II 

114TH CONGRESS 

1ST SESSION S. 2141 

To amend the Public Health Service Act with respect to health information 

technology. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 6, 2015 

Mr. CASSIDY (for himself and Mr. WHITEHOUSE) introduced the following bill; 

which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To amend the Public Health Service Act with respect to 

health information technology. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Transparent Ratings 

5 on Usability and Security to Transform Information Tech6 nology Act of 2015’’ or the ‘‘TRUST IT Act’’. 

7 SEC. 2. DEFINITIONS. 

8 Section 3000 of the Public Health Service Act (42 

9 U.S.C. 300jj) is amended— 


emcdonald on DSK67QTVN1PROD with BILLS
2 

•S 2141 IS

1 (1) by redesignating paragraphs (10) through 

2 (14) as paragraphs (12) through (16), respectively; 

3 and 

4 (2) by inserting after paragraph (9) the fol5 lowing: 

6 ‘‘(10) INFORMATION BLOCKING.—The term ‘in7 formation blocking’ means, with respect to the devel8 opment, configuration, implementation, and use of 

9 qualified electronic health records and other health 

10 information technology, business, technical, and or11 ganizational practices that— 

12 ‘‘(A) except as required by law, prevent or 

13 materially discourage the access, exchange, or 

14 use of electronic health information; and 

15 ‘‘(B) the person knows or should know (as 

16 defined in section 1128A(i)(7) of the Social Se17 curity Act) are likely to interfere with the ac18 cess, exchange, or use of electronic health infor19 mation. 

20 ‘‘(11) INTEROPERABILITY.—The term ‘inter21 operability’ means the ability of 2 or more health in22 formation systems or components to exchange clin23 ical and other information and to use the informa24 tion that has been exchanged using common stand25 ards to provide access to longitudinal or requested 


emcdonald on DSK67QTVN1PROD with BILLS
3 

•S 2141 IS

1 information to health care providers, patients, and 

2 other authorized users when such persons need such 

3 information in order to facilitate coordinated care 

4 and improved patient outcomes.’’. 

5 SEC. 3. ENHANCEMENTS TO TESTING AND CERTIFICATION. 

6 Section 3001(c)(5) of the Public Health Service Act 

7 (42 U.S.C. 300jj–11) is amended— 

8 (1) in subparagraph (A)— 

9 (A) by striking ‘‘The National Coordi10 nator’’ and inserting the following: 

11 ‘‘(i) VOLUNTARY CERTIFICATION PRO12 GRAM.—The National Coordinator’’; and 

13 (B) by adding at the end the following: 

14 ‘‘(ii) TRANSPARENCY OF PROGRAM.— 

15 ‘‘(I) IN GENERAL.—To enhance 

16 transparency in the compliance of 

17 health information technology with 

18 certification criteria adopted under 

19 this subtitle, the National Coordi20 nator, in coordination with authorized 

21 certification bodies, may make infor22 mation demonstrating how health in23 formation technology meets such cer24 tification criteria publicly available. 

25 Such information may include sumVerDate Sep 11 2014 02:18 Oct 08, 2015 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2141.IS S2141

emcdonald on DSK67QTVN1PROD with BILLS
4 

•S 2141 IS

1 maries, screenshots, video demonstra2 tions, or any other information the 

3 National Coordinator determines ap4 propriate. 

5 ‘‘(II) PROTECTION OF PROPRI6 ETARY INFORMATION.—Nothing in 

7 this paragraph shall be construed to 

8 require the release of trade secrets or 

9 any other protected intellectual prop10 erty.’’; 

11 (2) in subparagraph (B), by adding at the end 

12 the following: ‘‘Beginning 18 months after reporting 

13 criteria are finalized under section 3009A, certifi14 cation criteria shall include, in addition to criteria to 

15 establish that the technology meets such standards 

16 and implementation specifications, criteria consistent 

17 with section 3009A(b) to establish that technology 

18 meets applicable security requirements, incorporates 

19 user-centered design, and achieves interoperability.’’; 

20 and 

21 (3) by adding at the end the following: 

22 ‘‘(C) CONDITIONS OF CERTIFICATION.— 

23 Beginning 1 year after the date of enactment of 

24 the TRUST IT Act, the Secretary shall require 

25 that each vendor of health information techVerDate Sep 11 2014 02:18 Oct 08, 2015 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2141.IS S2141

emcdonald on DSK67QTVN1PROD with BILLS
5 

•S 2141 IS

1 nology and entity seeking certification of health 

2 information technology, as a condition of certifi3 cation and maintenance of certification of such 

4 technology, provide to the Secretary an attesta5 tion that— 

6 ‘‘(i) the vendor or entity, unless for a 

7 legitimate purpose specified by the Sec8 retary, has not taken and will not take any 

9 action that constitutes information block10 ing with respect to health information 

11 technology; 

12 ‘‘(ii) the vendor or entity will not en13 gage in business practices or impose bind14 ing business relationship obligations that 

15 seek to intentionally limit communication 

16 between health information technology 

17 users and an authorized certification body 

18 regarding the usability, interoperability, se19 curity, business practices, or other relevant 

20 information about the health information 

21 technology or users’ experience with the 

22 health information technology; and 

23 ‘‘(iii) health information from such 

24 technology may be exchanged, accessed, 

25 and used through the use of application 


emcdonald on DSK67QTVN1PROD with BILLS
6 

•S 2141 IS

1 programming interfaces and other stand2 ards without special effort, as authorized 

3 under applicable law. 

4 ‘‘(D) INSPECTOR GENERAL AUTHORITY.— 

5 ‘‘(i) IN GENERAL.—The Inspector 

6 General of the Department of Health and 

7 Human Services may investigate any claim 

8 that— 

9 ‘‘(I) a vendor of, or other entity 

10 offering, certified health information 

11 technology— 

12 ‘‘(aa) violated an attestation 

13 made under subparagraph (C); or 

14 ‘‘(bb) engaged in informa15 tion blocking with respect to the 

16 use of such health information 

17 technology by a health care pro18 vider, unless for a legitimate pur19 pose specified by the Secretary; 

20 ‘‘(II) a health care provider en21 gaged in information blocking with re22 spect to the use of certified health in23 formation technology, unless for a le24 gitimate purpose specified by the Sec25 retary; 


emcdonald on DSK67QTVN1PROD with BILLS
7 

•S 2141 IS

1 ‘‘(III) a health information sys2 tem provider engaged in information 

3 blocking with respect to the use of 

4 such certified health information tech5 nology, unless for a legitimate purpose 

6 specified by the Secretary. 

7 ‘‘(ii) PENALTY.—Any person or entity 

8 determined by the Inspector General to 

9 have committed an act described in sub10 clause (I), (II), or (III) of clause (i) shall 

11 be subject to a civil monetary penalty of 

12 not more than $10,000 for each such act. 

13 The provisions of section 1128A of the So14 cial Security Act (other than subsections 

15 (a) and (b)) shall apply to a civil money 

16 penalty applied under this subsection in 

17 the same manner as such provisions apply 

18 to a civil money penalty or proceeding 

19 under section 1128A(a).’’. 

20 SEC. 4. HEALTH INFORMATION TECHNOLOGY RATING PRO21 GRAM. 

22 Subtitle A of title XXX of the Public Health Service 

23 Act (42 U.S.C. 300jj–11 et seq.) is amended by adding 

24 at the end the following: 


emcdonald on DSK67QTVN1PROD with BILLS
8 

•S 2141 IS

1 ‘‘SEC. 3009A. HEALTH INFORMATION TECHNOLOGY RATING 

2 PROGRAM. 

3 ‘‘(a) ESTABLISHMENT.—Not later than 180 days 

4 after the date of enactment of the TRUST IT Act, the 

5 Secretary shall recognize a development council made up 

6 of one representative from each of the accredited certifying 

7 bodies accredited by the Office and the testing laboratories 

8 accredited under section 13201(b) of the Health Informa9 tion Technology for Economic and Clinical Health Act (42 

10 U.S.C. 17911(b)), and one representative from the Office 

11 of the National Coordinator, for the purpose of estab12 lishing a health information technology rating program to 

13 evaluate, based on the methodology established under sub14 section (d), the field performance of certified health infor15 mation technology with regard to interoperability, 

16 usability, and security, in accordance with the following: 

17 ‘‘(1) 1 STAR RATING.—Certified health informa18 tion technology shall receive a 1 star rating if an au19 thorized certification body determines that the 

20 health information technology is less than satisfac21 tory. 

22 ‘‘(2) 2 STAR RATING.—Certified health informa23 tion technology shall receive a 2 star rating if the 

24 authorized certification body determines that the 

25 health information technology is satisfactory. 


emcdonald on DSK67QTVN1PROD with BILLS
9 

•S 2141 IS

1 ‘‘(3) 3 STAR RATING.—Certified health informa2 tion technology shall receive a 3 star rating if the 

3 authorized certification body determines that the 

4 health information technology is excellent. 

5 ‘‘(b) REPORTING CRITERIA.— 

6 ‘‘(1) Not later than 1 year after the date of en7 actment of the TRUST IT Act, the Secretary, in 

8 consultation with the development council described 

9 in subsection (a), shall convene stakeholders as de10 scribed in paragraph (2) for the purpose of devel11 oping the reporting criteria in accordance with para12 graph (3). 

13 ‘‘(2) DEVELOPMENT OF REPORTING CRI14 TERIA.—The reporting criteria under this subsection 

15 shall be developed through a public, transparent 

16 process that reflects input from relevant stake17 holders, including— 

18 ‘‘(A) primary care and specialty care 

19 health care professionals; 

20 ‘‘(B) hospitals; 

21 ‘‘(C) health information technology ven22 dors; 

23 ‘‘(D) advocates for patients or consumers; 

24 ‘‘(E) data sharing networks, such as health 

25 information exchanges; 


emcdonald on DSK67QTVN1PROD with BILLS
10 

•S 2141 IS

1 ‘‘(F) authorized certification bodies and 

2 testing laboratories; 

3 ‘‘(G) security experts; and 

4 ‘‘(H) other entities or persons, as the Sec5 retary, in consultation with the development 

6 council, determines appropriate. 

7 ‘‘(3) CONSIDERATIONS FOR REPORTING CRI8 TERIA.—The reporting criteria developed under this 

9 subsection— 

10 ‘‘(A) may include measures that reflect 

11 categories including, with respect to the tech12 nology— 

13 ‘‘(i) security; 

14 ‘‘(ii) usability and user-centered de15 sign; 

16 ‘‘(iii) interoperability; 

17 ‘‘(iv) conformance to certification test18 ing; and 

19 ‘‘(v) other categories as appropriate to 

20 measure the performance of health infor21 mation technology; 

22 ‘‘(B) may include measures such as— 

23 ‘‘(i) enabling the user to order and 

24 view the results of laboratory tests, imag25 ing tests, and other diagnostic tests; 


emcdonald on DSK67QTVN1PROD with BILLS
11 

•S 2141 IS

1 ‘‘(ii) submitting, editing, and retriev2 ing data from registries for quality of care, 

3 such as physician registries; 

4 ‘‘(iii) accessing and exchanging infor5 mation and data from medical devices; 

6 ‘‘(iv) accessing and exchanging infor7 mation and data held by Federal, State, 

8 and local agencies and other applicable en9 tities useful to a health care provider or 

10 other applicable user in the furtherance of 

11 patient care; 

12 ‘‘(v) accessing and exchanging infor13 mation from other health care providers or 

14 applicable users; 

15 ‘‘(vi) accessing and exchanging pa16 tient generated information; 

17 ‘‘(vii) providing the patient with a 

18 complete copy of their electronic record in 

19 a computable format; and 

20 ‘‘(viii) other appropriate functionali21 ties; and 

22 ‘‘(C) shall be designed to ensure that small 

23 and start up vendors of health information 

24 technology are not unduly disadvantaged by the 

25 reporting criteria or rating scale methodology. 


emcdonald on DSK67QTVN1PROD with BILLS
12 

•S 2141 IS

1 ‘‘(4) PUBLIC COMMENT.—The Secretary shall 

2 conduct a 60-day public comment period during 

3 which any member of the public may provide com4 ments on the proposed reporting criteria and the 

5 methodology for authorized certification bodies to 

6 use in determining the star ratings. The Secretary 

7 shall provide timely responses to such comments be8 fore issuing a final rule. 

9 ‘‘(5) MODIFICATIONS.—After the reporting cri10 teria have been established, the Secretary, in con11 sultation with the development council, may convene 

12 stakeholders and conduct a public reporting period 

13 for the purpose of modifying the reporting criteria 

14 developed in this subsection and methodology for de15 termining the star ratings proposed under subsection 

16 (d). 

17 ‘‘(6) CONSIDERATION OF DEVELOPMENT COUN18 CIL RECOMMENDATIONS.—In promulgating final 

19 rules under this subsection, including modifications 

20 to such rules under paragraph (5), the Secretary 

21 may accept or reject the recommendations of the de22 velopment council, but may not promulgate a rule 

23 that does not represent a complete recommendation 

24 of such council. 


emcdonald on DSK67QTVN1PROD with BILLS
13 

•S 2141 IS

1 ‘‘(c) COLLECTION OF FEEDBACK.—The Secretary, in 

2 consultation with the development council, shall establish 

3 a process for authorized certification bodies to collect and 

4 verify confidential feedback from— 

5 ‘‘(1) health care providers, patients, and other 

6 users of health information technology on the 

7 usability, security, and interoperability of health in8 formation technology products; and 

9 ‘‘(2) vendors or other entities offering health in10 formation technology on practices of health informa11 tion technology users that may inhibit interoper12 ability. 

13 ‘‘(d) METHODOLOGY.—The Secretary, in consulta14 tion with the development council, shall develop a method15 ology for authorized certification bodies to use to calculate 

16 the star ratings for certified health information technology 

17 described in subsection (a). The methodology shall use the 

18 reporting criteria developed in subsection (b) and con19 fidential feedback collected under subsection (c). 

20 ‘‘(e) PARTICIPATION.—Each vendor of, or entity of21 fering, health information technology that is certified 

22 under section 3001(c)(5) of the Public Health Service Act 

23 after the date of enactment of the TRUST IT Act shall 

24 report on the criteria developed under subsection (b) on 


emcdonald on DSK67QTVN1PROD with BILLS
14 

•S 2141 IS

1 the date that is 2 years after such certification and every 

2 2 years thereafter. 

3 ‘‘(f) ONE STAR RATING.—Each vendor of, or entity 

4 offering, health information technology that receives a 1 

5 star rating shall take action, through a corrective action 

6 plan developed with the authorized certification body and 

7 approved by the Secretary, to improve the health informa8 tion technology rating within a timeframe that the Sec9 retary determines appropriate. 

10 ‘‘(g) ENFORCEMENT AUTHORITIES.— 

11 ‘‘(1) IN GENERAL.—The Secretary may assess 

12 fines on any vendor of, or entity offering, certified 

13 health information technology and decertify health 

14 information technology in accordance with para15 graphs (2) and (3). 

16 ‘‘(2) FINES.— 

17 ‘‘(A) IN GENERAL.—The Secretary may 

18 assess fines against such a vendor or entity if 

19 the vendor or entity— 

20 ‘‘(i) does not meet the requirements of 

21 the corrective action plan described in sub22 section (f); 

23 ‘‘(ii) does not improve from a one star 

24 rating in accordance with subsection (f); or 


emcdonald on DSK67QTVN1PROD with BILLS
15 

•S 2141 IS

1 ‘‘(iii) does not report on criteria in ac2 cordance with subsection (e). 

3 ‘‘(B) FINE AMOUNTS.—Not later than 1 

4 year after the date of enactment of the TRUST 

5 IT Act, the Secretary shall establish fine 

6 amounts for violations of clauses (i), (ii), and 

7 (iii) of subparagraph (A). In setting such 

8 amounts, the Secretary shall consider the 

9 amounts necessary to reimburse, in part or in 

10 full, the users of decertified health information 

11 technology for the amounts invested in pur12 chasing new certified health information tech13 nology, as applicable. 

14 ‘‘(3) DECERTIFICATION.—The Secretary may 

15 decertify health information technology if— 

16 ‘‘(A) the health information technology 

17 does not improve from a one star rating within 

18 the timeframe established under subsection (f); 

19 ‘‘(B) does not report on criteria in accord20 ance with subsection (b); or 

21 ‘‘(C) in other circumstances, as the Sec22 retary determines appropriate. 

23 ‘‘(h) GAO REPORTS.—The Comptroller General of 

24 the United States shall submit to Congress a report every 

25 4 years on the rating scale methodology developed pursuVerDate Sep 11 2014 02:18 Oct 08, 2015 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S2141.IS S2141

emcdonald on DSK67QTVN1PROD with BILLS
16 

•S 2141 IS

1 ant to subsection (b), providing observations on the appro2 priateness of the current methodology and recommenda3 tions for changes to the methodology. 

4 ‘‘(i) INTERNET WEBSITE.—The Secretary shall pub5 lish the star rating for each certified health information 

6 technology and methodology to determine the star rating 

7 on the Internet website of the Office of the National Coor8 dinator. Following the biannual reporting described in 

9 subsection (e), authorized certified bodies shall have 30 

10 days to calculate and submit updated ratings to the Sec11 retary, and updated ratings shall be published on such 

12 Internet website not later than 30 days following such sub13 mission. 

14 ‘‘(j) USER COMPENSATION FUND.—The Secretary 

15 shall establish a revolving user compensation fund in 

16 which amounts collected under subsection (g)(2) shall be 

17 directed and used to assist users of health information 

18 technology that are decertified under subsection (g)(3) to 

19 reimburse users for the costs of purchasing new certified 

20 health information technology products. 

21 ‘‘(k) HARDSHIP EXEMPTION.—The Secretary shall, 

22 on a case-by-case basis, exempt an eligible professional, 

23 eligible hospital, or critical access hospital from the appli24 cation of the payment adjustment under the Meaningful 

25 Use of Certified EHR Technology program under sections 


emcdonald on DSK67QTVN1PROD with BILLS
17 

•S 2141 IS

1 1848(a)(7)(A), 1886(b)(3)(B)(ix)(I), and 1814(l)(4), re2 spectively, of the Social Security Act for 1 year if the eligi3 ble professional, eligible hospital, or critical access hospital 

4 uses health information technology that becomes decerti5 fied under subsection (g)(3), to help such eligible profes6 sional, eligible hospital, or critical access hospital transi7 tion to a new certified electronic health record technology. 

8 ‘‘(l) APPEALS.—The Secretary shall establish a proc9 ess whereby any vendor of, or entity offering, health infor10 mation technology can appeal— 

11 ‘‘(1) the health information technology prod12 uct’s star rating; or 

13 ‘‘(2) the Secretary’s decision to decertify a 

14 product, as applicable.’’. 

15 SEC. 5. UPDATING INFORMATION ON ACCESSING PER16 SONAL HEALTH INFORMATION. 

17 Subtitle A of title XXX of the Public Health Service 

18 Act (42 U.S.C. 300jj–11 et seq.), as amended by section 

19 4, is further amended by adding at the end the following: 

20 ‘‘SEC. 3009B. UPDATING INFORMATION ON ACCESSING PER21 SONAL HEALTH INFORMATION. 

22 ‘‘The National Coordinator, in consultation with the 

23 Director of the Office of Civil Rights, shall, as appro24 priate, update the Internet website of the Office with in25 formation to assist individuals in understanding their 


emcdonald on DSK67QTVN1PROD with BILLS
18 

•S 2141 IS

1 rights to access and protect their personal health informa2 tion under the Health Insurance Portability and Account3 ability Act of 1996 (Public Law 104–191), including best 

4 practices for requesting their personal health information 

5 in a computable format and using patient portals, among 

6 other information.’’. 

Æ 


emcdonald on DSK67QTVN1PROD with BILLS