366
Title II, Subtitle B
terms such that the terms of no more than 3 mem-
bers expire at one time.
(4) VACANCIES.—
(A) IN GENERAL.—A vacancy on the com-
mittee shall be filled in the manner in which the
original appointment was made and shall be
subject to any conditions which applied with re-
spect to the original appointment.
(B) FILLING UNEXPIRED TERM.—An indi-
vidual chosen to fill a vacancy shall be ap-
pointed for the unexpired term of the member
replaced.
(C) EXPIRATION OF TERMS.—The term of
any member shall not expire before the date on
which the member’s successor takes office.
(5) CONFLICTS OF INTEREST.—Members of the
committee shall disclose upon appointment to the
committee or at any subsequent time that it may
occur, conflicts of interest.
(d) MEETINGS.—
(1) IN GENERAL.—Except as provided in para-
graph (2), the committee shall meet at the call of
the Chair.
(2) INITIAL MEETING.—Not later than 30 days
after the date on which all members of the commit-
367
Title II, Subtitle B
tee have been appointed, the committee shall hold its
first meeting.
(3) QUORUM.—A majority of the members of
the committee shall constitute a quorum, but a less-
er number of members may hold hearings.
(e) POWER TO HOLD HEARINGS.—The committee
may hold such hearings, sit and act at such times and
places, take such testimony, and receive such evidence as
the committee considers advisable to carry out the pur-
poses of this section.
(f) OTHER ADMINISTRATIVE PROVISIONS.—Subpara-
graphs (C), (D), and (H) of section 1886(e)(6) of the So-
cial Security Act shall apply to the committee in the same
manner as they apply to the Prospective Payment Assess-
ment Commission.
(g) REPORTS.—
(1) IN GENERAL.—The committee shall annu-
ally prepare and submit to Congress and the Sec-
retary a report including at least an analysis of—
(A) the status of the health information
network established under this part, including
whether the network is fulfilling the purpose de-
scribed in section 2100;
(B) the savings and costs of the network;
368
Title II, Subtitle B
(C) the activities of health information net-
work services certified under section 2121,
health providers, and plan sponsors under this
part;
(D) the extent to which entities described
in subparagraph (C) are meeting the standards
adopted under this part and working together
to form an integrated network that meets the
needs of its users;
(E) the extent to which entities described
in subparagraph (C) are meeting the privacy
and security protections of part 2;
(F) whether the Federal Government and
State Governments are receiving information of
sufficient quality to meet their responsibilities
under this Act;
(G) any problems with respect to imple-
mentation of the network;
(H) the extent to which timetables under
this part for the adoption and implementation
of standards are being met; and
(I) any legislative recommendations related
to the health information network.
(2) AVAILABILITY TO THE PUBLIC.—Any infor-
mation in the report submitted to Congress under
369
Title II, Subtitle B
paragraph (1) shall be made available to the public,
unless such information may not be disclosed by law.
(h) DURATION.—Notwithstanding section 14(a) of
the Federal Advisory Committee Act, the committee shall
continue in existence until otherwise provided by law.
PART 2—FAIR HEALTH INFORMATION
PRACTICES
SEC. 2140. DEFINITIONS.
(a) 
DEFINITIONS
RELATING
TO
PROTECTED
HEALTH INFORMATION.—For purposes of this part:
(1) DISCLOSE.—The term ‘‘disclose’’, when
used with respect to protected health information
that is held by a health information trustee, means
to provide access to the information, but only if such
access is provided by the trustee to a person other
than—
(A) the trustee or an officer or employee of
the trustee;
(B) an affiliated person of the trustee; or
(C) a protected individual who is a subject
of the information.
(2) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means the act or an instance of disclosing.
(3) PROTECTED HEALTH INFORMATION.—The
term ‘‘protected health information’’ means any in-
370
Title II, Subtitle B
formation, whether oral or recorded in any form or
medium—
(A) that is created or received in a State
by—
(i) a health care provider;
(ii) a health benefit plan sponsor;
(iii) a health oversight agency;
(iv) a health information service orga-
nization; or
(v) a public health authority;
(B) that relates in any way to the past,
present, or future physical or mental health or
condition or functional status of a protected in-
dividual, the provision of health care to a pro-
tected individual, or payment for the provision
of health care to a protected individual; and
(C) that—
(i) identifies the individual; or
(ii) with respect to which there is a
reasonable basis to believe that the infor-
mation can be used to identify the individ-
ual.
(4) PROTECTED INDIVIDUAL.—The term ‘‘pro-
tected individual’’ means an individual who, with re-
spect to a date—
371
Title II, Subtitle B
(A) is living on the date; or
(B) has died within the 2-year period end-
ing on the date.
(5) USE.—The term ‘‘use’’, when used with re-
spect to protected health information that is held by
a health information trustee, means—
(A) to use, or provide access to, the infor-
mation in any manner that does not constitute
a disclosure; or
(B) any act or instance of using, or provid-
ing access, described in subparagraph (A).
(b) DEFINITIONS RELATING TO HEALTH INFORMA-
TION TRUSTEES.—For purposes of this part:
(1) CARRIER.—The term ‘‘carrier’’ means a li-
censed insurance company, a hospital or medical
service corporation (including an existing Blue Cross
or Blue Shield organization, within the meaning of
section 833(c)(2) of the Internal Revenue Code of
1986), a health maintenance organization, or other
entity licensed or certified by a State to provide
health insurance or health benefits.
(2) 
HEALTH
BENEFIT
PLAN.—The 
term
‘‘health benefit plan’’ means—
(A) any contract of health insurance, in-
cluding any hospital or medical service policy or
372
Title II, Subtitle B
certificate, hospital or medical service plan con-
tract, or health maintenance organization group
contract, that is provided by a carrier; and
(B) an employee welfare benefit plan or
other arrangement insofar as the plan or ar-
rangement provides health benefits and is fund-
ed in a manner other than through the pur-
chase of one or more policies or contracts de-
scribed in subparagraph (A).
(3) HEALTH
BENEFIT
PLAN
SPONSOR.—The
term ‘‘health benefit plan sponsor’’ means a person
who, with respect to a specific item of protected
health information, receives, creates, uses, main-
tains, or discloses the information while acting in
whole or in part in the capacity of—
(A) a carrier providing a health benefit
plan;
(B) any other provider of a health benefit
plan, including any public entity that provides
payments for health care items and services
under a health benefit plan that are equivalent
to payments provided by a private person under
such a plan; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
373
Title II, Subtitle B
(4) HEALTH
CARE
PROVIDER.—The term
‘‘health care provider’’ means a person who, with re-
spect to a specific item of protected health informa-
tion, receives, creates, uses, maintains, or discloses
the information while acting in whole or in part in
the capacity of—
(A) a person who is licensed, certified, reg-
istered, or otherwise authorized by law to pro-
vide an item or service that constitutes health
care in the ordinary course of business or prac-
tice of a profession;
(B) a Federal or State program that di-
rectly provides items or services that constitute
health care to beneficiaries; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(5) HEALTH INFORMATION SERVICE ORGANIZA-
TION.—The term ‘‘health information service organi-
zation’’ means a person who, with respect to a spe-
cific item of protected health information, receives,
creates, uses, maintains, or discloses the information
while acting in whole or in part in the capacity of—
(A) a person, other than an affiliated per-
son, who performs specific functions for which
the Secretary has authorized (by means of a
374
Title II, Subtitle B
designation or certification) the person to re-
ceive access to health care data in electronic or
magnetic form that are regulated by this Act;
or
(B) an officer or employee of a person de-
scribed in subparagraph (A).
(6) HEALTH
INFORMATION
TRUSTEE.—The
term ‘‘health information trustee’’ means—
(A) a health care provider;
(B) a health information service organiza-
tion;
(C) a health oversight agency;
(D) a health benefit plan sponsor;
(E) a public health authority;
(F) a health researcher;
(G) a person who, with respect to a spe-
cific item of protected health information, is not
described in subparagraphs (A) through (F) but
receives the information—
(i) pursuant to—
(I) section 2157 (relating to
emergency circumstances);
(II) section 2158 (relating to ju-
dicial and administrative purposes);
375
Title II, Subtitle B
(III) section 2159 (relating to
law enforcement); or
(IV) section 2160 (relating to
subpoenas, warrants, and search war-
rants); or
(ii) while acting in whole or in part in
the capacity of an officer or employee of a
person described in clause (i).
(7) HEALTH OVERSIGHT AGENCY.—The term
‘‘health oversight agency’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
closes the information while acting in whole or in
part in the capacity of—
(A) a person who performs or oversees the
performance of an assessment, evaluation, de-
termination, or investigation relating to the li-
censing, accreditation, or certification of health
care providers;
(B) a person who—
(i) performs or oversees the perform-
ance of an audit, assessment, evaluation,
determination, or investigation relating to
the effectiveness of, compliance with, or
applicability of, legal, fiscal, medical, or
376
Title II, Subtitle B
scientific standards or aspects of perform-
ance related to the delivery of, or payment
for, health care; and
(ii) is a public agency, acting on be-
half of a public agency, acting pursuant to
a requirement of a public agency, or carry-
ing out activities under a State or Federal
statute regulating the assessment, evalua-
tion, determination, or investigation; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(8) HEALTH RESEARCHER.—The term ‘‘health
researcher’’ means a person who, with respect to a
specific item of protected health information, re-
ceives the information—
(A) pursuant to section 2156 (relating to
health research); or
(B) while acting in whole or in part in the
capacity of an officer or employee of a person
described in subparagraph (A).
(9) PUBLIC
HEALTH
AUTHORITY.—The term
‘‘public health authority’’ means a person who, with
respect to a specific item of protected health infor-
mation, receives, creates, uses, maintains, or dis-
377
Title II, Subtitle B
closes the information while acting in whole or in
part in the capacity of—
(A) an authority of the United States, a
State, or a political subdivision of a State that
is responsible for public health matters;
(B) a person acting under the direction of
such an authority; or
(C) an officer or employee of a person de-
scribed in subparagraph (A) or (B).
(c) OTHER DEFINITIONS.—For purposes of this part:
(1) AFFILIATED PERSON.—The term ‘‘affiliated
person’’ means a person who—
(A) is not a health information trustee;
(B) is a contractor, subcontractor, associ-
ate, or subsidiary of a person who is a health
information trustee; and
(C) pursuant to an agreement or other re-
lationship with such trustee, receives, creates,
uses, maintains, or discloses protected health
information.
(2) APPROVED HEALTH RESEARCH PROJECT.—
The term ‘‘approved health research project’’ means
a biomedical, epidemiological, or health services re-
search or statistics project, or a research project on
behavioral and social factors affecting health, that
378
Title II, Subtitle B
has been approved by a certified institutional review
board.
(3) 
CERTIFIED
INSTITUTIONAL
REVIEW
BOARD.—The term ‘‘certified institutional review
board’’ means a board—
(A) established by an entity to review re-
search involving protected health information
and the rights of protected individuals con-
ducted at or supported by the entity;
(B) established in accordance with regula-
tions of the Secretary under section 2156(e)(1);
and
(C) certified by the Secretary under section
2156(e)(2).
(4) HEALTH CARE.—The term ‘‘health care’’—
(A) means—
(i) any preventive, diagnostic, thera-
peutic, rehabilitative, maintenance, or pal-
liative care, counseling, service, or proce-
dure—
(I) with respect to the physical or
mental condition, or functional status,
of an individual; or
(II) affecting the structure or
function of the human body or any
379
Title II, Subtitle B
part of the human body, including
banking of blood, sperm, organs, or
any other tissue; or
(ii) any sale or dispensing of a drug,
device, equipment, or other item to an indi-
vidual, or for the use of an individual, pur-
suant to a prescription; but
(B) does not include any item or service
that is not furnished for the purpose of main-
taining or improving the health of an individual.
(5) LAW ENFORCEMENT INQUIRY.—The term
‘‘law enforcement inquiry’’ means a lawful investiga-
tion or official proceeding inquiring into a violation
of, or failure to comply with, any criminal or civil
statute or any regulation, rule, or order issued pur-
suant to such a statute.
(6) PERSON.—The term ‘‘person’’ includes an
authority of the United States, a State, or a political
subdivision of a State.
Subpart A—Duties of Health Information Trustees
SEC. 2141. INSPECTION OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—Except as provided in subsection
(b), a health information trustee described in subsection
(g)—
381
Title II, Subtitle B
logical, or mental health treatment notes about the
individual, the trustee determines in the exercise of
reasonable professional judgment that inspection or
copying of the notes would cause sufficient harm to
the protected individual so as to outweigh the desir-
ability of permitting access, and the trustee does not
disclose the notes to any person not directly engaged
in treating the individual, except with the authoriza-
tion of the individual or under compulsion of law.
(2) INFORMATION ABOUT OTHERS.—The infor-
mation relates to an individual, other than the pro-
tected individual or a health care provider, and the
trustee determines in the exercise of reasonable pro-
fessional judgment that inspection or copying of the
information would cause sufficient harm to one or
both of the individuals so as to outweigh the desir-
ability of permitting access.
(3) ENDANGERMENT TO LIFE OR SAFETY.—In-
spection or copying of the information could reason-
ably be expected to endanger the life or physical
safety of an individual.
(4) CONFIDENTIAL SOURCE.—The information
identifies or could reasonably lead to the identifica-
tion of an individual (other than a health care pro-
vider) who provided information under a promise of
382
Title II, Subtitle B
confidentiality to a health care provider concerning
a protected individual who is a subject of the infor-
mation.
(5) ADMINISTRATIVE PURPOSES.—The informa-
tion—
(A) is used by the trustee solely for admin-
istrative purposes and not in the provision of
health care to a protected individual who is a
subject of the information; and
(B) is not disclosed by the trustee to any
person.
(6) DUPLICATIVE INFORMATION.—The informa-
tion duplicates information available for inspection
under subsection (a).
(7) INFORMATION COMPILED IN ANTICIPATION
OF LITIGATION.—The information is compiled prin-
cipally—
(A) in anticipation of a civil, criminal, or
administrative action or proceeding; or
(B) for use in such an action or proceed-
ing.
(c) INSPECTION AND COPYING OF SEGREGABLE POR-
TION.—A health information trustee shall permit inspec-
tion and copying under subsection (a) of any reasonably
383
Title II, Subtitle B
segregable portion of a record after deletion of any portion
that is exempt under subsection (b).
(d) CONDITIONS.—A health information trustee
may—
(1) require a written request for the inspection
and copying of protected health information under
this section; and
(2) charge a reasonable cost-based fee for—
(A) permitting inspection of information
under this section; and
(B) providing a copy of protected health
information under this section.
(e) STATEMENT OF REASONS FOR DENIAL.—If a
health information trustee denies in whole or in part a
request for inspection or copying under this section, the
trustee shall provide the protected individual who made
the request with a written statement of the reasons for
the denial.
(f) DEADLINE.—A health information trustee shall
comply with or deny a request for inspection or copying
of protected health information under this section within
the 30-day period beginning on the date the trustee re-
ceives the request.
(g) APPLICABILITY.—This section applies to a health
information trustee who is—
384
Title II, Subtitle B
(1) a health benefit plan sponsor;
(2) a health care provider;
(3) a health information service organization;
(4) a health oversight agency; or
(5) a public health authority.
SEC. 2142. AMENDMENT OF PROTECTED HEALTH INFORMA-
TION.
(a) IN GENERAL.—A health information trustee de-
scribed in subsection (f) shall, within the 45-day period
beginning on the date the trustee receives from a protected
individual about whom the trustee maintains protected
health information a written request that the trustee cor-
rect or amend the information, complete the duties de-
scribed in one of the following paragraphs:
(1) CORRECTION OR AMENDMENT AND NOTIFI-
CATION.—The trustee shall—
(A) make the correction or amendment re-
quested;
(B) inform the protected individual of the
amendment or correction that has been made;
(C) make reasonable efforts to inform any
person who is identified by the protected indi-
vidual, who is not an employee of the trustee,
and to whom the uncorrected or unamended
portion of the information was previously dis-
385
Title II, Subtitle B
closed of the correction or amendment that has
been made; and
(D) at the request of the individual, make
reasonable efforts to inform any known source
of the uncorrected or unamended portion of the
information about the correction or amendment
that has been made.
(2) REASONS FOR REFUSAL AND REVIEW PRO-
CEDURES.—The trustee shall inform the protected
individual of—
(A) the reasons for the refusal of the trust-
ee to make the correction or amendment;
(B) any procedures for further review of
the refusal; and
(C) the individual’s right to file with the
trustee a concise statement setting forth the re-
quested correction or amendment and the indi-
vidual’s reasons for disagreeing with the refusal
of the trustee.
(b) STANDARDS
FOR
CORRECTION
OR
AMEND-
MENT.—A trustee shall correct or amend protected health
information in accordance with a request made under sub-
section (a) if the trustee determines that the information
is not accurate, relevant, timely, or complete for the pur-