I 

110TH CONGRESS 

2D SESSION H. R. 5442 

To provide individuals with access to health information of which they are 

a subject, to ensure personal privacy, security, and confidentiality with 

respect to health related information in promoting the development of 

a nationwide interoperable health information infrastructure, to impose 

criminal and civil penalties for unauthorized use of personal health information, to provide for the strong enforcement of these rights, to protect 

States’ rights, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 14, 2008 

Mr. MARKEY (for himself, Mr. EMANUEL, and Mrs. CAPPS) introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, Education 

and Labor, and Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions 

as fall within the jurisdiction of the committee concerned 

A BILL 

To provide individuals with access to health information of 

which they are a subject, to ensure personal privacy, 

security, and confidentiality with respect to health related 

information in promoting the development of a nationwide interoperable health information infrastructure, to 

impose criminal and civil penalties for unauthorized use 

of personal health information, to provide for the strong 

enforcement of these rights, to protect States’ rights, 

and for other purposes. 


hsrobinson on PROD1PC76 with BILLS
2 

•HR 5442 IH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Technologies for Restoring Users’ Security and Trust in 

6 Health Information Act of 2008’’ or as the ‘‘TRUST in 

7 Health Information Act of 2008’’. 

8 (b) TABLE OF CONTENTS.—The table of contents of 

9 this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Findings; purposes. 

TITLE I—HEALTH INFORMATION PRIVACY AND SECURITY 

Sec. 100. Summary of privacy rights and security obligations. 

Subtitle A—Access to and Accuracy of Personal Health Information 

Sec. 101. Inspection and copying of personal health information. 

Sec. 102. Modifications to personal health information. 

Subtitle B—Security of Personal Health Information 

Sec. 111. Notice of privacy practices. 

Sec. 112. Establishment of safeguards. 

Sec. 113. Notification in the case of breach. 

Sec. 114. Transparency. 

Sec. 115. Risk management. 

Sec. 116. Accounting for disclosures and use. 

Subtitle C—Use and Disclosure of Personal Health Information 

CHAPTER 1—GENERAL RESTRICTIONS

Sec. 121. General rules regarding use and disclosure. 

Sec. 122. Informed consent for disclosure of personal health information for 

treatment and payment. 

Sec. 123. Informed consent and authorization for disclosure of personal health 

information other than for treatment or payment. 

CHAPTER 2—EXCEPTIONS

Sec. 131. Disclosure for law enforcement, national security, and intelligence 

purposes. 

Sec. 132. Disclosure for public health purposes. 

Sec. 133. Reporting of abuse and neglect to protection and advocacy agencies. 

Sec. 134. Disclosure to next of kin and directory information. 


hsrobinson on PROD1PC76 with BILLS
3 

•HR 5442 IH

CHAPTER 3—SPECIAL CIRCUMSTANCES

Sec. 141. Emergency circumstances. 

Sec. 142. Health research. 

Sec. 143. Health oversight functions. 

Sec. 144. Individual representatives. 

Subtitle D—Enforcement 

Sec. 151. In general. 

Sec. 152. Enforcement by State attorneys general. 

Subtitle E—Miscellaneous 

Sec. 161. Office of Health Information Privacy. 

Sec. 162. Protection for whistleblowers. 

Sec. 163. Demonstration grant for individuals with limited English language 

proficiency or limited health literacy. 

Sec. 164. Relationship to other laws. 

Sec. 165. Effective date. 

Subtitle F—General Definitions 

Sec. 171. General definitions. 

TITLE II—PROMOTION OF HEALTH INFORMATION TECHNOLOGY 

Subtitle A—Improving the Interoperability of Health Information Technology 

Sec. 201. Office of the National Coordinator of Health Information Technology. 

Sec. 202. Partnership for Health Care Improvement. 

Sec. 203. American Health Information Community policies. 

Sec. 204. Research access to health care data and reporting on performance. 

Subtitle B—Facilitating the Widespread Adoption of Interoperable Health 

Information Technology 

Sec. 211. Facilitating the widespread adoption of interoperable health information technology. 

Sec. 212. Demonstration program to integrate information technology into clinical education. 

Sec. 213. Qualified health information technology system defined. 

Subtitle C—Improving the Quality of Health Care 

Sec. 221. Fostering development and use of health care quality measures. 

Sec. 222. Adoption and use of quality measures; reporting. 

Subtitle D—Miscellaneous Provisions 

Sec. 231. Health Information Technology Resource Center. 

Sec. 232. Facilitating the provision of telehealth services across State lines. 

Subtitle E—Definitions 

Sec. 241. Definitions. 

TITLE III—ADDITIONAL PROVISIONS 


hsrobinson on PROD1PC76 with BILLS
4 

•HR 5442 IH

Sec. 301. Federal purchasing and data collection by CMS and other Federal 

agencies. 

Sec. 302. Ensuring health care providers participating in the medicare program 

may maintain health information in electronic form. 

1 SEC. 2. FINDINGS; PURPOSES. 

2 (a) FINDINGS.—Congress finds the following: 

3 (1) Americans are deeply concerned about the 

4 privacy and security of their personal information, 

5 including their health records. 

6 (2) In October 2007, a Harris Interactive Poll 

7 commissioned by the Institute of Medicine found 

8 that 58 percent of respondents indicated they do not 

9 believe Federal and State laws and organizational 

10 practices offer sufficient protection of personal 

11 health information. 

12 (3) In February 2007, the Markle Foundation 

13 reported that 80 percent of individuals surveyed 

14 were very concerned about identity theft or fraud 

15 and 77 percent were very concerned that their med16 ical information would be used for marketing pur17 poses. 

18 (4) Concerns about the privacy and security of 

19 personal health information are fueled by the esca20 lating number of breaches of personal information 

21 that have occurred in recent years and numerous re22 ports of the inadequacy of the security of electronic 

23 networks. 


hsrobinson on PROD1PC76 with BILLS
5 

•HR 5442 IH

1 (5) According to the Privacy Rights Clearing2 house, more than 216,000,000 data records belong3 ing to U.S. residents have been exposed to potential 

4 misuse as a result of security breaches since Janu5 ary 2005. 

6 (6) A nationwide interoperable health informa7 tion infrastructure can strengthen privacy, security, 

8 and confidentiality safeguards, protecting patients’ 

9 personal health information while also improving 

10 health care quality, safety, and affordability. 

11 (7) In order for individuals, health care pro12 viders, and health care payers to achieve the benefits 

13 associated with such infrastructure, strong data pri14 vacy, security, and confidentiality standards must be 

15 developed, adopted, and incorporated into the health 

16 information technology infrastructure. 

17 (8) While Executive Order 13335 regarding 

18 interoperable health information technology issued 

19 on April 27, 2004, called for widespread adoption of 

20 interoperable electronic health records within 10 

21 years, established the position of National Coordi22 nator of Health Information Technology, and stipu23 lated that the plan for the nationwide implementa24 tion of interoperable health information technology 

25 should address privacy and security issues, adequate 


hsrobinson on PROD1PC76 with BILLS
6 

•HR 5442 IH

1 progress has not been made to ensure that a strong 

2 data privacy, security, and confidentiality approach 

3 will guide the development of this nationwide infra4 structure beginning in its initial stages and con5 tinuing throughout its formulation. 

6 (9) According to a February 1, 2007, report of 

7 the Government Accountability Office (GAO), the 

8 Department of Health and Human Services and its 

9 Office of the National Coordinator of Health Infor10 mation Technology have not yet defined an overall 

11 approach for integrating privacy-related initiatives 

12 the Department has undertaken in the area of 

13 health information technology or addressing key pri14 vacy principles, nor has the Department defined 

15 milestones for integrating the results of these activi16 ties while it has moved forward with development of 

17 standards for a national electronic health informa18 tion system. 

19 (10) All Americans have a right to privacy, se20 curity, and confidentiality with respect to the elec21 tronic disclosure of their personal health informa22 tion, and the nationwide implementation of inter23 operable health information technology should abide 

24 by, and be consistent with, this right. 


hsrobinson on PROD1PC76 with BILLS
7 

•HR 5442 IH

1 (11) Without adequate privacy, security, and 

2 confidentiality standards, individuals will be more 

3 likely to avoid or delay medical treatment or with4 hold pertinent information from their health pro5 viders, potentially resulting in lost productivity, in6 creased morbidity rates, and increased costs to the 

7 health care system. 

8 (12) As stipulated by the Secretary of Health 

9 and Human Services in the Final Rule for Stand10 ards for Privacy of Individually Identifiable Health 

11 Information (45 C.F.R. parts 160 and 164), the 

12 standards contained in the Final Rule are intended 

13 to establish a floor of privacy protection and are not 

14 designed to serve as ‘‘best practices’’ for the use or 

15 disclosure of personal health information. 

16 (13) To guide the development, implementation, 

17 and operation of an interoperable nationwide health 

18 information technology infrastructure, Congress 

19 should establish specific minimum standards for the 

20 use and disclosure of individuals’ personal health in21 formation and direct the Department of Health and 

22 Human Services to promulgate regulations relating 

23 to personal health information that are consistent 

24 with individuals’ right to privacy, security, and con25 fidentiality with respect to the electronic use or disVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
8 

•HR 5442 IH

1 closure of their personal health information, the 

2 public interest, and the purposes of this Act. 

3 (b) PURPOSE.—The purposes of this Act are as fol4 lows: 

5 (1) To recognize that individuals have a right 

6 to privacy, confidentiality, and security with respect 

7 to health information, including genetic information, 

8 and that those fundamental rights are rooted in the 

9 Nation’s history and medical ethics and must be 

10 protected. 

11 (2) To ensure that individuals are able to exer12 cise their right to health information privacy by re13 quiring their consent for the use and disclosure of 

14 their identifiable health information unless otherwise 

15 required by law. 

16 (3) To encourage the development of a nation17 wide interoperable health information technology in18 frastructure that protects individuals’ privacy, con19 fidentiality, and security with respect to their health 

20 information while also improving health care quality, 

21 promoting data accuracy, reducing medical errors, 

22 and increasing the efficiency of care. 

23 (4) To create incentives to turn personal health 

24 information into de-identified health information (as 

25 defined in section 171(5)), where appropriate. 


hsrobinson on PROD1PC76 with BILLS
9 

•HR 5442 IH

1 (5) To designate an Office of Health Informa2 tion Privacy within the Department of Health and 

3 Human Services to protect individuals’ right of pri4 vacy. 

5 (6) To provide individuals with— 

6 (A) access to health information of which 

7 they are the subject; 

8 (B) the opportunity to challenge the accu9 racy and completeness of such information by 

10 being able to file modifications to or request the 

11 deletion of such information; and 

12 (C) the right to limit the use and disclo13 sure of personal health information. 

14 (7) To establish strong and effective mecha15 nisms to protect against the unauthorized and inap16 propriate use of personal health information and en17 sure that these mechanisms safeguard this informa18 tion wherever it may reside. 

19 (8) To provide notice to individuals of breaches 

20 of their personal health information. 

21 (9) To invoke the sweep of congressional pow22 ers, including the power to enforce the 14th Amend23 ment to the Constitution, to regulate commerce, and 

24 to abrogate the immunity of the States under the 

25 11th Amendment to the Constitution, in order to adVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
10 

•HR 5442 IH

1 dress violations of the rights of individuals to pri2 vacy, to provide individuals with access to their 

3 health information, and to prevent the unauthorized 

4 use of personal health information that is genetic in5 formation. 

6 (10) To establish strong and effective remedies 

7 for violations of this Act. 

8 (11) To protect the rights of States. 

9 TITLE I—HEALTH INFORMATION 

10 PRIVACY AND SECURITY 

11 SEC. 100. SUMMARY OF PRIVACY RIGHTS AND SECURITY 

12 OBLIGATIONS. 

13 (a) PRIVACY RIGHTS.—In order to provide individ14 uals who are the subject of personal health information 

15 with privacy, security, and control in the use and disclo16 sure of such information, such individuals are provided the 

17 following rights under this title: 

18 (1) The right to not have their personal health 

19 information disclosed without their informed consent 

20 unless otherwise required by law, pursuant to sub21 title C. 

22 (2) The right to inspect and copy their personal 

23 health information, pursuant to section 101. 


hsrobinson on PROD1PC76 with BILLS
11 

•HR 5442 IH

1 (3) The right to correct, supplement, or remove 

2 their personal information held by a person, pursu3 ant to section 102. 

4 (4) The right to prohibit access by certain cat5 egories of persons to particularly sensitive personal 

6 health information about individuals, such as infor7 mation relating to mental health, domestic violence, 

8 sexually transmitted diseases, and infection with the 

9 human immunodeficiency virus (HIV), pursuant to 

10 section 122. 

11 (5) The right to receive notification of actual or 

12 suspected security breaches of their personal health 

13 information, pursuant to section 113. 

14 (6) The right to receive an accounting of all 

15 electronic disclosures of their personal health infor16 mation upon request, pursuant to section 116. 

17 (b) SECURITY OBLIGATIONS.—A person that dis18 closes, uses, or receives an individual’s personal health in19 formation has obligations under this title, including the 

20 following: 

21 (1) The obligation to expressly recognize the 

22 right to privacy and security of such individual with 

23 respect to the use and disclosure of such information 

24 under subtitle B. 


hsrobinson on PROD1PC76 with BILLS
12 

•HR 5442 IH

1 (2) The obligation to permit individuals who are 

2 the subject of such personal health information to 

3 inspect and copy the personal health information 

4 concerning the individual pursuant to section 101. 

5 (3) The obligation to provide written notifica6 tion to an individual of the person’s privacy prac7 tices pursuant to section 111. 

8 (4) The obligation to promptly notify individ9 uals of an actual or suspected security breach of 

10 their personal health information pursuant to section 

11 113. 

12 (5) The obligation to establish and maintain ap13 propriate administrative, organizational, technical 

14 and physical safeguards to ensure the privacy, con15 fidentiality, security, accuracy, and integrity of per16 sonal health information that is accessed, main17 tained, modified, recorded, stored, destroyed, or oth18 erwise used or disclosed by such person pursuant to 

19 section 112. 

20 (6) The obligation to make publicly available on 

21 the Internet a list, including contact information, of 

22 each data partner with which the person has entered 

23 into a contract or relationship to provide services in24 volving personal health information pursuant to sec25 tion 114. 


hsrobinson on PROD1PC76 with BILLS
13 

•HR 5442 IH

1 (7) The obligation to obtain an individual’s in2 formed consent or authorization before using or dis3 closing an individual’s personal health information 

4 pursuant to chapter 1 of subtitle C. 

5 (8) The obligation to establish and update risk 

6 management processes to protect against 

7 vulnerabilities to the privacy and security of individ8 ual’s personal health information pursuant to sec9 tions 112 and 114. 

10 (9) The obligation to establish and maintain a 

11 record of each disclosure of an individual’s personal 

12 health information pursuant to section 116. 

13 (10) The obligation to provide individuals with 

14 concise, comprehensive, and explicit information if 

15 seeking to use or disclose their personal health infor16 mation for marketing purposes and receive a sepa17 rate authorization from an individual before using or 

18 disclosing the information for that purpose pursuant 

19 to section 123. 

20 Subtitle A—Access to and Accuracy 

21 of Personal Health Information 

22 SEC. 101. INSPECTION AND COPYING OF PERSONAL 

23 HEALTH INFORMATION. 

24 (a) RIGHT OF INDIVIDUAL.— 


hsrobinson on PROD1PC76 with BILLS
14 

•HR 5442 IH

1 (1) IN GENERAL.—A health information person 

2 (as defined in section 171(13)) shall permit an indi3 vidual who is the subject of personal health informa4 tion (as defined in section 171(23)) that the person 

5 holds, uses, or discloses, or the individual’s designee, 

6 to inspect and copy the personal health information 

7 concerning the individual. 

8 (2) PROCEDURES AND FEES.—A health infor9 mation person may establish appropriate procedures 

10 to be followed for inspection and copying under 

11 paragraph (1) and may require an individual to pay 

12 reasonable fees associated with such inspection and 

13 copying in an amount that is not in excess of the ac14 tual costs of providing such copying. Such fees may 

15 not be assessed where such an assessment would 

16 have the effect of inhibiting an individual from gain17 ing access to the information described in paragraph 

18 (1). 

19 (b) DEADLINE.—A health information person shall 

20 comply with a request for inspection or copying of personal 

21 health information under this section not later than— 

22 (1) 15 business days after the date on which 

23 the person receives the request, if such request re24 quires the inspection, copying, or sending of printed 

25 materials; or 


hsrobinson on PROD1PC76 with BILLS
15 

•HR 5442 IH

1 (2) 5 business days after the date on which the 

2 person receives the request, or sooner if the Sec3 retary determines appropriate, if such request re4 quires only the inspection, copying, or sending of 

5 electronic or other digital materials. 

6 (c) RULES GOVERNING AGENTS.—A person that is 

7 the agent, officer, or employee of a health information per8 son shall provide for the inspection and copying of per9 sonal health information if— 

10 (1) the personal health information is retained 

11 by the person; and 

12 (2) the person has been asked by the health in13 formation person to fulfill the requirements of this 

14 section. 

15 (d) SPECIAL RULE RELATING TO ONGOING CLINICAL

16 TRIALS.—With respect to personal health information 

17 that is created as part of an individual’s voluntary partici18 pation in an ongoing clinical trial, access to the informa19 tion shall be provided within 15 business days after the 

20 date on which the health information person receives the 

21 request or consistent with the individual’s agreement to 

22 participate in the clinical trial, whichever is sooner. 


hsrobinson on PROD1PC76 with BILLS
16 

•HR 5442 IH

1 SEC. 102. MODIFICATIONS TO PERSONAL HEALTH INFOR2 MATION. 

3 (a) IN GENERAL.—Not later than 15 business days, 

4 or earlier if the Secretary determines appropriate, after 

5 the date on which a health information person receives 

6 from an individual a request in writing to supplement, cor7 rect, amend, segregate, or remove personal health infor8 mation that the person holds, uses, or discloses concerning 

9 the individual, such person— 

10 (1) shall, subject to subsections (b) and (c), 

11 modify the information, by adding the requested 

12 supplement, correction, or amendment to the infor13 mation, or by removing any information that has 

14 been requested to be destroyed; 

15 (2) shall inform the individual that the modi16 fication has been made; and 

17 (3) shall make reasonable efforts to inform any 

18 person to which the portion of the unmodified infor19 mation was previously disclosed, of any substantive 

20 modification that has been made. 

21 (b) REFUSAL TO MODIFY.—If a health information 

22 person declines to make the modification requested under 

23 subsection (a) within 15 business days after receipt of 

24 such request, such person shall inform the individual in 

25 writing of— 


hsrobinson on PROD1PC76 with BILLS
17 

•HR 5442 IH

1 (1) the reasons for declining to make the modi2 fication; 

3 (2) any procedures for further review of the de4 clining of such modification; and 

5 (3) the individual’s right to file with the person 

6 a concise statement setting forth the requested 

7 modification and the individual’s reasons for dis8 agreeing with the declining person and the individ9 ual’s right to include a copy of this refusal in the 

10 health record set (as defined in section 171(17)) 

11 concerning the individual. 

12 (c) STATEMENT OF DISAGREEMENT.—If an indi13 vidual has filed with a health information person a state14 ment of disagreement under subsection (b)(3), the person, 

15 in any subsequent disclosure of the disputed portion of 

16 the information— 

17 (1) shall include, at the individual’s request, a 

18 copy of the individual’s statement in the individual’s 

19 health record set; and 

20 (2) may include a concise statement of the rea21 sons for not making the requested modification. 

22 (d) RULES GOVERNING AGENTS.—A person that is 

23 the agent of a health information person shall only be re24 quired to make a modification to personal health informa25 tion where— 


hsrobinson on PROD1PC76 with BILLS
18 

•HR 5442 IH

1 (1) the personal health information is retained, 

2 distributed, used, or maintained by the agent; and 

3 (2) the agent has been asked by such person to 

4 fulfill the requirements of this section. 

5 Subtitle B—Security of Personal 

6 Health Information 

7 SEC. 111. NOTICE OF PRIVACY PRACTICES. 

8 (a) PREPARATION OF WRITTEN NOTICE.—A health 

9 information person shall prepare a written notice of the 

10 privacy practices of such person, including information 

11 with respect to the following: 

12 (1) The express right of an individual to pri13 vacy, security, and confidentiality with respect to the 

14 disclosure of such individual’s personal health infor15 mation. 

16 (2) The procedures for an individual to exercise 

17 that right by authorizing disclosures of personal 

18 health information, and to object to, modify, and re19 voke such authorizations. 

20 (3) The right of an individual to inspect, copy, 

21 and modify that individual’s personal health infor22 mation. 

23 (4) The right of an individual not to have em24 ployment or the receipt of services or choice of 

25 health plan conditioned upon the execution by the 


hsrobinson on PROD1PC76 with BILLS
19 

•HR 5442 IH

1 individual of an authorization for disclosure, except 

2 as permitted by section 122(c). 

3 (5) A description of— 

4 (A) the categories or types of employees, 

5 by general category or by general job descrip6 tion, who have access to or use of personal 

7 health information regarding the individual; 

8 (B) the right of the individual to limit ac9 cess to or use of his or her personal health in10 formation by employees, agents, and contractors 

11 of the person; and 

12 (C) the procedures for effecting such limi13 tations. 

14 (6) A simple, concise description of any infor15 mation systems used to store or transmit personal 

16 health information, including a description of any 

17 linkages made with other networks, systems, or 

18 databases outside the person’s direct control. 

19 (7) The circumstances under which the infor20 mation will be, lawfully and actually, used or dis21 closed without an authorization executed by the indi22 vidual. 

23 (8) A statement that, if an individual elects to 

24 pay for health care from the individual’s own funds, 

25 that individual may elect for personal health inforVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
20 

•HR 5442 IH

1 mation, including any identifying information, not to 

2 be disclosed to anyone other than designated health 

3 care providers, unless such disclosure is required by 

4 mandatory reporting requirements or other similar 

5 information collection duties required by law. 

6 (9) The right of the individual to have contin7 ued maintenance, distribution, or storage of that in8 dividual’s personal health information not condi9 tioned upon whether that individual amends or re10 vokes an authorization for disclosure, or requests a 

11 modification of personal health information. 

12 (10) The right of and procedures for an indi13 vidual to request that personal health information be 

14 transferred to a third party person without unrea15 sonable delay. 

16 (11) The right to prompt notification of an ac17 tual or suspected security breach of personal health 

18 information, and how such breaches will be remedied 

19 by the person. 

20 (12) The right of an individual to inspect and 

21 obtain a copy of records of authorized and unauthor22 ized disclosures as well as attempted and actual ac23 cess and use by an authorized or unauthorized per24 son. 


hsrobinson on PROD1PC76 with BILLS
21 

•HR 5442 IH

1 (13) The right of an individual to exercise non2 disclosure and nonuse rights with respect to their 

3 personal health information, including the right to 

4 opt out of any local, regional, or nationwide health 

5 information network or system that is used by the 

6 person. 

7 (b) PROVISION AND POSTING OF WRITTEN NO8 TICE.— 

9 (1) PROVISION.—A health information person 

10 shall provide in writing a copy of the notice of pri11 vacy practices required under subsection (a)— 

12 (A) at the first contact between the indi13 vidual and the person; and 

14 (B) upon the request of an individual. 

15 (2) POSTING.—A health information person 

16 shall post, in a clear and conspicuous manner, a 

17 brief summary of the privacy practices of the person. 

18 (c) MODEL NOTICE.—The Secretary, in consultation 

19 with the Director of the Office of Health Information Pri20 vacy, after notice and opportunity for public comment, 

21 shall develop and disseminate model notices of privacy 

22 practices, and model summary notices for posting for use 

23 under this section. Use of such model notice shall be 

24 deemed to satisfy the requirements of this section. 


hsrobinson on PROD1PC76 with BILLS
22 

•HR 5442 IH

1 SEC. 112. ESTABLISHMENT OF SAFEGUARDS. 

2 (a) IN GENERAL.—A health information person 

3 shall— 

4 (1) establish and maintain appropriate adminis5 trative, organizational, technical, and physical safe6 guards and procedures to ensure the privacy, con7 fidentiality, security, accuracy, and integrity of per8 sonal health information that is accessed, main9 tained, retained, modified, recorded, stored, de10 stroyed, or otherwise held, used, or disclosed by such 

11 person; and 

12 (2) employ an individual whose responsibilities 

13 include the management of the person’s information 

14 security. 

15 (b) FACTORS TO BE CONSIDERED.—The policies and 

16 safeguards established under subsection (a) shall ensure 

17 that— 

18 (1) personal health information is used or dis19 closed only with informed consent (as defined in sec20 tion 171(19)); 

21 (2) the categories of personnel who will, with 

22 the informed consent of the individual, have access 

23 to personal health information are identified; 

24 (3) the feasibility of limiting access to personal 

25 health information is considered; 


hsrobinson on PROD1PC76 with BILLS
23 

•HR 5442 IH

1 (4) the privacy, security, and confidentiality of 

2 personal health information is maintained; 

3 (5) personal health information is protected 

4 against any reasonably anticipated vulnerabilities to 

5 the privacy, security, or integrity of such informa6 tion; and 

7 (6) personal health information is protected 

8 against unauthorized access, use, or misuse of such 

9 information. 

10 (c) MODEL GUIDELINES.—The Secretary, in con11 sultation with the Director of the Office of Health Infor12 mation Privacy appointed under section 161, after notice 

13 and opportunity for public comment, in accordance with 

14 the requirements of chapter 5 of title 5, United States 

15 Code, shall develop and disseminate model guidelines for 

16 the establishment of safeguards and procedures for use 

17 under this section, such as, where appropriate, individual 

18 authentication of uses of computer systems, access con19 trols, audit trails, encryption or any additional security 

20 methodology or technology other than encryption which 

21 renders data in electronic form unreadable or indecipher22 able, physical security, protection of remote access points 

23 and protection of external electronic communications, peri24 odic security assessments, incident reports, and sanctions. 

25 The Secretary, in consultation with the Director, shall upVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
24 

•HR 5442 IH

1 date and disseminate the guidelines, as appropriate, to 

2 take advantage of new technologies, so as to ensure that 

3 the guidelines emphasize the need for stringent privacy, 

4 security, and confidentiality safeguards and procedures. 

5 (d) REVIEW AND UPDATING OF SAFEGUARDS.—Per6 sons subject to this title shall monitor, evaluate, and ad7 just, as appropriate, all safeguards and procedures, con8 comitant with relevant changes in technology, the sensi9 tivity of personally identifiable information, internal or ex10 ternal threats to personally identifiable information, and 

11 any changes in the contracts or business of the person. 

12 For the purpose of reviewing and updating safeguards, the 

13 Secretary may provide technical assistance to health infor14 mation persons, as appropriate. 

15 SEC. 113. NOTIFICATION IN THE CASE OF BREACH. 

16 (a) IN GENERAL.—A health information person that 

17 accesses, maintains, retains, modifies, records, stores, de18 stroys, or otherwise holds, uses, or discloses personal 

19 health information shall, following the discovery of a secu20 rity breach (as defined in section 171(28)) of such infor21 mation, notify each individual whose personal health infor22 mation has been, or is reasonably believed to have been, 

23 accessed, or acquired during such breach. 

24 (b) OBLIGATION OF OWNER OR LICENSEE.— 


hsrobinson on PROD1PC76 with BILLS
25 

•HR 5442 IH

1 (1) NOTICE TO OWNER OR LICENSEE.—Any 

2 person engaged in interstate commerce, that uses, 

3 accesses, transmits, stores, disposes of, or collects 

4 personal health information that the person does not 

5 own or license shall notify the owner or licensee of 

6 the information following the discovery of a security 

7 breach involving such information. 

8 (2) NOTICE BY OWNER, LICENSEE, OR OTHER

9 DESIGNATED THIRD PARTY.—Nothing in this sub10 title shall be construed to prevent or abrogate an 

11 agreement between a person required to give notice 

12 under this section and a designated third party, in13 cluding an owner or licensee of the personal health 

14 information subject to the security breach, to pro15 vide the notifications required under subsection (a). 

16 (3) PERSON RELIEVED FROM GIVING NOTICE.— 

17 A person obligated to give notice under subsection 

18 (a) shall be relieved of such obligation if an owner 

19 or licensee of the personal health information subject 

20 to the security breach, or other designated third 

21 party, provides such notification. 

22 (c) TIMELINESS OF NOTIFICATION.— 

23 (1) IN GENERAL.—All notifications required 

24 under this section shall be made within 15 business 

25 days, or earlier if the Secretary determines approVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
26 

•HR 5442 IH

1 priate, following the discovery by the person of a se2 curity breach. 

3 (2) BURDEN OF PROOF.—The person required 

4 to provide notification under this section shall have 

5 the burden of demonstrating that all notifications 

6 were made as required under this subtitle, including 

7 evidence demonstrating the necessity of any delay. 

8 (d) METHODS OF NOTICE.—A person described in 

9 subsection (a) shall provide to an individual the following 

10 forms of notice in the case of a security breach: 

11 (1) INDIVIDUAL NOTICE.—Notice required 

12 under this section shall be provided in such form as 

13 the individual selects, including— 

14 (A) written notification to the last known 

15 home mailing address of the individual in the 

16 records of the person; 

17 (B) telephone notice to the individual per18 sonally; or 

19 (C) e-mail notice, if the individual has con20 sented to receive such notice and the notice is 

21 consistent with the provisions permitting elec22 tronic transmission of notices under section 101 

23 of the Electronic Signatures in Global and Na24 tional Commerce Act (15 U.S.C. 7001). 


hsrobinson on PROD1PC76 with BILLS
27 

•HR 5442 IH

1 (2) MEDIA NOTICE.—Notice shall be provided 

2 to prominent media outlets serving a State or juris3 diction, if the personal health information of more 

4 than 500 residents of such State or jurisdiction is, 

5 or is reasonably believed to have been, acquired by 

6 an unauthorized person. 

7 (3) NOTICE TO SECRETARY.—Notice shall be 

8 provided to the Secretary for health information per9 sons that have lost, stolen, disclosed, or used in an 

10 unauthorized manner or for an unauthorized pur11 pose the personal health information of a significant 

12 number of individuals. 

13 (e) CONTENT OF NOTIFICATION.—Regardless of the 

14 method by which notice is provided to individuals under 

15 this section, notice of a security breach shall include, to 

16 the extent possible— 

17 (1) a description of the personal health infor18 mation that has been, or is reasonably believed to 

19 have been, accessed, disclosed, or otherwise used by 

20 an unauthorized person; 

21 (2) a toll-free number that the individual may 

22 use to contact the person described in subsection (a) 

23 to learn what types of personal health information 

24 the person maintained about that individual; and 


hsrobinson on PROD1PC76 with BILLS
28 

•HR 5442 IH

1 (3) toll-free contact telephone numbers and ad2 dresses for major credit reporting agencies. 

3 (f) DELAY OF NOTIFICATION AUTHORIZED FOR LAW

4 ENFORCEMENT PURPOSES.— 

5 (1) IN GENERAL.—If a Federal law enforce6 ment agency determines that the notification re7 quired under this section would impede a criminal 

8 investigation or cause damage to national security, 

9 such notification shall be delayed upon written no10 tice from the Federal law enforcement agency to the 

11 person that experienced the breach. 

12 (2) EXTENDED DELAY OF NOTIFICATION.—If 

13 the notification required under subsection (a) is de14 layed pursuant to paragraph (1), a person shall give 

15 notice not later than 30 days after such law enforce16 ment delay was invoked unless a Federal law en17 forcement agency provides written notification that 

18 further delay is necessary. 

19 SEC. 114. TRANSPARENCY. 

20 (a) PUBLIC LIST OF DATA PARTNERS.— 

21 (1) IN GENERAL.—A health information person 

22 shall establish a list of data partners (as defined in 

23 paragraph (2)) with which such person has entered 

24 into a contract or relationship for the purposes of 

25 providing services involving any personal health inVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
29 

•HR 5442 IH

1 formation held, used, or disclosed by the person. 

2 Such list and the contact information for each part3 ner shall be made publicly accessible on the Internet. 

4 (2) DATA PARTNER DEFINED.—In paragraph 

5 (1), the term ‘‘data partner’’ means a data bank, 

6 data warehouse, information clearinghouse, record 

7 locator system, or other business entity, which for 

8 monetary fees, dues, or on a cooperative nonprofit 

9 basis, engages in the practice of accessing, col10 lecting, maintaining, modifying, storing, recording, 

11 transmitting, destroying, or otherwise using or dis12 closing the personal health information of individ13 uals. Any person maintaining personal health infor14 mation for the purposes of making such information 

15 available to the individual or the health care pro16 vider, including persons furnishing free or paid per17 sonal health records, electronic health records, elec18 tronic medical records, and related products and 

19 services, shall be deemed to be a data partner sub20 ject to the requirements of this title. 

21 (b) SUBCONTRACTING AND OUTSOURCING OVER22 SEAS.—In the event a health information person contracts 

23 with service providers not subject to this title, including 

24 service providers operating in a foreign country, such per25 son shall— 


hsrobinson on PROD1PC76 with BILLS
30 

•HR 5442 IH

1 (1) take reasonable steps to select and retain 

2 third party service providers capable of maintaining 

3 appropriate safeguards for the security, privacy, and 

4 integrity of personal health information; 

5 (2) require by contract that such service pro6 viders implement and maintain appropriate meas7 ures designed to meet the requirements applicable to 

8 health information persons under this title; 

9 (3) be held liable for any violation of this title 

10 by an overseas service provider or other provider not 

11 subject to this title; and 

12 (4) in the case of a service provider operating 

13 in a foreign country, obtain the informed consent of 

14 the individual involved prior to outsourcing such in15 dividual’s personal health information to such pro16 vider. 

17 (c) LIST OF PERSONS.—The Secretary shall maintain 

18 a public list identifying health information persons that 

19 have lost, stolen, disclosed, or used in an unauthorized 

20 manner or for an unauthorized purpose the personal 

21 health information of 1,000 or more individuals. The list 

22 shall include how many individuals were affected by such 

23 action and be displayed on the Web site of the Department 

24 of Health and Human Services. 


hsrobinson on PROD1PC76 with BILLS
31 

•HR 5442 IH

1 SEC. 115. RISK MANAGEMENT. 

2 (a) IN GENERAL.—Each health information person 

3 shall establish risk management and control processes to 

4 protect against anticipated vulnerabilities to the privacy, 

5 security, and integrity of personal health information that 

6 the person accesses, holds, uses, or discloses. 

7 (b) RISK ASSESSMENT.—A health information person 

8 shall perform annual risk assessments of procedures, sys9 tems, or networks involved in the creation, accessing, 

10 maintenance, retention, modification, recording, storage, 

11 distribution, destruction, or other use or disclosure of per12 sonal health information. Such risk assessment shall in13 clude— 

14 (1) identifying reasonably foreseeable internal 

15 and external vulnerabilities that could result in inac16 curacy or in unauthorized access, disclosure, use, or 

17 modification of personal health information, or of 

18 systems containing personal health information; 

19 (2) assessing the likelihood of and potential 

20 damage from inaccuracy or from unauthorized ac21 cess, disclosure, use, or modification of personal 

22 health information; 

23 (3) assessing the sufficiency of policies, tech24 nologies, and safeguards in place to enable compli25 ance with individuals’ informed consent to the ac26 cess, disclosure, use, or modification of their perVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
32 

•HR 5442 IH

1 sonal health information and minimize and control 

2 risks from unauthorized access, disclosure, use, or 

3 modification of individuals’ personal health informa4 tion; and 

5 (4) assessing the vulnerability of personal 

6 health information during destruction and disposal 

7 of such information, including through the disposal 

8 or retirement of hardware. 

9 (c) RISK MANAGEMENT.—A health information per10 son shall establish risk management and control proce11 dures designed to control risks such as those identified 

12 in subsection (b). Such procedures shall include— 

13 (1) a means for the detection and recording of 

14 actual or attempted, unauthorized, fraudulent, or 

15 otherwise unlawful access, disclosure, transmission, 

16 modification, use, or loss of personal health informa17 tion; 

18 (2) procedures for ensuring the secure disposal 

19 of personal health information; 

20 (3) a means for limiting physical access to 

21 hardware, software, data storage technology, servers, 

22 systems, or networks by unauthorized persons in 

23 order to minimize the risk of information disclosure, 

24 modification, transmission, access, use, or loss; 


hsrobinson on PROD1PC76 with BILLS
33 

•HR 5442 IH

1 (4) providing appropriate risk management and 

2 control training for employees; and 

3 (5) carrying out annual testing of such risk 

4 management and control procedures. 

5 SEC. 116. ACCOUNTING FOR DISCLOSURES AND USE. 

6 (a) IN GENERAL.—A health information person shall 

7 establish and maintain, with respect to any personal 

8 health information disclosure, a record of each disclosure 

9 in accordance with regulations promulgated by the Sec10 retary in consultation with the Director of the Office of 

11 Health Information Privacy. Such record shall include the 

12 purpose of any disclosure and the identity of the specific 

13 individual executing the disclosure, as well as the person 

14 to which such information is disclosed. 

15 (b) MAINTENANCE OF RECORD.—A record estab16 lished under subsection (a) shall be maintained for not less 

17 than 6 years. 

18 (c) ELECTRONIC RECORDS.—A health information 

19 person shall, to the maximum extent practicable, maintain 

20 an accessible electronic record concerning each access, use, 

21 or disclosure, whether authorized or unauthorized and 

22 whether successful or unsuccessful, of personal health in23 formation maintained by such person in electronic form. 

24 The record shall include the identities of the specific indi25 viduals (or a way to identify such individuals, or informaVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00033 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
34 

•HR 5442 IH

1 tion helpful in determining the identities of such individ2 uals) who access or seek to gain access to, use or seek 

3 to use, or disclose or seek to disclose, information suffi4 cient to identify the personal health information sought 

5 or accessed, and other appropriate information. 

6 (d) ACCESS TO RECORDS.—A health information per7 son shall permit an individual who is the subject of per8 sonal health information, or the individual’s designee, to 

9 inspect and copy the records created in subsections (a) 

10 and (c). 

11 Subtitle C—Use and Disclosure of 

12 Personal Health Information 

13 CHAPTER 1—GENERAL RESTRICTIONS 

14 SEC. 121. GENERAL RULES REGARDING USE AND DISCLO15 SURE. 

16 (a) PROHIBITION.— 

17 (1) GENERAL RULE.—A person may not dis18 close, access, or use personal health information ex19 cept as authorized under this title. 

20 (2) RULE OF CONSTRUCTION.—Disclosure or 

21 use of health information that meets the standards 

22 of being de-identified health information shall not be 

23 construed as a disclosure or use of personal health 

24 information. 

25 (b) SCOPE OF DISCLOSURE OR USE.— 


hsrobinson on PROD1PC76 with BILLS
35 

•HR 5442 IH

1 (1) IN GENERAL.—A disclosure or use of per2 sonal health information under this subtitle shall be 

3 limited to the minimum amount of information nec4 essary to accomplish the purpose for which the dis5 closure or use is made, such as the individual’s name 

6 and address, date of service, place of service, type of 

7 service, cost of service, and diagnosis. 

8 (2) DETERMINATION.—The determination as to 

9 what constitutes the minimum disclosure or use pos10 sible for purposes of paragraph (1) shall be made by 

11 the individual or entity holding the information. The 

12 minimum necessary standard is intended to be con13 sistent with, and not override, professional judgment 

14 and standards. 

15 (c) USE OR DISCLOSURE FOR PURPOSE ONLY.— 

16 (1) IN GENERAL.—An authorized recipient (as 

17 defined in paragraph (2)) of information pursuant to 

18 this subtitle may use or disclose such information 

19 solely to carry out the purpose for which the infor20 mation was disclosed, except as provided in section 

21 143. 

22 (2) AUTHORIZED RECIPIENT DEFINED.—In 

23 paragraph (1), the term ‘‘authorized recipient’’ 

24 means a person granted the authority by an indi25 vidual, in accordance with this title, to access, mainVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00035 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
36 

•HR 5442 IH

1 tain, retain, modify, record, store, destroy, or other2 wise use the individual’s personal health information 

3 through an authorized disclosure. 

4 (d) NO GENERAL REQUIREMENT TO DISCLOSE.— 

5 Nothing in this subtitle permitting the disclosure of per6 sonal health information shall be construed to require such 

7 disclosure. 

8 (e) IDENTIFICATION OF DISCLOSED INFORMATION AS

9 PERSONAL HEALTH INFORMATION.—Personal health in10 formation disclosed or used pursuant to this subtitle shall 

11 be clearly identified and labeled as personal health infor12 mation that is subject to this title. 

13 (f) DISCLOSURE OR USE BY AGENTS.—An agent, 

14 employee, or affiliate of a health information person that 

15 accesses, seeks to access, obtains, discloses, uses, or re16 ceives personal health information from such person, shall 

17 be subject to this subtitle to the same extent as the person. 

18 (g) DISCLOSURE OR USE BY OTHERS.—A person re19 ceiving personal health information initially held by a per20 son described in subsection (f) shall be subject to this sub21 title to the same extent as the person described in sub22 section (f). 

23 (h) CREATION OF DE-IDENTIFIED INFORMATION.— 

24 Notwithstanding subsection (c), but subject to the other 

25 provisions of this section, a person described in subsection 


hsrobinson on PROD1PC76 with BILLS
37 

•HR 5442 IH

1 (f) may disclose personal health information to an em2 ployee or other agent of the person for purposes of cre3 ating de-identified information. 

4 (i) UNAUTHORIZED USE OR DISCLOSURE OF THE

5 DECRYPTION KEY.—The unauthorized disclosure of a 

6 decryption key (as defined in section 171(7)) or other sec7 ondary or tertiary means for accessing personal health in8 formation shall be deemed for purposes of this subtitle to 

9 be a disclosure of personal health information. The unau10 thorized use of a decryption key (or other secondary or 

11 tertiary means for accessing personal health information) 

12 or de-identified health information in order to identify an 

13 individual is deemed for purposes of this subtitle to be dis14 closure of personal health information. 

15 (j) NO WAIVER.—Except as provided in this title, an 

16 informed consent or other authorization to disclose or use 

17 personally identifiable health information executed by an 

18 individual pursuant to this subtitle shall not be construed 

19 as a waiver of any rights that the individual has under 

20 other Federal or State laws, the rules of evidence, or com21 mon law. 

22 (k) OPT-IN TO NETWORK SHARING.— 

23 (1) IN GENERAL.—Before a health information 

24 person may share personal health information, 

25 through disclosure, access, use, or otherwise, with a 


hsrobinson on PROD1PC76 with BILLS
38 

•HR 5442 IH

1 health information network or system, the individual 

2 must opt in to the sharing of such information with 

3 such network or system. 

4 (2) HEALTH INFORMATION NETWORK OR SYS5 TEM DEFINED.—In this subsection, the term ‘‘health 

6 information network or system’’ means an interoper7 able health information infrastructure consisting of 

8 health information systems and other networks that 

9 connect providers, consumers, and others involved in 

10 supporting health and health care. 

11 (l) DISPOSAL OF DATA.—To prevent the unauthor12 ized disclosure or use of personal health information, such 

13 information, when disposed of, shall be de-identified, de14 stroyed, or expunged from any electronic, paper, or other 

15 files and documents maintained by authorized persons to 

16 make such information permanently unreadable and 

17 undecipherable. 

18 (m) OBLIGATIONS OF UNAUTHORIZED RECIPI19 ENTS.—A person that obtains, accesses, or receives per20 sonal health information and that is an unauthorized re21 cipient of such information may not access, maintain, re22 tain, modify, record, store, destroy, or otherwise use or 

23 disclose such information for any purposes, and use or dis24 closure of personal health information under such cir25 cumstances shall be deemed for purposes of this subtitle 


hsrobinson on PROD1PC76 with BILLS
39 

•HR 5442 IH

1 an unauthorized disclosure of personal health information, 

2 unless the disclosure is for the purpose of informing the 

3 Secretary, law enforcement authorities, or Congress of the 

4 person’s unauthorized receipt of the personal health infor5 mation. 

6 SEC. 122. INFORMED CONSENT FOR DISCLOSURE OF PER7 SONAL HEALTH INFORMATION FOR TREAT8 MENT AND PAYMENT. 

9 (a) REQUIREMENTS RELATING TO EMPLOYERS, 

10 HEALTH PLANS, HEALTH OR LIFE INSURERS, UNIN11 SURED AND SELF-PAY INDIVIDUALS, AND PROVIDERS.— 

12 (1) IN GENERAL.—An employer, health plan, 

13 health or life insurer, or health care provider that 

14 seeks to disclose personal health information in con15 nection with treatment or payment shall obtain in16 formed consent (as defined in section 171(19)) from 

17 the subject of such personal health information that 

18 satisfies the requirements of this section. A single 

19 consent may authorize multiple disclosures. 

20 (2) HEALTH PLANS, HEALTH OR LIFE INSUR21 ERS.—Every health plan or health or life insurer of22 fering enrollment to individual or nonemployer 

23 groups shall, at the time of enrollment in the plan 

24 or insurance, obtain an informed consent for the use 

25 and disclosure of personal health information with 


hsrobinson on PROD1PC76 with BILLS
40 

•HR 5442 IH

1 respect to each individual who is eligible to receive 

2 care or benefits under the plan or insurance. 

3 (3) UNINSURED AND SELF-PAY.—An origi4 nating provider that provides health care in other 

5 than a network plan setting, or provides health care 

6 to an uninsured individual, shall obtain an informed 

7 consent for access to or use of personal health infor8 mation in providing health care or arranging for 

9 health care from other providers or seeking payment 

10 for the provision of health care services. 

11 (4) PROVIDERS.—Every health care provider 

12 that provides health care to an individual that has 

13 not been given the appropriate prior consent under 

14 this section, shall at the time of providing such care, 

15 or at such time as is practicable if services are nec16 essary prior to the opportunity to obtain consent, ob17 tain an informed consent for the use and disclosure 

18 of personal health information with respect to such 

19 individual. 

20 (b) REQUIREMENTS FOR INDIVIDUAL INFORMED

21 CONSENT.—To satisfy the requirements of this sub22 section, an informed consent from an individual to disclose 

23 the individual’s personal health information shall— 

24 (1) identify, by general job description or other 

25 functional description and by geographic location, 


hsrobinson on PROD1PC76 with BILLS
41 

•HR 5442 IH

1 those persons that are authorized to disclose the in2 formation, including entities employed by a person 

3 authorized to disclose the information; 

4 (2) describe the specific nature of the informa5 tion to be disclosed; 

6 (3) identify, by general job description or other 

7 functional description and by geographic location, 

8 those persons to which the information will be dis9 closed, including entities employed by a person to 

10 which information is authorized to be disclosed; 

11 (4) describe the purpose of the disclosures; 

12 (5) permit the executing individual to indicate 

13 that a particular person or class of persons (a group 

14 of persons with similar roles or functions) listed on 

15 the informed consent is not authorized to receive 

16 personal health information concerning the indi17 vidual, except as provided for in subsection (c)(3); 

18 (6) provide the means by which an individual 

19 may indicate that some of the individual’s personal 

20 health information should be segregated and to what 

21 persons or classes of persons such segregated infor22 mation may be disclosed; 

23 (7) be subject to revocation by the individual 

24 and indicate that the informed consent is valid until 


hsrobinson on PROD1PC76 with BILLS
42 

•HR 5442 IH

1 revocation by the individual or until an event or date 

2 specified; 

3 (8)(A) be in writing, dated, and signed by the 

4 individual; and 

5 (B) not have been revoked under subsection (f); 

6 (9) describe the procedure by which an indi7 vidual can amend an informed consent previously ob8 tained by a person; 

9 (10) describe the extent to which the authorized 

10 person will share information with sub-contracted 

11 persons, and the geographic location of sub-con12 tracted persons, including those operating or located 

13 overseas, except that the authorized person shall ob14 tain the informed consent of the individual involved 

15 prior to outsourcing such individual’s personal 

16 health information to a sub-contracted person oper17 ating or located overseas; and 

18 (11) describe the nature and probability of 

19 harm to the individual resulting from the informed 

20 consent for use or disclosure, consistent with the 

21 principle of informed consent. 

22 (c) LIMITATION ON INFORMED CONSENT.— 

23 (1) IN GENERAL.—Subject to paragraphs (2) 

24 and (3), a health information person that seeks in25 formed consent under this subtitle may not condition 


hsrobinson on PROD1PC76 with BILLS
43 

•HR 5442 IH

1 the delivery of treatment or payment for services on 

2 the receipt of such an informed consent. 

3 (2) RIGHT TO REQUIRE SELF-PAYMENT.— 

4 (A) IN GENERAL.—If an individual has re5 fused to provide an informed consent for disclo6 sure of administrative billing information (as 

7 defined in subparagraph (B)) to a person and 

8 such informed consent is necessary for a health 

9 care provider to receive payment for services de10 livered, the health care provider may require 

11 the individual to pay from their own funds for 

12 the services. 

13 (B) ADMINISTRATIVE BILLING INFORMA14 TION.—In subparagraph (A), the term ‘‘admin15 istrative billing information’’ means any of the 

16 following forms of personal health information: 

17 (i) Date of service, policy, patient 

18 identifiers, and practitioner or facility iden19 tifiers. 

20 (ii) Diagnostic codes, in accordance 

21 with medicare billing codes, for which 

22 treatment is being rendered or requested. 

23 (iii) Complexity of service codes, indi24 cating duration of treatment. 

25 (iv) Total billed charges. 


hsrobinson on PROD1PC76 with BILLS
44 

•HR 5442 IH

1 (3) RIGHT OF HEALTH CARE PROVIDER TO RE2 QUIRE INFORMED CONSENT FOR TREATMENT PUR3 POSES.—If a health care provider that is seeking an 

4 informed consent for disclosure of an individual’s 

5 personal health information believes that the disclo6 sure of such information is necessary so as not to 

7 endanger the health or treatment of the individual, 

8 and if the withholding of services will not endanger 

9 the life of the individual, the health care provider 

10 may condition the provision of services upon the in11 dividual’s execution of an informed consent to dis12 close personal health information to the minimum 

13 extent necessary. 

14 (4) INFORMED CONSENTS FOR PAYMENT

15 UNDER CERTAIN CIRCUMSTANCES.—If an individual 

16 is in a physical or mental condition such that the in17 dividual is not capable of authorizing the disclosure 

18 of personal health information and no other arrange19 ments have been made to pay for the health care 

20 services being rendered to the patient, such informa21 tion may be disclosed to a governmental authority to 

22 the extent necessary to determine the individual’s 

23 eligibility for, and to obtain, payment under a gov24 ernmental program for health care services provided 

25 to the patient. The information may also be disVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00044 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
45 

•HR 5442 IH

1 closed to another provider of health care or health 

2 care service plan as necessary to assist the other 

3 provider or health care service plan in obtaining pay4 ment for health care services rendered by that pro5 vider of health care or health care service plan to the 

6 patient. 

7 (d) MODEL INFORMED CONSENT.—The Secretary, in 

8 consultation with the Director of the Office of Health In9 formation Privacy, after notice and opportunity for public 

10 comment in accordance with section 553 of title 5, United 

11 States Code, shall develop and disseminate model written 

12 informed consents of the type described in this section, 

13 which represent informed consent from the subject of such 

14 personal health information that satisfies the require15 ments of this section, and model statements of the limita16 tions on informed consents. Any informed consent ob17 tained on a model informed consent form under this sec18 tion developed by the Secretary pursuant to the preceding 

19 sentence shall be deemed to satisfy the requirements for 

20 an informed consent under this section. 

21 (e) SEGREGATION OF FILES.—A health information 

22 person shall comply with the request of an individual who 

23 is the subject of personal health information— 


hsrobinson on PROD1PC76 with BILLS
46 

•HR 5442 IH

1 (1) to hide, mask, or mark separate any type or 

2 amount of personal health information held by the 

3 person; and 

4 (2) to limit the use or disclosure of the seg5 regated health information within the person to 

6 those specifically designated by the subject of the 

7 personal health information. 

8 (f) REVOCATION OF INFORMED CONSENT.— 

9 (1) IN GENERAL.—An individual may revoke or 

10 amend in writing an informed consent under this 

11 section at any time, unless the disclosure that is the 

12 subject of the consent is required to effectuate pay13 ment for health care that has been provided to the 

14 individual and for which the individual has declined 

15 or refused to pay from the individual’s own funds. 

16 (2) HEALTH PLAN.—With respect to a health 

17 plan, the informed consent of an individual is 

18 deemed to be revoked at the time of the cancellation 

19 or non-renewal of enrollment in the health plan, ex20 cept as may be necessary to complete plan adminis21 tration and payment requirements related to the in22 dividual’s period of enrollment. 

23 (g) RECORD OF INDIVIDUAL’S INFORMED CONSENTS

24 AND REVOCATIONS.—Each person accessing, maintaining, 

25 retaining, modifying, recording, storing, destroying, or 


hsrobinson on PROD1PC76 with BILLS
47 

•HR 5442 IH

1 otherwise using personally identifiable or personal health 

2 information for purposes of treatment or payment shall 

3 maintain a record for a period of 6 years of each informed 

4 consent by an individual and any revocation thereof, and 

5 such record shall become part of the individual’s health 

6 record set. 

7 SEC. 123. INFORMED CONSENT AND AUTHORIZATION FOR 

8 DISCLOSURE OF PERSONAL HEALTH INFOR9 MATION OTHER THAN FOR TREATMENT OR 

10 PAYMENT. 

11 (a) IN GENERAL.—A health information person that 

12 seeks to disclose personal health information for a purpose 

13 other than treatment or payment shall obtain informed 

14 consent. Such consent under this section shall be separate 

15 from an informed consent provided under section 122. 

16 (b) LIMITATION ON AUTHORIZATIONS.—A person 

17 subject to section 122 may not condition the delivery of 

18 treatment, or payment for services, on the receipt of an 

19 informed consent or authorization described in this sec20 tion. 

21 (c) MODEL INFORMED CONSENTS AND AUTHORIZA22 TIONS.—The Secretary, in consultation with the Director 

23 of the Office of Health Information Privacy, after notice 

24 and opportunity for public comment in accordance with 

25 section 553 of title 5, United States Code, shall develop 


hsrobinson on PROD1PC76 with BILLS
48 

•HR 5442 IH

1 and disseminate model informed consents of the type de2 scribed in subsection (a) and written authorizations of the 

3 type described in subsections (d) and (e). Any consent or 

4 authorization obtained on a respective model form shall 

5 be deemed to meet the requirements under the respective 

6 subsection. 

7 (d) REQUIREMENT OF SEPARATE, ADDITIONAL AU8 THORIZATION FOR PERSONNEL DECISIONS.—A health in9 formation person subject to section 122 may not disclose 

10 personal health information to any employees or agents 

11 who are responsible for making employment, work assign12 ment, or other personnel decisions with respect to the sub13 ject of the information without a separate, additional writ14 ten authorization permitting such a disclosure. 

15 (e) REQUIREMENT OF SEPARATE, ADDITIONAL AU16 THORIZATION FOR MARKETING.— 

17 (1) IN GENERAL.—A health information person 

18 may not disclose personal health information for 

19 marketing purposes without a separate, additional 

20 written authorization permitting such a disclosure. 

21 (2) REQUIREMENTS.—In the case of a disclo22 sure of personal health information for marketing 

23 purposes, a separate authorization required by para24 graph (1), to be valid, shall— 


hsrobinson on PROD1PC76 with BILLS
49 

•HR 5442 IH

1 (A) state that one purpose of the disclo2 sure is for ‘‘marketing’’; 

3 (B) state that the purpose of the use or 

4 disclosure involved is marketing; 

5 (C) describe the specific marketing uses 

6 and disclosures authorized, including whether 

7 the personal health information involved— 

8 (i) may be used for purposes internal 

9 to the person; 

10 (ii) may be disclosed to, and used by, 

11 a business associate of the person; and 

12 (iii) may be disclosed to, and used by, 

13 any person or entity other than a business 

14 associate of the person; and 

15 (D) state that the use or disclosure of per16 sonal health information for marketing will di17 rectly result in remuneration to the person from 

18 a third party, in any case in which a person ex19 pects, or reasonably should expect, that such re20 muneration will occur. 

21 (3) MARKETING DEFINED.— 

22 (A) IN GENERAL.—In this subsection, the 

23 term ‘‘marketing’’ is a communication about a 

24 product or service a purpose of which is to en25 courage recipients of the communication to purVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00049 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
50 

•HR 5442 IH

1 chase or use the product or service in return for 

2 direct or indirect compensation. 

3 (B) EXCLUSIONS.— 

4 (i) IN GENERAL.—Subject to clause 

5 (ii), such term excludes the following ex6 ceptions: 

7 (I) Communications made by per8 son for the purpose of describing the 

9 entities participating in a provider 

10 network or health plan network, and 

11 communications made by a person for 

12 the purpose of describing if and the 

13 extent to which a product or service, 

14 or payment for a product or service, is 

15 provided by the person or included in 

16 a benefit plan. 

17 (II) Communications tailored to 

18 the circumstances of a particular indi19 vidual, made by a health care provider 

20 to an individual as part of the treat21 ment of the individual, and for the 

22 purpose of furthering the treatment of 

23 that individual. 

24 (III) Communications tailored to 

25 the circumstances of a particular indiVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00050 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
51 

•HR 5442 IH

1 vidual and made by a health care pro2 vider or health plan to an individual 

3 in the course of managing or coordi4 nating the treatment of that indi5 vidual or for the purpose of directing 

6 or recommending to that individual al7 ternative treatments, therapies, pro8 viders, or settings of care. 

9 (ii) EXCEPTION.—Clause (i) shall not 

10 apply, and a communication shall be con11 sidered marketing, if a person receives di12 rect or indirect remuneration from a third 

13 party for making a written communication 

14 otherwise described in subclause (I), (II), 

15 or (III) of such clause. 

16 (f) REQUIREMENT TO RELEASE PERSONAL HEALTH

17 INFORMATION TO CORONERS AND MEDICAL EXAM18 INERS.— 

19 (1) IN GENERAL.—When a coroner or medical 

20 examiner or their duly appointed deputies seek per21 sonal health information for the purpose of inquiry 

22 into and determination of, the cause, manner, and 

23 circumstances of an individual’s death, the health in24 formation person shall provide that individual’s per25 sonal health information to the coroner or medical 


hsrobinson on PROD1PC76 with BILLS
52 

•HR 5442 IH

1 examiner or to the duly appointed deputies without 

2 undue delay or consent by the deceased individual’s 

3 representative. 

4 (2) PRODUCTION OF ADDITIONAL INFORMA5 TION.—If a coroner or medical examiner or their 

6 duly appointed deputies receives health information 

7 from a person referred to in paragraph (1), such 

8 health information shall remain as personal health 

9 information unless the health information is at10 tached to or otherwise made a part of a coroner’s or 

11 medical examiner’s official report, in which case it 

12 shall no longer be protected. 

13 (3) EXEMPTION.—Health information attached 

14 to or otherwise made a part of a coroner’s or med15 ical examiner’s official report shall be exempt from 

16 the provisions of this title except as provided for in 

17 this subsection. 

18 (4) REIMBURSEMENT.—A person referred to in 

19 paragraph (1) may request reimbursement from a 

20 coroner or medical examiner for the reasonable costs 

21 associated with inspection or copying of personal 

22 health information maintained, retained, or stored 

23 by such person. 

24 (g) REVOCATION OR AMENDMENT OF CONSENT OR

25 AUTHORIZATION.—An individual may revoke or amend in 


hsrobinson on PROD1PC76 with BILLS
53 

•HR 5442 IH

1 writing an informed consent or authorization under this 

2 section at any time. 

3 (h) ACTIONS.—It shall not be a violation of this title 

4 with respect to the disclosure of personal health informa5 tion— 

6 (1) if the disclosure was made based on a good 

7 faith reliance on the individual’s informed consent or 

8 authorization under this section at the time disclo9 sure was made; 

10 (2) in a case in which the consent or authoriza11 tion is revoked, if the disclosing person had no ac12 tual or constructive notice of the revocation; or 

13 (3) if the disclosure was for the purpose of pro14 tecting another individual from imminent physical 

15 harm and is authorized under section 141. 

16 (i) RECORD OF CONSENTS, AUTHORIZATIONS, AND

17 REVOCATIONS.—Each person accessing, maintaining, re18 taining, modifying, recording, storing, destroying, or oth19 erwise using personally identifiable or personal health in20 formation for purposes other than treatment or payment 

21 shall maintain a record for a period of 6 years of each 

22 informed consent and authorization by an individual and 

23 any revocation thereof, and such record shall become part 

24 of the individual’s health record set. 


hsrobinson on PROD1PC76 with BILLS
54 

•HR 5442 IH

1 CHAPTER 2—EXCEPTIONS 

2 SEC. 131. DISCLOSURE FOR LAW ENFORCEMENT, NA3 TIONAL SECURITY, AND INTELLIGENCE PUR4 POSES. 

5 (a) ACCESS TO PERSONAL HEALTH INFORMATION

6 FOR LAW ENFORCEMENT, NATIONAL SECURITY, AND IN7 TELLIGENCE ACTIVITIES.—A health information person, 

8 or a person who receives personal health information pur9 suant to section 131, may disclose personal health infor10 mation to— 

11 (1) an investigative or law enforcement officer 

12 (as defined in subsection (k)) pursuant to a warrant 

13 issued under the Federal Rules of Criminal Proce14 dure, an equivalent State warrant, a grand jury sub15 poena, civil subpoena, civil investigative demand, or 

16 a court order under limitations set forth in sub17 section (b); and 

18 (2) an authorized Federal official for the con19 duct of lawful intelligence, counter-intelligence, and 

20 other national security activities authorized by the 

21 National Security Act (50 U.S.C. 401 et seq.) and 

22 implementing authority (Executive Order 12333), or 

23 otherwise by law. 


hsrobinson on PROD1PC76 with BILLS
55 

•HR 5442 IH

1 (b) LIMITATION ON USE AND DISCLOSURE FOR NA2 TIONAL SECURITY, INTELLIGENCE, AND OTHER LAW EN3 FORCEMENT INQUIRIES.— 

4 (1) IN GENERAL.—Personal health information 

5 about an individual that is disclosed under this sec6 tion may not be used in, or disclosed to any entity 

7 for use in, any administrative, civil, or criminal ac8 tion or investigation directed against the individual, 

9 unless the action or investigation arises out of, or is 

10 directly related to, the law enforcement, national se11 curity, or intelligence inquiry for which the informa12 tion was obtained. 

13 (2) LAW ENFORCEMENT INQUIRY DEFINED.— 

14 In paragraph (1), the term ‘‘law enforcement in15 quiry’’ means a lawful executive branch investigation 

16 or official proceeding inquiring into a violation of, or 

17 failure to comply with, any criminal or civil statute 

18 or any regulation, rule, or order issued pursuant to 

19 such a statute. 

20 (c) REDACTIONS.—To the maximum extent prac21 ticable, and consistent with the requirements of due proc22 ess, a law enforcement agency shall redact personally iden23 tifying information from personal health information prior 

24 to the public disclosure of such protected information in 

25 a judicial or administrative proceeding. 


hsrobinson on PROD1PC76 with BILLS
56 

•HR 5442 IH

1 (d) EXCEPTION.—This section shall not be construed 

2 to limit or restrict the ability of law enforcement authori3 ties to gain information while in hot pursuit of a suspect 

4 or if other exigent circumstances exist. 

5 (e) INVESTIGATIVE OR LAW ENFORCEMENT OFFICER

6 DEFINED.—In this section, the term ‘‘investigative or law 

7 enforcement officer’’ means any officer of the United 

8 States or of a State or political subdivision thereof, who 

9 is empowered by law to conduct investigations of, or to 

10 make arrests for, civil or criminal offenses, and any attor11 ney authorized by law to prosecute or participate in the 

12 prosecution of such offenses. 

13 SEC. 132. DISCLOSURE FOR PUBLIC HEALTH PURPOSES. 

14 (a) IN GENERAL.—A health information person may 

15 disclose personal health information to a public health au16 thority (as defined in section 171(24)) or other entity au17 thorized by public health law, when receipt of such infor18 mation by the authority or other entity— 

19 (1) relates directly to a specified public health 

20 purpose; 

21 (2) is reasonably likely to achieve such purpose; 

22 and 

23 (3) is intended for a purpose that cannot be 

24 achieved through the receipt or use of de-identified 

25 health information. 


hsrobinson on PROD1PC76 with BILLS
57 

•HR 5442 IH

1 (b) PUBLIC HEALTH PROTECTION DEFINED.—For 

2 purposes of subsection (a), the term ‘‘public health pur3 pose’’ means a population-based activity or individual ef4 fort, authorized by law, the purpose of which is the preven5 tion of injury, disease, or premature mortality, or the pro6 motion of health, in a community, including— 

7 (1) assessing the health needs and status of the 

8 community through public health surveillance and 

9 epidemiological research; 

10 (2) implementing public health policy; 

11 (3) responding to public health needs and emer12 gencies; and 

13 (4) any other activities or efforts authorized by 

14 law. 

15 (c) LIMITATIONS.—The purpose of the disclosure de16 scribed in subsection (a) shall be of significant importance 

17 such that it warrants the potential effect on, or risk to, 

18 the privacy of individuals that the additional exposure of 

19 personal health information might bring. Any infringe20 ment on the right to privacy under this section shall use 

21 the least intrusive means that are tailored to minimize in22 trusion on the right to privacy. 


hsrobinson on PROD1PC76 with BILLS
58 

•HR 5442 IH

1 SEC. 133. REPORTING OF ABUSE AND NEGLECT TO PRO2 TECTION AND ADVOCACY AGENCIES. 

3 Any health information person may disclose personal 

4 health information to a protection and advocacy agency 

5 established under part C of title I of the Developmental 

6 Disabilities Assistance and Bill of Rights Act (42 U.S.C. 

7 6041 et seq.) or under the Protection and Advocacy for 

8 Mentally Ill Individuals Act of 1986 (42 U.S.C. 10801 et 

9 seq.) when such person reasonably believes that an indi10 vidual who is the subject of the personal health informa11 tion is vulnerable to abuse and neglect by an entity pro12 viding health or social services to the individual. 

13 SEC. 134. DISCLOSURE TO NEXT OF KIN AND DIRECTORY 

14 INFORMATION. 

15 (a) NEXT OF KIN.—A health care provider, or a per16 son that receives personal health information under sec17 tion 141, may disclose personal health information about 

18 health care services provided to an individual to the indi19 vidual’s next of kin, or to another entity that the indi20 vidual has identified, if at the time of the treatment of 

21 the individual— 

22 (1) the individual— 

23 (A) has been notified of the individual’s 

24 right to object to such disclosure and the indi25 vidual has not objected to the disclosure; or 


hsrobinson on PROD1PC76 with BILLS
59 

•HR 5442 IH

1 (B) is in a physical or mental condition 

2 such that the individual is not capable of object3 ing, and there are no prior indications that the 

4 individual would object; and 

5 (2) the information disclosed is relevant to 

6 health care services currently being provided to that 

7 individual. 

8 (b) DIRECTORY INFORMATION.— 

9 (1) DISCLOSURE.— 

10 (A) IN GENERAL.—Except as provided in 

11 paragraph (2), with respect to an individual 

12 who is admitted as an inpatient to a health care 

13 facility, a person described in subsection (a) 

14 may disclose information described in subpara15 graph (B) about the individual to any entity if, 

16 at the time of the admission, the individual— 

17 (i) has been notified of the individ18 ual’s right to object and has not objected 

19 to the disclosure; or 

20 (ii) is in a physical or mental condi21 tion such that the individual is not capable 

22 of objecting and there are no prior indica23 tions that the individual would object. 


hsrobinson on PROD1PC76 with BILLS
60 

•HR 5442 IH

1 (B) INFORMATION.—Information described 

2 in this subparagraph is information that con3 sists only of 1 or more of the following items: 

4 (i) The name of the individual who is 

5 the subject of the information. 

6 (ii) The general health status of the 

7 individual, described as critical, poor, fair, 

8 stable, or satisfactory or in terms denoting 

9 similar conditions. 

10 (iii) The location of the individual 

11 within the health care facility to which the 

12 individual is admitted. 

13 (2) EXCEPTION.—Paragraph (1)(B)(iii) shall 

14 not apply if disclosure of the location of the indi15 vidual would reveal specific information about the 

16 physical or mental condition of the individual, unless 

17 the individual expressly authorizes such disclosure. 

18 (c) DIRECTORY OR NEXT-OF-KIN INFORMATION.—A 

19 disclosure may not be made under this section if the dis20 closing person described in subsection (a) has reason to 

21 believe that the disclosure of directory or next-of-kin infor22 mation could lead to the physical or mental harm of the 

23 individual, unless the individual expressly authorizes such 

24 disclosure. 


hsrobinson on PROD1PC76 with BILLS
61 

•HR 5442 IH

1 CHAPTER 3—SPECIAL CIRCUMSTANCES 

2 SEC. 141. EMERGENCY CIRCUMSTANCES. 

3 (a) GENERAL RULE.—In the event of a threat of im4 minent physical or mental harm to the subject of personal 

5 health information, any person may, in order to allay or 

6 remedy such threat, disclose personal health information 

7 about such subject to a health care provider, health care 

8 facility, law enforcement authority, or emergency medical 

9 personnel, to the minimum extent necessary and only if 

10 determined appropriate by a health care provider. 

11 (b) HARM TO OTHERS.—Any person may disclose 

12 personal health information about the subject of the infor13 mation where— 

14 (1) such subject has made an identifiable threat 

15 of serious injury or death with respect to an identifi16 able individual or group of individuals; 

17 (2) the subject has the ability to carry out such 

18 threat; and 

19 (3) the release of such information is necessary 

20 to prevent or significantly reduce the possibility of 

21 such threat being carried out. 

22 SEC. 142. HEALTH RESEARCH. 

23 (a) REGULATIONS.— 

24 (1) IN GENERAL.—The requirements and pro25 tections provided for under part 46 of title 45, Code 


hsrobinson on PROD1PC76 with BILLS
62 

•HR 5442 IH

1 of Federal Regulations (as in effect on the date of 

2 enactment of this Act), shall apply to all health re3 search. 

4 (2) EFFECTIVE DATE.—Paragraph (1) shall not 

5 take effect until the Secretary has promulgated final 

6 regulations to implement such paragraph. 

7 (b) EVALUATION.—Not later than 24 months after 

8 the date of the enactment of this Act, the Secretary shall 

9 prepare and submit to Congress detailed recommendations 

10 on whether informed consent should be required, and if 

11 so, under what circumstances, before personal health in12 formation can be used for health research. 

13 (c) RECOMMENDATIONS.—The recommendations re14 quired to be submitted under subsection (b) shall in15 clude— 

16 (1) a detailed explanation of current institu17 tional review board practices, including the extent to 

18 which the privacy of individuals is taken into ac19 count as a factor before allowing waivers and under 

20 what circumstances informed consent is being 

21 waived; 

22 (2) a list of all known breaches of health infor23 mation privacy over the past 5 years in research 

24 projects approved by an institutional review board; 


hsrobinson on PROD1PC76 with BILLS
63 

•HR 5442 IH

1 (3) a summary of how technology that both fa2 cilitates research and preserves privacy could be 

3 used to obtain informed consent and strip identi4 fying data for the purpose of research; 

5 (4) an analysis of State and Federal laws, med6 ical ethics, and ethics in the performance of health 

7 research that examines requirements for the receipt 

8 of informed consent; and 

9 (5) an analysis of the risks and benefits of al10 lowing individuals to consent or to refuse to consent, 

11 at the time of receiving medical treatment, to the 

12 possible future use of records of medical treatments 

13 for research studies. 

14 (d) CONSULTATION.—In carrying out this section, 

15 the Secretary shall consult with individuals who have dis16 tinguished themselves in the fields of health research, pri17 vacy, related technology including electronic consent man18 agement tools, consumer interests in health information, 

19 health data standards, and the provision of health services. 

20 (e) CONGRESSIONAL NOTICE.—Not later than 6 

21 months after the date on which the Secretary submits to 

22 Congress the recommendations required under subsection 

23 (b), the Secretary shall propose to implement such rec24 ommendations through regulations promulgated on the 


hsrobinson on PROD1PC76 with BILLS
64 

•HR 5442 IH

1 record after opportunity for a hearing, and shall advise 

2 the Congress of such proposal. 

3 (f) OTHER REQUIREMENTS.— 

4 (1) OBLIGATIONS OF THE RECIPIENT.—A per5 son who receives personal health information pursu6 ant to this section shall remove or destroy, at the 

7 earliest opportunity consistent with the purposes of 

8 the project involved, information that would enable 

9 an individual to be identified, unless— 

10 (A) an institutional review board has de11 termined that there is a health or research jus12 tification for the retention of such identifiers; 

13 (B) an institutional review board has, to 

14 the maximum extent practicable, attempted to 

15 contact the individual to whom the identifiers 

16 relate; 

17 (C) upon being contacted pursuant to sub18 paragraph (B), the individual does not object to 

19 the retention of such identifiers; and 

20 (D) there is an adequate plan to protect 

21 the identifiers from disclosure consistent with 

22 this section. 

23 (2) PERIODIC REVIEW AND TECHNICAL ASSIST24 ANCE.— 


hsrobinson on PROD1PC76 with BILLS
65 

•HR 5442 IH

1 (A) INSTITUTIONAL REVIEW BOARD.—Any 

2 institutional review board that authorizes re3 search under this section shall provide the Sec4 retary with the names and addresses of the in5 stitutional review board members. 

6 (B) TECHNICAL ASSISTANCE.—The Sec7 retary shall provide technical assistance to insti8 tutional review boards described in this sub9 section. 

10 (C) MONITORING.—The Secretary shall pe11 riodically monitor institutional review boards 

12 described in this subsection, including with re13 spect to the privacy, security, and confiden14 tiality practices of such boards. 

15 (D) REPORTS.—Not later than 3 years 

16 after the date of enactment of this Act, the Sec17 retary shall report to Congress regarding the 

18 activities of institutional review boards de19 scribed in this subsection. 

20 (g) LIMITATION.—Nothing in this section shall be 

21 construed to permit personal health information that is 

22 received by a researcher under this section to be accessed 

23 for purposes other than research or as authorized by the 

24 individual that is the subject of such personal health infor25 mation. 


hsrobinson on PROD1PC76 with BILLS
66 

•HR 5442 IH

1 SEC. 143. HEALTH OVERSIGHT FUNCTIONS. 

2 (a) IN GENERAL.—A health information person may 

3 disclose personal health information to a health oversight 

4 agency (as defined in section 171(16)) to enable the agen5 cy to perform a health oversight function authorized by 

6 law, if— 

7 (1) the purpose for which the disclosure is to be 

8 made cannot reasonably be accomplished without 

9 personal health information; 

10 (2) the purpose for which the disclosure is to be 

11 made is of sufficient importance to warrant the ef12 fect on, or the risk to, the privacy of the individuals 

13 that additional exposure of the information might 

14 bring; and 

15 (3) there is a reasonable probability that the 

16 purpose of the disclosure will be accomplished. 

17 (b) USE AND MAINTENANCE OF PERSONAL HEALTH

18 INFORMATION.—A health oversight agency that receives 

19 personal health information under subsection (a)— 

20 (1) shall, to the maximum extent practicable, 

21 obtain the informed consent of the individual to 

22 whom the personal health information relates before 

23 using or disclosing the information; 

24 (2) shall secure personal health information in 

25 all work papers and all documents summarizing the 

26 health oversight activity through technological, adVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00066 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
67 

•HR 5442 IH

1 ministrative, and physical safeguards including cryp2 tographic-key based encryption; 

3 (3) shall maintain in its records only such infor4 mation about an individual as is relevant and nec5 essary to accomplish the purpose for which the per6 sonal health information was obtained; 

7 (4) using appropriate encryption measures, 

8 shall maintain such information securely and limit 

9 access to such information to those persons with a 

10 legitimate need for access to carry out the purpose 

11 for which the records were obtained; and 

12 (5) shall remove or destroy the information that 

13 allows subjects of personal health information to be 

14 identified at the earliest time at which removal or 

15 destruction can be accomplished, consistent with the 

16 purpose of the health oversight activity. 

17 (c) AUTHORIZATION BY A SUPERVISOR.—For pur18 poses of this section, the individual with authority to au19 thorize the oversight function involved shall provide to the 

20 disclosing person described in subsection (a) a statement 

21 that the personal health information is being sought for 

22 a legally authorized oversight function. 

23 SEC. 144. INDIVIDUAL REPRESENTATIVES. 

24 (a) IN GENERAL.—Except as provided in subsections 

25 (b) and (c), a person who is authorized by law (based on 


hsrobinson on PROD1PC76 with BILLS
68 

•HR 5442 IH

1 grounds other than an individual’s status as a minor), or 

2 by an instrument recognized under law, to act as an agent, 

3 attorney, proxy, or other legal representative of an indi4 vidual, may, to the extent so authorized, exercise and dis5 charge the rights of the individual under this title. 

6 (b) HEALTH CARE POWER OF ATTORNEY.—A person 

7 who is authorized by law (based on grounds other than 

8 being a minor), or by an instrument recognized under law, 

9 to make decisions about the provision of health care to 

10 an individual who is incapacitated, may exercise and dis11 charge the rights of the individual under this title to the 

12 extent necessary to effectuate the terms or purposes of 

13 the grant of authority. 

14 (c) INDIVIDUALS SUFFERING FROM CERTAIN MED15 ICAL CONDITIONS.—If a physician or other health care 

16 provider determines that an individual, who has not been 

17 declared to be legally incompetent, suffers from a medical 

18 condition that prevents the individual from acting know19 ingly or effectively on the individual’s own behalf, the right 

20 of the individual to access or amend the health informa21 tion and to authorize disclosure under this title may be 

22 exercised and discharged in the best interest of the indi23 vidual by— 

24 (1) a person described in subsection (b) with re25 spect to the individual; 


hsrobinson on PROD1PC76 with BILLS
69 

•HR 5442 IH

1 (2) a person described in subsection (a) with re2 spect to the individual, but only if a person de3 scribed in paragraph (1) cannot be contacted after 

4 a reasonable effort or if there is no individual who 

5 fits the description in paragraph (1); 

6 (3) the next of kin of the individual, but only 

7 if a person described in paragraph (1) or (2) cannot 

8 be contacted after a reasonable effort; or 

9 (4) the health care provider, but only if a per10 son described in paragraph (1), (2), or (3) cannot be 

11 contacted after a reasonable effort. 

12 (d) RIGHTS OF MINORS.— 

13 (1) INDIVIDUALS WHO ARE 18 OR LEGALLY CA14 PABLE.—In the case of an individual— 

15 (A) who is 18 years of age or older, all 

16 rights of the individual under this title shall be 

17 exercised by the individual; or 

18 (B) who, acting alone, can consent to 

19 health care without violating any applicable law, 

20 and who has sought such care, the individual 

21 shall exercise all rights of an individual under 

22 this title with respect to personal health infor23 mation relating to such health care. 


hsrobinson on PROD1PC76 with BILLS
70 

•HR 5442 IH

1 (2) INDIVIDUALS UNDER 18.—Except as pro2 vided in paragraph (1)(B), in the case of an indi3 vidual who is— 

4 (A) under 14 years of age, all of the indi5 vidual’s rights under this title shall be exercised 

6 through the parent or legal guardian; or 

7 (B) 14 through 17 years of age, the rights 

8 of inspection, supplementation, and modifica9 tion, and the right to authorize use and disclo10 sure of personal health information of the indi11 vidual shall be exercised by— 

12 (i) the individual where no parent or 

13 legal guardian exists; 

14 (ii) the parent or legal guardian of the 

15 individual; or 

16 (iii) the individual if the parent or 

17 legal guardian determined that the indi18 vidual has the sole right the control their 

19 health information. 

20 (e) DECEASED INDIVIDUALS.— 

21 (1) APPLICATION OF ACT.—The provisions of 

22 this title shall continue to apply to personal health 

23 information concerning a deceased individual. 

24 (2) EXERCISE OF RIGHTS ON BEHALF OF A DE25 CEASED INDIVIDUAL.—A person who is authorized 


hsrobinson on PROD1PC76 with BILLS
71 

•HR 5442 IH

1 by law or by an instrument recognized under law, to 

2 act as an executor or administrator of the estate of 

3 a deceased individual, or otherwise to exercise the 

4 rights of the deceased individual, may, to the extent 

5 so authorized, exercise and discharge the rights of 

6 such deceased individual under this title. If no such 

7 designee has been authorized, the rights of the de8 ceased individual may be exercised as provided for in 

9 subsection (c). 

10 (3) IDENTIFICATION OF DECEASED INDI11 VIDUAL.—A person described in section 136(a) may 

12 disclose personal health information if such disclo13 sure is necessary to assist in the identification of a 

14 deceased individual. 

15 Subtitle D—Enforcement 

16 SEC. 151. IN GENERAL. 

17 (a) CIVIL PENALTY.—A health information person 

18 who the Secretary, in consultation with the Attorney Gen19 eral, determines has substantially and materially failed to 

20 comply with this title shall be subject, in addition to any 

21 other penalties that may be prescribed by law— 

22 (1) in a case in which the violation relates to 

23 subtitle A, B, or C, to a civil penalty of not more 

24 than $500 for each such violation, but not to exceed 

25 $5,000 in the aggregate for multiple violations; 


hsrobinson on PROD1PC76 with BILLS
72 

•HR 5442 IH

1 (2) in a case in which the violation relates to 

2 subtitle A, B, or C, to a civil penalty of not more 

3 than $10,000 for each such violation, but not to ex4 ceed $50,000 in the aggregate for multiple viola5 tions; or 

6 (3) in a case in which such violations have oc7 curred with such frequency as to constitute a gen8 eral business practice, to a civil penalty of not more 

9 than $100,000. 

10 (b) CIVIL ACTION BY INDIVIDUALS.— 

11 (1) IN GENERAL.—Any individual whose rights 

12 under subtitle A, B, or C have been knowingly or 

13 negligently violated may bring a civil action to re14 cover— 

15 (A) such preliminary and equitable relief 

16 as the court determines to be appropriate; and 

17 (B) the greater of compensatory damages 

18 or liquidated damages of $5,000. 

19 (2) ADDITIONAL REMEDIES.—The equitable re20 lief or damages that may be available under this sec21 tion shall be in addition to any other lawful remedy 

22 or award that may be available. 

23 SEC. 152. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

24 (a) CIVIL ACTIONS.—In any case in which the attor25 ney general of a State or any State or local law enforceVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00072 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
73 

•HR 5442 IH

1 ment agency authorized by the State attorney general or 

2 by State law to prosecute violations of consumer protec3 tion laws, has reason to believe that an interest of the resi4 dents of that State has been or is threatened or adversely 

5 affected by the engagement of a person in a practice that 

6 is prohibited under subtitle A, B, or C, the State or local 

7 law enforcement agency on behalf of the residents of the 

8 agency’s jurisdiction, may bring a civil action on behalf 

9 of the residents of the State or jurisdiction in a district 

10 court of the United States of appropriate jurisdiction to— 

11 (1) enjoin that act or practice; 

12 (2) enforce compliance with the respective sub13 title; or 

14 (3) obtain civil penalties in an amount cal15 culated by multiplying the number of violations by 

16 an amount not greater than $11,000. 

17 For purposes of civil penalties under this subsection, each 

18 day that a person is in violation of the requirements of 

19 subtitle A, B, or C shall be treated as a separate violation, 

20 up to a maximum civil penalty of $5,000,000. 

21 (b) RULE OF CONSTRUCTION.—For purposes of 

22 bringing any civil action under subsection (a), nothing in 

23 this subtitle regarding notification shall be construed to 

24 prevent an attorney general of a State from exercising the 


hsrobinson on PROD1PC76 with BILLS
74 

•HR 5442 IH

1 powers conferred on such attorney general by the laws of 

2 that State to— 

3 (1) conduct investigations; 

4 (2) administer oaths or affirmations; or 

5 (3) compel the attendance of witnesses or the 

6 production of documentary and other evidence. 

7 (c) VENUE; SERVICE OF PROCESS.— 

8 (1) VENUE.—Any action brought under sub9 section (a) may be brought in the district court of 

10 the United States that meets applicable require11 ments relating to venue under section 1391 of title 

12 28, United States Code. 

13 (2) SERVICE OF PROCESS.—In an action 

14 brought under subsection (a), process may be served 

15 in any district in which the defendant— 

16 (A) is an inhabitant; or 

17 (B) may be found. 

18 Subtitle E—Miscellaneous 

19 SEC. 161. OFFICE OF HEALTH INFORMATION PRIVACY. 

20 (a) IN GENERAL.—The Secretary shall designate an 

21 office within the Department of Health and Human Serv22 ices to be known as the Office of Health Information Pri23 vacy (referred to in this section as the ‘‘Office’’). The Of24 fice shall be headed by a Director, who shall be appointed 

25 by the Secretary. 


hsrobinson on PROD1PC76 with BILLS
75 

•HR 5442 IH

1 (b) DUTIES.—The Director of the Office shall— 

2 (1) receive and investigate complaints of alleged 

3 violations of this title; 

4 (2) provide for the conduct of audits where ap5 propriate; 

6 (3) provide guidance to the Secretary on the 

7 implementation of this Act; 

8 (4) provide guidance to health care providers 

9 and other relevant individuals concerning the man10 ner in which to interpret and implement the privacy 

11 protections under this title (and the regulations pro12 mulgated under this title); 

13 (5) prepare and submit the report described in 

14 subsection (c); 

15 (6) consult with, and provide recommendation 

16 to, the Secretary concerning improvements in the 

17 privacy and security of personal health information 

18 and concerning medical privacy research needs; and 

19 (7) carry out any other activities determined 

20 appropriate by the Secretary. 

21 (c) STANDARDS FOR CERTIFICATION.— 

22 (1) ESTABLISHMENT.—Not later than 12 

23 months after the date of enactment of this Act, the 

24 Secretary, in consultation with the Director of the 

25 Office and the Director of the Office of Civil Rights, 


hsrobinson on PROD1PC76 with BILLS
76 

•HR 5442 IH

1 shall establish and implement standards for health 

2 information technology products, including qualified 

3 health information technology systems (as defined in 

4 section 213), used to access, disclose, maintain, 

5 store, distribute, transmit, amend, or dispose of per6 sonal health information in a manner that protects 

7 the individual’s right to privacy, confidentiality, and 

8 security relating to that information. 

9 (2) STAKEHOLDER PARTICIPATION.—In estab10 lishing the standards under paragraph (1), the Sec11 retary shall ensure the participation of various 

12 stakeholders, including patients and consumer advo13 cates, privacy advocates, experts in information tech14 nology and information systems, and experts in 

15 health care. The Secretary shall ensure that these 

16 advocates and experts are equally represented, such 

17 that the stakeholder process does not result in the 

18 experts in information technology, information sys19 tems, and health care being disproportionately rep20 resented compared to advocates for the interests of 

21 consumers and privacy proponents. 

22 (d) REPORT ON COMPLIANCE.—Not later than Janu23 ary 1 of the first calendar year beginning more than 1 

24 year after the establishment of the Office under subsection 

25 (a), and every January 1 thereafter, the Secretary, in conVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00076 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
77 

•HR 5442 IH

1 sultation with the Director of the Office, shall prepare and 

2 submit to Congress a report concerning the number of 

3 complaints of alleged violations of subtitle A that are re4 ceived during the year for which the report is being pre5 pared. Such report shall describe the complaints and any 

6 remedial action taken concerning such complaints and 

7 shall be made available to the public on the Internet 

8 website of the Department of Health and Human Services. 

9 SEC. 162. PROTECTION FOR WHISTLEBLOWERS. 

10 (a) PROHIBITION AGAINST DISCRIMINATION.—A 

11 health information person may not— 

12 (1) discharge, demote, suspend, threaten, har13 ass, retaliate against, or in any other manner dis14 criminate or cause any employer to discriminate 

15 against an employee in the terms and conditions of 

16 employment because of— 

17 (A) the refusal of the employee to engage 

18 in a violation of this title; or 

19 (B) any lawful act the employee has com20 mitted or is about to commit, or which the 

21 health information person perceives the em22 ployee to have committed, to provide informa23 tion or cause information to be provided, in24 cluding in the course of the employee’s routine 

25 job duties, to the individual’s employer or to a 


hsrobinson on PROD1PC76 with BILLS
78 

•HR 5442 IH

1 State or Federal official relating to an actual or 

2 suspected violation of this title by any person, 

3 including an employer or an employee of an em4 ployer; or 

5 (2) adversely affect another person, directly or 

6 indirectly, because such person has exercised a right 

7 under this title, disclosed information relating to a 

8 possible violation of subtitle A, B, or C or this sec9 tion, or associated with, or assisted, an individual in 

10 the exercise of a right under this title. 

11 (b) ENFORCEMENT ACTIONS.— 

12 (1) IN GENERAL.— 

13 (A) COMPLAINT WITH SECRETARY OF

14 LABOR.—Any employee or former employee who 

15 alleges a violation of subsection (a) may seek 

16 relief under subsection (c), by filing a complaint 

17 with the Secretary of Labor. 

18 (B) APPELLATE REVIEW IN CASE OF

19 FINAL ORDER.—Unless an employee brings an 

20 action in district court under subparagraph (C), 

21 any person adversely affected or aggrieved by a 

22 final order of the Secretary of Labor with re23 spect to a complaint filed under subparagraph 

24 (A) may obtain review of the order in the 

25 United States court of appeals for the circuit in 


hsrobinson on PROD1PC76 with BILLS
79 

•HR 5442 IH

1 which the violation, with respect to which the 

2 order was issued, allegedly occurred or the cir3 cuit in which the complainant resided on the 

4 date of such violation. The petition for review 

5 must be filed not later than 60 days after the 

6 date of the issuance of the final order. The re7 view shall conform to chapter 7 of title 5, 

8 United States Code. The commencement of pro9 ceedings under this subparagraph shall not, un10 less ordered by the court, operate as a stay of 

11 the order. 

12 (C) DE NOVO REVIEW.—If the Secretary of 

13 Labor has not issued a final decision within 

14 180 days after the filing of the complaint, or 

15 within 90 days after receiving any written de16 termination, the complainant may bring an ac17 tion at law or equity for de novo review in the 

18 appropriate district court of the United States 

19 with jurisdiction, which shall have jurisdiction 

20 over such an action without regard to the 

21 amount in controversy, and which action shall, 

22 at the request of either party to such action, be 

23 tried by the court with a jury. 

24 (2) PROCEDURES.— 


hsrobinson on PROD1PC76 with BILLS
80 

•HR 5442 IH

1 (A) IN GENERAL.—Except as provided in 

2 this paragraph, the complaint procedures con3 tained in section 42121(b) of title 49, United 

4 States Code, shall apply with respect to a com5 plaint filed under paragraph (1)(A). 

6 (B) EXCEPTION.—With respect to a com7 plaint filed under paragraph (1)(A), the notifi8 cation provided for under section 42121(b)(1) 

9 of title 49, United States Code, (as required 

10 under subparagraph (A)) shall be made to the 

11 person named in the complaint and to the em12 ployer. 

13 (C) BURDEN OF PROOF.—The legal bur14 dens of proof contained in section 42121(b) of 

15 title 49, United States Code, shall apply to any 

16 action brought under this subsection. 

17 (D) STATUTE OF LIMITATIONS.—A com18 plaint shall be filed under paragraph (1)(A) not 

19 later than 2 years after the date on which the 

20 alleged violation occurs. 

21 (E) CIVIL ACTIONS TO ENFORCE.—If a 

22 person fails to comply with an order issued by 

23 the Secretary of Labor pursuant to the proce24 dures in section 42121(b) of title 49, United 

25 States Code, the Secretary shall have the auVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00080 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
81 

•HR 5442 IH

1 thority described in section 42121(b)(5) of title 

2 49, United States Code, to bring a civil action 

3 to enforce the order in the district court of the 

4 United States for the judicial district in which 

5 the violation occurred. 

6 (c) REMEDIES.— 

7 (1) IN GENERAL.—If the Secretary of Labor or 

8 the district court determines that a violation of sub9 section (a) has occurred, the Secretary or court shall 

10 order any relief necessary to make the employee 

11 whole. 

12 (2) COMPENSATORY DAMAGES.—Relief in any 

13 action under such subsection shall include— 

14 (A) reinstatement of the employee to the 

15 employee’s former position with the same se16 niority status that the employee would have had 

17 but for the discrimination; 

18 (B) payment of the amount of back pay, 

19 with interest, to which the employee is entitled; 

20 and 

21 (C) the payment of compensation for any 

22 special damages sustained by the employee as a 

23 result of the discrimination, including litigation 

24 costs, expert witness fees, and reasonable attor25 ney fees. 


hsrobinson on PROD1PC76 with BILLS
82 

•HR 5442 IH

1 (3) PUNITIVE DAMAGES.—Relief in any action 

2 under such subsection may include punitive damages 

3 in an amount not to exceed $250,000. 

4 (d) RIGHTS RETAINED BY THE EMPLOYEE.—Noth5 ing in this section shall be construed to diminish or elimi6 nate the rights, privileges, or remedies available to an em7 ployee under any Federal or State law, or under any col8 lective bargaining agreement. 

9 (e) LIMITATION.—The protections of this section 

10 shall not apply to any employee who— 

11 (1) deliberately causes or participates in the al12 leged violation; or 

13 (2) knowingly or recklessly provides materially 

14 false information to an individual or entity described 

15 in subsection (a). 

16 (f) DEFINITIONS.—In this section: 

17 (1) EMPLOY.—The term ‘‘employ’’ has the 

18 meaning given such term under section 3(g) of the 

19 Fair Labor Standards Act of 1938 (29 U.S.C. 

20 203(g)) for the purposes of implementing the re21 quirements of that Act (29 U.S.C. 201, et seq.). 

22 (2) EMPLOYEE.—The term ‘‘employee’’ means 

23 an individual who is employed by an employer. 

24 (3) EMPLOYER.—The term ‘‘employer’’ means 

25 any person who employs employees, including any 


hsrobinson on PROD1PC76 with BILLS
83 

•HR 5442 IH

1 person acting directly or indirectly in the interest of 

2 any employer in relation to an employee and in3 cludes a public agency. 

4 SEC. 163. DEMONSTRATION GRANT FOR INDIVIDUALS WITH 

5 LIMITED ENGLISH LANGUAGE PROFICIENCY 

6 OR LIMITED HEALTH LITERACY. 

7 (a) IN GENERAL.—The Secretary shall award con8 tracts or competitive grants to eligible entities to support 

9 demonstration projects that are designed to improve the 

10 communication of information pertaining to health privacy 

11 rights with individuals with limited English language pro12 ficiency and limited health literacy. 

13 (b) PURPOSE.—It is the purpose of this section, to 

14 promote the cultural competency of persons that access, 

15 maintain, retain, modify, record, store, destroy, or other16 wise use or disclose personal health information, and to 

17 enable such persons to better communicate privacy proce18 dures to non-English speakers, those with limited English 

19 proficiency, and those with limited health literacy. 

20 (c) ELIGIBLE ENTITIES.—In this section, the term 

21 ‘‘eligible entity’’ means an organization or community22 based consortium that includes— 

23 (1) individuals who are representatives of orga24 nizations serving or advocating for ethnic and racial 

25 minorities, low income immigrant populations, and 


hsrobinson on PROD1PC76 with BILLS
84 

•HR 5442 IH

1 others with limited English language proficiency and 

2 limited health literacy; 

3 (2) health care providers that provide care for 

4 ethnic and racial minorities, low income immigrant 

5 populations, and others with limited English lan6 guage proficiency and limited health literacy; 

7 (3) community leaders and leaders of commu8 nity-based organizations; and 

9 (4) experts and researchers in the areas of so10 cial and behavioral sciences, who have knowledge, 

11 training, or practical experience in health policy, ad12 vocacy, cultural and linguistic competency, or other 

13 relevant areas as determined by the Secretary. 

14 (d) APPLICATION.—An eligible entity seeking a con15 tract or grant under this section shall submit an applica16 tion to the Secretary at such time, in such manner, and 

17 containing such information as the Secretary may require. 

18 (e) USE OF FUNDS.—An eligible entity shall use 

19 amounts received under this section to carry out programs 

20 and studies designed to help identify best practices in the 

21 communication of privacy rights and procedures to ensure 

22 comprehension by individuals with limited English pro23 ficiency and limited health literacy. 


hsrobinson on PROD1PC76 with BILLS
85 

•HR 5442 IH

1 SEC. 164. RELATIONSHIP TO OTHER LAWS. 

2 (a) FEDERAL AND STATE LAWS.—Nothing in this 

3 Act shall be construed as preempting, superseding, or re4 pealing, explicitly or implicitly, other Federal or State laws 

5 or regulations relating to personal health information or 

6 relating to an individual’s access to personal health infor7 mation or health care services, if such laws or regulations 

8 provide protections for the rights of individuals to the pri9 vacy of, and access to, their health information that is 

10 greater than those provided for in this Act. 

11 (b) PRIVILEGES.—Nothing in this Act shall be con12 strued to preempt or modify any provisions of State statu13 tory or common law to the extent that such law concerns 

14 a privilege of a witness or person in a court of that State. 

15 This Act shall not be construed to supersede or modify 

16 any provision of Federal statutory or common law to the 

17 extent such law concerns a privilege of a witness or entity 

18 prior to a court proceeding or in a court of the United 

19 States. Informed consent shall not be construed as a waiv20 er of any such privilege. 

21 (c) CERTAIN DUTIES UNDER LAW.—Nothing in this 

22 Act shall be construed to preempt, supersede, or modify 

23 the operation of any State law that— 

24 (1) provides for the reporting of vital statistics 

25 such as birth or death information; 


hsrobinson on PROD1PC76 with BILLS
86 

•HR 5442 IH

1 (2) requires the reporting of abuse or neglect 

2 information about any individual; 

3 (3) regulates the disclosure or reporting of in4 formation concerning an individual’s mental health; 

5 or 

6 (4) governs a minor’s rights to access personal 

7 health information or health care services. 

8 (d) HEALTH INSURANCE PORTABILITY AND AC9 COUNTABILITY ACT.—The standards governing the pri10 vacy and security of individually identifiable health infor11 mation promulgated by the Secretary of Health and 

12 Human Services under sections 262(a) and 264 of the 

13 Health Insurance Portability and Accountability Act of 

14 1996 shall remain in effect to the extent that they are 

15 consistent with this title. The Secretary shall by rule 

16 amend such Federal regulations as required to make such 

17 regulations consistent with this title. 

18 SEC. 165. EFFECTIVE DATE. 

19 (a) EFFECTIVE DATE.—Unless specifically provided 

20 for otherwise, this title shall take effect on the date that 

21 is 12 months after the date of the promulgation of the 

22 regulations required under subsection (b), or 30 months 

23 after the date of enactment of this Act, whichever is ear24 lier. 


hsrobinson on PROD1PC76 with BILLS
87 

•HR 5442 IH

1 (b) REGULATIONS.—Not later than 12 months after 

2 the date of enactment of this Act, or as specifically pro3 vided for otherwise, the Secretary shall promulgate regula4 tions implementing this title. 

5 Subtitle F—General Definitions 

6 SEC. 171. GENERAL DEFINITIONS. 

7 In this Act: 

8 (1) AGENT.—The term ‘‘agent’’ means a person 

9 that represents or acts for another person (a prin10 cipal) under a contract or relationship of agency, or 

11 that functions to bring about, modify, affect, accept 

12 performance of, or terminate, contractual obligations 

13 between the principal and a third person. With re14 spect to an employer, such term includes the employ15 ees of the employer. 

16 (2) AUTHORIZATION.—The term ‘‘authoriza17 tion’’ means the authority granted by an individual 

18 that is the subject of personal health information, in 

19 accordance with this title, for the disclosure or use 

20 of the individual’s personal health information. 

21 (3) BREACH.—The term ‘‘breach’’ means the 

22 unauthorized acquisition, disclosure, or loss of per23 sonal health information which compromises the se24 curity, privacy, or integrity of personal health infor25 mation maintained by or on behalf of a person. 


hsrobinson on PROD1PC76 with BILLS
88 

•HR 5442 IH

1 (4) CONFIDENTIALITY.—The term ‘‘confiden2 tiality’’ means the obligations of those who receive 

3 information to respect the privacy interests of those 

4 to whom the data relate. 

5 (5) DE-IDENTIFIED HEALTH INFORMATION.— 

6 The term ‘‘de-identified health information’’ means 

7 any personal health information, with respect to 

8 which— 

9 (A) all personal identifiers, or other infor10 mation that may be used by itself or in com11 bination with other information which may be 

12 available to re-identify (as defined in section 

13 171(25)) the subject of the information (such 

14 as geographic, credit, and financial information 

15 and all of the identifiers enumerated at section 

16 164.514(b)(2) of title 45 of the Code of Federal 

17 Regulations (as in effect on January 1, 2008)) 

18 have been removed; 

19 (B) a good faith effort has been made to 

20 evaluate, minimize, and mitigate the risks of re21 identification of the subject of such information, 

22 using commonly accepted scientific and statis23 tical standards and methods for minimizing risk 

24 of disclosure; and 


hsrobinson on PROD1PC76 with BILLS
89 

•HR 5442 IH

1 (C) there is no reasonable basis to believe 

2 that the information can be used to identify an 

3 individual. 

4 (6) DISCLOSE.—The term ‘‘disclose’’ means to 

5 release, publish, share, transfer, transmit, dissemi6 nate, show, permit access to, communicate (orally or 

7 otherwise), re-identify, or otherwise divulge personal 

8 health information to any person other than the in9 dividual who is the subject of such information. 

10 Such term includes the initial disclosure and any 

11 subsequent re-disclosure of personal health informa12 tion. 

13 (7) DECRYPTION KEY.—The term ‘‘decryption 

14 key’’ means the variable information used in or pro15 duced by a mathematical formula, code, or algo16 rithm, or any component thereof, used for 

17 encryption (as defined in paragraph (10)) or 

18 decryption of wire, electronic, or other communica19 tions or stored information. 

20 (8) DIRECTOR OF THE OFFICE OF HEALTH IN21 FORMATION PRIVACY.—The term ‘‘Director of the 

22 Office of Health Information Privacy’’ means such 

23 Director as appointed under section 161. 

24 (9) EMPLOYER.—Except as otherwise provided 

25 in section 164, the term ‘‘employer’’ means a person 


hsrobinson on PROD1PC76 with BILLS
90 

•HR 5442 IH

1 that is engaged in business affecting commerce and 

2 that has employees. 

3 (10) ENCRYPTION.—The term ‘‘encryption’’— 

4 (A) means the protection of data in elec5 tronic form, in storage or in transit, using an 

6 encryption technology that has been adopted by 

7 an established standards setting body which 

8 renders such data indecipherable in the absence 

9 of associated cryptographic keys necessary to 

10 enable decryption of such data; and 

11 (B) includes appropriate management and 

12 safeguards of such cryptographic keys so as to 

13 protect the integrity of the encryption. 

14 (11) HEALTH CARE.—The term ‘‘health care’’ 

15 means— 

16 (A) preventive, diagnostic, therapeutic, re17 habilitative, maintenance, or palliative care, in18 cluding appropriate assistance with disease or 

19 symptom management and maintenance, coun20 seling, service, or procedure— 

21 (i) with respect to the physical or 

22 mental condition of an individual; or 

23 (ii) affecting the structure or function 

24 of the human body or any part of the 

25 human body, including the banking of 


hsrobinson on PROD1PC76 with BILLS
91 

•HR 5442 IH

1 blood, sperm, organs, or any other tissue; 

2 or 

3 (B) any sale or dispensing of a drug, de4 vice, equipment, or other health care-related 

5 item to an individual, or for the use of an indi6 vidual, pursuant to a prescription. 

7 (12) HEALTH CARE PROVIDER.—The term 

8 ‘‘health care provider’’ means a person that, with re9 spect to a specific item of personal health informa10 tion, receives, accesses, maintains, retains, modifies, 

11 records, stores, destroys, or otherwise uses or dis12 closes the information while acting in whole or in 

13 part in the capacity of— 

14 (A) an entity that is, or holds itself out to 

15 be, licensed, certified, registered, or otherwise 

16 authorized by Federal or State law to provide 

17 an item or service that constitutes health care 

18 in the ordinary course of business, or practice 

19 of a profession; 

20 (B) a contractor or other health care pro21 vider or facility authorized to provide items or 

22 services related to diagnosis or treatment of a 

23 health concern, including a hospital, nursing fa24 cility, allied health professional, and a facility 


hsrobinson on PROD1PC76 with BILLS
92 

•HR 5442 IH

1 used or maintained by allied health profes2 sionals; 

3 (C) a Federal or State program that di4 rectly provides items or services that constitute 

5 health care to beneficiaries; 

6 (D) an officer or employee or agent of a 

7 person described in subparagraph (A) or (C) 

8 who is engaged in the provision of health care 

9 or who uses personal health information; or 

10 (E) medical personnel in an emergency sit11 uation, including while communicating personal 

12 health information by radio transmission or 

13 other means. 

14 (13) HEALTH INFORMATION PERSON.—The 

15 term ‘‘health information person’’ means, in relation 

16 to personal health information, a person, including a 

17 health care provider, health researcher, health plan, 

18 health insurer, health care clearinghouse, health 

19 oversight agency, or public health authority, or such 

20 person’s agent, officer, employee, or affiliate, that 

21 accesses, maintains, retains, modifies, records, 

22 stores, or otherwise holds, uses, or discloses such in23 formation. 

24 (14) HEALTH PLAN.— 


hsrobinson on PROD1PC76 with BILLS
93 

•HR 5442 IH

1 (A) IN GENERAL.—The term ‘‘health plan’’ 

2 means— 

3 (i) a group health plan (as defined in 

4 section 2791(a)(1) of the Public Health 

5 Service Act (42 U.S.C. 300gg–91(a)(1))); 

6 (ii) health insurance coverage (as such 

7 term is defined in section 2791(b)(1) of 

8 the Public Health Service Act (42 U.S.C. 

9 300gg–91(b)(1)); or 

10 (iii) a safety net health plan (as de11 fined in subparagraph (B)). 

12 (B) SAFETY NET HEALTH PLAN.—For 

13 purposes of subparagraph (A)(iii), the term 

14 ‘‘safety net health plan’’ means a managed care 

15 organization, as defined in section 

16 1932(a)(1)(B)(i) of the Social Security Act— 

17 (i) that is exempt from or not subject 

18 to Federal income tax, or that is owned by 

19 an entity or entities exempt from or not 

20 subject to Federal income tax; and 

21 (ii) for which not less than 75 percent 

22 of the enrolled population receives benefits 

23 under a Federal health care program (as 

24 defined in section 1128B(f)(1) of the So25 cial Security Act) or a health care plan or 


hsrobinson on PROD1PC76 with BILLS
94 

•HR 5442 IH

1 program which is funded, in whole or in 

2 part, by a State (other than a program for 

3 government employees). 

4 (15) HEALTH OR LIFE INSURER.—The term 

5 ‘‘health or life insurer’’ means a health insurance 

6 issuer (as defined in section 9805(b)(2) of the Inter7 nal Revenue Code of 1986) or a life insurance com8 pany (as defined in section 816 of such Code) and 

9 includes the employees and agents of such a person. 

10 (16) HEALTH OVERSIGHT AGENCY.—The term 

11 ‘‘health oversight agency’’— 

12 (A) means a person that— 

13 (i) performs or oversees the perform14 ance of an assessment, investigation, or 

15 prosecution relating to compliance with 

16 legal or fiscal standards relating to health 

17 care fraud or fraudulent claims regarding 

18 health care, health services or equipment, 

19 related activities and items, or the effec20 tiveness of health privacy and security 

21 measures; and 

22 (ii) is a public executive branch agen23 cy, acting on behalf of a public executive 

24 branch agency, acting pursuant to a re25 quirement of a public executive branch 


hsrobinson on PROD1PC76 with BILLS
95 

•HR 5442 IH

1 agency, or carrying out activities under a 

2 Federal or State law governing an assess3 ment, evaluation, determination, investiga4 tion, or prosecution described in clause (i); 

5 and 

6 (B) includes the employees and agents of 

7 such a person. 

8 (17) HEALTH RECORD SET.—The term ‘‘health 

9 record set’’ means any item, collection, or grouping 

10 of information that includes personal health infor11 mation, such as a medical record, electronic health 

12 record, electronic medical record, personal health 

13 record, or account of disclosure, use or access, that 

14 is created, accessed, received, maintained, retained, 

15 modified, recorded, stored, destroyed, or otherwise 

16 used or disclosed by a health care provider, em17 ployer, insurer, health plan, health researcher, data 

18 partner, or other person that relates to the health or 

19 illness of the body, mind, or genome of an indi20 vidual. 

21 (18) HEALTH RESEARCHER.—The term ‘‘health 

22 researcher’’ means a person that is engaged in ac23 tivities conducted for the purpose of advancing pub24 lic knowledge and, with respect to a specific item of 


hsrobinson on PROD1PC76 with BILLS
96 

•HR 5442 IH

1 personal health information, receives the informa2 tion— 

3 (A) pursuant to section 142 (relating to 

4 health research); or 

5 (B) while acting in whole or in part in the 

6 capacity of an officer, employee, or agent of a 

7 person that receives the information pursuant 

8 to such section. 

9 (19) INFORMED CONSENT.— 

10 (A) IN GENERAL.—Subject to subpara11 graph (B), the term ‘‘informed consent’’ means 

12 the written authorization for use or disclosure 

13 of personal health information by the individual 

14 who is the subject of such information, condi15 tioned upon— 

16 (i) that individual’s having been in17 formed of the nature and probability of 

18 harm to the individual resulting from such 

19 authorization; and 

20 (ii) the authorization meeting the re21 quirements of section 122(b). 

22 (B) THROUGH INFERENCE.—Informed 

23 consent may be inferred, in the absence of a 

24 contrary indication by the individual— 


hsrobinson on PROD1PC76 with BILLS
97 

•HR 5442 IH

1 (i) to the extent necessary to provide 

2 treatment and obtain payment for health 

3 care in emergency situations; 

4 (ii) to the extent necessary to provide 

5 treatment and payment where a health 

6 care provider is required by law to treat 

7 the individual; 

8 (iii) if the health care provider is un9 able to obtain informed consent due to 

10 substantial barriers to communicating with 

11 the individual and the provider reasonably 

12 infers from the circumstances, based upon 

13 the exercise of professional judgment, that 

14 the individual does not object to the disclo15 sure or the disclosure is in the best inter16 est of the individual; and 

17 (iv) to the extent the information is 

18 necessary to carry out or otherwise imple19 ment a medical or mental health practi20 tioner’s order or prescription for health 

21 services, medical devices or supplies, or 

22 pharmaceuticals. 

23 (C) MULTIPLE USES AND DISCLOSURES.— 

24 Informed consent may authorize multiple uses 

25 or disclosures. 


hsrobinson on PROD1PC76 with BILLS
98 

•HR 5442 IH

1 (20) OFFICE OF HEALTH INFORMATION PRI2 VACY.—The term ‘‘Office of Health Information Pri3 vacy’’ means the Office of Health Information Pri4 vacy designated under section 161. 

5 (21) PERSON.—The term ‘‘person’’ means an 

6 entity that is a government, governmental subdivi7 sion of an executive branch agency or authority, cor8 poration, company, association, firm, partnership, 

9 society, estate, trust, joint venture, individual, indi10 vidual representative, tribal government, or any 

11 other legal entity. Such term also includes the em12 ployees, contractors, agents, and affiliates of all legal 

13 entities described in the preceding sentence, whether 

14 or not they are acting in the capacity of their em15 ployment, contract, agency, or affiliation. 

16 (22) PRIVACY.—The term ‘‘privacy’’ means an 

17 individual’s right to control the acquisition, uses, or 

18 disclosures of his or her identifiable health data. 

19 (23) PERSONAL HEALTH INFORMATION.— 

20 (A) IN GENERAL.—The term ‘‘personal 

21 health information’’ means any information, in22 cluding genetic information, biometric informa23 tion, demographic information, and tissue sam24 ples collected from an individual, whether oral 

25 or recorded in any form or medium, that— 


hsrobinson on PROD1PC76 with BILLS
99 

•HR 5442 IH

1 (i) is created or received by a health 

2 care provider, health researcher, health 

3 plan, health or life insurer, medical or 

4 health savings plan administrator, health 

5 care clearinghouse, health oversight agen6 cy, public health authority, employer, data 

7 partner, or other person or such person’s 

8 agent, officer, or employee; and 

9 (ii)(I) relates to the past, present, or 

10 future physical or mental health or condi11 tion of an individual (including individual 

12 cells and their components), the provision 

13 of health care to an individual, or the past, 

14 present, or future payment for the provi15 sion of health care to an individual; and 

16 (II)(aa) identifies an individual; or 

17 (bb) with respect to which there is a 

18 reasonable basis to believe that the infor19 mation can be used to identify an indi20 vidual. 

21 (B) INCLUSION OF DECRYPTION KEY.— 

22 The term ‘‘personal health information’’ in23 cludes any decryption key used for the 

24 encryption or decryption of information de25 scribed in subparagraph (A). 


hsrobinson on PROD1PC76 with BILLS
100 

•HR 5442 IH

1 (24) PUBLIC HEALTH AUTHORITY.—The term 

2 ‘‘public health authority’’ means an authority or in3 strumentality of the United States, a tribal govern4 ment, a State, or a political subdivision of a State 

5 that is— 

6 (A) primarily responsible for public health 

7 matters; and 

8 (B) primarily engaged in activities such as 

9 injury reporting, public health surveillance, and 

10 public health investigation or intervention. 

11 (25) RE-IDENTIFY.—The term ‘‘re-identify’’, 

12 when used with respect to de-identified health infor13 mation, means an attempt, successful or otherwise, 

14 to ascertain— 

15 (A) the identity of the individual who is 

16 the subject of such information; or 

17 (B) the decryption key with respect to the 

18 information (when undertaken with knowledge 

19 that such key would allow for the identification 

20 of the individual who is the subject of such in21 formation). 

22 (26) SECRETARY.—The term ‘‘Secretary’’ 

23 means the Secretary of Health and Human Services. 

24 (27) SECURITY.—The term ‘‘security’’ means 

25 physical, technological, or administrative safeguards 


hsrobinson on PROD1PC76 with BILLS
101 

•HR 5442 IH

1 or tools used to protect identifiable health data from 

2 unwarranted access or disclosure. 

3 (28) SECURITY BREACH.—The term ‘‘security 

4 breach’’ means the physical, structural, or sub5 stantive compromise of the security of personal 

6 health information, through unauthorized disclosure, 

7 use, or access, whether actual or attempted, result8 ing in the acquisition, access, or use of such infor9 mation by an unauthorized person. Such term does 

10 not apply to good faith or accidental acquisition, or 

11 disclosure of personal health information by an un12 authorized person, so long as no further use or dis13 closure is made by such person. 

14 (29) SEGREGATE.—The term ‘‘segregate’’ 

15 means to hide, mask, or mark separate a designated 

16 subset of an individual’s personal health informa17 tion, or to place such a subset in a location that is 

18 securely separated from the location used to store 

19 other personal health information, such that access 

20 to or use of any information so segregated may be 

21 effectively limited to those persons that are author22 ized by the individual to access or use that seg23 regated information. 

24 (30) SIGNED.—The term ‘‘signed’’ refers both 

25 to signatures in ink and to electronic signatures that 


hsrobinson on PROD1PC76 with BILLS
102 

•HR 5442 IH

1 are authenticated by the individual using an authen2 tication method approved by the Secretary. 

3 (31) STATE.—The term ‘‘State’’ means each of 

4 the several States, the District of Columbia, Puerto 

5 Rico, the Virgin Islands, Guam, American Samoa, 

6 and the Northern Mariana Islands. 

7 (32) TO THE MAXIMUM EXTENT PRAC8 TICABLE.—The term ‘‘to the maximum extent prac9 ticable’’ means the level of compliance that a reason10 able person would deem technologically feasible so 

11 long as such feasibility is periodically evaluated in 

12 light of scientific advances. 

13 (33) USE.—The term ‘‘use’’ means to create, 

14 record, collect, access, obtain, store, maintain, 

15 amend, correct, restore, modify, supplement, iden16 tify, re-identify, employ, apply, utilize, examine, ana17 lyze, detect, remove, destroy, dispose of, account for, 

18 or monitor the flow of personal health information. 

19 (34) WRITING; WRITTEN.—The terms ‘‘writing’’ 

20 and ‘‘written’’ mean writing or written, respectively, 

21 in either a paper-based or computer-based form, in22 cluding electronic and digital signatures. 


hsrobinson on PROD1PC76 with BILLS
103 

•HR 5442 IH

1 TITLE II—PROMOTION OF 

2 HEALTH INFORMATION TECH3 NOLOGY 

4 Subtitle A—Improving the Inter5 operability of Health Informa6 tion Technology 

7 SEC. 201. OFFICE OF THE NATIONAL COORDINATOR OF 

8 HEALTH INFORMATION TECHNOLOGY. 

9 (a) ESTABLISHMENT.—There is established within 

10 the office of the Secretary, the Office of the National Co11 ordinator of Health Information Technology. The Na12 tional Coordinator shall be appointed by the Secretary in 

13 consultation with the President, and shall report directly 

14 to the Secretary. 

15 (b) PURPOSE.—The Office of the National Coordi16 nator shall be responsible for— 

17 (1) ensuring that key health information tech18 nology initiatives are coordinated across programs of 

19 the Department of Health and Human Services; 

20 (2) ensuring that health information technology 

21 policies and programs of the Department of Health 

22 and Human Services are coordinated with such poli23 cies and programs of other relevant Federal agencies 

24 (including Federal commissions and advisory com25 mittees) with a goal of avoiding duplication of efVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00103 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
104 

•HR 5442 IH

1 forts and of helping to ensure that each agency un2 dertakes activities primarily within the areas of its 

3 greatest expertise and technical capability; 

4 (3) reviewing Federal health information tech5 nology investments to ensure that Federal health in6 formation technology programs are meeting the ob7 jectives of the strategic plan published by the Office 

8 of the National Coordinator of Health Information 

9 Technology to establish a nationwide interoperable 

10 health information technology infrastructure; 

11 (4) providing comments and advice regarding 

12 specific Federal health information technology pro13 grams, at the request of Office of Management and 

14 Budget; 

15 (5) enhancing the use of health information 

16 technology to improve the quality of health care in 

17 the prevention and management of chronic disease 

18 and to address population health; and 

19 (6) consulting with the Office of Health Infor20 mation Privacy to ensure that key health informa21 tion technology initiatives of the Department of 

22 Health and Human Services and other Federal 

23 agencies are consistent with the privacy, confiden24 tiality, and security requirements in title I. 


hsrobinson on PROD1PC76 with BILLS
105 

•HR 5442 IH

1 (c) ROLE WITH AMERICAN HEALTH INFORMATION

2 COMMUNITY AND THE PARTNERSHIP FOR HEALTH CARE

3 IMPROVEMENT.—The Office of the National Coordinator 

4 shall— 

5 (1) serve as an ex officio member of the Amer6 ican Health Information Community established 

7 under section 203, and act as a liaison between the 

8 Federal Government and the Community; 

9 (2) serve as an ex officio member of the Part10 nership and act as a liaison between the Federal 

11 Government and the Partnership for Health Care 

12 Improvement (established under section 202); and 

13 (3) serve as a liaison between the Partnership 

14 and the Community. 

15 (d) REPORTS AND WEBSITE.—The Office of the Na16 tional Coordinator shall— 

17 (1) develop and publish a strategic plan for im18 plementing a nationwide interoperable health infor19 mation technology infrastructure; 

20 (2) maintain and frequently update an Internet 

21 website that— 

22 (A) publishes the schedule for the assess23 ment of standards for significant use cases; 

24 (B) publishes the recommendations of the 

25 American Health Information Community; 


hsrobinson on PROD1PC76 with BILLS
106 

•HR 5442 IH

1 (C) publishes the recommendations of the 

2 Partnership for Health Care Improvement; 

3 (D) publishes quality measures; 

4 (E) identifies sources of funds that will be 

5 made available to facilitate the purchase of, or 

6 enhance the utilization of, health information 

7 technology systems, either through grants or 

8 technical assistance; and 

9 (F) publishes a plan for a transition of any 

10 functions of the Office of the National Coordi11 nator that should be continued after September 

12 30, 2014; 

13 (3) prepare a report on the lessons learned 

14 from major public and private health care systems 

15 that have implemented health information tech16 nology systems, including an explanation of whether 

17 the systems and practices developed by such systems 

18 may be applicable to and usable in whole or in part 

19 by other health care providers; and 

20 (4) assess the impact of health information 

21 technology in communities with health disparities 

22 and identify practices to increase the adoption of 

23 such technology by health care providers in such 

24 communities. 


hsrobinson on PROD1PC76 with BILLS
107 

•HR 5442 IH

1 (e) RULE OF CONSTRUCTION.—Nothing in this sec2 tion shall be construed as requiring the duplication of Fed3 eral efforts with respect to the establishment of the Office 

4 of the National Coordinator of Health Information Tech5 nology, regardless of whether such efforts are carried out 

6 before or after the date of the enactment of this title. 

7 (f) AUTHORIZATION OF APPROPRIATIONS.—There is 

8 authorized to be appropriated to carry out this section, 

9 $5,000,000 for each of fiscal years 2009 and 2010. 

10 (g) SUNSET.—The provisions of this section shall not 

11 apply after September 30, 2014. 

12 SEC. 202. PARTNERSHIP FOR HEALTH CARE IMPROVE13 MENT. 

14 (a) ESTABLISHMENT.— 

15 (1) IN GENERAL.—There is established a pub16 lic-private Partnership for Health Care Improvement 

17 (in this title referred to as the ‘‘Partnership’’) to— 

18 (A) provide advice to the Secretary and the 

19 Nation and recommend specific actions to 

20 achieve a nationwide interoperable health infor21 mation technology infrastructure; 

22 (B) make recommendations concerning 

23 standards, including privacy, security, and con24 fidentiality standards, implementation specifica25 tions, and certification criteria for the electronic 


hsrobinson on PROD1PC76 with BILLS
108 

•HR 5442 IH

1 exchange of personal health information (in2 cluding for the reporting of quality data under 

3 section 221) for adoption by the Federal Gov4 ernment and voluntary adoption by private enti5 ties that are consistent with the requirements of 

6 title I; 

7 (C) serve as a forum for the participation 

8 of a broad range of stakeholders with specific 

9 technical expertise in the development of stand10 ards, implementation specifications, and certifi11 cation criteria and protection of privacy and 

12 data security to provide input on the effective 

13 implementation of health information tech14 nology systems; and 

15 (D) develop and maintain an Internet 

16 website that— 

17 (i) publishes established governance 

18 rules (including a subsequent appointment 

19 process); 

20 (ii) publishes a business plan; 

21 (iii) publishes meeting notices at least 

22 14 days prior to each meeting; 

23 (iv) publishes meeting agendas at 

24 least 7 days prior to each meeting; and 


hsrobinson on PROD1PC76 with BILLS
109 

•HR 5442 IH

1 (v) publishes meeting materials at 

2 least 3 days prior to each meeting. 

3 (2) LIMITATION.—The Partnership shall not 

4 meet or take any action until an advisory committee 

5 charter has been filed with the Secretary and with 

6 the appropriate committees of the Senate and House 

7 of Representatives for the American Health Infor8 mation Community described in section 203. 

9 (b) MEMBERSHIP.— 

10 (1) MEMBERS.—The members of the Partner11 ship shall consist of the following: 

12 (A) APPOINTED MEMBERS.—The ap13 pointed members of the Partnership shall be 

14 appointed as follows: 

15 (i) 2 members shall be appointed by 

16 the Secretary. 

17 (ii) 1 member shall be appointed by 

18 the majority leader of the Senate. 

19 (iii) 1 member shall be appointed by 

20 the minority leader of the Senate. 

21 (iv) 1 member shall be appointed by 

22 the Speaker of the House of Representa23 tives. 


hsrobinson on PROD1PC76 with BILLS
110 

•HR 5442 IH

1 (v) 1 member shall be appointed by 

2 the minority leader of the House of Rep3 resentatives. 

4 (vi) Seven members shall be appointed 

5 by the Comptroller General of whom— 

6 (I) one member shall be a rep7 resentative of consumer or patient or8 ganizations; 

9 (II) one member shall be a rep10 resentative of organizations with ex11 pertise in the protection of privacy; 

12 (III) one member shall be a rep13 resentative of organizations with ex14 pertise in security; 

15 (IV) one member shall be a rep16 resentative of health care providers; 

17 (V) one member shall be a rep18 resentative of health plans or other 

19 third party payers; 

20 (VI) one member shall be a rep21 resentative of information technology 

22 vendors; and 

23 (VII) one member shall be a rep24 resentative of purchasers or employ25 ers. 


hsrobinson on PROD1PC76 with BILLS
111 

•HR 5442 IH

1 (B) NATIONAL COORDINATOR.—The Na2 tional Coordinator shall be a member of the 

3 Partnership and act as a liaison among the 

4 Partnership, the community, and the Federal 

5 Government. 

6 (2) CHAIRPERSON AND VICE CHAIRPERSON.— 

7 The Partnership shall designate one member to 

8 serve as the chairperson and one member to serve as 

9 the vice chairperson of the Partnership. 

10 (3) PARTICIPATION.—Members shall be ap11 pointed under paragraph (1)(A), and the Partner12 ship shall develop procedures for conducting its ac13 tivities, so as to ensure a balance among various sec14 tors of the health care system so that no single sec15 tor unduly influences the recommendations of the 

16 Partnership. 

17 (4) TERMS.—Members appointed under para18 graph (1)(A) shall serve for 3 year terms, except 

19 that any member appointed to fill a vacancy for an 

20 unexpired term shall be appointed for the remainder 

21 of such term. A member may serve for not to exceed 

22 180 days after the expiration of such member’s term 

23 or until a successor has been appointed. 

24 (5) OUTSIDE INVOLVEMENT.—The Partnership 

25 shall ensure an adequate opportunity for the particiVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00111 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
112 

•HR 5442 IH

1 pation of outside advisors, including individuals with 

2 expertise in— 

3 (A) the protection of personal health infor4 mation privacy; 

5 (B) personal health information security; 

6 (C) health care quality and patient safety, 

7 including individuals with expertise in utilizing 

8 health information technology to improve health 

9 care quality and patient safety; 

10 (D) medical and clinical research data ex11 change; and 

12 (E) developing health information tech13 nology standards and new health information 

14 technology. 

15 (6) QUORUM.—Two-thirds of the members of 

16 the Partnership shall constitute a quorum for the 

17 purpose of conducting votes. 

18 (c) STANDARDS AND IMPLEMENTATION SPECIFICA19 TIONS.— 

20 (1) SCHEDULE.—Not later than 90 days after 

21 the date of enactment of this title, the Partnership 

22 shall develop a schedule for the assessment of stand23 ards and implementation specifications under this 

24 section. The Partnership shall update such schedule 

25 annually. The Secretary shall publish such schedule 


hsrobinson on PROD1PC76 with BILLS
113 

•HR 5442 IH

1 in the Federal Register and on the Internet website 

2 of the Department of Health and Human Services. 

3 (2) FIRST YEAR RECOMMENDATIONS.—Con4 sistent with the schedule published under paragraph 

5 (1) and not later than 1 year after date of enact6 ment of this title, the Partnership shall recommend, 

7 and the Secretary shall review, such standards and 

8 implementation specifications. 

9 (3) ONGOING RECOMMENDATIONS.—The Part10 nership shall review and modify, as appropriate but 

11 at least annually, adopted standards and implemen12 tation specifications and continue to recommend ad13 ditional standards and implementation specifications, 

14 consistent with the schedule published pursuant to 

15 paragraph (1). The Secretary shall review such 

16 modifications and recommendations. 

17 (4) RECOGNITION OF PRIVATE ENTITIES.—The 

18 Partnership, in consultation with the Secretary, may 

19 recognize a private entity or entities for the purpose 

20 of developing and updating standards and implemen21 tation specifications to achieve uniform and con22 sistent implementation of the standards adopted by 

23 the President under this title. Such entity or entities 

24 shall make recommendations to the Partnership con25 sistent with this section. 


hsrobinson on PROD1PC76 with BILLS
114 

•HR 5442 IH

1 (5) PUBLICATION.—All recommendations made 

2 by the Partnership pursuant to this section shall be 

3 published in the Federal Register and on the Inter4 net website of the Office of the National Coordi5 nator. 

6 (6) REQUIREMENT FOR CERTAIN REC7 OMMENDATIONS.—The Partnership may not issue 

8 any recommendation that affects an individual’s 

9 right to health information privacy unless such rec10 ommendation receives the affirmative support of the 

11 consumer or patient organization representative of 

12 the Partnership appointed under subsection 

13 (b)(1)(A)(vi)(I). 

14 (7) PILOT TESTING.—The Secretary may con15 duct, or recognize a private entity or entities to con16 duct, a pilot project to test the standards and imple17 mentation specifications developed under this section 

18 in order to provide for the efficient implementation 

19 of the standards and implementation specifications 

20 described in this subsection prior to issuing such 

21 recommendations. 

22 (8) PUBLIC INPUT.—The Partnership shall con23 duct open public meetings and develop a process to 

24 allow for public comment on the schedule and rec25 ommendations described in this section. Such procVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00114 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
115 

•HR 5442 IH

1 ess shall ensure that such comments will be sub2 mitted within 30 days of the publication of a rec3 ommendation under this section. 

4 (9) FEDERAL ACTION.—Not later than 90 days 

5 after the issuance of a recommendation from the 

6 Partnership under this subsection, the Secretary, in 

7 collaboration with representatives of other relevant 

8 Federal agencies as determined appropriate by the 

9 President, shall jointly review such recommendation. 

10 If appropriate, the President shall provide for the 

11 adoption by the Federal Government of any stand12 ard or implementation specification contained in 

13 such recommendation only after providing an oppor14 tunity for public comment in accordance with section 

15 553 of title 5, United States Code. Such determina16 tion shall be published in the Federal Register and 

17 on the Internet website of the Office of the National 

18 Coordinator within 30 days after such determination 

19 is made. 

20 (10) CONSISTENCY.—The standards and imple21 mentation specifications described in this subsection 

22 shall be consistent with the privacy protections in 

23 title I and the standards for information trans24 actions and data elements developed pursuant to the 

25 regulations promulgated under section 264(c) of the 


hsrobinson on PROD1PC76 with BILLS
116 

•HR 5442 IH

1 Health Insurance Portability and Accountability Act 

2 of 1996. 

3 (d) CERTIFICATION.— 

4 (1) DEVELOPING CRITERIA.—The Partnership, 

5 in consultation with the Secretary, may recognize a 

6 private entity or entities for the purpose of devel7 oping and recommending to the Partnership criteria 

8 to certify that appropriate categories of health infor9 mation technology products that claim to be in com10 pliance with applicable standards and implementa11 tion specifications adopted under this title have es12 tablished such compliance. 

13 (2) ADOPTION OF CRITERIA.—The Secretary, 

14 based upon the recommendations of the Partnership, 

15 shall review, and if appropriate, adopt such criteria. 

16 (3) CONDUCTING CERTIFICATION.—The Sec17 retary may recognize a private entity or entities to 

18 conduct the certifications described under paragraph 

19 (1) using the criteria adopted by the Secretary 

20 under this subsection. 

21 (e) RULE OF CONSTRUCTION.—Nothing in this sec22 tion shall be construed as disrupting existing activities de23 scribed in subsection (c) or (d). 

24 (f) REQUIREMENT TO CONSIDER RECOMMENDA25 TIONS.—In carrying out the activities described in subVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00116 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
117 

•HR 5442 IH

1 sections (c) and (d), the Partnership shall adopt and inte2 grate the recommendations of the American Health Infor3 mation Community that are adopted by the Secretary. 

4 (g) AUTHORIZATION OF APPROPRIATIONS.—There 

5 are authorized to be appropriated to carry out this section, 

6 $2,000,000 for each of the fiscal years 2009 and 2010. 

7 SEC. 203. AMERICAN HEALTH INFORMATION COMMUNITY 

8 POLICIES. 

9 (a) ESTABLISHMENT.—There is established a com10 mittee to be known as the American Health Information 

11 Community (in this section referred to as the ‘‘Commu12 nity’’). The Community shall— 

13 (1) provide advice to the Secretary and the 

14 heads of any relevant Federal agencies concerning 

15 the policy considerations related to health informa16 tion technology; 

17 (2) not later than 1 year after the date of en18 actment of this title, and annually thereafter, make 

19 recommendations concerning a policy framework for 

20 the development and adoption of a nationwide inter21 operable health information technology infrastruc22 ture; 

23 (3) not later than 1 year after the date of en24 actment of this title, and annually thereafter, make 

25 recommendation concerning national policies for 


hsrobinson on PROD1PC76 with BILLS
118 

•HR 5442 IH

1 adoption by the Federal Government, and voluntary 

2 adoption by private entities, to support the wide3 spread adoption of health information technology, 

4 including— 

5 (A) the protection of personal health infor6 mation, including policies concerning the indi7 vidual’s ability to control the acquisition, uses, 

8 and disclosures of personal health information; 

9 (B) methods to protect personal health in10 formation from improper use and disclosures 

11 and methods to notify patients if their personal 

12 health information is wrongfully disclosed; 

13 (C) methods to facilitate and secure access 

14 to such individual’s personal health information; 

15 (D) the appropriate uses of a nationwide 

16 personal health information infrastructure in17 cluding— 

18 (i) the collection of quality data and 

19 public reporting; 

20 (ii) biosurveillance and public health; 

21 (iii) medical and clinical research; and 

22 (iv) drug safety; 

23 (E) fostering the public understanding of 

24 health information technology; 


hsrobinson on PROD1PC76 with BILLS
119 

•HR 5442 IH

1 (F) strategies to enhance the use of health 

2 information technology in preventing and man3 aging chronic disease; 

4 (G) policies to incorporate the input of em5 ployees of health care providers in the design 

6 and implementation of health information tech7 nology systems; and 

8 (H) other policies determined to be nec9 essary by the Community; and 

10 (4) serve as a forum for the participation of a 

11 broad range of stakeholders to provide input on im12 proving the effective implementation of health infor13 mation technology systems. 

14 The Community may not make any recommendation that 

15 affects an individual’s right to health information privacy 

16 unless the recommendation receives the affirmative sup17 port of the consumer or patient organization representa18 tive appointed under subsection (c)(1)(A)(viii)(I). 

19 (b) PUBLICATION.—All recommendations made by 

20 the Community pursuant to this section shall be published 

21 in the Federal Register and on the Internet website of the 

22 National Coordinator. The Secretary shall review all rec23 ommendations and determine which recommendations 

24 shall be endorsed by the Federal Government and such 

25 determination shall be published on the Internet website 


hsrobinson on PROD1PC76 with BILLS
120 

•HR 5442 IH

1 of the Office of the National Coordinator after an oppor2 tunity for public comment in accordance with section 553 

3 of title 5, United States Code. 

4 (c) MEMBERSHIP.— 

5 (1) MEMBERS.—The members of the Commu6 nity shall consist of the following: 

7 (A) APPOINTED MEMBERS.—The ap8 pointed members of the Community shall be ap9 pointed as follows: 

10 (i) 3 members shall be appointed by 

11 the Secretary, 1 of whom shall be a rep12 resentative from the Department of Health 

13 and Human Services. 

14 (ii) 1 member shall be appointed by 

15 the Secretary of Veterans Affairs who shall 

16 represent the Department of Veterans Af17 fairs. 

18 (iii) 1 member shall be appointed by 

19 the Secretary of Defense who shall rep20 resent the Department of Defense. 

21 (iv) 1 member shall be appointed by 

22 the majority leader of the Senate. 

23 (v) 1 member shall be appointed by 

24 the minority leader of the Senate. 


hsrobinson on PROD1PC76 with BILLS
121 

•HR 5442 IH

1 (vi) 1 member shall be appointed by 

2 the Speaker of the House of Representa3 tives. 

4 (vii) 1 member shall be appointed by 

5 the minority leader of the House of Rep6 resentatives. 

7 (viii) Nine members shall be ap8 pointed by the Comptroller General of 

9 whom— 

10 (I) one member shall be advo11 cates for patients or consumers; 

12 (II) one member shall represent 

13 health care providers; 

14 (III) one member shall be from a 

15 labor organization representing health 

16 care workers; 

17 (IV) one member shall have ex18 pertise in the protection of privacy 

19 and data security; 

20 (V) one member shall have exper21 tise in improving the health of vulner22 able populations; 

23 (VI) one member shall represent 

24 health plans or other third party pay25 ers; 


hsrobinson on PROD1PC76 with BILLS
122 

•HR 5442 IH

1 (VII) one member shall represent 

2 information technology vendors; 

3 (VIII) one member shall rep4 resent purchasers or employers; and 

5 (IX) one member shall have ex6 pertise in health care quality measure7 ment and reporting. 

8 (B) NATIONAL COORDINATOR.—The Na9 tional Coordinator shall be a member of the 

10 Community and act as a liaison among the 

11 Community, the partnership, and the Federal 

12 Government. 

13 (2) CHAIRPERSON AND VICE CHAIRPERSON.— 

14 The Community shall designate one member to serve 

15 as the chairperson and one member to serve as the 

16 vice chairperson of the Community. 

17 (3) PARTICIPATION.—The members of the 

18 Community appointed under paragraph (1) shall 

19 represent a balance among various sectors of the 

20 health care system so that no single sector unduly 

21 influences the recommendations of the Community. 

22 (4) TERMS.— 

23 (A) IN GENERAL.—The terms of members 

24 of the Community shall be for 3 years except 

25 that the Comptroller General shall designate 


hsrobinson on PROD1PC76 with BILLS
123 

•HR 5442 IH

1 staggered terms for the members first ap2 pointed. 

3 (B) VACANCIES.—Any member appointed 

4 to fill a vacancy in the membership of the Com5 munity that occurs prior to the expiration of 

6 the term for which the member’s predecessor 

7 was appointed shall be appointed only for the 

8 remainder of that term. A member may serve 

9 after the expiration of that member’s term until 

10 a successor has been appointed. A vacancy in 

11 the Community shall be filled in the manner in 

12 which the original appointment was made. 

13 (5) OUTSIDE INVOLVEMENT.—The Community 

14 shall ensure an adequate opportunity for the partici15 pation of outside advisors, including individuals with 

16 expertise in— 

17 (A) the protection of health information 

18 privacy and security; 

19 (B) improving the health of vulnerable 

20 populations; 

21 (C) health care quality and patient safety, 

22 including individuals with expertise in measure23 ment and the use of health information tech24 nology to capture data to improve health care 

25 quality and patient safety; 


hsrobinson on PROD1PC76 with BILLS
124 

•HR 5442 IH

1 (D) ethics, including the ethical standards 

2 of professional medical and mental health prac3 titioner associations; 

4 (E) medical and clinical research data ex5 change; 

6 (F) developing health information tech7 nology standards and new health information 

8 technology; and 

9 (G) the operation of a State or local health 

10 information network. 

11 (6) QUORUM.—Ten members of the Community 

12 shall constitute a quorum for purposes of voting, but 

13 a lesser number of members may meet and hold 

14 hearings. 

15 (d) FEDERAL AGENCIES.— 

16 (1) STAFF OF OTHER FEDERAL AGENCIES.— 

17 Upon the request of the Community, the head of any 

18 Federal agency may detail, without reimbursement, 

19 any of the personnel of such agency to the Commu20 nity to assist in carrying out the duties of the Com21 munity. Any such detail shall not interrupt or other22 wise affect the civil service status or privileges of the 

23 Federal employee involved. 

24 (2) TECHNICAL ASSISTANCE.—Upon the re25 quest of the Community, the head of a Federal 


hsrobinson on PROD1PC76 with BILLS
125 

•HR 5442 IH

1 agency shall provide such technical assistance to the 

2 Community as the Community determines to be nec3 essary to carry out its duties. 

4 (3) OTHER RESOURCES.—The Community shall 

5 have reasonable access to materials, resources, sta6 tistical data, and other information from the Library 

7 of Congress and agencies and elected representatives 

8 of the executive and legislative branches of the Fed9 eral Government. The chairperson or vice chair10 person of the Community shall make requests for 

11 such access in writing when necessary. 

12 (e) APPLICATION OF FACA.—The Federal Advisory 

13 Committee Act (5 U.S.C. App.) shall apply to the Commu14 nity, except that the term provided for under section 

15 14(a)(2) of such Act shall be not longer than 7 years. 

16 (f) SUNSET.—The provisions of this section shall not 

17 apply after September 20, 2014. 

18 (g) AUTHORIZATION OF APPROPRIATIONS.—There is 

19 authorized to be appropriated to carry out this section, 

20 $2,000,000 for each of fiscal years 2009 and 2010. 

21 SEC. 204. RESEARCH ACCESS TO HEALTH CARE DATA AND 

22 REPORTING ON PERFORMANCE. 

23 The Secretary shall permit researchers that meet cri24 teria used to evaluate the appropriateness of the release 


hsrobinson on PROD1PC76 with BILLS
126 

•HR 5442 IH

1 data for research purpose (as established by the Sec2 retary) to— 

3 (1) have access to all Federal health care data; 

4 and 

5 (2) report on the performance of health care 

6 providers and suppliers, including reporting in a 

7 provider- or supplier-identifiable format. 

8 Subtitle B—Facilitating the Wide9 spread Adoption of Interoper10 able Health Information Tech11 nology 

12 SEC. 211. FACILITATING THE WIDESPREAD ADOPTION OF 

13 INTEROPERABLE HEALTH INFORMATION 

14 TECHNOLOGY. 

15 (a) COMPETITIVE GRANTS FOR ADOPTION OF TECH16 NOLOGY.— 

17 (1) IN GENERAL.—The Secretary may award 

18 competitive grants to eligible entities to facilitate the 

19 purchase and enhance the utilization of qualified 

20 health information technology systems (as defined in 

21 section 213) to improve the quality and efficiency of 

22 health care. 

23 (2) ELIGIBILITY.—To be eligible to receive a 

24 grant under paragraph (1) an entity shall— 


hsrobinson on PROD1PC76 with BILLS
127 

•HR 5442 IH

1 (A) submit to the Secretary an application 

2 at such time, in such manner, and containing 

3 such information as the Secretary may require; 

4 (B) submit to the Secretary a strategic 

5 plan for the implementation of data sharing 

6 and interoperability measures; 

7 (C) adopt the standards adopted by the 

8 Federal Government under section 301; 

9 (D) implement the measures adopted 

10 under section 221 and report to the Secretary 

11 on such measures; 

12 (E) comply with the requirements of title 

13 I; 

14 (F) take into account the input of employ15 ees and staff who are directly involved in pa16 tient care of such health care providers in the 

17 design, implementation, and use of qualified 

18 health information technology systems; 

19 (G) demonstrate significant financial need; 

20 (H) provide matching funds in accordance 

21 with paragraph (4); and 

22 (I) be a— 

23 (i) public or not for profit hospital; 


hsrobinson on PROD1PC76 with BILLS
128 

•HR 5442 IH

1 (ii) federally qualified health center 

2 (as defined in section 1861(aa)(4) of the 

3 Social Security Act); 

4 (iii) individual or group practice (or a 

5 consortium thereof); or 

6 (iv) another health care provider not 

7 described in clause (i) or (ii); 

8 that serves medically undeserved communities. 

9 (3) USE OF FUNDS.—Amounts received under a 

10 grant under this subsection shall be used to— 

11 (A) facilitate the purchase of qualified 

12 health information technology systems; 

13 (B) train personnel in the use of such sys14 tems; 

15 (C) enhance the utilization of qualified 

16 health information technology systems (which 

17 may include activities to increase the awareness 

18 among consumers of health care privacy protec19 tions); or 

20 (D) improve the prevention and manage21 ment of chronic disease. 

22 (4) MATCHING REQUIREMENT.—To be eligible 

23 for a grant under this subsection an entity shall con24 tribute non-Federal contributions to the costs of car25 rying out the activities for which the grant is awardVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00128 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
129 

•HR 5442 IH

1 ed in an amount equal to $1 for each $3 of Federal 

2 funds provided under the grant. 

3 (5) PREFERENCE IN AWARDING GRANTS.—In 

4 awarding grants under this subsection the Secretary 

5 shall give preference to— 

6 (A) eligible entities that will improve the 

7 degree to which such entity will link the quali8 fied health information technology system to 

9 local or regional health information plan or 

10 plans; and 

11 (B) with respect to awards made for the 

12 purpose of providing care in an outpatient med13 ical setting, entities that organize their prac14 tices as a patient-centered medical home. 

15 (b) COMPETITIVE GRANTS FOR THE DEVELOPMENT

16 OF STATE LOAN PROGRAMS TO FACILITATE THE WIDE17 SPREAD ADOPTION OF HEALTH INFORMATION TECH18 NOLOGY.— 

19 (1) IN GENERAL.—The Secretary may award 

20 competitive grants to States for the establishment of 

21 State programs for loans to health care providers to 

22 facilitate the purchase and enhance the utilization of 

23 qualified health information technology. 

24 (2) ESTABLISHMENT OF FUND.—To be eligible 

25 to receive a competitive grant under this subsection, 


hsrobinson on PROD1PC76 with BILLS
130 

•HR 5442 IH

1 a State shall establish a qualified health information 

2 technology loan fund (referred to in this subsection 

3 as a ‘‘State loan fund’’) and comply with the other 

4 requirements contained in this subsection. Amounts 

5 received under a grant under this subsection shall be 

6 deposited in the State loan fund established by the 

7 State. No funds authorized by other provisions of 

8 this title to be used for other purposes specified in 

9 this title shall be deposited in any such State loan 

10 fund. 

11 (3) ELIGIBILITY.—To be eligible to receive a 

12 grant under paragraph (1) a State shall— 

13 (A) submit to the Secretary an application 

14 at such time, in such manner, and containing 

15 such information as the Secretary may require; 

16 (B) submit to the Secretary a strategic 

17 plan in accordance with paragraph (4); 

18 (C) establish a qualified health information 

19 technology loan fund in accordance with para20 graph (2); 

21 (D) require that health care providers re22 ceiving loans under the grant— 

23 (i) link, to the extent practicable, the 

24 qualified health information system to a 


hsrobinson on PROD1PC76 with BILLS
131 

•HR 5442 IH

1 local or regional health information net2 work; 

3 (ii) consult, as needed, with the 

4 Health Information Technology Resource 

5 Center established in section 914(d) to ac6 cess the knowledge and experience of exist7 ing initiatives regarding the successful im8 plementation and effective use of health in9 formation technology; 

10 (iii) agree to notify individuals if their 

11 personal health information is wrongfully 

12 disclosed; and 

13 (iv) take into account the input of em14 ployees and staff who are directly involved 

15 in patient care of such health care pro16 viders in the design and implementation 

17 and use of qualified health information 

18 technology systems; 

19 (E) require that health care providers re20 ceiving loans under the grant adopt the stand21 ards adopted by the Federal Government under 

22 section 301; 

23 (F) require that health care providers re24 ceiving loans under the grant implement the 


hsrobinson on PROD1PC76 with BILLS
132 

•HR 5442 IH

1 measures adopted under section 221 and report 

2 to the Secretary on such measures; and 

3 (G) provide matching funds in accordance 

4 with paragraph (8). 

5 (4) STRATEGIC PLAN.— 

6 (A) IN GENERAL.—A State that receives a 

7 grant under this subsection shall annually pre8 pare a strategic plan that identifies the in9 tended uses of amounts available to the State 

10 loan fund of the State. 

11 (B) CONTENTS.—A strategic plan under 

12 subparagraph (A) shall include— 

13 (i) a list of the projects to be assisted 

14 through the State loan fund in the first 

15 fiscal year that begins after the date on 

16 which the plan is submitted; 

17 (ii) a description of the criteria and 

18 methods established for the distribution of 

19 funds from the State loan fund; 

20 (iii) a description of the financial sta21 tus of the State loan fund and the short22 term and long-term goals of the State loan 

23 fund; and 

24 (iv) a description of the strategies the 

25 State will use to address challenges in the 


hsrobinson on PROD1PC76 with BILLS
133 

•HR 5442 IH

1 adoption of health information technology 

2 due to limited broadband access. 

3 (5) USE OF FUNDS.— 

4 (A) IN GENERAL.—Amounts deposited in a 

5 State loan fund, including loan repayments and 

6 interest earned on such amounts, shall be used 

7 only for awarding loans or loan guarantees, or 

8 as a source of reserve and security for leveraged 

9 loans, the proceeds of which are deposited in 

10 the State loan fund established under para11 graph (1). Loans under this section may be 

12 used by a health care provider to— 

13 (i) facilitate the purchase of qualified 

14 health information technology systems; 

15 (ii) enhance the utilization of qualified 

16 health information technology systems 

17 (which may include activities to increase 

18 the awareness among consumers of health 

19 care of privacy protections and privacy 

20 rights); or 

21 (iii) train personnel in the use of such 

22 systems. 

23 (B) LIMITATION.—Amounts received by a 

24 State under this subsection may not be used— 


hsrobinson on PROD1PC76 with BILLS
134 

•HR 5442 IH

1 (i) for the purchase or other acquisi2 tion of any health information technology 

3 system that is not a qualified health infor4 mation technology system; 

5 (ii) to conduct activities for which 

6 Federal funds are expended under this 

7 title, or the amendments made by this 

8 title; or 

9 (iii) for any purpose other than mak10 ing loans to eligible entities under this sec11 tion. 

12 (6) TYPES OF ASSISTANCE.—Except as other13 wise limited by applicable State law, amounts depos14 ited into a State loan fund under this subsection 

15 may only be used for the following: 

16 (A) To award loans that comply with the 

17 following: 

18 (i) The interest rate for each loan 

19 shall be less than or equal to the market 

20 interest rate. 

21 (ii) The principal and interest pay22 ments on each loan shall commence not 

23 later than 1 year after the date on which 

24 the loan was awarded, and each loan shall 


hsrobinson on PROD1PC76 with BILLS
135 

•HR 5442 IH

1 be fully amortized not later than 10 years 

2 after such date. 

3 (iii) The State loan fund shall be 

4 credited with all payments of principal and 

5 interest on each loan awarded from the 

6 fund. 

7 (B) To guarantee, or purchase insurance 

8 for, a local obligation (all of the proceeds of 

9 which finance a project eligible for assistance 

10 under this subsection) if the guarantee or pur11 chase would improve credit market access or re12 duce the interest rate applicable to the obliga13 tion involved. 

14 (C) As a source of revenue or security for 

15 the payment of principal and interest on rev16 enue or general obligation bonds issued by the 

17 State if the proceeds of the sale of the bonds 

18 will be deposited into the State loan fund. 

19 (D) To earn interest on the amounts de20 posited into the State loan fund. 

21 (7) ADMINISTRATION OF STATE LOAN

22 FUNDS.— 

23 (A) COMBINED FINANCIAL ADMINISTRA24 TION.—A State may (as a convenience and to 

25 avoid unnecessary administrative costs) comVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00135 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
136 

•HR 5442 IH

1 bine, in accordance with State law, the financial 

2 administration of a State loan fund established 

3 under this subsection with the financial admin4 istration of any other revolving fund established 

5 by the State if not otherwise prohibited by the 

6 law under which the State loan fund was estab7 lished. 

8 (B) COST OF ADMINISTERING FUND.— 

9 Each State may annually use not to exceed 4 

10 percent of the funds provided to the State 

11 under a grant under this subsection to pay the 

12 reasonable costs of the administration of the 

13 programs under this section, including the re14 covery of reasonable costs expended to establish 

15 a State loan fund which are incurred after the 

16 date of enactment of this title. 

17 (C) GUIDANCE AND REGULATIONS.—The 

18 Secretary shall publish guidance and promul19 gate regulations as may be necessary to carry 

20 out the provisions of this subsection, includ21 ing— 

22 (i) provisions to ensure that each 

23 State commits and expends funds allotted 

24 to the State under this subsection as effiVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00136 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
137 

•HR 5442 IH

1 ciently as possible in accordance with this 

2 title and applicable State laws; and 

3 (ii) guidance to prevent waste, fraud, 

4 and abuse. 

5 (D) PRIVATE SECTOR CONTRIBUTIONS.— 

6 (i) IN GENERAL.—A State loan fund 

7 established under this subsection may ac8 cept contributions from private sector enti9 ties, except that such entities may not 

10 specify the recipient or recipients of any 

11 loan issued under this subsection. 

12 (ii) AVAILABILITY OF INFORMA13 TION.—A State shall make publicly avail14 able the identity of, and amount contrib15 uted by, any private sector entity under 

16 clause (i) and may issue letters of com17 mendation or make other awards (that 

18 have no financial value) to any such entity. 

19 (8) MATCHING REQUIREMENTS.— 

20 (A) IN GENERAL.—The Secretary may not 

21 make a grant under paragraph (1) to a State 

22 unless the State agrees to make available (di23 rectly or through donations from public or pri24 vate entities) non-Federal contributions in cash 

25 toward the costs of the State program to be imVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00137 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
138 

•HR 5442 IH

1 plemented under the grant in an amount equal 

2 to not less than $1 for each $1 of Federal 

3 funds provided under the grant. 

4 (B) DETERMINATION OF AMOUNT OF NON5 FEDERAL CONTRIBUTION.—In determining the 

6 amount of non-Federal contributions that a 

7 State has provided pursuant to subparagraph 

8 (A), the Secretary may not include any 

9 amounts provided to the State by the Federal 

10 Government. 

11 (9) PREFERENCE IN AWARDING GRANTS.—The 

12 Secretary may give a preference in awarding grants 

13 under this subsection to States that adopt value14 based purchasing programs to improve health care 

15 quality. 

16 (10) REPORTS.—The Secretary shall annually 

17 submit to the Committee on Health, Education, 

18 Labor, and Pensions and the Committee on Finance 

19 of the Senate, and the Committee on Energy and 

20 Commerce and the Committee on Ways and Means 

21 of the House of Representatives, a report summa22 rizing the reports received by the Secretary from 

23 each State that receives a grant under this sub24 section. 


hsrobinson on PROD1PC76 with BILLS
139 

•HR 5442 IH

1 (c) COMPETITIVE GRANTS FOR THE IMPLEMENTA2 TION OF REGIONAL OR LOCAL HEALTH INFORMATION

3 TECHNOLOGY PLANS.— 

4 (1) IN GENERAL.—The Secretary may award 

5 competitive grants to eligible entities to implement 

6 regional or local health information plans to improve 

7 health care quality and efficiency through the elec8 tronic exchange of personal health information pur9 suant to the standards, implementation specifica10 tions and certification criteria, and other require11 ments adopted by the Secretary under section 221. 

12 (2) ELIGIBILITY.—To be eligible to receive a 

13 grant under paragraph (1) an entity, which may be 

14 a health record bank or trust, shall— 

15 (A) demonstrate financial need to the Sec16 retary; 

17 (B) demonstrate that one of its principal 

18 missions or purposes is to use information tech19 nology to improve health care quality and effi20 ciency; 

21 (C) adopt bylaws, memoranda of under22 standing, or other charter documents that dem23 onstrate that the governance structure and de24 cision making processes of such entity allow for 


hsrobinson on PROD1PC76 with BILLS
140 

•HR 5442 IH

1 participation on an ongoing basis by multiple 

2 stakeholders within a community, including— 

3 (i) health care providers (including 

4 health care providers that provide services 

5 to low income and undeserved popu6 lations); 

7 (ii) pharmacists or pharmacies; 

8 (iii) health plans; 

9 (iv) health centers (as defined in sec10 tion 330(b)) and federally qualified health 

11 centers (as defined in section 1861(aa)(4) 

12 of the Social Security Act) and rural 

13 health clinics (as defined in section 

14 1861(aa) of the Social Security Act), if 

15 such centers or clinics are present in the 

16 community served by the entity; 

17 (v) patient or consumer organizations; 

18 (vi) organizations dedicated to im19 proving the health of vulnerable popu20 lations; 

21 (vii) employers; 

22 (viii) State or local health depart23 ments; and 


hsrobinson on PROD1PC76 with BILLS
141 

•HR 5442 IH

1 (ix) any other health care providers or 

2 other entities, as determined appropriate 

3 by the Secretary; 

4 (D) demonstrate the participation, to the 

5 extent practicable, of stakeholders in the elec6 tronic exchange of personal health information 

7 within the local or regional plan pursuant to 

8 subparagraph (C); 

9 (E) adopt nondiscrimination and conflict of 

10 interest policies that demonstrate a commit11 ment to open, fair, and nondiscriminatory par12 ticipation in the health information plan by all 

13 stakeholders; 

14 (F) adopt the standards adopted by the 

15 Secretary under section 301; 

16 (G) require that health care providers re17 ceiving such grants— 

18 (i) implement the measures adopted 

19 under section 221 and report to the Sec20 retary on such measures; and 

21 (ii) take into account the input of em22 ployees and staff who are directly involved 

23 in patient care of such health care pro24 viders in the design, implementation, and 


hsrobinson on PROD1PC76 with BILLS
142 

•HR 5442 IH

1 use of health information technology sys2 tems; 

3 (H) agree to comply with the requirements 

4 of title I; 

5 (I) facilitate the electronic exchange of per6 sonal health information within the local or re7 gional area and among local and regional areas; 

8 (J) prepare and submit to the Secretary an 

9 application in accordance with paragraph (3); 

10 (K) agree to provide matching funds in ac11 cordance with paragraph (5); and 

12 (L) reduce barriers to the implementation 

13 of health information technology by providers. 

14 (3) APPLICATION.— 

15 (A) IN GENERAL.—To be eligible to receive 

16 a grant under paragraph (1), an entity shall 

17 submit to the Secretary an application at such 

18 time, in such manner, and containing such in19 formation as the Secretary may require. 

20 (B) REQUIRED INFORMATION.—At a min21 imum, an application submitted under this 

22 paragraph shall include— 

23 (i) clearly identified short-term and 

24 long-term objectives of the regional or local 

25 health information plan; 


hsrobinson on PROD1PC76 with BILLS
143 

•HR 5442 IH

1 (ii) a technology plan that complies 

2 with the standards, implementation speci3 fications, and certification criteria adopted 

4 under section 202(c)(6) and that includes 

5 a descriptive and reasoned estimate of 

6 costs of the hardware, software, training, 

7 and consulting services necessary to imple8 ment the regional or local health informa9 tion plan; 

10 (iii) a strategy that includes initiatives 

11 to improve health care quality and effi12 ciency, including the use and reporting of 

13 health care quality measures adopted 

14 under section 221; 

15 (iv) a plan that describes provisions to 

16 encourage the implementation of the elec17 tronic exchange of personal health infor18 mation by all health care providers partici19 pating in the health information plan; 

20 (v) a plan to ensure the privacy and 

21 security of personal health information 

22 that is consistent with the requirements of 

23 title I; 

24 (vi) a governance plan that defines 

25 the manner in which the stakeholders shall 


hsrobinson on PROD1PC76 with BILLS
144 

•HR 5442 IH

1 jointly make policy and operational deci2 sions on an ongoing basis; 

3 (vii) a financial or business plan that 

4 describes— 

5 (I) the sustain ability of the plan; 

6 (II) the financial costs and bene7 fits of the plan; and 

8 (III) the entities to which such 

9 costs and benefits will accrue; 

10 (viii) a description of whether the 

11 State in which the entity resides has re12 ceived a grant under section 319D of the 

13 Public Health Service Act, alone or as a 

14 part of a consortium, and if the State has 

15 received such a grant, how the entity will 

16 coordinate the activities funded under such 

17 section 319D with the system under this 

18 section; and 

19 (ix) in the case of an applicant entity 

20 that is unable to demonstrate the partici21 pation of all stakeholders pursuant to 

22 paragraph (2)(C), the justification from 

23 the entity for any such nonparticipation. 

24 (4) USE OF FUNDS.—Amounts received under a 

25 grant under paragraph (1) shall be used to establish 


hsrobinson on PROD1PC76 with BILLS
145 

•HR 5442 IH

1 and implement a regional or local health information 

2 plan in accordance with this subsection. 

3 (5) MATCHING REQUIREMENT.— 

4 (A) IN GENERAL.—The Secretary may not 

5 make a grant under this subsection to an entity 

6 unless the entity agrees that, with respect to 

7 the costs to be incurred by the entity in car8 rying out the network program for which the 

9 grant was awarded, the entity will make avail10 able (directly or through donations from public 

11 or private entities) non-Federal contributions 

12 toward such costs in an amount equal to not 

13 less than 50 percent of such costs ($1 for each 

14 $2 of Federal funds provided under the grant). 

15 (B) DETERMINATION OF AMOUNT CON16 TRIBUTED.—Non-Federal contributions re17 quired under subparagraph (A) may be in cash 

18 or in kind, fairly evaluated, including equip19 ment, technology, or services. Amounts provided 

20 by the Federal Government, or services assisted 

21 or subsidized to any significant extent by the 

22 Federal Government, may not be included in 

23 determining the amount of such non-Federal 

24 contributions. 


hsrobinson on PROD1PC76 with BILLS
146 

•HR 5442 IH

1 (6) HEALTH RECORD BANK OR TRUST DE2 FINED.—In this section, the term ‘‘health record 

3 bank or trust’’ means an independent organization 

4 that provides a secure electronic repository for stor5 ing and maintaining an individual’s lifetime health 

6 and medical records from multiple sources and en7 suring that the individual always has complete con8 trol over who accesses their information. 

9 (d) REPORTS.—Not later than 1 year after the date 

10 on which the first grant is awarded under this section, 

11 and annually thereafter during the grant period, an entity 

12 that receives a grant under this section shall submit to 

13 the Secretary a report on the activities carried out under 

14 the grant involved. Each such report shall include— 

15 (1) a description of the financial costs and ben16 efits of the project involved and of the entities to 

17 which such costs and benefits accrue; 

18 (2) an analysis of the impact of the project on 

19 health care quality and safety; 

20 (3) a description of any reduction in duplicative 

21 or unnecessary care as a result of the project in22 volved; and 

23 (4) other information as required by the Sec24 retary. 

25 (e) AUTHORIZATION OF APPROPRIATIONS.— 


hsrobinson on PROD1PC76 with BILLS
147 

•HR 5442 IH

1 (1) IN GENERAL.—For the purpose of carrying 

2 out this section, there is authorized to be appro3 priated $139,000,000 for fiscal year 2009 and 

4 $139,000,000 for fiscal year 2010. 

5 (2) AVAILABILITY.—Amounts appropriated 

6 under paragraph (1) shall remain available through 

7 fiscal year 2012. 

8 SEC. 212. DEMONSTRATION PROGRAM TO INTEGRATE IN9 FORMATION TECHNOLOGY INTO CLINICAL 

10 EDUCATION. 

11 (a) IN GENERAL.—The Secretary may award grants 

12 to eligible entities or consortia under this section to carry 

13 out demonstration projects to develop academic curricula 

14 integrating qualified health information technology sys15 tems in the clinical education of health professionals or 

16 analyze clinical data sets to discover quality measures. 

17 Such awards shall be made on a competitive basis and 

18 pursuant to peer review. 

19 (b) ELIGIBILITY.—To be eligible to receive a grant 

20 under subsection (a), an entity or consortium shall— 

21 (1) submit to the Secretary an application at 

22 such time, in such manner, and containing such in23 formation as the Secretary may require; 

24 (2) be or include— 

25 (A) a health professions school; 


hsrobinson on PROD1PC76 with BILLS
148 

•HR 5442 IH

1 (B) a school of nursing; or 

2 (C) an institution with a graduate medical 

3 education program; 

4 (3) provide for the collection of data regarding 

5 the effectiveness of the demonstration project to be 

6 funded under the grant in improving the safety of 

7 patients and the efficiency of health care delivery; 

8 and 

9 (4) provide matching funds in accordance with 

10 subsection (d). 

11 (c) USE OF FUNDS.— 

12 (1) IN GENERAL.—With respect to a grant 

13 under subsection (a), an eligible entity or consortium 

14 shall use amounts received under the grant in col15 laboration with 2 or more disciplines. 

16 (2) LIMITATION.—An eligible entity or consor17 tium shall not award a grant under subsection (a) 

18 to purchase hardware, software, or services. 

19 (d) MATCHING FUNDS.— 

20 (1) IN GENERAL.—The Secretary may award a 

21 grant to an entity under or consortium this section 

22 only if the entity of consortium agrees to make avail23 able non-Federal contributions toward the costs of 

24 the program to be funded under the grant in an 


hsrobinson on PROD1PC76 with BILLS
149 

•HR 5442 IH

1 amount that is not less than $1 for each $2 of Fed2 eral funds provided under the grant. 

3 (2) DETERMINATION OF AMOUNT CONTRIB4 UTED.—Non-Federal contributions under paragraph 

5 (1) may be in cash or in kind, fairly evaluated, in6 cluding equipment or services. Amounts provided by 

7 the Federal Government, or services assisted or sub8 sidized to any significant extent by the Federal Gov9 ernment, may not be included in determining the 

10 amount of such contributions. 

11 (e) EVALUATION.—The Secretary shall take such ac12 tion as may be necessary to evaluate the projects funded 

13 under this section and publish, make available, and dis14 seminate the results of such evaluations on as wide a basis 

15 as is practicable. 

16 (f) REPORTS.—Not later than 1 year after the date 

17 of enactment of this title, and annually thereafter, the Sec18 retary shall submit to the Committee on Health, Edu19 cation, Labor, and Pensions and the Committee on Fi20 nance of the Senate, and the Committee on Energy and 

21 Commerce and the Committee on Ways and Means of the 

22 House of Representatives a report that— 

23 (1) describes the specific projects established 

24 under this section; and 


hsrobinson on PROD1PC76 with BILLS
150 

•HR 5442 IH

1 (2) contains recommendations for Congress 

2 based on the evaluation conducted under subsection 

3 (e). 

4 (g) AUTHORIZATION OF APPROPRIATIONS.—There is 

5 authorized to be appropriated to carry out this section, 

6 $2,000,000 for each of fiscal years 2009 and 2010. 

7 (h) SUNSET.—This provisions of this section shall not 

8 apply after September 30, 2012. 

9 SEC. 213. QUALIFIED HEALTH INFORMATION TECHNOLOGY 

10 SYSTEM DEFINED. 

11 In this subtitle, the term ‘‘qualified health informa12 tion technology system’’ means a computerized system (in13 cluding hardware and software) that— 

14 (1) safeguards the privacy, security, and con15 fidentiality of personal health information in accord16 ance with the requirements of title I; 

17 (2) maintains and provides permitted access to 

18 health information in an electronic format; 

19 (3) with respect to personal health information 

20 maintained in a designated record set, preserves an 

21 audit trail of each individual that has gained access 

22 to such record set; 

23 (4) incorporates decision support to reduce 

24 medical errors and enhance health care quality; 


hsrobinson on PROD1PC76 with BILLS
151 

•HR 5442 IH

1 (5) complies with the standards adopted by the 

2 Federal Government under section 202; 

3 (6) has the ability to transmit and exchange in4 formation to other health information technology 

5 systems and, to the extent feasible, public health in6 formation technology systems; and 

7 (7) allows for the reporting of quality measures 

8 adopted under section 221. 

9 Subtitle C—Improving the Quality 

10 of Health Care 

11 SEC. 221. FOSTERING DEVELOPMENT AND USE OF HEALTH 

12 CARE QUALITY MEASURES. 

13 (a) IN GENERAL.—The Secretary shall provide for 

14 the development and use of health care quality measures 

15 (referred to in this title as ‘‘quality measures’’) for the 

16 purpose of measuring the quality and efficiency of health 

17 care that patients receive. 

18 (b) DESIGNATION OF, AND ARRANGEMENT WITH, 

19 ORGANIZATION.— 

20 (1) IN GENERAL.—Not later than 90 days after 

21 the date of enactment of this title, the Secretary 

22 shall designate, and have in effect an arrangement 

23 with, a single organization that meets the require24 ments of subsection (c) under which such organiza25 tion shall promote the development of quality measVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00151 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
152 

•HR 5442 IH

1 ures and provide the Secretary with advice and rec2 ommendations on the key elements and priorities of 

3 a national system for healthcare performance meas4 urement. 

5 (2) RESPONSIBILITIES.—The responsibilities to 

6 be performed by the organization designated under 

7 paragraph (1) (in this title referred to as the ‘‘des8 ignated organization’’) shall include— 

9 (A) establishing and managing an inte10 grated national strategy and process for setting 

11 priorities and goals in establishing quality 

12 measures; 

13 (B) coordinating and harmonizing the de14 velopment and testing of such measures; 

15 (C) establishing standards for the develop16 ment and testing of such measures; 

17 (D) endorsing national consensus quality 

18 measures; 

19 (E) recommending, in collaboration with 

20 multi-stakeholder groups, quality measures to 

21 the Secretary for adoption and use; 

22 (F) promoting the development and use of 

23 electronic health records that contain the 

24 functionality for automated collection, aggregaVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00152 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
153 

•HR 5442 IH

1 tion, and transmission of performance measure2 ment information; and 

3 (G) providing recommendations and advice 

4 to the Partnership for Health Care Improve5 ment regarding the integration of quality meas6 ures into the certification process outlined 

7 under section 202 and the American Health In8 formation Community regarding national poli9 cies outlined under section 203. 

10 (c) REQUIREMENTS DESCRIBED.—The requirements 

11 described in this subsection are the following: 

12 (1) PRIVATE ENTITY.—The organization shall 

13 be a private nonprofit entity that is governed by a 

14 board of directors and an individual who is des15 ignated as president and chief executive officer. 

16 (2) BOARD MEMBERSHIP.—The members of the 

17 board of directors of the entity shall include rep18 resentatives of— 

19 (A) health care providers or groups rep20 resenting providers; 

21 (B) health plans or groups representing 

22 health plans; 

23 (C) patients or consumers enrolled in such 

24 plans or groups representing individuals en25 rolled in such plans; 


hsrobinson on PROD1PC76 with BILLS
154 

•HR 5442 IH

1 (D) health care purchasers and employers 

2 or groups representing purchasers or employers; 

3 and 

4 (E) organizations that develop health in5 formation technology standards and new health 

6 information technology. 

7 (3) OTHER MEMBERSHIP REQUIREMENTS.— 

8 The membership of the board of directors of the en9 tity shall be representative of individuals with expe10 rience with— 

11 (A) urban health care issues; 

12 (B) safety net health care issues; 

13 (C) rural or frontier health care issues; 

14 (D) quality and safety issues; 

15 (E) State or local health programs; 

16 (F) individuals or entities skilled in the 

17 conduct and interpretation of biomedical, health 

18 services, and health economics research and 

19 with expertise in outcomes and effectiveness re20 search and technology assessment; 

21 (G) individuals or entities involved in the 

22 development and establishment of standards 

23 and certification for health information tech24 nology systems and clinical data; and 


hsrobinson on PROD1PC76 with BILLS
155 

•HR 5442 IH

1 (H) members of the medical and mental 

2 health professions with expertise in standards 

3 of professional ethics. 

4 (4) OPEN AND TRANSPARENT.—With respect to 

5 matters related to the arrangement with the Sec6 retary under subsection (a)(1), the organization 

7 shall conduct its business in an open and trans8 parent manner, and provide the opportunity for pub9 lic comment and ensure a balance among disparate 

10 stakeholders, so that no member organization unduly 

11 influences the work of the organization. 

12 (5) VOLUNTARY CONSENSUS STANDARDS SET13 TING ORGANIZATIONS.—The organization shall oper14 ate as a voluntary consensus standards setting orga15 nization as defined for purposes of section 12(d) of 

16 the National Technology Transfer and Advancement 

17 Act of 1995 (Public Law 104–113) and Office of 

18 Management and Budget Revised Circular A–119 

19 (published in the Federal Register on February 10, 

20 1998). 

21 (6) PARTICIPATION.—If the organization re22 quires a fee for membership, the organization shall 

23 ensure that such fee is not a substantial barrier to 

24 participation in the entity’s activities related to the 

25 arrangement with the Secretary. 


hsrobinson on PROD1PC76 with BILLS
156 

•HR 5442 IH

1 (d) REQUIREMENTS FOR MEASURES.—The quality 

2 measures developed under this title shall comply with the 

3 following: 

4 (1) MEASURES.—The designated organization, 

5 in promoting the development of quality measures 

6 under this title, shall ensure that such measures— 

7 (A) are evidence-based, reliable, and valid; 

8 (B) include— 

9 (i) measures of clinical processes and 

10 outcomes, patient experience, efficiency, 

11 and equity; and 

12 (ii) measures to assess effectiveness, 

13 timeliness, patient self-management, pa14 tient centeredness, and safety; and 

15 (C) include measures of underuse and 

16 overuse. 

17 (2) PRIORITIES.—In carrying out its respon18 sibilities under this section, the designated organiza19 tion shall ensure that priority is given to— 

20 (A) measures that preserve access to qual21 ity health care by protecting the privacy and se22 curity of personal health information; 

23 (B) measures with the greatest potential 

24 impact for improving the performance and effi25 ciency of care; 


hsrobinson on PROD1PC76 with BILLS
157 

•HR 5442 IH

1 (C) measures that may be rapidly imple2 mented by group health plans, health insurance 

3 issuers, physicians, hospitals, nursing homes, 

4 long-term care providers, and other providers; 

5 (D) measures which may inform health 

6 care decisions made by consumers and patients; 

7 (E) measures that apply to multiple serv8 ices furnished by different providers during an 

9 episode of care; 

10 (F) measures that can be integrated into 

11 certification process described in section 202; 

12 and 

13 (G) measures that may be integrated into 

14 the decision support function of qualified health 

15 information technology as defined by this title. 

16 (3) RISK ADJUSTMENT.—The designated orga17 nization, in consultation with performance measure 

18 developers and other stakeholders, shall establish 

19 procedures to ensure that quality measures take into 

20 account differences in patient health status, patient 

21 characteristics, and geographic location, as appro22 priate. 

23 (4) MAINTENANCE.—The designated organiza24 tion, in consultation with owners and developers of 

25 quality measures, shall require the owners or develVerDate Aug 31 2005 20:42 Feb 21, 2008 Jkt 069200 PO 00000 Frm 00157 Fmt 6652 Sfmt 6201 E:\BILLS\H5442.IH H5442

hsrobinson on PROD1PC76 with BILLS
158 

•HR 5442 IH

1 opers of quality measures to update and enhance 

2 such measures, including the development of more 

3 accurate and precise specifications, and retire exist4 ing outdated measures. Such updating shall occur 

5 not more often than once during each 12-month pe6 riod, except in the case of emergency circumstances 

7 requiring a more immediate update to a measure. 

8 (e) GRANTS FOR PERFORMANCE MEASURE DEVEL9 OPMENT.—The Secretary, acting through the Agency for 

10 Healthcare Research and Quality, may award grants, in 

11 amounts not to exceed $50,000 each, to organizations to 

12 support the development and testing of quality measures 

13 that meet the standards established by the designated or14 ganization. 

15 SEC. 222. ADOPTION AND USE OF QUALITY MEASURES; RE16 PORTING. 

17 (a) IN GENERAL.—For purposes of carrying out ac18 tivities authorized or required by this title to ensure the 

19 use of quality measures and to foster uniformity between 

20 health care quality measures utilized by private entities, 

21 the Secretary shall— 

22 (1) select quality measures for adoption and 

23 use, from quality measures recommended by multi24 stakeholder groups and endorsed by the designated 

25 organization; and 


hsrobinson on PROD1PC76 with BILLS
159 

•HR 5442 IH

1 (2) ensure that standards adopted under sec2 tion 301 integrate the quality measures endorsed, 

3 adopted, and utilized under this section. 

4 (b) RELATIONSHIP WITH PROGRAMS UNDER THE

5 SOCIAL SECURITY ACT.—The Secretary shall ensure that 

6 the quality measures adopted under this section— 

7 (1) complement quality measures developed by 

8 the Secretary under programs administered by the 

9 Secretary under the Social Security Act, including 

10 programs under titles XVIII, XIX, and XXI of such 

11 Act; and 

12 (2) do not conflict with the needs and priorities 

13 of the programs under titles XVIII, XIX, and XXI 

14 of such Act, as set forth by the Administrator of the 

15 Centers for Medicare & Medicaid Services. 

16 (c) REPORTING.—The Secretary shall implement pro17 cedures, consistent with generally accepted standards, to 

18 enable the Department of Health and Human Services to 

19 accept the electronic submission of data for purposes of 

20 performance measurement, including at the provider level, 

21 using the quality measures developed, endorsed, and 

22 adopted pursuant to this title. 

23 (d) DISSEMINATION OF INFORMATION.—In order to 

24 make comparative performance information available to 

25 health care consumers, health professionals, public health 


hsrobinson on PROD1PC76 with BILLS
160 

•HR 5442 IH

1 officials, oversight organizations, researchers, and other 

2 appropriate individuals and entities, after consultation 

3 with multi-stakeholder groups, the Secretary shall promul4 gate regulations to provide for the dissemination, aggrega5 tion, and analysis of quality measures collected pursuant 

6 to this title. 

7 Subtitle D—Miscellaneous 

8 Provisions 

9 SEC. 231. HEALTH INFORMATION TECHNOLOGY RESOURCE 

10 CENTER. 

11 Section 914 of the Public Health Service Act (42 

12 U.S.C. 299b–3) is amended by adding at the end the fol13 lowing: 

14 ‘‘(d) HEALTH INFORMATION TECHNOLOGY RE15 SOURCE CENTER.— 

16 ‘‘(1) IN GENERAL.—The Secretary, acting 

17 through the Director, shall develop a Health Infor18 mation Technology Resource Center (referred to in 

19 this subsection as the ‘Center’) to provide technical 

20 assistance and develop best practices to support and 

21 accelerate efforts to adopt, implement, and effec22 tively use interoperable health information tech23 nology in compliance with sections 202 and 221 of 

24 the TRUST in Health Information Act of 2008. 


hsrobinson on PROD1PC76 with BILLS
161 

•HR 5442 IH

1 ‘‘(2) PURPOSES.—The purposes of the Center 

2 are to— 

3 ‘‘(A) provide a forum for the exchange of 

4 knowledge and experience; 

5 ‘‘(B) accelerate the transfer of lessons 

6 learned from existing public and private sector 

7 initiatives, including those currently receiving 

8 Federal financial support; 

9 ‘‘(C) assemble, analyze, and widely dis10 seminate evidence and experience related to the 

11 adoption, implementation, and effective use of 

12 interoperable health information technology; 

13 ‘‘(D) provide for the establishment of re14 gional and local health information networks to 

15 facilitate the development of interoperability 

16 across health care settings and improve the 

17 quality of health care; 

18 ‘‘(E) provide for the development of solu19 tions to barriers to the exchange of electronic 

20 health information; and 

21 ‘‘(F) conduct other activities identified by 

22 the States, local, or regional health information 

23 networks, or health care stakeholders as a focus 

24 for developing and sharing best practices. 


hsrobinson on PROD1PC76 with BILLS
162 

•HR 5442 IH

1 ‘‘(3) SUPPORT FOR ACTIVITIES.—To provide 

2 support for the activities of the Center, the Director 

3 shall modify the requirements, if necessary, that 

4 apply to the National Resource Center for Health 

5 Information Technology to provide the necessary in6 frastructure to support the duties and activities of 

7 the Center and facilitate information exchange 

8 across the public and private sectors. 

9 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in 

10 this subsection shall be construed to require the du11 plication of Federal efforts with respect to the estab12 lishment of the Center, regardless of whether such 

13 efforts were carried out prior to or after the enact14 ment of this subsection. 

15 ‘‘(e) AUTHORIZATION OF APPROPRIATIONS.—There 

16 is authorized to be appropriated, such sums as may be 

17 necessary for each of fiscal years 2009 and 2010 to carry 

18 out this section.’’. 

19 SEC. 232. FACILITATING THE PROVISION OF TELEHEALTH 

20 SERVICES ACROSS STATE LINES. 

21 Section 330L of the Public Health Service Act (42 

22 U.S.C. 254c–18) is amended to read as follows: 


hsrobinson on PROD1PC76 with BILLS
163 

•HR 5442 IH

1 ‘‘SEC. 330L. TELEMEDICINE; INCENTIVE GRANTS REGARD2 ING COORDINATION AMONG STATES. 

3 ‘‘(a) FACILITATING THE PROVISION OF TELE4 HEALTH SERVICES ACROSS STATE LINES.—The Sec5 retary may make grants to States that have adopted re6 gional State reciprocity agreements for practitioner licen7 sure, in order to expedite the provision of telehealth serv8 ices across State lines. 

9 ‘‘(b) AUTHORIZATION OF APPROPRIATIONS.—For the 

10 purpose of carrying out subsection (a), there are author11 ized to be appropriated such sums as may be necessary 

12 for each of the fiscal years 2009 and 2010.’’. 

13 Subtitle E—Definitions 

14 SEC. 241. DEFINITIONS. 

15 In this title, the following terms, defined in section 

16 171, have the meanings given such terms in such section: 

17 Breach , confidentiality, de-identified health information, 

18 disclose, Director of the Office of Health Information Pri19 vacy, employer, health care, health care provider, Office 

20 of Health Information Privacy, privacy, personal health 

21 information, Secretary, security, State, and use. 

22 TITLE III—ADDITIONAL 

23 PROVISIONS 

24 SEC. 301. FEDERAL PURCHASING AND DATA COLLECTION 

25 BY CMS AND OTHER FEDERAL AGENCIES. 

26 (a) COORDINATION OF FEDERAL SPENDING.— 


hsrobinson on PROD1PC76 with BILLS
164 

•HR 5442 IH

1 (1) IN GENERAL.—Not later than 1 year after 

2 the adoption by the President of a recommendation 

3 under section 202(c)(6), the Administrator of the 

4 Center for Medicare & Medicaid Services and the 

5 head of any other Federal agency shall not expend 

6 Federal funds for the purchase of any new health in7 formation technology or health information tech8 nology system for clinical care or for the electronic 

9 retrieval, storage, or exchange of personal health in10 formation if such technology or system is not con11 sistent with applicable standards adopted by the 

12 Federal Government under section 202. 

13 (2) RULE OF CONSTRUCTION.—Nothing in 

14 paragraph (1) shall be construed to restrict the pur15 chase of minor (as determined by the Secretary) 

16 hardware or software components in order to mod17 ify, correct a deficiency in, or extend the life of exist18 ing hardware or software. 

19 (b) VOLUNTARY ADOPTION.— 

20 (1) IN GENERAL.—Any standards and imple21 mentation specifications adopted by the Federal 

22 Government under section 202(c) shall be voluntary 

23 with respect to private entities. 

24 (2) REQUIREMENT.—Private entities that enter 

25 into a contract with the Federal Government shall 


hsrobinson on PROD1PC76 with BILLS
165 

•HR 5442 IH

1 adopt the standards and implementation specifica2 tions adopted by the Federal Government under this 

3 section for the purpose of activities under such Fed4 eral contract. 

5 (3) RULE OF CONSTRUCTION.—Nothing in this 

6 section shall be construed to require that a private 

7 entity that enters into a contract with the Federal 

8 Government adopt the standards and implementa9 tion specifications adopted by the Federal Govern10 ment under this section with respect to activities not 

11 related to the contract. 

12 (c) COORDINATION OF FEDERAL DATA COLLEC13 TION.—Not later than 3 years after the adoption by the 

14 Federal Government of a recommendation as provided for 

15 in section 202(c), all Federal agencies (including the Cen16 ter for Medicare & Medicaid Services) collecting health 

17 data in an electronic format for the purposes of quality 

18 reporting, surveillance, epidemiology, adverse event report19 ing, research, or for other purposes determined appro20 priate by the Secretary, shall comply with the standards 

21 and implementation specifications adopted under such 

22 subsection. 


hsrobinson on PROD1PC76 with BILLS
166 

•HR 5442 IH

1 SEC. 302. ENSURING HEALTH CARE PROVIDERS PARTICI2 PATING IN THE MEDICARE PROGRAM MAY 

3 MAINTAIN HEALTH INFORMATION IN ELEC4 TRONIC FORM. 

5 Section 1871 of the Social Security Act (42 U.S.C. 

6 1395hh) is amended by adding at the end the following 

7 new subsection: 

8 ‘‘(g)(1) Any provider of services or supplier shall be 

9 deemed as meeting any requirement for the maintenance 

10 of data in paper form under this title (whether or not for 

11 purposes of management, billing, reporting, reimburse12 ment, or otherwise) if the required data is maintained in 

13 an electronic form. 

14 ‘‘(2) Nothing in this subsection shall be construed as 

15 requiring health care providers to maintain or submit data 

16 in electronic form.’’. 

Æ 


hsrobinson on PROD1PC76 with BILLS