II 

112TH CONGRESS 

2D SESSION S. 3351 

To amend the American Recovery and Reinvestment Act with respect to 

the privacy of protected health information. 

IN THE SENATE OF THE UNITED STATES 

JUNE 27, 2012 

Mr. FRANKEN introduced the following bill; which was read twice and referred 

to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To amend the American Recovery and Reinvestment Act 

with respect to the privacy of protected health information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protect Our Health 

5 Privacy Act’’. 

6 SEC. 2. REPORTING REQUIREMENTS. 

7 (a) NOTIFICATION IN THE CASE OF BREACH.—Para8 graph (2) of section 13402(i) of division A of the Amer9 ican Recovery and Reinvestment Act of 2009 (42 U.S.C. 

10 17932(i)) is amended to read as follows: 


smartinez on DSK6TPTVN1PROD with BILLS
2 

•S 3351 IS

1 ‘‘(2) INFORMATION.—The information de2 scribed in this paragraph regarding breaches speci3 fied in paragraph (1) shall include— 

4 ‘‘(A) the number and nature of all such 

5 breaches, including a description of the types of 

6 unsecured protected health information that 

7 were involved in each breach; 

8 ‘‘(B) the identity of the covered entity in9 volved in each breach, or if the breach affected 

10 less than 500 individuals, the kind of covered 

11 entity involved (such as a health plan, health 

12 care clearinghouse, or a health care provider 

13 who transmits any health information in elec14 tronic form in connection with a transaction 

15 covered by this subtitle); and 

16 ‘‘(C) actions taken in response to such 

17 breaches.’’. 

18 (b) REPORT ON COMPLIANCE.—Section 13424 of di19 vision A of the American Recovery and Reinvestment Act 

20 of 2009 (42 U.S.C. 17954) is amended— 

21 (1) in subsection (a)(1)— 

22 (A) by amending subparagraph (B) to read 

23 as follows: 

24 ‘‘(B) information about such complaints 

25 resolved informally, including— 


smartinez on DSK6TPTVN1PROD with BILLS
3 

•S 3351 IS

1 ‘‘(i) the number of such complaints 

2 resolved informally; 

3 ‘‘(ii) a summary of the types of com4 plaints so resolved, including identification 

5 of the most common types complaints so 

6 resolved, categorized by the privacy and se7 curity rule allegedly violated; 

8 ‘‘(iii) for each such category, the aver9 age amount of time between receipt of a 

10 complaint to resolution of such complaint; 

11 ‘‘(iv) examples, with entity and pa12 tient names and other individually identifi13 able health information redacted, of com14 plaints resolved informally and the Sec15 retary’s rationale for resolving such com16 plaints informally; and 

17 ‘‘(v) the number of covered entities 

18 that received technical assistance from the 

19 Secretary during such year in order to 

20 achieve compliance with such provisions 

21 and the types of such technical assistance 

22 provided.’’; 

23 (B) in subparagraph (E), by inserting 

24 ‘‘and a summary of the outcome of such sub25 poenas or inquiries’’ after ‘‘inquiries issued’’; 


smartinez on DSK6TPTVN1PROD with BILLS
4 

•S 3351 IS

1 (C) in subparagraph (F), by striking ‘‘fol2 lowing year; and’’ and inserting ‘‘following year 

3 and enforcement priorities for the succeeding 

4 year;’’; 

5 (D) in subparagraph (G), by striking the 

6 period at the end and inserting a semicolon; 

7 and 

8 (E) by adding at the end the following: 

9 ‘‘(H) the number of State attorney general 

10 actions that were pursued under this subtitle 

11 and notice of which was provided to the Sec12 retary pursuant to section 1176(d)(4) of the 

13 Social Security Act; and 

14 ‘‘(I) the number of health privacy or health 

15 security or data breach complaints referred to 

16 the Attorney General, including— 

17 ‘‘(i) whether the Attorney General de18 clined enforcement; and 

19 ‘‘(ii) the number of complaints re20 ferred to the Attorney General but re21 turned to the Secretary for enforcement 

22 and a summary of enforcement actions 

23 taken by the Secretary with respect to 

24 such complaints, including informal resolu25 tions, civil monetary penalties, resolution 


smartinez on DSK6TPTVN1PROD with BILLS
5 

•S 3351 IS

1 agreements or settlements, or voluntary 

2 compliance actions.’’; and 

3 (2) by adding at the end the following: 

4 ‘‘(g) ANNUAL STUDIES.— 

5 ‘‘(1) IN GENERAL.—For the first year begin6 ning after the date of enactment of the Protect Our 

7 Health Privacy Act, and every year thereafter, the 

8 Attorney General shall submit to the Committee on 

9 the Judiciary of the Senate and the Committee on 

10 the Judiciary of the House of Representatives a re11 port concerning complaints of alleged violations de12 scribed in section 1177 of the Social Security Act, 

13 including violations of the provisions of this subtitle 

14 relating to privacy and security of health informa15 tion, that were referred to the Department of Jus16 tice by the Department of Health and Human Serv17 ices, the Federal Bureau of Investigation, or another 

18 State or Federal agency during the year for which 

19 the report is being prepared. 

20 ‘‘(2) REQUIREMENTS.—Each report required 

21 under paragraph (1) shall— 

22 ‘‘(A) be made available to the public on the 

23 websites of the Department of Justice and the 

24 Department of Health and Human Services; 

25 and 


smartinez on DSK6TPTVN1PROD with BILLS
6 

•S 3351 IS

1 ‘‘(B) include, with respect to complaints 

2 received during the year for which the report is 

3 being prepared— 

4 ‘‘(i) the total number of complaints 

5 received; 

6 ‘‘(ii) the number of complaints re7 ceived that were eligible for criminal en8 forcement; and 

9 ‘‘(iii) of the complaints described in 

10 clause (ii), a summary of how each com11 plaint was resolved that— 

12 ‘‘(I) includes the rationale for de13 clining enforcement, if applicable; and 

14 ‘‘(II) does not identify the pa15 tients, individuals, or entities in16 volved.’’. 

17 SEC. 3. ENCRYPTION FOR PORTABLE MEDIA. 

18 (a) GUIDANCE REGARDING UNSECURED PROTECTED

19 HEALTH INFORMATION.— 

20 (1) IN GENERAL.—Section 13402(h)(2) of divi21 sion A of the American Recovery and Reinvestment 

22 Act of 2009 (42 U.S.C. 17932(h)(2)) is amended by 

23 inserting ‘‘, including protected health information 

24 stored on portable media (as defined by the Sec25 retary, which shall include thumb drives, laptop comVerDate Mar 15 2010 02:51 Jul 03, 2012 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3351.IS S3351

smartinez on DSK6TPTVN1PROD with BILLS
7 

•S 3351 IS

1 puters, tablet computers, and other similar de2 vices),’’ after ‘‘protected health information’’. 

3 (2) APPLICABLE.—The amendment made by 

4 paragraph (1) shall apply to updated guidance 

5 issued under section 13402(h)(2) of division A of the 

6 American Recovery and Reinvestment Act of 2009 

7 (42 U.S.C. 17932(h)(2)) after the date of enactment 

8 of this Act. 

9 (b) PORTABLE MEDIA ENCRYPTION REQUIRE10 MENT.— 

11 (1) IN GENERAL.—Section 13401 of division A 

12 of the American Recovery and Reinvestment Act of 

13 2009 (42 U.S.C. 17931) is amended by adding at 

14 the end the following: 

15 ‘‘(d) PORTABLE MEDIA ENCRYPTION REQUIRE16 MENT.—Not later than 1 year after the date of enactment 

17 of the Protect Our Health Privacy Act, the Secretary shall 

18 issue regulations to require covered entities and business 

19 associates to render protected health information that is 

20 stored on portable media (as defined by the Secretary, 

21 which shall include thumb drives, laptop computers, tablet 

22 computers, and other similar devices) unusable, 

23 unreadable, or indecipherable to unauthorized individ24 uals.’’. 


smartinez on DSK6TPTVN1PROD with BILLS
8 

•S 3351 IS

1 (2) CONFORMING AMENDMENT.—Section 

2 13401(b) of such Act (42 U.S.C. 17931(b)) is 

3 amended by inserting ‘‘or (d)’’ after ‘‘subsection 

4 (a)’’. 

5 SEC. 4. USE OF DATA IN BUSINESS ASSOCIATE CONTRACTS; 

6 APPLICATION OF MINIMUM NECESSARY 

7 STANDARD TO BUSINESS ASSOCIATES. 

8 (a) IN GENERAL.—Section 13404 of division A of the 

9 American Recovery and Reinvestment Act (42 U.S.C. 

10 17934) is amended by adding at the end the following: 

11 ‘‘(d) USE OF DATA IN BUSINESS ASSOCIATE CON12 TRACTS; APPLICATION OF MINIMUM NECESSARY STAND13 ARD TO BUSINESS ASSOCIATES.— 

14 ‘‘(1) LIMITATION ON SCOPE AND USE OF PRO15 TECTED HEALTH INFORMATION.—As required by 

16 section 164.504(e) of title 45, Code of Regulations 

17 (as in effect on the date of enactment of this sub18 section), any business associate agreement between a 

19 covered entity and a business associate shall limit 

20 the use of protected health information by such busi21 ness associate— 

22 ‘‘(A) to only such information as necessary 

23 for the performance of the service or function 

24 that the covered entity has contracted with the 


smartinez on DSK6TPTVN1PROD with BILLS
9 

•S 3351 IS

1 business associate to perform on behalf of the 

2 covered entity; and 

3 ‘‘(B) to only those uses that are necessary 

4 for the performance of the service or function 

5 described in subparagraph (A). 

6 ‘‘(2) APPLICATION OF MINIMUM NECESSARY

7 STANDARD TO BUSINESS ASSOCIATES.—Section 

8 164.502(b) of title 45, Code of Federal Regulations 

9 shall apply to a business associate of a covered enti10 ty in the same manner that such section applies to 

11 the covered entity. The additional requirements of 

12 this title that relate to the minimum necessary 

13 standard with respect to the use, disclosure, and re14 quest of protected health information that are made 

15 applicable with respect to covered entities shall also 

16 be applicable to such a business associate and shall 

17 be incorporated into the business associate agree18 ment between the business associate and the covered 

19 entity.’’. 

20 (b) CONFORMING AMENDMENT.—Subsection (c) of 

21 such section 13404 (42 U.S.C. 17934) is amended by 

22 striking ‘‘(a) or (b)’’ and inserting ‘‘(a), (b), or (d)(2)’’. 

23 (c) CLARIFICATION.—Nothing in subsection (d)(2) of 

24 section 13404 of division A of the American Recovery and 

25 Reinvestment Act (42 U.S.C. 17934) (as amended by subVerDate Mar 15 2010 02:51 Jul 03, 2012 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3351.IS S3351

smartinez on DSK6TPTVN1PROD with BILLS
10 

•S 3351 IS

1 section (a)) affects the application of the minimum nec2 essary standard to business associates pursuant to section 

3 164.504(e) of title 45, Code of Federal Regulations (relat4 ing to contracts and other arrangements between business 

5 associates and covered entities) as in effect on the date 

6 of enactment of this Act. 

7 SEC. 5. HEALTH INFORMATION TECHNOLOGY IMPROVE8 MENT INITIATIVE. 

9 Title XXX of the Public Health Service Act (42 

10 U.S.C. 300jj et seq.) is amended by adding at the end 

11 the following: 

12 ‘‘SEC. 3022. HEALTH INFORMATION TECHNOLOGY IM13 PROVEMENT INITIATIVE. 

14 ‘‘(a) IN GENERAL.—Not later than 18 months after 

15 the date of enactment of the Protect Our Health Privacy 

16 Act, the Secretary shall issue regulations to improve the 

17 safety, interoperability, and utility of health information 

18 technology systems. 

19 ‘‘(b) CONTENT.—The regulations issued under sub20 section (a) shall include— 

21 ‘‘(1) a system to track the effect of health in22 formation technology on the health of patients; and 

23 ‘‘(2) minimum quality and risk management re24 quirements for health information technology ven25 dors. 


smartinez on DSK6TPTVN1PROD with BILLS
11 

•S 3351 IS

1 ‘‘(c) HEALTH INFORMATION TECHNOLOGY ADVERSE

2 HEALTH EVENT REPORTING.— 

3 ‘‘(1) IN GENERAL.—The Secretary shall des4 ignate an agency within the Department of Health 

5 and Human Services to promulgate regulations re6 lating to a health information technology adverse 

7 health event reporting program and database. The 

8 Department shall consider definitions and standards 

9 developed by the National Quality Forum before 

10 promulgating such regulations. 

11 ‘‘(2) CONTENT.—The regulations promulgated 

12 under paragraph (1) shall include mandatory sub13 mission of adverse health event reports by health in14 formation technology vendors and voluntary submis15 sion of adverse health event reports by users of 

16 health information, including patients and their fam17 ily caregivers. 

18 ‘‘(3) USE OF REPORTS.—The agency designated 

19 under paragraph (1) shall analyze adverse health 

20 event reports and report findings and recommenda21 tions to the applicable industry and policymakers. 

22 ‘‘(4) PROTECTION OF REPORTS.—The agency 

23 designated under paragraph (1) shall remove identi24 fying information if adverse health event reports are 

25 made public. An adverse health event report may not 


smartinez on DSK6TPTVN1PROD with BILLS
12 

•S 3351 IS

1 be admitted or used in any action in a Federal or 

2 State court or any Federal or State administrative 

3 proceeding as evidence of fault, liability, or occur4 rence of an adverse health event. 

5 ‘‘(5) ANNUAL REPORT.—The agency designated 

6 under paragraph (1) shall use the database estab7 lished under such paragraph to submit to Congress 

8 an annual report regarding the use and safety of 

9 health information technology.’’. 

Æ 


smartinez on DSK6TPTVN1PROD with BILLS