To amend the HITECH Act with respect to accessing, sharing, and using health data for research purposes.

To amend the HITECH Act with respect to accessing, sharing, and using health data for research purposes. 1. Accessing, sharing, and using health data for research purposes (a) In general The HITECH Act (title XIII of division A of Public Law 111–5 42 U.S.C. 17921 et seq. 4 Accessing, sharing, and using health data for research purposes 13441. References In this part: (a) The Rule References to the Rule (b) Part 164 References to a specified section of part 164 13442. Defining health data research as part of health care operations (a) In general Subject to subsection (b), the Secretary shall revise or clarify the rule to allow the use and disclosure of protected health information by a covered entity for research purposes, including studies whose purpose is to obtain generalizable knowledge, to be treated as the use and disclosure of such information for health care operations described in subparagraph (1) of the definition of health care operations in section 164.501 of part 164. (b) Modifications to rules for disclosures for health care operations In applying section 164.506 of part 164 to the disclosure of protected health information described in subsection (a)— (1) the Secretary shall revise or clarify the Rule so that the disclosure may be made by the covered entity to only— (A) another covered entity for health care operations (as defined in such section 164.501 of part 164); (B) a business associate that has entered into a contract under section 164.504(e) of part 164 with a disclosing covered entity to perform health care operations; or (C) a business associate that has entered into a contract under section 164.504(e) of part 164 for the purpose of data aggregation (as defined in such section 164.501 of part 164); and (2) the Secretary shall further revise or clarify the Rule so that the limitation specified by section 164.506(c)(4) of part 164 does not apply to disclosures that are described by subsection (a). (c) Rule of construction This section shall not be construed as prohibiting or restricting a use or disclosure of protected health information for research purposes that is otherwise permitted under part 164. 13443. Treating disclosures of protected health information for research similarly to disclosures of such information for public health purposes (a) Remuneration The Secretary shall revise or clarify the Rule so that disclosures of protected health information for research purposes are not subject to the limitation on remuneration described in section 164.502(a)(5)(ii)(B)(2)(ii) of part 164. (b) Permitted uses and disclosures The Secretary shall revise or clarify the Rule so that research activities, including comparative research activities, related to the quality, safety, or effectiveness of a product or activity that is regulated by the Food and Drug Administration are included as public health activities for purposes of which a covered entity may disclose protected health information to a person described in section 164.512(b)(1)(iii) of part 164. 13444. Permitting remote access to protected health information by researchers The Secretary shall revise or clarify the Rule so that subparagraph (B) of section 164.512(i)(1)(ii) of part 164 (prohibiting the removal of protected health information by a researcher) shall not prohibit remote access to health information by a researcher so long as— (1) appropriate security and privacy safeguards are maintained by the covered entity and the researcher; and (2) the protected health information is not copied or otherwise retained by the researcher. 13445. Allowing one-time authorization of use and disclosure of protected health information for research purposes (a) In general The Secretary shall revise or clarify the Rule to specify that an authorization for the use or disclosure of protected health information, with respect to an individual, for future research purposes shall be deemed to contain a sufficient description of the purpose of the use or disclosure if the authorization— (1) sufficiently describes the purposes such that it would be reasonable for the individual to expect that the protected health information could be used or disclosed for such future research; (2) either— (A) states that the authorization will expire on a particular date or on the occurrence of a particular event; or (B) states that the authorization will remain valid unless and until it is revoked by the individual; and (3) provides instruction to the individual on how to revoke such authorization at any time. (b) Revocation of authorization The Secretary shall revise or clarify the Rule to specify that, if an individual revokes an authorization for future research purposes such as is described by subsection (a), the covered entity may not make any further uses or disclosures based on that authorization, except, as provided in paragraph (b)(5) of section 164.508 of part 164, to the extent that the covered entity has taken action in reliance on the authorization. . (b) Revision of regulations Not later than 12 months after the date of the enactment of this Act, the Secretary of Health and Human Services shall revise and clarify the provisions of title 45, Code of Federal Regulations, for consistency with part 4 of subtitle D of the HITECH Act, as added by subsection (a).

Summary: This bill amends the HITECH Act to require the Department of Health and Human Services (HHS) to revise or clarify the privacy rule established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to allow the use and disclosure of protected health information for research purposes without the individual's authorization, approval from an Institutional Review Board or Privacy Board, or representations from the researcher regarding limited use of the information. These disclosures may only be made to entities subject to HIPAA for health care operations or to business associates that are complying with the privacy rule for health care operations or data aggregation. There is no limitation on payments for these disclosures. Currently, payment is limited to the cost to prepare and transmit the information. An individual's protected health information may be disclosed without the authorization or agreement of the individual for research related to a product or activity that is regulated by the Food and Drug Administration. A researcher is allowed remote access to protected health information if security and privacy safeguards are maintained and the researcher does not retain the information. An individual's authorization to use protected health information for future research is sufficient for a research purpose if the authorization reasonably describes the research and provides instruction to the individual on how to revoke the authorization.