C753EB5F"><enum>(5)</enum><text>provide matching
funds in accordance with subsection (d).</text>
</paragraph></subsection><subsection id="H0B8D5B5A938843509976E7EE0E1C9A0"><enum>(c)</enum><header>Use of
Funds</header>
<paragraph id="H1FC5F9D40D7744388C41430023A3A628"><enum>(1)</enum><header>In
general</header><text>With respect to a grant under subsection (a), an eligible
entity shall—</text>
<subparagraph id="HBFBDC55BF2994FA8ABDA7BCBC67B4FBF"><enum>(A)</enum><text>use grant funds in
collaboration with 2 or more disciplines; and</text>
</subparagraph><subparagraph id="H9E0799E44A6A49459B98CC07C6C1E828"><enum>(B)</enum><text>use grant funds to
integrate qualified health information technology into community-based clinical
education.</text>
</subparagraph></paragraph><paragraph id="H71239C9ADD88455C8EDC44C6AB49DFC7"><enum>(2)</enum><header>Limitation</header><text>An
eligible entity shall not use amounts received under a grant under subsection
(a) to purchase hardware, software, or services.</text>
</paragraph></subsection><subsection id="H3EE239151E4A4FF5B34528C2FC6080F8"><enum>(d)</enum><header>Matching
Funds</header>
<paragraph id="HE677D6A2879E478381EC3C214CF69C52"><enum>(1)</enum><header>In
general</header><text>The Secretary may award a grant to an entity under this
section only if the entity agrees to make available non-Federal contributions
toward the costs of the program to be funded under the grant in an amount that
is not less than $1 for each $2 of Federal funds provided under the
grant.</text>
</paragraph><paragraph id="HCE10890563EE426CA4E6009EDF189FAB"><enum>(2)</enum><header>Determination of
amount contributed</header><text>Non-Federal contributions under paragraph (1)
may be in cash or in kind, fairly evaluated, including equipment or services.
Amounts provided by the Federal Government, or services assisted or subsidized
to any significant extent by the Federal Government, may not be included in
determining the amount of such contributions.</text>
</paragraph></subsection><subsection id="H817D216790504C14958374AF27F36E66"><enum>(e)</enum><header>Evaluation</header><text>The
Secretary shall take such action as may be necessary to evaluate the projects
funded under this section and publish, make available, and disseminate the
results of such evaluations on as wide a basis as is practicable.</text>
</subsection><subsection id="H33CF6A3361924F85987611FE6D829B1E"><enum>(f)</enum><header>Reports</header><text>Not
later than 1 year after the date of enactment of this title, and annually
thereafter, the Secretary shall submit to the Committee on Health, Education,
Labor, and Pensions and the Committee on Finance of the Senate, and the
Committees on Energy and Commerce and Ways and Means of the House of
Representatives a report that—</text>
<paragraph id="H6289D496D92C4378AEC4252DEAE01141"><enum>(1)</enum><text>describes the
specific projects established under this section; and</text>
</paragraph><paragraph id="HE1A1CA2AFD2C486F85F79255DDDBB2AE"><enum>(2)</enum><text>contains
recommendations for Congress based on the evaluation conducted under subsection
(e).</text>
</paragraph></subsection><subsection id="HF66FB4712D124F0A8F00449F588B30B"><enum>(g)</enum><header>Authorization of
Appropriations</header><text>There is authorized to be appropriated to carry
out this section, $10,000,000 for each of fiscal years 2009 through
2011.</text>
</subsection><subsection id="H6179BC3D8CE14FB2BEFAB9867529DA5B"><enum>(h)</enum><header>Sunset</header><text>This
section shall not apply after September 30,
2011.</text>
</subsection></section></subtitle><after-quoted-block>.</after-quoted-block></quoted-block>
</section></subtitle><enum>IV</enum><header>Privacy and
security provisions</header>
<section commented="no" display-inline="no-display-inline" id="H84787789185C4CEE94D40900DBDDD9D4" section-type="subsequent-section"><enum>400.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title, except as specified
otherwise:</text>
<paragraph commented="no" id="H181E71018CD4415FB6C9C7ECD7F0001"><enum>(1)</enum><header>Breach</header><text display-inline="yes-display-inline">The term <term>breach</term> means the
unauthorized acquisition, access, or disclosure of protected health information
which compromises the security, privacy, or integrity of protected health
information maintained by or on behalf of a person. Such term does not include
any unintentional acquisition or access of such information by an employee or
agent of the covered entity or business associate involved if such acquisition
or access, respectively, was made in good faith and within the course and scope
of the employment or other contractual relationship of such employee or agent,
respectively, with the covered entity or business associate and if such
information is not further acquired, accessed, or disclosed by such employee or
agent.</text>
</paragraph><paragraph commented="no" id="HB2417DFD9E064077AAB508283F688951"><enum>(2)</enum><header>Business
associate</header><text display-inline="yes-display-inline">The term
<term>business associate</term> has the meaning given such term in section
160.103 of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="H04C93BF13293412FB536FF4E7F3261F8"><enum>(3)</enum><header>Covered
entity</header><text display-inline="yes-display-inline">The term <term>covered
entity</term> has the meaning given such term in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45,
Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HC4BE33836A164FFE93F17C52B042E851"><enum>(4)</enum><header>Disclose</header><text>The
terms <term>disclose</term> and <term>disclosure</term> have the meaning given
the term <term>disclosure</term> in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45, Code of
Federal Regulations.</text>
</paragraph><paragraph id="H3CB42A822C5E4714BC586E0000B45103"><enum>(5)</enum><header>Electronic
health record</header><text display-inline="yes-display-inline">The term
<quote>electronic health record</quote> means an electronic record of
health-related information on an individual that is created, gathered, managed,
and consulted by authorized health care clinicians and staff of one or more
organizations, that conforms to standards adopted under section 3003(a) of the
Public Health Service Act, as added by section 101, and is made accessible
electronically to other health care organizations and other authorized
users.</text>
</paragraph><paragraph id="H3D3A836FA5A64839AFAE2517E9B8D133"><enum>(6)</enum><header>Electronic
medical record</header><text>The term <term>electronic medical record</term>
means an electronic record of individually identifiable health information on
an individual that is created, gathered, managed, and consulted by authorized
health care clinicians and staff within a single organization.</text>
</paragraph><paragraph commented="no" id="HAE8E80F586AB4FB683BE7884483401E2"><enum>(7)</enum><header>Health care
operations</header><text display-inline="yes-display-inline">The term
<term>health care operation</term> has the meaning given such term in section
164.501 of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="H750A0C9EF0CB4416BFDAD9BF21649D4F"><enum>(8)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> has the
meaning given such term in <external-xref legal-doc="usc" parsable-cite="usc/45/160">section 160.103</external-xref> of title 45, Code of Federal
Regulations.</text>
</paragraph><paragraph id="HD62FCF67319F41188DA314F8081EFA7E"><enum>(9)</enum><header>Health
plan</header><text>The term <term>health plan</term> has the meaning given such
term in section 1171(5) of the Social Security Act, as amended by section
415.</text>
</paragraph><paragraph id="HA8FD890D03C444F4AD8DEEDC7BBC119C"><enum>(10)</enum><header>National
Coordinator</header><text>The term <quote>National Coordinator</quote> means
the head of the Office of the National Coordinator for Health Information
Technology established under section 3001(a) of the Public Health Service Act,
as added by section 101.</text>
</paragraph><paragraph id="H76A85BE2778E4A13B49B73744D80A865"><enum>(11)</enum><header>Payment</header><text>The
term <quote>payment</quote> has the meaning given such term in section 164.501
of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph id="H3EB3B1AEEF9C4DE7A5DF0092C6A13F28"><enum>(12)</enum><header>Personal health
record</header><text display-inline="yes-display-inline">The term
<term>personal health record</term> means an electronic record of individually
identifiable health information on an individual that can be drawn from
multiple sources and that is managed, shared, and controlled by or for the
individual.</text>
</paragraph><paragraph commented="no" id="H6738079F01DF4E05B74F69B9E2FB076D"><enum>(13)</enum><header>Protected
health information</header><text display-inline="yes-display-inline">The term
<term>protected health information</term> has the meaning given such term in
<external-xref legal-doc="regulation" parsable-cite="cfr/45/160.103">section 160.103</external-xref> of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HD63675B6264B4822B4771454B0FD014D"><enum>(14)</enum><header>Secretary</header><text>The
term <term>Secretary</term> means the Secretary of Health and Human
Services.</text>
</paragraph><paragraph commented="no" id="H9A24E20A879141FBA045AB143F53824B"><enum>(15)</enum><header>Security</header><text>The
term <term>security</term> has the meaning given such term in section 164.304
of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="H490E85BA897F42319EDB80A0CDE14DFD"><enum>(16)</enum><header>State</header><text>The
term <term>State</term> means each of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Northern Mariana Islands.</text>
</paragraph><paragraph id="H3232697F149643CD9090FFA197EE69E1"><enum>(17)</enum><header>Treatment</header><text>The
term <quote>treatment</quote> has the meaning given such term in section
164.501 of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph commented="no" id="HD54FDB726697436DBE4F138D3B5B1743"><enum>(18)</enum><header>Use</header><text>The
term <term>use</term> has the meaning given such term in section 160.103 of
title 45, Code of Federal Regulations.</text>
</paragraph><paragraph id="HD9516B56C0074B71A54FC7C8FDC64838"><enum>(19)</enum><header>Vendor of
personal health records</header><text>The term <term>vendor of personal health
records</term> means an entity that offers or maintains a personal health
record. Such term does not include an entity that is a covered entity for
purposes of offering or maintaining such personal health record.</text>
</paragraph></section><subtitle id="H379588DF998B42AA817817521ED51D64"><enum>A</enum><header>Improved privacy
provisions and security provisions</header>
<section display-inline="no-display-inline" id="H1DFD8CB9F84142C292E492F4796D00BA"><enum>401.</enum><header>Application of
security provisions and penalties to business associates of covered entities;
annual guidance on privacy and security provisions</header>
<subsection id="H4F534B50319E434DBBFDE00BC82885"><enum>(a)</enum><header>Application of
security provisions</header><text display-inline="yes-display-inline">Sections
164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal
Regulations, and any applicable security standards adopted by the Secretary
under section 3003(a) of the Public Health Service Act, as added by section
101, shall apply to a business associate of a covered entity in the same manner
that such sections and standards, respectively, apply to the covered
entity.</text>
</subsection><subsection id="H459283151DAF499585D0A172327923FE"><enum>(b)</enum><header>Application of
civil and criminal penalties</header><text display-inline="yes-display-inline">Sections 1176 and 1177 of the Social
Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>, 1320d–6) shall apply to a business associate
of a covered entity with respect to a section applied under subsection (a) to
such business associate in the same manner that such sections apply to a
covered entity with respect to such section.</text>
</subsection><subsection id="H3B6152298D9546138C3D4CEF84F01DD2"><enum>(c)</enum><header>Annual
guidance</header><text display-inline="yes-display-inline">Not later than 12
months after the date of the enactment of this Act and annually thereafter, the
Secretary of Health and Human Services shall, in consultation with industry
stakeholders, annually issue guidance on the latest privacy and security
safeguard technologies for use in carrying out the sections described in
subsection (a).</text>
</subsection></section><section display-inline="no-display-inline" id="HC570348E8B1A42698043C0BA6CB48CF1" section-type="subsequent-section"><enum>402.</enum><header>Notification in the
case of breach</header>
<subsection id="H3DCC9AEB71F84AC7A938EFDDB9A695F3"><enum>(a)</enum><header>In
general</header><text>A covered entity that accesses, maintains, retains,
modifies, records, stores, destroys, or otherwise holds, uses, or discloses
unsecured protected health information (as defined in subsection (h)(1)) shall,
in the case of a breach of such information that is discovered by the covered
entity, notify each individual whose unsecured protected health information has
been, or is reasonably believed by the covered entity to have been, accessed,
acquired, or disclosed as a result of such breach.</text>
</subsection><subsection id="HEE6A2F41F9BC4775B0E1D22074FCE07"><enum>(b)</enum><header>Notification of
covered entity by business associate</header><text>A business associate of a
covered entity that accesses, maintains, retains, modifies, records, stores,
destroys, or otherwise holds, uses, or discloses unsecured protected health
information shall, following the discovery of a breach of such information,
notify the covered entity of such breach. Such notice shall include the
identification of each individual whose unsecured protected health information
has been, or is reasonably believed by the business associate to have been,
accessed, acquired, or disclosed during such breach.</text>
</subsection><subsection id="HFDEB1B1E362E44B9A0065461CB808826"><enum>(c)</enum><header>Breaches treated
as discovered</header><text>For purposes of this section, a breach shall be
treated as discovered by a covered entity or by a business associate as of the
first day on which such breach is known to such entity or associate,
respectively, (including any person that is an employee, officer, or other
agent of such entity or associate, respectively) or should reasonably have been
known to such entity or associate (or person) to have occurred.</text>
</subsection><subsection id="HB24A34BB89414960AC51D893759300DC"><enum>(d)</enum><header>Timeliness of
notification</header>
<paragraph id="H997F9D102D244D62BA35CBFEBB48C40"><enum>(1)</enum><header>In
general</header><text>Subject to subsection (g), all notifications required
under this section shall be made without unreasonable delay and in no case
later than 60 calendar days after the discovery of a breach by the covered
entity involved (or business associate involved in the case of a notification
required under subsection (b)).</text>
</paragraph><paragraph id="H767401674136495200EB82A6F61759ED"><enum>(2)</enum><header>Burden of
proof</header><text>The covered entity involved (or business associate involved
in the case of a notification required under subsection (b)), shall have the
burden of demonstrating that all notifications were made as required under this
subtitle, including evidence demonstrating the necessity of any delay.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H2190246694914E88A5B67C1EB390077"><enum>(e)</enum><header>Methods of
notice</header>
<paragraph id="HD45F7D06BC0243649F5BE22B9266A367"><enum>(1)</enum><header>Individual
notice</header><text display-inline="yes-display-inline">Notice required under
this section to be provided to an individual, with respect to a breach, shall
be provided promptly and in the following form:</text>
<subparagraph id="H3F4B661EC3E14E20A3F3C74B57001E23"><enum>(A)</enum><text>Written
notification by first-class mail to the individual (or the next of kin of the
individual if the individual is deceased) at the last known address of the
individual or the next of kin, respectively, or, if specified as a preference
by the individual, by electronic mail. The notification may be provided in one
or more mailings as information is available.</text>
</subparagraph><subparagraph id="H43CD76A7B1BF495980A7D97555CA8D66"><enum>(B)</enum><text>In the case in
which there is insufficient, or out-of-date contact information that precludes
direct written (or, if specified by the individual under subparagraph (A),
electronic) notification to the individual, a substitute form of notice shall
be provided, including a conspicuous posting on the home page of the Web site
of the covered entity involved or notice in major print or broadcast media,
including major media in geographic areas where the individuals affected by the
breach likely reside. Such a notice in media will include a toll-free phone
number where an individual can learn whether or not the individual’s unsecured
protected health information is possibly included in the breach.</text>
</subparagraph><subparagraph id="H54088BDD5FA84F5BBA8493BD068BFF19"><enum>(C)</enum><text>In any case deemed
by the covered entity involved to require urgency because of possible imminent
misuse of unsecured protected health information, the covered entity, in
addition to notice provided under subparagraph (A), may provide information to
individuals by telephone or other means, as appropriate.</text>
</subparagraph></paragraph><paragraph id="HACA184CD2AD24E35B98D71FD00FBCFB"><enum>(2)</enum><header>Media
notice</header><text>Notice shall be provided to prominent media outlets
serving a State or jurisdiction, following the discovery of a breach described
in subsection (a), if the unsecured protected health information of more than
500 residents of such State or jurisdiction is, or is reasonably believed to
have been, accessed, acquired, or disclosed during such breach.</text>
</paragraph><paragraph id="H7EB8155C95704EE5836C6D42D92091D2"><enum>(3)</enum><header>Notice to
Secretary</header><text display-inline="yes-display-inline">Notice shall be
provided to the Secretary by covered entities of unsecured protected health
information that has been acquired or disclosed in a breach.</text>
</paragraph><paragraph id="H751A4FAAD4C343B9A2E8FA6856E1B8E0"><enum>(4)</enum><header>Posting on HHS
public website</header><text display-inline="yes-display-inline">The Secretary
shall make available to the public on the Internet website of the Department of
Health and Human Services a list that identifies each covered entity involved
in a breach described in subsection (a) in which the unsecured protected health
information of more than 1,000 individuals is acquired or disclosed.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H4C17661AF5BF4C7900A2BF57F7055C79"><enum>(f)</enum><header>Content of
notification</header><text>Regardless of the method by which notice is provided
to individuals under this section, notice of a breach shall include, to the
extent possible, the following:</text>
<paragraph id="H19898536B39545628064536F74EE7C87"><enum>(1)</enum><text display-inline="yes-display-inline">A brief description of what happened,
including the date of the breach and the date of the discovery of the breach,
if known.</text>
</paragraph><paragraph id="HF1CE104E44BE478E844EA460B506EF38"><enum>(2)</enum><text>A
description of the types of unsecured protected health information that were
involved in the breach (such as full name, Social Security number, date of
birth, home address, account number, or disability code).</text>
</paragraph><paragraph id="H40102068AA0840EC99DE24B3856FA4F2"><enum>(3)</enum><text>The steps
individuals should take to protect themselves from potential harm resulting
from the breach.</text>
</paragraph><paragraph id="H8876B1C0A7A646C388715805828C32A4"><enum>(4)</enum><text>A
brief description of what the covered entity involved is doing to investigate
the breach, to mitigate losses, and to protect against any further
breaches.</text>
</paragraph><paragraph id="H49660E7EC3D64F18B7B1947B21821144"><enum>(5)</enum><text>Contact procedures
for individuals to ask questions or learn additional information, which shall
include a toll-free telephone number, an e-mail address, Web site, or postal
address.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H5848C609BFDD468DBEF661427435A260"><enum>(g)</enum><header>Delay of
notification authorized for law enforcement purposes</header><text display-inline="yes-display-inline">If a law enforcement official determines
that a notification, notice, or posting required under this section would
impede a criminal investigation or cause damage to national security, such
notification, notice, or posting shall be delayed in the same manner as
provided under <external-xref legal-doc="regulation" parsable-cite="cfr/45/164.528">section 164.528(a)(2)</external-xref> of title 45, Code of Federal Regulations,
in the case of a disclosure covered under such section.</text>
</subsection><subsection id="HFBA5F8183AA94E35B1B9C979518134C"><enum>(h)</enum><header>Unsecured
protected health information</header>
<paragraph id="H4A14E4E277994970BBC3DD157C885500"><enum>(1)</enum><header>Definition</header>
<subparagraph id="H45E360CAAD0F41F6A190444E2CBA47E1"><enum>(A)</enum><header>In
general</header><text>Subject to subparagraph (B), for purposes of this
section, the term <term>unsecured protected health information</term> means
protected health information that is not protected through the use of a
technology or methodology specified by the Secretary in the guidance issued
under paragraph (2).</text>
</subparagraph><subparagraph id="HF7E841614C0C4F478831A8F4AB235865"><enum>(B)</enum><header>Exception in
case timely guidance not issued</header><text display-inline="yes-display-inline">In the case that the Secretary does not
issue guidance under paragraph (2) by the date specified in such paragraph, for
purposes of this section, the term <quote>unsecured protected health
information</quote> shall mean information that is not protected by technology
standards developed or endorsed by a standards developing organization that is
accredited by the American National Standards Institute.</text>
</subparagraph></paragraph><paragraph id="HF00DA27348CD4D20868CA40998365F02"><enum>(2)</enum><header>Guidance</header><text display-inline="yes-display-inline">For purposes of paragraph (1) and section
415(f), not later than the date that is 60 days after the date of the enactment
of this Act, the Secretary shall, after consultation with stakeholders, issue
(and annually update) guidance specifying the technologies and methodologies
that render protected health information unusable, unreadable, or
indecipherable to unauthorized individuals.</text>
</paragraph></subsection><subsection id="HB8989F3557FB4878994BC627096CF4DA"><enum>(i)</enum><header>Report to
Congress on breaches</header>
<paragraph id="HC614C5C7338B4ACD9FF4764DC22BBDFB"><enum>(1)</enum><header>In
general</header><text>Not later than 12 months after the date of the enactment
of this Act and annually thereafter, the Secretary shall prepare and submit to
the Committee on Finance and the Committee on Health, Education, Labor, and
Pensions of the Senate and the Committee on Ways and Means and the Committee on
Energy and Commerce of the House of Representatives a report containing the
information described in paragraph (2) regarding breaches for which notice was
provided to the Secretary under subsection (e)(3).</text>
</paragraph><paragraph id="H06598471840C4EFEBD03BFC38E94D284"><enum>(2)</enum><header>Information</header><text>The
information described in this paragraph regarding breaches specified in
paragraph (1) shall include—</text>
<subparagraph id="H54214B95ACBE466FB6D9D1F590ACF8C1"><enum>(A)</enum><text>the number and
nature of such breaches;</text>
</subparagraph><subparagraph id="HE91CEBD1FC8847C882F998716DE0E733"><enum>(B)</enum><text>actions taken in
response to such breaches; and</text>
</subparagraph><subparagraph id="HF61578DB8F4448DCB425E6F79DA300C9"><enum>(C)</enum><text display-inline="yes-display-inline">any recommendations described in section
422(b)(9) made by the National Coordinator for the year involved.</text>
</subparagraph></paragraph></subsection><subsection id="H0EDDFC4C5949438FB6D19DF427B5D12E"><enum>(j)</enum><header>Effective
date</header><text>The provisions of this section shall apply to breaches that
are discovered on or after the date that is 90 days after the date of the
enactment of this Act.</text>
</subsection></section><section display-inline="no-display-inline" id="H2555D6AB47224BC49BF4CE75D2749C3" section-type="subsequent-section"><enum>403.</enum><header>Education on health
information privacy and report on compliance</header>
<subsection id="H07142CC207B8400DA3C8D1CB1C9DA55E"><enum>(a)</enum><header>Regional office
privacy advisors</header><text display-inline="yes-display-inline">Not later
than 6 months after the date of the enactment of this Act, the Secretary shall
designate an individual in each regional office of the Department of Health and
Human Services to offer guidance and education to covered entities, business
associates, and individuals on their rights and responsibilities related to
Federal privacy and security requirements for protected health
information.</text>
</subsection><subsection id="H66B6FA0C30D74879803B6063F8AD7F14"><enum>(b)</enum><header>Report on
compliance</header>
<paragraph id="HCF846CADC0494D1BAF56DDAC3DE90086"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Not later than 24
months after the date of the enactment of this Act and annually thereafter, the
Secretary shall prepare and submit to the Committee on Finance and the
Committee on Health, Education, Labor, and Pensions of the Senate and the
Committee on Ways and Means and the Committee on Energy and Commerce of the
House of Representatives a report concerning the number of audits performed and
a summary of audit findings pursuant to section 414 and complaints of alleged
violations of the provisions of sections 401 and 402, the provisions of
subtitle B, and the provisions of subparts C and E of title 45, Code of Federal
Regulations that are received by the Secretary during the year for which the
report is being prepared. Each such report shall include, with respect to such
complaints received during the year—</text>
<subparagraph id="H00C33CBE68324474AB57101100005C7F"><enum>(A)</enum><text>the number of such
complaints;</text>
</subparagraph><subparagraph id="HADD41776087D45BF889CBFE566E783F4"><enum>(B)</enum><text>the number of such
complaints resolved informally, a summary of the types of such complaints so
resolved, and the number of covered entities that received technical assistance
from the Secretary during such year in order to achieve compliance with such
provisions and the types of such technical assistance provided;</text>
</subparagraph><subparagraph id="HFB9442BAA994484FAC028DB8DEF3429C"><enum>(C)</enum><text>the number of such
complaints that resulted in the imposition of civil money penalties, the amount
of the civil money penalty imposed in each such case, and a summary of the
basis for each such civil money penalty;</text>
</subparagraph><subparagraph id="HC5E2DA893ED4403791C4C16F00050C2"><enum>(D)</enum><text>the number of
compliance reviews conducted and the outcome of each such review;</text>
</subparagraph><subparagraph id="HC63FD16F12A44ABDAD22B7F11B6572B7"><enum>(E)</enum><text>the number of
subpoenas or inquiries issued; and</text>
</subparagraph><subparagraph id="H6F4E95CBE7CF4A4794F0F9DB37004887"><enum>(F)</enum><text>the Secretary’s
plan for improving compliance with and enforcement of such provisions for the
following year.</text>
</subparagraph></paragraph><paragraph id="H9A24D2CB513C4B5C9456FBF63DEBAD2F"><enum>(2)</enum><header>Availability to
public</header><text>Each report under paragraph (1) shall be made available to
the public on the Internet website of the Department of Health and Human
Services.</text>
</paragraph></subsection><subsection id="H57F0EBEBFBEF4B4C97FEC61C455FB887"><enum>(c)</enum><header>Education
initiative on uses of health information</header>
<paragraph id="H9448A226DB1F42C8B6AE77FE823548AB"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Not later than 12
months after the date of the enactment of this Act, the Office for Civil Rights
within the Department of Health and Human Services shall develop and maintain a
multi-faceted national education initiative to enhance public transparency
regarding the uses of protected health information, including programs to
educate individuals about the potential uses of their protected health
information, the effects of such uses, and the rights of individuals with
respect to such uses. Such programs shall be conducted in a variety of
languages and present information in a clear and understandable manner.</text>
</paragraph><paragraph id="H47E096565FCE4BFEA8076095704B615C"><enum>(2)</enum><header>Authorization of
appropriations</header><text>There is authorized to be appropriated to carry
out paragraph (1), $10,000,000 for the period of fiscal years 2009 through
2013.</text>
</paragraph></subsection></section><section id="HC4215B3BFBA84633B1B9002F2E579573"><enum>404.</enum><header>Application of
penalties to business associates of covered entities for violations of privacy
contract requirements</header>
<subsection id="HD4DF3138AC9343169292CA63B33CC9AD"><enum>(a)</enum><header>Application of
contract requirements</header><text display-inline="yes-display-inline">In the
case of a business associate of a covered entity that obtains or creates
protected health information pursuant to a written contract (or other written
arrangement) described in <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.502(e)(2)</external-xref> of title 45, Code of Federal
Regulations, with such covered entity, the business associate may use and
disclose such protected health information only if such use or disclosure,
respectively, is in compliance with each applicable requirement of section
164.504(e) of such title and section 405(b).</text>
</subsection><subsection id="H3BAA88CB9157405D816B00516CA3F116"><enum>(b)</enum><header>Application of
knowledge elements associated with contracts</header><text display-inline="yes-display-inline"><external-xref legal-doc="usc" parsable-cite="usc/45/164">Section 164.504(e)(1)(ii)</external-xref> of title 45, Code
of Federal Regulations, shall apply to a business associate described in
subsection (a), with respect to compliance with such subsection, in the same
manner that such section applies to a covered entity, with respect to
compliance with the standards in sections 164.502(e) and 164.504(e) of such
title, except that in applying such section 164.504(e)(1)(ii) each reference to
the business associate, with respect to a contract, shall be treated as a
reference to the covered entity involved in such contract.</text>
</subsection><subsection id="H765F3017D6884D93981C009BAF4D6B91"><enum>(c)</enum><header>Application of
civil and criminal penalties</header><text>In the case of a business associate
that violates any provision of subsection (a) or (b), the provisions of
sections 1176 and 1177 of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>, 1320d–6)
shall apply to the business associate with respect to such violation in the
same manner as such provisions apply to a person who violates a provision of
part C of title XI of such Act.</text>
</subsection></section><section id="H1335285DEA614C2BA5FB61C26D636569"><enum>405.</enum><header>Restrictions on
certain uses and disclosures and sales of health information; accounting of
certain protected health information disclosures; access to certain information
in electronic format</header>
<subsection id="HA6C6F45FA2DC41579EAF9E82F4326B5C"><enum>(a)</enum><header>Requested
restrictions on certain disclosures of health information</header><text display-inline="yes-display-inline">In the case that an individual requests
under paragraph (a)(1)(i)(A) of <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.522</external-xref> of title 45, Code of Federal
Regulations, that a covered entity restrict the disclosure of the protected
health information of the individual, notwithstanding paragraph (a)(1)(ii) of
such section, the covered entity must comply with the requested restriction
if—</text>
<paragraph id="H942446F7E1054E09AB2596AFEEEA4273"><enum>(1)</enum><text>except as
otherwise required by law, the disclosure is to a health plan for purposes of
carrying out payment or health care operations (and is not for purposes of
carrying out treatment); and</text>
</paragraph><paragraph id="H0C8B567624C24684A9E3D813003F91B9"><enum>(2)</enum><text>the protected
health information pertains solely to a health care item or service for which
the health care provider involved has been paid out of pocket in full.</text>
</paragraph></subsection><subsection id="H7A7127AFF0FF43529024FBC44372192B"><enum>(b)</enum><header>Disclosures
required To be limited to the limited data set or the minimum
necessary</header>
<paragraph id="H34FE8CEA66A74DF781FFF19CB158F0B8"><enum>(1)</enum><header>Transitional
rule</header>
<subparagraph id="HAC4234A8B3B54F8FA2CF21EBA9ADAD25"><enum>(A)</enum><header>In
general</header><text>Subject to subparagraph (B), a covered entity shall be
treated as being in compliance with <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.502(b)(1)</external-xref> of title 45, Code of
Federal Regulations, and for purposes of section 404(a) a business associate
shall be treated as being in compliance with this subsection, with respect to
the use, disclosure, or request of protected health information described in
such section, only if the covered entity or business associate, respectively,
limits such protected health information, to the extent practicable, to either
the limited data set (as defined in section 164.514(e)(2) of such title) or to
the minimum necessary to accomplish the intended purpose of such use,
disclosure, or request, respectively.</text>
</subparagraph><subparagraph id="HEE0FF6F9AD7D461E9E5521B41EEBCC52"><enum>(B)</enum><header>Sunset</header><text display-inline="yes-display-inline">Subparagraph (A) shall not apply on and
after the earlier of—</text>
<clause id="H815A545E86A64AF2B56EBE6EECD50043"><enum>(i)</enum><text display-inline="yes-display-inline">the effective date on which the Secretary
adopts, taking into consideration the regulations promulgated under section
406(d), the study under section 410, and the report under section 411, a
standard under section 3003(a) of the Public Health Service Act, as added by
section 101, which defines the term <quote>minimum necessary</quote> for
purposes of subpart E of part 164 of title 45, Code of Federal Regulations;
or</text>
</clause><clause id="H7F4A9E746ED94C46A22B23D7DA00CB2F"><enum>(ii)</enum><text>the
National Coordinator recommends guidance under section 3001(c)(2) of such Act
which defines such term for such purposes.</text>
</clause></subparagraph></paragraph><paragraph id="HB58A077460C141B4957E5819A6D6D4E7"><enum>(2)</enum><header>Determination of
minimum necessary</header><text>For purposes of paragraph (1), in the case of
the disclosure of protected health information, the covered entity or business
associate disclosing such information shall determine what constitute the
minimum necessary to accomplish the intended purpose of such disclosure.</text>
</paragraph><paragraph id="H3E3B7BB6FEB84A9895CE177505C2CBDA"><enum>(3)</enum><header>Application of
exceptions</header><text>The exceptions described in section 164.502(b)(2) of
title 45, Code of Federal Regulations, shall apply to the requirement under
paragraph (1) as of the effective date described in section 433 in the same
manner that such exceptions apply to section 164.502(b)(1) of such title before
such date.</text>
</paragraph><paragraph id="HEE221EC69A854FBB8E60E38C1D05B0DD"><enum>(4)</enum><header>Rule of
construction</header><text>Nothing in this subsection shall be construed as
affecting the use, disclosure, or request of protected health information that
has been de-identified to the greatest extent practicable rather than the use
of protected health information that has been limited to the limited data
set.</text>
</paragraph></subsection><subsection commented="no" id="H9BC9784E974D467EA3BD2E8577A1B930"><enum>(c)</enum><header>Accounting of
certain protected health information disclosures required if covered entity
uses electronic medical record or electronic health record</header>
<paragraph commented="no" id="H3E0F315E4CB54547B5ACE0AD01861401"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">In applying section
164.528 of title 45, Code of Federal Regulations, in the case of protected
health information used or maintained by a covered entity in an electronic
medical record or an electronic health record—</text>
<subparagraph commented="no" id="H815E23AFD8064E77A9A60888899DEDD1"><enum>(A)</enum><text display-inline="yes-display-inline">the exception under section paragraph
(a)(1)(i) of such section shall not apply to disclosures (other than oral
disclosures) made by such entity of such information; and</text>
</subparagraph><subparagraph commented="no" id="H493B7DC31DE543EF922C326809505284"><enum>(B)</enum><text>an individual
shall have a right to receive an accounting of disclosures described in such
paragraph of such information made by such covered entity during only the three
years prior to the date on which the accounting is requested.</text>
</subparagraph></paragraph><paragraph commented="no" id="HA3005DFD4B8C4E2F00001388BA9E3BA6"><enum>(2)</enum><header>Effective
date</header><text>The provisions of this subsection shall apply to
disclosures, with respect to protected health information, made by a covered
entity on or after the sooner of the following dates:</text>
<subparagraph commented="no" id="H97A2E6CAF0914F28B94D44CC12020257"><enum>(A)</enum><text display-inline="yes-display-inline">In the case of an entity that does not use
or maintain an electronic medical record or electronic health record before the
date of the enactment of this Act with respect to such information, the date on
which the covered entity first uses or maintains an electronic medical record
or electronic health record, with respect to such information, and in the case
of an entity that uses or maintains an electronic medical record or electronic
health record with respect to such information before such date of enactment,
the date on which the covered entity upgrades such electronic medical record or
electronic health record.</text>
</subparagraph><subparagraph commented="no" id="H9FA1D3ABF4E1435F9604E1ACF4003E00"><enum>(B)</enum><text display-inline="yes-display-inline">If a standard that relates to technologies
that allow for an accounting for disclosures made by a covered entity for
purposes of treatment, payment, and health care operations is adopted under
section 3003(a) of the Public Health Service Act, as added by section 101, the
date that is 6 months after the date of such adoption.</text>
</subparagraph></paragraph></subsection><subsection commented="no" id="H03DC651F2AB4410A818BA21802F3F145"><enum>(d)</enum><header>Prohibition on
certain disclosures</header>
<paragraph id="H59E2CDDFAAE84E6AA29CBA5627CD57D6"><enum>(1)</enum><header>In
general</header><text>The following uses and disclosures shall not be
considered to be permitted uses or disclosures of protected health information
for purposes of subparts C and E of part 164 of title 45, Code of Federal
Regulations:</text>
<subparagraph id="HF354293AEDF24F7A88E8A644823F65A3"><enum>(A)</enum><header>Sale of
protected health information</header><text display-inline="yes-display-inline">The sale of any protected health
information of an individual by a covered entity or business associate unless
the covered entity or business associate obtains from the individual, in
accordance with <external-xref legal-doc="regulation" parsable-cite="cfr/45/164.508">section 164.508</external-xref> of title 45, Code of Federal Regulations, a
valid authorization (as described in paragraph (b) of such section) to sell
such information or unless the sale is for purposes of research and public
health activities (as described in sections 164.501, 164.512(i), and 164.512(b)
of title 45, Code of Federal Regulations) and the price charged reflects the
costs of preparation and transmittal of the data for such purposes.</text>
</subparagraph><subparagraph id="H69E869E74EAC45DCAF443F003FB5D5D2"><enum>(B)</enum><header>Re-identification
of de-identified information</header><text display-inline="yes-display-inline">In the case of an entity that has received
information that has been de-identified in accordance with section 164.514 of
title 45, Code of Federal Regulations, the re-identification by the entity of
such information.</text>
</subparagraph><subparagraph id="H934E62FEB7CF4B4E963882F7855BC176"><enum>(C)</enum><header>Identification
of individual through use of limited data set</header><text display-inline="yes-display-inline">In the case of an entity that has received
a limited data set (as defined in <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.514(e)(2)</external-xref> of title 45, Code of
Federal Regulations), the use, alone or in combination with other information,
of such set to identify the subject of the data set.</text>
</subparagraph></paragraph><paragraph id="H796D244B179F4B879997D3F51040155"><enum>(2)</enum><header>Limitation on
condition</header><text>In no case may a covered entity condition the provision
of treatment to an individual, or payment for such treatment, on the individual
providing authorization described in paragraph (1)(A).</text>
</paragraph><paragraph id="HF1F0F518EB4E4AB593B9C9248E118BD9"><enum>(3)</enum><header>Construction</header><text>Nothing
in this subsection shall be construed as limiting the authority of the
Secretary to adopt standards and guidance under section 3003(a) of the Public
Health Service Act, as added by section 101.</text>
</paragraph><paragraph id="HBDF2D134B3364326007D93033136C95C"><enum>(4)</enum><header>Effective
date</header><text>The provisions of this subsection shall apply to uses and
disclosures made on or after the date of the enactment of this Act.</text>
</paragraph></subsection><subsection id="HBF01CA56B6E9477F8F1244216809C8E8"><enum>(e)</enum><header>Access to
certain information in electronic format</header><text display-inline="yes-display-inline">In applying <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.524</external-xref> of title 45,
Code of Federal Regulations, in the case that a covered entity uses or
maintains an electronic medical record or electronic health record with respect
to protected health information of an individual—</text>
<paragraph id="H903CE434EE374D87B49193BC50134D65"><enum>(1)</enum><text>the individual
shall have a right to obtain from such covered entity a copy of such
information in an electronic format; and</text>
</paragraph><paragraph id="H322FEC13BF6F4C5591ABF2296DCB0200"><enum>(2)</enum><text>notwithstanding
paragraph (c)(4) of such section, the covered entity may not impose any fee for
providing such individual with a copy of such information (or a summary or
explanation of such information) if such copy (or summary or explanation) is in
an electronic form.</text>
</paragraph></subsection><subsection id="H0991E5B5378343C8A04FD0F0615CA735"><enum>(f)</enum><header>Application of
privacy regulations for making amendments to protected health information to
information in electronic format</header><text>In applying section 164.526 of
title 45, Code of Regulations, in the case of protected health information used
or maintained by a covered entity in an electronic medical record or electronic
health record, instead of any timeframes or deadlines described in such section
the Secretary may apply such timeframes and deadlines as the Secretary
determines to be appropriate.</text>
</subsection></section><section id="H2F745D026636472AA57C2E65D367CE3F"><enum>406.</enum><header>Limitations on
certain activities as part of health care operations</header>
<subsection id="H61AC6B42E83149F480354FDF1439664F"><enum>(a)</enum><header>Marketing</header>
<paragraph id="H08976F5F25154586A090D3C4ED3698C9"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A communication by a
covered entity or business associate that is about a product or service and
that encourages recipients of the communication to purchase or use the product
or service shall not be considered a health care operation for purposes of
subpart E of part 164 of title 45, Code of Federal Regulations, unless the
communication is made as described in subparagraph (i), (ii), or (iii) of
paragraph (1) of the definition of marketing in section 164.501 of such
title.</text>
</paragraph><paragraph id="HBB6529636F474B54A395AB54C077EAD1"><enum>(2)</enum><header>Payment for
certain communications</header><text display-inline="yes-display-inline">Subject to subparagraph (B), a covered
entity or business associate may not receive direct or indirect payment in
exchange for making any communication described in subparagraph (i), (ii), or
(iii) of paragraph (1) of the definition of marketing in section 164.501 of
title 45, Code of Federal Regulations, except—</text>
<subparagraph id="HCD1195304E7C4D8E8D2F70082D386B01"><enum>(A)</enum><text>a business
associate of a covered entity may receive payment from the covered entity for
making any such communication on behalf of the covered entity that is
consistent with the written contract (or other written arrangement) described
in section 164.502(e)(2) of such title between such business associate and
covered entity; and</text>
</subparagraph><subparagraph commented="no" id="H39CF839E788D4FFCA394E69EA1831639"><enum>(B)</enum><text>a covered entity
may receive payment in exchange for making any such communication if the entity
obtains from the recipient of the communication, in accordance with section
164.508 of title 45, Code of Federal Regulations, a valid authorization (as
described in paragraph (b) of such section), which shall be explicitly and
affirmatively provided by the recipient, with respect to such
communication.</text>
</subparagraph></paragraph></subsection><subsection id="HB1D9A0DC24F44DCC9B5F9516B78C21FA"><enum>(b)</enum><header>Fund
raising</header><text display-inline="yes-display-inline">Fundraising for the
benefit of a covered entity shall not be considered a health care operation for
purposes of <external-xref legal-doc="regulation" parsable-cite="cfr/45/164.501">section 164.501</external-xref> of title 45, Code of Federal Regulations.</text>
</subsection><subsection id="HF0B856D96E5E4072B935E84167E0DB42"><enum>(c)</enum><header>Effective
date</header><text display-inline="yes-display-inline">Subsections (a) and (b)
shall apply to contracting occurring on or after the effective date specified
under section 433.</text>
</subsection><subsection id="H4A6B81A95C5E49708DE7D03C302F6810"><enum>(d)</enum><header>Regulations</header>
<paragraph id="H7218970CA5C94BDD8D549E34B66FF069"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Not later than 18
months after the date of the enactment of this Act, the Secretary shall issue a
notice of proposed rulemaking in the Federal Register, taking into account the
report submitted under section 411 and the study under section 410, to
eliminate from the definition of health care operations under section 164.501
of title 45, Code of Federal Regulations, those activities (other than the
process of de-identifying health information) that can reasonably and
efficiently be conducted through the use of information that is de-identified
(in accordance with the requirements of section 164.514(b) of such title) or
that should require a valid authorization for use or disclosure. In
promulgating any such regulations, the Secretary may consider the form in which
the health information is maintained, such as non-electronic records.</text>
</paragraph><paragraph id="HCB56882C164D434E84E1C800404146D"><enum>(2)</enum><header>Considerations</header><text>In
promulgating any such regulations, the Secretary shall take into consideration
the extent to which—</text>
<subparagraph id="H323C32ED1BFD478FAC4ECB85B1EEF143"><enum>(A)</enum><text>specific health
care operations require the use or disclosure of protected health information;
and</text>
</subparagraph><subparagraph id="H3354ACEDFA4441888E00AC7CD4843300"><enum>(B)</enum><text>clinical utility
of such information would potentially be decreased in the case that such
information is de-identified or valid authorization is required; and</text>
</subparagraph><subparagraph id="HECD4D2C2619047409761D85388D17CAD"><enum>(C)</enum><text display-inline="yes-display-inline">the classification of health care
operations (as in existence as of the date of the enactment of this Act) under
<external-xref legal-doc="regulation" parsable-cite="cfr/45/164.501">section 164.501</external-xref> of title 45, Code of Federal Regulations, may be further
delineated.</text>
</subparagraph></paragraph></subsection></section><section commented="no" id="H7C6AF6E61D7540AA96CAD542EBE4467"><enum>407.</enum><header>Study and report
on application of privacy and security requirements to non-HIPAA covered
entities</header><text display-inline="no-display-inline">Not later than one
year after the date of the enactment of this Act, the Secretary, in
consultation with the Federal Trade Commission, shall conduct a study on
privacy and security requirements to entities that are not considered covered
entities as of the date of the enactment of this Act and submit to the
Committee on Finance and the Committee on Health, Education, Labor, and
Pensions of the Senate and the Committee on Ways and Means and the Committee on
Energy and Commerce of the House of Representatives a report on the findings of
the study, including—</text>
<paragraph commented="no" id="H2CD2ABBBB12C45DBB52DA1C8B9DE3828"><enum>(1)</enum><text>requirements
relating to security, privacy, and notification in the case of a breach of
security or privacy (including the applicability of an exemption to
notification in the case of individually identifiable health information that
has been rendered unusable, unreadable, or indecipherable through technologies
or methodologies recognized by appropriate professional organization or
standard setting bodies to provide effective security for the information) that
should be applied to—</text>
<subparagraph id="HFD1F443F3B0C4953B74361C12D3B4126"><enum>(A)</enum><text>vendors of
personal health records;</text>
</subparagraph><subparagraph id="HDA76459165FD4954A662F1467029DA1F"><enum>(B)</enum><text>entities that
offer products or services through the website of a vendor of personal health
records;</text>
</subparagraph><subparagraph id="H64008C0BB5AE4B18B6A726BABFCBAB54"><enum>(C)</enum><text>entities that are
not covered entities and that offer products or services through the websites
of covered entities that offer individuals personal health records;</text>
</subparagraph><subparagraph id="HB3236367906F4F85963610E53125C3FA"><enum>(D)</enum><text>entities that are
not covered entities and that access information in a personal health record or
send information to a personal health record; and</text>
</subparagraph><subparagraph id="H2D8DE12E31A5469C8EE1EE1DE7E41E4D"><enum>(E)</enum><text>third party
service providers used by a vendor or entity described in subparagraph (A),
(B), (C), or (D) to assist in providing personal health record products or
services;</text>
</subparagraph></paragraph><paragraph commented="no" id="HA220B0BB5B9F4F6E8DD323CDA483C9B"><enum>(2)</enum><text>a determination of
which Federal government agency is best equipped to enforce such requirements
recommended to be applied to such vendors, entities, and service providers
under paragraph (1); and</text>
</paragraph><paragraph id="HC7773C021CA248488678DAAAC0FD0000"><enum>(3)</enum><text display-inline="yes-display-inline">a timeframe for implementing regulations
based on such findings.</text>
</paragraph></section><section id="HF3CF3E454C7C47B68E07C89EF0B57320"><enum>408.</enum><header>Temporary
breach notification requirement for vendors of personal health records and
other non-HIPAA covered entities</header>
<subsection id="HA12603F34ACF4945B976841716048EFF"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">In accordance with
subsection (c), each vendor of personal health records, following the discovery
of a breach of security of unsecured PHR identifiable health information that
is in a personal health record maintained or offered by such vendor, and each
entity described in subparagraph (B), (C), or (D) of section 407(1), following
the discovery of a breach of security of such information that is obtained
through a product or service provided by such entity, shall—</text>
<paragraph id="HE3A115EB34DD47FE9F504122E99CFE00"><enum>(1)</enum><text>notify each
individual who is a citizen or resident of the United States whose unsecured
PHR identifiable health information was acquired by an unauthorized person as a
result of such a breach of security; and</text>
</paragraph><paragraph id="H538B4A9DE9FC4467BB96564D63B5A923"><enum>(2)</enum><text>notify the Federal
Trade Commission.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H25644096F84F42D7837D1000326746E6"><enum>(b)</enum><header>Notification by
third party service providers</header><text>A third party service provider that
provides services to a vendor of personal health records or to an entity
described in subparagraph (B), (C), or (D) of section 407(1) in connection with
the offering or maintenance of a personal health record or a related product or
service and that accesses, maintains, retains, modifies, records, stores,
destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable
health information in such a record as a result of such services shall,
following the discovery of a breach of security of such information, notify
such vendor or entity, respectively, of such breach. Such notice shall include
the identification of each individual whose unsecured PHR identifiable health
information has been, or is reasonably believed to have been, accessed,
acquired, or disclosed during such breach.</text>
</subsection><subsection id="H303F86ADD9244C0D97F21604BB634303"><enum>(c)</enum><header>Application of
requirements for timeliness, method, and content of
notifications</header><text>Subsections (c), (d), (e), and (f) of section 402
shall apply to a notification required under subsection (a) and a vendor of
personal health records, an entity described in subsection (a) and a third
party service provider described in subsection (b), with respect to a breach of
security under subsection (a) of unsecured PHR identifiable health information
in such records maintained or offered by such vendor, in a manner specified by
the Federal Trade Commission.</text>
</subsection><subsection id="H707FF6C79AB741338B16B944EF2500D9"><enum>(d)</enum><header>Notification of
the Secretary</header><text>Upon receipt of a notification of a breach of
security under subsection (a)(2), the Federal Trade Commission shall notify the
Secretary of such breach.</text>
</subsection><subsection id="H9FAA86E10C43412FB83E3E18C30500D6"><enum>(e)</enum><header>Enforcement</header><text>A
violation of subsection (a) or (b) shall be treated as an unfair and deceptive
act or practice in violation of a regulation under section 18(a)(1)(B) of the
<act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name> (15
U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.</text>
</subsection><subsection id="H7F0C1DA0BF0C4CE4A3B501DF5249FCA1"><enum>(f)</enum><header>Definitions</header><text display-inline="yes-display-inline">For purposes of this section:</text>
<paragraph id="H4C8E466CDD184CA2B07FEBA844089158"><enum>(1)</enum><header>Breach of
security</header><text>The term <term>breach of security</term> means, with
respect to unsecured PHR identifiable health information of an individual in a
personal health record, the acquisition, use, or disclosure of such information
without the authorization of the individual.</text>
</paragraph><paragraph commented="no" id="H491B40301DD74F188DA23E1CD88E8483"><enum>(2)</enum><header>PHR identifiable
health information</header><text>The term <term>PHR identifiable health
information</term> means individually identifiable health information, as
defined in section 1171(6) of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d">42 U.S.C. 1320d(6)</external-xref>), and
includes, with respect to an individual, information—</text>
<subparagraph commented="no" id="HA9044925EBF84E98BEACB4A8344B8F65"><enum>(A)</enum><text>that is provided
by or on behalf of the individual; and</text>
</subparagraph><subparagraph commented="no" id="H91C152AE58694F0FB47894298BFE1445"><enum>(B)</enum><text>that identifies
the individual or with respect to which there is a reasonable basis to believe
that the information can be used to identify the individual.</text>
</subparagraph></paragraph><paragraph id="HC83FC0C458024A63AC24EB341A219E"><enum>(3)</enum><header>Unsecured PHR
identifiable health information</header>
<subparagraph id="H15BCAC94DF7C492500B700345CC007D"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to
subparagraph (B), the term <quote>unsecured PHR identifiable health
information</quote> means PHR identifiable health information that is not
protected through the use of a technology or methodology specified by the
Secretary in the guidance issued under section 402(h)(2).</text>
</subparagraph><subparagraph id="H945AF1A5E6DF474998A0B3F3FFF18503"><enum>(B)</enum><header>Exception in
case timely guidance not issued</header><text display-inline="yes-display-inline">In the case that the Secretary does not
issue guidance under section 402(h)(2) by the date specified in such section,
for purposes of this section, the term <quote>unsecured PHR identifiable health
information</quote> shall mean information that is not protected by technology
standards developed or endorsed by a standards developing organization that is
accredited by the American National Standards Institute.</text>
</subparagraph></paragraph></subsection><subsection id="H82C62E2489B74314BD807041489B5439"><enum>(g)</enum><header>Effective date;
sunset</header>
<paragraph id="HAB9721B1625F417C897512D3E124777E"><enum>(1)</enum><header>In
general</header><text>Subject to paragraph (2), the provisions of this section
shall apply to breaches of security occurring during the period beginning on
the date that is 90 days after the date of the enactment of this Act.</text>
</paragraph><paragraph id="H229EFD9836A849A2ADDB1465EF083600"><enum>(2)</enum><header>Sunset</header><text display-inline="yes-display-inline">The provisions of this section shall not
apply to breaches of security occurring on or after the earlier of the
following:</text>
<subparagraph id="HA7575E61F67145FEA76BB2A8B5F328B0"><enum>(A)</enum><text>A standard
relating to requirements for entities that are not covered entities that
includes requirements relating to breach notification has been adopted by the
Secretary under section 3002 of the Public Health Service Act, as added by
section 101, and has taken effect.</text>
</subparagraph><subparagraph id="H51DEA53B0B464D7ABB98120810FCD2AC"><enum>(B)</enum><text>A standard
relating to requirements for entities that are not covered entities that
includes requirements relating to breach notification has been promulgated by
the Federal Trade Commission and has taken effect.</text>
</subparagraph></paragraph></subsection></section><section id="H4C4116ECE5A041A4B8AC14BC0019EE4D"><enum>409.</enum><header>Business
associate contracts required for certain entities; other provisions related to
business associate contracts</header>
<subsection id="H0B23E65FB80B42EDACE86D37E08CF50"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Each organization,
with respect to a covered entity, that provides data transmission of protected
health information to such entity and that requires access on a routine basis
to such protected health information, such as a Health Information Exchange,
Regional Health Information Organization, or E-prescribing Gateway and each
vendor of a personal health record that contracts with a covered entity for
purposes of including a personal health record within an electronic medical
record or electronic health record, is required to enter into a written
contract (or other written arrangement) described in section 164.502(e)(2) of
title 45, Code of Federal Regulations and a written contract (or other
arrangement) described in section 164.308(b) of such title, with such entity
and shall be treated as a business associate of the covered entity for purposes
of the provisions of this title and subparts C and E of title 45, Code of
Federal Regulations.</text>
</subsection><subsection id="HBDD2CF51BCA0402700EAA07ED74FAF2"><enum>(b)</enum><header>Covered entities
To monitor compliance of business associates</header>
<paragraph id="H06527BDFC8034881B0EA35D08F34BE00"><enum>(1)</enum><header>In
general</header><text>A covered entity shall monitor the extent to which a
business associate of such entity complies with the terms of the written
contract (or other arrangement) described in <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.502(e)(2)</external-xref> of title 45,
Code of Federal Regulations or section 164. 308(b) of such title, as
applicable, entered into between such entity and such business
associate.</text>
</paragraph><paragraph id="H68645E0435F7409AACC4EB1BD1C9D11B"><enum>(2)</enum><header>Enforcement</header><text>If
in the process of investigating a complaint related to a violation of the
requirements of this title or subpart C or E of title 45, Code of Federal
Regulations, committed by a business associate of a covered entity, the Office
for Civil Rights of the Department of Health and Human Services determines
that—</text>
<subparagraph id="HB044D2D0B4A0439E9CAFA27EED325FE"><enum>(A)</enum><text>the covered entity
reasonably should have known of a pattern of activity or practice of the
business associate that was not in compliance with the terms of a contract
described in paragraph (1) and that relates to such violation; and</text>
</subparagraph><subparagraph id="HD1F43366725541A6BDF678915D9058B0"><enum>(B)</enum><text>the covered entity
did not take action required under <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.504(e)(1)(ii)</external-xref> of title 45, Code
of Federal Regulations in response to such pattern or practice,</text>
</subparagraph><continuation-text continuation-text-level="paragraph">the covered
entity shall be treated, for purposes of section 1176 of the Social Security
Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>), as having violated part C of title XI of such
Act.</continuation-text></paragraph></subsection></section><section id="H18A5A52D05AF4B3B9103361659FD4F00"><enum>410.</enum><header>Guidance on
implementation specification to de-identify protected health
information</header><text display-inline="no-display-inline">Not later than 12
months after the date of the enactment of this Act, the Secretary shall, in
consultation with stakeholders, issue guidance on how best to implement the
requirements for the de-identification of protected health information under
<external-xref legal-doc="regulation" parsable-cite="cfr/45/164.514">section 164.514(b)</external-xref> of title 45, Code of Federal Regulations.</text>
</section><section commented="no" id="HAC5269BF38FC4BC4ABE846A81E637971"><enum>411.</enum><header>GAO report on
treatment, payment, and health care operations uses and
disclosures</header><text display-inline="no-display-inline">Not later than one
year after the date of the enactment of this Act, the Comptroller General of
the United States shall submit to the Committee on Finance and the Committee on
Health, Education, Labor, and Pensions of the Senate and the Committee on Ways
and Means and the Committee on Energy and Commerce of the House of
Representatives a report on—</text>
<paragraph commented="no" id="H141DC4641D7943618E5F9EA4F9C5DB71"><enum>(1)</enum><text>the best practices
related to the disclosure among health care providers of protected health
information of an individual for purposes of treatment of such individual,
including an examination of the best practices implemented by States and by
other entities, such as health information exchanges and regional health
information organizations, and an examination of the extent to which such best
practices are successful with respect to the quality of the resulting health
care provided to the individual and with respect to the ability of the health
care provider to manage such best practices; and</text>
</paragraph><paragraph commented="no" id="HB2ABB458F28B4215AFA6C9D71E86B600"><enum>(2)</enum><text display-inline="yes-display-inline">the best practices with respect to
determining the minimum necessary set of protected health information for uses
and disclosures of such information for purposes of payment and the most common
health care operations, as specified by the Secretary, including those health
care operations that could be reasonably and efficiently performed with either
de-identified data (as defined in <external-xref legal-doc="usc" parsable-cite="usc/45/164">section 164.514(a)</external-xref> of title 45, Code of
Federal Regulations) or the limited data set (as defined section 164.514(e)(1)
of such title).</text>
</paragraph></section><section commented="no" id="H2460E44D07E44F8AB6EB3647D8FE000"><enum>412.</enum><header>Clarification of
application of wrongful disclosures criminal penalties</header><text display-inline="no-display-inline">Section 1177(a) of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-6">42 U.S.C. 1320d–6(a)</external-xref>) is amended by adding at the end the following new
sentence: <quote>For purposes of the previous sentence, a person (including an
employee or other individual who is not a covered entity, as defined in the
HIPAA privacy regulation described in section 1180(b)(3)) shall be considered
to have obtained or disclosed individually identifiable health information in
violation of this part if the information is maintained by a covered entity (as
so defined) and the person knowingly obtained or disclosed such information
without authorization.</quote>.</text>
</section><section id="HF87942C16E2D4A5FA2BD29C64C32FC4F"><enum>413.</enum><header>Improved
enforcement</header>
<subsection id="H9178AD0B7A3C4A6EAC29BAF2665D0052"><enum>(a)</enum><header>Improved civil
penalties</header>
<paragraph id="H18D54E6362204A77BAD501E4EFDA7BF5"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 1176 of the
Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>) is amended—</text>
<subparagraph id="H9CF6A29DB9D543B58467DEF8600A89D"><enum>(A)</enum><text>in subsection
(b)(1), by striking <quote>the act constitutes an offense punishable under
section 1177</quote> and inserting <quote>a penalty has been imposed under
section 1177 with respect to such act</quote>; and</text>
</subparagraph><subparagraph id="H002AE6F48B734CA58E697D7213F5586F"><enum>(B)</enum><text>by adding at the
end the following new subsection:</text>
<quoted-block display-inline="no-display-inline" id="H29568B3A42E142B79F018D146444EF74" style="OLC">
<subsection id="H8C72CEF1D524499FB500FA8FB33F9F68"><enum>(c)</enum><header>Noncompliance
due to willful neglect</header>
<paragraph id="H65C7B37544014816BA40BCA6895E7247"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A violation of a
provision of this part due to willful neglect is a violation for which the
Secretary is required to impose a penalty under subsection (a)(1).</text>
</paragraph><paragraph id="H030F2684A8344F8997FB93AA13399732"><enum>(2)</enum><header>Required
investigation</header><text>For purposes of paragraph (1), the Secretary shall
formally investigate any complaint of a violation of a provision of this part
if a preliminary investigation of the facts of the complaint indicate such a
possible violation due to willful neglect.</text>
</paragraph><paragraph id="H48BFDE64CCDA4994A63DB04E829BE07F"><enum>(3)</enum><header>Regulations</header><text display-inline="yes-display-inline">Not later than 90 days after the date of
the enactment of the Health-e Information Technology Act of 2008, the Secretary
shall issue a notice of proposed rulemaking in the Federal Register to
implement this
subsection.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="H4DCBE09FF31A411D82C91C2194EF77CC"><enum>(2)</enum><header>Effective
date</header><text>The amendments made by paragraph (1) shall apply to
penalties imposed on or after the date specified in section 433.</text>
</paragraph></subsection><subsection id="H7830D0F7513248EF805691A507BB4EA8"><enum>(b)</enum><header>Distribution of
civil monetary penalties collected</header>
<paragraph id="HDA722E54A9DB4F0EB7C602B4BF35BAA"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to the
regulation promulgated pursuant to paragraph (3), any civil monetary penalty
collected with respect to an offense punishable under this title or section
1176 of the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5</external-xref>) shall be transferred to the
Office of Civil Rights of the Department of Health and Human Services to be
used for purposes of enforcing the provisions of this title and subparts C and
E of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph id="H6A857946B25441CEB962241122D2E48F"><enum>(2)</enum><header>GAO
report</header><text display-inline="yes-display-inline">Not later than 18
months after the date of the enactment of this Act, the Comptroller General
shall submit to the Secretary a report including recommendations for a
methodology under which an individual who is harmed by an act that constitutes
an offense punishable under this title or section 1176 of the Social Security
Act may receive a percentage of any civil monetary penalty collected with
respect to such offense under this title or such section.</text>
</paragraph><paragraph id="H0234E550839C4D8F9B7ED479A597B035"><enum>(3)</enum><header>Establishment of
methodology to distribute percentage of CMPs collected to harmed
individuals</header><text display-inline="yes-display-inline">Not later 3 years
after the date of the enactment of this Act, the Secretary shall establish by
regulation and based on the recommendations submitted under paragraph (2), a
methodology under which an individual who is harmed by an act that constitutes
an offense punishable under this title or section 1176 of the Social Security
Act may receive a percentage of any civil monetary penalty collected with
respect to such offense under this title or such section.</text>
</paragraph><paragraph id="HC60236B25F814969ADAF9F599DC4A982"><enum>(4)</enum><header>Application of
methodology</header><text>The methodology under paragraph (3) shall be applied
with respect to civil monetary penalties imposed on or after the effective date
of the regulation.</text>
</paragraph></subsection><subsection id="H6D9F4486EBBB441895A200EF64E9217E"><enum>(c)</enum><header>Tiered increase
in amount of civil monetary penalties</header>
<paragraph id="H92F4C855387E4A5582BB4100B4BAED7"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 1176(a)(1) of
the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5(a)(1)</external-xref>) is amended by striking
<quote>who violates a provision of this part a penalty of not more than</quote>
and all that follows and inserting the
following:</text>
<quoted-block display-inline="yes-display-inline" id="H54BF6C91969A4727B794D129D842CC13" style="OLC">
<text>who violates a provision of this
part—</text><subparagraph id="HC9E60DE4201E4A95B7A6A5F0B039917F"><enum>(A)</enum><text display-inline="yes-display-inline">in the case of a violation of such
provision in which it is established to the satisfaction of the Secretary that
the person did not know (and by exercising reasonable diligence would not have
known) that such person violated such provision, a penalty for each such
violation of an amount that is at least the amount described in paragraph
(3)(A) but not to exceed the amount described in paragraph (3)(D);</text>
</subparagraph><subparagraph id="H7AF2690627E24059B778ED44D27128C6"><enum>(B)</enum><text display-inline="yes-display-inline">in the case of a violation of such
provision in which it is established to the satisfaction of the Secretary that
the violation was due to reasonable cause and not to willful neglect, a penalty
for each such violation of an amount that is at least the amount described in
paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D);
and</text>
</subparagraph><subparagraph id="H4EF46C7187C64FEFB84D07087D7CB84B"><enum>(C)</enum><text display-inline="yes-display-inline">in the case of a violation of such
provision in which it is established to the satisfaction of the Secretary that
the violation was due to willful neglect—</text>
<clause id="HE26E36204A514476A613942E93A127F"><enum>(i)</enum><text>if
the violation is corrected as described in subsection (b)(3)(A), a penalty in
an amount that is at least the amount described in paragraph (3)(C) but not to
exceed the amount described in paragraph (3)(D); and</text>
</clause><clause id="HEDF478C07F4B465C85927FEBD22F49B3"><enum>(ii)</enum><text display-inline="yes-display-inline">if the violation is not corrected as
described in such subsection, a penalty in an amount that is at least the
amount described in paragraph (3)(D).</text>
</clause><continuation-text continuation-text-level="subparagraph">In
determining the amount of a penalty under this section for a violation, the
Secretary shall base such determination on the nature and extent of the
violation and the nature and extent of the harm resulting from such
violation.</continuation-text></subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="H9BD0D3A29AE147E4AB38886DEB6E9BBD"><enum>(2)</enum><header>Tiers of
penalties described</header><text display-inline="yes-display-inline">Section
1176(a) of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5(a)</external-xref>) is further amended by adding at the
end the following new paragraph:</text>
<quoted-block display-inline="no-display-inline" id="HC3E4550F720144AC8293E9D559E48F7" style="OLC">
<paragraph id="HF7B0D73FE2CC4A84A64B5FEA48C3002"><enum>(3)</enum><header>Tiers of
penalties described</header><text display-inline="yes-display-inline">For
purposes of paragraph (1), with respect to a violation by a person of a
provision of this part—</text>
<subparagraph id="H7FF0A2688FDC4F54AF14B8115FCA6F51"><enum>(A)</enum><text display-inline="yes-display-inline">the amount described in this subparagraph
is $100 for each such violation, except that the total amount imposed on the
person for all such violations of an identical requirement or prohibition
during a calendar year may not exceed $25,000;</text>
</subparagraph><subparagraph id="H7F93932D59694C849FBE2D2A526DA38"><enum>(B)</enum><text display-inline="yes-display-inline">the amount described in this subparagraph
is $1,000 for each such violation, except that the total amount imposed on the
person for all such violations of an identical requirement or prohibition
during a calendar year may not exceed $100,000;</text>
</subparagraph><subparagraph id="HE2336CB700A84F56A4FC28046C4FEBBE"><enum>(C)</enum><text display-inline="yes-display-inline">the amount described in this subparagraph
is $10,000 for each such violation, except that the total amount imposed on the
person for all such violations of an identical requirement or prohibition
during a calendar year may not exceed $250,000; and</text>
</subparagraph><subparagraph id="H2A63AE0EFA7F42C5BB36D74900232547"><enum>(D)</enum><text display-inline="yes-display-inline">the amount described in this subparagraph
is $50,000 for each such violation, except that the total amount imposed on the
person for all such violations of an identical requirement or prohibition
during a calendar year may not exceed
$1,500,000.</text>
</subparagraph></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="HD4775D54C17043FD9400C902A7B4DB5C"><enum>(3)</enum><header>Conforming
amendments</header><text display-inline="yes-display-inline">Section 1176(b) of
such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-5">42 U.S.C. 1320d–5(b)</external-xref>) is amended—</text>
<subparagraph id="H409245B3A1D64C35BEB2A73FD029B0F1"><enum>(A)</enum><text>by striking
paragraph (2) and redesignating paragraphs (3) and (4) as paragraphs (2) and
(3), respectively; and</text>
</subparagraph><subparagraph id="HD68A244BA8D7456389F16FFDAEE52413"><enum>(B)</enum><text>in paragraph
(3)—</text>
<clause id="H52F7F88015FD453588AD5843DB6C0324"><enum>(i)</enum><text>in
subparagraph (A), by striking <quote>in subparagraph (B), a penalty may not be
imposed under subsection (a) if</quote> and all that follows through <quote>the
failure to comply is corrected</quote> and inserting <quote>in subparagraph (B)
or subsection (a)(1)(C), a penalty may not be imposed under subsection (a) if
the failure to comply is corrected</quote>; and</text>
</clause><clause id="H996C345DCA59480E8308C5C5FE298861"><enum>(ii)</enum><text>in
subparagraph (B), by striking <quote>(A)(ii)</quote> each place it appears and
inserting <quote>(A)</quote>.</text>
</clause></subparagraph></paragraph><paragraph id="H979EFAE1A25E4E78B8B55991B6F06C84"><enum>(4)</enum><header>Effective
date</header><text>The amendments made by this subsection shall apply to
violations occurring after the date of the enactment of this Act.</text>
</paragraph></subsection><subsection id="H03EEDBE15C604DD4A16FA54E28FE491D"><enum>(d)</enum><header>Enforcement by
State attorneys general</header>
<paragraph id="H2453321A281D4A478C6358C861C756EB"><enum>(1)</enum><header>Civil
actions</header><text>In any case in which the attorney general of a State or
any State or local law enforcement agency authorized by the State attorney
general or by State law to prosecute violations of consumer protection laws,
has reason to believe that an interest of the residents of that State has been
or is threatened or adversely affected by the engagement of a person in a
practice that is prohibited under a provision of this title or subparts C or E
of title 45, Code of Federal Regulations, the State or local law enforcement
agency on behalf of the residents of the agency’s jurisdiction, may bring a
civil action on behalf of the residents of the State or jurisdiction in a
district court of the United States of appropriate jurisdiction to—</text>
<subparagraph id="H18D1F0792A924117B72C3F03777B78A5"><enum>(A)</enum><text>enjoin that act or
practice;</text>
</subparagraph><subparagraph id="H1CBFA6A4226843BDA7D38FFCCC55A925"><enum>(B)</enum><text>enforce compliance
with the provision; or</text>
</subparagraph><subparagraph id="HBB8B1F153F6A43628C253242094EFB1E"><enum>(C)</enum><text>obtain civil
penalties in an amount calculated by multiplying the number of violations by an
amount not greater than $11,000.</text>
</subparagraph></paragraph><paragraph id="HB20E1BB6B2DD44A09E7D97B6E2D3EDCF"><enum>(2)</enum><header>Rule of
construction</header><text>For purposes of bringing any civil action under
paragraph (1), nothing in this title regarding notification shall be construed
to prevent an attorney general of a State from exercising the powers conferred
on such attorney general by the laws of that State to—</text>
<subparagraph id="H958EE875CB1F46AE917615F37D4EF9CE"><enum>(A)</enum><text>conduct
investigations;</text>
</subparagraph><subparagraph id="H15B0F164945D4672B2AB1CAC81E005A7"><enum>(B)</enum><text>administer oaths
or affirmations; or</text>
</subparagraph><subparagraph id="H096F8334216347CA9B8211E24214E86C"><enum>(C)</enum><text>compel the
attendance of witnesses or the production of documentary and other
evidence.</text>
</subparagraph></paragraph><paragraph id="H91135A541E704EE0BEF3EE00069D77D5"><enum>(3)</enum><header>Venue; service
of process</header>
<subparagraph id="H403165FF127F4CEDA869A017C667534C"><enum>(A)</enum><header>Venue</header><text>Any
action brought under paragraph (1) may be brought in the district court of the
United States that meets applicable requirements relating to venue under
<external-xref legal-doc="usc" parsable-cite="usc/28/1391">section 1391</external-xref> of title 28, United States Code.</text>
</subparagraph><subparagraph id="H1E2D3F7BF1BD4D4C9962C71CC7E59EA"><enum>(B)</enum><header>Service of
process</header><text>In an action brought under paragraph (1), process may be
served in any district in which the defendant—</text>
<clause id="HDC887E9A185C4133A4A5566BC58C04C7"><enum>(i)</enum><text>is
an inhabitant; or</text>
</clause><clause id="H735231EE6AEA44DCB01F718B2C51718D"><enum>(ii)</enum><text>may
be found.</text>
</clause></subparagraph></paragraph></subsection></section><section id="H09A028C303964B7D92FD63BD5F71FBA2"><enum>414.</enum><header>Audits</header><text display-inline="no-display-inline">The Secretary shall provide for periodic
audits to ensure that entities that are subject to the requirements of this
title and subparts C and E of title 45, Code of Federal Regulations, comply
with such requirements.</text>
</section><section id="H85BC24B8FBDA406EAAE2D5CB8062EE26"><enum>415.</enum><header>Technical
amendment</header><text display-inline="no-display-inline">Section 1171(5) of
the Social Security Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320d">42 U.S.C. 1320d</external-xref>) is amended by striking <quote>or
C</quote> and inserting <quote>C, or D</quote>.</text>
</section></subtitle><subtitle id="H7FE79D2709D74C7991C1C8150091A76"><enum>B</enum><header>Chief Privacy
Officer of ONCHIT; Standards and guidance recommendations related to privacy
and security</header>
<section id="H11B8CE382C074957B950F929C7831F7E"><enum>421.</enum><header>Chief Privacy
Officer of the Office of the National Coordinator </header>
<subsection id="HACB7BB1B88134CB0AE48D61043AD2DB1"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">To assist the
National Coordinator in carrying out all the duties of the National Coordinator
relating to the privacy and security of health information, not later than 12
months after the date of the enactment of this Act, the Secretary shall appoint
a Chief Privacy Officer of the Office of the National Coordinator established
under section 3001(a) of the Public Health Service Act, as added by section
101.</text>
</subsection><subsection id="H665824A7271F42579900EC9D008DCB2"><enum>(b)</enum><header>Consultation</header><text>In
carrying out the duties under subsection (a), the Chief Privacy Officer shall
consult with the officials designated under subsection (c)(1) and is encouraged
to consult with officials in other Federal agencies who have primary
responsibility relating to the privacy and security of individually
identifiable information.</text>
</subsection><subsection id="H57F18407D51449C2A52BD16586F83C1E"><enum>(c)</enum><header>Coordination
with internal privacy officers</header><text>The Secretary shall ensure
that—</text>
<paragraph id="H413F78454E2240A6B1BFD0BDE8563EBE"><enum>(1)</enum><text>not later than 12
months after the date of the enactment of this Act, each agency specified by
the Secretary with the Department of Health and Human Services that deals with
health information has an official who is designated with specific
responsibilities with regard to the privacy and security of such information;
and</text>
</paragraph><paragraph id="H7845071CDCBE4818B51365657CE30C6"><enum>(2)</enum><text>such officials
coordinate their activities with the Chief Privacy Officer.</text>
</paragraph></subsection></section><section id="HC35C031DA26B40DA85076EF6C729FAFD"><enum>422.</enum><header>Additional
standards and guidance recommendations related to privacy and security</header>
<subsection id="HCD4692AD76334CD7BE2B79DD71DC1451"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">In carrying out
section 3001(c)(2) of the Public Health Service Act, as added by section 101,
the National Coordinator shall—</text>
<paragraph id="H7250915EA33F4439A2E11BED12753474"><enum>(1)</enum><text>periodically
recommend to the Secretary standards and guidance related to ensuring the
privacy and security of health information for purposes of adoption under
section 3003(a) of such Act, as so added; and</text>
</paragraph><paragraph id="H59E453D9FF3D4DF4BBE41DBB2F707100"><enum>(2)</enum><text>periodically
review and revise as necessary health information privacy and security
standards and regulations implemented under this title and subparts C and E of
title 45, Code of Federal Regulations.</text>
</paragraph></subsection><subsection id="HAFAFEFDB2C114849AC7F7507FA6BC2D"><enum>(b)</enum><header>Specific
recommendations</header><text display-inline="yes-display-inline">For purposes
of subsection (a), the National Coordinator shall submit to the Secretary
recommendations on at least the following:</text>
<paragraph id="HAC2A5D65E40B43D383B7E2F227C57300"><enum>(1)</enum><header>Application of
HIPAA to entities that aren’t covered entities</header><text>Taking into
account the results of the study conducted under section 407,
recommendations—</text>
<subparagraph id="H7F1AE632E0C54FD19093F5C86C9216CC"><enum>(A)</enum><text>on the extent to
which the provisions of this title and subparts C and E of title 45, Code of
Federal Regulations, should apply to entities using, disclosing or receiving
health information that are not included under this title or such subparts as a
covered entity or business associate; and</text>
</subparagraph><subparagraph id="H07FD673289164EA194C81E1500469B4D"><enum>(B)</enum><text>that identify to
which entities that are not so included should such provisions apply.</text>
</subparagraph></paragraph><paragraph id="HDD731DB8D806447186FC064CB992B3BC"><enum>(2)</enum><header>Collection
Limitations</header><text>Recommendations identifying under what circumstances
and for what purposes protected health information may be collected, including
model notices for such purposes as necessary and recommendations about which of
such purposes should require separate, prior authorization from the individual
involved. Such recommendations shall provide that—</text>
<subparagraph id="H3EE7E35B27904329B6EEB81134B4866"><enum>(A)</enum><text>such collection
will occur in a transparent process;</text>
</subparagraph><subparagraph id="H311DC2C3E5794FD196D069C9D3D88873"><enum>(B)</enum><text>such collection
shall be in accordance with applicable Federal, State, and local laws;
and</text>
</subparagraph><subparagraph id="H4960F852D2244E98BAACB5EE14A85617"><enum>(C)</enum><text>such collection
may only occur for the purposes specified by the entity collecting the
information and such purposes must be so specified at least not later than the
time of collection.</text>
</subparagraph></paragraph><paragraph id="HB97C97999855415F9FCC2E018374AEC8"><enum>(3)</enum><header>Disclosure and
use limitations</header><text>Recommendations identifying the circumstances
under which, to whom, and for what purposes protected health information may be
used or disclosed, including—</text>
<subparagraph id="H4ABC2022B0994C9CB4F90000828B61F5"><enum>(A)</enum><text>recommendations
about what uses or purposes are permitted or required (taking into account that
protected health information shall be disclosed in a non-identifiable manner to
the maximum extent possible);</text>
</subparagraph><subparagraph id="H9CF113CE36954B9D915498957BAF3643"><enum>(B)</enum><text>recommendations on
best practices on de-identifying data;</text>
</subparagraph><subparagraph id="HF9D2057F77614E13B7AD6DBE5686B4B6"><enum>(C)</enum><text display-inline="yes-display-inline">recommendations for a technical standard
that allows for the de-identification of health information;</text>
</subparagraph><subparagraph id="H732C9844EB424A49AECB2065AA1C97D6"><enum>(D)</enum><text>recommendations on
how to segregate sensitive protected health information with the goal of
minimizing the reluctance of patients to seek care (or disclose information
about a condition) because of privacy concerns involving sensitive protected
health information while maximizing patient safety and clinical utility of the
information;</text>
</subparagraph><subparagraph id="H4B0FBC8B437D46E6821E659C39F85FD8"><enum>(E)</enum><text>recommendations to
define the “minimum necessary” set of health information for the most common
treatment and health care operations, as specified by the Secretary; and</text>
</subparagraph><subparagraph id="H4F166E9E32A0441D925E01EA7B4340F2"><enum>(F)</enum><text>recommendations
for standardized notification describing, in terms that are easily
understandable to individuals, permissible uses and disclosures for the most
common payment and health care operations purposes and specific to the most
common covered entities.</text>
</subparagraph></paragraph><paragraph id="H388C53A50813404885ADFB6E718839EE"><enum>(4)</enum><header>Electronic
health records and electronic medical records security features</header><text display-inline="yes-display-inline">Recommendations on security features, such
as user authentication, identity management tools, and data scrubbing, that
electronic health records must have in order to receive certification under the
program under section 3001(c)(3) of the Public Health Service Act, as added by
section 101. Such recommendations shall include at a minimum recommendations
with respect to immutable audit trails.</text>
</paragraph><paragraph id="H833FA2DAE70E46FE9F698EA5FAEE5778"><enum>(5)</enum><header>Data
accuracy</header><text>Recommendations on how to maximize the accuracy of
health information used or disclosed.</text>
</paragraph><paragraph id="H89011B00EF454CD5A59EC9321E5BA493"><enum>(6)</enum><header>Accountability</header><text>Recommendations
on how to best provide for accountability for uses and disclosures of health
information.</text>
</paragraph><paragraph id="H8CE1444B74F243F0A5D68D09BB776DD"><enum>(7)</enum><header>Transparency</header><text>Recommendations
on how to maximize the transparency and openness of health information privacy
and security policies, including requiring that notices informing individuals
of such policies be written in an understandable and simple manner and clearly
and simply describe what the privacy and security policies are and how
individuals can access their protected health information and amend it.</text>
</paragraph><paragraph id="H1C04146C6A6C47B4AB8BA0CAA37851BB"><enum>(8)</enum><header>Enforcement</header><text>Recommendation
on how to improve and revise the enforcement of this title and subparts C and E
of title 45, Code of Federal Regulations.</text>
</paragraph><paragraph id="HCB028D1C5E9D4548AF6930D6B81C4E76"><enum>(9)</enum><header>Reductions in
breaches</header><text>Recommendations on how to reduce the number and scope of
breaches, taking into account information received by the Secretary under
section 3002(e)(3) of the Public Health Service Act.</text>
</paragraph><continuation-text continuation-text-level="subsection">The
National Coordinator shall, to the maximum extent practicable, include the
recommendations described in paragraphs (1), (3)(C), (3)(D), and (4) in the
initial set of recommendations submitted by the Coordinator under section
3001(c)(2)(A) of the Public Health Service Act, as added by section 101.</continuation-text></subsection></section></subtitle><subtitle id="H5CBEFD562D994DFFAE3FCBCEFD47A2ED"><enum>C</enum><header>Relationship to
other laws; regulatory references; effective date</header>
<section commented="no" display-inline="no-display-inline" id="H00F2C81B99034B118476E026AEE46225" section-type="subsequent-section"><enum>431.</enum><header>Relationship to
other laws</header>
<subsection commented="no" id="H1FF0A21224464B7F8514146C56590062"><enum>(a)</enum><header>Application of
HIPAA State preemption</header><text>Section 1178 of the Social Security Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320d-7">42 U.S.C. 1320d–7</external-xref>) shall apply to a provision or requirement under this title
in the same manner that such section applies to a provision or requirement
under part C of title XI of such Act or a standard or implementation
specification adopted or established under sections 1172 through 1174 of such
Act.</text>
</subsection><subsection commented="no" id="HF0A2F65EBB1643DDBE00BE644E04EE7D"><enum>(b)</enum><header>Health Insurance
Portability and Accountability Act</header><text display-inline="yes-display-inline">The standards governing the privacy and
security of individually identifiable health information promulgated by the
Secretary under sections 262(a) and 264 of the Health Insurance Portability and
Accountability Act of 1996 shall remain in effect to the extent that they are
consistent with this title. The Secretary shall by rule amend such Federal
regulations as required to make such regulations consistent with this
title.</text>
</subsection></section><section id="H874B89666CF84CF881C735C2EF65A67F"><enum>432.</enum><header>Regulatory
references</header><text display-inline="no-display-inline">Each reference in
this title to a provision of the Code of Federal Regulations refers to such
provision as in effect on the date of the enactment of this Act (or to the most
recent update of such provision).</text>
</section><section commented="no" display-inline="no-display-inline" id="H869FC86B7D964FC2B7B812C91FCDC5C5" section-type="subsequent-section"><enum>433.</enum><header>Effective
date</header><text display-inline="no-display-inline">The provisions of
subtitles A and B of this title (other than sections 401(c), 402, 403, 405(c),
405(d), 406(d), 407, 408, 410, 411, 412, 413(b)(2), 413(b)(3), 413(c), 415,
421, 422, 431, and 432) shall take effect on the date that is 12 months after
the date of the enactment of this Act.</text>
</section></subtitle>