II 

114TH CONGRESS 

2D SESSION S. 3530 

To allow the use of claims, eligibility, and payment data to produce reports, 

analyses, and presentations to benefit Medicare, and other similar health 

insurance programs, entities, researchers, and health care providers, to 

help develop cost saving approaches, standards, and reference materials 

and to support medical care and improved payment models. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 8, 2016 

Mr. CASSIDY introduced the following bill; which was read twice and referred 

to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To allow the use of claims, eligibility, and payment data 

to produce reports, analyses, and presentations to benefit 

Medicare, and other similar health insurance programs, 

entities, researchers, and health care providers, to help 

develop cost saving approaches, standards, and reference 

materials and to support medical care and improved payment models. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Ensuring Patient Ac5 cess to Healthcare Records Act of 2016’’. 

mstockstill on DSK3G9T082PROD with BILLS

2 

•S 3530 IS

1 SEC. 2. PROMOTION OF ACCESS TO DATA, VIA RESEARCH 

2 AND USER FRIENDLY PRESENTATIONS AND 

3 APPLICATIONS. 

4 (a) IN GENERAL.—Subtitle D of the Health Informa5 tion Technology for Economic and Clinical Health Act (42 

6 U.S.C. 17921 et seq.) is amended by adding at the end 

7 the following: 

8 ‘‘PART 3—HEALTH CARE CLEARINGHOUSES; 

9 DATA PROCESSING TO EMPOWER PATIENTS 

10 AND IMPROVE THE HEALTH CARE SYSTEM 

11 ‘‘SEC. 13451. MODERNIZING THE ROLE OF CLEARING12 HOUSES IN HEALTH CARE. 

13 ‘‘(a) EFFORTS TO PROMOTE ACCESS TO AND

14 LEVERAGING OF HEALTH INFORMATION.— 

15 ‘‘(1) IN GENERAL.—The Secretary shall, 

16 through the updating of existing policies and devel17 opment of policies that support dynamic technology 

18 solutions, promote patient access to information re19 lated to their care, including real world outcomes 

20 and economic data (including claims, eligibility, and 

21 payment data), in a manner that would ensure that 

22 such information is available in a form convenient 

23 for the patient, in a reasonable manner, and without 

24 burdening the health care provider involved. 

25 ‘‘(2) REQUIREMENT.—Activities carried out 

26 under paragraph (1) shall include the development 

mstockstill on DSK3G9T082PROD with BILLS

3 

•S 3530 IS

1 of policies to enable covered entities with access to 

2 health information to— 

3 ‘‘(A) provide patient access to information 

4 related to their care, including real world out5 comes and economic data; and 

6 ‘‘(B) develop patient engagement tools, re7 ports, analyses, and presentations based on 

8 population health, epidemiological, and health 

9 services outcomes data, that may demonstrate a 

10 fiscal or treatment benefit to the taxpayer. 

11 ‘‘(b) TREATMENT AS COVERED ENTITY FOR SPECI12 FIED FUNCTIONS.— 

13 ‘‘(1) IN GENERAL.—With respect to the use 

14 and disclosure of protected health information, the 

15 Secretary shall— 

16 ‘‘(A) not consider health care clearing17 houses that engage in the functions described in 

18 paragraph (3) to be business associates under 

19 HIPAA-related provisions (as defined in sub20 section (j)(3)) regardless of the role of such 

21 clearinghouses in collecting or receiving the in22 formation; and 

23 ‘‘(B) consider such clearinghouses to be 

24 covered entities under such provisions of law for 

25 all purposes. 

mstockstill on DSK3G9T082PROD with BILLS

4 

•S 3530 IS

1 Such clearinghouses shall not be considered business 

2 associates for data translation, analytic, cloud com3 puting, or any other purpose. 

4 ‘‘(2) DATA ACCURACY AND SECURITY REQUIRE5 MENT.—In order to use health data as authorized by 

6 this section, a clearinghouse or other covered entity 

7 engaging in activities authorized under this section 

8 shall be certified to have the necessary expertise and 

9 technical infrastructure to ensure the accuracy and 

10 security of such claims, eligibility, and payment data 

11 through receipt of an accreditation by the Electronic 

12 Healthcare Network Accreditation Commission, or 

13 by an equivalent accreditation program determined 

14 appropriate by the Secretary. 

15 ‘‘(3) ENHANCING TREATMENT, QUALITY IM16 PROVEMENT, RESEARCH, PUBLIC HEALTH EFFORTS

17 AND OTHER FUNCTIONS.— 

18 ‘‘(A) EQUIVALENT AUTHORITY TO OTHER

19 COVERED ENTITIES.—Subject to paragraph (2), 

20 a health care clearinghouse shall— 

21 ‘‘(i) in addition to carrying out claims 

22 processing functions, be permitted to use 

23 and disclose protected health information 

24 in the same manner as other covered enti25 ties, including for purposes of treatment, 

mstockstill on DSK3G9T082PROD with BILLS

5 

•S 3530 IS

1 payment, health care operations as per2 mitted by section 164.506 of title 45, Code 

3 of Federal Regulations, research, and pub4 lic health as permitted by section 164.512 

5 of title 45, Code of Federal Regulations, 

6 and creating de-identified information as 

7 permitted by section 164.502(d) of title 

8 45, Code of Federal Regulations; and 

9 ‘‘(ii) use or disclose protected health 

10 information as required by section 

11 164.502(a)(2) of title 45, Code of Federal 

12 Regulations. 

13 ‘‘(B) ADDITIONAL AUTHORITY.—Subject 

14 to paragraph (2), a health care clearinghouse 

15 and other covered entity shall, in addition to 

16 claims processing functions, be permitted to— 

17 ‘‘(i) provide individuals with access to 

18 their own protected health information as 

19 described in subsection (d); 

20 ‘‘(ii) subject to subsection (c)(2), and 

21 on behalf of both covered entities and non22 covered entities, use and disclose protected 

23 health information for health care oper24 ations purposes (as defined by section 

25 164.501 of title 45, Code of Federal Regumstockstill on DSK3G9T082PROD with BILLS

6 

•S 3530 IS

1 lations) without respect to whether the re2 cipient of the information has or had a re3 lationship with the individual; 

4 ‘‘(iii) subject to subsection (c)(2), and 

5 upon the request of a covered entity, 

6 benchmark the operations of such covered 

7 entity against the operations of one or 

8 more other covered entities that have elect9 ed to participate in such benchmarking; 

10 and 

11 ‘‘(iv) subject to subsection (c)(2), use 

12 protected health information to facilitate 

13 clinical trial recruitment. 

14 ‘‘(c) AUTHORITIES RELATING TO DATA PROC15 ESSING.— 

16 ‘‘(1) IN GENERAL.—In carrying out HIPAA-re17 lated provisions, the Secretary shall permit a health 

18 care clearinghouse to aggregate protected health in19 formation that the clearinghouse possesses in order 

20 to carry out the functions described in subsection 

21 (b)(3). Subject to section 164.502(a)(5)(i) of title 

22 45, Code of Federal Regulations, a health care clear23 inghouse may carry out the functions described in 

24 subsection (b)(3) without obtaining individual aumstockstill on DSK3G9T082PROD with BILLS

7 

•S 3530 IS

1 thorization under section 164.508 of title 45, Code 

2 of Federal Regulations. 

3 ‘‘(2) PRIVACY.—For purposes of clauses (ii) 

4 through (iv) of subsection (b)(3)(B), with respect to 

5 any report, analysis, or presentation provided by the 

6 clearinghouse to a third party, such report, analysis, 

7 or presentation— 

8 ‘‘(A) shall include only de-identified data; 

9 or 

10 ‘‘(B) if containing protected health infor11 mation, shall include such data that is subject 

12 to a qualifying data use agreement (as defined 

13 in subsection (j)). 

14 ‘‘(3) FEE PERMITTED.—Nothing in this para15 graph shall be construed to prohibit an individual’s 

16 right to access claims and payment records in 

17 HIPAA standard format for a reasonable, cost-based 

18 fee pursuant to section 164.524(c)(4) of title 45, 

19 Code of Federal Regulations. In requesting access to 

20 records held by a health care clearinghouse, the indi21 vidual shall identify the health care provider or pro22 viders that rendered care. 

23 ‘‘(d) COMPREHENSIVE RECORDS AT THE REQUEST

24 OF AN INDIVIDUAL.— 

mstockstill on DSK3G9T082PROD with BILLS

8 

•S 3530 IS

1 ‘‘(1) IN GENERAL.—When a health care clear2 inghouse receives a written request from an indi3 vidual for the protected health information of the in4 dividual, the clearinghouse shall provide to the indi5 vidual a comprehensive record of such information 

6 (across health care providers and health plans and 

7 longitudinal in scope), unless the clearinghouse de8 termines in its sole discretion that providing a com9 prehensive record is not technologically feasible. 

10 ‘‘(2) PURCHASE FROM OTHER CLEARING11 HOUSES.—In preparing a comprehensive record for 

12 an individual under paragraph (1), a health care 

13 clearinghouse may, with the permission of the indi14 vidual, purchase the protected health information of 

15 the individual from one or more other health clear16 inghouses (and the cost of such purchase may be in17 cluded in a fair-market fee charged to the individual 

18 as provided for under paragraph (1)). 

19 ‘‘(e) SITUATIONS NOT INVOLVING DIRECT INTER20 ACTION WITH INDIVIDUALS.—Sections 164.400 through 

21 164.414 (relating to breach notification) and sections 

22 164.520 through 164.528 (relating to individual rights) 

23 of title 45, Code of Federal Regulations, shall apply to 

24 a health care clearinghouse that engages in the functions 

25 described in subsection (b)(3) to the extent that such 

mstockstill on DSK3G9T082PROD with BILLS

9 

•S 3530 IS

1 clearinghouse has current contact information pursuant to 

2 direct interaction with the individual involved. In the case 

3 of each other individual, the clearinghouse shall provide 

4 notice to the covered entity of any breach of unsecured 

5 protected health information and provide a notice of pri6 vacy practices on its website. 

7 ‘‘(f) TRANSITION.— 

8 ‘‘(1) IN GENERAL.—Nothing in this section 

9 shall be construed to provide a health care clearing10 house greater authority to use and disclose protected 

11 health information than that provided to another 

12 covered entity. 

13 ‘‘(2) EXISTING AGREEMENTS.—With respect to 

14 agreements entered into by a health care clearing15 house prior to the date of enactment of this section, 

16 a provision of such an agreement that conflicts with 

17 this section shall not have any legal force or effect. 

18 The preceding sentence may not be construed as af19 fecting any provision of an agreement that does not 

20 conflict with this section. 

21 ‘‘(g) SAFE HARBOR AND CLARIFICATION OF LIABIL22 ITY.—In the case of a health care clearinghouse that en23 gages in a function described in subsection (b), only that 

24 clearinghouse may be held liable for a violation of a 

25 HIPAA-related provision (and a covered entity that promstockstill on DSK3G9T082PROD with BILLS

10 

•S 3530 IS

1 vided data or data access to the clearinghouse shall not 

2 be liable for such violations). 

3 ‘‘(h) ENFORCEMENT.—Section 13410(a)(2) shall 

4 apply to this section in the same manner as such section 

5 applies to parts 1 and 2. 

6 ‘‘(i) RELATION TO OTHER LAWS.— 

7 ‘‘(1) APPLICATION OF HITECH RULE.—Section 

8 13421 shall apply to this section in the same man9 ner as such section applies to parts 1 and 2, except 

10 to the extent that such section 13421 concerns sec11 tion 1178(a)(2)(B) of the Social Security Act. 

12 ‘‘(2) STATE LAWS REGARDING UNFAIR OR DE13 CEPTIVE ACTS OR PRACTICES.—This part shall not 

14 be construed to preempt the law of any State that 

15 prohibits unfair or deceptive acts or practices. 

16 ‘‘(j) DEFINITIONS.—In this part: 

17 ‘‘(1) DE-IDENTIFIED.—The term ‘de-identified’, 

18 with respect to health information, means such in19 formation that is not individually identifiable as de20 termined in accordance with the standards under 

21 section 164.514(b) of title 45, Code of Federal Reg22 ulations. 

23 ‘‘(2) HEALTH CARE CLEARINGHOUSE.—The 

24 term ‘health care clearinghouse’ has the meaning 

mstockstill on DSK3G9T082PROD with BILLS

11 

•S 3530 IS

1 given such term in section 1171 of the Social Secu2 rity Act. 

3 ‘‘(3) HIPAA-RELATED PROVISION.—The term 

4 ‘HIPAA-related provision’ means the provisions of 

5 each of the following: 

6 ‘‘(A) This subtitle. 

7 ‘‘(B) Part C of title XI of the Social Secu8 rity Act. 

9 ‘‘(C) Regulations promulgated pursuant to 

10 sections 262(a) and 264(c) of the Health Insur11 ance Portability and Accountability Act of 1996 

12 or this subtitle. 

13 ‘‘(4) INDIVIDUAL.—The term ‘individual’, with 

14 respect to protected health information, has the 

15 meaning applicable under section 160.103 of title 

16 45, Code of Federal Regulations. 

17 ‘‘(5) QUALIFYING DATA USE AGREEMENT.—The 

18 term ‘qualifying data use agreement’ means an 

19 agreement, which may be electronic, that establishes 

20 the permitted uses and disclosures of protected 

21 health information by the recipient consistent with 

22 this paragraph. A qualifying data use agreement be23 tween the health care clearinghouse and the data re24 cipient shall— 

mstockstill on DSK3G9T082PROD with BILLS

12 

•S 3530 IS

1 ‘‘(A) establish the permitted uses and dis2 closures of such information by the recipient 

3 which shall be limited to the original purpose of 

4 disclosure under subsection (b)(3)(B); and 

5 ‘‘(B) provide that the data recipient will— 

6 ‘‘(i) not use or further disclose the in7 formation other than as permitted by the 

8 qualifying data use agreement or as other9 wise required by law; 

10 ‘‘(ii) use appropriate safeguards to 

11 prevent use or disclosure of the informa12 tion other than as provided for by the 

13 qualifying data use agreement; and 

14 ‘‘(iii) ensure that any agents to whom 

15 it provides the data agree to the same re16 strictions and conditions that apply to the 

17 data recipient with respect to such infor18 mation.’’. 

19 (b) REGULATIONS.—Not later than 30 days after the 

20 date of the enactment of this Act, the Secretary of Health 

21 and Human Services shall promulgate regulations to carry 

22 out the amendment made by subsection (a). 

23 (c) CONFORMING AMENDMENT.—Section 1171(2) of 

24 the Social Security Act (42 U.S.C. 1320d(2)) is amended 

25 by inserting before the period the following: ‘‘or receives 

mstockstill on DSK3G9T082PROD with BILLS

13 

•S 3530 IS

1 a standard transaction from another entity and processes 

2 or facilitates the processing of health information into 

3 nonstandard format or nonstandard data content for the 

4 receiving entity. Such term also includes an entity that 

5 carries out such processing functions, processes standard 

6 health care claims, processes health care claim payments 

7 or provides advice on such, and processes eligibility claims 

8 relating to health plan transactions on behalf of a HIPAA 

9 covered entity and in addition, engages in any of the func10 tions described in subsection (a) of section 13451 of the 

11 Health Information Technology for Economic and Clinical 

12 Health Act’’. 

Æ 

mstockstill on DSK3G9T082PROD with BILLS