69–006 

110TH CONGRESS REPT. 110–837 " ! HOUSE OF REPRESENTATIVES 2d Session Part 1 

PRO(TECH)T ACT OF 2008 

SEPTEMBER 11, 2008.—Ordered to be printed 

Mr. DINGELL, from the Committee on Energy and Commerce, 

submitted the following 

R E P O R T 

together with 

DISSENTING VIEWS 

[To accompany H.R. 6357] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Energy and Commerce, to whom was referred 

the bill (H.R. 6357) to amend the Public Health Service Act to promote the adoption of health information technology, and for other 

purposes, having considered the same, report favorably thereon 

with an amendment and recommend that the bill as amended do 

pass. 

CONTENTS 

Page 

Amendment .............................................................................................................. 2 

Purpose and Summary ............................................................................................ 29 

Background and Need for Legislation .................................................................... 30 

Hearings ................................................................................................................... 34 

Committee Consideration ........................................................................................ 35 

Committee Votes ...................................................................................................... 35 

Committee Oversight Findings ............................................................................... 35 

Statement of General Performance Goals and Objectives .................................... 35 

New Budget Authority, Entitlement Authority, and Tax Expenditures ............. 35 

Earmarks and Tax and Tariff Benefits .................................................................. 35 

Committee Cost Estimate ....................................................................................... 35 

Congressional Budget Office Estimate ................................................................... 36 

Federal Mandates Statement ................................................................................. 40 

Advisory Committee Statement .............................................................................. 40 

Constitutional Authority Statement ...................................................................... 40 

Applicability to Legislative Branch ........................................................................ 41 

Exchange of Committee Letters ............................................................................. 42 

Section-by-Section Analysis of the Legislation ...................................................... 49 


jbell on PROD1PC69 with REPORTS
2 

Changes in Existing Law Made by the Bill, as Reported ..................................... 58 

Dissenting Views ..................................................................................................... 82 

AMENDMENT

The amendment is as follows: 

Strike all after the enacting clause and insert the following: 

SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

(a) SHORT TITLE.—This Act may be cited as the ‘‘Protecting Records, Optimizing 

Treatment, and Easing Communication through Healthcare Technology Act of 2008’’ 

or the ‘‘PRO(TECH)T Act of 2008’’. 

(b) TABLE OF CONTENTS.—The table of contents of this Act is as follows: 

Sec. 1. Short title; table of contents.++TITLE I—HEALTH INFORMATION TECHNOLOGY 

Subtitle A—Promotion of Health Information Technology 

Part I—Improving Health Care Quality, Safety, and Efficiency 

Sec. 101. ONCHIT; standards development and adoption; Health Information Technology Resource Center.++‘‘TITLE XXX—HEALTH INFORMATION TECHNOLOGY AND QUALITY 

‘‘Sec. 3000. Definitions.++‘‘Subtitle A—Promotion of Health Information Technology 

‘‘Sec. 3001. Office of the National Coordinator of Health Information Technology. 

‘‘Sec. 3002. HIT Policy Committee. 

‘‘Sec. 3003. HIT Standards Committee. 

‘‘Sec. 3004. Process for adoption of endorsed recommendations. 

‘‘Sec. 3005. Application and use of adopted standards and implementation specifications by Federal agencies. 

‘‘Sec. 3006. Voluntary application and use of adopted standards and implementation specifications by private entities. 

‘‘Sec. 3007. Health Information Technology Resource Center. 

Sec. 102. Transitions.++Part II—Application and Use of Adopted Health Information Technology Standards; Reports 

Sec. 111. Coordination of Federal activities with adopted standards and implementation specifications. 

Sec. 112. Application to private entities. 

Sec. 113. Study and reports.++Subtitle B—Incentives for the Use of Health Information Technology 

Sec. 121. Grant, loan, and demonstration programs.++‘‘Subtitle B—Incentives for the Use of Health Information 

Technology 

‘‘Sec. 3011. Grants and loans to facilitate the widespread adoption of qualified health information technology. 

‘‘Sec. 3012. Demonstration program to integrate information technology into clinical education.++TITLE 

II—TESTING OF HEALTH INFORMATION TECHNOLOGY 

Sec. 201. National Institute for Standards and Technology testing. 

Sec. 202. Research and development programs.++TITLE III—PRIVACY AND SECURITY PROVISIONS 

Sec. 300. Definitions.++Subtitle A—Security Provisions 

Sec. 301. Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions. 

Sec. 302. Notification in the case of breach. 

Sec. 303. Education on Health Information Privacy and report on compliance.++Subtitle B—Improved Privacy 

Provisions and Additional Security Provisions 

Sec. 311. Application of penalties to business associates of covered entities for violations of privacy contract requirements. 

Sec. 312. Restrictions on certain disclosures and sales of health information; accounting of certain protected 

health information disclosures; access to certain information in electronic format. 

Sec. 313. Conditions on certain contacts as part of health care operations. 

Sec. 314. Study on application of privacy and security requirements to non-HIPAA covered entities. 

Sec. 315. Temporary breach notification requirement for vendors of personal health records and other nonHIPAA covered entities. 

Sec. 316. Business associate contracts required for certain entities. 

Sec. 317. Guidance on implementation specification to de-identify protected health information. 

Sec. 318. GAO report on treatment disclosures. 

Sec. 319. Clarification of application of wrongful disclosures criminal penalties. 

Sec. 320. Improved enforcement.++Subtitle C—Relationship to Other Laws; Regulatory References; Effective 

Date 

Sec. 321. Relationship to other laws. 

Sec. 322. Regulatory references. 

Sec. 323. Effective date. 


jbell on PROD1PC69 with REPORTS
3 

TITLE I—HEALTH INFORMATION 

TECHNOLOGY 

Subtitle A—Promotion of Health Information 

Technology 

PART I—IMPROVING HEALTH CARE QUALITY, SAFETY, 

AND EFFICIENCY 

SEC. 101. ONCHIT; STANDARDS DEVELOPMENT AND ADOPTION; HEALTH INFORMATION TECHNOLOGY RESOURCE CENTER. 

The Public Health Service Act (42 U.S.C. 201 et seq.) is amended by adding at 

the end the following: 

‘‘TITLE XXX—HEALTH INFORMATION 

TECHNOLOGY AND QUALITY 

‘‘SEC. 3000. DEFINITIONS. 

‘‘In this title: 

‘‘(1) ENTERPRISE INTEGRATION.—The term ‘enterprise integration’ means the 

electronic linkage of health care providers, health plans, the government, and 

other interested parties, to enable the electronic exchange and use of health information among all the components in the health care infrastructure in accordance with applicable law, and such term includes related application protocols 

and other related standards. 

‘‘(2) HEALTH CARE PROVIDER.—The term ‘health care provider’ means a hospital, skilled nursing facility, nursing facility, home health entity, health care 

clinic, Federally qualified health center, group practice (as defined in section 

1877(h)(4) of the Social Security Act), a pharmacist, a pharmacy, a laboratory, 

a physician (as defined in section 1861(r) of the Social Security Act), a practitioner (as described in section 1842(b)(18)(C) of the Social Security Act), a provider operated by, or under contract with, the Indian Health Service or by an 

Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act), tribal organization, or urban Indian organization (as defined in section 4 of the Indian Health Care Improvement Act), a rural health clinic, and 

any other category of facility or clinician determined appropriate by the Secretary. 

‘‘(3) HEALTH INFORMATION.—The term ‘health information’ has the meaning 

given such term in section 1171(4) of the Social Security Act. 

‘‘(4) HEALTH INFORMATION TECHNOLOGY.—The term ‘health information technology’ means hardware, software, integrated technologies and related licenses, 

intellectual property, upgrades, and packaged solutions sold as services that are 

specifically designed for use by health care entities for the electronic creation, 

maintenance, or exchange of health information. 

‘‘(5) HEALTH PLAN.—The term ‘health plan’ has the meaning given such term 

in section 1171(5) of the Social Security Act. 

‘‘(6) HIT POLICY COMMITTEE.—The term ‘HIT Policy Committee’ means such 

Committee established under section 3002(a). 

‘‘(7) HIT STANDARDS COMMITTEE.—The term ‘HIT Standards Committee’ 

means such Committee established under section 3003(a). 

‘‘(8) INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION.—The term ‘individually identifiable health information’ has the meaning given such term in section 1171(6) of the Social Security Act. 

‘‘(9) LABORATORY.—The term ‘laboratory’ has the meaning given such term in 

section 353(a). 

‘‘(10) NATIONAL COORDINATOR.—The term ‘National Coordinator’ means the 

head of the Office of the National Coordinator for Health Information Technology established under section 3001(a). 

‘‘(11) PHARMACIST.—The term ‘pharmacist’ has the meaning given such term 

in section 804(2) of the Federal Food, Drug, and Cosmetic Act. 

‘‘(12) STATE.—The term ‘State’ means each of the several States, the District 

of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the 

Northern Mariana Islands. 


jbell on PROD1PC69 with REPORTS
4 

‘‘Subtitle A—Promotion of Health Information 

Technology 

‘‘SEC. 3001. OFFICE OF THE NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY. 

‘‘(a) ESTABLISHMENT.—There is established within the Department of Health and 

Human Services an Office of the National Coordinator for Health Information Technology (referred to in this section as the ‘Office’). The Office shall be headed by a 

National Coordinator who shall be appointed by the Secretary and shall report directly to the Secretary. 

‘‘(b) PURPOSE.—The National Coordinator shall perform the duties under subsection (c) in a manner consistent with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange 

of information and that— 

‘‘(1) ensures that each patient’s health information is secure and protected, in 

accordance with applicable law; 

‘‘(2) improves health care quality, reduces medical errors, and advances the 

delivery of patient-centered medical care; 

‘‘(3) reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete information; 

‘‘(4) ensures that appropriate information to help guide medical decisions is 

available at the time and place of care; 

‘‘(5) ensures the inclusion of meaningful public input in such development of 

such infrastructure; 

‘‘(6) improves the coordination of care and information among hospitals, laboratories, physician offices, and other entities through an effective infrastructure for the secure and authorized exchange of health care information; 

‘‘(7) improves public health reporting and facilitates the early identification 

and rapid response to public health threats and emergencies, including bioterror 

events and infectious disease outbreaks; 

‘‘(8) facilitates health and clinical research and health care quality; 

‘‘(9) promotes prevention of chronic diseases; 

‘‘(10) promotes a more effective marketplace, greater competition, greater systems analysis, increased consumer choice, and improved outcomes in health 

care services; and 

‘‘(11) improves efforts to reduce health disparities. 

‘‘(c) DUTIES OF THE NATIONAL COORDINATOR.— 

‘‘(1) STANDARDS.—The National Coordinator shall review and determine 

whether to endorse each standard, implementation specification, and certification criterion for the electronic exchange and use of health information that 

is recommended by the HIT Standards Committee under section 3003 for purposes of adoption under section 3004(b). The Coordinator shall make such determination, and report to the Secretary such determination, not later than 90 

days after the date the recommendation is received by the Coordinator. 

‘‘(2) HIT POLICY COORDINATION.—The National Coordinator shall coordinate 

health information technology policy and programs of the Department with 

those of other relevant executive branch agencies with a goal of avoiding duplication of efforts and of helping to ensure that each agency undertakes health 

information technology activities primarily within the areas of its greatest expertise and technical capability. 

‘‘(3) STRATEGIC PLAN.— 

‘‘(A) IN GENERAL.—The National Coordinator shall, in consultation with 

other appropriate Federal agencies (including the National Institute of 

Standards and Technology), maintain and update a strategic plan with specific objectives, milestones, and metrics for the following: 

‘‘(i) The electronic exchange and use of health information and the 

enterprise integration of such information. 

‘‘(ii) The utilization of an electronic health record for each person in 

the United States by 2014. 

‘‘(iii) The incorporation of privacy and security protections for the 

electronic exchange of an individual’s individually identifiable health 

information. 

‘‘(iv) Ensuring security methods to ensure appropriate authorization 

and electronic authentication of health information and specifying technologies or methodologies for rendering health information unusable, 

unreadable, or indecipherable. 


jbell on PROD1PC69 with REPORTS
5 

‘‘(v) Specifying a framework for coordination and flow of recommendations and policies under this subtitle among the Secretary, the National 

Coordinator, the HIT Policy Committee, the HIT Standards Committee, 

and other health information exchanges and other relevant entities. 

‘‘(vi) Methods to foster the public understanding of health information technology. 

‘‘(vii) Strategies to enhance the use of health information technology 

in improving the quality of health care, reducing medical errors, reducing health disparities, and in improving the continuity of care among 

health care settings. 

‘‘(B) COLLABORATION.—The strategic plan shall be developed and updated 

through collaboration of public and private interests. 

‘‘(C) MEASURABLE OUTCOME GOALS.—The strategic plan shall include 

measurable outcome goals. 

‘‘(D) PUBLICATION.—The National Coordinator shall publish the strategic 

plan, including all updates. 

‘‘(4) WEBSITE.—The National Coordinator shall maintain and frequently update an Internet website on which there is posted information that includes the 

following: 

‘‘(A) The schedule developed by the HIT Standards Committee under section 3003(b)(3). 

‘‘(B) The recommendations of the HIT Policy Committee under section 

3002. 

‘‘(C) Recommendations of the HIT Standards Committee under section 

3003. 

‘‘(D) Sources of Federal grant funds and technical assistance that are 

available to facilitate the purchase of, or enhance the utilization of, health 

information technology systems. 

‘‘(E) The report prepared by the National Coordinator under paragraph 

(5). 

‘‘(F) The assessment by the National Coordinator under paragraph (6). 

‘‘(G) The evaluation by the National Coordinator under paragraph (7). 

‘‘(H) The annual estimate of resources required under paragraph (8). 

‘‘(5) IMPLEMENTATION REPORT.—The National Coordinator shall prepare a report that identifies lessons learned from major public and private health care 

systems in their implementation of health information technology systems, including information on whether the systems and practices developed by such 

systems may be applicable to and usable in whole or in part by other health 

care providers. 

‘‘(6) ASSESSMENT OF IMPACT OF HIT ON COMMUNITIES WITH HEALTH DISPARITIES

AND UNINSURED, UNDERINSURED, AND MEDICALLY UNDERSERVED AREAS.—The 

National Coordinator shall assess and publish the impact of health information 

technology in communities with health disparities and in areas that serve uninsured, underinsured, and medically underserved individuals (including urban 

and rural areas) and identify practices to increase the adoption of such technology by health care providers in such communities. 

‘‘(7) EVALUATION OF BENEFITS AND COSTS OF THE ELECTRONIC USE AND EXCHANGE OF HEALTH INFORMATION.—The National Coordinator shall evaluate 

and publish evidence on the benefits and costs of the electronic use and exchange of health information and assess to whom these benefits and costs accrue. 

‘‘(8) RESOURCE REQUIREMENTS.—The National Coordinator shall estimate and 

publish resources required annually to reach the goal of utilization of an electronic health record for each person in the United States by 2014, including the 

required level of Federal funding, expectations for regional, State, and private 

investment, and the expected contributions by volunteers to activities for the 

utilization of such records. 

‘‘(9) CERTIFICATION.— 

‘‘(A) IN GENERAL.—The National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall develop 

a program (either directly or by contract) for the voluntary certification of 

health information technology as being in compliance with applicable certification criteria adopted under this subtitle. Such program shall include 

testing of the technology in accordance with section 201(b) of the 

PRO(TECH)T Act of 2008. 

‘‘(B) CERTIFICATION CRITERIA DESCRIBED.—In this title, the term ‘certification criteria’ means, with respect to standards and implementation specifications for health information technology, criteria to establish that the 

technology meets such standards and implementation specifications. 


jbell on PROD1PC69 with REPORTS
6 

‘‘(d) DETAIL OF FEDERAL EMPLOYEES.— 

‘‘(1) IN GENERAL.—Upon the request of the National Coordinator, the head of 

any Federal agency is authorized to detail, with or without reimbursement from 

the Office, any of the personnel of such agency to the Office to assist it in carrying out its duties under this section. 

‘‘(2) EFFECT OF DETAIL.—Any detail of personnel under paragraph (1) shall— 

‘‘(A) not interrupt or otherwise affect the civil service status or privileges 

of the Federal employee; and 

‘‘(B) be in addition to any other staff of the Department employed by the 

National Coordinator. 

‘‘(3) ACCEPTANCE OF DETAILEES.—Notwithstanding any other provision of law, 

the Office may accept detailed personnel from other Federal agencies without 

regard to whether the agency described under paragraph (1) is reimbursed. 

‘‘(e) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated 

to carry out this section $66,000,000 for fiscal year 2009. 

‘‘SEC. 3002. HIT POLICY COMMITTEE. 

‘‘(a) ESTABLISHMENT.—There is established a HIT Policy Committee to make policy recommendations to the National Coordinator relating to the implementation of 

a nationwide health information technology infrastructure, including implementation of the strategic plan described in section 3001(c)(3). 

‘‘(b) DUTIES.— 

‘‘(1) RECOMMENDATIONS ON HEALTH INFORMATION TECHNOLOGY INFRASTRUCTURE.—Not later than 1 year after the date of the enactment of this title, the 

HIT Policy Committee shall recommend a policy framework for the development 

and adoption of a nationwide health information technology infrastructure that 

permits the electronic exchange and use of health information as is consistent 

with the strategic plan under section 3001(c)(3) and that includes the recommendations under paragraph (2). Annually thereafter the Committee shall 

update such recommendations and make new recommendations as appropriate. 

‘‘(2) SPECIFIC AREAS OF STANDARD DEVELOPMENT.— 

‘‘(A) IN GENERAL.—The HIT Policy Committee shall recommend the areas 

in which standards, implementation specifications, and certification criteria 

are needed for the electronic exchange and use of health information for 

purposes of adoption under section 3004(b) and shall recommend an order 

of priority for the development, harmonization, and recognition of such 

standards, specifications, and criteria among the areas so recommended. 

Such standards and implementation specifications shall include named 

standards, architectures, and software schemes for the authentication and 

security of individually identifiable health information and other information as needed to ensure the reproducible development of common solutions 

across disparate entities. 

‘‘(B) AREAS REQUIRED FOR CONSIDERATION.—For purposes of subparagraph (A), the HIT Policy Committee shall make recommendations for at 

least the following areas: 

‘‘(i) Technologies that protect the privacy of health information and 

promote security, including for the segmentation and protection from 

disclosure of specific and sensitive individually identifiable health information, in accordance with applicable law, and for the use and disclosure of limited data sets (as defined for purposes of regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996) of such information. 

‘‘(ii) A nationwide health information technology infrastructure that 

allows for the electronic use and exchange of health information. 

‘‘(iii) The utilization of an electronic health record for each person in 

the United States by 2014. 

‘‘(iv) Technologies that allow for an accounting of disclosures made by 

a covered entity (as defined for purposes of regulations promulgated 

under section 264(c) of the Health Insurance Portability and Accountability Act of 1996) for purposes of treatment, payment, and health care 

operations (as such terms are defined for purposes of such regulations). 

‘‘(C) OTHER AREAS FOR CONSIDERATION.—In making recommendations 

under subparagraph (A), the HIT Policy Committee may consider the following additional areas: 

‘‘(i) The appropriate uses of a nationwide health information infrastructure, including for purposes of— 

‘‘(I) the collection of quality data and public reporting; 

‘‘(II) biosurveillance and public health; 

‘‘(III) medical and clinical research; and 


jbell on PROD1PC69 with REPORTS
7 

‘‘(IV) drug safety. 

‘‘(ii) Self-service technologies that facilitate the use and exchange of 

patient information and reduce wait times. 

‘‘(iii) Telemedicine technologies, in order to reduce travel requirements for patients in remote areas. 

‘‘(iv) Technologies that facilitate home health care and the monitoring 

of patients recuperating at home. 

‘‘(v) Technologies that help reduce medical errors. 

‘‘(vi) Technologies that facilitate the continuity of care among health 

settings. 

‘‘(vii) Technologies that meet the needs of diverse populations. 

‘‘(viii) Any other technology that the HIT Policy Committee finds to 

be among the technologies with the greatest potential to improve the 

quality and efficiency of health care. 

‘‘(3) FORUM.—The HIT Policy Committee shall serve as a forum for broad 

stakeholder input with specific expertise in policies relating to the matters described in paragraphs (1) and (2). 

‘‘(4) WEBSITE.—The HIT Policy Committee shall develop and maintain an 

Internet website on which there is posted information that includes the following: 

‘‘(A) Established governance rules. 

‘‘(B) A business plan. 

‘‘(C) Meeting notices at least 14 days prior to each meeting. 

‘‘(D) Meeting agendas at least 7 days prior to each meeting. 

‘‘(E) Meeting materials at least 3 days prior to each meeting. 

‘‘(c) MEMBERSHIP.— 

‘‘(1) APPOINTMENTS.—The HIT Policy Committee shall be composed of members to be appointed as follows: 

‘‘(A) 3 members shall be appointed by the Secretary, 1 of whom shall be 

appointed to represent the Department of Health and Human Services and 

1 of whom shall be a public health official. 

‘‘(B) 1 member shall be appointed by the majority leader of the Senate. 

‘‘(C) 1 member shall be appointed by the minority leader of the Senate. 

‘‘(D) 1 member shall be appointed by the Speaker of the House of Representatives. 

‘‘(E) 1 member shall be appointed by the minority leader of the House of 

Representatives. 

‘‘(F) Such other members as shall be appointed by the President as representatives of other relevant Federal agencies. 

‘‘(G) 11 members shall be appointed by the Comptroller General of the 

United States of whom— 

‘‘(i) 1 member shall be an advocate for patients or consumers; 

‘‘(ii) 2 members shall represent health care providers, one of which 

shall be a physician; 

‘‘(iii) 1 member shall be from a labor organization representing health 

care workers; 

‘‘(iv) 1 member shall have expertise in privacy and security; 

‘‘(v) 1 member shall have expertise in improving the health of vulnerable populations; 

‘‘(vi) 1 member shall be from the health research community; 

‘‘(vii) 1 member shall represent health plans or other third-party payers; 

‘‘(viii) 1 member shall represent information technology vendors; 

‘‘(ix) 1 member shall represent purchasers or employers; and 

‘‘(x) 1 member shall have expertise in health care quality measurement and reporting. 

‘‘(2) NATIONAL COORDINATOR.—The National Coordinator shall be a member 

of the HIT Policy Committee and act as a liaison among the HIT Policy Committee, the HIT Standards Committee, and the Federal Government. 

‘‘(3) CHAIRPERSON AND VICE CHAIRPERSON.—The HIT Policy Committee shall 

designate 1 member to serve as the chairperson and 1 member to serve as the 

vice chairperson of the HIT Policy Committee. 

‘‘(4) PARTICIPATION.—The members of the HIT Policy Committee appointed 

under paragraph (1) shall represent a balance among various sectors of the 

health care system so that no single sector unduly influences the recommendations of such Committee. 

‘‘(5) TERMS.— 

‘‘(A) IN GENERAL.—The terms of members of the HIT Policy Committee 

appointed under paragraph (1) shall be 3 years except that the Comptroller 


jbell on PROD1PC69 with REPORTS
8 

General of the United States shall designate staggered terms for the members first appointed under paragraph (1)(G). 

‘‘(B) VACANCIES.—Any member appointed to fill a vacancy in the membership of the HIT Policy Committee that occurs prior to the expiration of the 

term for which the member’s predecessor was appointed shall be appointed 

only for the remainder of that term. A member may serve after the expiration of that member’s term until a successor has been appointed. A vacancy 

in the HIT Policy Committee shall be filled in the manner in which the 

original appointment was made. 

‘‘(6) OUTSIDE INVOLVEMENT.—The HIT Policy Committee shall ensure an adequate opportunity for the participation in activities of the Committee of outside 

advisors, including individuals with expertise in the development of policies for 

the electronic exchange and use of health information, including in the areas 

of health information privacy and security. 

‘‘(7) QUORUM.—Ten members of the HIT Policy Committee shall constitute a 

quorum for purposes of voting, but a lesser number of members may meet and 

hold hearings. 

‘‘(d) APPLICATION OF FACA.—The Federal Advisory Committee Act (5 U.S.C. 

App.), other than section 14 of such Act, shall apply to the HIT Policy Committee. 

‘‘(e) PUBLICATION.—The Secretary shall provide for publication in the Federal Register and the posting on the Internet website of the Office of the National Coordinator for Health Information Technology of all policy recommendations made by the 

HIT Policy Committee under this section. 

‘‘SEC. 3003. HIT STANDARDS COMMITTEE. 

‘‘(a) ESTABLISHMENT.—There is established a committee to be known as the HIT 

Standards Committee to recommend to the National Coordinator standards, implementation specifications, and certification criteria for the electronic exchange and 

use of health information for purposes of adoption under section 3004(b), consistent 

with the implementation of the strategic plan described in section 3001(c)(3). 

‘‘(b) DUTIES.— 

‘‘(1) STANDARD DEVELOPMENT.— 

‘‘(A) IN GENERAL.—Beginning not later than 1 year after the date of the 

enactment of this title, the HIT Standards Committee shall recommend to 

the National Coordinator standards, implementation specifications, and certification criteria described in subsection (a) that have been developed, harmonized, or recognized by the Committee. Annually thereafter the Committee shall update such recommendations and make new recommendations 

as appropriate, including in response to a notification sent under section 

3004(b)(2). Such recommendations shall be consistent with the latest recommendations made by the HIT Policy Committee. 

‘‘(B) PILOT TESTING OF STANDARDS AND IMPLEMENTATION SPECIFICATIONS.—In the development, harmonization, or recognition of standards and 

implementation specifications, the HIT Standards Committee, as appropriate, shall provide for the testing of such standards and specifications by 

the National Institute for Standards and Technology under section 201 of 

the PRO(TECH)T Act of 2008. 

‘‘(C) CONSISTENCY.—The standards, implementation specifications, and 

certification criteria recommended under this subsection shall be consistent 

with the standards for information transactions and data elements adopted 

pursuant to section 1173 of the Social Security Act. 

‘‘(2) FORUM.—The HIT Standards Committee shall serve as a forum for the 

participation of a broad range of stakeholders to provide input on the development, harmonization, and recognition of standards, implementation specifications, and certification criteria necessary for the development and adoption of 

a nationwide health information technology infrastructure that allows for the 

electronic use and exchange of health information. 

‘‘(3) SCHEDULE.—Not later than 90 days after the date of the enactment of 

this title, the HIT Standards Committee shall develop a schedule for the assessment of policy recommendations developed by the HIT Policy Committee under 

section 3002. The HIT Standards Committee shall update such schedule annually. The Secretary shall publish such schedule in the Federal Register. 

‘‘(4) PUBLIC INPUT.—The HIT Standards Committee shall conduct open public 

meetings and develop a process to allow for public comment on the schedule described in paragraph (3) and recommendations described in this subsection. 

Under such process comments shall be submitted in a timely manner after the 

date of publication of a recommendation under this subsection. 


jbell on PROD1PC69 with REPORTS
9 

‘‘(5) WEBSITE.—The HIT Standards Committee shall develop and maintain an 

Internet website on which there is posted information that includes the following: 

‘‘(A) Established governance rules. 

‘‘(B) A business plan. 

‘‘(C) Meeting notices at least 14 days prior to each meeting. 

‘‘(D) Meeting agendas at least 7 days prior to each meeting. 

‘‘(E) Meeting materials at least 3 days prior to each meeting. 

‘‘(6) REQUIREMENT TO INTEGRATE RECOMMENDATIONS.—In carrying out the activities under this section, the HIT Standards Committee shall integrate the 

recommendations of the HIT Policy Committee. 

‘‘(c) MEMBERSHIP.— 

‘‘(1) APPOINTMENTS.—The HIT Standards Committee shall be composed of 

members to be appointed as follows: 

‘‘(A) 2 members shall be appointed by the Secretary. 

‘‘(B) 1 member shall be appointed by the majority leader of the Senate. 

‘‘(C) 1 member shall be appointed by the minority leader of the Senate. 

‘‘(D) 1 member shall be appointed by the Speaker of the House of Representatives. 

‘‘(E) 1 member shall be appointed by the minority leader of the House of 

Representatives. 

‘‘(F) 9 members shall be appointed by the Comptroller General of the 

United States of whom— 

‘‘(i) 1 member shall be a representative of consumer or patient organizations; 

‘‘(ii) 1 member shall be a representative of organizations with expertise in privacy; 

‘‘(iii) 1 member shall be a representative of organizations with expertise in security; 

‘‘(iv) 2 members shall be a representative of health care providers, 

one of which shall be a physician; 

‘‘(v) 1 member shall be a representative of health plans or other third 

party payers; 

‘‘(vi) 1 member shall be a representative of information technology 

vendors; 

‘‘(vii) 1 member shall be a representative of purchasers or employers; 

and 

‘‘(viii) 1 member shall be a representative of the health research community. 

‘‘(G) 1 member shall be appointed by the Director of the National Institute for Standards and Technology. 

‘‘(2) NATIONAL COORDINATOR.—The National Coordinator shall be a member 

of the HIT Standards Committee and act as a liaison among the HIT Standards 

Committee, the HIT Policy Committee, and the Federal government. 

‘‘(3) CHAIRPERSON AND VICE CHAIRPERSON.—The HIT Standards Committee 

shall designate 1 member to serve as the chairperson and 1 member to serve 

as the vice chairperson of the Committee. 

‘‘(4) PARTICIPATION.—The members of the HIT Standards Committee appointed under paragraph (1) shall represent a balance among various sectors of 

the health care system so that no single sector unduly influences the recommendations of such Committee. 

‘‘(5) TERMS.— 

‘‘(A) IN GENERAL.—The terms of members of the HIT Standards Committee appointed under paragraph (1) shall be 3 years except that the 

Comptroller General of the United States shall designate staggered terms 

for the members first appointed under paragraph (1)(F). 

‘‘(B) VACANCIES.—Any member appointed to fill a vacancy in the membership of the HIT Standards Committee that occurs prior to the expiration 

of the term for which the member’s predecessor was appointed shall be appointed only for the remainder of that term. A member may serve after the 

expiration of that member’s term until a successor has been appointed. A 

vacancy in the HIT Standards Committee shall be filled in the manner in 

which the original appointment was made. 

‘‘(6) OUTSIDE INVOLVEMENT.—The HIT Standards Committee shall ensure an 

adequate opportunity for the participation in activities of the Committee of outside advisors, including individuals with expertise in the development of standards for the electronic exchange and use of health information, including in the 

areas of health information privacy and security. 


jbell on PROD1PC69 with REPORTS
10 

‘‘(7) QUORUM.—Eight members of the HIT Standards Committee shall constitute a quorum for purposes of voting, but a lesser number of members may 

meet and hold hearings. 

‘‘(d) APPLICATION OF FACA.—The Federal Advisory Committee Act (5 U.S.C. 

App.), other than section 14, shall apply to the HIT Standards Committee. 

‘‘(e) PUBLICATION.—The Secretary shall provide for publication in the Federal Register and the posting on the Internet website of the Office of the National Coordinator for Health Information Technology of all recommendations made by the HIT 

Standards Committee under this section. 

‘‘SEC. 3004. PROCESS FOR ADOPTION OF ENDORSED RECOMMENDATIONS. 

‘‘(a) REVIEW OF ENDORSED STANDARDS, SPECIFICATIONS, AND CRITERIA.—Not later 

than 90 days after the date of receipt of standards, implementation specifications, 

or certification criteria endorsed under section 3001(c), the Secretary, in consultation with representatives of other relevant Federal agencies, shall jointly review 

such standards, specifications, or criteria and shall determine whether or not to propose adoption of such standards, specifications, or criteria. 

‘‘(b) DETERMINATION TO ADOPT STANDARDS, SPECIFICATIONS, AND CRITERIA.—If the 

Secretary determines— 

‘‘(1) to propose adoption of any grouping of such standards, specifications, or 

criteria, the Secretary shall, through a rulemaking process, determine whether 

or not to adopt such grouping of standards, specifications, or criteria; or 

‘‘(2) not to propose adoption of any grouping of standards, specifications, or 

criteria, the Secretary shall notify the National Coordinator and the HIT Standards Committee in writing of such determination and the reasons for not proposing the adoption of such recommendation. 

‘‘(c) PUBLICATION.—The Secretary shall provide for publication in the Federal Register of all determinations made by the Secretary under subsection (a). 

‘‘SEC. 3005. APPLICATION AND USE OF ADOPTED STANDARDS AND IMPLEMENTATION SPECIFICATIONS BY FEDERAL AGENCIES. 

‘‘For requirements relating to the application and use by Federal agencies of the 

standards and implementation specifications adopted under section 3004(b), see section 111 of the PRO(TECH)T Act of 2008. 

‘‘SEC. 3006. VOLUNTARY APPLICATION AND USE OF ADOPTED STANDARDS AND IMPLEMENTATION SPECIFICATIONS BY PRIVATE ENTITIES. 

‘‘(a) IN GENERAL.—Except as provided under section 112 of the PRO(TECH)T Act 

of 2008, any standard or implementation specification adopted under section 3004(b) 

shall be voluntary with respect to private entities. 

‘‘(b) RULE OF CONSTRUCTION.—Nothing in this subtitle shall be construed to require that a private entity that enters into a contract with the Federal Government 

apply or use the standards and implementation specifications adopted under section 

3004(b) with respect to activities not related to the contract. 

‘‘SEC. 3007. HEALTH INFORMATION TECHNOLOGY RESOURCE CENTER. 

‘‘(a) DEVELOPMENT.— 

‘‘(1) IN GENERAL.—The National Coordinator shall develop a Health Information Technology Resource Center to provide technical assistance and develop 

best practices to support and accelerate efforts to adopt, implement, and effectively use health information technology that allows for the electronic exchange 

and use of information in compliance with standards, implementation specifications, and certification criteria adopted under section 3004(b). 

‘‘(2) PURPOSES.—The purpose of the Center is to— 

‘‘(A) provide a forum for the exchange of knowledge and experience; 

‘‘(B) accelerate the transfer of lessons learned from existing public and 

private sector initiatives, including those currently receiving Federal financial support; 

‘‘(C) assemble, analyze, and widely disseminate evidence and experience 

related to the adoption, implementation, and effective use of health information technology that allows for the electronic exchange and use of information; 

‘‘(D) provide technical assistance for the establishment and evaluation of 

regional and local health information networks to facilitate the electronic 

exchange of information across health care settings and improve the quality 

of health care; 

‘‘(E) provide technical assistance for the development and dissemination 

of solutions to barriers to the exchange of electronic health information; 

‘‘(F) learn about effective strategies to adopt and utilize health information technology in medically underserved communities; 


jbell on PROD1PC69 with REPORTS
11 

‘‘(G) conduct other activities identified by the States, local or regional 

health information networks, or health care stakeholders as a focus for developing and sharing best practices; and 

‘‘(H) provide technical assistance to promote adoption and utilization of 

health information technology by health care providers, including in medically underserved communities. 

‘‘(b) TECHNICAL ASSISTANCE TELEPHONE NUMBER OR WEBSITE.—The National Coordinator shall establish a toll-free telephone number or Internet website to provide 

health care providers with a single point of contact to— 

‘‘(1) learn about Federal grants and technical assistance services related to 

the electronic exchange and use of health information; 

‘‘(2) learn about standards, implementation specifications, and certification 

criteria adopted under section 3004(b); 

‘‘(3) learn about regional and local health information networks for assistance 

with health information technology; and 

‘‘(4) disseminate additional information determined by the National Coordinator.’’. 

SEC. 102. TRANSITIONS. 

(a) ONCHIT.—To the extent consistent with section 3001 of the Public Health 

Service Act, as added by section 101, all functions, personnel, assets, liabilities, and 

administrative actions applicable to the National Coordinator for Health Information Technology appointed under Executive Order 13335 or the Office of such National Coordinator on the date before the date of the enactment of this Act shall 

be transferred to the National Coordinator appointed under section 3001(a) of such 

Act and the Office of such National Coordinator as of the date of the enactment of 

this Act. 

(b) AHIC.— 

(1) To the extent consistent with sections 3002 and 3003 of the Public Health 

Service Act, as added by section 101, all functions, personnel, assets, and liabilities applicable to the American Health Information Community created in response to Executive Order 13335 as of the day before the date of the enactment 

of this Act shall be transferred to the HIT Policy Committee or the HIT Standards Committee, established under section 3002(a) or 3003(a) of such Act, as appropriate, as of the date of the enactment of this Act. 

(2) In carrying out section 3003(b)(1)(A) of the Public Health Service Act, as 

so added, until recommendations are made by the HIT Policy Committee, recommendations of the HIT Standards Committee shall be consistent with the 

most recent recommendations made by the American Health Information Community. 

(c) RULES OF CONSTRUCTION.— 

(1) ONCHIT.—Nothing in section 3001 of the Public Health Service Act, as 

added by section 101, or subsection (a) shall be construed as requiring the creation of a new entity to the extent that the Office of the National Coordinator 

for Health Information Technology established pursuant to Executive Order 

13335 is consistent with the provisions of such section 3001. 

(2) AHIC.—Nothing in sections 3002 or 3003 of the Public Health Service Act, 

as added by section 101, or subsection (b) shall be construed as requiring the 

creation of a new entity to the extent that the American Health Information 

Community created in response to Executive Order 13335 is consistent with the 

provisions of such sections 3002 and 3003. 

PART II—APPLICATION AND USE OF ADOPTED HEALTH 

INFORMATION TECHNOLOGY STANDARDS; REPORTS 

SEC. 111. COORDINATION OF FEDERAL ACTIVITIES WITH ADOPTED STANDARDS AND IMPLEMENTATION SPECIFICATIONS. 

(a) SPENDING ON HEALTH INFORMATION TECHNOLOGY SYSTEMS.—As each agency 

(as defined in the Executive Order issued on August 22, 2006, relating to promoting 

quality and efficient health care in Federal government administered or sponsored 

health care programs) implements, acquires, or upgrades health information technology systems used for the direct exchange of individually identifiable health information between agencies and with non-Federal entities, it shall utilize, where available, health information technology systems and products that meet standards and 

implementation specifications adopted under section 3004(b) of the Public Health 

Service Act, as added by section 101. 

(b) FEDERAL INFORMATION COLLECTION ACTIVITIES.—With respect to a standard 

or implementation specification adopted under section 3004(b) of the Public Health 


jbell on PROD1PC69 with REPORTS
12 

Service Act, as added by section 101, the President shall take measures to ensure 

that Federal activities involving the broad collection and submission of health information are consistent with such standard or specification, respectively, within three 

years after the date of such adoption. 

(c) APPLICATION OF DEFINITIONS.—The definitions contained in section 3000 of the 

Public Health Service Act, as added by section 101, shall apply for purposes of this 

part. 

SEC. 112. APPLICATION TO PRIVATE ENTITIES. 

Each agency (as defined in such Executive Order issued on August 22, 2006, relating to promoting quality and efficient health care in Federal government administered or sponsored health care programs) shall require in contracts or agreements 

with health care providers, health plans, or health insurance issuers that as each 

provider, plan, or issuer implements, acquires, or upgrades health information technology systems, it shall utilize, where available, health information technology systems and products that meet standards and implementation specifications adopted 

under section 3004(b) of the Public Health Service Act, as added by section 101. 

SEC. 113. STUDY AND REPORTS. 

(a) REPORT ON ADOPTION OF NATIONWIDE SYSTEM.—Not later than 2 years after 

the date of the enactment of this Act and annually thereafter, the Secretary of 

Health and Human Services shall submit to the Committee on Health, Education, 

Labor, and Pensions and the Committee on Commerce, Science, and Transportation 

of the Senate and the Committee on Energy and Commerce and the Committee on 

Science and Technology of the House of Representatives a report that— 

(1) describes the specific actions that have been taken by the Federal Government and private entities to facilitate the adoption of a nationwide system for 

the electronic use and exchange of health information; 

(2) describes barriers to the adoption of such a nationwide system; and 

(3) contains recommendations to achieve full implementation of such a nationwide system. 

(b) REIMBURSEMENT INCENTIVE STUDY AND REPORT.— (1) STUDY.—The Secretary of Health and Human Services shall carry out, or 

contract with a private entity to carry out, a study that examines methods to 

create efficient reimbursement incentives for improving health care quality in 

Federally qualified health centers, rural health clinics, and free clinics. 

(2) REPORT.—Not later than 2 years after the date of the enactment of this 

Act, the Secretary of Health and Human Services shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy 

and Commerce and the Committee on Science and Technology of the House of 

Representatives a report on the study carried out under paragraph (1). 

(c) AGING SERVICES TECHNOLOGY STUDY AND REPORT.— 

(1) IN GENERAL.—The Secretary of Health and Human Services shall carry 

out, or contract with a private entity to carry out, a study of matters relating 

to the potential use of new aging services technology to assist seniors, individuals with disabilities, and their caregivers throughout the aging process. 

(2) MATTERS TO BE STUDIED.—The study under paragraph (1) shall include— 

(A) an evaluation of— 

(i) methods for identifying current, emerging, and future health technology that can be used to meet the needs of seniors and individuals 

with disabilities and their caregivers across all aging services settings, 

as specified by the Secretary; 

(ii) methods for fostering scientific innovation with respect to aging 

services technology within the business and academic communities; and 

(iii) developments in aging services technology in other countries that 

may be applied in the United States; and 

(B) identification of— 

(i) barriers to innovation in aging services technology and devising 

strategies for removing such barriers; and 

(ii) barriers to the adoption of aging services technology by health 

care providers and consumers and devising strategies to removing such 

barriers. 

(3) REPORT.—Not later than 24 months after the date of the enactment of this 

Act, the Secretary shall submit to the Committee on Health, Education, Labor, 

and Pensions and the Committee on Commerce, Science, and Transportation of 

the Senate and the Committee on Energy and Commerce and the Committee 

on Science and Technology of the House of Representatives a report on the 

study carried out under paragraph (1). 

(4) DEFINITIONS.—For purposes of this subsection: 


jbell on PROD1PC69 with REPORTS
13 

(A) AGING SERVICES TECHNOLOGY.—The term ‘‘aging services technology’’ 

means health technology that meets the health care needs of seniors, individuals with disabilities, and the caregivers of such seniors and individuals. 

(B) SENIOR.—The term ‘‘senior’’ has such meaning as specified by the Secretary. 

Subtitle B—Incentives for the Use of Health 

Information Technology 

SEC. 121. GRANT, LOAN, AND DEMONSTRATION PROGRAMS. 

Title XXX of the Public Health Service Act, as added by section 101, is amended 

by adding at the end the following new subtitle: 

‘‘Subtitle B—Incentives for the Use of Health 

Information Technology 

‘‘SEC. 3011. GRANTS AND LOANS TO FACILITATE THE WIDESPREAD ADOPTION OF QUALIFIED 

HEALTH INFORMATION TECHNOLOGY. 

‘‘(a) COMPETITIVE GRANTS TO FACILITATE THE WIDESPREAD ADOPTION OF HEALTH

INFORMATION TECHNOLOGY.— 

‘‘(1) IN GENERAL.—The National Coordinator may award competitive grants to 

eligible entities to purchase qualified health information technology. 

‘‘(2) QUALIFIED HEALTH INFORMATION TECHNOLOGY.—For purposes of this section, the term ‘qualified health information technology’ means health information technology that consists of hardware, software, or the provision of support 

services and that— 

‘‘(A) enables the protection of health information, in accordance with applicable law; 

‘‘(B) is (or is necessary for the operation of) an electronic health records 

system, including the provision of decision support and physician order 

entry for medications; 

‘‘(C) has the ability to allow timely and permissible access to patient information and to transmit and exchange health information among providers, patients, or insurers; and 

‘‘(D) is certified under the program developed under section 3001(c)(9) to 

be in compliance with any applicable standards and implementation specifications adopted under section 3004(b). 

‘‘(3) ELIGIBILITY.—To be eligible to receive a grant under paragraph (1) an entity shall— 

‘‘(A) submit to the National Coordinator an application at such time and 

in such manner as the National Coordinator may require, and containing— 

‘‘(i) a plan on how the entity intends to maintain and support the 

qualified health information technology that would be purchased with 

amounts under such grant, including the type of resources expected to 

be involved; and 

‘‘(ii) such other information as the National Coordinator may require; 

‘‘(B) submit to the National Coordinator a plan for how qualified health 

information technology purchased by the entity will result in the electronic 

exchange and use of health information; 

‘‘(C) be— 

‘‘(i) a not for profit hospital or a Federally qualified health center (as 

defined in section 1861(aa)(4) of the Social Security Act); 

‘‘(ii) an individual or group practice; or 

‘‘(iii) another health care provider, such as a rural health clinic, not 

described in clause (i) or (ii); 

‘‘(D) demonstrate significant financial need; 

‘‘(E) agree to notify individuals in accordance with section 302 of the 

PRO(TECH)T Act of 2008 (relating to notifications in the case of breaches); 

‘‘(F) provide matching funds in accordance with paragraph (5); 

‘‘(G) consult with the Health Information Technology Resource Center established under section 3007 to access the knowledge and experience of existing initiatives regarding the successful implementation and effective use 

of health information technology; and 

‘‘(H) link, to the extent practicable, to one or more local or regional health 

information plans. 


jbell on PROD1PC69 with REPORTS
14 

‘‘(4) USE OF FUNDS.—Amounts received under a grant under this subsection 

shall be used to facilitate the purchase of qualified health information technology. 

‘‘(5) MATCHING REQUIREMENT.—To be eligible for a grant under this subsection an entity shall contribute non-Federal contributions to the costs of carrying out the activities for which the grant is awarded in an amount equal to 

$1 for each $3 of Federal funds provided under the grant. 

‘‘(6) PREFERENCE IN AWARDING GRANTS.—In awarding grants under this subsection the National Coordinator shall give preference to the following eligible 

entities: 

‘‘(A) Small health care providers. 

‘‘(B) Entities that are located in rural and other areas that serve uninsured, underinsured, and medically underserved individuals (regardless of 

whether such area is urban or rural). 

‘‘(C) Nonprofit health care providers. 

‘‘(7) ADDITIONAL SOURCES OF FUNDING FOR HEALTH INFORMATION TECHNOLOGY.—Funding made available under this subsection is in addition to funding which may be used toward the acquisition and utilization of health information technology under other law, which includes the following: 

‘‘(A) Medicaid transformation grants under section 1903(z) of the Social 

Security Act. 

‘‘(B) Grants or funding available through the Agency for Healthcare Research and Quality. 

‘‘(C) Grants or funding that may be available through the Health Resources and Services Administration for investment in health information 

technologies or telehealth. 

‘‘(D) Grants or funding that may be available through the Department of 

Agriculture’s Rural Development Telecommunications Program for investment in telemedicine. 

‘‘(b) COMPETITIVE GRANTS TO STATES AND INDIAN TRIBES FOR THE DEVELOPMENT

OF LOAN PROGRAMS TO FACILITATE THE WIDESPREAD ADOPTION OF QUALIFIED

HEALTH INFORMATION TECHNOLOGY.— 

‘‘(1) IN GENERAL.—The National Coordinator may award competitive grants to 

eligible entities for the establishment of programs for loans to health care providers to purchase qualified health information technology. 

‘‘(2) ELIGIBLE ENTITY DEFINED.—For purposes of this subsection, the term ‘eligible entity’ means a State or Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act) that— 

‘‘(A) submits to the National Coordinator an application at such time, in 

such manner, and containing such information as the National Coordinator 

may require; 

‘‘(B) submits to the National Coordinator a strategic plan in accordance 

with paragraph (4) and provides to the National Coordinator assurances 

that the entity will update such plan annually in accordance with such 

paragraph; 

‘‘(C) provides assurances to the National Coordinator that the entity will 

establish a Loan Fund in accordance with paragraph (3); 

‘‘(D) provides assurances to the National Coordinator that the entity will 

not provide a loan from the Loan Fund to a health care provider unless the 

provider meets each of the conditions described in paragraph (5); and 

‘‘(E) agrees to provide matching funds in accordance with paragraph (9). 

‘‘(3) ESTABLISHMENT OF FUND.—For purposes of paragraph (2)(C), an eligible 

entity shall establish a qualified health information technology loan fund (referred to in this subsection as a ‘Loan Fund’) and comply with the other requirements contained in this section. A grant to an eligible entity under this subsection shall be deposited in the Loan Fund established by the eligible entity. 

No funds authorized by other provisions of this subtitle to be used for other purposes specified in this subtitle shall be deposited in any Loan Fund. 

‘‘(4) STRATEGIC PLAN.— 

‘‘(A) IN GENERAL.—For purposes of paragraph (2)(B), a strategic plan of 

an eligible entity under this paragraph shall identify the intended uses of 

amounts available to the Loan Fund of such entity. 

‘‘(B) CONTENTS.—A strategic plan under subparagraph (A), with respect 

to a Loan Fund of an eligible entity, shall include for a year the following: 

‘‘(i) A list of the projects to be assisted through the Loan Fund during 

such year. 

‘‘(ii) A description of the criteria and methods established for the distribution of funds from the Loan Fund during the year. 


jbell on PROD1PC69 with REPORTS
15 

‘‘(iii) A description of the financial status of the Loan Fund as of the 

date of submission of the plan. 

‘‘(iv) The short-term and long-term goals of the Loan Fund. 

‘‘(5) HEALTH CARE PROVIDER CONDITIONS FOR RECEIPT OF LOANS.—For purposes of paragraph (2)(D), the conditions described in this paragraph, with respect to a health care provider that seeks a loan from a Loan Fund established 

under this subsection, are the following: 

‘‘(A) The health care provider links, to the extent practicable, to one or 

more local or regional health information networks. 

‘‘(B) The health care provider consults with the Health Information Technology Resource Center established under section 3007 to access the knowledge and experience of existing initiatives regarding the successful implementation and effective use of health information technology. 

‘‘(C) The health care provider agrees to notify individuals in accordance 

with section 302 of the PRO(TECH)T Act of 2008 (relating to notifications 

in the case of breaches). 

‘‘(D) The health care provider submits to the State or Indian tribe involved a plan on how the health care provider intends to maintain and support the qualified health information technology that would be purchased 

with such loan, including the type of resources expected to be involved and 

any such other information as the State or Indian Tribe, respectively, may 

require. 

‘‘(6) USE OF FUNDS.— 

‘‘(A) IN GENERAL.—Amounts deposited in a Loan Fund, including loan repayments and interest earned on such amounts, shall be used only for 

awarding loans or loan guarantees, making reimbursements described in 

paragraph (8)(D)(i), or as a source of reserve and security for leveraged 

loans, the proceeds of which are deposited in the Loan Fund established 

under paragraph (1). Loans under this section may be used by a health care 

provider to purchase qualified health information technology. 

‘‘(B) LIMITATION.—Amounts received by an eligible entity under this subsection may not be used— 

‘‘(i) for the purchase or other acquisition of any health information 

technology system that is not a qualified health information technology; 

or 

‘‘(ii) to conduct activities for which Federal funds are expended under 

this title. 

‘‘(7) TYPES OF ASSISTANCE.—Except as otherwise limited by applicable State 

law, amounts deposited into a Loan Fund under this subsection may only be 

used for the following: 

‘‘(A) To award loans that comply with the following: 

‘‘(i) The interest rate for each loan shall not exceed the market interest rate. 

‘‘(ii) The principal and interest payments on each loan shall commence not later than 1 year after the date the loan was awarded, and 

each loan shall be fully amortized not later than 10 years after the date 

of the loan. 

‘‘(iii) The Loan Fund shall be credited with all payments of principal 

and interest on each loan awarded from the Loan Fund. 

‘‘(B) To guarantee, or purchase insurance for, a local obligation (all of the 

proceeds of which finance a project eligible for assistance under this subsection) if the guarantee or purchase would improve credit market access 

or reduce the interest rate applicable to the obligation involved. 

‘‘(C) As a source of revenue or security for the payment of principal and 

interest on revenue or general obligation bonds issued by the eligible entity 

if the proceeds of the sale of the bonds will be deposited into the Loan 

Fund. 

‘‘(D) To earn interest on the amounts deposited into the Loan Fund. 

‘‘(E) To make reimbursements described in paragraph (8)(D)(i). 

‘‘(8) ADMINISTRATION OF LOAN FUNDS.— 

‘‘(A) COMBINED FINANCIAL ADMINISTRATION.—An eligible entity may (as a 

convenience and to avoid unnecessary administrative costs) combine, in accordance with applicable State law, the financial administration of a Loan 

Fund established under this subsection with the financial administration of 

any other revolving fund established by the entity if otherwise not prohibited by the law under which the Loan Fund was established. 

‘‘(B) COST OF ADMINISTERING FUND.—Each eligible entity may annually 

use not to exceed 4 percent of the funds provided to the entity under a 

grant under this subsection to pay the reasonable costs of the administraVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00015 Fmt 6659 Sfmt 6621 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
16 

tion of the programs under this section, including the recovery of reasonable costs expended to establish a Loan Fund which are incurred after the 

date of the enactment of this title. 

‘‘(C) GUIDANCE AND REGULATIONS.—The National Coordinator shall publish guidance and promulgate regulations as may be necessary to carry out 

the provisions of this subsection, including— 

‘‘(i) provisions to ensure that each eligible entity commits and expends funds allotted to the entity under this subsection as efficiently 

as possible in accordance with this title and applicable State laws; and 

‘‘(ii) guidance to prevent waste, fraud, and abuse. 

‘‘(D) PRIVATE SECTOR CONTRIBUTIONS.— ‘‘(i) IN GENERAL.—A Loan Fund established under this subsection 

may accept contributions from private sector entities, except that such 

entities may not specify the recipient or recipients of any loan issued 

under this subsection. An eligible entity may agree to reimburse a private sector entity for any contribution made under this subparagraph, 

except that the amount of such reimbursement may not be greater than 

the principal amount of the contribution made. 

‘‘(ii) AVAILABILITY OF INFORMATION.—An eligible entity shall make 

publicly available the identity of, and amount contributed by, any private sector entity under clause (i) and may issue letters of commendation or make other awards (that have no financial value) to any such 

entity. 

‘‘(9) MATCHING REQUIREMENTS.— 

‘‘(A) IN GENERAL.—The National Coordinator may not make a grant 

under paragraph (1) to an eligible entity unless the entity agrees to make 

available (directly or through donations from public or private entities) nonFederal contributions in cash to the costs of carrying out the activities for 

which the grant is awarded in an amount equal to not less than $1 for each 

$1 of Federal funds provided under the grant. 

‘‘(B) DETERMINATION OF AMOUNT OF NON-FEDERAL CONTRIBUTION.—In determining the amount of non-Federal contributions that an eligible entity 

has provided pursuant to subparagraph (A), the National Coordinator may 

not include any amounts provided to the entity by the Federal Government. 

‘‘(10) REPORTS.—The National Coordinator shall annually submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Finance of the Senate, and the Committee on Energy and Commerce of the House 

of Representatives, a report summarizing the reports received by the National 

Coordinator from each eligible entity that receives a grant under this subsection. 

‘‘(c) COMPETITIVE GRANTS FOR THE IMPLEMENTATION OF REGIONAL OR LOCAL

HEALTH INFORMATION TECHNOLOGY PLANS.— 

‘‘(1) IN GENERAL.—The National Coordinator may award competitive grants to 

eligible entities to implement regional or local health information plans to improve health care quality and efficiency through the electronic exchange and use 

of health information. 

‘‘(2) ELIGIBILITY.—To be eligible to receive a grant under paragraph (1) an entity shall— 

‘‘(A) facilitate the electronic exchange and use of health information within the local or regional area and among local and regional areas; 

‘‘(B) demonstrate financial need to the National Coordinator; 

‘‘(C) demonstrate that one of its principal missions or purposes is to use 

information technology to improve health care quality and efficiency; 

‘‘(D) adopt bylaws, memoranda of understanding, or other charter documents that demonstrate that the governance structure and decisionmaking 

processes of such entity allow for participation on an ongoing basis by multiple stakeholders within a community, including— 

‘‘(i) physicians (as defined in section 1861(r) of the Social Security 

Act), including physicians that provide services to low income populations and populations that are uninsured, underinsured, and medically underserved (including such populations in urban and rural 

areas); 

‘‘(ii) hospitals (including hospitals that provide services to low income 

and underserved populations); 

‘‘(iii) pharmacists and pharmacies; 

‘‘(iv) health plans; 

‘‘(v) health centers (as defined in section 330(b)) and Federally qualified health centers (as defined in section 1861(aa)(4) of the Social Security Act); 


jbell on PROD1PC69 with REPORTS
17 

‘‘(vi) rural health clinics (as defined in section 1861(aa) of the Social 

Security Act); 

‘‘(vii) patient or consumer organizations that reflect the population to 

be served; 

‘‘(viii) employers; 

‘‘(ix) public health agencies; and 

‘‘(x) such other health care providers or other entities, as determined 

appropriate by the National Coordinator; 

‘‘(E) demonstrate the participation, to the extent practicable, of stakeholders in the electronic exchange and use of health information within the 

local or regional health information plan pursuant to subparagraph (D); 

‘‘(F) adopt nondiscrimination and conflict of interest policies that demonstrate a commitment to open, fair, and nondiscriminatory participation in 

the regional or local health information plan by all stakeholders; 

‘‘(G) comply with applicable standards and implementation specifications 

adopted under subtitle A of this title; 

‘‘(H) prepare and submit to the National Coordinator an application in accordance with paragraph (3); and 

‘‘(I) agree to provide matching funds in accordance with paragraph (6). 

‘‘(3) APPLICATION.— ‘‘(A) IN GENERAL.—To be eligible to receive a grant under paragraph (1), 

an entity shall submit to the National Coordinator an application at such 

time, in such manner, and containing such information (in addition to information required under subparagraph (B)), as the National Coordinator may 

require. 

‘‘(B) REQUIRED INFORMATION.—At a minimum, an application submitted 

under this paragraph shall include— 

‘‘(i) clearly identified short-term and long-term objectives of the regional or local health information plan; 

‘‘(ii) an estimate of costs of the hardware, software, training, and 

other services necessary to implement the regional or local health information plan; 

‘‘(iii) a strategy that includes initiatives to improve health care quality and efficiency; 

‘‘(iv) a plan that describes provisions to encourage the electronic exchange and use of health information by all physicians, including single 

physician practices and small physician groups, participating in the 

health information plan; 

‘‘(v) a plan to ensure the privacy and security of individually identifiable health information that is consistent with applicable Federal and 

State law; 

‘‘(vi) a governance plan that defines the manner in which the stakeholders shall jointly make policy and operational decisions on an ongoing basis; 

‘‘(vii) a financial or business plan that describes— 

‘‘(I) the sustainability of the plan; 

‘‘(II) the financial costs and benefits of the plan; and 

‘‘(III) the entities to which such costs and benefits will accrue; 

‘‘(viii) a plan on how the entity involved intends to maintain and support the regional or local health information plan, including the type 

of resources expected to be involved; and 

‘‘(ix) in the case of an applicant that is unable to demonstrate the 

participation of all stakeholders pursuant to paragraph (2)(D), the justification from the entity for any such nonparticipation. 

‘‘(4) USE OF FUNDS.—Amounts received under a grant under paragraph (1) 

shall be used to establish and implement a regional or local health information 

plan in accordance with this subsection. 

‘‘(5) PREFERENCE.—In awarding grants under paragraph (1), the Secretary 

shall give preference to eligible entities that intend to use amounts received 

under a grant to establish or implement a regional or local health information 

plan that encompasses communities with health disparities or areas that serve 

uninsured, underinsured, and medically underserved individuals (including 

urban and rural areas). 

‘‘(6) MATCHING REQUIREMENT.— 

‘‘(A) IN GENERAL.—The National Coordinator may not make a grant 

under this subsection to an entity unless the entity agrees that, with respect to the costs of carrying out the activities for which the grant is awarded, the entity will make available (directly or through donations from public 

or private entities) non-Federal contributions toward such costs in an 


jbell on PROD1PC69 with REPORTS
18 

amount equal to not less than 50 percent of such costs ($1 for each $2 of 

Federal funds provided under the grant). 

‘‘(B) DETERMINATION OF AMOUNT CONTRIBUTED.—Non-Federal contributions required under subparagraph (A) may be in cash or in kind, fairly 

evaluated, including equipment, technology, or services. Amounts provided 

by the Federal Government, or services assisted or subsidized to any significant extent by the Federal Government, may not be included in determining the amount of such non-Federal contributions. 

‘‘(d) REPORTS.—Not later than 1 year after the date on which the first grant is 

awarded under this section, and annually thereafter during the grant period, an entity that receives a grant under this section shall submit to the National Coordinator a report on the activities carried out under the grant involved. Each such report shall include— 

‘‘(1) a description of the financial costs and benefits of the project involved 

and of the entities to which such costs and benefits accrue; 

‘‘(2) an analysis of the impact of the project on health care quality and safety; 

‘‘(3) a description of any reduction in duplicative or unnecessary care as a result of the project involved; 

‘‘(4) a description of the efforts of recipients under this section to facilitate secure patient access to health information; 

‘‘(5) an analysis of the effectiveness of the project involved on ensuring the 

privacy and security of individually identifiable health information in accordance with applicable Federal and State law; and 

‘‘(6) other information as required by the National Coordinator. 

‘‘(e) REQUIREMENT TO IMPROVE QUALITY OF CARE AND DECREASE IN COSTS.—The 

National Coordinator shall annually evaluate the activities conducted under this 

section and shall, in awarding grants, implement the lessons learned from such 

evaluation in a manner so that awards made subsequent to each such evaluation 

are made in a manner that, in the determination of the National Coordinator, will 

result in the greatest improvement in quality of care and decrease in costs. 

‘‘(f) LIMITATION.—An eligible entity may only receive one non-renewable grant 

under subsection (a), one non-renewable grant under subsection (b), and one nonrenewable grant under subsection (c). 

‘‘(g) SMALL HEALTH CARE PROVIDER.—For purposes of this section, the term ‘small 

health care provider’ means a health care provider that has an average of 10 or 

fewer full-time equivalent employees during the period involved. 

‘‘(h) AUTHORIZATION OF APPROPRIATIONS.— 

‘‘(1) IN GENERAL.—For the purpose of carrying out subsections (a) through (d), 

there is authorized to be appropriated $115,000,000 for each of the fiscal years 

2009 through 2013. 

‘‘(2) AVAILABILITY.—Amounts appropriated under paragraph (1) shall remain 

available through fiscal year 2013. 

‘‘SEC. 3012. DEMONSTRATION PROGRAM TO INTEGRATE INFORMATION TECHNOLOGY INTO 

CLINICAL EDUCATION. 

‘‘(a) IN GENERAL.—The Secretary may award grants under this section to carry 

out demonstration projects to develop academic curricula integrating qualified 

health information technology in the clinical education of health professionals. Such 

awards shall be made on a competitive basis and pursuant to peer review. 

‘‘(b) ELIGIBILITY.—To be eligible to receive a grant under subsection (a), an entity 

shall— 

‘‘(1) submit to the Secretary an application at such time, in such manner, and 

containing such information as the Secretary may require; 

‘‘(2) submit to the Secretary a strategic plan for integrating qualified health 

information technology in the clinical education of health professionals to reduce medical errors and enhance health care quality; 

‘‘(3) be— 

‘‘(A) a school of medicine, osteopathic medicine, dentistry, or pharmacy, 

a graduate program in behavioral or mental health, or any other graduate 

health professions school; 

‘‘(B) a graduate school of nursing or physician assistant studies; 

‘‘(C) a consortium of two or more schools described in subparagraph (A) 

or (B); or 

‘‘(D) an institution with a graduate medical education program in medicine, osteopathic medicine, dentistry, pharmacy, nursing, or physician assistance studies. 

‘‘(4) provide for the collection of data regarding the effectiveness of the demonstration project to be funded under the grant in improving the safety of patients, the efficiency of health care delivery, and in increasing the likelihood 


jbell on PROD1PC69 with REPORTS
19 

that graduates of the grantee will adopt and incorporate qualified health information technology, in the delivery of health care services; and 

‘‘(5) provide matching funds in accordance with subsection (d). 

‘‘(c) USE OF FUNDS.— 

‘‘(1) IN GENERAL.—With respect to a grant under subsection (a), an eligible entity shall— 

‘‘(A) use grant funds in collaboration with 2 or more disciplines; and 

‘‘(B) use grant funds to integrate qualified health information technology 

into community-based clinical education. 

‘‘(2) LIMITATION.—An eligible entity shall not use amounts received under a 

grant under subsection (a) to purchase hardware, software, or services. 

‘‘(d) MATCHING FUNDS.— 

‘‘(1) IN GENERAL.—The Secretary may award a grant to an entity under this 

section only if the entity agrees to make available non-Federal contributions toward the costs of the program to be funded under the grant in an amount that 

is not less than $1 for each $2 of Federal funds provided under the grant. 

‘‘(2) DETERMINATION OF AMOUNT CONTRIBUTED.—Non-Federal contributions 

under paragraph (1) may be in cash or in kind, fairly evaluated, including 

equipment or services. Amounts provided by the Federal Government, or services assisted or subsidized to any significant extent by the Federal Government, 

may not be included in determining the amount of such contributions. 

‘‘(e) EVALUATION.—The Secretary shall take such action as may be necessary to 

evaluate the projects funded under this section and publish, make available, and 

disseminate the results of such evaluations on as wide a basis as is practicable. 

‘‘(f) REPORTS.—Not later than 1 year after the date of enactment of this title, and 

annually thereafter, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Finance of the Senate, and the 

Committee on Energy and Commerce of the House of Representatives a report 

that— 

‘‘(1) describes the specific projects established under this section; and 

‘‘(2) contains recommendations for Congress based on the evaluation conducted under subsection (e). 

‘‘(g) AUTHORIZATION OF APPROPRIATIONS.—There is authorized to be appropriated 

to carry out this section, $10,000,000 for each of fiscal years 2009 through 2011. 

‘‘(h) SUNSET.—This section shall not apply after September 30, 2011.’’. 

TITLE II—TESTING OF HEALTH INFORMATION 

TECHNOLOGY 

SEC. 201. NATIONAL INSTITUTE FOR STANDARDS AND TECHNOLOGY TESTING. 

(a) PILOT TESTING OF STANDARDS AND IMPLEMENTATION SPECIFICATIONS.—In coordination with the HIT Standards Committee established under section 3003 of the 

Public Health Service Act, as added by section 101, with respect to the development 

of standards and implementation specifications under such section, the Director of 

the National Institute for Standards and Technology shall test such standards and 

specifications in order to assure the efficient implementation and use of such standards and specifications. 

(b) VOLUNTARY TESTING PROGRAM.—In coordination with the HIT Standards Committee established under section 3003 of the Public Health Service Act, as added 

by section 101, with respect to the development of standards and implementation 

specifications under such section, the Director of the National Institute of Standards 

and Technology shall support the establishment of a conformance testing infrastructure, including the development of technical test beds. The development of this conformance testing infrastructure may include a program to accredit independent, 

non-Federal laboratories to perform testing. 

SEC. 202. RESEARCH AND DEVELOPMENT PROGRAMS. 

(a) HEALTH CARE INFORMATION ENTERPRISE INTEGRATION RESEARCH CENTERS.— 

(1) IN GENERAL.—The Director of the National Institute of Standards and 

Technology, in consultation the Director of the National Science Foundation and 

other appropriate Federal agencies, shall establish a program of assistance to 

institutions of higher education (or consortia thereof which may include nonprofit entities and Federal Government laboratories) to establish multidisciplinary Centers for Health Care Information Enterprise Integration. 

(2) REVIEW; COMPETITION.—Grants shall be awarded under this subsection on 

a merit-reviewed, competitive basis. 


jbell on PROD1PC69 with REPORTS
20 

(3) PURPOSE.—The purposes of the Centers described in paragraph (1) shall 

be— 

(A) to generate innovative approaches to health care information enterprise integration by conducting cutting-edge, multidisciplinary research on 

the systems challenges to health care delivery; and 

(B) the development and use of health information technologies and other 

complementary fields. 

(4) RESEARCH AREAS.—Research areas may include— 

(A) interfaces between human information and communications technology systems; 

(B) voice-recognition systems; 

(C) software that improves interoperability and connectivity among 

health information systems; 

(D) software dependability in systems critical to health care delivery; 

(E) measurement of the impact of information technologies on the quality 

and productivity of health care; 

(F) health information enterprise management; 

(G) health information technology security and integrity; and 

(H) relevant health information technology to reduce medical errors. 

(5) APPLICATIONS.—An institution of higher education (or a consortium thereof) seeking funding under this subsection shall submit an application to the Director of the National Institute of Standards and Technology at such time, in 

such manner, and containing such information as the Director may require. The 

application shall include, at a minimum, a description of— 

(A) the research projects that will be undertaken by the Center established pursuant to assistance under paragraph (1) and the respective contributions of the participating entities; 

(B) how the Center will promote active collaboration among scientists and 

engineers from different disciplines, such as information technology, biologic sciences, management, social sciences, and other appropriate disciplines; 

(C) technology transfer activities to demonstrate and diffuse the research 

results, technologies, and knowledge; and 

(D) how the Center will contribute to the education and training of researchers and other professionals in fields relevant to health information 

enterprise integration. 

(b) NATIONAL INFORMATION TECHNOLOGY RESEARCH AND DEVELOPMENT PROGRAM.—The National High-Performance Computing Program established by section 

101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) shall coordinate Federal research and development programs related to the development and 

deployment of health information technology, including activities related to— 

(1) computer infrastructure; 

(2) data security; 

(3) development of large-scale, distributed, reliable computing systems; 

(4) wired, wireless, and hybrid high-speed networking; 

(5) development of software and software-intensive systems; 

(6) human-computer interaction and information management technologies; 

and 

(7) the social and economic implications of information technology. 

TITLE III—PRIVACY AND SECURITY 

PROVISIONS 

SEC. 300. DEFINITIONS. 

In this title, except as specified otherwise: 

(1) BREACH.—The term ‘‘breach’’ means the unauthorized acquisition, access, 

or disclosure of protected health information which compromises the security, 

privacy, or integrity of protected health information maintained by or on behalf 

of a person. Such term does not include any unintentional acquisition, access, 

or disclosure of such information by an employee or agent of the covered entity 

or business associate involved if such acquisition, access, or disclosure, respectively, was made in good faith and within the course and scope of the employment or other contractual relationship of such employee or agent, respectively, 

with the covered entity or business associate and if such information is not further acquired, accessed, or disclosed by such employee or agent. 

(2) BUSINESS ASSOCIATE.—The term ‘‘business associate’’ has the meaning 

given such term in section 160.103 of title 45, Code of Federal Regulations. 


jbell on PROD1PC69 with REPORTS
21 

(3) COVERED ENTITY.—The term ‘‘covered entity’’ has the meaning given such 

term in section 160.103 of title 45, Code of Federal Regulations. 

(4) DISCLOSE.—The terms ‘‘disclose’’ and ‘‘disclosure’’ have the meaning given 

the term ‘‘disclosure’’ in section 160.103 of title 45, Code of Federal Regulations. 

(5) HEALTH CARE OPERATIONS.—The term ‘‘health care operation’’ has the 

meaning given such term in section 164.501 of title 45, Code of Federal Regulations. 

(6) HEALTH CARE PROVIDER.—The term ‘‘health care provider’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. 

(7) PAYMENT.—The term ‘‘payment’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. 

(8) PERSONAL HEALTH RECORD.—The term ‘‘personal health record’’ means an 

electronic record of individually identifiable health information on an individual 

that can be drawn from multiple sources and that is managed, shared, and controlled by or for the individual. 

(9) PROTECTED HEALTH INFORMATION.—The term ‘‘protected health information’’ has the meaning given such term in section 160.103 of title 45, Code of 

Federal Regulations. 

(10) SECRETARY.—The term ‘‘Secretary’’ means the Secretary of Health and 

Human Services. 

(11) SECURITY.—The term ‘‘security’’ has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations. 

(12) STATE.—The term ‘‘State’’ means each of the several States, the District 

of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the 

Northern Mariana Islands. 

(13) TREATMENT.—The term ‘‘treatment’’ has the meaning given such term in 

section 164.501 of title 45, Code of Federal Regulations. 

(14) USE.—The term ‘‘use’’ has the meaning given such term in section 

160.103 of title 45, Code of Federal Regulations. 

(15) VENDOR OF PERSONAL HEALTH RECORDS.—The term ‘‘vendor of personal 

health records’’ means an entity that offers or maintains a personal health 

record. Such term does not include an entity that is a covered entity for purposes of offering or maintaining such personal health record. 

Subtitle A—Security Provisions 

SEC. 301. APPLICATION OF SECURITY PROVISIONS AND PENALTIES TO BUSINESS ASSOCIATES OF COVERED ENTITIES; ANNUAL GUIDANCE ON SECURITY PROVISIONS. 

(a) APPLICATION OF SECURITY PROVISIONS.—Sections 164.308, 164.310, and 

164.312 of title 45, Code of Federal Regulations, shall apply to a business associate 

of a covered entity in the same manner that such sections apply to the covered entity. 

(b) APPLICATION OF CIVIL AND CRIMINAL PENALTIES.—Sections 1176 and 1177 of 

the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to a business associate of a covered entity with respect to a section applied under subsection (a) to 

such business associate in the same manner that such sections apply to a covered 

entity with respect to such section. 

(c) ANNUAL GUIDANCE.—For the first year beginning after the date of the enactment of this Act and annually thereafter, the Secretary of Health and Human Services shall, in consultation with industry stakeholders, annually issue guidance on 

the latest safeguard technologies for use in carrying out the sections described in 

subsection (a). 

SEC. 302. NOTIFICATION IN THE CASE OF BREACH. 

(a) IN GENERAL.—A covered entity that accesses, maintains, retains, modifies, 

records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected 

health information (as defined in subsection (h)(1)) shall, in the case of a breach of 

such information that is discovered by the covered entity, notify each individual 

whose unsecured protected health information has been, or is reasonably believed 

by the covered entity to have been, accessed, acquired, or disclosed as a result of 

such breach. 

(b) NOTIFICATION OF COVERED ENTITY BY BUSINESS ASSOCIATE.—A business associate of a covered entity that accesses, maintains, retains, modifies, records, stores, 

destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, following the discovery of a breach of such information, notify the covered 

entity of such breach. Such notice shall include the identification of each individual 

whose unsecured protected health information has been, or is reasonably believed 


jbell on PROD1PC69 with REPORTS
22 

by the business associate to have been, accessed, acquired, or disclosed during such 

breach. 

(c) BREACHES TREATED AS DISCOVERED.—For purposes of this section, a breach 

shall be treated as discovered by a covered entity or by a business associate as of 

the first day on which such breach is known to such entity or associate, respectively, 

(including any person that is an employee, officer, or other agent of such entity or 

associate, respectively) or should reasonably have been known to such entity or associate (or person) to have occurred. 

(d) TIMELINESS OF NOTIFICATION.— 

(1) IN GENERAL.—Subject to subsection (g), all notifications required under 

this section shall be made without unreasonable delay and in no case later than 

60 calendar days after the discovery of a breach by the covered entity involved 

(or business associate involved in the case of a notification required under subsection (b)). 

(2) BURDEN OF PROOF.—The covered entity involved (or business associate involved in the case of a notification required under subsection (b)), shall have 

the burden of demonstrating that all notifications were made as required under 

this subtitle, including evidence demonstrating the necessity of any delay. 

(e) METHODS OF NOTICE.— 

(1) INDIVIDUAL NOTICE.—Notice required under this section to be provided to 

an individual, with respect to a breach, shall be provided promptly and in the 

following form: 

(A) Written notification by first-class mail to the individual (or the next 

of kin of the individual if the individual is deceased) at the last known address of the individual or the next of kin, respectively, or, if specified as a 

preference by the individual, by electronic mail. The notification may be 

provided in one or more mailings as information is available. 

(B) In the case in which there is insufficient, or out-of-date contact information that precludes direct written (or, if specified by the individual under 

subparagraph (A), electronic) notification to the individual, a substitute 

form of notice shall be provided, including a conspicuous posting on the 

home page of the Web site of the covered entity involved or notice in major 

print or broadcast media, including major media in geographic areas where 

the individuals affected by the breach likely reside. Such a notice in media 

will include a toll-free phone number where an individual can learn whether or not the individual’s unsecured protected health information is possibly 

included in the breach. 

(C) In any case deemed by the covered entity involved to require urgency 

because of possible imminent misuse of unsecured protected health information, the covered entity, in addition to notice provided under subparagraph 

(A), may provide information to individuals by telephone or other means, 

as appropriate. 

(2) MEDIA NOTICE.—Notice shall be provided to prominent media outlets serving a State or jurisdiction, following the discovery of a breach described in subsection (a), if the unsecured protected health information of more than 500 residents of such State or jurisdiction is, or is reasonably believed to have been, 

accessed, acquired, or disclosed during such breach. 

(3) NOTICE TO SECRETARY.—Notice shall be provided to the Secretary by covered entities of unsecured protected health information that has been acquired 

or disclosed in a breach. 

(4) POSTING ON HHS PUBLIC WEBSITE.—The Secretary shall make available to 

the public on the Internet website of the Department of Health and Human 

Services a list that identifies each covered entity involved in a breach described 

in subsection (a) in which the unsecured protected health information of more 

than 1,000 individuals is acquired or disclosed. 

(f) CONTENT OF NOTIFICATION.—Regardless of the method by which notice is provided to individuals under this section, notice of a breach shall include, to the extent 

possible, the following: 

(1) A brief description of what happened, including the date of the breach and 

the date of the discovery of the breach, if known. 

(2) A description of the types of unsecured protected health information that 

were involved in the breach (such as full name, Social Security number, date 

of birth, home address, account number, or disability code). 

(3) The steps individuals should take to protect themselves from potential 

harm resulting from the breach. 

(4) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further 

breaches. 


jbell on PROD1PC69 with REPORTS
23 

(5) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, 

Web site, or postal address. 

(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW ENFORCEMENT PURPOSES.—If 

a law enforcement official determines that a notification, notice, or posting required 

under this section would impede a criminal investigation or cause damage to national security, such notification, notice, or posting shall be delayed in the same 

manner as provided under section 164.528(a)(2) of title 45, Code of Federal Regulations, in the case of a disclosure covered under such section. 

(h) UNSECURED PROTECTED HEALTH INFORMATION.— 

(1) DEFINITION.— 

(A) IN GENERAL.—Subject to subparagraph (B), for purposes of this section, the term ‘‘unsecured protected health information’’ means protected 

health information that is not protected through the use of a technology or 

methodology specified by the Secretary in the guidance issued under paragraph (2). 

(B) EXCEPTION IN CASE TIMELY GUIDANCE NOT ISSUED.—In the case that 

the Secretary does not issue guidance under paragraph (2) by the date specified in such paragraph, for purposes of this section, the term ‘‘unsecured 

protected health information’’ shall mean protected health information that 

is not protected by technology standards developed or endorsed by a standards developing organization that is accredited by the American National 

Standards Institute. 

(2) GUIDANCE.—For purposes of paragraph (1) and section 315(f), not later 

than the date that is 60 days after the date of the enactment of this Act, the 

Secretary shall, after consultation with stakeholders, issue (and annually update) guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. 

(i) EFFECTIVE DATE.—The provisions of this section shall apply to breaches that 

are discovered on or after the date that is 90 days after the date of the enactment 

of this Act. 

SEC. 303. EDUCATION ON HEALTH INFORMATION PRIVACY AND REPORT ON COMPLIANCE. 

(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not later than 6 months after the date 

of the enactment of this Act, the Secretary shall designate an individual in each regional office of the Department of Health and Human Services to offer guidance and 

education to covered entities, business associates, and individuals on their rights 

and responsibilities related to Federal privacy and security requirements for protected health information. 

(b) REPORT ON COMPLIANCE.— 

(1) IN GENERAL.—For the first year beginning after the date of the enactment 

of this Act and annually thereafter, the Secretary shall prepare and submit to 

Congress a report concerning complaints of alleged violations of the provisions 

of sections 301 and 302, the provisions of subtitle B, and the provisions of subparts C and E of title 45, Code of Federal Regulations that are received by the 

Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year— 

(A) the number of such complaints; 

(B) the number of such complaints resolved informally, a summary of the 

types of such complaints so resolved, and the number of covered entities 

that received technical assistance from the Secretary during such year in 

order to achieve compliance with such provisions and the types of such 

technical assistance provided; 

(C) the number of such complaints that resulted in the imposition of civil 

money penalties, the amount of the civil money penalty imposed in each 

such case, and a summary of the basis for each such civil money penalty; 

(D) the number of compliance reviews conducted and the outcome of each 

such review; 

(E) the number of subpoenas or inquiries issued; and 

(F) the Secretary’s plan for improving compliance with and enforcement 

of such provisions for the following year. 

(2) AVAILABILITY TO PUBLIC.—Each report under paragraph (1) shall be made 

available to the public on the Internet website of the Department of Health and 

Human Services. 

(c) EDUCATION INITIATIVE ON USES OF HEALTH INFORMATION.— 

(1) IN GENERAL.—The Office for Civil Rights within the Department of Health 

and Human Services shall develop and maintain a multi-faceted national education initiative to enhance public transparency regarding the uses of protected 


jbell on PROD1PC69 with REPORTS
24 

health information, including programs to educate individuals about the potential uses of their protected health information, the effects of such uses, and the 

rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present information in a clear and understandable manner. 

(2) AUTHORIZATION OF APPROPRIATIONS.—There is authorized to be appro- priated to carry out paragraph (1), $10,000,000 for the period of fiscal years 

2009 through 2013. 

Subtitle B—Improved Privacy Provisions and 

Additional Security Provisions 

SEC. 311. APPLICATION OF PENALTIES TO BUSINESS ASSOCIATES OF COVERED ENTITIES FOR 

VIOLATIONS OF PRIVACY CONTRACT REQUIREMENTS. 

(a) APPLICATION OF CONTRACT REQUIREMENTS.—In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 

164.502(e)(2) of title 45, Code of Federal Regulations, with such covered entity, the 

business associate may use and disclose such protected health information only if 

such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. 

(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSOCIATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such 

title, except that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract. 

(c) APPLICATION OF CIVIL AND CRIMINAL PENALTIES.—In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of sections 

1176 and 1177 of the Social Security Act (42 U.S.C. 1320d-5, 1320d-6) shall apply 

to the business associate with respect to such violation in the same manner as such 

provisions apply to a person who violates a provision of part C of title XI of such 

Act. 

SEC. 312. RESTRICTIONS ON CERTAIN DISCLOSURES AND SALES OF HEALTH INFORMATION; 

ACCOUNTING OF CERTAIN PROTECTED HEALTH INFORMATION DISCLOSURES; ACCESS TO CERTAIN INFORMATION IN ELECTRONIC FORMAT. 

(a) REQUESTED RESTRICTIONS ON CERTAIN DISCLOSURES OF HEALTH INFORMA- TION.—In the case that an individual requests under paragraph (a)(1)(i)(A) of section 

164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the 

disclosure of the protected health information of the individual, notwithstanding 

paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— 

(1) except as otherwise required by law, the disclosure is to a health plan for 

purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and 

(2) the protected health information pertains solely to a health care item or 

service for which the health care provider involved has been paid out of pocket 

in full. 

(b) DISCLOSURES REQUIRED TO BE LIMITED TO THE LIMITED DATA SET OR THE

MINIMUM NECESSARY.— 

(1) IN GENERAL.—A covered entity shall be treated as being in compliance 

with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect 

to the use, disclosure, or request of protected health information described in 

such section, only if the covered entity limits such protected health information, 

to the extent practicable, to the limited data set (as defined in section 

164.514(e)(2) of such title) or, if needed by such entity, to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, 

respectively. 

(2) APPLICATION OF EXCEPTIONS.—The exceptions described in section 

164.502(b)(2) of title 45, Code of Federal Regulations, shall apply to the requirement under paragraph (1) as of the effective date described in section 323 in 

the same manner that such exceptions apply to section 164.502(b)(1) of such 

title before such date. 

(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH INFORMATION DISCLOSURES REQUIRED IF COVERED ENTITY USES ELECTRONIC MEDICAL RECORD.— 


jbell on PROD1PC69 with REPORTS
25 

(1) IN GENERAL.—In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic medical record with respect to protected health information— 

(A) the exception under section paragraph (a)(1)(i) of such section shall 

not apply to disclosures (other than oral disclosures) made by such entity 

of such information; and 

(B) an individual shall have a right to receive an accounting of disclosures described in such paragraph of such information made by such covered entity during only the three years prior to the date on which the accounting is requested. 

(2) ELECTRONIC MEDICAL RECORD DEFINED.—For purposes of paragraph (1), 

the term ‘‘electronic medical record’’ means an electronic record of individually 

identifiable health information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff within a single organization. 

(3) EFFECTIVE DATE.—The provisions of this subsection shall apply to disclosures, with respect to protected health information, made by a covered entity 

on or after the sooner of the following dates: 

(A) In the case of an entity that does not use or maintain an electronic 

medical record before the date of the enactment of this Act with respect to 

such information, the date on which the covered entity first uses or maintains an electronic medical record, with respect to such information, and in 

the case of an entity that uses or maintains an electronic medical record 

with respect to such information before such date of enactment, the date 

on which the covered entity upgrades such electronic medical record. 

(B) The date that is 6 months after the date on which a standard described in section 3002(b)(2)(B) of the Public Health Service Act, as added 

by section 101, is adopted under section 3004 of such Act, as so added. 

(d) APPLICATION OF CONSENT REQUIREMENTS FOR CERTAIN USES AND DISCLOSURES BY HEALTH CARE PROVIDERS WITH ELECTRONIC MEDICAL RECORDS.— 

(1) IN GENERAL.—In applying section 164.506 of title 45, Code of Federal Regulations, in the case of a covered entity that is a health care provider, with respect to protected health information of an individual that is used or maintained by such entity in an electronic medical record (as defined in subsection 

(c)(2)), such covered entity may not use or disclose such protected health information for purposes of health care operations unless the covered entity obtains 

the consent of the individual to use or disclose such information for such purposes. 

(2) TREATMENT OF CONSENT AND REVOCABILITY OF CONSENT.—For purposes of 

paragraph (1), in the case that an individual provides consent to a covered entity described in such paragraph to use or disclose protected health information 

described in such paragraph for purposes of health care operations— 

(A) such consent may be valid and applicable to future uses or disclosures 

by such covered entity of such information for such purposes unless and 

until the individual revokes such consent; 

(B) such consent shall be revocable by the individual at any time; and 

(C) in the case that an individual revokes such consent, such revocation 

shall only apply to any information acquired by the covered entity after the 

date of such revocation. 

(3) APPLICATION OF MINIMUM NECESSARY AND LIMITED DATA SET RULES.—The 

provision of consent under paragraph (1) shall not affect the application of the 

requirements under section 164.502(b)(1) of title 45, Code of Federal Regulations, and subsection (b) of this section to such entity for purposes of the use 

or disclosure of protected health information described in such paragraph. 

(4) CLARIFICATION.—Nothing in this subsection shall be construed as preventing a covered entity described in paragraph (1) from maintaining protected 

health information of an individual in an electronic medical record solely on the 

basis that the covered entity seeks consent of the individual as required under 

paragraph (1) and the individual does not provide such consent (or revokes any 

such consent provided). 

(5) REGULATIONS.—Not later than 18 months after the date of the enactment 

of this Act, the Secretary shall promulgate regulations to implement this subsection to ensure the integrity of protected health information in a reasonable 

and workable manner. In such regulations, the Secretary may exempt certain 

health care operations specified by the Secretary from the requirements under 

paragraphs (1) and (7). 

(6) RULE OF CONSTRUCTION.—The provision of consent under paragraph (1) by 

an individual, with respect to protected health information, does not constitute 


jbell on PROD1PC69 with REPORTS
26 

a waiver of any privilege otherwise applicable to such individual with respect 

to such information. 

(7) DISCLOSURES BY HEALTH PLANS.—In the case that a covered entity seeks 

consent, with respect to protected health information of an individual, as required under paragraph (1) and the individual does not provide such consent 

(or revokes any such consent provided) and such information is disclosed to a 

health plan for a purpose, such plan may only use such information for such 

purpose. 

(8) MODEL INFORMED CONSENT.— 

(A) IN GENERAL.—The Secretary, after notice and opportunity for public 

comment in accordance with section 553 of title 5, United States Code, shall 

develop and make publicly available model consents of the type described 

in paragraph (1). 

(B) REQUIREMENTS OF MODEL INFORMED CONSENT.—Each model consent 

developed under subparagraph (A), with respect to the protected health information of an individual, shall— 

(i) inform such individual about the matter to which the individual 

is providing consent; 

(ii) inform such individual about the specific purposes for which the 

information may be used or disclosed; 

(iii) explain what activities are considered health care operations; 

and 

(iv) be in a form that is easily accessible and understandable and 

supports the ability of the individual to decide whether to consent pursuant to paragraph (1). 

(C) TREATMENT OF CONSENT OBTAINED ON MODEL FORM.— 

(i) IN GENERAL.—Any consent obtained by a health care provider 

using a model form under subparagraph (A) shall be deemed to meet 

the requirement under paragraph (1). 

(ii) RULE OF CONSTRUCTION.—Clause (i) applies with respect to the 

use by a health care provider of a model form under subparagraph (A) 

without regard to whether such provider includes in the form additional provisions in order to meet requirements under State or Federal 

law that relate to obtaining consent. 

(9) EFFECTIVE DATE.—The provisions of this subsection shall apply to disclosures made by a covered entity on or after the date that is 24 months after the 

date of the enactment of this Act. 

(e) PROHIBITION ON SALE OF ELECTRONIC MEDICAL RECORDS OR PROTECTED

HEALTH INFORMATION OBTAINED FROM ELECTRONIC MEDICAL RECORDS.—A covered 

entity or business associate may not sell an electronic medical record (as defined in 

subsection (c)(2)) of an individual or any protected health information obtained from 

such electronic medical record unless— 

(1) such sale is necessary for treatment of the individual or payment for treatment of the individual; or 

(2) the covered entity obtains from the individual, in accordance with section 

164.508 of title 45, Code of Federal Regulations, a valid authorization (as described in paragraph (b) of such section) to sell such record or information, respectively. 

(f) ACCESS TO CERTAIN INFORMATION IN ELECTRONIC FORMAT.—In applying section 164.524 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic medical record (as defined in subsection (c)(2)) 

with respect to protected health information of an individual— 

(1) the individual shall have a right to obtain from such covered entity a copy 

of such information in an electronic format; and 

(2) notwithstanding paragraph (c)(4) of such section, the covered entity may 

not impose any fee for providing such individual with a copy of such information 

(or a summary or explanation of such information) if such copy (or summary 

or explanation) is in an electronic form. 

SEC. 313. CONDITIONS ON CERTAIN CONTACTS AS PART OF HEALTH CARE OPERATIONS. 

(a) IN GENERAL.—A communication by a covered entity or business associate that 

is about a product or service and that encourages recipients of the communication 

to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, 

unless the communication is made as described in subparagraph (i), (ii), or (iii) of 

paragraph (1) of the definition of marketing in section 164.501 of such title. 

(b) PAYMENT FOR CERTAIN COMMUNICATIONS.—Subject to paragraph (2), a covered 

entity or business associate may not receive direct or indirect payment in exchange 

for making any communication described in subparagraph (i), (ii), or (iii) of paraVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00026 Fmt 6659 Sfmt 6621 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
27 

graph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, except— 

(1) a business associate of a covered entity may receive payment from the covered entity for making any such communication on behalf of the covered entity 

that is consistent with the written contract (or other written arrangement) described in section 164.502(e)(2) of such title between such business associate 

and covered entity; and 

(2) a covered entity may receive payment in exchange for making any such 

communication if the entity obtains from the recipient of the communication, in 

accordance with section 164.508 of title 45, Code of Federal Regulations, a valid 

authorization (as described in paragraph (b) of such section) with respect to 

such communication. 

(c) EFFECTIVE DATE.—Subsections (a) and (b) shall apply to contracting occurring 

on or after the effective date specified under section 323. 

SEC. 314. STUDY ON APPLICATION OF PRIVACY AND SECURITY REQUIREMENTS TO NONHIPAA COVERED ENTITIES. 

Not later than one year after the date of the enactment of this Act, the Secretary, 

in consultation with the Federal Trade Commission, shall submit to Congress recommendations— 

(1) to identify requirements relating to security, privacy, and notification in 

the case of a breach of security or privacy (including the applicability of an exemption to notification in the case of individually identifiable health information that has been rendered unusable, unreadable, or indecipherable through 

technologies or methodologies recognized by appropriate professional organization or standard setting bodies to provide effective security for the information) 

that should be applied to— 

(A) vendors of personal health records; 

(B) entities that offer products or services through the website of a vendor 

of personal health records; 

(C) entities that are not covered entities and that offer products or services through the websites of covered entities that offer individuals personal 

health records; 

(D) entities that are not covered entities and that access information in 

a personal health record or send information to a personal health record; 

and 

(E) third party service providers used by a vendor or entity described in 

subparagraph (A), (B), (C), or (D) to assist in providing personal health 

record products or services; and 

(2) to determine which Federal government agency is best equipped to enforce 

such requirements recommended to be applied to such vendors, entities, and 

service providers under paragraph (1). 

SEC. 315. TEMPORARY BREACH NOTIFICATION REQUIREMENT FOR VENDORS OF PERSONAL 

HEALTH RECORDS AND OTHER NON-HIPAA COVERED ENTITIES. 

(a) IN GENERAL.—In accordance with subsection (c), each vendor of personal 

health records, following the discovery of a breach of security of unsecured PHR 

identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in subparagraph (B), (C), or (D) of 

section 314(1), following the discovery of a breach of security of such information 

that is obtained through a product or service provided by such entity, shall— 

(1) notify each individual who is a citizen or resident of the United States 

whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and 

(2) notify the Federal Trade Commission. 

(b) NOTIFICATION BY THIRD PARTY SERVICE PROVIDERS.—A third party service provider that provides services to a vendor of personal health records or to an entity 

described in subparagraph (B), (C), or (D) of section 314(1) in connection with the 

offering or maintenance of a personal health record or a related product or service 

and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such 

a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. 

Such notice shall include the identification of each individual whose unsecured PHR 

identifiable health information has been, or is reasonably believed to have been, 

accessed, acquired, or disclosed during such breach. 

(c) APPLICATION OF REQUIREMENTS FOR TIMELINESS, METHOD, AND CONTENT OF

NOTIFICATIONS.—Subsections (c), (d), (e), and (f) of section 302 shall apply to a notification required under subsection (a) and a vendor of personal health records, an 

entity described in subsection (a) and a third party service provider described in 


jbell on PROD1PC69 with REPORTS
28 

subsection (b), with respect to a breach of security under subsection (a) of unsecured 

PHR identifiable health information in such records maintained or offered by such 

vendor, in a manner specified by the Federal Trade Commission. 

(d) NOTIFICATION OF THE SECRETARY.—Upon receipt of a notification of a breach 

of security under subsection (a)(2), the Federal Trade Commission shall notify the 

Secretary of such breach. 

(e) ENFORCEMENT.—A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 

18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding 

unfair or deceptive acts or practices. 

(f) DEFINITIONS.—For purposes of this section: 

(1) BREACH OF SECURITY.—The term ‘‘breach of security’’ means, with respect 

to unsecured PHR identifiable health information of an individual in a personal 

health record, acquisition of such information without the authorization of the 

individual. 

(2) PHR IDENTIFIABLE HEALTH INFORMATION.—The term ‘‘PHR identifiable 

health information’’ means individually identifiable health information, as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), and includes, with respect to an individual, information— 

(A) that is provided by or on behalf of the individual; and 

(B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. 

(3) UNSECURED PHR IDENTIFIABLE HEALTH INFORMATION.— 

(A) IN GENERAL.—Subject to subparagraph (B), the term ‘‘unsecured PHR 

identifiable health information’’ means PHR identifiable health information 

that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under section 302(h)(2). 

(B) EXCEPTION IN CASE TIMELY GUIDANCE NOT ISSUED.—In the case that 

the Secretary does not issue guidance under section 302(h)(2) by the date 

specified in such section, for purposes of this section, the term ‘‘unsecured 

PHR identifiable health information’’ shall mean PHR identifiable health 

information that is not protected by technology standards that are developed or endorsed by a standards developing organization that is accredited 

by the American National Standards Institute. 

(g) EFFECTIVE DATE.—The provisions of this section shall apply to breaches of security occurring during the 2-year period beginning on the date that is 90 days after 

the date of the enactment of this Act. 

SEC. 316. BUSINESS ASSOCIATE CONTRACTS REQUIRED FOR CERTAIN ENTITIES. 

Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity and that requires access on 

a routine basis to such protected health information, such as a Health Information 

Exchange, Regional Health Information Organization, or E-prescribing Gateway, is 

required to enter into a written contract (or other written arrangement) described 

in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such 

entity and shall be treated as a business associate of the covered entity for purposes 

of the provisions of this title. 

SEC. 317. GUIDANCE ON IMPLEMENTATION SPECIFICATION TO DE-IDENTIFY PROTECTED 

HEALTH INFORMATION. 

Not later than 12 months after the date of the enactment of this Act, the Secretary shall, in consultation with stakeholders, issue guidance on how best to implement the requirements for the de-identification of protected health information 

under section 164.514(b) of title 45, Code of Federal Regulations. 

SEC. 318. GAO REPORT ON TREATMENT DISCLOSURES. 

Not later than one year after the date of the enactment of this Act, the Comptroller General of the United States shall submit to Congress a report on the best 

practices related to the disclosure among health care providers of protected health 

information of an individual for purposes of treatment of such individual. Such report shall include an examination of the best practices implemented by States and 

by other entities, such as health information exchanges and regional health information organizations, including an examination of the extent to which such best practices are successful with respect to the quality of the resulting health care provided 

to the individual and with respect to the ability of the health care provider to manage such best practices. 


jbell on PROD1PC69 with REPORTS
29 

SEC. 319. CLARIFICATION OF APPLICATION OF WRONGFUL DISCLOSURES CRIMINAL PENALTIES. 

Section 1177(a) of the Social Security Act (42 U.S.C. 1320d–6(a)) is amended by 

adding at the end the following new sentence: ‘‘For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to 

have obtained or disclosed individually identifiable health information in violation 

of this part if the information is maintained by a covered entity (as defined in the 

HIPAA privacy regulation described in section 1180(b)(3)) and the individual obtained or disclosed such information without authorization.’’. 

SEC. 320. IMPROVED ENFORCEMENT. 

(a) IN GENERAL.—Section 1176 of the Social Security Act (42 U.S.C. 1320d-5) is 

amended— 

(1) in subsection (b)(1), by striking ‘‘the act constitutes an offense punishable 

under section 1177’’ and inserting ‘‘a penalty has been imposed under section 

1177 with respect to such act’’; and 

(2) by adding at the end the following new subsection: 

‘‘(c) NONCOMPLIANCE DUE TO WILLFUL NEGLECT.— 

‘‘(1) IN GENERAL.—A violation of a provision of this part due to willful neglect 

is a violation for which the Secretary is required to impose a penalty under subsection (a)(1). 

‘‘(2) REQUIRED INVESTIGATION.—For purposes of paragraph (1), the Secretary 

shall formally investigate any complaint of a violation of a provision of this part 

if a preliminary investigation of the facts of the complaint indicate such a possible violation due to willful neglect. 

‘‘(3) REGULATIONS.—Not later than 180 days after the date of the enactment 

of the PRO(TECH)T Act of 2008, the Secretary shall promulgate regulations to 

implement this subsection.’’. 

(b) EFFECTIVE DATE.—The amendments made by subsection (a) shall apply to penalties imposed on or after the date specified in section 323. 

Subtitle C—Relationship to Other Laws; 

Regulatory References; Effective Date 

SEC. 321. RELATIONSHIP TO OTHER LAWS. 

(a) APPLICATION OF HIPAA STATE PREEMPTION.—Section 1178 of the Social Security Act (42 U.S.C. 1320d–7) shall apply to a provision or requirement under this 

title in the same manner that such section applies to a provision or requirement 

under part C of title XI of such Act or a standard or implementation specification 

adopted or established under sections 1172 through 1174 of such Act. 

(b) HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT.—The standards 

governing the privacy and security of individually identifiable health information 

promulgated by the Secretary under sections 262(a) and 264 of the Health Insurance Portability and Accountability Act of 1996 shall remain in effect to the extent 

that they are consistent with this title. The Secretary shall by rule amend such Federal regulations as required to make such regulations consistent with this title. 

SEC. 322. REGULATORY REFERENCES. 

Each reference in this title to a provision of the Code of Federal Regulations refers to such provision as in effect on the date of the enactment of this Act (or to 

the most recent update of such provision). 

SEC. 323. EFFECTIVE DATE. 

The provisions of subtitles A and B of this title (other than sections 301(c), 302, 

303, 312(c), 312(d), 314, 315, 317, 318, and 319) shall take effect on the date that 

is 12 months after the date of the enactment of this Act. 

PURPOSE AND SUMMARY

The purpose of H.R. 6357, the Protecting Records, Optimizing 

Treatment, and Easing Communication through Healthcare Technology Act of 2008 (or the PRO(TECH)T Act of 2008), is to facilitate 

the nationwide adoption and use of health information technology 

(HIT) in the United States while also protecting the privacy and security of each individual’s health information. The bill makes permanent the Office of the National Coordinator for Health InformaVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00029 Fmt 6659 Sfmt 6602 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
30 

1To Err is Human. IOM (2000) National Academy Press. Page 1. 

2Kaiser Family Foundation. ‘‘Trends in Health Care Costs and Spending.’’ September 2007. 

http://www.kff.org/insurance/upload/7692.pdf. 3The Commonwealth Fund Commission on a High Performance Health System. ‘‘Why Not the 

Best? Results from the National Scorecard on U.S. Health System Performance, 2008.’’ July 

2008. Pages 10–11. 

tion Technology (ONCHIT), originally created by Executive Order 

13335, within the Department of Health and Human Services 

(HHS). With the assistance of two Federal advisory committees, 

ONCHIT will develop HIT, privacy policy, and technical standards, 

as well as conduct activities to promote the growth of a nationwide 

HIT infrastructure. That infrastructure will lower health care 

costs, reduce medical errors, and provide for a more efficient delivery of health care through the use of electronic health records 

(EHR). Because this legislation encourages the electronic flow of a 

person’s health information, it will also strengthen current privacy 

and security protections of a person’s information. This legislation 

will ensure that such personal information is only obtained or 

accessed by appropriate entities for legitimate purposes. 

BACKGROUND AND NEED FOR LEGISLATION

The U.S. health care system is characterized by systemic quality 

and efficiency shortcomings. The system’s quality problems are evidenced by high rates of medical and medication errors and a lack 

of adherence to practice guidelines. In a 2000 study, the Institute 

of Medicine (IOM) found that as many as 98,000 people die each 

year due to preventable medical errors.1 According to the Agency 

for Healthcare Research and Quality (AHRQ), an average of 17 

years is required for findings from randomized clinical trials to be 

implemented into clinical practice. These documented shortcomings 

in our quality of care contribute to higher health care costs and 

place patients at risk. The U.S. is the top spender on health care 

in the world, with projected spending of over $2 trillion in 2007 

(which represents about 16 percent of GDP and over $7,000 per 

capita).2 A July 2008 study reports that despite spending two times 

more per capita than any other major industrialized country on 

health care, the United States has a mortality rate where 110 per 

100,000 deaths are preventable through health care intervention.3

Nationwide adoption of health information technology (HIT), that 

supports the electronic exchange of health information, has the potential to ameliorate many of the quality and efficiency problems 

endemic to our health care system. HIT would allow for the centralization of patient information, enhanced, real-time communication between providers to improve the coordination of care, improved patient access to medical records, and access to a variety of 

quality enhancing programs and tools. While HIT includes electronic health records (EHRs), the term also includes the infrastructure required to support EHRs and allow providers to exchange the 

information in the EHRs. A robust EHR system includes the capability to maintain and access electronic health information about a 

patient in a timely manner and exchange that information with 

other providers. This includes computerized prescription order 

entry and clinical decision support programs. 

A 2005 RAND study estimates that implementation of an HIT 

system that permits providers, insurers, and others to exchange 


jbell on PROD1PC69 with REPORTS
31 

4 Hillestad, R., et al. ‘‘Can Electronic Medical Record Systems Transform Health Care? Potential Health Benefits, Savings, and Costs’’ Health Affairs; 24(5): 1103–1117; September/October 

2005. 5 Catherine M. DesRoches, Dr.P.H., Eric G. Campbell, Ph.D., Sowmya R. Rao, Ph.D., Karen 

Donelan, Sc.D., Timothy G. Ferris, M.D., M.P.H., Ashish Jha, M.D., M.P.H., Rainu Kaushal, 

M.D., M.P.H., Douglas E. Levy, Ph.D., Sara Rosenbaum, J.D., Alexandra E. Shields, Ph.D., and 

David Blumenthal, M.D., M.P.P, ‘‘Electronic Health Records in Ambulatory Care—A National 

Survey of Physicians’’ The New England Journal of Medicine, Published at www.nejm.org June 

18, 2008 (10.1056/NEJMsa0802005). 6 Robert H. Miller, Christopher West, Tiffany Martin Brown, Ida Sim, and Chris Ganchoff, 

‘‘The Value Of Electronic Health Records In Solo Or Small Group Practices,’’ Health Affairs— 

Volume 24 , Number 5, 2005. 7 Catherine M. DesRoches, Dr.P.H., Eric G. Campbell, Ph.D., Sowmya R. Rao, Ph.D., Karen 

Donelan, Sc.D., Timothy G. Ferris, M.D., M.P.H., Ashish Jha, M.D., M.P.H., Rainu Kaushal, 

M.D., M.P.H., Douglas E. Levy, Ph.D., Sara Rosenbaum, J.D., Alexandra E. Shields, Ph.D., and 

David Blumenthal, M.D., M.P.P, ‘‘Electronic Health Records in Ambulatory Care—A National 

Survey of Physicians’’ The New England Journal of Medicine, Published at www.nejm.org June 

18, 2008 (10.1056/NEJMsa0802005). 8 Id. 

9 Id. 

10Gerard F. Anderson, Bianca K. Frogner, Roger A. Johns and Uwe E. Reinhardt, ‘‘Health 

Care Spending And Use Of Information Technology In OECD Countries,’’ Health Affairs, 25, no. 

3 (2006): 819–831 available at http:// content. health affairs. org/ cgi/ content/ full/ 25/ 3/ 819? 

max to show= &HITS =10 &hits= 10& RESULT FORMAT =& author1= Anderson & full text 

=spending & and or exact full text =and & search 1A id =1& FIRST INDEX =0 & resource type 

=HW CIT #R10. 11 Id. 

and use health information could save an average of $77 billion annually, and this figure only accounts for the efficiency savings. 

When savings from improvements in quality and safety are included, the study estimates that as much as $147 billion might be 

saved annually. This reflects improved health outcomes in the form 

of significant declines in medical and medication errors, increased 

use of indicated preventive care, and enhanced chronic disease 

management.4

Regardless of these apparent benefits, many obstacles to the successful uptake and widespread implementation of HIT have been 

documented by policymakers. Currently, only 13 percent of physicians have a basic EHR system, and only 4 percent have a fully 

functional EHR system.5 A commonly cited impediment to the 

adoption of HIT is cost. The average cost of purchasing an EHR 

system is about $43,000 with approximately $8,000 in annual ongoing costs for such activities as maintenance and support.6 A recently released study published in the New England Journal of 

Medicine showed that a large majority of physicians using EHR 

systems are satisfied and report that those systems have positive 

effects on the quality of patient care.7 The study, which surveyed 

2,607 physicians, showed that physicians without HIT systems 

were concerned about financial barriers.8 Evidence from this study 

and others strongly indicate that health care providers need guidance and financial support if HIT is to be widely adopted in the 

United States.9

The United States spends, on average, as much as two and a half 

times more per capita than other similarly situated industrialized 

nations. Still, in comparison to other countries, the U.S. lags far behind in the adoption of HIT.10 Nations such as Germany, Canada, 

the United Kingdom, Norway, and Australia are all significantly 

ahead of the U.S. in establishing nationwide HIT networks.11 Many 

of these countries achieved success in implementing nationwide 

HIT networks by establishing committees as long ago as 1993 with 


jbell on PROD1PC69 with REPORTS
32 

12 Id. 13Stevens, Gina Marie, ‘‘Enforcement of the HIPAA Privacy Rule,’’ CRS Report RL33989, 

April 30, 2007. 14 Id. 15 Id. 16Statement of Deven McGraw, Director, Health Privacy Project, Center for Democracy and 

Technology, Testimony Before the Subcommittee on Health of the House Committee on Energy 

and Commerce, June 4, 2008, available at http://energycommerce. house.gov/ cmte—mtgs/ 110– 

he-hrg. 060408.HealthIT draft.shtml. 17 Id. 18 Id. 

functions very similar to those vested in the Office of the National 

Coordinator which will be codified through the bill.12

In addition to costs, concerns about the security and privacy of 

health information have also been regarded as an obstacle to the 

adoption of HIT. As the electronic transmission of health information between various independent entities is encouraged, the privacy and security of that health information becomes a much greater concern. The Health Insurance Portability and Accountability 

Act of 1996 (HIPAA; P.L. 104–191) resulted in the Secretary of 

HHS developing privacy and security standards giving patients the 

right of access to their medical information and placing restrictions 

on the use and disclosure of that information without the patient’s 

consent. The HIPAA ‘‘Privacy Rule’’ and ‘‘Security Rule’’ currently 

provide the Federal standard for the protection of individually 

identifiable health information.13 There are, however, clear gaps in 

the current privacy and security structure established under 

HIPAA that have become apparent over time. For example, there 

are no requirements that a person be notified if their information 

is accessed by an unauthorized party. In addition, between April 

2003 and March 2007, HHS documented 26,408 complaints of Privacy Rule violations.14 Despite the relatively large number of complaints, no civil penalties were levied during that period and only 

one civil fine has been levied since then.15

HIT holds the promise of implementing a seamless nationwide 

electronic exchange of health information between numerous entities. This will improve health care but can create a greater opportunity for information to be accessed or obtained by an unauthorized party. In testimony before the Committee on Energy and Commerce, however, Deven McGraw, the Director of the Health Privacy 

Project for the Center for Democracy and Technology, stated that 

HIT, implemented properly, ‘‘has a greater capacity to protect sensitive personal health information than is the case now with paper 

records.’’ 16 For example, HIT has the capability of employing technical safeguards, such as encryption, to ensure that sensitive data 

is not accessed when a system has been breached.17 Mr. McGraw 

stated in addition that ‘‘it is often impossible to tell whether someone has inappropriately accessed a paper record. By contrast, technologies, including strong user authentication and audit trails, can 

be employed to limit and track access to electronic health information automatically.’’ 18

H.R. 6357 would address these barriers to adoption and take 

steps to provide for greater privacy and security of health information and stronger enforcement of violations of Federal law. 


jbell on PROD1PC69 with REPORTS
33 

19Public Law 104–191. 

LEGISLATIVE AND EXECUTIVE HISTORY

Bills in the 109th Congress.—The 109th Congress was the first 

in which the House and Senate passed HIT legislation to create a 

process for the adoption of standards for the nationwide electronic 

exchange of health information. The legislation was not enacted, 

however. The House and Senate each passed its own HIT bill. On 

November 18, 2005, the Senate, by unanimous consent, passed the 

Wired for Health Care Quality Act (S. 1418, S.Rept. 109–111). On 

July 27, 2006, the House passed the Health Information Technology Promotion Act (H.R. 4157, H.Rept. 109–603) by a vote of 

270–148. The bills contained several important differences, and a 

House-Senate conference committee to resolve the differences was 

not convened. Both bills included similar language establishing 

ONCHIT and its responsibilities for adopting standards for the 

electronic exchange and use of health information. The bills, however, took different approaches to the public-private entity that 

would make recommendations to ONCHIT on standards that allow 

for the electronic exchange and use of health information. Only the 

Senate bill addressed certification of private health information 

technology hardware and software that meet such standards. The 

Senate bill would have authorized grants for health care providers, 

grants for implementing regional HIT plans, and a State loan program to facilitate HIT adoption. The House bill included an HIT 

grant program for integrated health care systems and for small 

physician practices. The House bill also included a provision to expedite updating and modifying the HIPAA electronic transactions 

and codes standards. The Senate bill contained no such provisions. 

Enactment of HIPAA in the 104th Congress.—Prior to the passage of House and Senate HIT bills in the 109th Congress, Congress took an important first step towards promoting HIT and privacy and security of health information when it enacted HIPAA in 

August 1996.19 Under the ‘‘Administrative Simplification’’ subtitle 

of HIPAA, the Secretary of HHS was required to develop standards 

to support the growth of electronic record keeping and secure 

claims processing in the health care system. Section 264 of HIPAA 

required HHS to develop recommendations regarding the rights 

that an individual who is a subject of individually identifiable 

health information should have; the procedures that should be established for the exercise of such rights; and the uses and disclosures of such information that should be authorized or required. 

Eventually, HHS promulgated regulations to fulfill these requirements. 

Enactment of Administrative Simplification Compliance Act in 

107th Congress.—In 2001, Congress enacted the Administrative 

Simplification Compliance Act (P.L. 107–105), which, among other 

things, requires Medicare providers to submit claims electronically. 

E-Prescribing.—Besides HIPAA, the other significant legislative 

action taken by Congress to promote HIT was the inclusion of electronic prescribing (e-prescribing) provisions in the Medicare Modernization Act of 2003 (MMA; P.L. 108–173), which created the 

Medicare Part D prescription drug benefit. Additionally, the recently enacted Medicare Improvement for Patients and Providers 

Act of 2008 (P.L. 110–161) includes an e-prescribing mandate and 


jbell on PROD1PC69 with REPORTS
34 

20 E-Prescribing: Overview available at http://www.cms.hhs.gov/EPrescribing. 

authorizes incentive bonus payments for physicians who use e-prescribing between 2009 and 2013; payments would be reduced for 

those who fail to e-prescribe after 2012.20

CMS Grants and Demonstrations.—CMS is administering a number of additional programs to promote HIT adoption. The MMA 

mandated a demonstration in four States to encourage physicians 

to adopt and use HIT to improve the care of chronically ill Medicare patients. CMS, using its Medicare waiver authority, has also 

developed a second demonstration to promote EHR adoption in as 

many as 1,200 small- to medium-sized Medicare participating physicians’ practices in 12 communities across the country. Additionally, the Deficit Reduction Act of 2005 (P.L. 109–171) authorized 

Medicaid Transformation Grants to states totaling $150 million 

over two years. Most of the funds are being used for HIT-related 

initiatives. 

Office of the National Coordinator for Health Information Technology; Other Administrative Actions.—On April 27, 2004, the 

President signed Executive Order 13335, which created the 

ONCHIT within the Department of HHS. The mission of ONCHIT 

is to develop, maintain, and direct a strategic plan to guide the nationwide implementation of HIT in the public and private health 

care sectors. 

In 2005, the Secretary created the American Health Information 

Community (AHIC), a federally chartered commission, to make recommendations to the Secretary on how to make health records digital and exchangeable, encourage market-led adoption of electronic 

health records that allow for the electronic exchange and use of 

health information, and ensure the privacy and security of those 

records. ONCHIT provides management of and logistical support 

for the AHIC. 

In August 2006, the President signed Executive Order 13410, 

which required Federal agencies that purchase and deliver health 

care to acquire and use, where available, HIT that is based on technical standards recognized by the Secretary. The order also applied 

to entities that contract with Federal agencies, such as Medicare 

carriers. 

HEARINGS

On June 4, 2008, the Subcommittee on Health held a hearing entitled ‘‘Discussion Draft of Health Information Technology and Privacy Legislation.’’ The witnesses included Steven J. Stack, M.D., 

Chairman of the American Medical Association’s HIT Advisory 

Group; Byron Thames, M.D., member of the Board of Directors of 

AARP; Frances Dare, Director of the Cisco Internet Business Solutions Group; Marc C. Reed, Executive Vice President of Corporate 

Human Resources of Verizon Corporate Services Group Inc.; James 

A. Ferguson, Executive Director of Health I.T. Strategy and Policy 

of Kaiser Permanente; Joycelyn Elders, M.D., former U.S. Surgeon 

General and Co-Chair of the African American Health Alliance; 

Deborah C. Peel, M.D., Founder and Chair of Patient Privacy 

Rights; Deven McGraw, Director of the Health Privacy Project of 

the Center for Democracy and Technology; Carolyn M. Clancy, 

M.D., Director of the Agency for Healthcare Research and Quality 


jbell on PROD1PC69 with REPORTS
35 

of the Department of Health and Human Services; and Susan D. 

McAndrew, J.D., Deputy Director for Health Information Privacy of 

the Office for Civil Rights of the Department of Health and Human 

Services. 

COMMITTEE CONSIDERATION

On Wednesday, June 25, 2008, the Subcommittee on Health met 

in open markup session and favorably forwarded H.R. 6357 to the 

full Committee for consideration, by a voice vote. On Wednesday, 

July 23, 2008, the full Committee met in open markup session and 

ordered H.R. 6357 favorably reported to the House, amended, by a 

voice vote. 

COMMITTEE VOTES

Clause 3(b) of rule XIII of the Rules of the House of Representatives requires the Committee to list the record votes on the motion 

to report legislation and amendments thereto. No record votes were 

taken on amendments or in connection with ordering H.R. 6357 reported to the House. A motion by Mr. Dingell to order H.R. 6357 

favorably reported to the House, amended, was agreed to by a voice 

vote. 

COMMITTEE OVERSIGHT FINDINGS

Regarding clause 3(c)(1) of rule XIII of the Rules of the House 

of Representatives, the Subcommittee on Health held a legislative 

hearing on a draft concerning HIT that was later modified and introduced as H.R. 6357, and the oversight findings of the Committee 

regarding the bill are reflected in this report. 

STATEMENT OF GENERAL PERFORMANCE GOALS AND OBJECTIVES

The purpose of H.R. 6357 is to facilitate the nationwide adoption 

and use of HIT in the United States while also protecting the privacy and security of each individual’s health information. 

NEW BUDGET AUTHORITY, ENTITLEMENT AUTHORITY, AND TAX

EXPENDITURES

Regarding compliance with clause 3(c)(2) of rule XIII of the Rules 

of the House of Representatives, the Committee finds that H.R. 

6357 would result in no new or increased budget authority, entitlement authority, or tax expenditures or revenues. 

EARMARKS AND TAX AND TARIFF BENEFITS

Regarding compliance with clause 9 of rule XXI of the Rules of 

the House of Representatives, H.R. 6357 does not contain any congressional earmarks, limited tax benefits, or limited tariff benefits 

as defined in clause 9(d), 9(e), or 9(f) of rule XXI. 

COMMITTEE COST ESTIMATE

The Committee adopts as its own the cost estimate on H.R. 6357 

prepared by the Director of the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974. 


jbell on PROD1PC69 with REPORTS
36 

CONGRESSIONAL BUDGET OFFICE ESTIMATE

Pursuant to clause 3(c)(3) of rule XIII of the Rules of the House 

of Representatives, the following is the cost estimate on H.R. 6357 

provided by the Congressional Budget Office pursuant to section 

402 of the Congressional Budget Act of 1974: 

U.S. CONGRESS, 

CONGRESSIONAL BUDGET OFFICE, 

Washington, DC, September 5, 2008. 

Hon. JOHN D. DINGELL, 

Chairman, Committee on Energy and Commerce, 

House of Representatives, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 6357, the Protecting 

Records, Optimizing Treatment, and Easing Communication 

through Healthcare Technology Act of 2008. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contacts are Stephanie Cameron 

and Kirstin Nelson. 

Sincerely, 

ROBERT A. SUNSHINE

(For Peter R. Orszag, Director). 

Enclosure. 

H.R. 6357—Protecting Records, Optimizing Treatment, and Easing 

Communication Through Healthcare Technology Act of 2008 

Summary: On April 27, 2004, the President issued Executive 

Order 13335, which established within the Office of the Secretary 

of Health and Human Services (HHS) the position of National 

Health Information Technology Coordinator. The Secretary subsequently established the Office of the National Coordinator of 

Health Information Technology (ONCHIT) and the American 

Health Information Community (AHIC) to support the adoption of 

health information technology (HIT). H.R. 6357 would amend the 

Public Health Service Act to codify the establishment and responsibilities of those entities. In addition, the bill would authorize 

funding for programs to facilitate the development of HIT standards and the widespread adoption of qualified HIT, and to enhance 

the security of private health information. 

H.R. 6357 would authorize the appropriation of $193 million in 

2009 and $960 million over the 2009–2013 period. CBO estimates 

that implementing the bill would cost an additional $58 million in 

2009 and $743 million over the 2009–2013 period, when compared 

to current law, assuming the appropriation of the authorized 

amounts. Enacting H.R. 6357 would not affect direct spending or 

revenues. 

Over the long term, widespread adoption of health IT could facilitate cost savings in the health care system as a whole and thus for 

government programs. Research indicates that in certain settings, 

health IT appears to make it easier to reduce health spending if 

other steps in the broader health care system are also taken to 

alter incentives to promote savings. By itself, however, the adoption of more health IT is generally not sufficient to produce significant cost savings. 


jbell on PROD1PC69 with REPORTS
37 

H.R. 6357 contains both intergovernmental and private-sector 

mandates as defined in the Unfunded Mandates Reform Act 

(UMRA) because it would require governmental and private-sector 

entities, as providers and insurers of health care, to comply with 

new federal standards regarding protected health information. 

CBO believes that the costs to the private sector to comply with the 

new requirements would probably exceed the threshold established 

in UMRA for private-sector mandates ($136 million in 2008, adjusted for inflation) in the first year or two following enactment. 

The cost to state, local and tribal governments to comply with the 

mandates in the bill, however, would not exceed the threshold established in UMRA for intergovernmental mandates ($68 million in 

2008, adjusted for inflation). 

Estimated cost to the Federal Government: The estimated cost of 

H.R. 6357 is shown in the following table. The costs of this legislation fall within budget function 550 (health). 

By fiscal year, millions of dollars— 

2008 2009 2010 2011 2012 2013 

SPENDING SUBJECT TO APPROPRIATION 

Spending Under Current Law: 

Budget Authority .............................................................................. 68 0 0 0 0 0 

Estimated Outlays ........................................................................... 59 46 8 1 0 0 

Proposed Changes: 

Estimated Authorization Level ......................................................... 0 193 195 196 187 189 

Estimated Outlays ........................................................................... 0 58 141 177 184 183 

Estimated Spending Under H.R. 6357: 

Estimated Authorization Level ......................................................... 68 193 195 196 187 189 

Estimated Outlays ........................................................................... 59 104 150 179 184 183 

Basis of estimate: H.R. 6357 would amend the Public Health 

Service Act to add title 30—which would specify the responsibilities 

of ONCHIT and related committees, as well as establish several 

grant and loan programs. The bill also would establish privacy and 

security provisions for certain health information. For this estimate, CBO assumes that H.R. 6357 will be enacted near the end 

of fiscal year 2008, that the necessary amounts will be appropriated each year, and that outlays will follow historical patterns 

for similar activities of the Department of Health and Human Services. CBO estimates that implementing H.R. 6357 would cost $58 

million in 2009 and $743 million over the 2009–2013 period. 

HEALTH INFORMATION TECHNOLOGY AND QUALITY

The National Coordinator of Health Information Technology 

serves as the senior advisor to the Secretary of HHS and the President on HIT programs and initiatives, and is responsible for: 

• Developing, maintaining, and updating a strategic plan to 

guide the nationwide implementation of electronic health records in 

both the public and private health care sectors; and 

• Coordinating HIT policy across federal agencies. 

H.R. 6357 would add title 30 to the Public Health Service Act to 

further specify the responsibilities of ONCHIT and create two committees to assume the current functions of the AHIC—the HIT Policy Committee and the HIT Standards Committee. 

This bill would require the National Coordinator to ensure that 

standards for the secure electronic exchange of information incorVerDate Aug 31 2005 07:12 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00037 Fmt 6659 Sfmt 6602 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
38 

porate adequate privacy and security protections. The bill would 

also require the National Coordinator to develop a program for the 

voluntary certification of products as meeting the standards developed for the secure electronic exchange of health information. In 

addition, the National Coordinator would be responsible for: 

• Reviewing and determining the endorsement of industry standards; 

• Implementing specifications and certifying criteria for the electronic exchange and use of health information; and 

• Evaluating and reporting progress toward implementation of 

electronic health records, barriers to access to technology, and the 

benefits and costs of HIT, including those in medically underserved 

communities. 

The HIT Policy Committee would serve as a federal advisory 

committee comprised of public and private stakeholders to provide 

input and assistance to the National Coordinator. The committee 

would be responsible for recommending a policy framework and 

prioritizing the technical standards necessary for the development 

of an HIT infrastructure. The HIT Standards Committee would 

also serve as a federal advisory committee of public and private 

stakeholders and be responsible for developing, recognizing, or harmonizing the technical standards necessary for secure electronic exchange of health information. 

This bill would require private entities contracting with the federal government to carry out health care activities to adopt the 

standards established in this bill for the electronic exchange of 

health care information. 

H.R. 6357 would authorize the appropriation of $66 million for 

fiscal year 2009 for those purposes. Because ONCHIT’s responsibilities would be ongoing, the estimate assumes that amount, with adjustments for inflation, would be appropriated in subsequent years. 

Assuming the appropriation of the necessary amounts, CBO estimates that spending for those activities resulting from this bill 

would total $20 million in 2009 and $265 million over the 2009– 

2013 period. 

INCENTIVES FOR THE USE OF HEALTH INFORMATION TECHNOLOGY

H.R. 6357 would also establish several grant and loan programs 

to promote the widespread adoption of qualified HIT, including programs for health care providers, states and Indian tribes, and local 

or regional organizations. The grant programs would require that 

recipients provide matching funds. Small health care providers, 

those in medically underserved or rural areas, and others who may 

have difficulty acquiring electronic health records without outside 

assistance would be given preference in awarding the grants. The 

bill also would create a demonstration program to integrate HIT in 

the clinical education of health professionals. 

H.R. 6357 would authorize appropriations for the grant programs 

of $115 million a year for fiscal years 2009 through 2013. It would 

authorize the appropriation of $10 million a year for fiscal years 

2009 through 2011 for the demonstration projects. Assuming appropriation of the authorized amounts, CBO estimates that implementing those programs would cost $38 million in 2009 and $470 

million over the 2009–2013 period. 


jbell on PROD1PC69 with REPORTS
39 

PRIVACY AND SECURITY PROVISIONS

H.R. 6357 would establish federal standards regarding the privacy and security of protected health information (PHI), and would 

require health care providers and insurers to comply with those 

standards. 

The bill also would require the Secretary of HHS to implement 

an education program to enhance public transparency regarding 

the uses of PHI, and would authorize the appropriation of $10 million during the 2009–2013 period for that purpose. Assuming the 

appropriation of the authorized amount, CBO estimates that implementing that provision would cost $8 million over the 2009–2013 

period. 

Intergovernmental and private-sector impact: H.R. 6357 contains 

both intergovernmental and private-sector mandates as defined in 

UMRA. In aggregate, CBO estimates that the cost to private-sector 

entities to comply with the mandates in the bill would probably exceed the UMRA threshold of $136 million per year (adjusted for inflation); the cost to state, local and tribal governments to comply 

with the mandates in the bill, however, would not exceed the 

UMRA threshold ($68 million per year, adjusted for inflation). Precise estimates are difficult, given the lack of available data. 

The bill would require providers and insurers of health care, both 

in the private sector and as operated by state, local, and tribal governments, to notify individuals whose health information has been, 

or is reasonably believed to have been, breached. Such a requirement would be an intergovernmental and private-sector mandate. 

CBO estimates, however, that few breaches of health information 

would occur that would require a notice as specified in the bill; 

thus, the cost of this provision would be small. 

The bill also would impose intergovernmental and private-sector 

mandates by requiring providers and insurers to comply with a patient’s request that they not disclose protected health information 

if the information pertains solely to a health care item or service 

that has been paid for completely out of pocket. Disclosures for purposes of carrying out treatment or as otherwise required by law 

would be exempt from this requirement. 

Providers and insurers that use electronic medical record systems also would be prohibited from using or disclosing an individual’s PHI for purposes of health care operations unless they obtain 

the consent of the individual. Such a requirement would constitute 

an intergovernmental and private-sector mandate as defined in 

UMRA. Due to the bill’s relatively broad definition of an ‘‘electronic 

medical record,’’ most health care entities, including pharmacies, 

physicians, ancillary service providers, and hospitals, would be considered to have electronic medical records. Thus, because of the 

large number of consents required by this provision, CBO believes 

that the cost would probably exceed the threshold for private-sector 

mandates established under UMRA in the first year or two following enactment. Because most health care providers are private 

entities, CBO does not believe that the cost to state, local and tribal governments would exceed the threshold. 

H.R. 6357 also would require private-sector entities and state, 

local, and tribal governments with electronic medical records to 

maintain a six-year log of disclosures of an individual’s PHI for 


jbell on PROD1PC69 with REPORTS
40 

treatment, payment, and health care operations. Covered entities 

would be required to provide a copy of the log to the individual 

upon request. CBO believes that the cost of this provision would be 

relatively small, however, because under the Health Insurance 

Portability and Accountability Act (HIPAA), providers already must 

provide logs of disclosures of PHI for purposes other than for treatment, payment, and health care operations, and therefore, already 

must have capabilities for maintaining such logs. Indeed, most electronic medical record systems used by providers have audit trail capabilities that can maintain logs of disclosures and transactions. In 

addition, requests for such logs would probably be infrequent. 

With some exceptions, HIPAA preempts state laws that impose 

standards less stringent than the federal standard. H.R. 6357 

would apply HIPAA’s criteria for preempting state laws. Therefore, 

state standards with respect to health information technology and 

the privacy of unsecured protected health information that are less 

stringent than the new federal standard would be preempted by 

the bill. That preemption would be an intergovernmental mandate 

as defined in UMRA. CBO estimates that the costs to state, local, 

and tribal government of this provision would be minimal. 

Other provisions in the bill would benefit state, local, and tribal 

governments that participate in grant and loan programs to facilitate the adoption of health information technology; any costs they 

incur to comply with grant or loan conditions would be incurred 

voluntarily. 

Estimate prepared by: Federal Costs: Stephanie Cameron and 

Kirstin Nelson; Impact on State, Local, and Tribal Governments: 

Lisa Ramirez-Branum; Impact on the Private Sector: Keisuke 

Nakagawa. 

Estimate approved by: Keith J. Fontenot, Deputy Assistant Director for Health and Human Resources, Budget Analysis Division. 

FEDERAL MANDATES STATEMENT

The Committee adopts as its own the estimate of Federal mandates regarding H.R. 6357 prepared by the Director of the Congressional Budget Office pursuant to section 423 of the Unfunded Mandates Reform Act. 

ADVISORY COMMITTEE STATEMENT

Regarding section 5(b) of the Federal Advisory Committee Act, 

H.R. 6357 provides for two advisory committees, an HIT Policy 

Committee and an HIT Standards Committee. See sections 3002 

and 3003 of the Public Health Service Act, respectively, as added 

by section 101 of the bill. The Committee finds that establishing 

these advisory committees is the most efficient way of carrying out 

the policies involved. 

CONSTITUTIONAL AUTHORITY STATEMENT

Pursuant to clause 3(d)(1) of rule XIII of the Rules of the House 

of Representatives, the Committee finds that the Constitutional authority for H.R. 6357 is provided in Article I, section 8, clause 3, 

which grants Congress the power to regulate commerce with foreign nations, among the several States, and with the Indian Tribes, 

and in the provisions of Article I, section 8, clause 1, that relate 


jbell on PROD1PC69 with REPORTS
41 

to expending funds to provide for the general welfare of the United 

States. 

APPLICABILITY TO LEGISLATIVE BRANCH

The Committee finds that H.R. 6357 does not relate to the terms 

and conditions of employment or access to public services or accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act of 1995. 


jbell on PROD1PC69 with REPORTS
42 


jbell on PROD1PC69 with REPORTSInsert offset folio 47 here HR837.001
43 


jbell on PROD1PC69 with REPORTSInsert offset folio 48 here HR837.002
44 


jbell on PROD1PC69 with REPORTSInsert offset folio 49 here HR837.003
45 


jbell on PROD1PC69 with REPORTSInsert offset folio 50 here HR837.004
46 


jbell on PROD1PC69 with REPORTSInsert offset folio 51 here HR837.005
47 


jbell on PROD1PC69 with REPORTSInsert offset folio 52 here HR837.006
48 


jbell on PROD1PC69 with REPORTSInsert offset folio 53 here HR837.007
49 

SECTION-BY-SECTION ANALYSIS OF THE LEGISLATION

Section 1. Short title; table of contents 

Section 1 establishes the short title of H.R. 6357 as the ‘‘Protecting Records, Optimizing Treatment, and Easing Communication through Healthcare Technology Act of 2008’’ or the 

‘‘PRO(TECH)T Act of 2008’’ and provides the table of contents of 

the bill. 

TITLE I—HEALTH INFORMATION TECHNOLOGY

Subtitle A—Promotion of Health Information Technology 

Part 1—Improving Health Care Quality, Safety, and Efficiency 

Section 101. ONCHIT; standards development and adoption; Health 

Information Technology Resource Center 

Section 101 adds a new title XXX to the Public Health Service 

Act: 

‘‘TITLE XXX—HEALTH INFORMATION TECHNOLOGY AND QUALITY’’ 

‘‘Section 3000. Definitions’’ 

Section 3000 defines key terms related to the promotion of health 

information technology. 

‘‘Subtitle A—Promotion of Health Information Technology’’ 

‘‘Section 3001. Office of the National Coordinator of Health Information Technology’’ 

The Office of the National Coordinator of Health Information 

Technology (ONCHIT), which was originally created administratively by Executive Order 13335, would by statute be established 

within the Department of Health and Human Services (HHS). The 

head of ONCHIT, the National Coordinator, will lead the efforts for 

the development of policies and recognition of standards to allow 

for the secure electronic exchange of health information. 

The National Coordinator is required to maintain and update the 

strategic plan on how to achieve these goals. The plan should include steps to encourage the nationwide utilization of an electronic 

health record for each person in the United States by 2014 and ensure the incorporation of adequate privacy and security protections 

into those electronic records. The National Coordinator is additionally charged with evaluating and reporting on progress toward 

these goals, on barriers to accessing technology, and on the benefits 

and costs of health information technology. The National Coordinator shall also report on the impact of HIT in medically underserved communities. 

The National Coordinator, in consultation with the Director of 

the National Institute of Standards and Technology, shall develop 

a program for the voluntary certification of products that meet the 

standards developed for the secure electronic exchange of health information. This provision is not intended to ratify or eliminate existing organizations and entities not mentioned, such as the Certification Commission for Healthcare Information Technology 

(CCHIT). Their future will depend on their ability to comply with 

the requirements of this section or their ability to coordinate with 

or create added value to the certification structure developed under 


jbell on PROD1PC69 with REPORTS
50 

section 3001. In addition, current work and certifications made by 

the CCHIT shall be transitioned into the certification program developed under section 3001(c)(9). The authorization of appropriations for these purposes is $66 

million for fiscal year 2009. 

‘‘Section 3002. HIT Policy Committee’’ 

Section 3002 establishes a Federal advisory committee of public 

and private stakeholders to provide input and assistance to the National Coordinator. The HIT Policy Committee will recommend a 

policy framework and prioritize the technical standards necessary 

for the electronic exchange and use of health information with the 

goal of each American having an electronic health record by 2014. 

In addition, the HIT Policy Committee shall make recommendations on standards to protect the privacy of and promote the security of health information. These standards should also allow for an 

accounting of all disclosures made of a person’s health information 

from an electronic medical record. In addition, the HIT Policy Committee can consider a number of other areas of standards and technologies. This includes the ability for the HIT Policy Committee to 

look at technologies that reduce medical errors, ensuring that technologies are not improperly causing medical errors. Their recommendations will then be forwarded to the HIT Standards Committee, a technical advisory committee. 

‘‘Section 3003. HIT Standards Committee’’ 

Section 3003 establishes a second Federal advisory committee of 

public and private stakeholders. The purpose of this committee is 

to develop, recognize, or harmonize the technical standards necessary for the secure electronic exchange of health information. The 

HIT Standards Committee shall develop a schedule for the assessment of policy recommendations by the HIT Policy Committee. 

The membership of both committees under sections 3002 and 

3003 is intended to include a broad and diverse cross-section of individuals with expertise and background in the issues to be reviewed. In particular, the provider positions and other appointments should be used to ensure a broad array of representatives 

as necessary. Additionally, the committees shall ensure that those 

with expertise in areas of consideration are included in the process 

for determining standards. For example, research representatives 

appointed to both committees should therefore have extensive understanding and experience with medical and clinical research, the 

use and reporting of aggregated research data, and such related 

issues as drug safety, biosurveillance, and public health reporting. 

‘‘Section 3004. Process for adoption of endorsed recommendations’’ 

‘‘Section 3005. Application and use of adopted standards and implementation specifications by Federal agencies’’ 

‘‘Section 3006. Voluntary application and use of adopted standards 

and implementation specifications by private entities’’ 

These sections direct the Secretary, in consultation with other 

relevant agencies, to review standards recommended by the HIT 

Standards Committee and, where appropriate, provide for adoption 

by the Federal Government through a rulemaking process. Section 


jbell on PROD1PC69 with REPORTS
51 

3004 is intended to require that all standards for adoption go 

through the Federal rulemaking process. Sections 3005 and 3006, 

which refer to sections 111 and 112, respectively, are intended to 

track the implementation of Executive Order 13410, signed August 

22, 2006, and entitled ‘‘Promoting Quality and Efficient Health 

Care in Federal Government Administered or Sponsored Health 

Care Programs.’’ These standards would not be binding on private 

entities, but may be voluntarily adopted. 

‘‘Section 3007. Health Information Technology Resource Center’’ 

Section 3007 directs the National Coordinator to establish an 

HIT Resource Center to provide technical assistance, develop best 

practices, and serve as a forum for the exchange of knowledge and 

experience with regard to the adoption of HIT. 

Section 102. Transitions 

Section 102 of the bill provides for transitions to allow for the 

current development and harmonization of standards to continue 

once ONCHIT is established by statute and the functions of the 

current American Health Information Collaborative are subsumed 

by the HIT Policy and Standards Committees. 

This section is not intended to ratify or eliminate existing organizations and entities not mentioned, such as the Health Information 

Technology Standard Panel and National Committee of Vital and 

Health Statistics. Their future will depend on their role, their usefulness, and ability to coordinate with or create added value to the 

structure developed under the bill. 

Part 2—Application and Use of Adopted Health Information Technology Standards; Reports 

Section 111. Coordination of Federal activities with adopted standards and implementation specifications 

Section 111 requires that Federal agencies implementing, acquiring, or upgrading HIT systems for the electronic exchange of identifiable health information use HIT products meeting standards 

adopted by the Federal Government in accordance with the bill, 

where available. It also requires that the President ensure that 

Federal activities involving the collection and submission of health 

information be consistent with standards established under the bill 

for the electronic exchange of health information. 

Section 112. Application to private entities 

Section 112 requires that all Federal contracts with health care 

providers, health plans, or health insurance issuers include a requirement to meet standards adopted by the Federal Government 

in accordance with the bill, where available. These standards 

would apply as the entity implements, acquires, or upgrades HIT 

systems for the electronic exchange of identifiable health information. 

Sections 111 and 112 are intended to track how the August 22, 

2006, Executive Order has been applied by the Federal Government. To satisfy the requirements in sections 111 and 112, the 

Government will have flexibility to ensure that products meeting 

standards adopted by the Government are certified in a timely 


jbell on PROD1PC69 with REPORTS
52 

manner. In addition, the Committee does not intend section 112 to 

apply to Medicare Part A and B providers. 

Section 113. Reports 

Section 113 requires the Secretary to submit an annual report to 

Congress on the efforts toward, and barriers to, facilitating the 

electronic exchange of health information nationwide. It also requires the Secretary to study methods for creating efficient reimbursement incentives to improve health care quality in Federallyqualified health centers, rural health clinics, and free clinics. This 

reimbursement study should consider the expected benefits and efficiencies that health information technology and electronic medical 

records provide. Finally, it requires the study of aging services 

technology to help seniors and individuals with disabilities. 

Subtitle B—Incentives for the Use of Health Information Technology 

Sec. 121. Grant, loan, and demonstration programs 

Section 121 of the bill adds a subtitle B to the title XXX of the 

Public Health Service Act that was added by section 101 of the bill: 

‘‘Subtitle B—Incentives for the Use of Health Information Technology’’ 

‘‘Section 3011. Grants and loans to facilitate the widespread adoption of qualified health information technology’’ 

Section 3011 provides incentives for the widespread adoption and 

use of electronic health records through the creation of three separate competitive grant programs. 

The first grant program offers matching funds to eligible health 

care providers for the purchase of qualified health information 

technology. 

The second competitive grant program offers funds to States and 

Indian Tribes to develop loan programs that will leverage privatesector funds. The program will also provide low-interest loans to 

health care providers to purchase health information technology as 

described above. 

The third grant program provides support for local or regional organizations to develop HIT plans. These plans must provide for the 

exchange of health information among physicians, pharmacies, hospitals, health centers, health plans, and others within a given region. 

Preference in awarding these grants will be given to small health 

care providers, to providers in rural and other areas that service 

uninsured, underinsured, medically underserved individuals, and 

to nonprofit health care providers. The authorization of appropriations for these grants is $115 mil- lion for each of the fiscal years 2009 through 2013, a total of $675 

million over five years. 

‘‘Section 3012. Demonstration program to integrate information 

technology into clinical education’’ 

Section 3012 creates a demonstration program to integrate HIT 

into the clinical education of health care professionals. The authorization of appropriations is $10 million for each of the fiscal years 


jbell on PROD1PC69 with REPORTS
53 

2009 through 2011. Competitive funding will be offered to current 

and future health care educational institutions to provide for training on the use of HIT that promotes quality of care. The Secretary 

shall consider any health professions school, including those not 

specifically listed, such as optometry and chiropractic schools. 

TITLE II—TESTING OF HEALTH INFORMATION TECHNOLOGY

Section 201. National Institute for Standards and Technology testing 

Section 201 of the bill requires that the National Institute for 

Standards and Technology (NIST) work in coordination with the 

HIT Standards Committee to test technical standards. These are 

standards being developed or recognized for the electronic exchange 

of health information by the HIT Standards Committee. It additionally requires the director of NIST, in coordination with the HIT 

Standards Committee, to support the establishment of accredited 

testing laboratories for the voluntary testing of products for certification by the National Coordinator that they meet standards for 

the electronic exchange of information. 

Section 202. Research and development programs 

Section 202 requires that the Director of NIST, in consultation 

with the Director of the National Science Foundation and other appropriate Federal agencies, award competitive grants to institutes 

of higher education for research of innovative approaches for the 

use of HIT in the delivery of health care. Additionally, it directs the 

National High-Performance Computing Program, created by the 

High Performance Computing Act of 1991, to coordinate Federal research and programs related to the development and deployment of 

HIT. 

TITLE III—PRIVACY AND SECURITY PROVISIONS

Section 300. Definitions 

Section 300 defines key terms related to the privacy and security 

provisions of the bill. 

Subtitle A—Security Provisions 

Section 301. Application of security provisions and penalties to business associates of covered entities; annual guidance on security 

provisions 

Section 301 requires that security safeguards, promulgated pursuant to the Health Insurance Portability and Accountability Act 

of 1996 (HIPAA), and the penalties for violation of those safeguards, be applied to business associates under HIPAA in the same 

manner as applied to covered entities. This section also requires 

that the Secretary, in consultation with stakeholders, annually 

issue guidance on the latest safeguard technologies for protecting 

information. (Pursuant to section 300, (1) covered entities are defined as providers, such as physicians, health plans and health care 

clearinghouses, such as claims processors; and (2) business associates are defined as entities that assist covered entities with particular routine business functions.) 


jbell on PROD1PC69 with REPORTS
54 

Section 302. Notification in the case of breach 

Section 302 requires that, in the case of a breach of unsecured 

protected health information (PHI), a covered entity must notify 

each individual whose information has been, or is reasonably believed to have been, breached. PHI is individually identifiable 

health information maintained or transmitted by the covered entity. In the case of a breach of unsecured PHI that is under the control of a business associate, that business associate is required to 

notify the covered entity. All breach notifications must be made 

without unreasonable delay and no later than 60 calendar days 

after discovery. This section provides instruction for the required 

methods by which an individual must be notified and the content 

of the notification. Finally, the section provides that this notification may be delayed if it could impede a criminal investigation or 

damage national security. 

The Secretary, after consultation with stakeholders, will issue 

guidance within 60 days of enactment that will define unsecured 

PHI, specifying technologies and methodologies that render PHI 

unusable, unreadable, or indecipherable to unauthorized individuals. If the Secretary fails to issue this guidance within 60 days, 

unsecured PHI shall mean information that is not protected by 

technology standards developed or endorsed by a standards developing organization that is accredited by the American National 

Standards Institute (ANSI). 

Breach, as defined, does not include unintentional acquisition, 

access, or disclosure, such as inadvertently looking at a person’s 

medical record, mailing an explanation of benefits to an address on 

file that is outdated, or having the post office deliver it to the 

wrong address. 

Section 303. Education on health information privacy and report on 

compliance 

Section 303 requires that the Secretary, not later than 6 months 

after enactment, designate an individual in each regional HHS office to offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related 

to Federal privacy and security requirements for PHI. It requires 

that the Secretary annually report to Congress on complaints of alleged violations. Finally, the provision requires that HHS develop 

and maintain a multi-faceted national education initiative to enhance public transparency regarding the potential uses of their 

PHI, the effects of such uses, and the rights of individuals with respect to such uses. 

Subtitle B—Improved Privacy Provisions and Additional Security 

Provisions 

Section 311. Application of penalties to business associates of covered entities for violations of privacy contract requirements 

Section 311 requires that the penalties for violating the business 

associate contract standard in the HIPAA Privacy Rule apply to 

business associates under HIPAA in the same manner as applied 

to covered entities. 


jbell on PROD1PC69 with REPORTS
55 

Section 312. Restrictions on certain disclosures and sales of health 

information; accounting of certain protected health information 

disclosures; access to certain information in electronic format 

(a) Requested restrictions on certain disclosures of health information.— 

If a patient has paid in full out-of-pocket for an item or service, 

subsection (a) permits a patient to request that his PHI not be disclosed by a covered entity to a health plan for purposes of payment 

or health care operations, unless otherwise required by law. In 

such a circumstance, the covered entity is required to honor the patient’s request. The Committee intends that this provision override 

all conflicting contractual requirements. 

(b) Disclosures required to be limited to the limited data set or the 

minimum necessary.— 

Subsection (b) requires covered entities, to the extent practicable, 

when sharing PHI with other entities, make a reasonable effort to 

restrict the use, disclosure, or request of PHI to a limited data set 

of information as defined in regulation. If the limited data set is 

insufficient, the covered entity must restrict the use, disclosure, or 

request of PHI to the minimum necessary to achieve the purpose. 

(c) Accounting of certain protected health information disclosures required if covered entity uses electronic medical record.— 

Subsection (c) gives an individual the right to request an accounting of disclosures of PHI made by a covered entity to another 

party for treatment, payment, and health care operations in the 

three years prior to the request if that entity is utilizing an electronic medical record. Covered entities would not be required to 

make an accounting for uses of PHI or oral disclosures of such information. The provision takes effect either when an entity acquires or upgrades its electronic medical record, or six months after 

a technical standard is developed pursuant to section 

3002(b)(2)(B)(iv) of the Public Health Service Act (as added by title 

I of the bill) that relates to a standard for accounting for disclosures and is adopted by the Federal Government, whichever is 

sooner. This provision provides the entity flexibility in determining 

when it will integrate such technology into its electronic medical 

record systems if it already utilizes one. Alternatively, the provision ensures future electronic health records are built with the capability to account for disclosures. 

(d) Application of consent requirements for certain uses and disclosures by health care providers with electronic medical 

records.— 

Subsection (d) requires that a health care provider who creates 

or maintains an electronic medical record for the patients of the 

provider receive a patient’s consent to use or disclose the patient’s 

PHI for health care operations. If the patient gives consent, the requirements under subsection (b) regarding limiting PHI to the limited data set where practicable still apply. In addition, the provision clarifies (1) that the consent may be a one-time aggregated 

consent; (2) that revocation of consent can only be for data collected 

prospectively, not retrospectively; (3) that whether or not a proVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00055 Fmt 6659 Sfmt 6602 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
56 

vider receives consent, the provider can maintain the patient’s information in an electronic medical record; and (4) that the consent 

shall not constitute a waiver of any evidentiary privilege. In addition, consistent with the current regulations, the Committee intends that a provider be allowed to refuse treatment if a patient 

does not provide consent to share the patient’s PHI for health care 

operations. Also, the Committee intends that the consent provision 

does not override other permitted uses and disclosures enumerated 

under HIPAA, such as those in section 164.512 or section 164.514, 

and only applies to uses and disclosures as defined in health care 

operations. 

The consent provision takes effect 24 months after enactment. 

The Secretary is required to promulgate regulations implementing 

the provision in a manner that ensures the integrity of PHI in a 

reasonable and workable manner. The Secretary may exempt certain health care operations from the consent provision and is required to develop and make publically available a model consent 

form. The Committee strongly encourages the Secretary to consider 

whether requiring patient consent for certain health care operations would impede the ability of medical schools and providers to 

provide access to health care and train and evaluate health professionals; reduce health care quality or safety; impede treatment of 

payment activities of the provider; or impact any of the permitted 

uses and disclosures under the HIPAA Privacy Rule other than 

health care operations (e.g., the exception for information to flow 

to a public health authority or for research purposes). 

(e) Prohibition on sale of electronic medical records or protected 

health information obtained from electronic medical records.— 

Subsection (e) further enhances privacy protections by prohibiting the sale of electronic medical records or PHI obtained from 

electronic medical records. Covered entities and business associates 

are prohibited from selling a person’s electronic medical record or 

PHI without authorization from the person unless it is necessary 

for treatment or to receive payment for the treatment of the person. 

(f) Access to certain information in electronic format.— 

Subsection (f) gives a patient the right to receive the patient’s 

medical information in an electronic format without charge if a provider maintains the patient’s medical record in an electronic format. 

Section 313. Conditions on certain contacts as part of health care 

operations 

Section 313 clarifies the definition of marketing under HIPAA to 

include receiving direct or indirect payment to make the communication, and it precludes covered entities from marketing to patients unless the patient authorizes the communication pursuant to 

the HIPAA Privacy Rule authorization requirements. 

Section 314. Study on application of privacy and security requirements to non-HIPAA covered entities 

Section 314 requires the Secretary, in consultation with the Federal Trade Commission (FTC), to submit recommendations to ConVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00056 Fmt 6659 Sfmt 6602 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
57 

gress to identify requirements relating to security, privacy, and notification in the case of a breach that should be applied to vendors 

of personal health records. The recommendations would include 

which Federal agency is best equipped to enforce such requirements. 

Section 315. Temporary breach notification requirement for vendors 

of personal health records and other non-HIPAA covered entities 

Section 315 requires that each vendor of personal health records, 

following the discovery of a breach of an individual’s unsecured 

personal health record (PHR) identifiable health information, notify 

the individual and the FTC. The provision requires that any third 

party service provider that provides services to a vendor of PHRs 

or others, notify such vendor or entity of such breach. The provision requires that the notification requirements applicable to covered entities under section 302 of the bill be applied to notifications 

required under this section and that FTC notify HHS of breach notices received by FTC. The provision gives the FTC enforcement 

authority regarding breaches of health information under this section. The provision sunsets two years after enactment of the bill. 

The term ‘‘unsecured PHR identifiable health information’’ is information that is not protected through the use of a technology or 

methodology specified by the Secretary in the guidance issued 

under section 302(h)(2). If the Secretary fails to issue this guidance 

within 60 days, unsecured PHR identifiable health information 

shall mean information that is not protected by technology standards developed or endorsed by a standards developing organization 

that is accredited by the American National Standards Institute. 

Section 316. Business associate contracts required for certain entities 

Section 316 requires organizations such as Health Information 

Exchanges, Regional Health Information Organizations, or E-prescribing Gateways to have business associate contracts. 

Section 317. Guidance on implementation specification to de-identify protected health information 

Section 317 requires the Secretary, in consultation with stakeholders, to issue guidance on how to best implement regulatory requirements for the de-identification of PHI. 

Section 318. GAO report on treatment disclosures 

Section 318 directs the Government Accountability Office to submit a report to Congress on best practices related to the disclosure 

of PHI among health care providers for the purposes of treatment. 

Section 319. Clarification of application of wrongful disclosures 

criminal penalties 

Section 319 clarifies that criminal penalties for violations of 

HIPAA can be applied directly to individuals. Currently, the Department of Justice has interpreted the law as not permitting 

criminal enforcement against an individual working within an entity, only against the entity itself. This section permits the DepartVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00057 Fmt 6659 Sfmt 6602 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
58 

ment of Justice to prosecute the bad actor whether acting on his 

or her own or while working within an entity. 

Section 320. Improved enforcement 

Section 320 amends section 1176 of the Social Security Act to require a formal investigation of complaints and the imposition of 

civil monetary penalties for violations that rise to the level of willful neglect. This provision still preserves current tools for informal 

resolution, technical assistance, and correction within 30 days 

without the imposition of a penalty in situations where the violation was due to a reasonable cause. 

In addition, the amendments to section 1176 permit the Department of Health and Human Services to pursue an investigation 

and impose civil monetary penalties against a person under section 

1176 as long as a criminal penalty has not been imposed under section 1177 for that same act of the person. The amendments do not 

affect section 1176(b)(2), relating to acts that are not knowing violations. 

Subtitle C—Relationship to Other Laws; Regulatory References; Effective Date 

Section 321. Relationship to other laws 

Section 321 applies the preemption in section 1178 of the Social 

Security Act to the provisions of title III of the bill and preserves 

the HIPAA and the regulations promulgated pursuant to that Act 

to the extent that they are consistent with title III of the bill. 

Section 322. Regulatory references 

Section 322 clarifies that each reference in this title to a provision of the Code of Federal Regulations refers to such provision as 

in effect on the date of the enactment of this Act (or to the most 

recent update of such provision). 

Section 323. Effective date 

With the exception of certain specified provisions, section 323 

provides that the bill shall become effective 12 months after the 

date of enactment. 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

In compliance with clause 3(e) of rule XIII of the Rules of the 

House of Representatives, changes in existing law made by the bill, 

as reported, are shown as follows (existing law proposed to be omitted is enclosed in black brackets, new matter is printed in italic, 

existing law in which no change is proposed is shown in roman): 

PUBLIC HEALTH SERVICE ACT 

* * * * * * * 


jbell on PROD1PC69 with REPORTS
59 

TITLE XXX—HEALTH INFORMATION 

TECHNOLOGY AND QUALITY 

SEC. 3000. DEFINITIONS. 

In this title: 

(1) ENTERPRISE INTEGRATION.—The term ‘‘enterprise integration’’ means the electronic linkage of health care providers, 

health plans, the government, and other interested parties, to 

enable the electronic exchange and use of health information 

among all the components in the health care infrastructure in 

accordance with applicable law, and such term includes related 

application protocols and other related standards. 

(2) HEALTH CARE PROVIDER.—The term ‘‘health care provider’’ 

means a hospital, skilled nursing facility, nursing facility, 

home health entity, health care clinic, Federally qualified 

health center, group practice (as defined in section 1877(h)(4) of 

the Social Security Act), a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1861(r) of the Social Security Act), a practitioner (as described in section 1842(b)(18)(C) 

of the Social Security Act), a provider operated by, or under 

contract with, the Indian Health Service or by an Indian tribe 

(as defined in the Indian Self-Determination and Education Assistance Act), tribal organization, or urban Indian organization 

(as defined in section 4 of the Indian Health Care Improvement 

Act), a rural health clinic, and any other category of facility or 

clinician determined appropriate by the Secretary. 

(3) HEALTH INFORMATION.—The term ‘‘health information’’ 

has the meaning given such term in section 1171(4) of the Social Security Act. 

(4) HEALTH INFORMATION TECHNOLOGY.—The term ‘‘health 

information technology’’ means hardware, software, integrated 

technologies and related licenses, intellectual property, upgrades, and packaged solutions sold as services that are specifically designed for use by health care entities for the electronic 

creation, maintenance, or exchange of health information. 

(5) HEALTH PLAN.—The term ‘‘health plan’’ has the meaning 

given such term in section 1171(5) of the Social Security Act. 

(6) HIT POLICY COMMITTEE.—The term ‘‘HIT Policy Committee’’ means such Committee established under section 

3002(a). 

(7) HIT STANDARDS COMMITTEE.—The term ‘‘HIT Standards 

Committee’’ means such Committee established under section 

3003(a). 

(8) INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION.—The 

term ‘‘individually identifiable health information’’ has the 

meaning given such term in section 1171(6) of the Social Security Act. 

(9) LABORATORY.—The term ‘‘laboratory’’ has the meaning 

given such term in section 353(a). 

(10) NATIONAL COORDINATOR.—The term ‘‘National Coordinator’’ means the head of the Office of the National Coordinator 

for Health Information Technology established under section 

3001(a). 


jbell on PROD1PC69 with REPORTS
60 

(11) PHARMACIST.—The term ‘‘pharmacist’’ has the meaning 

given such term in section 804(2) of the Federal Food, Drug, 

and Cosmetic Act. 

(12) STATE.—The term ‘‘State’’ means each of the several 

States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. 

Subtitle A—Promotion of Health 

Information Technology 

SEC. 3001. OFFICE OF THE NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY. 

(a) ESTABLISHMENT.—There is established within the Department 

of Health and Human Services an Office of the National Coordinator for Health Information Technology (referred to in this section 

as the ‘‘Office’’). The Office shall be headed by a National Coordinator who shall be appointed by the Secretary and shall report directly to the Secretary. 

(b) PURPOSE.—The National Coordinator shall perform the duties 

under subsection (c) in a manner consistent with the development 

of a nationwide health information technology infrastructure that 

allows for the electronic use and exchange of information and that— 

(1) ensures that each patient’s health information is secure 

and protected, in accordance with applicable law; 

(2) improves health care quality, reduces medical errors, and 

advances the delivery of patient-centered medical care; 

(3) reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete 

information; 

(4) ensures that appropriate information to help guide medical decisions is available at the time and place of care; 

(5) ensures the inclusion of meaningful public input in such 

development of such infrastructure; 

(6) improves the coordination of care and information among 

hospitals, laboratories, physician offices, and other entities 

through an effective infrastructure for the secure and authorized exchange of health care information; 

(7) improves public health reporting and facilitates the early 

identification and rapid response to public health threats and 

emergencies, including bioterror events and infectious disease 

outbreaks; 

(8) facilitates health and clinical research and health care 

quality; 

(9) promotes prevention of chronic diseases; 

(10) promotes a more effective marketplace, greater competition, greater systems analysis, increased consumer choice, and 

improved outcomes in health care services; and 

(11) improves efforts to reduce health disparities. 

(c) DUTIES OF THE NATIONAL COORDINATOR.— (1) STANDARDS.—The National Coordinator shall review and 

determine whether to endorse each standard, implementation 

specification, and certification criterion for the electronic exchange and use of health information that is recommended by 


jbell on PROD1PC69 with REPORTS
61 

the HIT Standards Committee under section 3003 for purposes 

of adoption under section 3004(b). The Coordinator shall make 

such determination, and report to the Secretary such determination, not later than 90 days after the date the recommendation 

is received by the Coordinator. 

(2) HIT POLICY COORDINATION.—The National Coordinator 

shall coordinate health information technology policy and programs of the Department with those of other relevant executive 

branch agencies with a goal of avoiding duplication of efforts 

and of helping to ensure that each agency undertakes health information technology activities primarily within the areas of its 

greatest expertise and technical capability. 

(3) STRATEGIC PLAN.— 

(A) IN GENERAL.—The National Coordinator shall, in 

consultation with other appropriate Federal agencies (including the National Institute of Standards and Technology), maintain and update a strategic plan with specific 

objectives, milestones, and metrics for the following: 

(i) The electronic exchange and use of health information and the enterprise integration of such information. 

(ii) The utilization of an electronic health record for 

each person in the United States by 2014. 

(iii) The incorporation of privacy and security protections for the electronic exchange of an individual’s individually identifiable health information. 

(iv) Ensuring security methods to ensure appropriate 

authorization and electronic authentication of health 

information and specifying technologies or methodologies for rendering health information unusable, 

unreadable, or indecipherable. 

(v) Specifying a framework for coordination and flow 

of recommendations and policies under this subtitle 

among the Secretary, the National Coordinator, the 

HIT Policy Committee, the HIT Standards Committee, 

and other health information exchanges and other relevant entities. 

(vi) Methods to foster the public understanding of 

health information technology. 

(vii) Strategies to enhance the use of health information technology in improving the quality of health care, 

reducing medical errors, reducing health disparities, 

and in improving the continuity of care among health 

care settings. 

(B) COLLABORATION.—The strategic plan shall be developed and updated through collaboration of public and private interests. 

(C) MEASURABLE OUTCOME GOALS.—The strategic plan 

shall include measurable outcome goals. 

(D) PUBLICATION.—The National Coordinator shall publish the strategic plan, including all updates. 

(4) WEBSITE.—The National Coordinator shall maintain and 

frequently update an Internet website on which there is posted 

information that includes the following: 


jbell on PROD1PC69 with REPORTS
62 

(A) The schedule developed by the HIT Standards Committee under section 3003(b)(3). 

(B) The recommendations of the HIT Policy Committee 

under section 3002. 

(C) Recommendations of the HIT Standards Committee 

under section 3003. 

(D) Sources of Federal grant funds and technical assistance that are available to facilitate the purchase of, or enhance the utilization of, health information technology systems. 

(E) The report prepared by the National Coordinator 

under paragraph (5). 

(F) The assessment by the National Coordinator under 

paragraph (6). 

(G) The evaluation by the National Coordinator under 

paragraph (7). 

(H) The annual estimate of resources required under 

paragraph (8). 

(5) IMPLEMENTATION REPORT.—The National Coordinator 

shall prepare a report that identifies lessons learned from major 

public and private health care systems in their implementation 

of health information technology systems, including information 

on whether the systems and practices developed by such systems 

may be applicable to and usable in whole or in part by other 

health care providers. 

(6) ASSESSMENT OF IMPACT OF HIT ON COMMUNITIES WITH

HEALTH DISPARITIES AND UNINSURED, UNDERINSURED, AND

MEDICALLY UNDERSERVED AREAS.—The National Coordinator 

shall assess and publish the impact of health information technology in communities with health disparities and in areas that 

serve uninsured, underinsured, and medically underserved individuals (including urban and rural areas) and identify practices to increase the adoption of such technology by health care 

providers in such communities. 

(7) EVALUATION OF BENEFITS AND COSTS OF THE ELECTRONIC

USE AND EXCHANGE OF HEALTH INFORMATION.—The National 

Coordinator shall evaluate and publish evidence on the benefits 

and costs of the electronic use and exchange of health information and assess to whom these benefits and costs accrue. 

(8) RESOURCE REQUIREMENTS.—The National Coordinator 

shall estimate and publish resources required annually to reach 

the goal of utilization of an electronic health record for each 

person in the United States by 2014, including the required 

level of Federal funding, expectations for regional, State, and 

private investment, and the expected contributions by volunteers 

to activities for the utilization of such records. 

(9) CERTIFICATION.— 

(A) IN GENERAL.—The National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall develop a program (either directly or by contract) for the voluntary certification of 

health information technology as being in compliance with 

applicable certification criteria adopted under this subtitle. 

Such program shall include testing of the technology in acVerDate Aug 31 2005 04:59 Sep 13, 2008 Jkt 069006 PO 00000 Frm 00062 Fmt 6659 Sfmt 6603 E:\HR\OC\HR837P1.XXX HR837P1

jbell on PROD1PC69 with REPORTS
63 

cordance with section 201(b) of the PRO(TECH)T Act of 

2008. 

(B) CERTIFICATION CRITERIA DESCRIBED.—In this title, 

the term ‘‘certification criteria’’ means, with respect to 

standards and implementation specifications for health information technology, criteria to establish that the technology meets such standards and implementation specifications. 

(d) DETAIL OF FEDERAL EMPLOYEES.— (1) IN GENERAL.—Upon the request of the National Coordinator, the head of any Federal agency is authorized to detail, 

with or without reimbursement from the Office, any of the personnel of such agency to the Office to assist it in carrying out 

its duties under this section. 

(2) EFFECT OF DETAIL.—Any detail of personnel under paragraph (1) shall— 

(A) not interrupt or otherwise affect the civil service status or privileges of the Federal employee; and 

(B) be in addition to any other staff of the Department 

employed by the National Coordinator. 

(3) ACCEPTANCE OF DETAILEES.—Notwithstanding any other 

provision of law, the Office may accept detailed personnel from 

other Federal agencies without regard to whether the agency described under paragraph (1) is reimbursed. 

(e) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to 

be appropriated to carry out this section $66,000,000 for fiscal year 

2009. 

SEC. 3002. HIT POLICY COMMITTEE. 

(a) ESTABLISHMENT.—There is established a HIT Policy Committee to make policy recommendations to the National Coordinator 

relating to the implementation of a nationwide health information 

technology infrastructure, including implementation of the strategic 

plan described in section 3001(c)(3). 

(b) DUTIES.— (1) RECOMMENDATIONS ON HEALTH INFORMATION TECH- NOLOGY INFRASTRUCTURE.—Not later than 1 year after the date 

of the enactment of this title, the HIT Policy Committee shall 

recommend a policy framework for the development and adoption of a nationwide health information technology infrastructure that permits the electronic exchange and use of health information as is consistent with the strategic plan under section 

3001(c)(3) and that includes the recommendations under paragraph (2). Annually thereafter the Committee shall update such 

recommendations and make new recommendations as appropriate. 

(2) SPECIFIC AREAS OF STANDARD DEVELOPMENT.— 

(A) IN GENERAL.—The HIT Policy Committee shall recommend the areas in which standards, implementation 

specifications, and certification criteria are needed for the 

electronic exchange and use of health information for purposes of adoption under section 3004(b) and shall recommend an order of priority for the development, harmonization, and recognition of such standards, specifications, 

and criteria among the areas so recommended. Such standards and implementation specifications shall include 


jbell on PROD1PC69 with REPORTS
64 

named standards, architectures, and software schemes for 

the authentication and security of individually identifiable 

health information and other information as needed to ensure the reproducible development of common solutions 

across disparate entities. 

(B) AREAS REQUIRED FOR CONSIDERATION.—For purposes 

of subparagraph (A), the HIT Policy Committee shall make 

recommendations for at least the following areas: 

(i) Technologies that protect the privacy of health information and promote security, including for the segmentation and protection from disclosure of specific 

and sensitive individually identifiable health information, in accordance with applicable law, and for the 

use and disclosure of limited data sets (as defined for 

purposes of regulations promulgated under section 

264(c) of the Health Insurance Portability and Accountability Act of 1996) of such information. 

(ii) A nationwide health information technology infrastructure that allows for the electronic use and exchange of health information. 

(iii) The utilization of an electronic health record for 

each person in the United States by 2014. 

(iv) Technologies that allow for an accounting of disclosures made by a covered entity (as defined for purposes of regulations promulgated under section 264(c) 

of the Health Insurance Portability and Accountability 

Act of 1996) for purposes of treatment, payment, and 

health care operations (as such terms are defined for 

purposes of such regulations). 

(C) OTHER AREAS FOR CONSIDERATION.—In making recommendations under subparagraph (A), the HIT Policy 

Committee may consider the following additional areas: 

(i) The appropriate uses of a nationwide health information infrastructure, including for purposes of— 

(I) the collection of quality data and public reporting; 

(II) biosurveillance and public health; 

(III) medical and clinical research; and 

(IV) drug safety. 

(ii) Self-service technologies that facilitate the use 

and exchange of patient information and reduce wait 

times. 

(iii) Telemedicine technologies, in order to reduce 

travel requirements for patients in remote areas. 

(iv) Technologies that facilitate home health care and 

the monitoring of patients recuperating at home. 

(v) Technologies that help reduce medical errors. 

(vi) Technologies that facilitate the continuity of care 

among health settings. 

(vii) Technologies that meet the needs of diverse populations. 

(viii) Any other technology that the HIT Policy Committee finds to be among the technologies with the 

greatest potential to improve the quality and efficiency 

of health care. 


jbell on PROD1PC69 with REPORTS
65 

(3) FORUM.—The HIT Policy Committee shall serve as a 

forum for broad stakeholder input with specific expertise in 

policies relating to the matters described in paragraphs (1) and 

(2). 

(4) WEBSITE.—The HIT Policy Committee shall develop and 

maintain an Internet website on which there is posted information that includes the following: 

(A) Established governance rules. 

(B) A business plan. 

(C) Meeting notices at least 14 days prior to each meeting. 

(D) Meeting agendas at least 7 days prior to each meeting. 

(E) Meeting materials at least 3 days prior to each meeting. 

(c) MEMBERSHIP.— 

(1) APPOINTMENTS.—The HIT Policy Committee shall be composed of members to be appointed as follows: 

(A) 3 members shall be appointed by the Secretary, 1 of 

whom shall be appointed to represent the Department of 

Health and Human Services and 1 of whom shall be a public health official. 

(B) 1 member shall be appointed by the majority leader 

of the Senate. 

(C) 1 member shall be appointed by the minority leader 

of the Senate. 

(D) 1 member shall be appointed by the Speaker of the 

House of Representatives. 

(E) 1 member shall be appointed by the minority leader 

of the House of Representatives. 

(F) Such other members as shall be appointed by the 

President as representatives of other relevant Federal agencies. 

(G) 11 members shall be appointed by the Comptroller 

General of the United States of whom— 

(i) 1 member shall be an advocate for patients or 

consumers; 

(ii) 2 members shall represent health care providers, 

one of which shall be a physician; 

(iii) 1 member shall be from a labor organization 

representing health care workers; 

(iv) 1 member shall have expertise in privacy and security; 

(v) 1 member shall have expertise in improving the 

health of vulnerable populations; 

(vi) 1 member shall be from the health research community; 

(vii) 1 member shall represent health plans or other 

third-party payers; 

(viii) 1 member shall represent information technology vendors; 

(ix) 1 member shall represent purchasers or employers; and 

(x) 1 member shall have expertise in health care 

quality measurement and reporting. 


jbell on PROD1PC69 with REPORTS
66 

(2) NATIONAL COORDINATOR.—The National Coordinator 

shall be a member of the HIT Policy Committee and act as a 

liaison among the HIT Policy Committee, the HIT Standards 

Committee, and the Federal Government. 

(3) CHAIRPERSON AND VICE CHAIRPERSON.—The HIT Policy 

Committee shall designate 1 member to serve as the chairperson 

and 1 member to serve as the vice chairperson of the HIT Policy 

Committee. 

(4) PARTICIPATION.—The members of the HIT Policy Committee appointed under paragraph (1) shall represent a balance 

among various sectors of the health care system so that no single sector unduly influences the recommendations of such Committee. 

(5) TERMS.— (A) IN GENERAL.—The terms of members of the HIT Policy Committee appointed under paragraph (1) shall be 3 

years except that the Comptroller General of the United 

States shall designate staggered terms for the members first 

appointed under paragraph (1)(G). 

(B) VACANCIES.—Any member appointed to fill a vacancy 

in the membership of the HIT Policy Committee that occurs 

prior to the expiration of the term for which the member’s 

predecessor was appointed shall be appointed only for the 

remainder of that term. A member may serve after the expiration of that member’s term until a successor has been appointed. A vacancy in the HIT Policy Committee shall be 

filled in the manner in which the original appointment was 

made. 

(6) OUTSIDE INVOLVEMENT.—The HIT Policy Committee shall 

ensure an adequate opportunity for the participation in activities of the Committee of outside advisors, including individuals 

with expertise in the development of policies for the electronic 

exchange and use of health information, including in the areas 

of health information privacy and security. 

(7) QUORUM.—Ten members of the HIT Policy Committee 

shall constitute a quorum for purposes of voting, but a lesser 

number of members may meet and hold hearings. 

(d) APPLICATION OF FACA.—The Federal Advisory Committee Act 

(5 U.S.C. App.), other than section 14 of such Act, shall apply to the 

HIT Policy Committee. 

(e) PUBLICATION.—The Secretary shall provide for publication in 

the Federal Register and the posting on the Internet website of the 

Office of the National Coordinator for Health Information Technology of all policy recommendations made by the HIT Policy Committee under this section. 

SEC. 3003. HIT STANDARDS COMMITTEE. 

(a) ESTABLISHMENT.—There is established a committee to be 

known as the HIT Standards Committee to recommend to the National Coordinator standards, implementation specifications, and 

certification criteria for the electronic exchange and use of health information for purposes of adoption under section 3004(b), consistent 

with the implementation of the strategic plan described in section 

3001(c)(3). 

(b) DUTIES.— 

(1) STANDARD DEVELOPMENT.— 


jbell on PROD1PC69 with REPORTS
67 

(A) IN GENERAL.—Beginning not later than 1 year after 

the date of the enactment of this title, the HIT Standards 

Committee shall recommend to the National Coordinator 

standards, implementation specifications, and certification 

criteria described in subsection (a) that have been developed, harmonized, or recognized by the Committee. Annually thereafter the Committee shall update such recommendations and make new recommendations as appropriate, including in response to a notification sent under 

section 3004(b)(2). Such recommendations shall be consistent with the latest recommendations made by the HIT 

Policy Committee. 

(B) PILOT TESTING OF STANDARDS AND IMPLEMENTATION

SPECIFICATIONS.—In the development, harmonization, or 

recognition of standards and implementation specifications, 

the HIT Standards Committee, as appropriate, shall provide for the testing of such standards and specifications by 

the National Institute for Standards and Technology under 

section 201 of the PRO(TECH)T Act of 2008. 

(C) CONSISTENCY.—The standards, implementation specifications, and certification criteria recommended under this 

subsection shall be consistent with the standards for information transactions and data elements adopted pursuant 

to section 1173 of the Social Security Act. 

(2) FORUM.—The HIT Standards Committee shall serve as a 

forum for the participation of a broad range of stakeholders to 

provide input on the development, harmonization, and recognition of standards, implementation specifications, and certification criteria necessary for the development and adoption of a 

nationwide health information technology infrastructure that 

allows for the electronic use and exchange of health information. 

(3) SCHEDULE.—Not later than 90 days after the date of the 

enactment of this title, the HIT Standards Committee shall develop a schedule for the assessment of policy recommendations 

developed by the HIT Policy Committee under section 3002. The 

HIT Standards Committee shall update such schedule annually. The Secretary shall publish such schedule in the Federal 

Register. 

(4) PUBLIC INPUT.—The HIT Standards Committee shall conduct open public meetings and develop a process to allow for 

public comment on the schedule described in paragraph (3) and 

recommendations described in this subsection. Under such process comments shall be submitted in a timely manner after the 

date of publication of a recommendation under this subsection. 

(5) WEBSITE.—The HIT Standards Committee shall develop 

and maintain an Internet website on which there is posted information that includes the following: 

(A) Established governance rules. 

(B) A business plan. 

(C) Meeting notices at least 14 days prior to each meeting. 

(D) Meeting agendas at least 7 days prior to each meeting. 


jbell on PROD1PC69 with REPORTS
68 

(E) Meeting materials at least 3 days prior to each meeting. 

(6) REQUIREMENT TO INTEGRATE RECOMMENDATIONS.—In carrying out the activities under this section, the HIT Standards 

Committee shall integrate the recommendations of the HIT Policy Committee. 

(c) MEMBERSHIP.— (1) APPOINTMENTS.—The HIT Standards Committee shall be 

composed of members to be appointed as follows: 

(A) 2 members shall be appointed by the Secretary. 

(B) 1 member shall be appointed by the majority leader 

of the Senate. 

(C) 1 member shall be appointed by the minority leader 

of the Senate. 

(D) 1 member shall be appointed by the Speaker of the 

House of Representatives. 

(E) 1 member shall be appointed by the minority leader 

of the House of Representatives. 

(F) 9 members shall be appointed by the Comptroller 

General of the United States of whom— 

(i) 1 member shall be a representative of consumer or 

patient organizations; 

(ii) 1 member shall be a representative of organizations with expertise in privacy; 

(iii) 1 member shall be a representative of organizations with expertise in security; 

(iv) 2 members shall be a representative of health 

care providers, one of which shall be a physician; 

(v) 1 member shall be a representative of health 

plans or other third party payers; 

(vi) 1 member shall be a representative of information technology vendors; 

(vii) 1 member shall be a representative of purchasers or employers; and 

(viii) 1 member shall be a representative of the 

health research community. 

(G) 1 member shall be appointed by the Director of the 

National Institute for Standards and Technology. 

(2) NATIONAL COORDINATOR.—The National Coordinator 

shall be a member of the HIT Standards Committee and act as 

a liaison among the HIT Standards Committee, the HIT Policy 

Committee, and the Federal government. 

(3) CHAIRPERSON AND VICE CHAIRPERSON.—The HIT Standards Committee shall designate 1 member to serve as the chairperson and 1 member to serve as the vice chairperson of the 

Committee. 

(4) PARTICIPATION.—The members of the HIT Standards 

Committee appointed under paragraph (1) shall represent a 

balance among various sectors of the health care system so that 

no single sector unduly influences the recommendations of such 

Committee. 

(5) TERMS.— (A) IN GENERAL.—The terms of members of the HIT 

Standards Committee appointed under paragraph (1) shall 

be 3 years except that the Comptroller General of the 


jbell on PROD1PC69 with REPORTS
69 

United States shall designate staggered terms for the members first appointed under paragraph (1)(F). 

(B) VACANCIES.—Any member appointed to fill a vacancy 

in the membership of the HIT Standards Committee that 

occurs prior to the expiration of the term for which the 

member’s predecessor was appointed shall be appointed 

only for the remainder of that term. A member may serve 

after the expiration of that member’s term until a successor 

has been appointed. A vacancy in the HIT Standards Committee shall be filled in the manner in which the original 

appointment was made. 

(6) OUTSIDE INVOLVEMENT.—The HIT Standards Committee 

shall ensure an adequate opportunity for the participation in 

activities of the Committee of outside advisors, including individuals with expertise in the development of standards for the 

electronic exchange and use of health information, including in 

the areas of health information privacy and security. 

(7) QUORUM.—Eight members of the HIT Standards Committee shall constitute a quorum for purposes of voting, but a 

lesser number of members may meet and hold hearings. 

(d) APPLICATION OF FACA.—The Federal Advisory Committee Act 

(5 U.S.C. App.), other than section 14, shall apply to the HIT 

Standards Committee. 

(e) PUBLICATION.—The Secretary shall provide for publication in 

the Federal Register and the posting on the Internet website of the 

Office of the National Coordinator for Health Information Technology of all recommendations made by the HIT Standards Committee under this section. 

SEC. 3004. PROCESS FOR ADOPTION OF ENDORSED RECOMMENDATIONS. 

(a) REVIEW OF ENDORSED STANDARDS, SPECIFICATIONS, AND CRITERIA.—Not later than 90 days after the date of receipt of standards, implementation specifications, or certification criteria endorsed under section 3001(c), the Secretary, in consultation with 

representatives of other relevant Federal agencies, shall jointly review such standards, specifications, or criteria and shall determine 

whether or not to propose adoption of such standards, specifications, 

or criteria. 

(b) DETERMINATION TO ADOPT STANDARDS, SPECIFICATIONS, AND

CRITERIA.—If the Secretary determines— 

(1) to propose adoption of any grouping of such standards, 

specifications, or criteria, the Secretary shall, through a rulemaking process, determine whether or not to adopt such grouping of standards, specifications, or criteria; or 

(2) not to propose adoption of any grouping of standards, 

specifications, or criteria, the Secretary shall notify the National Coordinator and the HIT Standards Committee in writing of such determination and the reasons for not proposing the 

adoption of such recommendation. 

(c) PUBLICATION.—The Secretary shall provide for publication in 

the Federal Register of all determinations made by the Secretary 

under subsection (a). 


jbell on PROD1PC69 with REPORTS
70 

SEC. 3005. APPLICATION AND USE OF ADOPTED STANDARDS AND IMPLEMENTATION SPECIFICATIONS BY FEDERAL AGENCIES. 

For requirements relating to the application and use by Federal 

agencies of the standards and implementation specifications adopted under section 3004(b), see section 111 of the PRO(TECH)T Act 

of 2008. 

SEC. 3006. VOLUNTARY APPLICATION AND USE OF ADOPTED STANDARDS AND IMPLEMENTATION SPECIFICATIONS BY PRIVATE ENTITIES. 

(a) IN GENERAL.—Except as provided under section 112 of the 

PRO(TECH)T Act of 2008, any standard or implementation specification adopted under section 3004(b) shall be voluntary with respect to private entities. 

(b) RULE OF CONSTRUCTION.—Nothing in this subtitle shall be 

construed to require that a private entity that enters into a contract 

with the Federal Government apply or use the standards and implementation specifications adopted under section 3004(b) with respect 

to activities not related to the contract. 

SEC. 3007. HEALTH INFORMATION TECHNOLOGY RESOURCE CENTER. 

(a) DEVELOPMENT.— 

(1) IN GENERAL.—The National Coordinator shall develop a 

Health Information Technology Resource Center to provide technical assistance and develop best practices to support and accelerate efforts to adopt, implement, and effectively use health information technology that allows for the electronic exchange 

and use of information in compliance with standards, implementation specifications, and certification criteria adopted 

under section 3004(b). 

(2) PURPOSES.—The purpose of the Center is to— 

(A) provide a forum for the exchange of knowledge and 

experience; 

(B) accelerate the transfer of lessons learned from existing public and private sector initiatives, including those 

currently receiving Federal financial support; 

(C) assemble, analyze, and widely disseminate evidence 

and experience related to the adoption, implementation, 

and effective use of health information technology that allows for the electronic exchange and use of information; 

(D) provide technical assistance for the establishment 

and evaluation of regional and local health information 

networks to facilitate the electronic exchange of information 

across health care settings and improve the quality of 

health care; 

(E) provide technical assistance for the development and 

dissemination of solutions to barriers to the exchange of 

electronic health information; 

(F) learn about effective strategies to adopt and utilize 

health information technology in medically underserved 

communities; 

(G) conduct other activities identified by the States, local 

or regional health information networks, or health care 

stakeholders as a focus for developing and sharing best 

practices; and 

(H) provide technical assistance to promote adoption and 

utilization of health information technology by health care 


jbell on PROD1PC69 with REPORTS
71 

providers, including in medically underserved communities. 

(b) TECHNICAL ASSISTANCE TELEPHONE NUMBER OR WEBSITE.— 

The National Coordinator shall establish a toll-free telephone number or Internet website to provide health care providers with a single 

point of contact to— 

(1) learn about Federal grants and technical assistance services related to the electronic exchange and use of health information; 

(2) learn about standards, implementation specifications, and 

certification criteria adopted under section 3004(b); 

(3) learn about regional and local health information networks for assistance with health information technology; and 

(4) disseminate additional information determined by the National Coordinator. 

Subtitle B—Incentives for the Use of Health 

Information Technology 

SEC. 3011. GRANTS AND LOANS TO FACILITATE THE WIDESPREAD 

ADOPTION OF QUALIFIED HEALTH INFORMATION TECHNOLOGY. 

(a) COMPETITIVE GRANTS TO FACILITATE THE WIDESPREAD ADOPTION OF HEALTH INFORMATION TECHNOLOGY.— 

(1) IN GENERAL.—The National Coordinator may award competitive grants to eligible entities to purchase qualified health 

information technology. 

(2) QUALIFIED HEALTH INFORMATION TECHNOLOGY.—For purposes of this section, the term ‘‘qualified health information 

technology’’ means health information technology that consists 

of hardware, software, or the provision of support services and 

that— 

(A) enables the protection of health information, in accordance with applicable law; 

(B) is (or is necessary for the operation of) an electronic 

health records system, including the provision of decision 

support and physician order entry for medications; 

(C) has the ability to allow timely and permissible access 

to patient information and to transmit and exchange health 

information among providers, patients, or insurers; and 

(D) is certified under the program developed under section 3001(c)(9) to be in compliance with any applicable 

standards and implementation specifications adopted 

under section 3004(b). 

(3) ELIGIBILITY.—To be eligible to receive a grant under paragraph (1) an entity shall— 

(A) submit to the National Coordinator an application at 

such time and in such manner as the National Coordinator 

may require, and containing— 

(i) a plan on how the entity intends to maintain and 

support the qualified health information technology 

that would be purchased with amounts under such 

grant, including the type of resources expected to be involved; and 


jbell on PROD1PC69 with REPORTS
72 

(ii) such other information as the National Coordinator may require; 

(B) submit to the National Coordinator a plan for how 

qualified health information technology purchased by the 

entity will result in the electronic exchange and use of 

health information; 

(C) be— 

(i) a not for profit hospital or a Federally qualified 

health center (as defined in section 1861(aa)(4) of the 

Social Security Act); 

(ii) an individual or group practice; or 

(iii) another health care provider, such as a rural 

health clinic, not described in clause (i) or (ii); 

(D) demonstrate significant financial need; 

(E) agree to notify individuals in accordance with section 

302 of the PRO(TECH)T Act of 2008 (relating to notifications in the case of breaches); 

(F) provide matching funds in accordance with paragraph (5); 

(G) consult with the Health Information Technology Resource Center established under section 3007 to access the 

knowledge and experience of existing initiatives regarding 

the successful implementation and effective use of health 

information technology; and 

(H) link, to the extent practicable, to one or more local or 

regional health information plans. 

(4) USE OF FUNDS.—Amounts received under a grant under 

this subsection shall be used to facilitate the purchase of qualified health information technology. 

(5) MATCHING REQUIREMENT.—To be eligible for a grant 

under this subsection an entity shall contribute non-Federal 

contributions to the costs of carrying out the activities for which 

the grant is awarded in an amount equal to $1 for each $3 of 

Federal funds provided under the grant. 

(6) PREFERENCE IN AWARDING GRANTS.—In awarding grants 

under this subsection the National Coordinator shall give preference to the following eligible entities: 

(A) Small health care providers. 

(B) Entities that are located in rural and other areas that 

serve uninsured, underinsured, and medically underserved 

individuals (regardless of whether such area is urban or 

rural). 

(C) Nonprofit health care providers. 

(7) ADDITIONAL SOURCES OF FUNDING FOR HEALTH INFORMATION TECHNOLOGY.—Funding made available under this subsection is in addition to funding which may be used toward the 

acquisition and utilization of health information technology 

under other law, which includes the following: 

(A) Medicaid transformation grants under section 1903(z) 

of the Social Security Act. 

(B) Grants or funding available through the Agency for 

Healthcare Research and Quality. 

(C) Grants or funding that may be available through the 

Health Resources and Services Administration for investment in health information technologies or telehealth. 


jbell on PROD1PC69 with REPORTS
73 

(D) Grants or funding that may be available through the 

Department of Agriculture’s Rural Development Telecommunications Program for investment in telemedicine. 

(b) COMPETITIVE GRANTS TO STATES AND INDIAN TRIBES FOR THE

DEVELOPMENT OF LOAN PROGRAMS TO FACILITATE THE WIDE- SPREAD ADOPTION OF QUALIFIED HEALTH INFORMATION TECH- NOLOGY.— 

(1) IN GENERAL.—The National Coordinator may award competitive grants to eligible entities for the establishment of programs for loans to health care providers to purchase qualified 

health information technology. 

(2) ELIGIBLE ENTITY DEFINED.—For purposes of this subsection, the term ‘‘eligible entity’’ means a State or Indian tribe 

(as defined in the Indian Self-Determination and Education Assistance Act) that— 

(A) submits to the National Coordinator an application 

at such time, in such manner, and containing such information as the National Coordinator may require; 

(B) submits to the National Coordinator a strategic plan 

in accordance with paragraph (4) and provides to the National Coordinator assurances that the entity will update 

such plan annually in accordance with such paragraph; 

(C) provides assurances to the National Coordinator that 

the entity will establish a Loan Fund in accordance with 

paragraph (3); 

(D) provides assurances to the National Coordinator that 

the entity will not provide a loan from the Loan Fund to 

a health care provider unless the provider meets each of the 

conditions described in paragraph (5); and 

(E) agrees to provide matching funds in accordance with 

paragraph (9). 

(3) ESTABLISHMENT OF FUND.—For purposes of paragraph 

(2)(C), an eligible entity shall establish a qualified health information technology loan fund (referred to in this subsection as 

a ‘‘Loan Fund’’) and comply with the other requirements contained in this section. A grant to an eligible entity under this 

subsection shall be deposited in the Loan Fund established by 

the eligible entity. No funds authorized by other provisions of 

this subtitle to be used for other purposes specified in this subtitle shall be deposited in any Loan Fund. 

(4) STRATEGIC PLAN.— 

(A) IN GENERAL.—For purposes of paragraph (2)(B), a 

strategic plan of an eligible entity under this paragraph 

shall identify the intended uses of amounts available to the 

Loan Fund of such entity. 

(B) CONTENTS.—A strategic plan under subparagraph 

(A), with respect to a Loan Fund of an eligible entity, shall 

include for a year the following: 

(i) A list of the projects to be assisted through the 

Loan Fund during such year. 

(ii) A description of the criteria and methods established for the distribution of funds from the Loan Fund 

during the year. 

(iii) A description of the financial status of the Loan 

Fund as of the date of submission of the plan. 


jbell on PROD1PC69 with REPORTS
74 

(iv) The short-term and long-term goals of the Loan 

Fund. 

(5) HEALTH CARE PROVIDER CONDITIONS FOR RECEIPT OF

LOANS.—For purposes of paragraph (2)(D), the conditions described in this paragraph, with respect to a health care provider 

that seeks a loan from a Loan Fund established under this subsection, are the following: 

(A) The health care provider links, to the extent practicable, to one or more local or regional health information 

networks. 

(B) The health care provider consults with the Health Information Technology Resource Center established under 

section 3007 to access the knowledge and experience of existing initiatives regarding the successful implementation 

and effective use of health information technology. 

(C) The health care provider agrees to notify individuals 

in accordance with section 302 of the PRO(TECH)T Act of 

2008 (relating to notifications in the case of breaches). 

(D) The health care provider submits to the State or Indian tribe involved a plan on how the health care provider 

intends to maintain and support the qualified health information technology that would be purchased with such loan, 

including the type of resources expected to be involved and 

any such other information as the State or Indian Tribe, respectively, may require. 

(6) USE OF FUNDS.— (A) IN GENERAL.—Amounts deposited in a Loan Fund, 

including loan repayments and interest earned on such 

amounts, shall be used only for awarding loans or loan 

guarantees, making reimbursements described in paragraph (8)(D)(i), or as a source of reserve and security for leveraged loans, the proceeds of which are deposited in the 

Loan Fund established under paragraph (1). Loans under 

this section may be used by a health care provider to purchase qualified health information technology. 

(B) LIMITATION.—Amounts received by an eligible entity 

under this subsection may not be used— 

(i) for the purchase or other acquisition of any health 

information technology system that is not a qualified 

health information technology; or 

(ii) to conduct activities for which Federal funds are 

expended under this title. 

(7) TYPES OF ASSISTANCE.—Except as otherwise limited by 

applicable State law, amounts deposited into a Loan Fund 

under this subsection may only be used for the following: 

(A) To award loans that comply with the following: 

(i) The interest rate for each loan shall not exceed the 

market interest rate. 

(ii) The principal and interest payments on each loan 

shall commence not later than 1 year after the date the 

loan was awarded, and each loan shall be fully amortized not later than 10 years after the date of the loan. 

(iii) The Loan Fund shall be credited with all payments of principal and interest on each loan awarded 

from the Loan Fund. 


jbell on PROD1PC69 with REPORTS
75 

(B) To guarantee, or purchase insurance for, a local obligation (all of the proceeds of which finance a project eligible for assistance under this subsection) if the guarantee or 

purchase would improve credit market access or reduce the 

interest rate applicable to the obligation involved. 

(C) As a source of revenue or security for the payment of 

principal and interest on revenue or general obligation 

bonds issued by the eligible entity if the proceeds of the sale 

of the bonds will be deposited into the Loan Fund. 

(D) To earn interest on the amounts deposited into the 

Loan Fund. 

(E) To make reimbursements described in paragraph 

(8)(D)(i). 

(8) ADMINISTRATION OF LOAN FUNDS.— 

(A) COMBINED FINANCIAL ADMINISTRATION.—An eligible 

entity may (as a convenience and to avoid unnecessary administrative costs) combine, in accordance with applicable 

State law, the financial administration of a Loan Fund established under this subsection with the financial administration of any other revolving fund established by the entity 

if otherwise not prohibited by the law under which the 

Loan Fund was established. 

(B) COST OF ADMINISTERING FUND.—Each eligible entity 

may annually use not to exceed 4 percent of the funds provided to the entity under a grant under this subsection to 

pay the reasonable costs of the administration of the programs under this section, including the recovery of reasonable costs expended to establish a Loan Fund which are incurred after the date of the enactment of this title. 

(C) GUIDANCE AND REGULATIONS.—The National Coordinator shall publish guidance and promulgate regulations 

as may be necessary to carry out the provisions of this subsection, including— 

(i) provisions to ensure that each eligible entity commits and expends funds allotted to the entity under 

this subsection as efficiently as possible in accordance 

with this title and applicable State laws; and 

(ii) guidance to prevent waste, fraud, and abuse. 

(D) PRIVATE SECTOR CONTRIBUTIONS.— (i) IN GENERAL.—A Loan Fund established under 

this subsection may accept contributions from private 

sector entities, except that such entities may not specify 

the recipient or recipients of any loan issued under this 

subsection. An eligible entity may agree to reimburse a 

private sector entity for any contribution made under 

this subparagraph, except that the amount of such reimbursement may not be greater than the principal 

amount of the contribution made. 

(ii) AVAILABILITY OF INFORMATION.—An eligible entity shall make publicly available the identity of, and 

amount contributed by, any private sector entity under 

clause (i) and may issue letters of commendation or 

make other awards (that have no financial value) to 

any such entity. 

(9) MATCHING REQUIREMENTS.— 


jbell on PROD1PC69 with REPORTS
76 

(A) IN GENERAL.—The National Coordinator may not 

make a grant under paragraph (1) to an eligible entity unless the entity agrees to make available (directly or through 

donations from public or private entities) non-Federal contributions in cash to the costs of carrying out the activities 

for which the grant is awarded in an amount equal to not 

less than $1 for each $1 of Federal funds provided under 

the grant. 

(B) DETERMINATION OF AMOUNT OF NON-FEDERAL CONTRIBUTION.—In determining the amount of non-Federal 

contributions that an eligible entity has provided pursuant 

to subparagraph (A), the National Coordinator may not include any amounts provided to the entity by the Federal 

Government. 

(10) REPORTS.—The National Coordinator shall annually 

submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Finance of the Senate, and the 

Committee on Energy and Commerce of the House of Representatives, a report summarizing the reports received by the National Coordinator from each eligible entity that receives a 

grant under this subsection. 

(c) COMPETITIVE GRANTS FOR THE IMPLEMENTATION OF REGIONAL

OR LOCAL HEALTH INFORMATION TECHNOLOGY PLANS.— 

(1) IN GENERAL.—The National Coordinator may award competitive grants to eligible entities to implement regional or local 

health information plans to improve health care quality and efficiency through the electronic exchange and use of health information. 

(2) ELIGIBILITY.—To be eligible to receive a grant under paragraph (1) an entity shall— 

(A) facilitate the electronic exchange and use of health information within the local or regional area and among 

local and regional areas; 

(B) demonstrate financial need to the National Coordinator; 

(C) demonstrate that one of its principal missions or purposes is to use information technology to improve health 

care quality and efficiency; 

(D) adopt bylaws, memoranda of understanding, or other 

charter documents that demonstrate that the governance 

structure and decisionmaking processes of such entity allow 

for participation on an ongoing basis by multiple stakeholders within a community, including— 

(i) physicians (as defined in section 1861(r) of the Social Security Act), including physicians that provide 

services to low income populations and populations 

that are uninsured, underinsured, and medically underserved (including such populations in urban and 

rural areas); 

(ii) hospitals (including hospitals that provide services to low income and underserved populations); 

(iii) pharmacists and pharmacies; 

(iv) health plans; 


jbell on PROD1PC69 with REPORTS
77 

(v) health centers (as defined in section 330(b)) and 

Federally qualified health centers (as defined in section 

1861(aa)(4) of the Social Security Act); 

(vi) rural health clinics (as defined in section 

1861(aa) of the Social Security Act); 

(vii) patient or consumer organizations that reflect 

the population to be served; 

(viii) employers; 

(ix) public health agencies; and 

(x) such other health care providers or other entities, 

as determined appropriate by the National Coordinator; 

(E) demonstrate the participation, to the extent practicable, of stakeholders in the electronic exchange and use 

of health information within the local or regional health information plan pursuant to subparagraph (D); 

(F) adopt nondiscrimination and conflict of interest policies that demonstrate a commitment to open, fair, and nondiscriminatory participation in the regional or local health 

information plan by all stakeholders; 

(G) comply with applicable standards and implementation specifications adopted under subtitle A of this title; 

(H) prepare and submit to the National Coordinator an 

application in accordance with paragraph (3); and 

(I) agree to provide matching funds in accordance with 

paragraph (6). 

(3) APPLICATION.— (A) IN GENERAL.—To be eligible to receive a grant under 

paragraph (1), an entity shall submit to the National Coordinator an application at such time, in such manner, and 

containing such information (in addition to information required under subparagraph (B)), as the National Coordinator may require. 

(B) REQUIRED INFORMATION.—At a minimum, an application submitted under this paragraph shall include— 

(i) clearly identified short-term and long-term objectives of the regional or local health information plan; 

(ii) an estimate of costs of the hardware, software, 

training, and other services necessary to implement the 

regional or local health information plan; 

(iii) a strategy that includes initiatives to improve 

health care quality and efficiency; 

(iv) a plan that describes provisions to encourage the 

electronic exchange and use of health information by 

all physicians, including single physician practices and 

small physician groups, participating in the health information plan; 

(v) a plan to ensure the privacy and security of individually identifiable health information that is consistent with applicable Federal and State law; 

(vi) a governance plan that defines the manner in 

which the stakeholders shall jointly make policy and 

operational decisions on an ongoing basis; 

(vii) a financial or business plan that describes— 

(I) the sustainability of the plan; 


jbell on PROD1PC69 with REPORTS
78 

(II) the financial costs and benefits of the plan; 

and 

(III) the entities to which such costs and benefits 

will accrue; 

(viii) a plan on how the entity involved intends to 

maintain and support the regional or local health information plan, including the type of resources expected 

to be involved; and 

(ix) in the case of an applicant that is unable to demonstrate the participation of all stakeholders pursuant 

to paragraph (2)(D), the justification from the entity for 

any such nonparticipation. 

(4) USE OF FUNDS.—Amounts received under a grant under 

paragraph (1) shall be used to establish and implement a regional or local health information plan in accordance with this 

subsection. 

(5) PREFERENCE.—In awarding grants under paragraph (1), 

the Secretary shall give preference to eligible entities that intend 

to use amounts received under a grant to establish or implement a regional or local health information plan that encompasses communities with health disparities or areas that serve 

uninsured, underinsured, and medically underserved individuals (including urban and rural areas). 

(6) MATCHING REQUIREMENT.— 

(A) IN GENERAL.—The National Coordinator may not 

make a grant under this subsection to an entity unless the 

entity agrees that, with respect to the costs of carrying out 

the activities for which the grant is awarded, the entity will 

make available (directly or through donations from public 

or private entities) non-Federal contributions toward such 

costs in an amount equal to not less than 50 percent of 

such costs ($1 for each $2 of Federal funds provided under 

the grant). 

(B) DETERMINATION OF AMOUNT CONTRIBUTED.—NonFederal contributions required under subparagraph (A) 

may be in cash or in kind, fairly evaluated, including 

equipment, technology, or services. Amounts provided by 

the Federal Government, or services assisted or subsidized 

to any significant extent by the Federal Government, may 

not be included in determining the amount of such nonFederal contributions. 

(d) REPORTS.—Not later than 1 year after the date on which the 

first grant is awarded under this section, and annually thereafter 

during the grant period, an entity that receives a grant under this 

section shall submit to the National Coordinator a report on the activities carried out under the grant involved. Each such report shall 

include— 

(1) a description of the financial costs and benefits of the 

project involved and of the entities to which such costs and benefits accrue; 

(2) an analysis of the impact of the project on health care 

quality and safety; 

(3) a description of any reduction in duplicative or unnecessary care as a result of the project involved; 


jbell on PROD1PC69 with REPORTS
79 

(4) a description of the efforts of recipients under this section 

to facilitate secure patient access to health information; 

(5) an analysis of the effectiveness of the project involved on 

ensuring the privacy and security of individually identifiable 

health information in accordance with applicable Federal and 

State law; and 

(6) other information as required by the National Coordinator. 

(e) REQUIREMENT TO IMPROVE QUALITY OF CARE AND DECREASE

IN COSTS.—The National Coordinator shall annually evaluate the 

activities conducted under this section and shall, in awarding 

grants, implement the lessons learned from such evaluation in a 

manner so that awards made subsequent to each such evaluation 

are made in a manner that, in the determination of the National 

Coordinator, will result in the greatest improvement in quality of 

care and decrease in costs. 

(f) LIMITATION.—An eligible entity may only receive one non-renewable grant under subsection (a), one non-renewable grant under 

subsection (b), and one non-renewable grant under subsection (c). 

(g) SMALL HEALTH CARE PROVIDER.—For purposes of this section, 

the term ‘‘small health care provider’’ means a health care provider 

that has an average of 10 or fewer full-time equivalent employees 

during the period involved. 

(h) AUTHORIZATION OF APPROPRIATIONS.— 

(1) IN GENERAL.—For the purpose of carrying out subsections 

(a) through (d), there is authorized to be appropriated 

$115,000,000 for each of the fiscal years 2009 through 2013. 

(2) AVAILABILITY.—Amounts appropriated under paragraph 

(1) shall remain available through fiscal year 2013. 

SEC. 3012. DEMONSTRATION PROGRAM TO INTEGRATE INFORMATION 

TECHNOLOGY INTO CLINICAL EDUCATION. 

(a) IN GENERAL.—The Secretary may award grants under this 

section to carry out demonstration projects to develop academic curricula integrating qualified health information technology in the 

clinical education of health professionals. Such awards shall be 

made on a competitive basis and pursuant to peer review. 

(b) ELIGIBILITY.—To be eligible to receive a grant under subsection (a), an entity shall— 

(1) submit to the Secretary an application at such time, in 

such manner, and containing such information as the Secretary 

may require; 

(2) submit to the Secretary a strategic plan for integrating 

qualified health information technology in the clinical education of health professionals to reduce medical errors and enhance health care quality; 

(3) be— 

(A) a school of medicine, osteopathic medicine, dentistry, 

or pharmacy, a graduate program in behavioral or mental 

health, or any other graduate health professions school; 

(B) a graduate school of nursing or physician assistant 

studies; 

(C) a consortium of two or more schools described in subparagraph (A) or (B); or 


jbell on PROD1PC69 with REPORTS
80 

(D) an institution with a graduate medical education 

program in medicine, osteopathic medicine, dentistry, pharmacy, nursing, or physician assistance studies. 

(4) provide for the collection of data regarding the effectiveness of the demonstration project to be funded under the grant 

in improving the safety of patients, the efficiency of health care 

delivery, and in increasing the likelihood that graduates of the 

grantee will adopt and incorporate qualified health information 

technology, in the delivery of health care services; and 

(5) provide matching funds in accordance with subsection (d). 

(c) USE OF FUNDS.— (1) IN GENERAL.—With respect to a grant under subsection 

(a), an eligible entity shall— 

(A) use grant funds in collaboration with 2 or more disciplines; and 

(B) use grant funds to integrate qualified health information technology into community-based clinical education. 

(2) LIMITATION.—An eligible entity shall not use amounts received under a grant under subsection (a) to purchase hardware, software, or services. 

(d) MATCHING FUNDS.— (1) IN GENERAL.—The Secretary may award a grant to an entity under this section only if the entity agrees to make available non-Federal contributions toward the costs of the program 

to be funded under the grant in an amount that is not less than 

$1 for each $2 of Federal funds provided under the grant. 

(2) DETERMINATION OF AMOUNT CONTRIBUTED.—Non-Federal 

contributions under paragraph (1) may be in cash or in kind, 

fairly evaluated, including equipment or services. Amounts provided by the Federal Government, or services assisted or subsidized to any significant extent by the Federal Government, 

may not be included in determining the amount of such contributions. 

(e) EVALUATION.—The Secretary shall take such action as may be 

necessary to evaluate the projects funded under this section and 

publish, make available, and disseminate the results of such evaluations on as wide a basis as is practicable. 

(f) REPORTS.—Not later than 1 year after the date of enactment 

of this title, and annually thereafter, the Secretary shall submit to 

the Committee on Health, Education, Labor, and Pensions and the 

Committee on Finance of the Senate, and the Committee on Energy 

and Commerce of the House of Representatives a report that— 

(1) describes the specific projects established under this section; and 

(2) contains recommendations for Congress based on the evaluation conducted under subsection (e). 

(g) AUTHORIZATION OF APPROPRIATIONS.—There is authorized to 

be appropriated to carry out this section, $10,000,000 for each of fiscal years 2009 through 2011. 

(h) SUNSET.—This section shall not apply after September 30, 

2011. 

SOCIAL SECURITY ACT 

* * * * * * * 


jbell on PROD1PC69 with REPORTS
81 

TITLE XI—GENERAL PROVISIONS, PEER REVIEW, AND 

ADMINISTRATIVE SIMPLIFICATION 

* * * * * * * 

PART C—ADMINISTRATIVE SIMPLIFICATION

* * * * * * * 

GENERAL PENALTY FOR FAILURE TO COMPLY WITH REQUIREMENTS

AND STANDARDS

SEC. 1176. (a) * * * 

(b) LIMITATIONS.— 

(1) OFFENSES OTHERWISE PUNISHABLE.—A penalty may not 

be imposed under subsection (a) with respect to an act if øthe 

act constitutes an offense punishable under section 1177¿ a 

penalty has been imposed under section 1177 with respect to 

such act. 

* * * * * * * 

(c) NONCOMPLIANCE DUE TO WILLFUL NEGLECT.— 

(1) IN GENERAL.—A violation of a provision of this part due 

to willful neglect is a violation for which the Secretary is required to impose a penalty under subsection (a)(1). 

(2) REQUIRED INVESTIGATION.—For purposes of paragraph 

(1), the Secretary shall formally investigate any complaint of a 

violation of a provision of this part if a preliminary investigation of the facts of the complaint indicate such a possible violation due to willful neglect. 

(3) REGULATIONS.—Not later than 180 days after the date of 

the enactment of the PRO(TECH)T Act of 2008, the Secretary 

shall promulgate regulations to implement this subsection. 

WRONGFUL DISCLOSURE OF INDIVIDUALLY IDENTIFIABLE HEALTH

INFORMATION

SEC. 1177. (a) OFFENSE.—A person who knowingly and in violation of this part— 

(1) * * * 

* * * * * * * 

shall be punished as provided in subsection (b). For purposes of the 

previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the 

information is maintained by a covered entity (as defined in the 

HIPAA privacy regulation described in section 1180(b)(3)) and the 

individual obtained or disclosed such information without authorization. 

* * * * * * * 


jbell on PROD1PC69 with REPORTS
(82) 

DISSENTING VIEWS 

The future of health care reform in the United States depends 

greatly on the widespread adoption of health information technology. Replacing paper-based records with secure electronic systems will save billions in taxpayer dollars through greater efficiencies, and more importantly, will prevent thousands of deaths 

each year by virtually eliminating medical errors. We are pleased 

that the Committee continues to work toward a common goal: ensuring that health information technology can be implemented by 

providers with effective guidelines to protect patient privacy and 

information security. 

Clearly, the federal government can play a critical role in advancing health information technology by moving forward on the 

standard setting process and incentivizing adoption. For example, 

the American Health Information Community (AHIC), a federal advisory body created in 2005, has already made significant progress 

toward these goals by making recommendations to the Secretary of 

the Department of Health and Human Services (HHS) on how to 

accelerate the development and adoption of health information 

technology. AHIC has provided input to HHS on key issues including how to make health records digital and interoperable, and how 

to ensure that the privacy and security of those records are protected. 

We applaud the Committee for its efforts to pass legislation to 

encourage the widespread adoption of health IT. Specifically, we 

share the goals outlined in H.R. 6357, including codifying the Office 

of the National Coordinator for Health Information Technology, 

strengthening the federal standard-setting process, and 

incentivizing providers to use health IT. These elements of H.R. 

6357 serve as a critical first step. 

We are concerned, however, that H.R. 6357 in its current form 

could obstruct these objectives. The goal of health IT legislation 

should be to create incentives for the adoption of new technologies, 

not to discourage their use. We believe several of the privacy and 

security provisions contained in Title III of H.R. 6357 are unnecessary, duplicative of existing Health Insurance Portability and Accountability Act (HIPAA) regulations, and could potentially discourage providers from investing in health IT. 

Section 312(d) of H.R. 6357 requires covered entities to obtain 

the consent of an individual before using or disclosing that individual’s protected health information, which is maintained in an electronic medical record, for the purposes of health care operations. As 

defined in 45 CFR 164.501, ‘‘health care operations’’ include many 

basic functions of health care providers that are integral to ensuring appropriate payment, preventing fraud and abuse, and ensuring quality of care. 


jbell on PROD1PC69 with REPORTS
83 

We believe there could be adverse health consequences in requiring health care providers to obtain prior consent from individuals 

to perform basic health care functions. In addition, allowing patient 

consent for the use and disclosure of protected health information 

to be revocable at any time will likely inject uncertainty and confusion into critical health functions like physician training, care coordination, and public health research. In many cases, because 

treatment and operations functions are intertwined, this new requirement may force health care providers to obtain consent from 

patients even for just providing treatment. Requiring prior patient 

consent would impose significant burdens on providers, while providing little to no privacy benefit to patients. 

Furthermore, we believe that existing HIPAA rules strike the appropriate balance between protecting patient privacy and ensuring 

that critical medical information is available to providers for treatment and vital medical research purposes, especially given the 

scrutiny that both rules received during the rulemaking process. 

The initial HIPPA privacy regulations were the subject of over 

50,000 comments and years of careful consideration. As part of this 

balanced process, the Privacy Rule permitted individuals to request 

restrictions on the uses and disclosures of their information for all 

purposes, but did not explicitly require providers to obtain consent 

before carrying out critical health care functions. 

We support maintaining the existing HIPAA framework as we 

look for ways to expand privacy and security provisions related to 

entities that have emerged since the drafting of these rules. We 

support provisions in H.R. 6357 aimed at exploring what types of 

rules may be appropriate for these entities, including vendors of 

personal health records. We also support efforts to ensure existing 

HIPAA privacy rules are being enforced in an appropriate manner. 

Section 312(c) of H.R. 6357 requires health care providers (covered entities) to afford individuals an accounting of protected 

health information used or maintained in an electronic medical 

record that was disclosed to carry out treatment, payment or 

health care operations. 45 CFR 164.528 currently exempts from 

this ‘‘accounting of disclosures’’ provision all disclosures made to 

carry out treatment, payment or health care operations, as such 

disclosures are routine. As routine disclosures, a patient would be 

notified about these disclosures by the covered entity’s Notice of 

Privacy Practices. Consequently, we believe this provision is unnecessary. 

We are also concerned that this accounting requirement could 

overwhelm patients with unhelpful information and will adversely 

affect providers’ ability to provide patients with safe, efficient 

health care services. For example, most health care providers make 

countless disclosures every day in order to process claims for payment and provide health services. Most IT systems in a doctor’s office, hospital, or pharmacy have not been designed to comply with 

this type of requirement for the millions of routine transactions 

that would be required to be recorded and stored for a minimum 

of three years. 

Section 302 of H.R. 6357 requires a covered entity, in the case 

of a breach of protected health information, to notify each individual whose unsecured protected health information has been, or 


jbell on PROD1PC69 with REPORTS
84 

reasonably believed by the covered entity to have been accessed, acquired, or disclosed. H.R. 6357 defines ‘‘breach’’ as the unauthorized acquisition, access or disclosure of protected health information which compromises the security, privacy or integrity of protected health information maintained by or on behalf of a person. 

We support breach notification requirements as a potential tool 

to keep patients informed, and ensure provider compliance with 

privacy rules. However, we believe that the definition of ‘‘breach’’ 

should be more clearly defined, and based upon risk to the individual. Instead of a blanket notification requirement, it would be 

more useful if patients were notified in instances where there is a 

substantial likelihood of identity theft or medical harm. Similarly, 

unintentional, inconsequential breaches should not be included in 

the notification requirement. A risk-based definition for breach notification would set an objective standard that would guide covered 

entities and health care providers about when a breach occurred, 

and would provide clear guidance to patients as to why they are 

receiving such notification. 

To be clear, we do support changes the Committee made to Title 

III of H.R. 6357 after the Subcommittee on Health markup, including requiring the consent provision to go through a transparent 

rulemaking process, creating exceptions for protected data and 

‘‘good faith’’ disclosures in breach notification requirements, and requiring the Secretary to certify a technology that can handle the 

accounting of disclosures requirement. 

However, we believe that adoption of the new requirements contained in Title III, which would be in addition to existing HIPAA 

rules, would create numerous disincentives for providers to adopt 

health IT, and add little benefit to patient privacy or information 

security. Instead of creating a new regulatory regime, we believe 

this Committee should focus on protecting patient privacy by 

strengthening existing HIPAA rules and protecting data security 

by incentivizing the adoption of new technologies. 

Right now, doctors and hospitals find it hard to justify the cost 

of installing health IT into their practices. At the same time, health 

IT innovators are waiting at the gate to provide new technology to 

providers and patients alike. Tools like secure electronic medical 

records and e-prescribing software all promise to dramatically improve how our health care system is administered. But these 

innovators are also holding back investment because standards for 

interoperability still do not exist. If the federal government continues to delay the process of setting interoperability standards, we 

may miss an important opportunity to advance the widespread 

adoption of health IT. Likewise, if health care providers are burdened with a new set of privacy rules that provide little benefit to 

their patients, they may never be able to, or see the need to, invest 

in health IT systems. 

MIKE ROGERS. 

STEVE BUYER. 

Æ 


jbell on PROD1PC69 with REPORTS