IB Union Calendar No. 3 111th CONGRESS 1st Session H. R. 629 [Report No. 111–7, Part I] IN THE HOUSE OF REPRESENTATIVES January 22, 2009 Mr. Waxman introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, Education and Labor, and Science and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned January 26, 2009 Reported from the Committee on Energy and Commerce with an amendment Strike out all after the enacting clause and insert the part printed in italic January 27, 2009 The Committees on Ways and Means, Education and Labor, and Science and Technology discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed For text of introduced bill, see copy of bill as introduced on January 22, 2009 A BILL To provide energy and commerce provisions of the American Recovery and Reinvestment Act of 2009.

1.

Short title

This Act may be cited as the Energy and Commerce Recovery and Reinvestment Act.

2.

Table of contents

The table of contents of this Act is as follows: Sec. 1. Short title. Sec. 2. Table of contents. Title I—Broadband Communications Sec. 1001. Inventory of Broadband Service Capability and Availability. Sec. 1002. Wireless and Broadband Deployment Grant Programs. Sec. 1003. National broadband plan. Title II—Energy Sec. 2001. Technical corrections to the Energy Independence and Security Act of 2007. Sec. 2002. Amendments to title XIII of the Energy Independence and Security Act of 2007. Sec. 2003. Renewable energy and electric power transmission loan guarantee program. Sec. 2004. Weatherization Assistance Program amendments. Sec. 2005. Renewable electricity transmission study. Sec. 2006. Additional State energy grants. Sec. 2007. Inapplicability of limitation. Title III—Health insurance assistance for the unemployed Sec. 3001. Short title and table of contents of title. Sec. 3002. Premium assistance for COBRA benefits and extension of COBRA benefits for older or long-term employees. Sec. 3003. Temporary optional Medicaid coverage for the unemployed. Title IV—Health Information Technology Sec. 4001. Short title; table of contents of title. Subtitle A—Promotion of Health Information Technology Part 1—Improving health care quality, safety, and efficiency Sec. 4101. ONCHIT; standards development and adoption. Sec. 4102. Technical amendment. Sec. 4103. American technology required. Part 2—Application and use of adopted health information technology standards; reports Sec. 4111. Coordination of Federal activities with adopted standards and implementation specifications. Sec. 4112. Application to private entities. Sec. 4113. Study and reports. Subtitle B—Testing of Health Information Technology Sec. 4201. National Institute for Standards and Technology testing. Sec. 4202. Research and development programs. Subtitle C—Incentives for the Use of Health Information Technology Part I—Grants and loans funding Sec. 4301. Grant, loan, and demonstration programs. Part II—Medicare program Sec. 4311. Incentives for eligible professionals. Sec. 4312. Incentives for hospitals. Sec. 4313. Treatment of payments and savings; implementation funding. Sec. 4314. Study on application of EHR payment incentives for providers not receiving other incentive payments. Part III—Medicaid Funding Sec. 4321. Medicaid provider HIT adoption and operation payments; implementation funding. Subtitle D—Privacy Sec. 4400. Definitions. Part I—Improved Privacy Provisions and Security Provisions Sec. 4401. Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions. Sec. 4402. Notification in the case of breach. Sec. 4403. Education on Health Information Privacy. Sec. 4404. Application of privacy provisions and penalties to business associates of covered entities. Sec. 4405. Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format. Sec. 4406. Conditions on certain contacts as part of health care operations. Sec. 4407. Temporary breach notification requirement for vendors of personal health records and other non-HIPAA covered entities. Sec. 4408. Business associate contracts required for certain entities. Sec. 4409. Clarification of application of wrongful disclosures criminal penalties. Sec. 4410. Improved enforcement. Sec. 4411. Audits. Sec. 4412. Securing individually identifiable health information. Sec. 4413. Special rule for information to reduce medication errors and improve patient safety. Part II—Relationship to other laws; regulatory references; effective date; reports Sec. 4421. Relationship to other laws. Sec. 4422. Regulatory references. Sec. 4423. Effective date. Sec. 4424. Studies, reports, guidance. Title V—Medicaid Provisions Sec. 5000. Table of contents of title. Sec. 5001. Temporary increase of Medicaid FMAP. Sec. 5002. Moratoria on certain regulations. Sec. 5003. Transitional Medicaid assistance (TMA). Sec. 5004. State eligibility option for family planning services. Sec. 5005. Protections for Indians under Medicaid and CHIP. Sec. 5006. Consultation on Medicaid and CHIP. Sec. 5007. Temporary increase in DSH allotments during recession.

3000.

Definitions

In this title: (1)

Certified EHR technology

The term certified EHR technology means a qualified electronic health record that is certified pursuant to section 3001(c)(5) as meeting standards adopted under section 3004 that are applicable to the type of record involved (as determined by the Secretary, such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals). (2)

Enterprise integration

The term enterprise integration means the electronic linkage of health care providers, health plans, the government, and other interested parties, to enable the electronic exchange and use of health information among all the components in the health care infrastructure in accordance with applicable law, and such term includes related application protocols and other related standards. (3)

Health care provider

The term health care provider means a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, Federally qualified health center, group practice (as defined in section 1877(h)(4) of the Social Security Act), a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1861(r) of the Social Security Act), a practitioner (as described in section 1842(b)(18)(C) of the Social Security Act), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act), tribal organization, or urban Indian organization (as defined in section 4 of the Indian Health Care Improvement Act), a rural health clinic, a covered entity under section 340B, an ambulatory surgical center described in section 1833(i) of the Social Security Act, and any other category of facility or clinician determined appropriate by the Secretary. (4)

Health information

The term health information has the meaning given such term in section 1171(4) of the Social Security Act. (5)

Health information technology

The term health information technology means hardware, software, integrated technologies and related licenses, intellectual property, upgrades, and packaged solutions sold as services that are specifically designed for use by health care entities for the electronic creation, maintenance, or exchange of health information. (6)

Health plan

The term health plan has the meaning given such term in section 1171(5) of the Social Security Act. (7)

HIT Policy Committee

The term HIT Policy Committee means such Committee established under section 3002(a). (8)

HIT Standards Committee

The term HIT Standards Committee means such Committee established under section 3003(a). (9)

Individually identifiable health information

The term individually identifiable health information has the meaning given such term in section 1171(6) of the Social Security Act. (10)

Laboratory

The term laboratory has the meaning given such term in section 353(a). (11)

National Coordinator

The term National Coordinator means the head of the Office of the National Coordinator for Health Information Technology established under section 3001(a). (12)

Pharmacist

The term pharmacist has the meaning given such term in section 804(2) of the Federal Food, Drug, and Cosmetic Act. (13)

Qualified electronic health record

The term qualified electronic health record means an electronic record of health-related information on an individual that— (A)includes patient demographic and clinical health information, such as medical history and problem lists; and (B)has the capacity— (i)to provide clinical decision support; (ii)to support physician order entry; (iii)to capture and query information relevant to health care quality; and (iv)to exchange electronic health information with, and integrate such information from other sources. (14)

State

The term State means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.

A

Promotion of Health Information Technology

3001.

Office of the National Coordinator for Health Information Technology

(a)

Establishment

There is established within the Department of Health and Human Services an Office of the National Coordinator for Health Information Technology (referred to in this section as the Office). The Office shall be headed by a National Coordinator who shall be appointed by the Secretary and shall report directly to the Secretary. (b)

Purpose

The National Coordinator shall perform the duties under subsection (c) in a manner consistent with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of information and that— (1)ensures that each patient’s health information is secure and protected, in accordance with applicable law; (2)improves health care quality, reduces medical errors, reduces health disparities, and advances the delivery of patient-centered medical care; (3)reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete information; (4)provides appropriate information to help guide medical decisions at the time and place of care; (5)ensures the inclusion of meaningful public input in such development of such infrastructure; (6)improves the coordination of care and information among hospitals, laboratories, physician offices, and other entities through an effective infrastructure for the secure and authorized exchange of health care information; (7)improves public health activities and facilitates the early identification and rapid response to public health threats and emergencies, including bioterror events and infectious disease outbreaks; (8)facilitates health and clinical research and health care quality; (9)promotes prevention of chronic diseases; (10)promotes a more effective marketplace, greater competition, greater systems analysis, increased consumer choice, and improved outcomes in health care services; and (11)improves efforts to reduce health disparities. (c)

Duties of the National Coordinator

(1)

Standards

The National Coordinator shall review and determine whether to endorse each standard, implementation specification, and certification criterion for the electronic exchange and use of health information that is recommended by the HIT Standards Committee under section 3003 for purposes of adoption under section 3004. The Coordinator shall make such determination, and report to the Secretary such determination, not later than 45 days after the date the recommendation is received by the Coordinator. (2)

HIT policy coordination

(A)

In general

The National Coordinator shall coordinate health information technology policy and programs of the Department with those of other relevant executive branch agencies with a goal of avoiding duplication of efforts and of helping to ensure that each agency undertakes health information technology activities primarily within the areas of its greatest expertise and technical capability and in a manner towards a coordinated national goal. (B)

HIT Policy and Standards Committees

The National Coordinator shall be a leading member in the establishment and operations of the HIT Policy Committee and the HIT Standards Committee and shall serve as a liaison among those two Committees and the Federal Government. (3)

Strategic plan

(A)

In general

The National Coordinator shall, in consultation with other appropriate Federal agencies (including the National Institute of Standards and Technology), update the Federal Health IT Strategic Plan (developed as of June 3, 2008) to include specific objectives, milestones, and metrics with respect to the following: (i)The electronic exchange and use of health information and the enterprise integration of such information. (ii)The utilization of an electronic health record for each person in the United States by 2014. (iii)The incorporation of privacy and security protections for the electronic exchange of an individual’s individually identifiable health information. (iv)Ensuring security methods to ensure appropriate authorization and electronic authentication of health information and specifying technologies or methodologies for rendering health information unusable, unreadable, or indecipherable. (v)Specifying a framework for coordination and flow of recommendations and policies under this subtitle among the Secretary, the National Coordinator, the HIT Policy Committee, the HIT Standards Committee, and other health information exchanges and other relevant entities. (vi)Methods to foster the public understanding of health information technology. (vii)Strategies to enhance the use of health information technology in improving the quality of health care, reducing medical errors, reducing health disparities, improving public health, and improving the continuity of care among health care settings. (B)

Collaboration

The strategic plan shall be updated through collaboration of public and private entities. (C)

Measurable outcome goals

The strategic plan update shall include measurable outcome goals. (D)

Publication

The National Coordinator shall republish the strategic plan, including all updates. (4)

Website

The National Coordinator shall maintain and frequently update an Internet website on which there is posted information on the work, schedules, reports, recommendations, and other information to ensure transparency in promotion of a nationwide health information technology infrastructure. (5)

Certification

(A)

In general

The National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall develop a program (either directly or by contract) for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle. Such program shall include testing of the technology in accordance with section 4201(b) of the HITECH Act. (B)

Certification criteria described

In this title, the term certification criteria means, with respect to standards and implementation specifications for health information technology, criteria to establish that the technology meets such standards and implementation specifications. (6)

Reports and publications

(A)

Report on additional funding or authority needed

Not later than 12 months after the date of the enactment of this title, the National Coordinator shall submit to the appropriate committees of jurisdiction of the House of Representatives and the Senate a report on any additional funding or authority the Coordinator or the HIT Policy Committee or HIT Standards Committee requires to evaluate and develop standards, implementation specifications, and certification criteria, or to achieve full participation of stakeholders in the adoption of a nationwide health information technology infrastructure that allows for the electronic use and exchange of health information. (B)

Implementation report

The National Coordinator shall prepare a report that identifies lessons learned from major public and private health care systems in their implementation of health information technology, including information on whether the technologies and practices developed by such systems may be applicable to and usable in whole or in part by other health care providers. (C)

Assessment of impact of HIT on communities with health disparities and uninsured, underinsured, and medically underserved areas

The National Coordinator shall assess and publish the impact of health information technology in communities with health disparities and in areas with a high proportion of individuals who are uninsured, underinsured, and medically underserved individuals (including urban and rural areas) and identify practices to increase the adoption of such technology by health care providers in such communities. (D)

Evaluation of benefits and costs of the electronic use and exchange of health information

The National Coordinator shall evaluate and publish evidence on the benefits and costs of the electronic use and exchange of health information and assess to whom these benefits and costs accrue. (E)

Resource requirements

The National Coordinator shall estimate and publish resources required annually to reach the goal of utilization of an electronic health record for each person in the United States by 2014, including the required level of Federal funding, expectations for regional, State, and private investment, and the expected contributions by volunteers to activities for the utilization of such records. (7)

Assistance

The National Coordinator may provide financial assistance to consumer advocacy groups and not-for-profit entities that work in the public interest for purposes of defraying the cost to such groups and entities to participate under, whether in whole or in part, the National Technology Transfer Act of 1995 (15 U.S.C. 272 note). (8)

Governance for nationwide health information network

The National Coordinator shall establish a governance mechanism for the nationwide health information network. (d)

Detail of Federal Employees

(1)

In general

Upon the request of the National Coordinator, the head of any Federal agency is authorized to detail, with or without reimbursement from the Office, any of the personnel of such agency to the Office to assist it in carrying out its duties under this section. (2)

Effect of detail

Any detail of personnel under paragraph (1) shall— (A)not interrupt or otherwise affect the civil service status or privileges of the Federal employee; and (B)be in addition to any other staff of the Department employed by the National Coordinator. (3)

Acceptance of detailees

Notwithstanding any other provision of law, the Office may accept detailed personnel from other Federal agencies without regard to whether the agency described under paragraph (1) is reimbursed. (e)

Chief Privacy Officer of the Office of the National Coordinator

Not later than 12 months after the date of the enactment of this title, the Secretary shall appoint a Chief Privacy Officer of the Office of the National Coordinator, whose duty it shall be to advise the National Coordinator on privacy, security, and data stewardship of electronic health information and to coordinate with other Federal agencies (and similar privacy officers in such agencies), with State and regional efforts, and with foreign countries with regard to the privacy, security, and data stewardship of electronic individually identifiable health information.

3002.

HIT Policy Committee

(a)

Establishment

There is established a HIT Policy Committee to make policy recommendations to the National Coordinator relating to the implementation of a nationwide health information technology infrastructure, including implementation of the strategic plan described in section 3001(c)(3). (b)

Duties

(1)

Recommendations on health information technology infrastructure

The HIT Policy Committee shall recommend a policy framework for the development and adoption of a nationwide health information technology infrastructure that permits the electronic exchange and use of health information as is consistent with the strategic plan under section 3001(c)(3) and that includes the recommendations under paragraph (2). The Committee shall update such recommendations and make new recommendations as appropriate. (2)

Specific areas of standard development

(A)

In general

The HIT Policy Committee shall recommend the areas in which standards, implementation specifications, and certification criteria are needed for the electronic exchange and use of health information for purposes of adoption under section 3004 and shall recommend an order of priority for the development, harmonization, and recognition of such standards, specifications, and certification criteria among the areas so recommended. Such standards and implementation specifications shall include named standards, architectures, and software schemes for the authentication and security of individually identifiable health information and other information as needed to ensure the reproducible development of common solutions across disparate entities. (B)

Areas required for consideration

For purposes of subparagraph (A), the HIT Policy Committee shall make recommendations for at least the following areas: (i)Technologies that protect the privacy of health information and promote security in a qualified electronic health record, including for the segmentation and protection from disclosure of specific and sensitive individually identifiable health information with the goal of minimizing the reluctance of patients to seek care (or disclose information about a condition) because of privacy concerns, in accordance with applicable law, and for the use and disclosure of limited data sets of such information. (ii)A nationwide health information technology infrastructure that allows for the electronic use and accurate exchange of health information. (iii)The utilization of a certified electronic health record for each person in the United States by 2014. (iv)Technologies that as a part of a qualified electronic health record allow for an accounting of disclosures made by a covered entity (as defined for purposes of regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996) for purposes of treatment, payment, and health care operations (as such terms are defined for purposes of such regulations). (v)The use of certified electronic health records to improve the quality of health care, such as by promoting the coordination of health care and improving continuity of health care among health care providers, by reducing medical errors, by improving population health, by reducing health disparities, and by advancing research and education. (C)

Other areas for consideration

In making recommendations under subparagraph (A), the HIT Policy Committee may consider the following additional areas: (i)The appropriate uses of a nationwide health information infrastructure, including for purposes of— (I)the collection of quality data and public reporting; (II)biosurveillance and public health; (III)medical and clinical research; and (IV)drug safety. (ii)Self-service technologies that facilitate the use and exchange of patient information and reduce wait times. (iii)Telemedicine technologies, in order to reduce travel requirements for patients in remote areas. (iv)Technologies that facilitate home health care and the monitoring of patients recuperating at home. (v)Technologies that help reduce medical errors. (vi)Technologies that facilitate the continuity of care among health settings. (vii)Technologies that meet the needs of diverse populations. (viii)Any other technology that the HIT Policy Committee finds to be among the technologies with the greatest potential to improve the quality and efficiency of health care. (3)

Forum

The HIT Policy Committee shall serve as a forum for broad stakeholder input with specific expertise in policies relating to the matters described in paragraphs (1) and (2). (c)

Membership and operations

(1)

In general

The National Coordinator shall provide leadership in the establishment and operations of the HIT Policy Committee. (2)

Membership

The membership of the HIT Policy Committee shall at least reflect providers, ancillary healthcare workers, consumers, purchasers, health plans, technology vendors, researchers, relevant Federal agencies, and individuals with technical expertise on health care quality, privacy and security, and on the electronic exchange and use of health information. (3)

Consideration

The National Coordinator shall ensure that the relevant recommendations and comments from the National Committee on Vital and Health Statistics are considered in the development of policies. (d)

Application of FACA

The Federal Advisory Committee Act (5 U.S.C. App.), other than section 14 of such Act, shall apply to the HIT Policy Committee. (e)

Publication

The Secretary shall provide for publication in the Federal Register and the posting on the Internet website of the Office of the National Coordinator for Health Information Technology of all policy recommendations made by the HIT Policy Committee under this section.

3003.

HIT Standards Committee

(a)

Establishment

There is established a committee to be known as the HIT Standards Committee to recommend to the National Coordinator standards, implementation specifications, and certification criteria for the electronic exchange and use of health information for purposes of adoption under section 3004, consistent with the implementation of the strategic plan described in section 3001(c)(3) and beginning with the areas listed in section 3002(b)(2)(B) in accordance with policies developed by the HIT Policy Committee. (b)

Duties

(1)

Standards development

(A)

In general

The HIT Standards Committee shall recommend to the National Coordinator standards, implementation specifications, and certification criteria described in subsection (a) that have been developed, harmonized, or recognized by the HIT Standards Committee. The HIT Standards Committee shall update such recommendations and make new recommendations as appropriate, including in response to a notification sent under section 3004(b)(2). Such recommendations shall be consistent with the latest recommendations made by the HIT Policy Committee. (B)

Pilot testing of standards and implementation specifications

In the development, harmonization, or recognition of standards and implementation specifications, the HIT Standards Committee shall, as appropriate, provide for the testing of such standards and specifications by the National Institute for Standards and Technology under section 4201 of the HITECH Act. (C)

Consistency

The standards, implementation specifications, and certification criteria recommended under this subsection shall be consistent with the standards for information transactions and data elements adopted pursuant to section 1173 of the Social Security Act. (2)

Forum

The HIT Standards Committee shall serve as a forum for the participation of a broad range of stakeholders to provide input on the development, harmonization, and recognition of standards, implementation specifications, and certification criteria necessary for the development and adoption of a nationwide health information technology infrastructure that allows for the electronic use and exchange of health information. (3)

Schedule

Not later than 90 days after the date of the enactment of this title, the HIT Standards Committee shall develop a schedule for the assessment of policy recommendations developed by the HIT Policy Committee under section 3002. The HIT Standards Committee shall update such schedule annually. The Secretary shall publish such schedule in the Federal Register. (4)

Public input

The HIT Standards Committee shall conduct open public meetings and develop a process to allow for public comment on the schedule described in paragraph (3) and recommendations described in this subsection. Under such process comments shall be submitted in a timely manner after the date of publication of a recommendation under this subsection. (c)

Membership and operations

(1)

In general

The National Coordinator shall provide leadership in the establishment and operations of the HIT Standards Committee. (2)

Membership

The membership of the HIT Standards Committee shall at least reflect providers, ancillary healthcare workers, consumers, purchasers, health plans, technology vendors, researchers, relevant Federal agencies, and individuals with technical expertise on health care quality, privacy and security, and on the electronic exchange and use of health information. (3)

Consideration

The National Coordinator shall ensure that the relevant recommendations and comments from the National Committee on Vital and Health Statistics are considered in the development of standards. (4)

Assistance

For the purposes of carrying out this section, the Secretary may provide or ensure that financial assistance is provided by the HIT Standards Committee to defray in whole or in part any membership fees or dues charged by such Committee to those consumer advocacy groups and not for profit entities that work in the public interest as a part of their mission. (d)

Application of FACA

The Federal Advisory Committee Act (5 U.S.C. App.), other than section 14, shall apply to the HIT Standards Committee. (e)

Publication

The Secretary shall provide for publication in the Federal Register and the posting on the Internet website of the Office of the National Coordinator for Health Information Technology of all recommendations made by the HIT Standards Committee under this section.

3004.

Process for adoption of endorsed recommendations; adoption of initial set of standards, implementation specifications, and certification criteria

(a)

Process for adoption of endorsed recommendations

(1)

Review of endorsed standards, implementation specifications, and certification criteria

Not later than 90 days after the date of receipt of standards, implementation specifications, or certification criteria endorsed under section 3001(c), the Secretary, in consultation with representatives of other relevant Federal agencies, shall jointly review such standards, implementation specifications, or certification criteria and shall determine whether or not to propose adoption of such standards, implementation specifications, or certification criteria. (2)

Determination to adopt standards, implementation specifications, and certification criteria

If the Secretary determines— (A)to propose adoption of any grouping of such standards, implementation specifications, or certification criteria, the Secretary shall, by regulation, determine whether or not to adopt such grouping of standards, implementation specifications, or certification criteria; or (B)not to propose adoption of any grouping of standards, implementation specifications, or certification criteria, the Secretary shall notify the National Coordinator and the HIT Standards Committee in writing of such determination and the reasons for not proposing the adoption of such recommendation. (3)

Publication

The Secretary shall provide for publication in the Federal Register of all determinations made by the Secretary under paragraph (1). (b)

Adoption of initial set of standards, implementation specifications, and certification criteria

(1)

In general

Not later than December 31, 2009, the Secretary shall, through the rulemaking process described in section 3003, adopt an initial set of standards, implementation specifications, and certification criteria for the areas required for consideration under section 3002(b)(2)(B). (2)

Application of current standards, implementation specifications, and certification criteria

The standards, implementation specifications, and certification criteria adopted before the date of the enactment of this title through the process existing through the Office of the National Coordinator for Health Information Technology may be applied towards meeting the requirement of paragraph (1).

3005.

Application and use of adopted standards and implementation specifications by Federal agencies

For requirements relating to the application and use by Federal agencies of the standards and implementation specifications adopted under section 3004, see section 4111 of the HITECH Act.

3006.

Voluntary application and use of adopted standards and implementation specifications by private entities

(a)

In general

Except as provided under section 4112 of the HITECH Act, any standard or implementation specification adopted under section 3004 shall be voluntary with respect to private entities. (b)

Rule of construction

Nothing in this subtitle shall be construed to require that a private entity that enters into a contract with the Federal Government apply or use the standards and implementation specifications adopted under section 3004 with respect to activities not related to the contract.

3007.

Federal health information technology

(a)

In general

The National Coordinator shall support the development, routine updating, and provision of qualified EHR technology (as defined in section 3000) consistent with subsections (b) and (c) unless the Secretary determines that the needs and demands of providers are being substantially and adequately met through the marketplace. (b)

Certification

In making such EHR technology publicly available, the National Coordinator shall ensure that the qualified EHR technology described in subsection (a) is certified under the program developed under section 3001(c)(3) to be in compliance with applicable standards adopted under section 3003(a). (c)

Authorization To charge a nominal fee

The National Coordinator may impose a nominal fee for the adoption by a health care provider of the health information technology system developed or approved under subsection (a) and (b). Such fee shall take into account the financial circumstances of smaller providers, low income providers, and providers located in rural or other medically underserved areas. (d)

Rule of construction

Nothing in this section shall be construed to require that a private or government entity adopt or use the technology provided under this section.

3008.

Transitions

(a)

ONCHIT

To the extent consistent with section 3001, all functions, personnel, assets, liabilities, and administrative actions applicable to the National Coordinator for Health Information Technology appointed under Executive Order 13335 or the Office of such National Coordinator on the date before the date of the enactment of this title shall be transferred to the National Coordinator appointed under section 3001(a) and the Office of such National Coordinator as of the date of the enactment of this title. (b)

AHIC

(1)To the extent consistent with sections 3002 and 3003, all functions, personnel, assets, and liabilities applicable to the AHIC Successor, Inc. doing business as the National eHealth Collaborative as of the day before the date of the enactment of this title shall be transferred to the HIT Policy Committee or the HIT Standards Committee, established under section 3002(a) or 3003(a), as appropriate, as of the date of the enactment of this title. (2)In carrying out section 3003(b)(1)(A), until recommendations are made by the HIT Policy Committee, recommendations of the HIT Standards Committee shall be consistent with the most recent recommendations made by such AHIC Successor, Inc. (c)

Rules of construction

(1)

ONCHIT

Nothing in section 3001 or subsection (a) shall be construed as requiring the creation of a new entity to the extent that the Office of the National Coordinator for Health Information Technology established pursuant to Executive Order 13335 is consistent with the provisions of section 3001. (2)

AHIC

Nothing in sections 3002 or 3003 or subsection (b) shall be construed as prohibiting the AHIC Successor, Inc. doing business as the National eHealth Collaborative from modifying its charter, duties, membership, and any other structure or function required to be consistent with section 3002 and 3003 in a manner that would permit the Secretary to choose to recognize such AHIC Successor, Inc. as the HIT Policy Committee or the HIT Standards Committee.

3009.

Relation to HIPAA privacy and security law

(a)

In general

With respect to the relation of this title to HIPAA privacy and security law: (1)This title may not be construed as having any effect on the authorities of the Secretary under HIPAA privacy and security law. (2)The purposes of this title include ensuring that the health information technology standards and implementation specifications adopted under section 3004 take into account the requirements of HIPAA privacy and security law. (b)

Definition

For purposes of this section, the term HIPAA privacy and security law means— (1)the provisions of part C of title XI of the Social Security Act, section 264 of the Health Insurance Portability and Accountability Act of 1996, and subtitle D of title IV of the HITECH Act; and (2)regulations under such provisions.

3010.

Authorization for appropriations

There is authorized to be appropriated to the Office of the National Coordinator for Health Information Technology to carry out this subtitle $250,000,000 for fiscal year 2009.

.

4102.

Technical amendment

Section 1171(5) of the Social Security Act (42 U.S.C. 1320d) is amended by striking or C and inserting C, or D.

4103.

American technology required

(a)

Requirement

Any funds made available to carry out this title and the amendments made by this title (including through grants, contracts, loans, payments under title XVIII or XIX of the Social Security Act, or other assistance) may be used to purchase health information technology only if such technology is manufactured, including the engineering and programming of any software, in the United States substantially all from articles, materials, or supplies mined, produced, or manufactured, as the case may be, in the United States. (b)

Definition

In this section, the term health information technology has the meaning given to that term in section 3000 of the Public Health Service Act, as added by section 4101.

2

Application and use of adopted health information technology standards; reports

4111.

Coordination of Federal activities with adopted standards and implementation specifications

(a)

Spending on health information technology systems

As each agency (as defined in the Executive Order issued on August 22, 2006, relating to promoting quality and efficient health care in Federal government administered or sponsored health care programs) implements, acquires, or upgrades health information technology systems used for the direct exchange of individually identifiable health information between agencies and with non-Federal entities, it shall utilize, where available, health information technology systems and products that meet standards and implementation specifications adopted under section 3004 of the Public Health Service Act, as added by section 4101. (b)

Federal information collection activities

With respect to a standard or implementation specification adopted under section 3004 of the Public Health Service Act, as added by section 4101, the President shall take measures to ensure that Federal activities involving the broad collection and submission of health information are consistent with such standard or implementation specification, respectively, within three years after the date of such adoption. (c)

Application of definitions

The definitions contained in section 3000 of the Public Health Service Act, as added by section 4101, shall apply for purposes of this part.

4112.

Application to private entities

Each agency (as defined in such Executive Order issued on August 22, 2006, relating to promoting quality and efficient health care in Federal government administered or sponsored health care programs) shall require in contracts or agreements with health care providers, health plans, or health insurance issuers that as each provider, plan, or issuer implements, acquires, or upgrades health information technology systems, it shall utilize, where available, health information technology systems and products that meet standards and implementation specifications adopted under section 3004 of the Public Health Service Act, as added by section 4101.

4113.

Study and reports

(a)

Report on adoption of nationwide system

Not later than 2 years after the date of the enactment of this Act and annually thereafter, the Secretary of Health and Human Services shall submit to the appropriate committees of jurisdiction of the House of Representatives and the Senate a report that— (1)describes the specific actions that have been taken by the Federal Government and private entities to facilitate the adoption of a nationwide system for the electronic use and exchange of health information; (2)describes barriers to the adoption of such a nationwide system; and (3)contains recommendations to achieve full implementation of such a nationwide system. (b)

Reimbursement incentive study and report

(1)

Study

The Secretary of Health and Human Services shall carry out, or contract with a private entity to carry out, a study that examines methods to create efficient reimbursement incentives for improving health care quality in Federally qualified health centers, rural health clinics, and free clinics. (2)

Report

Not later than 2 years after the date of the enactment of this Act, the Secretary of Health and Human Services shall submit to the appropriate committees of jurisdiction of the House of Representatives and the Senate a report on the study carried out under paragraph (1). (c)

Aging services technology study and report

(1)

In general

The Secretary of Health and Human Services shall carry out, or contract with a private entity to carry out, a study of matters relating to the potential use of new aging services technology to assist seniors, individuals with disabilities, and their caregivers throughout the aging process. (2)

Matters to be studied

The study under paragraph (1) shall include— (A)an evaluation of— (i)methods for identifying current, emerging, and future health technology that can be used to meet the needs of seniors and individuals with disabilities and their caregivers across all aging services settings, as specified by the Secretary; (ii)methods for fostering scientific innovation with respect to aging services technology within the business and academic communities; and (iii)developments in aging services technology in other countries that may be applied in the United States; and (B)identification of— (i)barriers to innovation in aging services technology and devising strategies for removing such barriers; and (ii)barriers to the adoption of aging services technology by health care providers and consumers and devising strategies to removing such barriers. (3)

Report

Not later than 24 months after the date of the enactment of this Act, the Secretary shall submit to the appropriate committees of jurisdiction of the House of Representatives and of the Senate a report on the study carried out under paragraph (1). (4)

Definitions

For purposes of this subsection: (A)

Aging services technology

The term aging services technology means health technology that meets the health care needs of seniors, individuals with disabilities, and the caregivers of such seniors and individuals. (B)

Senior

The term senior has such meaning as specified by the Secretary.

B

Testing of Health Information Technology

4201.

National Institute for Standards and Technology testing

(a)

Pilot testing of standards and implementation specifications

In coordination with the HIT Standards Committee established under section 3003 of the Public Health Service Act, as added by section 4101, with respect to the development of standards and implementation specifications under such section, the Director of the National Institute for Standards and Technology shall test such standards and implementation specifications, as appropriate, in order to assure the efficient implementation and use of such standards and implementation specifications. (b)

Voluntary testing program

In coordination with the HIT Standards Committee established under section 3003 of the Public Health Service Act, as added by section 4101, with respect to the development of standards and implementation specifications under such section, the Director of the National Institute of Standards and Technology shall support the establishment of a conformance testing infrastructure, including the development of technical test beds. The development of this conformance testing infrastructure may include a program to accredit independent, non-Federal laboratories to perform testing.

4202.

Research and development programs

(a)

Health care Information Enterprise Integration Research Centers

(1)

In general

The Director of the National Institute of Standards and Technology, in consultation with the Director of the National Science Foundation and other appropriate Federal agencies, shall establish a program of assistance to institutions of higher education (or consortia thereof which may include nonprofit entities and Federal Government laboratories) to establish multidisciplinary Centers for Health Care Information Enterprise Integration. (2)

Review; competition

Grants shall be awarded under this subsection on a merit-reviewed, competitive basis. (3)

Purpose

The purposes of the Centers described in paragraph (1) shall be— (A)to generate innovative approaches to health care information enterprise integration by conducting cutting-edge, multidisciplinary research on the systems challenges to health care delivery; and (B)the development and use of health information technologies and other complementary fields. (4)

Research areas

Research areas may include— (A)interfaces between human information and communications technology systems; (B)voice-recognition systems; (C)software that improves interoperability and connectivity among health information systems; (D)software dependability in systems critical to health care delivery; (E)measurement of the impact of information technologies on the quality and productivity of health care; (F)health information enterprise management; (G)health information technology security and integrity; and (H)relevant health information technology to reduce medical errors. (5)

Applications

An institution of higher education (or a consortium thereof) seeking funding under this subsection shall submit an application to the Director of the National Institute of Standards and Technology at such time, in such manner, and containing such information as the Director may require. The application shall include, at a minimum, a description of— (A)the research projects that will be undertaken by the Center established pursuant to assistance under paragraph (1) and the respective contributions of the participating entities; (B)how the Center will promote active collaboration among scientists and engineers from different disciplines, such as information technology, biologic sciences, management, social sciences, and other appropriate disciplines; (C)technology transfer activities to demonstrate and diffuse the research results, technologies, and knowledge; and (D)how the Center will contribute to the education and training of researchers and other professionals in fields relevant to health information enterprise integration. (b)

National Information Technology Research and Development Program

The National High-Performance Computing Program established by section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) shall coordinate Federal research and development programs related to the development and deployment of health information technology, including activities related to— (1)computer infrastructure; (2)data security; (3)development of large-scale, distributed, reliable computing systems; (4)wired, wireless, and hybrid high-speed networking; (5)development of software and software-intensive systems; (6)human-computer interaction and information management technologies; and (7)the social and economic implications of information technology.

C

Incentives for the Use of Health Information Technology

I

Grants and loans funding

4301.

Grant, loan, and demonstration programs

Title XXX of the Public Health Service Act, as added by section 4101, is amended by adding at the end the following new subtitle: B

Incentives for the Use of Health Information Technology

3011.

Immediate funding to strengthen the health information technology infrastructure

(a)

In general

The Secretary shall, using amounts appropriated under section 3018, invest in the infrastructure necessary to allow for and promote the electronic exchange and use of health information for each individual in the United States consistent with the goals outlined in the strategic plan developed by the National Coordinator (and as available) under section 3001. To the greatest extent practicable, the Secretary shall ensure that any funds so appropriated shall be used for the acquisition of health information technology that meets standards and certification criteria adopted before the date of the enactment of this title until such date as the standards are adopted under section 3004. The Secretary shall invest funds through the different agencies with expertise in such goals, such as the Office of the National Coordinator for Health Information Technology, the Health Resources and Services Administration, the Agency for Healthcare Research and Quality, the Centers of Medicare & Medicaid Services, the Centers for Disease Control and Prevention, and the Indian Health Service to support the following: (1)Health information technology architecture that will support the nationwide electronic exchange and use of health information in a secure, private, and accurate manner, including connecting health information exchanges, and which may include updating and implementing the infrastructure necessary within different agencies of the Department of Health and Human Services to support the electronic use and exchange of health information. (2)Development and adoption of appropriate certified electronic health records for categories of providers, as defined in section 3000, not eligible for support under title XVIII or XIX of the Social Security Act for the adoption of such records. (3)Training on and dissemination of information on best practices to integrate health information technology, including electronic health records, into a provider’s delivery of care, consistent with best practices learned from the Health Information Technology Research Center developed under section 3012(b), including community health centers receiving assistance under section 330, covered entities under section 340B, and providers participating in one or more of the programs under titles XVIII, XIX, and XXI of the Social Security Act (relating to Medicare, Medicaid, and the State Children’s Health Insurance Program). (4)Infrastructure and tools for the promotion of telemedicine, including coordination among Federal agencies in the promotion of telemedicine. (5)Promotion of the interoperability of clinical data repositories or registries. (6)Promotion of technologies and best practices that enhance the protection of health information by all holders of individually identifiable health information. (7)Improvement and expansion of the use of health information technology by public health departments. (8)Provision of $300 million to support regional or sub-national efforts towards health information exchange. (b)

Coordination

The Secretary shall ensure funds under this section are used in a coordinated manner with other health information promotion activities. (c)

Additional Use of Funds

In addition to using funds as provided in subsection (a), the Secretary may use amounts appropriated under section 3018 to carry out health information technology activities that are provided for under laws in effect on the date of the enactment of this title.

3012.

Health information technology implementation assistance

(a)

Health information technology extension program

To assist health care providers to adopt, implement, and effectively use certified EHR technology that allows for the electronic exchange and use of health information, the Secretary, acting through the Office of the National Coordinator, shall establish a health information technology extension program to provide health information technology assistance services to be carried out through the Department of Health and Human Services. The National Coordinator shall consult with other Federal agencies with demonstrated experience and expertise in information technology services, such as the National Institute of Standards and Technology, in developing and implementing this program. (b)

Health information technology research center

(1)

In general

The Secretary shall create a Health Information Technology Research Center (in this section referred to as the Center) to provide technical assistance and develop or recognize best practices to support and accelerate efforts to adopt, implement, and effectively utilize health information technology that allows for the electronic exchange and use of information in compliance with standards, implementation specifications, and certification criteria adopted under section 3004. (2)

Input

The Center shall incorporate input from— (A)other Federal agencies with demonstrated experience and expertise in information technology services such as the National Institute of Standards and Technology; (B)users of health information technology, such as providers and their support and clerical staff and others involved in the care and care coordination of patients, from the health care and health information technology industry; and (C)others as appropriate. (3)

Purposes

The purposes of the Center are to— (A)provide a forum for the exchange of knowledge and experience; (B)accelerate the transfer of lessons learned from existing public and private sector initiatives, including those currently receiving Federal financial support; (C)assemble, analyze, and widely disseminate evidence and experience related to the adoption, implementation, and effective use of health information technology that allows for the electronic exchange and use of information including through the regional centers described in subsection (c); (D)provide technical assistance for the establishment and evaluation of regional and local health information networks to facilitate the electronic exchange of information across health care settings and improve the quality of health care; (E)provide technical assistance for the development and dissemination of solutions to barriers to the exchange of electronic health information; and (F)learn about effective strategies to adopt and utilize health information technology in medically underserved communities. (c)

Health information technology regional extension centers

(1)

In general

The Secretary shall provide assistance for the creation and support of regional centers (in this subsection referred to as regional centers) to provide technical assistance and disseminate best practices and other information learned from the Center to support and accelerate efforts to adopt, implement, and effectively utilize health information technology that allows for the electronic exchange and use of information in compliance with standards, implementation specifications, and certification criteria adopted under section 3004. Activities conducted under this subsection shall be consistent with the strategic plan developed by the National Coordinator, (and, as available) under section 3001. (2)

Affiliation

Regional centers shall be affiliated with any United States-based nonprofit institution or organization, or group thereof, that applies and is awarded financial assistance under this section. Individual awards shall be decided on the basis of merit. (3)

Objective

The objective of the regional centers is to enhance and promote the adoption of health information technology through— (A)assistance with the implementation, effective use, upgrading, and ongoing maintenance of health information technology, including electronic health records, to healthcare providers nationwide; (B)broad participation of individuals from industry, universities, and State governments; (C)active dissemination of best practices and research on the implementation, effective use, upgrading, and ongoing maintenance of health information technology, including electronic health records, to health care providers in order to improve the quality of healthcare and protect the privacy and security of health information; (D)participation, to the extent practicable, in health information exchanges; and (E)utilization, when appropriate, of the expertise and capability that exists in Federal agencies other than the Department; and (F)integration of health information technology, including electronic health records, into the initial and ongoing training of health professionals and others in the healthcare industry that would be instrumental to improving the quality of healthcare through the smooth and accurate electronic use and exchange of health information. (4)

Regional assistance

Each regional center shall aim to provide assistance and education to all providers in a region, but shall prioritize any direct assistance first to the following: (A)Public or not-for-profit hospitals or critical access hospitals. (B)Federally qualified health centers (as defined in section 1861(aa)(4) of the Social Security Act). (C)Entities that are located in rural and other areas that serve uninsured, underinsured, and medically underserved individuals (regardless of whether such area is urban or rural). (D)Individual or small group practices (or a consortium thereof) that are primarily focused on primary care. (5)

Financial support

The Secretary may provide financial support to any regional center created under this subsection for a period not to exceed four years. The Secretary may not provide more than 50 percent of the capital and annual operating and maintenance funds required to create and maintain such a center, except in an instance of national economic conditions which would render this cost-share requirement detrimental to the program and upon notification to Congress as to the justification to waive the cost-share requirement. (6)

Notice of program description and availability of funds

The Secretary shall publish in the Federal Register, not later than 90 days after the date of the enactment of this title, a draft description of the program for establishing regional centers under this subsection. Such description shall include the following: (A)A detailed explanation of the program and the programs goals. (B)Procedures to be followed by the applicants. (C)Criteria for determining qualified applicants. (D)Maximum support levels expected to be available to centers under the program. (7)

Application review

The Secretary shall subject each application under this subsection to merit review. In making a decision whether to approve such application and provide financial support, the Secretary shall consider at a minimum the merits of the application, including those portions of the application regarding— (A)the ability of the applicant to provide assistance under this subsection and utilization of health information technology appropriate to the needs of particular categories of health care providers; (B)the types of service to be provided to health care providers; (C)geographical diversity and extent of service area; and (D)the percentage of funding and amount of in-kind commitment from other sources. (8)

Biennial evaluation

Each regional center which receives financial assistance under this subsection shall be evaluated biennially by an evaluation panel appointed by the Secretary. Each evaluation panel shall be composed of private experts, none of whom shall be connected with the center involved, and of Federal officials. Each evaluation panel shall measure the involved center’s performance against the objective specified in paragraph (3). The Secretary shall not continue to provide funding to a regional center unless its evaluation is overall positive. (9)

Continuing support

After the second year of assistance under this subsection, a regional center may receive additional support under this subsection if it has received positive evaluations and a finding by the Secretary that continuation of Federal funding to the center was in the best interest of provision of health information technology extension services.

3013.

State grants to promote health information technology

(a)

In general

The Secretary, acting through the National Coordinator, shall establish a program in accordance with this section to facilitate and expand the electronic movement and use of health information among organizations according to nationally recognized standards. (b)

Planning grants

The Secretary may award a grant to a State or qualified State-designated entity (as described in subsection (f)) that submits an application to the Secretary at such time, in such manner, and containing such information as the Secretary may specify, for the purpose of planning activities described in subsection (d). (c)

Implementation grants

The Secretary may award a grant to a State or qualified State designated entity that— (1)has submitted, and the Secretary has approved, a plan described in subsection (e) (regardless of whether such plan was prepared using amounts awarded under subsection (b); and (2)submits an application at such time, in such manner, and containing such information as the Secretary may specify. (d)

Use of funds

Amounts received under a grant under subsection (c) shall be used to conduct activities to facilitate and expand the electronic movement and use of health information among organizations according to nationally recognized standards through activities that include— (1)enhancing broad and varied participation in the authorized and secure nationwide electronic use and exchange of health information; (2)identifying State or local resources available towards a nationwide effort to promote health information technology; (3)complementing other Federal grants, programs, and efforts towards the promotion of health information technology; (4)providing technical assistance for the development and dissemination of solutions to barriers to the exchange of electronic health information; (5)promoting effective strategies to adopt and utilize health information technology in medically underserved communities; (6)assisting patients in utilizing health information technology; (7)encouraging clinicians to work with Health Information Technology Regional Extension Centers as described in section 3012, to the extent they are available and valuable; (8)supporting public health agencies’ authorized use of and access to electronic health information; (9)promoting the use of electronic health records for quality improvement including through quality measures reporting; and (10)such other activities as the Secretary may specify. (e)

Plan

(1)

In general

A plan described in this subsection is a plan that describes the activities to be carried out by a State or by the qualified State-designated entity within such State to facilitate and expand the electronic movement and use of health information among organizations according to nationally recognized standards and implementation specifications. (2)

Required elements

A plan described in paragraph (1) shall— (A)be pursued in the public interest; (B)be consistent with the strategic plan developed by the National Coordinator, (and, as available) under section 3001; (C)include a description of the ways the State or qualified State-designated entity will carry out the activities described in subsection (b); and (D)contain such elements as the Secretary may require. (f)

Qualified State-designated entity

For purposes of this section, to be a qualified State-designated entity, with respect to a State, an entity shall— (1)be designated by the State as eligible to receive awards under this section; (2)be a not-for-profit entity with broad stakeholder representation on its governing board; (3)demonstrate that one of its principal goals is to use information technology to improve health care quality and efficiency through the authorized and secure electronic exchange and use of health information; (4)adopt nondiscrimination and conflict of interest policies that demonstrate a commitment to open, fair, and nondiscriminatory participation by stakeholders; and (5)conform to such other requirements as the Secretary may establish. (g)

Required consultation

In carrying out activities described in subsections (b) and (c), a State or qualified State-designated entity shall consult with and consider the recommendations of— (1)health care providers (including providers that provide services to low income and underserved populations); (2)health plans; (3)patient or consumer organizations that represent the population to be served; (4)health information technology vendors; (5)health care purchasers and employers; (6)public health agencies; (7)health professions schools, universities and colleges; (8)clinical researchers; (9)other users of health information technology such as the support and clerical staff of providers and others involved in the care and care coordination of patients; and (10)such other entities, as may be determined appropriate by the Secretary. (h)

Continuous improvement

The Secretary shall annually evaluate the activities conducted under this section and shall, in awarding grants under this section, implement the lessons learned from such evaluation in a manner so that awards made subsequent to each such evaluation are made in a manner that, in the determination of the Secretary, will lead towards the greatest improvement in quality of care, decrease in costs, and the most effective authorized and secure electronic exchange of health information. (i)

Required match

(1)

In general

For a fiscal year (beginning with fiscal year 2011), the Secretary may not make a grant under this section to a State unless the State agrees to make available non-Federal contributions (which may include in-kind contributions) toward the costs of a grant awarded under subsection (c) in an amount equal to— (A)for fiscal year 2011, not less than $1 for each $10 of Federal funds provided under the grant; (B)for fiscal year 2012, not less than $1 for each $7 of Federal funds provided under the grant; and (C)for fiscal year 2013 and each subsequent fiscal year, not less than $1 for each $3 of Federal funds provided under the grant. (2)

Authority to require State match for fiscal years before fiscal year 2011

For any fiscal year during the grant program under this section before fiscal year 2011, the Secretary may determine the extent to which there shall be required a non-Federal contribution from a State receiving a grant under this section.

3014.

Competitive grants to States and Indian tribes for the development of loan programs to facilitate the widespread adoption of certified EHR technology

(a)

In general

The National Coordinator may award competitive grants to eligible entities for the establishment of programs for loans to health care providers to conduct the activities described in subsection (e). (b)

Eligible entity defined

For purposes of this subsection, the term eligible entity means a State or Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act) that— (1)submits to the National Coordinator an application at such time, in such manner, and containing such information as the National Coordinator may require; (2)submits to the National Coordinator a strategic plan in accordance with subsection (d) and provides to the National Coordinator assurances that the entity will update such plan annually in accordance with such subsection; (3)provides assurances to the National Coordinator that the entity will establish a Loan Fund in accordance with subsection (c); (4)provides assurances to the National Coordinator that the entity will not provide a loan from the Loan Fund to a health care provider unless the provider agrees to— (A)submit reports on quality measures adopted by the Federal Government (by not later than 90 days after the date on which such measures are adopted), to— (i)the Administrator of the Centers for Medicare & Medicaid Services (or his or her designee), in the case of an entity participating in the Medicare program under title XVIII of the Social Security Act or the Medicaid program under title XIX of such Act; or (ii)the Secretary in the case of other entities; (B)demonstrate to the satisfaction of the Secretary (through criteria established by the Secretary) that any certified EHR technology purchased, improved, or otherwise financially supported under a loan under this section is used to exchange health information in a manner that, in accordance with law and standards (as adopted under section 3004) applicable to the exchange of information, improves the quality of health care, such as promoting care coordination; (C)comply with such other requirements as the entity or the Secretary may require; (D)include a plan on how health care providers involved intend to maintain and support the certified EHR technology over time; and (E)include a plan on how the health care providers involved intend to maintain and support the certified EHR technology that would be purchased with such loan, including the type of resources expected to be involved and any such other information as the State or Indian Tribe, respectively, may require; and (5)agrees to provide matching funds in accordance with subsection (h). (c)

Establishment of fund

For purposes of subsection (b)(3), an eligible entity shall establish a certified EHR technology loan fund (referred to in this subsection as a Loan Fund) and comply with the other requirements contained in this section. A grant to an eligible entity under this section shall be deposited in the Loan Fund established by the eligible entity. No funds authorized by other provisions of this title to be used for other purposes specified in this title shall be deposited in any Loan Fund. (d)

Strategic plan

(1)

In general

For purposes of subsection (b)(2), a strategic plan of an eligible entity under this subsection shall identify the intended uses of amounts available to the Loan Fund of such entity. (2)

Contents

A strategic plan under paragraph (1), with respect to a Loan Fund of an eligible entity, shall include for a year the following: (A)A list of the projects to be assisted through the Loan Fund during such year. (B)A description of the criteria and methods established for the distribution of funds from the Loan Fund during the year. (C)A description of the financial status of the Loan Fund as of the date of submission of the plan. (D)The short-term and long-term goals of the Loan Fund. (e)

Use of funds

Amounts deposited in a Loan Fund, including loan repayments and interest earned on such amounts, shall be used only for awarding loans or loan guarantees, making reimbursements described in subsection (g)(4)(A), or as a source of reserve and security for leveraged loans, the proceeds of which are deposited in the Loan Fund established under subsection (c). Loans under this section may be used by a health care provider to— (1)facilitate the purchase of certified EHR technology; (2)enhance the utilization of certified EHR technology; (3)train personnel in the use of such technology; or (4)improve the secure electronic exchange of health information. (f)

Types of assistance

Except as otherwise limited by applicable State law, amounts deposited into a Loan Fund under this section may only be used for the following: (1)To award loans that comply with the following: (A)The interest rate for each loan shall not exceed the market interest rate. (B)The principal and interest payments on each loan shall commence not later than 1 year after the date the loan was awarded, and each loan shall be fully amortized not later than 10 years after the date of the loan. (C)The Loan Fund shall be credited with all payments of principal and interest on each loan awarded from the Loan Fund. (2)To guarantee, or purchase insurance for, a local obligation (all of the proceeds of which finance a project eligible for assistance under this subsection) if the guarantee or purchase would improve credit market access or reduce the interest rate applicable to the obligation involved. (3)As a source of revenue or security for the payment of principal and interest on revenue or general obligation bonds issued by the eligible entity if the proceeds of the sale of the bonds will be deposited into the Loan Fund. (4)To earn interest on the amounts deposited into the Loan Fund. (5)To make reimbursements described in subsection (g)(4)(A). (g)

Administration of Loan Funds

(1)

Combined financial administration

An eligible entity may (as a convenience and to avoid unnecessary administrative costs) combine, in accordance with applicable State law, the financial administration of a Loan Fund established under this subsection with the financial administration of any other revolving fund established by the entity if otherwise not prohibited by the law under which the Loan Fund was established. (2)

Cost of administering fund

Each eligible entity may annually use not to exceed 4 percent of the funds provided to the entity under a grant under this section to pay the reasonable costs of the administration of the programs under this section, including the recovery of reasonable costs expended to establish a Loan Fund which are incurred after the date of the enactment of this title. (3)

Guidance and regulations

The National Coordinator shall publish guidance and promulgate regulations as may be necessary to carry out the provisions of this section, including— (A)provisions to ensure that each eligible entity commits and expends funds allotted to the entity under this section as efficiently as possible in accordance with this title and applicable State laws; and (B)guidance to prevent waste, fraud, and abuse. (4)

Private sector contributions

(A)

In general

A Loan Fund established under this section may accept contributions from private sector entities, except that such entities may not specify the recipient or recipients of any loan issued under this subsection. An eligible entity may agree to reimburse a private sector entity for any contribution made under this subparagraph, except that the amount of such reimbursement may not be greater than the principal amount of the contribution made. (B)

Availability of information

An eligible entity shall make publicly available the identity of, and amount contributed by, any private sector entity under subparagraph (A) and may issue letters of commendation or make other awards (that have no financial value) to any such entity. (h)

Matching requirements

(1)

In general

The National Coordinator may not make a grant under subsection (a) to an eligible entity unless the entity agrees to make available (directly or through donations from public or private entities) non-Federal contributions in cash to the costs of carrying out the activities for which the grant is awarded in an amount equal to not less than $1 for each $5 of Federal funds provided under the grant. (2)

Determination of amount of non-federal contribution

In determining the amount of non-Federal contributions that an eligible entity has provided pursuant to subparagraph (A), the National Coordinator may not include any amounts provided to the entity by the Federal Government. (i)

Effective date

The Secretary may not make an award under this section prior to January 1, 2010.

3015.

Demonstration program to integrate information technology into clinical education

(a)

In General

The Secretary may award grants under this section to carry out demonstration projects to develop academic curricula integrating certified EHR technology in the clinical education of health professionals. Such awards shall be made on a competitive basis and pursuant to peer review. (b)

Eligibility

To be eligible to receive a grant under subsection (a), an entity shall— (1)submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require; (2)submit to the Secretary a strategic plan for integrating certified EHR technology in the clinical education of health professionals to reduce medical errors and enhance health care quality; (3)be— (A)a school of medicine, osteopathic medicine, dentistry, or pharmacy, a graduate program in behavioral or mental health, or any other graduate health professions school; (B)a graduate school of nursing or physician assistant studies; (C)a consortium of two or more schools described in subparagraph (A) or (B); or (D)an institution with a graduate medical education program in medicine, osteopathic medicine, dentistry, pharmacy, nursing, or physician assistance studies; (4)provide for the collection of data regarding the effectiveness of the demonstration project to be funded under the grant in improving the safety of patients, the efficiency of health care delivery, and in increasing the likelihood that graduates of the grantee will adopt and incorporate certified EHR technology, in the delivery of health care services; and (5)provide matching funds in accordance with subsection (d). (c)

Use of Funds

(1)

In general

With respect to a grant under subsection (a), an eligible entity shall— (A)use grant funds in collaboration with 2 or more disciplines; and (B)use grant funds to integrate certified EHR technology into community-based clinical education. (2)

Limitation

An eligible entity shall not use amounts received under a grant under subsection (a) to purchase hardware, software, or services. (d)

Financial support

The Secretary may not provide more than 50 percent of the costs of any activity for which assistance is provided under subsection (a), except in an instance of national economic conditions which would render the cost-share requirement under this subsection detrimental to the program and upon notification to Congress as to the justification to waive the cost-share requirement. (e)

Evaluation

The Secretary shall take such action as may be necessary to evaluate the projects funded under this section and publish, make available, and disseminate the results of such evaluations on as wide a basis as is practicable. (f)

Reports

Not later than 1 year after the date of enactment of this title, and annually thereafter, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Finance of the Senate, and the Committee on Energy and Commerce of the House of Representatives a report that— (1)describes the specific projects established under this section; and (2)contains recommendations for Congress based on the evaluation conducted under subsection (e).

3016.

Information technology professionals on health care

(a)

In general

The Secretary, in consultation with the Director of the National Science Foundation, shall provide assistance to institutions of higher education (or consortia thereof) to establish or expand medical health informatics education programs, including certification, undergraduate, and masters degree programs, for both health care and information technology students to ensure the rapid and effective utilization and development of health information technologies (in the United States health care infrastructure). (b)

Activities

Activities for which assistance may be provided under subsection (a) may include the following: (1)Developing and revising curricula in medical health informatics and related disciplines. (2)Recruiting and retaining students to the program involved. (3)Acquiring equipment necessary for student instruction in these programs, including the installation of testbed networks for student use. (4)Establishing or enhancing bridge programs in the health informatics fields between community colleges and universities. (c)

Priority

In providing assistance under subsection (a), the Secretary shall give preference to the following: (1)Existing education and training programs. (2)Programs designed to be completed in less than six months. (d)

Financial Support

The Secretary may not provide more than 50 percent of the costs of any activity for which assistance is provided under subsection (a), except in an instance of national economic conditions which would render the cost-share requirement under this subsection detrimental to the program and upon notification to Congress as to the justification to waive the cost-share requirement.

3017.

General grant and loan provisions

(a)

Reports

The Secretary may require that an entity receiving assistance under this subtitle shall submit to the Secretary, not later than the date that is 1 year after the date of receipt of such assistance, a report that includes— (1)an analysis of the effectiveness of the activities for which the entity receives such assistance, as compared to the goals for such activities; and (2)an analysis of the impact of the project on health care quality and safety. (b)

Requirement To improve quality of care and decrease in costs

The National Coordinator shall annually evaluate the activities conducted under this subtitle and shall, in awarding grants, implement the lessons learned from such evaluation in a manner so that awards made subsequent to each such evaluation are made in a manner that, in the determination of the National Coordinator, will result in the greatest improvement in the quality and efficiency of health care.

3018.

Authorization for appropriations

For the purposes of carrying out this subtitle, there is authorized to be appropriated such sums as may be necessary for each of the fiscal years 2009 through 2013. Amounts so appropriated shall remain available until expended.

.

II

Medicare program

4311.

Incentives for eligible professionals

(a)

Incentive payments

Section 1848 of the Social Security Act (42 U.S.C. 1395w–4) is amended by adding at the end the following new subsection: (o)

Incentives for adoption and meaningful use of certified EHR technology

(1)

Incentive payments

(A)

In general

Subject to the succeeding subparagraphs of this paragraph, with respect to covered professional services furnished by an eligible professional during a payment year (as defined in subparagraph (E)), if the eligible professional is a meaningful EHR user (as determined under paragraph (2)) for the reporting period with respect to such year, in addition to the amount otherwise paid under this part, there also shall be paid to the eligible professional (or to an employer or facility in the cases described in clause (A) of section 1842(b)(6)), from the Federal Supplementary Medical Insurance Trust Fund established under section 1841 an amount equal to 75 percent of the Secretary’s estimate (based on claims submitted not later than 2 months after the end of the payment year) of the allowed charges under this part for all such covered professional services furnished by the eligible professional during such year. (B)

Limitations on amounts of incentive payments

(i)

In general

In no case shall the amount of the incentive payment provided under this paragraph for an eligible professional for a payment year exceed the applicable amount specified under this subparagraph with respect to such eligible professional and such year. (ii)

Amount

Subject to clause (iii), the applicable amount specified in this subparagraph for an eligible professional is as follows: (I)For the first payment year for such professional, $15,000. (II)For the second payment year for such professional, $12,000. (III)For the third payment year for such professional, $8,000. (IV)For the fourth payment year for such professional, $4,000. (V)For the fifth payment year for such professional, $2,000. (VI)For any succeeding payment year for such professional, $0. (iii)

Phase down for eligible professionals first adopting EHR after 2013

If the first payment year for an eligible professional is after 2013, then the amount specified in this subparagraph for a payment year for such professional is the same as the amount specified in clause (ii) for such payment year for an eligible professional whose first payment year is 2013. If the first payment year for an eligible professional is after 2015 then the applicable amount specified in this subparagraph for such professional for such year and any subsequent year shall be $0. (C)

Non-application to hospital-based eligible professionals

(i)

In general

No incentive payment may be made under this paragraph in the case of a hospital-based eligible professional. (ii)

Hospital-based eligible professional

For purposes of clause (i), the term hospital-based eligible professional means, with respect to covered professional services furnished by an eligible professional during the reporting period for a payment year, an eligible professional, such as a pathologist, anesthesiologist, or emergency physician, who furnishes substantially all of such services in a hospital setting (whether inpatient or outpatient) and through the use of the facilities and equipment, including computer equipment, of the hospital. (D)

Payment

(i)

Form of payment

The payment under this paragraph may be in the form of a single consolidated payment or in the form of such periodic installments as the Secretary may specify. (ii)

Coordination of application of limitation for professionals in different practices

In the case of an eligible professional furnishing covered professional services in more than one practice (as specified by the Secretary), the Secretary shall establish rules to coordinate the incentive payments, including the application of the limitation on amounts of such incentive payments under this paragraph, among such practices. (iii)

Coordination with Medicaid

The Secretary shall seek, to the maximum extent practicable, to avoid duplicative requirements from Federal and State Governments to demonstrate meaningful use of certified EHR technology under this title and title XIX. In doing so, the Secretary may deem satisfaction of State requirements for such meaningful use for a payment year under title XIX to be sufficient to qualify as meaningful use under this subsection and subsection (a)(7) and vice versa. The Secretary may also adjust the reporting periods under such title and such subsections in order to carry out this clause. (E)

Payment year defined

(i)

In general

For purposes of this subsection, the term payment year means a year beginning with 2011. (ii)

First, second, etc. payment year

The term first payment year means, with respect to covered professional services furnished by an eligible professional, the first year for which an incentive payment is made for such services under this subsection. The terms ‘second payment year’, ‘third payment year’, ‘fourth payment year’, and ‘fifth payment year’ mean, with respect to covered professional services furnished by such eligible professional, each successive year immediately following the first payment year for such professional. (2)

Meaningful EHR user

(A)

In general

For purposes of paragraph (1), an eligible professional shall be treated as a meaningful EHR user for a reporting period for a payment year (or, for purposes of subsection (a)(7), for a reporting period under such subsection for a year) if each of the following requirements is met: (i)

Meaningful use of certified EHR technology

The eligible professional demonstrates to the satisfaction of the Secretary, in accordance with subparagraph (C)(i), that during such period the professional is using certified EHR technology in a meaningful manner, which shall include the use of electronic prescribing as determined to be appropriate by the Secretary. (ii)

Information exchange

The eligible professional demonstrates to the satisfaction of the Secretary, in accordance with subparagraph (C)(i), that during such period such certified EHR technology is connected in a manner that provides, in accordance with law and standards applicable to the exchange of information, for the electronic exchange of health information to improve the quality of health care, such as promoting care coordination. (iii)

Reporting on measures using EHR

Subject to subparagraph (B)(ii) and using such certified EHR technology, the eligible professional submits information for such period, in a form and manner specified by the Secretary, on such clinical quality measures and such other measures as selected by the Secretary under subparagraph (B)(i).The Secretary may provide for the use of alternative means for meeting the requirements of clauses (i), (ii), and (iii) in the case of an eligible professional furnishing covered professional services in a group practice (as defined by the Secretary). The Secretary shall seek to improve the use of electronic health records and health care quality over time by requiring more stringent measures of meaningful use selected under this paragraph. (B)

Reporting on measures

(i)

Selection

The Secretary shall select measures for purposes of subparagraph (A)(iii) but only consistent with the following: (I)The Secretary shall provide preference to clinical quality measures that have been endorsed by the entity with a contract with the Secretary under section 1890(a). (II)Prior to any measure being selected under this subparagraph, the Secretary shall publish in the Federal Register such measure and provide for a period of public comment on such measure. (ii)

Limitation

The Secretary may not require the electronic reporting of information on clinical quality measures under subparagraph (A)(iii) unless the Secretary has the capacity to accept the information electronically, which may be on a pilot basis. (iii)

Coordination of reporting of information

In selecting such measures, and in establishing the form and manner for reporting measures under subparagraph (A)(iii), the Secretary shall seek to avoid redundant or duplicative reporting otherwise required, including reporting under subsection (k)(2)(C). (C)

Demonstration of meaningful use of certified EHR technology and information exchange

(i)

In general

A professional may satisfy the demonstration requirement of clauses (i) and (ii) of subparagraph (A) through means specified by the Secretary, which may include— (I)an attestation; (II)the submission of claims with appropriate coding (such as a code indicating that a patient encounter was documented using certified EHR technology); (III)a survey response; (IV)reporting under subparagraph (A)(iii); and (V)other means specified by the Secretary. (ii)

Use of part D data

Notwithstanding sections 1860D–15(d)(2)(B) and 1860D–15(f)(2), the Secretary may use data regarding drug claims submitted for purposes of section 1860D–15 that are necessary for purposes of subparagraph (A). (3)

Application

(A)

Physician reporting system rules

Paragraphs (5), (6), and (8) of subsection (k) shall apply for purposes of this subsection in the same manner as they apply for purposes of such subsection. (B)

Coordination with other payments

The provisions of this subsection shall not be taken into account in applying the provisions of subsection (m) of this section and of section 1833(m) and any payment under such provisions shall not be taken into account in computing allowable charges under this subsection. (C)

Limitations on review

There shall be no administrative or judicial review under section 1869, section 1878, or otherwise of the determination of any incentive payment under this subsection and the payment adjustment under subsection (a)(7), including the determination of a meaningful EHR user under paragraph (2), a limitation under paragraph (1)(B), and the exception under subsection (a)(7)(B). (D)

Posting on website

The Secretary shall post on the Internet website of the Centers for Medicare & Medicaid Services, in an easily understandable format, a list of the names, business addresses, and business phone numbers of the eligible professionals who are meaningful EHR users and, as determined appropriate by the Secretary, of group practices receiving incentive payments under paragraph (1). (4)

Certified EHR technology defined

For purposes of this section, the term certified EHR technology means a qualified electronic health record (as defined in 3000(13) of the Public Health Service Act) that is certified pursuant to section 3001(c)(5) of such Act as meeting standards adopted under section 3004 of such Act that are applicable to the type of record involved (as determined by the Secretary, such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals). (5)

Definitions

For purposes of this subsection: (A)

Covered professional services

The term covered professional services has the meaning given such term in subsection (k)(3). (B)

Eligible professional

The term eligible professional means a physician, as defined in section 1861(r). (C)

Reporting period

The term reporting period means any period (or periods), with respect to a payment year, as specified by the Secretary.. (b)

Incentive payment adjustment

Section 1848(a) of the Social Security Act (42 U.S.C. 1395w–4(a)) is amended by adding at the end the following new paragraph: (7)

Incentives for meaningful use of certified EHR technology

(A)

Adjustment

(i)

In general

Subject to subparagraphs (B) and (D), with respect to covered professional services furnished by an eligible professional during 2016 or any subsequent payment year, if the eligible professional is not a meaningful EHR user (as determined under subsection (o)(2)) for a reporting period for the year, the fee schedule amount for such services furnished by such professional during the year (including the fee schedule amount for purposes of determining a payment based on such amount) shall be equal to the applicable percent of the fee schedule amount that would otherwise apply to such services under this subsection (determined after application of paragraph (3) but without regard to this paragraph). (ii)

Applicable percent

Subject to clause (iii), for purposes of clause (i), the term applicable percent means— (I)for 2016, 99 percent; (II)for 2017, 98 percent; and (III)for 2018 and each subsequent year, 97 percent. (iii)

Authority to decrease applicable percentage for 2019 and subsequent years

For 2019 and each subsequent year, if the Secretary finds that the proportion of eligible professionals who are meaningful EHR users (as determined under subsection (o)(2)) is less than 75 percent, the applicable percent shall be decreased by 1 percentage point from the applicable percent in the preceding year, but in no case shall the applicable percent be less than 95 percent. (B)

Significant hardship exception

The Secretary may, on a case-by-case basis, exempt an eligible professional from the application of the payment adjustment under subparagraph (A) if the Secretary determines, subject to annual renewal, that compliance with the requirement for being a meaningful EHR user would result in a significant hardship, such as in the case of an eligible professional who practices in a rural area without sufficient Internet access. In no case may an eligible professional be granted an exemption under this subparagraph for more than 5 years. (C)

Application of physician reporting system rules

Paragraphs (5), (6), and (8) of subsection (k) shall apply for purposes of this paragraph in the same manner as they apply for purposes of such subsection. (D)

Non-application to hospital-based eligible professionals

No payment adjustment may be made under subparagraph (A) in the case of hospital-based eligible professionals (as defined in subsection (o)(1)(C)(ii)). (E)

Definitions

For purposes of this paragraph: (i)

Covered professional services

The term covered professional services has the meaning given such term in subsection (k)(3). (ii)

Eligible professional

The term eligible professional means a physician, as defined in section 1861(r). (iii)

Reporting period

The term reporting period means, with respect to a year, a period specified by the Secretary.. (c)

Application to certain HMO-affiliated eligible professionals

Section 1853 of the Social Security Act (42 U.S.C. 1395w–23) is amended by adding at the end the following new subsection: (l)

Application of eligible professional incentives for certain MA Organizations for adoption and meaningful use of certified EHR technology

(1)

In general

Subject to paragraphs (3) and (4), in the case of a qualifying MA organization, the provisions of sections 1848(o) and 1848(a)(7) shall apply with respect to eligible professionals described in paragraph (2) of the organization who the organization attests under paragraph (6) to be meaningful EHR users in a similar manner as they apply to eligible professionals under such sections. Incentive payments under paragraph (3) shall be made to and payment adjustments under paragraph (4) shall apply to such qualifying organizations. (2)

Eligible professional described

With respect to a qualifying MA organization, an eligible professional described in this paragraph is an eligible professional (as defined for purposes of section 1848(o)) who— (A) (i)is employed by the organization; or (ii) (I)is employed by, or is a partner of, an entity that through contract with the organization furnishes at least 80 percent of the entity’s patient care services to enrollees of such organization; and (II)furnishes at least 75 percent of the professional services of the eligible professional to enrollees of the organization; and (B)furnishes, on average, at least 20 hours per week of patient care services. (3)

Eligible professional incentive payments

(A)

In general

In applying section 1848(o) under paragraph (1), instead of the additional payment amount under section 1848(o)(1)(A) and subject to subparagraph (B), the Secretary may substitute an amount determined by the Secretary to the extent feasible and practical to be similar to the estimated amount in the aggregate that would be payable if payment for services furnished by such professionals was payable under part B instead of this part. (B)

Avoiding duplication of payments

(i)

In general

If an eligible professional described in paragraph (2) is eligible for the maximum incentive payment under section 1848(o)(1)(A) for the same payment period, the payment incentive shall be made only under such section and not under this subsection. (ii)

Methods

In the case of an eligible professional described in paragraph (2) who is eligible for an incentive payment under section 1848(o)(1)(A) but is not described in clause (i) for the same payment period, the Secretary shall develop a process— (I)to ensure that duplicate payments are not made with respect to an eligible professional both under this subsection and under section 1848(o)(1)(A); and (II)to collect data from Medicare Advantage organizations to ensure against such duplicate payments. (C)

Fixed schedule for application of limitation on incentive payments for all eligible professionals

In applying section 1848(o)(1)(B)(ii) under subparagraph (A), in accordance with rules specified by the Secretary, a qualifying MA organization shall specify a year (not earlier than 2011) that shall be treated as the first payment year for all eligible professionals with respect to such organization. (4)

Payment adjustment

(A)

In general

In applying section 1848(a)(7) under paragraph (1), instead of the payment adjustment being an applicable percent of the fee schedule amount for a year under such section, subject to subparagraph (D), the payment adjustment under paragraph (1) shall be equal to the percent specified in subparagraph (B) for such year of the payment amount otherwise provided under this section for such year. (B)

Specified percent

The percent specified under this subparagraph for a year is 100 percent minus a number of percentage points equal to the product of— (i)the number of percentage points by which the applicable percent (under section 1848(a)(7)(A)(ii)) for the year is less than 100 percent; and (ii)the Medicare physician expenditure proportion specified in subparagraph (C) for the year. (C)

Medicare physician expenditure proportion

The Medicare physician expenditure proportion under this subparagraph for a year is the Secretary’s estimate of the proportion, of the expenditures under parts A and B that are not attributable to this part, that are attributable to expenditures for physicians’ services. (D)

Application of payment adjustment

In the case that a qualifying MA organization attests that not all eligible professionals are meaningful EHR users with respect to a year, the Secretary shall apply the payment adjustment under this paragraph based on the proportion of such eligible professionals that are not meaningful EHR users for such year. (5)

Qualifying ma organization defined

In this subsection and subsection (m), the term qualifying MA organization means a Medicare Advantage organization that is organized as a health maintenance organization (as defined in section 2791(b)(3) of the Public Health Service Act). (6)

Meaningful EHR user attestation

For purposes of this subsection and subsection (m), a qualifying MA organization shall submit an attestation, in a form and manner specified by the Secretary which may include the submission of such attestation as part of submission of the initial bid under section 1854(a)(1)(A)(iv), identifying— (A)whether each eligible professional described in paragraph (2), with respect to such organization is a meaningful EHR user (as defined in section 1848(o)(2)) for a year specified by the Secretary; and (B)whether each eligible hospital described in subsection (m)(1), with respect to such organization, is a meaningful EHR user (as defined in section 1886(n)(3)) for an applicable period specified by the Secretary.. (d)

Conforming amendments

Section 1853 of the Social Security Act (42 U.S.C. 1395w–23) is amended— (1)in subsection (a)(1)(A), by striking and (i) and inserting (i), and (l); (2)in subsection (c)— (A)in paragraph (1)(D)(i), by striking section 1886(h) and inserting sections 1848(o) and 1886(h); and (B)in paragraph (6)(A), by inserting after under part B, the following: excluding expenditures attributable to subsections (a)(7) and (o) of section 1848,; and (3)in subsection (f), by inserting and for payments under subsection (l) after with the organization. (e)

Conforming amendments to e-prescribing

(1)Section 1848(a)(5)(A) of the Social Security Act (42 U.S.C. 1395w–4(a)(5)(A)) is amended— (A)in clause (i), by striking or any subsequent year and inserting , 2013, 2014, or 2015; and (B)in clause (ii), by striking and each subsequent year and inserting and 2015. (2)Section 1848(m)(2) of such Act (42 U.S.C. 1395w–4(m)(2)) is amended— (A)in subparagraph (A), by striking For 2009 and inserting Subject to subparagraph (D), for 2009; and (B)by adding at the end the following new subparagraph: (D)

Limitation with respect to EHR incentive payments

The provisions of this paragraph shall not apply to an eligible professional (or, in the case of a group practice under paragraph (3)(C), to the group practice) if, for the reporting period the eligible professional (or group practice) receives an incentive payment under subsection (o)(1)(A) with respect to a certified EHR technology (as defined in subsection (o)(4)) that has the capability of electronic prescribing..

4312.

Incentives for hospitals

(a)

Incentive payment

Section 1886 of the Social Security Act (42 U.S.C. 1395ww) is amended by adding at the end the following new subsection: (n)

Incentives for adoption and meaningful use of certified EHR technology

(1)

In general

Subject to the succeeding provisions of this subsection, with respect to inpatient hospital services furnished by an eligible hospital during a payment year (as defined in paragraph (2)(G)), if the eligible hospital is a meaningful EHR user (as determined under paragraph (3)) for the reporting period with respect to such year, in addition to the amount otherwise paid under this section, there also shall be paid to the eligible hospital, from the Federal Hospital Insurance Trust Fund established under section 1817, an amount equal to the applicable amount specified in paragraph (2)(A) for the hospital for such payment year. (2)

Payment amount

(A)

In general

Subject to the succeeding subparagraphs of this paragraph, the applicable amount specified in this subparagraph for an eligible hospital for a payment year is equal to the product of the following: (i)

Initial amount

The sum of— (I)the base amount specified in subparagraph (B); plus (II)the discharge related amount specified in subparagraph (C) for a 12-month period selected by the Secretary with respect to such payment year. (ii)

Medicare share

The Medicare share as specified in subparagraph (D) for the hospital for a period selected by the Secretary with respect to such payment year. (iii)

Transition factor

The transition factor specified in subparagraph (E) for the hospital for the payment year. (B)

Base amount

The base amount specified in this subparagraph is $2,000,000. (C)

Discharge related amount

The discharge related amount specified in this subparagraph for a 12-month period selected by the Secretary shall be determined as the sum of the amount, based upon total discharges (regardless of any source of payment) for the period, for each discharge up to the 23,000th discharge as follows: (i)For the 1,150th through the 9,200th discharge, $200. (ii)For the 9,201st through the 13,800th discharge, 50 percent of the amount specified in clause (i). (iii)For the 13,801st through the 23,000th discharge, 30 percent of the amount specified in clause (i). (D)

Medicare share

The Medicare share specified under this subparagraph for a hospital for a period selected by the Secretary for a payment year is equal to the fraction— (i)the numerator of which is the sum (for such period and with respect to the hospital) of— (I)the number of inpatient-bed-days (as established by the Secretary) which are attributable to individuals with respect to whom payment may be made under part A; and (II)the number of inpatient-bed-days (as so established) which are attributable to individuals who are enrolled with a Medicare Advantage organization under part C; and (ii)the denominator of which is the product of— (I)the total number of inpatient-bed-days with respect to the hospital during such period; and (II)the total amount of the hospital’s charges during such period, not including any charges that are attributable to charity care (as such term is used for purposes of hospital cost reporting under this title), divided by the total amount of the hospital’s charges during such period.Insofar as the Secretary determines that data are not available on charity care necessary to calculate the portion of the formula specified in clause (ii)(II), the Secretary shall use data on uncompensated care and may adjust such data so as to be an appropriate proxy for charity care including a downward adjustment to eliminate bad debt data from uncompensated care data. In the absence of the data necessary, with respect to a hospital, for the Secretary to compute the amount described in clause (ii)(II), the amount under such clause shall be deemed to be 1. In the absence of data, with respect to a hospital, necessary to compute the amount described in clause (i)(II), the amount under such clause shall be deemed to be 0. (E)

Transition factor specified

(i)

In general

Subject to clause (ii), the transition factor specified in this subparagraph for an eligible hospital for a payment year is as follows: (I)For the first payment year for such hospital, 1. (II)For the second payment year for such hospital, 3/4. (III)For the third payment year for such hospital, ½. (IV)For the fourth payment year for such hospital, 1/4. (V)For any succeeding payment year for such hospital, 0. (ii)

Phase down for eligible hospitals first adopting EHR after 2013

If the first payment year for an eligible hospital is after 2013, then the transition factor specified in this subparagraph for a payment year for such hospital is the same as the amount specified in clause (i) for such payment year for an eligible hospital for which the first payment year is 2013. If the first payment year for an eligible hospital is after 2015 then the transition factor specified in this subparagraph for such hospital and for such year and any subsequent year shall be 0. (F)

Form of payment

The payment under this subsection for a payment year may be in the form of a single consolidated payment or in the form of such periodic installments as the Secretary may specify. (G)

Payment year defined

(i)

In general

For purposes of this subsection, the term payment year means a fiscal year beginning with fiscal year 2011. (ii)

First, second, etc. payment year

The term first payment year means, with respect to inpatient hospital services furnished by an eligible hospital, the first fiscal year for which an incentive payment is made for such services under this subsection. The terms second payment year, third payment year, and fourth payment year mean, with respect to an eligible hospital, each successive year immediately following the first payment year for that hospital. (3)

Meaningful EHR user

(A)

In general

For purposes of paragraph (1), an eligible hospital shall be treated as a meaningful EHR user for a reporting period for a payment year (or, for purposes of subsection (b)(3)(B)(ix), for a reporting period under such subsection for a fiscal year) if each of the following requirements are met: (i)

Meaningful use of certified EHR technology

The eligible hospital demonstrates to the satisfaction of the Secretary, in accordance with subparagraph (C)(i), that during such period the hospital is using certified EHR technology in a meaningful manner. (ii)

Information exchange

The eligible hospital demonstrates to the satisfaction of the Secretary, in accordance with subparagraph (C)(i), that during such period such certified EHR technology is connected in a manner that provides, in accordance with law and standards applicable to the exchange of information, for the electronic exchange of health information to improve the quality of health care, such as promoting care coordination. (iii)

Reporting on measures using EHR

Subject to subparagraph (B)(ii) and using such certified EHR technology, the eligible hospital submits information for such period, in a form and manner specified by the Secretary, on such clinical quality measures and such other measures as selected by the Secretary under subparagraph (B)(i).The Secretary shall seek to improve the use of electronic health records and health care quality over time by requiring more stringent measures of meaningful use selected under this paragraph. (B)

Reporting on measures

(i)

Selection

The Secretary shall select measures for purposes of subparagraph (A)(iii) but only consistent with the following: (I)The Secretary shall provide preference to clinical quality measures that have been selected for purposes of applying subsection (b)(3)(B)(viii) or that have been endorsed by the entity with a contract with the Secretary under section 1890(a). (II)Prior to any measure (other than a clinical quality measure that has been selected for purposes of applying subsection (b)(3)(B)(viii)) being selected under this subparagraph, the Secretary shall publish in the Federal Register such measure and provide for a period of public comment on such measure. (ii)

Limitations

The Secretary may not require the electronic reporting of information on clinical quality measures under subparagraph (A)(iii) unless the Secretary has the capacity to accept the information electronically, which may be on a pilot basis. (iii)

Coordination of reporting of information

In selecting such measures, and in establishing the form and manner for reporting measures under subparagraph (A)(iii), the Secretary shall seek to avoid redundant or duplicative reporting with reporting otherwise required, including reporting under subsection (b)(3)(B)(viii). (C)

Demonstration of meaningful use of certified EHR technology and information exchange

(i)

In general

A hospital may satisfy the demonstration requirement of clauses (i) and (ii) of subparagraph (A) through means specified by the Secretary, which may include— (I)an attestation; (II)the submission of claims with appropriate coding (such as a code indicating that inpatient care was documented using certified EHR technology); (III)a survey response; (IV)reporting under subparagraph (A)(iii); and (V)other means specified by the Secretary. (ii)

Use of part D data

Notwithstanding sections 1860D–15(d)(2)(B) and 1860D–15(f)(2), the Secretary may use data regarding drug claims submitted for purposes of section 1860D–15 that are necessary for purposes of subparagraph (A). (4)

Application

(A)

Limitations on review

There shall be no administrative or judicial review under section 1869, section 1878, or otherwise of the determination of any incentive payment under this subsection and the payment adjustment under subsection (b)(3)(B)(ix), including the determination of a meaningful EHR user under paragraph (3), determination of measures applicable to services furnished by eligible hospitals under this subsection, and the exception under subsection (b)(3)(B)(ix)(II). (B)

Posting on website

The Secretary shall post on the Internet website of the Centers for Medicare & Medicaid Services, in an easily understandable format, a list of the names of the eligible hospitals that are meaningful EHR users under this subsection or subsection (b)(3)(B)(ix) and other relevant data as determined appropriate by the Secretary. The Secretary shall ensure that a hospital has the opportunity to review the other relevant data that are to be made public with respect to the hospital prior to such data being made public. (5)

Certified EHR technology defined

The term certified EHR technology has the meaning given such term in section 1848(o)(4). (6)

Definitions

For purposes of this subsection: (A)

Eligible hospital

The term eligible hospital means a subsection (d) hospital. (B)

Reporting period

The term reporting period means any period (or periods), with respect to a payment year, as specified by the Secretary.. (b)

Incentive market basket adjustment

Section 1886(b)(3)(B) of the Social Security Act (42 U.S.C. 1395ww(b)(3)(B)) is amended— (1)in clause (viii)(I), by inserting (or, beginning with fiscal year 2016, by one-quarter) after 2.0 percentage points; and (2)by adding at the end the following new clause: (ix) (I)For purposes of clause (i) for fiscal year 2016 and each subsequent fiscal year, in the case of an eligible hospital (as defined in subsection (n)(6)(A)) that is not a meaningful EHR user (as defined in subsection (n)(3)) for the reporting period for such fiscal year, three-quarters of the applicable percentage increase otherwise applicable under clause (i) for such fiscal year shall be reduced by 331/3 percent for fiscal year 2016, 662/3 percent for fiscal year 2017, and 100 percent for fiscal year 2018 and each subsequent fiscal year. Such reduction shall apply only with respect to the fiscal year involved and the Secretary shall not take into account such reduction in computing the applicable percentage increase under clause (i) for a subsequent fiscal year. (II)The Secretary may, on a case-by-case basis, exempt a subsection (d) hospital from the application of subclause (I) with respect to a fiscal year if the Secretary determines, subject to annual renewal, that requiring such hospital to be a meaningful EHR user during such fiscal year would result in a significant hardship, such as in the case of a hospital in a rural area without sufficient Internet access. In no case may a hospital be granted an exemption under this subclause for more than 5 years. (III)For fiscal year 2016 and each subsequent fiscal year, a State in which hospitals are paid for services under section 1814(b)(3) shall adjust the payments to each subsection (d) hospital in the State that is not a meaningful EHR user (as defined in subsection (n)(3)) in a manner that is designed to result in an aggregate reduction in payments to hospitals in the State that is equivalent to the aggregate reduction that would have occurred if payments had been reduced to each subsection (d) hospital in the State in a manner comparable to the reduction under the previous provisions of this clause. The State shall report to the Secretary the methodology it will use to make the payment adjustment under the previous sentence. (IV)For purposes of this clause, the term reporting period means, with respect to a fiscal year, any period (or periods), with respect to the fiscal year, as specified by the Secretary.. (c)

Application to certain HMO-affiliated eligible hospitals

Section 1853 of the Social Security Act (42 U.S.C. 1395w–23), as amended by section 4311(c), is further amended by adding at the end the following new subsection: (m)

Application of eligible hospital incentives for certain MA organizations for adoption and meaningful use of certified EHR technology

(1)

Application

Subject to paragraphs (3) and (4), in the case of a qualifying MA organization, the provisions of sections 1886(n) and 1886(b)(3)(B)(ix) shall apply with respect to eligible hospitals described in paragraph (2) of the organization which the organization attests under subsection (l)(6) to be meaningful EHR users in a similar manner as they apply to eligible hospitals under such sections. Incentive payments under paragraph (3) shall be made to and payment adjustments under paragraph (4) shall apply to such qualifying organizations. (2)

Eligible hospital described

With respect to a qualifying MA organization, an eligible hospital described in this paragraph is an eligible hospital that is under common corporate governance with such organization and serves individuals enrolled under an MA plan offered by such organization. (3)

Eligible hospital incentive payments

(A)

In general

In applying section 1886(n)(2) under paragraph (1), instead of the additional payment amount under section 1886(n)(2), there shall be substituted an amount determined by the Secretary to be similar to the estimated amount in the aggregate that would be payable if payment for services furnished by such hospitals was payable under part A instead of this part. In implementing the previous sentence, the Secretary— (i)shall, insofar as data to determine the discharge related amount under section 1886(n)(2)(C) for an eligible hospital are not available to the Secretary, use such alternative data and methodology to estimate such discharge related amount as the Secretary determines appropriate; and (ii)shall, insofar as data to determine the medicare share described in section 1886(n)(2)(D) for an eligible hospital are not available to the Secretary, use such alternative data and methodology to estimate such share, which data and methodology may include use of the inpatient bed days (or discharges) with respect to an eligible hospital during the appropriate period which are attributable to both individuals for whom payment may be made under part A or individuals enrolled in an MA plan under a Medicare Advantage organization under this part as a proportion of the total number of patient-bed-days (or discharges) with respect to such hospital during such period. (B)

Avoiding duplication of payments

(i)

In general

In the case of a hospital that for a payment year is an eligible hospital described in paragraph (2), is an eligible hospital under section 1886(n), and for which at least one-third of their discharges (or bed-days) of Medicare patients for the year are covered under part A, payment for the payment year shall be made only under section 1886(n) and not under this subsection. (ii)

Methods

In the case of a hospital that is an eligible hospital described in paragraph (2) and also is eligible for an incentive payment under section 1886(n) but is not described in clause (i) for the same payment period, the Secretary shall develop a process— (I)to ensure that duplicate payments are not made with respect to an eligible hospital both under this subsection and under section 1886(n); and (II)to collect data from Medicare Advantage organizations to ensure against such duplicate payments. (4)

Payment adjustment

(A)Subject to paragraph (3), in the case of a qualifying MA organization (as defined in section 1853(l)(5)), if, according to the attestation of the organization submitted under subsection (l)(6) for an applicable period, one or more eligible hospitals (as defined in section 1886(n)(6)(A)) that are under common corporate governance with such organization and that serve individuals enrolled under a plan offered by such organization are not meaningful EHR users (as defined in section 1886(n)(3)) with respect to a period, the payment amount payable under this section for such organization for such period shall be the percent specified in subparagraph (B) for such period of the payment amount otherwise provided under this section for such period. (B)

Specified percent

The percent specified under this subparagraph for a year is 100 percent minus a number of percentage points equal to the product of— (i)the number of the percentage point reduction effected under section 1886(b)(3)(B)(ix)(I) for the period; and (ii)the Medicare hospital expenditure proportion specified in subparagraph (C) for the year. (C)

Medicare hospital expenditure proportion

The Medicare hospital expenditure proportion under this subparagraph for a year is the Secretary’s estimate of the proportion, of the expenditures under parts A and B that are not attributable to this part, that are attributable to expenditures for inpatient hospital services. (D)

Application of payment adjustment

In the case that a qualifying MA organization attests that not all eligible hospitals are meaningful EHR users with respect to an applicable period, the Secretary shall apply the payment adjustment under this paragraph based on a methodology specified by the Secretary, taking into account the proportion of such eligible hospitals, or discharges from such hospitals, that are not meaningful EHR users for such period.. (d)

Conforming amendments

(1)Section 1814(b) of the Social Security Act (42 U.S.C. 1395f(b)) is amended— (A)in paragraph (3), in the matter preceding subparagraph (A), by inserting , subject to section 1886(d)(3)(B)(ix)(III), after then; and (B)by adding at the end the following: For purposes of applying paragraph (3), there shall be taken into account incentive payments, and payment adjustments under subsection (b)(3)(B)(ix) or (n) of section 1886.. (2)Section 1851(i)(1) of the Social Security Act (42 U.S.C. 1395w–21(i)(1)) is amended by striking and 1886(h)(3)(D) and inserting 1886(h)(3)(D), and 1853(m). (3)Section 1853 of the Social Security Act (42 U.S.C. 1395w–23), as amended by section 4311(d)(1), is amended— (A)in subsection (c)— (i)in paragraph (1)(D)(i), by striking 1848(o) and inserting , 1848(o), and 1886(n); and (ii)in paragraph (6)(A), by inserting and subsections (b)(3)(B)(ix) and (n) of section 1886 after section 1848; and (B)in subsection (f), by inserting and subsection (m) after under subsection (l).

4313.

Treatment of payments and savings; implementation funding

(a)

Premium hold harmless

(1)

In general

Section 1839(a)(1) of the Social Security Act (42 U.S.C. 1395r(a)(1)) is amended by adding at the end the following: In applying this paragraph there shall not be taken into account additional payments under section 1848(o) and section 1853(l)(3) and the Government contribution under section 1844(a)(3).. (2)

Payment

Section 1844(a) of such Act (42 U.S.C. 1395w(a)) is amended— (A)in paragraph (2), by striking the period at the end and inserting ; plus; and (B)by adding at the end the following new paragraph: (3)a Government contribution equal to the amount of payment incentives payable under sections 1848(o) and 1853(l)(3).. (b)

Medicare Improvement Fund

Section 1898 of the Social Security Act (42 U.S.C. 1395iii), as added by section 7002(a) of the Supplemental Appropriations Act, 2008 (Public Law 110–252) and as amended by section 188(a)(2) of the Medicare Improvements for Patients and Providers Act of 2008 (Public Law 110–275; 122 Stat. 2589) and by section 6 of the QI Program Supplemental Funding Act of 2008, is amended— (1)in subsection (a)— (A)by inserting medicare before fee-for-service; and (B)by inserting before the period at the end the following: including, but not limited to, an increase in the conversion factor under section 1848(d) to address, in whole or in part, any projected shortfall in the conversion factor for 2014 relative to the conversion factor for 2008 and adjustments to payments for items and services furnished by providers of services and suppliers under such original medicare fee-for-service program; and (2)in subsection (b)— (A)in paragraph (1), by striking during fiscal year 2014, and all that follows and inserting the following: during— (A)fiscal year 2014, $22,290,000,000; and (B)fiscal year 2020 and each subsequent fiscal year, the Secretary’s estimate, as of July 1 of the fiscal year, of the aggregate reduction in expenditures under this title during the preceding fiscal year directly resulting from the reduction in payment amounts under sections 1848(a)(7), 1853(l)(4), 1853(m)(4), and 1886(b)(3)(B)(ix).; and (B)by adding at the end the following new paragraph: (4)

No effect on payments in subsequent years

In the case that expenditures from the Fund are applied to, or otherwise affect, a payment rate for an item or service under this title for a year, the payment rate for such item or service shall be computed for a subsequent year as if such application or effect had never occurred.. (c)

Implementation funding

In addition to funds otherwise available, out of any funds in the Treasury not otherwise appropriated, there are appropriated to the Secretary of Health and Human Services for the Center for Medicare & Medicaid Services Program Management Account, $60,000,000 for each of fiscal years 2009 through 2015 and $30,000,000 for each succeeding fiscal year through fiscal year 2019, which shall be available for purposes of carrying out the provisions of (and amendments made by) this part. Amounts appropriated under this subsection for a fiscal year shall be available until expended.

4314.

Study on application of EHR payment incentives for providers not receiving other incentive payments

(a)

Study

(1)

In general

The Secretary of Health and Human Services shall conduct a study to determine the extent to which and manner in which payment incentives (such as under title XVIII or XIX of the Social Security Act) and other funding for purposes of implementing and using certified EHR technology (as defined in section 3000 of the Public Health Service Act) should be made available to health care providers who are receiving minimal or no payment incentives or other funding under this Act, under title XVIII or XIX of the Social Security Act, or otherwise, for such purposes. (2)

Details of study

Such study shall include an examination of— (A)the adoption rates of certified EHR technology by such health care providers; (B)the clinical utility of such technology by such health care providers; (C)whether the services furnished by such health care providers are appropriate for or would benefit from the use of such technology; (D)the extent to which such health care providers work in settings that might otherwise receive an incentive payment or other funding under this Act, title XVIII or XIX of the Social Security Act, or otherwise; (E)the potential costs and the potential benefits of making payment incentives and other funding available to such health care providers; and (F)any other issues the Secretary deems to be appropriate. (b)

Report

Not later than June 30, 2010, the Secretary shall submit to Congress a report on the findings and conclusions of the study conducted under subsection (a).

III

Medicaid Funding

4321.

Medicaid provider HIT adoption and operation payments; implementation funding

(a)

In general

Section 1903 of the Social Security Act (42 U.S.C. 1396b) is amended— (1)in subsection (a)(3)— (A)by striking and at the end of subparagraph (D); (B)by striking plus at the end of subparagraph (E) and inserting and; and (C)by adding at the end the following new subparagraph: (F) (i)100 percent of so much of the sums expended during such quarter as are attributable to payments for certified EHR technology (and support services including maintenance and training that is for, or is necessary for the adoption and operation of, such technology) by Medicaid providers described in subsection (t)(1); and (ii)90 percent of so much of the sums expended during such quarter as are attributable to payments for reasonable administrative expenses related to the administration of payments described in clause (i) if the State meets the condition described in subsection (t)(9); plus; and (2)by inserting after subsection (s) the following new subsection: (t) (1)For purposes of subsection (a)(3)(F), the payments for certified EHR technology (and support services including maintenance that is for, or is necessary for the operation of, such technology) by Medicaid providers described in this paragraph are payments made by the State in accordance with this subsection of 85 percent of the net allowable costs of Medicaid providers (as defined in paragraph (2)) for such technology (and support services). (2)In this subsection and subsection (a)(3)(F), the term Medicaid provider means— (A)an eligible professional (as defined in paragraph (3)(B)) who is not hospital-based and has at least 30 percent of the professional’s patient volume (as estimated in accordance with standards established by the Secretary) attributable to individuals who are receiving medical assistance under this title; and (B) (i)a children’s hospital, (ii) an acute-care hospital that is not described in clause (i) and that has at least 10 percent of the hospital’s patient volume (as estimated in accordance with standards established by the Secretary) attributable to individuals who are receiving medical assistance under this title, or (iii)a Federally-qualified health center or rural health clinic that has at least 30 percent of the center’s or clinic’s patient volume (as estimated in accordance with standards established by the Secretary) attributable to individuals who are receiving medical assistance under this title.An eligible professional shall not qualify as a Medicaid provider under this subsection unless the eligible professional has waived, in a manner specified by the Secretary, any right to payment under section 1848(o) with respect to the adoption or support of certified EHR technology by the professional. In applying clauses (ii) and (iii) of subparagraph (B), the standards established by the Secretary for patient volume shall include individuals enrolled in a Medicaid managed care plan (under section 1903(m) or section 1932). (3)In this subsection and subsection (a)(3)(F): (A)The term certified EHR technology means a qualified electronic health record (as defined in 3000(13) of the Public Health Service Act) that is certified pursuant to section 3001(c)(5) of such Act as meeting standards adopted under section 3004 of such Act that are applicable to the type of record involved (as determined by the Secretary, such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals). (B)The term eligible professional means a physician as defined in paragraphs (1) and (2) of section 1861(r), and includes a nurse mid-wife and a nurse practitioner. (C)The term hospital-based means, with respect to an eligible professional, a professional (such as a pathologist, anesthesiologist, or emergency physician) who furnishes substantially all of the individual’s professional services in a hospital setting (whether inpatient or outpatient) and through the use of the facilities and equipment, including computer equipment, of the hospital. (4) (A)The term allowable costs means, with respect to certified EHR technology of a Medicaid provider, costs of such technology (and support services including maintenance and training that is for, or is necessary for the adoption and operation of, such technology) as determined by the Secretary to be reasonable. (B)The term net allowable costs means allowable costs reduced by any payment that is made to the Medicaid provider involved from any other source that is directly attributable to payment for certified EHR technology or services described in subparagraph (A). (C)In no case shall— (i)the aggregate allowable costs under this subsection (covering one or more years) with respect to a Medicaid provider described in paragraph (2)(A) for purchase and initial implementation of certified EHR technology (and services described in subparagraph (A)) exceed $25,000 or include costs over a period of longer than 5 years; (ii)for costs not described in clause (i) relating to the operation, maintenance, or use of certified EHR technology, the annual allowable costs under this subsection with respect to such a Medicaid provider for costs not described in clause (i) for any year exceed $10,000; (iii)payment described in paragraph (1) for costs described in clause (ii) be made with respect to such a Medicaid provider over a period of more than 5 years; (iv)the aggregate allowable costs under this subsection with respect to such a Medicaid provider for all costs exceed $75,000; or (v)the allowable costs, whether for purchase and initial implementation, maintenance, or otherwise, for a Medicaid provider described in paragraph (2)(B) exceed such aggregate or annual limitation as the Secretary shall establish, based on an amount determined by the Secretary as being adequate to adopt and maintain certified EHR technology, consistent with paragraph (6). (5)Payments described in paragraph (1) are not in accordance with this subsection unless the following requirements are met: (A)The State provides assurances satisfactory to the Secretary that amounts received under subsection (a)(3)(F) with respect to costs of a Medicaid provider are paid directly to such provider without any deduction or rebate. (B)Such Medicaid provider is responsible for payment of the costs described in such paragraph that are not provided under this title. (C)With respect to payments to such Medicaid provider for costs other than costs related to the initial adoption of certified EHR technology, the Medicaid provider demonstrates meaningful use of certified EHR technology through a means that is approved by the State and acceptable to the Secretary, and that may be based upon the methodologies applied under section 1848(o) or 1886(n). (D)To the extent specified by the Secretary, the certified EHR technology is compatible with State or Federal administrative management systems. (6) (A)In no case shall the payments described in paragraph (1), with respect to a hospital, exceed in the aggregate the product of— (i)the overall hospital EHR amount for the hospital computed under subparagraph (B); and (ii)the Medicaid share for such hospital computed under subparagraph (C). (B)For purposes of this paragraph, the overall hospital EHR amount, with respect to a hospital, is the sum of the applicable amounts specified in section 1886(n)(2)(A) for such hospital for the first 4 payment years (as estimated by the Secretary) determined as if the Medicare share specified in clause (ii) of such section were 1. The Secretary shall publish in the Federal Register the overall hospital EHR amount for each hospital eligible for payments under this subsection. In computing amounts under clause (ii) for payment years after the first payment year, the Secretary shall assume that in subsequent payment years discharges increase at the average annual rate of growth of the most recent 3 years for which discharge data are available per year. (C)The Medicaid share computed under this subparagraph, for a hospital for a period specified by the Secretary, shall be calculated in the same manner as the Medicare share under section 1886(n)(2)(D) for such a hospital and period, except that there shall be substituted for the numerator under clause (i) of such section the amount that is equal to the number of inpatient-bed-days (as established by the Secretary) which are attributable to individuals who are receiving medical assistance under this title and who are not described in section 1886(n)(2)(D)(i). In computing inpatient-bed-days under the previous sentence, the Secretary shall take into account inpatient-bed-days attributable to inpatient-bed-days that are paid for individuals enrolled in a Medicaid managed care plan (under section 1903(m) or section 1932). (7)With respect to health care providers other than hospitals, the Secretary shall ensure coordination of the different programs for payment of such health care providers for adoption or use of health information technology (including certified EHR technology), as well as payments for such health care providers provided under this title or title XVIII, to assure no duplication of funding. (8) In carrying out paragraph (5)(C), the State and Secretary shall seek, to the maximum extent practicable, to avoid duplicative requirements from Federal and State Governments to demonstrate meaningful use of certified EHR technology under this title and title XVIII. In doing so, the Secretary may deem satisfaction of requirements for such meaningful use for a payment year under title XVIII to be sufficient to qualify as meaningful use under this subsection. The Secretary may also specify the reporting periods under this subsection in order to carry out this paragraph. (9)In order to be provided Federal financial participation under subsection (a)(3)(F)(ii), a State must demonstrate to the satisfaction of the Secretary, that the State— (A)is using the funds provided for the purposes of administering payments under this subsection, including tracking of meaningful use by Medicaid providers; (B)is conducting adequate oversight of the program under this subsection, including routine tracking of meaningful use attestations and reporting mechanisms; and (C)is pursuing initiatives to encourage the adoption of certified EHR technology to promote health care quality and the exchange of health care information under this title, subject to applicable laws and regulations governing such exchange. (10)The Secretary shall periodically submit reports to the Committee on Energy and Commerce of the House of Representatives and the Committee on Finance of the Senate on status, progress, and oversight of payments under paragraph (1).. (b)

Implementation funding

In addition to funds otherwise available, out of any funds in the Treasury not otherwise appropriated, there are appropriated to the Secretary of Health and Human Services for the Center for Medicare & Medicaid Services Program Management Account, $40,000,000 for each of fiscal years 2009 through 2015 and $20,000,000 for each succeeding fiscal year through fiscal year 2019, which shall be available for purposes of carrying out the provisions of (and the amendments made by) this part. Amounts appropriated under this subsection for a fiscal year shall be available until expended.

D

Privacy

4400.

Definitions

In this subtitle, except as specified otherwise: (1)

Breach

The term breach means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security, privacy, or integrity of protected health information maintained by or on behalf of a person. Such term does not include any unintentional acquisition, access, use, or disclosure of such information by an employee or agent of the covered entity or business associate involved if such acquisition, access, use, or disclosure, respectively, was made in good faith and within the course and scope of the employment or other contractual relationship of such employee or agent, respectively, with the covered entity or business associate and if such information is not further acquired, accessed, used, or disclosed by such employee or agent. (2)

Business associate

The term business associate has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (3)

Covered entity

The term covered entity has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (4)

Disclose

The terms disclose and disclosure have the meaning given the term disclosure in section 160.103 of title 45, Code of Federal Regulations. (5)

Electronic health record

The term electronic health record means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. (6)

Health care operations

The term health care operation has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (7)

Health care provider

The term health care provider has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (8)

Health plan

The term health plan has the meaning given such term in section 1171(5) of the Social Security Act. (9)

National Coordinator

The term National Coordinator means the head of the Office of the National Coordinator for Health Information Technology established under section 3001(a) of the Public Health Service Act, as added by section 4101. (10)

Payment

The term payment has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (11)

Personal health record

The term personal health record means an electronic record of individually identifiable health information on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or for the individual. (12)

Protected health information

The term protected health information has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (13)

Secretary

The term Secretary means the Secretary of Health and Human Services. (14)

Security

The term security has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations. (15)

State

The term State means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. (16)

Treatment

The term treatment has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (17)

Use

The term use has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (18)

Vendor of personal health records

The term vendor of personal health records means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.

I

Improved Privacy Provisions and Security Provisions

4401.

Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions

(a)

Application of security provisions

Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. (b)

Application of civil and criminal penalties

In the case of a business associate that violates any security provision specified in subsection (a), sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision. (c)

Annual guidance

For the first year beginning after the date of the enactment of this Act and annually thereafter, the Secretary of Health and Human Services shall, in consultation with industry stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of the date before the enactment of this Act.

4402.

Notification in the case of breach

(a)

In general

A covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information (as defined in subsection (h)(1)) shall, in the case of a breach of such information that is discovered by the covered entity, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, or disclosed as a result of such breach. (b)

Notification of covered entity by business associate

A business associate of a covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, following the discovery of a breach of such information, notify the covered entity of such breach. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, or disclosed during such breach. (c)

Breaches treated as discovered

For purposes of this section, a breach shall be treated as discovered by a covered entity or by a business associate as of the first day on which such breach is known to such entity or associate, respectively, (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of such entity or associate, respectively) or should reasonably have been known to such entity or associate (or person) to have occurred. (d)

Timeliness of notification

(1)

In general

Subject to subsection (g), all notifications required under this section shall be made without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach by the covered entity involved (or business associate involved in the case of a notification required under subsection (b)). (2)

Burden of proof

The covered entity involved (or business associate involved in the case of a notification required under subsection (b)), shall have the burden of demonstrating that all notifications were made as required under this part, including evidence demonstrating the necessity of any delay. (e)

Methods of notice

(1)

Individual notice

Notice required under this section to be provided to an individual, with respect to a breach, shall be provided promptly and in the following form: (A)Written notification by first-class mail to the individual (or the next of kin of the individual if the individual is deceased) at the last known address of the individual or the next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. The notification may be provided in one or more mailings as information is available. (B)In the case in which there is insufficient, or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes direct written (or, if specified by the individual under subparagraph (A), electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are 10 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting for a period determined by the Secretary on the home page of the website of the covered entity involved or notice in major print or broadcast media, including major media in geographic areas where the individuals affected by the breach likely reside. Such a notice in media or web posting will include a toll-free phone number where an individual can learn whether or not the individual’s unsecured protected health information is possibly included in the breach. (C)In any case deemed by the covered entity involved to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity, in addition to notice provided under subparagraph (A), may provide information to individuals by telephone or other means, as appropriate. (2)

Media notice

Notice shall be provided to prominent media outlets serving a State or jurisdiction, following the discovery of a breach described in subsection (a), if the unsecured protected health information of more than 500 residents of such State or jurisdiction is, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. (3)

Notice to Secretary

Notice shall be provided to the Secretary by covered entities of unsecured protected health information that has been acquired or disclosed in a breach. If the breach was with respect to 500 or more individuals than such notice must be provided immediately. If the breach was with respect to less than 500 individuals, the covered entity involved may maintain a log of any such breach occurring and annually submit such a log to the Secretary documenting such breaches occurring during the year involved. (4)

Posting on HHS public website

The Secretary shall make available to the public on the Internet website of the Department of Health and Human Services a list that identifies each covered entity involved in a breach described in subsection (a) in which the unsecured protected health information of more than 500 individuals is acquired or disclosed. (f)

Content of notification

Regardless of the method by which notice is provided to individuals under this section, notice of a breach shall include, to the extent possible, the following: (1)A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known. (2)A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code). (3)The steps individuals should take to protect themselves from potential harm resulting from the breach. (4)A brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches. (5)Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, website, or postal address. (g)

Delay of notification authorized for law enforcement purposes

If a law enforcement official determines that a notification, notice, or posting required under this section would impede a criminal investigation or cause damage to national security, such notification, notice, or posting shall be delayed in the same manner as provided under section 164.528(a)(2) of title 45, Code of Federal Regulations, in the case of a disclosure covered under such section. (h)

Unsecured protected health information

(1)

Definition

(A)

In general

Subject to subparagraph (B), for purposes of this section, the term unsecured protected health information means protected health information that is not secured through the use of a technology or methodology specified by the Secretary in the guidance issued under paragraph (2). (B)

Exception in case timely guidance not issued

In the case that the Secretary does not issue guidance under paragraph (2) by the date specified in such paragraph, for purposes of this section, the term unsecured protected health information shall mean protected health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute. (2)

Guidance

For purposes of paragraph (1) and section 407(f)(3), not later than the date that is 60 days after the date of the enactment of this Act, the Secretary shall, after consultation with stakeholders, issue (and annually update) guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. (i)

Report to Congress on breaches

(1)

In general

Not later than 12 months after the date of the enactment of this Act and annually thereafter, the Secretary shall prepare and submit to the Committee on Finance and the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report containing the information described in paragraph (2) regarding breaches for which notice was provided to the Secretary under subsection (e)(3). (2)

Information

The information described in this paragraph regarding breaches specified in paragraph (1) shall include— (A)the number and nature of such breaches; and (B)actions taken in response to such breaches. (j)

Regulations; Effective date

To carry out this section, the Secretary of Health and Human Services shall promulgate interim final regulations by not later than the date that is 180 days after the date of the enactment of this title. The provisions of this section shall apply to breaches that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations.

4403.

Education on Health Information Privacy

(a)

Regional office privacy advisors

Not later than 6 months after the date of the enactment of this Act, the Secretary shall designate an individual in each regional office of the Department of Health and Human Services to offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related to Federal privacy and security requirements for protected health information. (b)

Education initiative on uses of health information

Not later than 12 months after the date of the enactment of this Act, the Office for Civil Rights within the Department of Health and Human Services shall develop and maintain a multi-faceted national education initiative to enhance public transparency regarding the uses of protected health information, including programs to educate individuals about the potential uses of their protected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present information in a clear and understandable manner.

4404.

Application of privacy provisions and penalties to business associates of covered entities

(a)

Application of contract requirements

In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations, with such covered entity, the business associate may use and disclose such protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subtitle that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. (b)

Application of knowledge elements associated with contracts

Section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract. (c)

Application of civil and criminal penalties

In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such provisions apply to a person who violates a provision of part C of title XI of such Act.

4405.

Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format

(a)

Requested restrictions on certain disclosures of health information

In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwithstanding paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— (1)except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and (2)the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. (b)

Disclosures required To be limited to the limited data set or the minimum necessary

(1)

In general

(A)

In general

Subject to subparagraph (B), a covered entity shall be treated as being in compliance with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect to the use, disclosure, or request of protected health information described in such section, only if the covered entity limits such protected health information, to the extent practicable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if needed by such entity, to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, respectively. (B)

Guidance

Not later than 18 months after the date of the enactment of this section, the Secretary shall issue guidance on what constitutes minimum necessary for purposes of subpart E of part 164 of title 45, Code of Federal Regulation. In issuing such guidance the Secretary shall take into consideration the guidance under section 4424(c). (C)

Sunset

Subparagraph (A) shall not apply on and after the effective date on which the Secretary issues the guidance under subparagraph (B). (2)

Determination of minimum necessary

For purposes of paragraph (1), in the case of the disclosure of protected health information, the covered entity or business associate disclosing such information shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure. (3)

Application of exceptions

The exceptions described in section 164.502(b)(2) of title 45, Code of Federal Regulations, shall apply to the requirement under paragraph (1) as of the effective date described in section 4423 in the same manner that such exceptions apply to section 164.502(b)(1) of such title before such date. (4)

Rule of construction

Nothing in this subsection shall be construed as affecting the use, disclosure, or request of protected health information that has been de-identified. (c)

Accounting of certain protected health information disclosures required if covered entity uses electronic health record

(1)

In general

In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information— (A)the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information; and (B)an individual shall have a right to receive an accounting of disclosures described in such paragraph of such information made by such covered entity during only the three years prior to the date on which the accounting is requested. (2)

Regulations

The Secretary shall promulgate regulations on what information shall be collected about each disclosure referred to in paragraph (1)(A) not later than 18 months after the date on which the Secretary adopts standards on accounting for disclosure described in the section 3002(b)(2)(B)(iv) of the Public Health Service Act, as added by section 4101. Such regulations shall only require such information to be collected through an electronic health record in a manner that takes into account the interests of individuals in learning the circumstances under which their protected health information is being disclosed and takes into account the administrative burden of accounting for such disclosures. (3)

Construction

Nothing in this subsection shall be construed as requiring a covered entity to account for disclosures of protected health information that are not made by such covered entity or by a business associate acting on behalf of the covered entity. (4)

Effective date

(A)

Current users of electronic records

In the case of a covered entity insofar as it acquired an electronic health record as of January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such a record on and after January 1, 2014. (B)

Others

In the case of a covered entity insofar as it acquires an electronic health record after January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such record on and after the later of the following: (i)January 1, 2011; or (ii)the date that it acquires an electronic health record. (d)

Review of health care operations

Not later than 18 months after the date of the enactment of this title, the Secretary shall promulgate regulations to eliminate from the definition of health care operations under section 164.501 of title 45, Code of Federal Regulations, those activities that can reasonably and efficiently be conducted through the use of information that is de-identified (in accordance with the requirements of section 164.514(b) of such title) or that should require a valid authorization for use or disclosure. In promulgating such regulations, the Secretary may choose to narrow or clarify activities that the Secretary chooses to retain in the definition of health care operations and the Secretary shall take into account the report under section 424(d). In such regulations the Secretary shall specify the date on which such regulations shall apply to disclosures made by a covered entity, but in no case would such date be sooner than the date that is 24 months after the date of the enactment of this section. (e)

Prohibition on sale of electronic health records or protected health information

(1)

In general

Except as provided in paragraph (2), a covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization that includes, in accordance with such section, a specification of whether the protected health information can be further exchanged for remuneration by the entity receiving protected health information of that individual. (2)

Exceptions

Paragraph (1) shall not apply in the following cases: (A)The purpose of the exchange is for research or public health activities (as described in sections 164.501, 164.512(i), and 164.512(b) of title 45, Code of Federal Regulations) and the price charged reflects the costs of preparation and transmittal of the data for such purpose. (B)The purpose of the exchange is for the treatment of the individual and the price charges reflects not more than the costs of preparation and transmittal of the data for such purpose. (C)The purpose of the exchange is the health care operation specifically described in subparagraph (iv) of paragraph (6) of the definition of health care operations in section 164.501 of title 45, Code of Federal Regulations. (D)The purpose of the exchange is for remuneration that is provided by a covered entity to a business associate for activities involving the exchange of protected health information that the business associate undertakes on behalf of and at the specific request of the covered entity pursuant to a business associate agreement. (E)The purpose of the exchange is to provide an individual with a copy of the individual’s protected health information pursuant to section 164.524 of title 45, Code of Federal Regulations. (F)The purpose of the exchange is otherwise determined by the Secretary in regulations to be similarly necessary and appropriate as the exceptions provided in subparagraphs (A) through (E). (3)

Regulations

The Secretary shall promulgate regulations to carry out paragraph (this subsection, including exceptions described in paragraph (2), not later than 18 months after the date of the enactment of this title. (4)

Effective date

Paragraph (1) shall apply to exchanges occurring on or after the date that is 6 months after the date of the promulgation of final regulations implementing this subsection. (f)

Access to certain information in electronic format

In applying section 164.524 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information of an individual— (1)the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format; and (2)notwithstanding paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information (or a summary or explanation of such information) if such copy (or summary or explanation) is in an electronic form shall not be greater than the entity’s labor costs in responding to the request for the copy (or summary or explanation).

4406.

Conditions on certain contacts as part of health care operations

(a)

Marketing

(1)

In general

A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of such title. (2)

Payment for certain communications

A covered entity or business associate may not receive direct or indirect payment in exchange for making any communication described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, except— (A)a business associate of a covered entity may receive payment from the covered entity for making any such communication on behalf of the covered entity that is consistent with the written contract (or other written arrangement) described in section 164.502(e)(2) of such title between such business associate and covered entity; or (B)a covered entity may receive payment in exchange for making any such communication if the entity obtains from the recipient of the communication, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization (as described in paragraph (b) of such section) with respect to such communication. (b)

Fundraising

Fundraising for the benefit of a covered entity shall not be considered a health care operation for purposes of section 164.501 of title 45, Code of Federal Regulations. (c)

Effective date

This section shall apply to contracting occurring on or after the effective date specified under section 4423.

4407.

Temporary breach notification requirement for vendors of personal health records and other non-HIPAA covered entities

(a)

In general

In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii) or (iii) of section 4424(b)(1)(A), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall— (1)notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and (2)notify the Federal Trade Commission. (b)

Notification by third party service providers

A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii) or (iii) of section 4424(b)(1)(A) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each individual whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. (c)

Application of requirements for timeliness, method, and content of notifications

Subsections (c), (d), (e), and (f) of section 402 shall apply to a notification required under subsection (a) and a vendor of personal health records, an entity described in subsection (a) and a third party service provider described in subsection (b), with respect to a breach of security under subsection (a) of unsecured PHR identifiable health information in such records maintained or offered by such vendor, in a manner specified by the Federal Trade Commission. (d)

Notification of the Secretary

Upon receipt of a notification of a breach of security under subsection (a)(2), the Federal Trade Commission shall notify the Secretary of such breach. (e)

Enforcement

A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. (f)

Definitions

For purposes of this section: (1)

Breach of security

The term breach of security means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual. (2)

PHR identifiable health information

The term PHR identifiable health information means individually identifiable health information, as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), and includes, with respect to an individual, information— (A)that is provided by or on behalf of the individual; and (B)that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. (3)

Unsecured PHR identifiable health information

(A)

In general

Subject to subparagraph (B), the term unsecured PHR identifiable health information means PHR identifiable health information that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under section 4402(h)(2). (B)

Exception in case timely guidance not issued

In the case that the Secretary does not issue guidance under section 4402(h)(2) by the date specified in such section, for purposes of this section, the term unsecured PHR identifiable health information shall mean PHR identifiable health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and that is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute. (g)

Regulations; Effective date; sunset

(1)

Regulations; effective date

To carry out this section, the Secretary of Health and Human Services shall promulgate interim final regulations by not later than the date that is 180 days after the date of the enactment of this section. The provisions of this section shall apply to breaches of security that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations. (2)

Sunset

The provisions of this section shall not apply to breaches of security occurring on or after the earlier of the following the dates: (A)The date on which a standard relating to requirements for entities that are not covered entities that includes requirements relating to breach notification has been promulgated by the Secretary. (B)The date on which a standard relating to requirements for entities that are not covered entities that includes requirements relating to breach notification has been promulgated by the Federal Trade Commission and has taken effect.

4408.

Business associate contracts required for certain entities

Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subtitle and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of the date of enactment of this title.

4409.

Clarification of application of wrongful disclosures criminal penalties

Section 1177(a) of the Social Security Act (42 U.S.C. 1320d–6(a)) is amended by adding at the end the following new sentence: For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1180(b)(3)) and the individual obtained or disclosed such information without authorization..

4410.

Improved enforcement

(a)

In general

Section 1176 of the Social Security Act (42 U.S.C. 1320d–5) is amended— (1)in subsection (b)(1), by striking the act constitutes an offense punishable under section 1177 and inserting a penalty has been imposed under section 1177 with respect to such act; and (2)by adding at the end the following new subsection: (c)

Noncompliance due to willful neglect

(1)

In general

A violation of a provision of this part due to willful neglect is a violation for which the Secretary is required to impose a penalty under subsection (a)(1). (2)

Required investigation

For purposes of paragraph (1), the Secretary shall formally investigate any complaint of a violation of a provision of this part if a preliminary investigation of the facts of the complaint indicate such a possible violation due to willful neglect.. (b)

Effective date; regulations

(1)The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after the date of the enactment of this title. (2)Not later than 18 months after the date of the enactment of this title, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments. (c)

Distribution of certain civil monetary penalties collected

(1)

In general

Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subtitle or section 1176 of the Social Security Act (42 U.S.C. 1320d–5) insofar as such section relates to privacy or security shall be transferred to the Office of Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subtitle and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of the date of enactment of this Act. (2)

GAO report

Not later than 18 months after the date of the enactment of this title, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. (3)

Establishment of methodology to distribute percentage of CMPs collected to harmed individuals

Not later than 3 years after the date of the enactment of this title, the Secretary shall establish by regulation and based on the recommendations submitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. (4)

Application of methodology

The methodology under paragraph (3) shall be applied with respect to civil monetary penalties or monetary settlements imposed on or after the effective date of the regulation. (d)

Tiered increase in amount of civil monetary penalties

(1)

In general

Section 1176(a)(1) of the Social Security Act (42 U.S.C. 1320d–5(a)(1)) is amended by striking who violates a provision of this part a penalty of not more than and all that follows and inserting the following: who violates a provision of this part— (A)in the case of a violation of such provision in which it is established that the person did not know (and by exercising reasonable diligence would not have known) that such person violated such provision, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(A) but not to exceed the amount described in paragraph (3)(D); (B)in the case of a violation of such provision in which it is established that the violation was due to reasonable cause and not to willful neglect, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D); and (C)in the case of a violation of such provision in which it is established that the violation was due to willful neglect— (i)if the violation is corrected as described in subsection (b)(3)(A), a penalty in an amount that is at least the amount described in paragraph (3)(C) but not to exceed the amount described in paragraph (3)(D); and (ii)if the violation is not corrected as described in such subsection, a penalty in an amount that is at least the amount described in paragraph (3)(D).In determining the amount of a penalty under this section for a violation, the Secretary shall base such determination on the nature and extent of the violation and the nature and extent of the harm resulting from such violation.. (2)

Tiers of penalties described

Section 1176(a) of such Act (42 U.S.C. 1320d–5(a)) is further amended by adding at the end the following new paragraph: (3)

Tiers of penalties described

For purposes of paragraph (1), with respect to a violation by a person of a provision of this part— (A)the amount described in this subparagraph is $100 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $25,000; (B)the amount described in this subparagraph is $1,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $100,000; (C)the amount described in this subparagraph is $10,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $250,000; and (D)the amount described in this subparagraph is $50,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.. (3)

Conforming amendments

Section 1176(b) of such Act (42 U.S.C. 1320d–5(b)) is amended— (A)by striking paragraph (2) and redesignating paragraphs (3) and (4) as paragraphs (2) and (3), respectively; and (B)in paragraph (2), as so redesignated— (i)in subparagraph (A), by striking in subparagraph (B), a penalty may not be imposed under subsection (a) if and all that follows through the failure to comply is corrected and inserting in subparagraph (B) or subsection (a)(1)(C), a penalty may not be imposed under subsection (a) if the failure to comply is corrected; and (ii)in subparagraph (B), by striking (A)(ii) and inserting (A) each place it appears. (4)

Effective date

The amendments made by this subsection shall apply to violations occurring after the date of the enactment of this title. (e)

Enforcement through State attorneys general

(1)

In general

Section 1176 of the Social Security Act (42 U.S.C. 1320d–5) is amended by adding at the end the following new subsection: (c)

Enforcement by State attorneys general

(1)

Civil action

Except as provided in subsection (b), in any case in which the attorney general of a State has reason to believe that an interest of one or more of the residents of that State has been or is threatened or adversely affected by any person who violates a provision of this part, the attorney general of the State, as parens patriae, may bring a civil action on behalf of such residents of the State in a district court of the United States of appropriate jurisdiction— (A)to enjoin further such violation by the defendant; or (B)to obtain damages on behalf of such residents of the State, in an amount equal to the amount determined under paragraph (2). (2)

Statutory damages

(A)

In general

For purposes of paragraph (1)(B), the amount determined under this paragraph is the amount calculated by multiplying the number of violations by up to $100. For purposes of the preceding sentence, in the case of a continuing violation, the number of violations shall be determined consistent with the HIPAA privacy regulations (as defined in section 1180(b)(3)) for violations of subsection (a). (B)

Limitation

The total amount of damages imposed on the person for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000. (C)

Reduction of damages

In assessing damages under subparagraph (A), the court may consider the factors the Secretary may consider in determining the amount of a civil money penalty under subsection (a) under the HIPAA privacy regulations. (3)

Attorney fees

In the case of any successful action under paragraph (1), the court, in its discretion, may award the costs of the action and reasonable attorney fees to the State. (4)

Notice to Secretary

The State shall serve prior written notice of any action under paragraph (1) upon the Secretary and provide the Secretary with a copy of its complaint, except in any case in which such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action. The Secretary shall have the right— (A)to intervene in the action; (B)upon so intervening, to be heard on all matters arising therein; and (C)to file petitions for appeal. (5)

Construction

For purposes of bringing any civil action under paragraph (1), nothing in this section shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State. (6)

Venue; service of process

(A)

Venue

Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code. (B)

Service of process

In an action brought under paragraph (1), process may be served in any district in which the defendant— (i)is an inhabitant; or (ii)maintains a physical place of business. (7)

Limitation on State action while Federal action is pending

If the Secretary has instituted an action against a person under subsection (a) with respect to a specific violation of this part, no State attorney general may bring an action under this subsection against the person with respect to such violation during the pendency of that action. (8)

Application of CMP statute of limitation

A civil action may not be instituted with respect to a violation of this part unless an action to impose a civil money penalty may be instituted under subsection (a) with respect to such violation consistent with the second sentence of section 1128A(c)(1).. (2)

Conforming amendments

Subsection (b) of such section, as amended by subsection (d)(3), is amended— (A)in paragraph (1), by striking A penalty may not be imposed under subsection (a) and inserting No penalty may be imposed under subsection (a) and no damages obtained under subsection (c); (B)in paragraph (2)(A)— (i)in the matter before clause (i), by striking a penalty may not be imposed under subsection (a) and inserting no penalty may be imposed under subsection (a) and no damages obtained under subsection (c); and (ii)in clause (ii), by inserting or damages after the penalty; (C)in paragraph (2)(B)(i), by striking The period and inserting With respect to the imposition of a penalty by the Secretary under subsection (a), the period; and (D)in paragraph (3), by inserting and any damages under subsection (c) after any penalty under subsection (a). (3)

Effective date

The amendments made by this subsection shall apply to violations occurring after the date of the enactment of this Act. (f)

Allowing continued use of corrective action

Such section is further amended by adding at the end the following new subsection: (d)

Allowing continued use of corrective action

Nothing in this section shall be construed as preventing the Office of Civil Rights of the Department of Health and Human Services from continuing, in its discretion, to use corrective action without a penalty in cases where the person did not know (and by exercising reasonable diligence would not have known) of the violation involved..

4411.

Audits

The Secretary shall provide for periodic audits to ensure that covered entities and business associates that are subject to the requirements of this subtitle and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of the date of enactment of this Act, comply with such requirements.

4412.

Securing individually identifiable health information

Notwithstanding the previous provisions of this title, a covered entity or business associate must use a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute to secure individually identifiable health information that is transmitted in the nationwide health information network supported in this title or physically transported outside of a covered entity’s or business associate’s secured, physical perimeter, including information transported on removable media and on portable devices. The Secretary may establish implementation criteria such that smaller covered entities with fewer resources are granted a longer period of time to comply with these requirements.

4413.

Special rule for information to reduce medication errors and improve patient safety

Nothing under this subtitle shall prevent a pharmacist from collecting and sharing information with patients in order to reduce medication errors and improve patient safety as long as any renumeration received for making such communication is reasonable and cost-based. Within 180 days of the date of the enactment of this Act, the Secretary shall promulgate regulations implementing this section.

II

Relationship to other laws; regulatory references; effective date; reports

4421.

Relationship to other laws

(a)

Application of HIPAA State preemption

Section 1178 of the Social Security Act (42 U.S.C. 1320d–7) shall apply to a provision or requirement under this subtitle in the same manner that such section applies to a provision or requirement under part C of title XI of such Act or a standard or implementation specification adopted or established under sections 1172 through 1174 of such Act. (b)

Health Insurance Portability and Accountability Act

The standards governing the privacy and security of individually identifiable health information promulgated by the Secretary under sections 262(a) and 264 of the Health Insurance Portability and Accountability Act of 1996 shall remain in effect to the extent that they are consistent with this subtitle. The Secretary shall by rule amend such Federal regulations as required to make such regulations consistent with this subtitle.

4422.

Regulatory references

Each reference in this subtitle to a provision of the Code of Federal Regulations refers to such provision as in effect on the date of the enactment of this title (or to the most recent update of such provision).

4423.

Effective date

Except as otherwise specifically provided, the provisions of part I shall take effect on the date that is 12 months after the date of the enactment of this title.

4424.

Studies, reports, guidance

(a)

Report on compliance

(1)

In general

For the first year beginning after the date of the enactment of this Act and annually thereafter, the Secretary shall prepare and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report concerning complaints of alleged violations of law, including the provisions of this subtitle as well as the provisions of subparts C and E of part 164 of title 45, Code of Federal Regulations, (as such provisions are in effect as of the date of enactment of this Act) relating to privacy and security of health information that are received by the Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year— (A)the number of such complaints; (B)the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided; (C)the number of such complaints that have resulted in the imposition of civil monetary penalties or have been resolved through monetary settlements, including the nature of the complaints involved and the amount paid in each penalty or settlement; (D)the number of compliance reviews conducted and the outcome of each such review; (E)the number of subpoenas or inquiries issued; (F)the Secretary’s plan for improving compliance with and enforcement of such provisions for the following year; and (G)the number of audits performed and a summary of audit findings pursuant to section 4411. (2)

Availability to public

Each report under paragraph (1) shall be made available to the public on the Internet website of the Department of Health and Human Services. (b)

Study and report on application of privacy and security requirements to non-HIPAA covered entities

(1)

Study

Not later than one year after the date of the enactment of this title, the Secretary, in consultation with the Federal Trade Commission, shall conduct a study, and submit a report under paragraph (2), on privacy and security requirements for entities that are not covered entities or business associates as of the date of the enactment of this title, including— (A)requirements relating to security, privacy, and notification in the case of a breach of security or privacy (including the applicability of an exemption to notification in the case of individually identifiable health information that has been rendered unusable, unreadable, or indecipherable through technologies or methodologies recognized by appropriate professional organization or standard setting bodies to provide effective security for the information) that should be applied to— (i)vendors of personal health records; (ii)entities that offer products or services through the website of a vendor of personal health records; (iii)entities that are not covered entities and that offer products or services through the websites of covered entities that offer individuals personal health records; (iv)entities that are not covered entities and that access information in a personal health record or send information to a personal health record; and (v)third party service providers used by a vendor or entity described in clause (i), (ii), (iii), or (iv) to assist in providing personal health record products or services; (B)a determination of which Federal government agency is best equipped to enforce such requirements recommended to be applied to such vendors, entities, and service providers under subparagraph (A); and (C)a timeframe for implementing regulations based on such findings. (2)

Report

The Secretary shall submit to the Committee on Finance, the Committee on Health, Education, Labor, and Pensions, and the Committee on Commerce of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the findings of the study under paragraph (1) and shall include in such report recommendations on the privacy and security requirements described in such paragraph. (c)

Guidance on implementation specification To de-identify protected health information

Not later than 12 months after the date of the enactment of this title, the Secretary shall, in consultation with stakeholders, issue guidance on how best to implement the requirements for the de-identification of protected health information under section 164.514(b) of title 45, Code of Federal Regulations. (d)

GAO report on treatment disclosures

Not later than one year after the date of the enactment of this title, the Comptroller General of the United States shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the best practices related to the disclosure among health care providers of protected health information of an individual for purposes of treatment of such individual. Such report shall include an examination of the best practices implemented by States and by other entities, such as health information exchanges and regional health information organizations, an examination of the extent to which such best practices are successful with respect to the quality of the resulting health care provided to the individual and with respect to the ability of the health care provider to manage such best practices, and an examination of the use of electronic informed consent for disclosing protected health information for treatment, payment, and health care operations.

January 27, 2009 The Committees on Ways and Means, Education and Labor, and Science and Technology discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed