paragraph (4). In particular, the study shall examine 
the following: 
(A) The effectiveness of each safe harbor 
in increasing the adoption of health information 
technology. 
(B) The types of health information tech-
nology provided under each safe harbor. 
(C) The extent to which the financial or 
other business relationships between providers 
under each safe harbor have changed as a re-
sult of the safe harbor in a way that adversely 
affects the health care system or choices avail-
able to consumers. 
(2) REPORT.—Not later than three years after 
the effective date described in subsection (d)(2), the 
Secretary of Health and Human Services shall sub-
mit to Congress a report on the study under para-
graph (1) and shall include such recommendations 
for changes in the safe harbors as the Secretary de-
termines may be appropriate. 
(3) UPDATED
CRITERIA
FOR
PERMISSIBLE 
HEALTH
INFORMATION
TECHNOLOGY
REMUNERA-
TION UNDER SAFE HARBORS.—Not later than three 
years after the effective date described in subsection 
(d)(2), the Secretary of Health and Human Services
may issue regulations that establish updated criteria 
for nonmonetary remuneration (in the form of 
health information technology and related training 
services) for purposes of the safe harbors described 
in paragraph (4). Such criteria may be based on the 
extent to which the health information technology 
conforms to a standard developed under section 
271(c)(3)(B)(i) of the Public Health Service Act, as 
added by section 2, only to the extent that such 
standard is recognized by the National Coordinator 
of Health Information Technology under such sec-
tion 271(c)(3)(B)(i). 
(4) SAFE HARBORS DESCRIBED.—For purposes 
of paragraphs (1) and (3), the safe harbors de-
scribed in this paragraph are— 
(A) 
the 
safe 
harbor 
under 
section 
1128A(b)(4) of the Social Security Act (42 
U.S.C. 1320a–7a(b)(4)), as added by subsection 
(a); 
(B) 
the 
safe 
harbor 
under 
section 
1128B(b)(3)(J) of such Act (42 U.S.C. 1320a– 
7b(b)(3)(J)), as added by subsection (b); and 
(C) 
the 
safe 
harbor 
under 
section 
1877(e)(9) 
of 
such 
Act 
(42 
U.S.C. 
1395nn(e)(9)), as added by subsection (c).
SEC. 4. UNIFORM HEALTH INFORMATION LAWS AND REGU-
LATIONS. 
(a) STUDY TO DETERMINE EXTENT OF VARIATION 
IN STATE HEALTH INFORMATION LAWS AND REGULA-
TIONS.— 
(1) IN GENERAL.—The Secretary of Health and 
Human Services shall conduct a study of State secu-
rity and confidentiality laws and current Federal se-
curity and confidentiality standards to determine— 
(A) the degree to which such State laws 
vary among States, and between the States and 
such current Federal standards; 
(B) how any such variation may adversely 
impact the security and confidentiality of indi-
vidually identifiable health information and the 
electronic exchange of clinical health informa-
tion among States, the Federal government, 
and private entities; and 
(C) the strengths and weaknesses of such 
State laws and of such current Federal stand-
ards for purposes of protecting the security and 
confidentiality of individually identifiable health 
information while also taking into account the 
need for timely and efficient exchanges of 
health information to improve quality of care 
and ensure the availability of health informa-
tion necessary to make medical decisions at the 
the location in which the medical care involved 
is provided. 
(2) REPORT.—Not later than 18 months after 
the date of the enactment of this Act, the Secretary 
of Health and Human Services shall submit to Con-
gress a report on the study under paragraph (1) and 
shall include in such report— 
(A) a determination by the Secretary 
whether State security and confidentiality laws 
and current Federal security and confidentiality 
standards should be conformed to create a sin-
gle set of national standards to preserve and 
protect the security and confidentiality of pa-
tient health information in order to improve 
health care quality and efficiency; and 
(B) if the Secretary determines such State 
laws and such current Federal standards should 
be conformed to create such a single set of na-
tional standards, what the single set of stand-
ards should be. 
(3) DEFINITIONS.—For purposes of this sub-
section: 
(A) STATE
SECURITY
AND
CONFIDEN-
TIALITY LAWS.—The term ‘‘State security and
confidentiality laws’’ means State laws and reg-
ulations relating to the privacy and confiden-
tiality of individually identifiable health infor-
mation or to the security of such information. 
(B) CURRENT
FEDERAL
SECURITY
AND 
CONFIDENTIALITY
STANDARDS.—The 
term 
‘‘current Federal security and confidentiality 
standards’’ means the Federal privacy stand-
ards established pursuant to section 264(c) of 
the Health Insurance Portability and Account-
ability Act of 1996 (42 U.S.C. 1320d–2 note) 
and security standards established under sec-
tion 1173(d) of the Social Security Act. 
(C) STATE.—The term ‘‘State’’ has the 
meaning given such term when used in title XI 
of the Social Security Act, as provided under 
section 1101(a) of such Act (42 U.S.C. 
1301(a)). 
(b) ESTABLISHMENT
OF
UNIFORM
CONFIDEN-
TIALITY AND SECURITY STANDARDS.— 
(1) IN GENERAL.—Section 1178(a) of the So-
cial Security Act (42 U.S.C. 1320d–7(a)), is amend-
ed—
(A) in paragraph (1), by inserting after 
‘‘Except as provided in paragraph (2)’’ the fol-
lowing: ‘‘and subject to paragraph (3)’’; 
(B) in paragraph (2), by striking ‘‘A provi-
sion’’ and inserting ‘‘Subject to paragraph 
(3)(B), a provision’’; and 
(C) by adding at the end the following new 
paragraph: 
‘‘(3) UNIFORM NATIONAL STANDARDS.— 
‘‘(A) IN GENERAL.— 
‘‘(i) CREATING
UNIFORM
NATIONAL 
STANDARDS.—If 
the 
conditions 
under 
clause (ii) are met, then the regulation and 
standards described in subparagraph (C) 
shall become the single set of national 
standards to preserve and protect the secu-
rity and confidentiality of individually iden-
tifiable patient health information in order 
to improve health care quality and effi-
ciency and supersede the current Federal 
security and confidentiality standards and 
State security and confidentiality laws, as 
defined in section 4(a)(3) of the Health In-
formation Technology Promotion Act of 
2005.
‘‘(ii) CONDITIONS.—For purposes of 
clause (i), the conditions under this clause 
are the following: 
‘‘(I) DETERMINATION
OF
NEED 
FOR
SINGLE
SET
OF
STANDARDS.— 
The Secretary determines under sec-
tion 4(a)(2)(A) of the Health Infor-
mation Technology Promotion Act of 
2005 that State security and con-
fidentiality laws and current Federal 
security and confidentiality standards 
should be conformed to create a single 
set of national standards to preserve 
and protect the security and confiden-
tiality of individually identifiable pa-
tient health information in order to 
improve health care quality and effi-
ciency. 
‘‘(II) 
SECRETARY
SPECIFIES 
STANDARDS.—The Secretary specifies 
that the regulation and standards de-
scribed in subparagraph (C) should be 
the single set of national standards. 
‘‘(III) NO
LEGISLATION
ESTAB-
LISHING
STANDARDS.—Legislation
creating a single set of national stand-
ards and preempting State security 
and confidentiality laws is not enacted 
by the date that is 36 months after 
the date of the enactment of the 
Health Information Technology Pro-
motion Act of 2005. 
‘‘(B) NARROWING OF PREEMPTION EXCEP-
TIONS.— 
‘‘(i) SUBSEQUENT
LEGISLATION.—If 
legislation described in subparagraph (A) 
is enacted by the date described in such 
subparagraph, as of the date of enactment 
of such legislation paragraph (2) shall be 
superseded by such exceptions as may be 
provided for in such legislation. It is the 
intent of Congress that such exceptions be 
as narrow as possible to maximize the uni-
form application of the regulation and 
standards described in subparagraph (C). 
‘‘(ii) NO LEGISLATION.—If legislation 
described in subparagraph (A) is not en-
acted by the date described in such sub-
paragraph, paragraph (2) shall be super-
seded by such exceptions as may be pro-
vided for by the Secretary by regulation 
issued in connection with the regulation 
and standards described in subparagraph 
(C). It is the intent of Congress that such 
exceptions be as narrow as possible to 
maximize the uniform application of the 
regulation and standards described in sub-
paragraph (C). 
‘‘(C) APPLICATION
OF
UNIFORM
STAND-
ARDS.—The regulation and standards described 
in this subparagraph are the regulation promul-
gated under section 264(c)(1) of the Health In-
surance Portability and Accountability Act of 
1996 (42 U.S.C. 1320d–2 note) and standards 
under section 1173(d), as modified by the Sec-
retary to the extent the Secretary determines, 
after consideration of the results of the study 
conducted under section 4(a) of the Health In-
formation Technology Promotion Act of 2005, 
necessary to promote uniformity and efficiency 
in the application of confidentiality and security 
standards with respect to individually identifi-
able health information.’’. 
(2) HIPAA CONFORMING
AMENDMENT.—Sec-
tion 264(c)(2) of the Health Insurance Portability
and Accountability Act of 1996 (42 U.S.C. 1320d– 
2 note) is amended by striking ‘‘A regulation’’ and 
inserting ‘‘(A) Subject to section 1178(a)(3) of the 
Social Security Act, a regulation’’. 
SEC. 5. RULEMAKING TO UPGRADE ASC X12 AND NCPDP 
STANDARDS AND ICD CODES. 
(a) IN GENERAL.—Not later than April 1, 2007, the 
Secretary of Health and Human Services shall promulgate 
a final rule under section 1174(b) of the Social Security 
Act (42 U.S.C. 1320d–3(b)) to provide for the following 
modification of standards: 
(1) ACCREDITED STANDARDS COMMITTEE X12 
(ASC X12) STANDARD.—The replacement of the Ac-
credited Standards Committee X12 (ASC X12) 
version 4010 adopted under section 1173(a) of such 
Act (42 U.S.C. 1320d–2(a)), including for purposes 
of part A of title XVIII of such Act, with the ASC 
X12 version 5010, as reviewed by the National Com-
mittee on Vital Health Statistics. 
(2) NATIONAL
COUNCIL
FOR
PRESCRIPTION 
DRUG
PROGRAMS (NCPDP) TELECOMMUNICATIONS 
STANDARDS.—The replacement of the National 
Council for Prescription Drug Programs (NCPDP) 
Telecommunications Standards version 5.1 adopted 
under section 1173(a) of such Act (42 U.S.C.
1320d–2(a)), including for purposes of part A of 
title XVIII of such Act, with NCPDP Telecommuni-
cations Standards version C.3, as approved by such 
Council and reviewed by the National Committee on 
Vital Health Statistics. 
(3) ICD CODES.—The replacement of the Inter-
national Statistical Classification of Diseases and 
Related Health Problems, 9th revision, Clinical 
Modification (ICD–9–CM) under the regulation pro-
mulgated under section 1173(c) of such Act (42 
U.S.C. 1320d–2(c)), including for purposes of part 
A of title XVIII of such Act, with both of the fol-
lowing: 
(A) The International Statistical Classi-
fication of Diseases and Related Health Prob-
lems, 10th revision, Clinical Modification (ICD– 
10–CM). 
(B) The International Statistical Classi-
fication of Diseases and Related Health Prob-
lems, 10th revision, Procedure Coding System 
(ICD–10–PCS). 
(b) RULE
OF CONSTRUCTION.—Nothing in sub-
section (a)(3) shall be construed as affecting the applica-
tion of classification methodologies or codes, such as CPT 
or HCPCS codes, other than under the International Sta-
tistical Classification of Diseases and Related Health 
Problems (ICD). 
(c) NOTICE.—Not later than 30 days after the date 
of the enactment of this Act, the Secretary of Health and 
Human Services shall publish in the Federal Register a 
notice of the requirements to promulgate final rules under 
subsection (a). Such notice shall include— 
(1) the respective date by which each such rule 
must be promulgated under such subsection; 
(2) the respective compliance date described in 
subsection (e) for each such rule; and 
(3) a statement that entities covered under the 
Health Insurance Portability and Accountability Act 
of 1996 and health information technology vendors 
should plan for the implementation of upgraded ASC 
X12, NCPDP, and ICD codes under such sub-
section. 
(d) NO JUDICIAL REVIEW.—The final rules promul-
gated under subsections (a) shall not be subject to judicial 
review. 
(e) COMPLIANCE WITH UPGRADED STANDARDS.— 
For purposes of section 1175(b)(2) of the Social Security 
Act (42 U.S.C. 1320d–4(b)(2))— 
(1) ASC X12
AND
NCPDP
STANDARDS.—The 
final rules promulgated under paragraphs (1) and
(2) of subsection (a) shall apply to transactions oc-
curring on or after April 1, 2009. 
(2) ICD CODES.—The final rule promulgated 
under paragraph (3) of subsection (a) shall apply to 
transactions occurring on or after October 1, 2009. 
SEC. 6. REPORT ON THE AMERICAN HEALTH INFORMATION 
COMMUNITY. 
Not later than two years after the date of the enact-
ment of this Act, the Secretary of Health and Human 
Services shall submit to Congress a report on the work 
conducted by the American Health Information Commu-
nity (in this section referred to as ‘‘AHIC’’), as established 
by the Secretary. Such report shall include the following: 
(1) A description of the accomplishments of 
AHIC, with respect to the promotion of the develop-
ment of a nationwide health information network 
and the increased adoption of health information 
technology. 
(2) Information identifying the practices that 
are used to protect health information and to guar-
antee confidentiality and security of such informa-
tion. 
(3) Information on the progress in— 
(A) establishing uniform industry-wide 
health information technology standards;
(B) achieving an internet-based nationwide 
health information network; and 
(C) 
achieving 
interoperable 
electronic 
health record adoption across health care pro-
viders. 
(4) Recommendations for the transition of the 
AHIC to a permanent advisory entity, including— 
(A) a schedule for such transition; 
(B) options for structuring the entity as ei-
ther a public-private or private sector entity; 
(C) the role of the Federal Government in 
the entity; and 
(D) the ongoing responsibilities of the enti-
ty, such as in establishing standards, certifying 
health information technology, and providing 
long-term governance for health care trans-
formation. 
SEC. 7. STRATEGIC PLAN FOR COORDINATING IMPLEMEN-
TATION OF HEALTH INFORMATION TECH-
NOLOGY. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of Health 
and Human Services, in consultation with entities involved 
in the area of health information technology, shall develop
a strategic plan related to the need for coordination in 
such area. 
(b) COORDINATION OF SPECIFIC IMPLEMENTATION 
PROCESSES.—The strategic plan under subsection (a) 
shall address the need for coordination in the implementa-
tion of the following: 
(1) 
HEALTH
INFORMATION
TECHNOLOGY 
STANDARDS.—Health information technology stand-
ards approved under section 271(c)(3)(B)(i) of the 
Public Health Service Act, as added by section 2. 
(2) HIPAA TRANSACTION STANDARDS.—Trans-
action standards under section 1173(a) of the Social 
Security Act (42 U.S.C. 1320d–2(d)). 
(3) UPDATED ICD CODES.—The International 
Statistical Classification of Diseases and Related 
Health Problems, 10th revision, Clinical Modifica-
tion (ICD–10–CM) and the International Statistical 
Classification of Diseases and Related Health Prob-
lems, 10th revision, Procedure Coding System 
(ICD–10–PCS) described in section 5. 
(c) COORDINATION AMONG SPECIFIC FEDERAL EN-
TITIES.—The strategic plan under subsection (a) shall ad-
dress any methods to coordinate, with respect to the elec-
tronic exchange of health information, actions taken by 
the following entities:
(1) The Office of the National Coordinator for 
Health Information Technology. 
(2) The American Health Information Commu-
nity. 
(3) The Office of Electronic Standards and Se-
curity of the Centers for Medicare and Medicaid 
Services. 
(4) The National Committee on Vital Health 
Statistics. 
(5) Any other entity involved in the electronic 
exchange of health information that the Secretary 
determines appropriate. 
Æ