I 

115TH CONGRESS 

1ST SESSION H. R. 4613 

To allow the use of claims, eligibility, and payment data to produce reports, 

analyses, and presentations to benefit Medicare, and other similar health 

insurance programs, entities, researchers, and health care providers, to 

help develop cost saving approaches, standards, and reference materials 

and to support medical care and improved payment models. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 11, 2017 

Mrs. MCMORRIS RODGERS (for herself, Mr. KELLY of Pennsylvania, Mr. 

HUDSON, Mrs. BLACKBURN, Mr. LONG, Mr. BISHOP of Michigan, Mr. 

PAULSEN, and Mr. KRISHNAMOORTHI) introduced the following bill; 

which was referred to the Committee on Energy and Commerce, and in 

addition to the Committee on Ways and Means, for a period to be subsequently determined by the Speaker, in each case for consideration of such 

provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To allow the use of claims, eligibility, and payment data 

to produce reports, analyses, and presentations to benefit 

Medicare, and other similar health insurance programs, 

entities, researchers, and health care providers, to help 

develop cost saving approaches, standards, and reference 

materials and to support medical care and improved payment models. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


SSpencer on DSKBBV9HB2PROD with BILLS
2 

•HR 4613 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Ensuring Patient Ac3 cess to Healthcare Records Act of 2017’’. 

4 SEC. 2. PROMOTION OF ACCESS TO DATA, VIA RESEARCH 

5 AND USER FRIENDLY PRESENTATIONS AND 

6 APPLICATIONS. 

7 (a) IN GENERAL.—Subtitle D of the Health Informa8 tion Technology for Economic and Clinical Health Act (42 

9 U.S.C. 17921 et seq.) is amended by adding at the end 

10 the following: 

11 ‘‘PART 3—HEALTH CARE CLEARINGHOUSES; 

12 DATA PROCESSING TO EMPOWER PATIENTS 

13 AND IMPROVE THE HEALTH CARE SYSTEM 

14 ‘‘SEC. 13451. MODERNIZING THE ROLE OF CLEARING15 HOUSES IN HEALTH CARE. 

16 ‘‘(a) EFFORTS TO PROMOTE ACCESS TO AND

17 LEVERAGING OF HEALTH INFORMATION.— 

18 ‘‘(1) IN GENERAL.—The Secretary shall, 

19 through the updating of existing policies and devel20 opment of policies that support dynamic technology 

21 solutions, promote patient access to information re22 lated to their care, including real world outcomes 

23 and economic data (including claims, eligibility, and 

24 payment data), in a manner that would ensure that 

25 such information is available in a form convenient 


SSpencer on DSKBBV9HB2PROD with BILLS
3 

•HR 4613 IH

1 for the patient, in a reasonable manner, and without 

2 burdening the health care provider involved. 

3 ‘‘(2) REQUIREMENT.—Activities carried out 

4 under paragraph (1) shall include the development 

5 of policies to enable covered entities with access to 

6 health information to— 

7 ‘‘(A) provide patient access to information 

8 related to their care, including real world out9 comes and economic data; 

10 ‘‘(B) develop, in accordance with HIPAA11 related provisions (as defined in subsection (j)), 

12 patient engagement tools, reports, analyses, and 

13 presentations based on population health, epide14 miological, and health services outcomes data, 

15 that may demonstrate a fiscal or treatment ben16 efit to patients and health plan enrollees; and 

17 ‘‘(C) promote transparency regarding the 

18 use and disclosure of health information by 

19 health care clearinghouses in accordance with 

20 the notice provisions of subsection (e). 

21 ‘‘(b) TREATMENT AS COVERED ENTITY FOR SPECI22 FIED FUNCTIONS.— 

23 ‘‘(1) IN GENERAL.—With respect to the use 

24 and disclosure of protected health information, the 

25 Secretary shall— 


SSpencer on DSKBBV9HB2PROD with BILLS
4 

•HR 4613 IH

1 ‘‘(A) not consider health care clearing2 houses that engage in the functions described in 

3 paragraph (3) to be business associates, includ4 ing subcontractor business associates, under 

5 HIPAA-related provisions (as defined in sub6 section (j)(3)) regardless of the role of such 

7 clearinghouses in collecting or receiving the in8 formation; and 

9 ‘‘(B) consider such clearinghouses to be 

10 covered entities under such provisions of law for 

11 all purposes. 

12 Such clearinghouses shall not be considered business 

13 associates, or subcontractor business associates, for 

14 translation of data into and out of standard format, 

15 analytic, cloud computing, or any other purpose. 

16 ‘‘(2) DATA ACCURACY AND SECURITY REQUIRE17 MENT.—In order to use health data as authorized by 

18 this section, a clearinghouse or other covered entity 

19 engaging in activities authorized under this section 

20 shall be certified to have the necessary expertise and 

21 technical infrastructure to ensure the accuracy and 

22 security of such claims, eligibility, and payment data 

23 through receipt of an accreditation by the Electronic 

24 Healthcare Network Accreditation Commission, or 


SSpencer on DSKBBV9HB2PROD with BILLS
5 

•HR 4613 IH

1 by an equivalent accreditation program determined 

2 appropriate by the Secretary. 

3 ‘‘(3) ENHANCING TREATMENT, QUALITY IM4 PROVEMENT, RESEARCH, PUBLIC HEALTH EFFORTS

5 AND OTHER FUNCTIONS.— 

6 ‘‘(A) EQUIVALENT AUTHORITY TO OTHER

7 COVERED ENTITIES.—Subject to paragraph (2), 

8 a health care clearinghouse shall— 

9 ‘‘(i) in addition to carrying out claims 

10 processing functions, be permitted to use 

11 and disclose protected health information 

12 without obtaining individual authorization 

13 to the same extent as other covered enti14 ties, including for purposes of treatment, 

15 payment, health care operations as per16 mitted by section 164.506 of title 45, Code 

17 of Federal Regulations, research, and pub18 lic health as permitted by section 164.512 

19 of title 45, Code of Federal Regulations, 

20 and creating de-identified information as 

21 permitted by section 164.502(d) of title 

22 45, Code of Federal Regulations; and 

23 ‘‘(ii) use or disclose protected health 

24 information as required by section 


SSpencer on DSKBBV9HB2PROD with BILLS
6 

•HR 4613 IH

1 164.502(a)(2) of title 45, Code of Federal 

2 Regulations. 

3 ‘‘(B) ADDITIONAL AUTHORITY.— 

4 ‘‘(i) A health care clearinghouse shall 

5 be permitted to provide an individual or 

6 the personal representative of such indi7 vidual access to the protected health infor8 mation of such individual as described in 

9 subsection (d). 

10 ‘‘(ii) All covered entities, including a 

11 health care clearinghouse, shall, subject to 

12 subsection (c)(2), be permitted to— 

13 ‘‘(I) on behalf of covered entities, 

14 use and disclose protected health in15 formation for health care operations 

16 purposes (as defined by section 

17 164.501 of title 45, Code of Federal 

18 Regulations) without respect to 

19 whether the recipient of the informa20 tion has or had a relationship with the 

21 individual; 

22 ‘‘(II) upon the request of a cov23 ered entity, benchmark (as defined by 

24 the Secretary pursuant to rulemaking) 

25 the operations of such covered entity 


SSpencer on DSKBBV9HB2PROD with BILLS
7 

•HR 4613 IH

1 against the operations of one or more 

2 other covered entities that have elect3 ed to participate in such benchmark4 ing; and 

5 ‘‘(III) use and disclose protected 

6 health information to facilitate clinical 

7 trial recruitment, except that in the 

8 case the covered entity provides a con9 sumer-facing portal or website that in10 forms individuals of clinical trials con11 ducted by the covered entity, the cov12 ered entity shall secure opt-in consent 

13 from the individual, or the individual’s 

14 personal representative, prior to con15 tacting an individual regarding such 

16 clinical trials unless such covered enti17 ty already has a relationship with the 

18 individual. 

19 ‘‘(C) CLARIFICATION.—Nothing in this 

20 paragraph shall expand the authority of a 

21 health care clearinghouse or any other covered 

22 entity to use or disclose protected health infor23 mation for marketing purposes under sections 

24 164.501 and 164.508(a)(3) of title 45, Code of 

25 Federal Regulations. 


SSpencer on DSKBBV9HB2PROD with BILLS
8 

•HR 4613 IH

1 ‘‘(c) AUTHORITIES RELATING TO DATA PROC2 ESSING.— 

3 ‘‘(1) IN GENERAL.—In carrying out HIPAA-re4 lated provisions, the Secretary shall permit a health 

5 care clearinghouse to aggregate protected health in6 formation, within the clearinghouse and among other 

7 clearinghouses, that the clearinghouse possesses in 

8 order to carry out the functions described in sub9 section (b)(3). Subject to section 164.502(a)(5)(i) of 

10 title 45, Code of Federal Regulations, a health care 

11 clearinghouse may carry out the functions described 

12 in subsection (b)(3) without obtaining individual au13 thorization under section 164.508 of title 45, Code 

14 of Federal Regulations. 

15 ‘‘(2) PRIVACY.—For purposes of clauses (ii) 

16 through (iv) of subsection (b)(3)(B), with respect to 

17 any report, analysis, or presentation provided by the 

18 covered entity to a third party, such report, analysis, 

19 or presentation— 

20 ‘‘(A) shall include only de-identified data; 

21 or 

22 ‘‘(B) shall include, subject to a qualifying 

23 data use agreement (as defined in subsection 

24 (j)), protected health information. 

25 ‘‘(3) CLARIFICATION; FEE PERMITTED.— 


SSpencer on DSKBBV9HB2PROD with BILLS
9 

•HR 4613 IH

1 ‘‘(A) IN GENERAL.—Nothing in this para2 graph shall be construed as affecting an individ3 ual’s right to access claims and payment 

4 records in HIPAA standard format, in accord5 ance with section 164.524 of title 45, Code of 

6 Federal Regulations. 

7 ‘‘(B) FEE PERMITTED.—If an individual 

8 or a personal representative of the individual 

9 requests a copy of records in HIPAA standard 

10 format a health care clearinghouse may charge 

11 a reasonable, cost-based fee so far as such fee 

12 is in accordance with section 164.524(c)(4) of 

13 title 45, Code of Federal Regulations. 

14 ‘‘(d) COMPREHENSIVE RECORDS AT THE REQUEST

15 OF AN INDIVIDUAL.— 

16 ‘‘(1) IN GENERAL.—When a health care clear17 inghouse receives a written request from an indi18 vidual or the personal representative of the indi19 vidual for the protected health information of the in20 dividual, the clearinghouse shall provide to the indi21 vidual a comprehensive record of such information 

22 (across health care providers and health plans and 

23 longitudinal in scope), unless the clearinghouse de24 termines in its sole discretion that providing a com25 prehensive record is not technologically feasible. 


SSpencer on DSKBBV9HB2PROD with BILLS
10 

•HR 4613 IH

1 ‘‘(2) PURCHASE FROM OTHER CLEARING2 HOUSES.—In preparing a comprehensive record for 

3 an individual under paragraph (1), a health care 

4 clearinghouse may, with the permission of the indi5 vidual, purchase the protected health information of 

6 the individual from one or more other health clear7 inghouses (and the amount of such purchase may be 

8 included in a fee that is fair market value, as de9 fined in subsection (j)(2), charged to the individual. 

10 ‘‘(e) SITUATIONS NOT INVOLVING DIRECT INTER11 ACTION WITH INDIVIDUALS.—Sections 164.400 through 

12 164.414 (relating to breach notification) and sections 

13 164.520 through 164.528 (relating to individual rights) 

14 of title 45, Code of Federal Regulations, shall apply to 

15 a health care clearinghouse that engages in the functions 

16 described in subsection (b)(3) to the extent that such 

17 clearinghouse has current contact information pursuant to 

18 direct interaction with the individual involved. If the clear19 inghouse does not have direct interaction with the indi20 vidual involved, the clearinghouse shall provide notice of 

21 any breach of unsecured protected health information to 

22 the covered entity that does have direct interaction with 

23 the individual involved. The clearinghouse shall not be re24 quired to report a breach if the protected health informa25 tion is rendered unusable, unreadable, or indecipherable 


SSpencer on DSKBBV9HB2PROD with BILLS
11 

•HR 4613 IH

1 to unauthorized persons through the use of a technology 

2 or methodology specified by the Secretary in the guidance 

3 issued under section 13402(h)(2). The clearinghouse shall 

4 also provide a notice of privacy practices on its website. 

5 ‘‘(f) TRANSITION.— 

6 ‘‘(1) IN GENERAL.—Except where specifically 

7 stated, nothing in this section shall be construed to 

8 apply to clearinghouses to the exclusion of other cov9 ered entities or to provide a health care clearing10 house greater authority to use and disclose protected 

11 health information than that provided to another 

12 covered entity. 

13 ‘‘(2) EXISTING AGREEMENTS.—With respect to 

14 agreements entered into by a health care clearing15 house prior to the date of enactment of this section, 

16 a provision of such an agreement that conflicts with 

17 this section shall not have any legal force or effect. 

18 The preceding sentence may not be construed as af19 fecting any provision of an agreement that does not 

20 conflict with this section. 

21 ‘‘(g) SAFE HARBOR AND CLARIFICATION OF LIABIL22 ITY.—In the case of a health care clearinghouse that en23 gages in a function described in subsection (b), only that 

24 clearinghouse may be held liable for a violation of a 

25 HIPAA-related provision (and a covered entity that proVerDate Sep 11 2014 03:23 Dec 14, 2017 Jkt 079200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H4613.IH H4613

SSpencer on DSKBBV9HB2PROD with BILLS
12 

•HR 4613 IH

1 vided data or data access to the clearinghouse shall not 

2 be liable for such violations). 

3 ‘‘(h) ENFORCEMENT.—Section 13410(a)(2) shall 

4 apply to this section in the same manner as such section 

5 applies to parts 1 and 2. 

6 ‘‘(i) RELATION TO OTHER LAWS.— 

7 ‘‘(1) APPLICATION OF HITECH RULE.—Section 

8 13421 shall apply to this section in the same man9 ner as such section applies to parts 1 and 2, except 

10 to the extent that such section 13421 concerns sec11 tion 1178(a)(2)(B) of the Social Security Act. 

12 ‘‘(2) STATE LAWS REGARDING UNFAIR OR DE13 CEPTIVE ACTS OR PRACTICES.—This part shall not 

14 be construed to preempt the law of any State that 

15 prohibits unfair or deceptive acts or practices or 

16 limit the authority of State attorneys general to en17 force such laws. 

18 ‘‘(j) DEFINITIONS.—In this part: 

19 ‘‘(1) DE-IDENTIFIED.—The term ‘de-identified’, 

20 with respect to health information, means such in21 formation that is not individually identifiable as de22 termined in accordance with the standards under 

23 section 164.514(b) of title 45, Code of Federal Reg24 ulations. 


SSpencer on DSKBBV9HB2PROD with BILLS
13 

•HR 4613 IH

1 ‘‘(2) FAIR MARKET VALUE.—The term ‘fair 

2 market value’ means the price that a person reason3 ably knowledgeable and interested in buying a given 

4 product or service would pay to a person reasonably 

5 knowledgeable and interested in selling the product 

6 or service. 

7 ‘‘(3) HEALTH CARE CLEARINGHOUSE.—The 

8 term ‘health care clearinghouse’ has the meaning 

9 given such term in section 1171 of the Social Secu10 rity Act. 

11 ‘‘(4) HIPAA-RELATED PROVISION.—The term 

12 ‘HIPAA-related provision’ means the provisions of 

13 each of the following: 

14 ‘‘(A) This subtitle. 

15 ‘‘(B) Part C of title XI of the Social Secu16 rity Act. 

17 ‘‘(C) Regulations promulgated pursuant to 

18 sections 262(a) and 264(c) of the Health Insur19 ance Portability and Accountability Act of 1996 

20 or this subtitle. 

21 ‘‘(5) INDIVIDUAL.—The term ‘individual’, with 

22 respect to protected health information, has the 

23 meaning applicable under section 160.103 of title 

24 45, Code of Federal Regulations. 


SSpencer on DSKBBV9HB2PROD with BILLS
14 

•HR 4613 IH

1 ‘‘(6) QUALIFYING DATA USE AGREEMENT.—The 

2 term ‘qualifying data use agreement’ means an 

3 agreement, which may be electronic, that— 

4 ‘‘(A) establishes the permitted uses and 

5 disclosures of protected health information by 

6 the recipient; 

7 ‘‘(B) limits such uses and disclosures to 

8 the original purpose of disclosure under sub9 section (b)(3)(B); and 

10 ‘‘(C) provides that the data recipient will— 

11 ‘‘(i) not use or further disclose the in12 formation other than as permitted by the 

13 qualifying data use agreement or as other14 wise required by law; 

15 ‘‘(ii) use appropriate safeguards to 

16 prevent use or disclosure of the informa17 tion other than as provided for by the 

18 qualifying data use agreement; and 

19 ‘‘(iii) ensure that any agents to whom 

20 it provides the data agree to the same re21 strictions and conditions that apply to the 

22 data recipient with respect to such infor23 mation.’’. 

24 (b) REGULATIONS.—Not later than 180 days after 

25 the date of the enactment of this Act, the Secretary of 


SSpencer on DSKBBV9HB2PROD with BILLS
15 

•HR 4613 IH

1 Health and Human Services shall promulgate regulations 

2 to carry out the amendment made by subsection (a). 

3 (c) CONFORMING AMENDMENT.—Section 1171(2) of 

4 the Social Security Act (42 U.S.C. 1320d(2)) is amended 

5 by inserting before the period the following: ‘‘or receives 

6 a standard transaction from another entity and processes 

7 or facilitates the processing of health information into 

8 nonstandard format or nonstandard data content for the 

9 receiving entity. Such term also includes an entity that 

10 carries out such processing functions, transmits standard 

11 health care claims, transmits health care claim payments 

12 or provides advice on such, and transmits any standard 

13 transactions on behalf of a HIPAA-covered entity and in 

14 addition, engages in any authority of such entity described 

15 in subsection (b)(3) of section 13451 of the Health Infor16 mation Technology for Economic and Clinical Health 

17 Act’’. 

Æ 


SSpencer on DSKBBV9HB2PROD with BILLS