269 
‘‘(5) Payments described in paragraph (1) are not in 
accordance with this subsection unless the following require-
ments are met: 
‘‘(A) The State provides assurances satisfactory 
to the Secretary that amounts received under sub-
section (a)(3)(F) with respect to costs of a Medicaid 
provider are paid directly to such provider without 
any deduction or rebate. 
‘‘(B) Such Medicaid provider is responsible for 
payment of the costs described in such paragraph that 
are not provided under this title. 
‘‘(C) With respect to payments to such Medicaid 
provider for costs other than costs related to the ini-
tial adoption of certified EHR technology, the Med-
icaid provider demonstrates meaningful use of cer-
tified EHR technology through a means that is ap-
proved by the State and acceptable to the Secretary, 
and that may be based upon the methodologies ap-
plied under section 1848(o) or 1886(n). 
‘‘(D) To the extent specified by the Secretary, the 
certified EHR technology is compatible with State or 
Federal administrative management systems. 
‘‘(6)(A) In no case shall the payments described in 
paragraph (1), with respect to a hospital, exceed in the ag-
gregate the product of— 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00269
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
270 
‘‘(i) the overall hospital HIT amount for the hos-
pital computed under subparagraph (B); and 
‘‘(ii) the Medicaid share for such hospital com-
puted under subparagraph (C). 
‘‘(B) For purposes of this paragraph, the overall hos-
pital HIT amount, with respect to a hospital, is the sum 
of the applicable amounts specified in section 1886(n)(2)(A) 
for such hospital for the first 4 payment years (as estimated 
by the Secretary) determined as if the Medicare share speci-
fied in clause (ii) of such section were 1. The Secretary shall 
publish in the Federal Register the overall hospital HIT 
amount for each hospital eligible for payments under this 
subsection. In computing amounts under clause (ii) for 
payment years after the first payment year, the Secretary 
shall assume that in subsequent payment years discharges 
increase at an annual rate of 2 percent per year. 
‘‘(C) The Medicaid share computed under this sub-
paragraph, for a hospital for a period specified by the Sec-
retary, shall be calculated in the same manner as the Medi-
care share under section 1886(n)(2)(D) for such a hospital 
and period, except that there shall be substituted for the nu-
merator under clause (i) of such section the amount that 
is equal to the number of inpatient-bed-days (as established 
by the Secretary) which are attributable to individuals who 
are receiving medical assistance under this title and who 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00270
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
271 
are not described in section 1886(n)(2)(D)(i). In computing 
inpatient-bed-days under the previous sentence, the Sec-
retary shall take into account inpatient-bed-days attrib-
utable to inpatient-bed-days that are paid for individuals 
enrolled in a Medicaid managed care plan (under section 
1903(m) or section 1932). 
‘‘(7) With respect to health care providers other than 
hospitals, the Secretary shall ensure coordination of the dif-
ferent programs for payment of such health care providers 
for adoption or use of health information technology (in-
cluding certified EHR technology), as well as payments for 
such health care providers provided under this title or title 
XVIII, to assure no duplication of funding. 
‘‘(8) In carrying out paragraph (5)(C), the State and 
Secretary shall seek, to the maximum extent practicable, to 
avoid duplicative requirements from Federal and State 
Governments to demonstrate meaningful use of certified 
EHR technology under this title and title XVIII. In doing 
so, the Secretary may deem satisfaction of requirements for 
such meaningful use for a payment year under title XVIII 
to be sufficient to qualify as meaningful use under this sub-
section. The Secretary may also specify the reporting peri-
ods under this subsection in order to carry out this para-
graph. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00271
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
272 
‘‘(9) In order to be provided Federal financial partici-
pation under subsection (a)(3)(F)(ii), a State must dem-
onstrate to the satisfaction of the Secretary, that the State— 
‘‘(A) is using the funds provided for the purposes 
of administering payments under this subsection, in-
cluding tracking of meaningful use by Medicaid pro-
viders; 
‘‘(B) conducting adequate oversight of the pro-
gram under this subsection, including routine track-
ing of meaningful use attestations and reporting 
mechanisms; and 
‘‘(C) be pursuing initiatives to encourage the 
adoption of certified EHR technology to promote 
health care quality and the exchange of health care 
information under this title, subject to applicable 
laws and regulations governing such exchange. 
‘‘(10) The Secretary shall periodically submit reports 
to the Committee on Energy and Commerce of the House 
of Representatives and the Committee on Finance of the 
Senate on status, progress, and oversight of payments under 
paragraph (1).’’. 
(b) IMPLEMENTATION FUNDING.—In addition to funds 
otherwise available, out of any funds in the Treasury not 
otherwise appropriated, there are appropriated to the Sec-
retary of Health and Human Services for the Center for 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00272
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
273 
Medicare & Medicaid Services Program Management Ac-
count, $40,000,000 for each of fiscal years 2009 through 
2015 and $20,000,000 for each succeeding fiscal year 
through fiscal year 2019, which shall be available for pur-
poses of carrying out the provisions of (and the amendments 
made by) this part. Amounts appropriated under this sub-
section for a fiscal year shall be available until expended. 
Subtitle D—Privacy 
SEC. 4400. DEFINITIONS. 
In this subtitle, except as specified otherwise: 
(1) BREACH.—The term ‘‘breach’’ means the un-
authorized acquisition, access, use, or disclosure of 
protected health information which compromises the 
security, privacy, or integrity of protected health in-
formation maintained by or on behalf of a person. 
Such term does not include any unintentional acqui-
sition, access, use, or disclosure of such information 
by an employee or agent of the covered entity or busi-
ness associate involved if such acquisition, access, use, 
or disclosure, respectively, was made in good faith 
and within the course and scope of the employment 
or other contractual relationship of such employee or 
agent, respectively, with the covered entity or business 
associate and if such information is not further ac-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00273
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
274 
quired, accessed, used, or disclosed by such employee 
or agent. 
(2) BUSINESS ASSOCIATE.—The term ‘‘business 
associate’’ has the meaning given such term in section 
160.103 of title 45, Code of Federal Regulations. 
(3) COVERED ENTITY.—The term ‘‘covered enti-
ty’’ has the meaning given such term in section 
160.103 of title 45, Code of Federal Regulations. 
(4) DISCLOSE.—The terms ‘‘disclose’’ and ‘‘dis-
closure’’ have the meaning given the term ‘‘disclosure’’ 
in section 160.103 of title 45, Code of Federal Regula-
tions. 
(5) ELECTRONIC
HEALTH
RECORD.—The term 
‘‘electronic health record’’ means an electronic record 
of health-related information on an individual that is 
created, gathered, managed, and consulted by author-
ized health care clinicians and staff. 
(6) HEALTH
CARE
OPERATIONS.—The term 
‘‘health care operation’’ has the meaning given such 
term in section 164.501 of title 45, Code of Federal 
Regulations. 
(7) HEALTH CARE PROVIDER.—The term ‘‘health 
care provider’’ has the meaning given such term in 
section 160.103 of title 45, Code of Federal Regula-
tions. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00274
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
275 
(8) HEALTH PLAN.—The term ‘‘health plan’’ has 
the meaning given such term in section 1171(5) of the 
Social Security Act. 
(9) NATIONAL
COORDINATOR.—The term ‘‘Na-
tional Coordinator’’ means the head of the Office of 
the National Coordinator for Health Information 
Technology established under section 3001(a) of the 
Public Health Service Act, as added by section 4101. 
(10) PAYMENT.—The term ‘‘payment’’ has the 
meaning given such term in section 164.501 of title 
45, Code of Federal Regulations. 
(11) PERSONAL
HEALTH
RECORD.—The term 
‘‘personal health record’’ means an electronic record of 
individually identifiable health information on an in-
dividual that can be drawn from multiple sources and 
that is managed, shared, and controlled by or for the 
individual. 
(12) PROTECTED
HEALTH
INFORMATION.—The 
term ‘‘protected health information’’ has the meaning 
given such term in section 160.103 of title 45, Code 
of Federal Regulations. 
(13) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Health and Human Services. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00275
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
276 
(14) SECURITY.—The term ‘‘security’’ has the 
meaning given such term in section 164.304 of title 
45, Code of Federal Regulations. 
(15) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, Puerto 
Rico, the Virgin Islands, Guam, American Samoa, 
and the Northern Mariana Islands. 
(16) TREATMENT.—The term ‘‘treatment’’ has 
the meaning given such term in section 164.501 of 
title 45, Code of Federal Regulations. 
(17) USE.—The term ‘‘use’’ has the meaning 
given such term in section 160.103 of title 45, Code 
of Federal Regulations. 
(18) 
VENDOR
OF
PERSONAL
HEALTH 
RECORDS.—The term ‘‘vendor of personal health 
records’’ means an entity, other than a covered entity 
(as defined in paragraph (3)), that offers or main-
tains a personal health record. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00276
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
277 
PART I—IMPROVED PRIVACY PROVISIONS AND 
SECURITY PROVISIONS 
SEC. 4401. APPLICATION OF SECURITY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES; ANNUAL GUIDANCE ON 
SECURITY PROVISIONS. 
(a) APPLICATION OF SECURITY PROVISIONS.—Sections 
164.308, 164.310, 164.312, and 164.316 of title 45, Code 
of Federal Regulations, shall apply to a business associate 
of a covered entity in the same manner that such sections 
apply to the covered entity. The additional requirements of 
this title that relate to security and that are made applica-
ble with respect to covered entities shall also be applicable 
to such a business associate and shall be incorporated into 
the business associate agreement between the business asso-
ciate and the covered entity. 
(b) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any security provision specified in subsection (a), sections 
1176 and 1177 of the Social Security Act (42 U.S.C. 
1320d–5, 1320d–6) shall apply to the business associate 
with respect to such violation in the same manner such sec-
tions apply to a covered entity that violates such security 
provision. 
(c) ANNUAL GUIDANCE.—For the first year beginning 
after the date of the enactment of this Act and annually 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00277
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
278 
thereafter, the Secretary of Health and Human Services 
shall, in consultation with industry stakeholders, annually 
issue guidance on the most effective and appropriate tech-
nical safeguards for use in carrying out the sections referred 
to in subsection (a) and the security standards in subpart 
C of part 164 of title 45, Code of Federal Regulations, as 
such provisions are in effect as of the date before the enact-
ment of this Act. 
SEC. 4402. NOTIFICATION IN THE CASE OF BREACH. 
(a) IN GENERAL.—A covered entity that accesses, 
maintains, retains, modifies, records, stores, destroys, or 
otherwise holds, uses, or discloses unsecured protected health 
information (as defined in subsection (h)(1)) shall, in the 
case of a breach of such information that is discovered by 
the covered entity, notify each individual whose unsecured 
protected health information has been, or is reasonably be-
lieved by the covered entity to have been, accessed, acquired, 
or disclosed as a result of such breach. 
(b) NOTIFICATION OF COVERED ENTITY BY BUSINESS 
ASSOCIATE.—A business associate of a covered entity that 
accesses, maintains, retains, modifies, records, stores, de-
stroys, or otherwise holds, uses, or discloses unsecured pro-
tected health information shall, following the discovery of 
a breach of such information, notify the covered entity of 
such breach. Such notice shall include the identification of 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00278
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
279 
each individual whose unsecured protected health informa-
tion has been, or is reasonably believed by the business asso-
ciate to have been, accessed, acquired, or disclosed during 
such breach. 
(c) BREACHES TREATED AS DISCOVERED.—For pur-
poses of this section, a breach shall be treated as discovered 
by a covered entity or by a business associate as of the first 
day on which such breach is known to such entity or asso-
ciate, respectively, (including any person, other than the in-
dividual committing the breach, that is an employee, officer, 
or other agent of such entity or associate, respectively) or 
should reasonably have been known to such entity or asso-
ciate (or person) to have occurred. 
(d) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Subject to subsection (g), all 
notifications required under this section shall be made 
without unreasonable delay and in no case later than 
60 calendar days after the discovery of a breach by 
the covered entity involved (or business associate in-
volved in the case of a notification required under 
subsection (b)). 
(2) BURDEN OF PROOF.—The covered entity in-
volved (or business associate involved in the case of a 
notification required under subsection (b)), shall have 
the burden of demonstrating that all notifications 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00279
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
280 
were made as required under this part, including evi-
dence demonstrating the necessity of any delay. 
(e) METHODS OF NOTICE.— 
(1) INDIVIDUAL NOTICE.—Notice required under 
this section to be provided to an individual, with re-
spect to a breach, shall be provided promptly and in 
the following form: 
(A) Written notification by first-class mail 
to the individual (or the next of kin of the indi-
vidual if the individual is deceased) at the last 
known address of the individual or the next of 
kin, respectively, or, if specified as a preference 
by the individual, by electronic mail. The notifi-
cation may be provided in one or more mailings 
as information is available. 
(B) In the case in which there is insuffi-
cient, or out-of-date contact information (includ-
ing a phone number, e-mail address, or any 
other form of appropriate communication) that 
precludes direct written (or, if specified by the 
individual under subparagraph (A), electronic) 
notification to the individual, a substitute form 
of notice shall be provided, including, in the case 
that there are 10 or more individuals for which 
there is insufficient or out-of-date contact infor-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00280
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
281 
mation, a conspicuous posting for a period deter-
mined by the Secretary on the home page of the 
website of the covered entity involved or notice in 
major print or broadcast media, including major 
media in geographic areas where the individuals 
affected by the breach likely reside. Such a notice 
in media or web posting will include a toll-free 
phone number where an individual can learn 
whether or not the individual’s unsecured pro-
tected health information is possibly included in 
the breach. 
(C) In any case deemed by the covered enti-
ty involved to require urgency because of possible 
imminent misuse of unsecured protected health 
information, the covered entity, in addition to 
notice provided under subparagraph (A), may 
provide information to individuals by telephone 
or other means, as appropriate. 
(2) MEDIA NOTICE.—Notice shall be provided to 
prominent media outlets serving a State or jurisdic-
tion, following the discovery of a breach described in 
subsection (a), if the unsecured protected health infor-
mation of more than 500 residents of such State or 
jurisdiction is, or is reasonably believed to have been, 
accessed, acquired, or disclosed during such breach. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00281
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
282 
(3) NOTICE TO SECRETARY.—Notice shall be pro-
vided to the Secretary by covered entities of unsecured 
protected health information that has been acquired 
or disclosed in a breach. If the breach was with re-
spect to 500 or more individuals than such notice 
must be provided immediately. If the breach was with 
respect to less than 500 individuals, the covered entity 
involved may maintain a log of any such breach oc-
curring and annually submit such a log to the Sec-
retary documenting such breaches occuring during the 
year involved. 
(4) POSTING
ON
HHS
PUBLIC
WEBSITE.—The 
Secretary shall make available to the public on the 
Internet website of the Department of Health and 
Human Services a list that identifies each covered en-
tity involved in a breach described in subsection (a) 
in which the unsecured protected health information 
of more than 500 individuals is acquired or disclosed. 
(f) CONTENT
OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a breach shall include, to the extent 
possible, the following: 
(1) A brief description of what happened, includ-
ing the date of the breach and the date of the dis-
covery of the breach, if known. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00282
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
283 
(2) A description of the types of unsecured pro-
tected health information that were involved in the 
breach (such as full name, Social Security number, 
date of birth, home address, account number, or dis-
ability code). 
(3) The steps individuals should take to protect 
themselves from potential harm resulting from the 
breach. 
(4) A brief description of what the covered entity 
involved is doing to investigate the breach, to mitigate 
losses, and to protect against any further breaches. 
(5) Contact procedures for individuals to ask 
questions or learn additional information, which shall 
include a toll-free telephone number, an e-mail ad-
dress, website, or postal address. 
(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.—If a law enforcement official 
determines that a notification, notice, or posting required 
under this section would impede a criminal investigation 
or cause damage to national security, such notification, no-
tice, or posting shall be delayed in the same manner as pro-
vided under section 164.528(a)(2) of title 45, Code of Fed-
eral Regulations, in the case of a disclosure covered under 
such section. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00283
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
284 
(h) UNSECURED
PROTECTED
HEALTH
INFORMA-
TION.— 
(1) DEFINITION.— 
(A) IN GENERAL.—Subject to subparagraph 
(B), for purposes of this section, the term ‘‘unse-
cured protected health information’’ means pro-
tected health information that is not secured 
through the use of a technology or methodology 
specified by the Secretary in the guidance issued 
under paragraph (2). 
(B) EXCEPTION IN CASE TIMELY GUIDANCE 
NOT ISSUED.—In the case that the Secretary does 
not issue guidance under paragraph (2) by the 
date specified in such paragraph, for purposes of 
this section, the term ‘‘unsecured protected health 
information’’ shall mean protected health infor-
mation that is not secured by a technology 
standard that renders protected health informa-
tion unusable, unreadable, or indecipherable to 
unauthorized individuals and is developed or en-
dorsed by a standards developing organization 
that is accredited by the American National 
Standards Institute. 
(2) GUIDANCE.—For purposes of paragraph (1) 
and section 407(f)(3), not later than the date that is 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00284
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
285 
60 days after the date of the enactment of this Act, 
the Secretary shall, after consultation with stake-
holders, issue (and annually update) guidance speci-
fying the technologies and methodologies that render 
protected health information unusable, unreadable, or 
indecipherable to unauthorized individuals. 
(i) REPORT TO CONGRESS ON BREACHES.— 
(1) IN
GENERAL.—Not later than 12 months 
after the date of the enactment of this Act and annu-
ally thereafter, the Secretary shall prepare and sub-
mit to the Committee on Finance and the Committee 
on Health, Education, Labor, and Pensions of the 
Senate and the Committee on Ways and Means and 
the Committee on Energy and Commerce of the House 
of Representatives a report containing the informa-
tion described in paragraph (2) regarding breaches 
for which notice was provided to the Secretary under 
subsection (e)(3). 
(2) INFORMATION.—The information described 
in this paragraph regarding breaches specified in 
paragraph (1) shall include— 
(A) the number and nature of such breaches; 
and 
(B) actions taken in response to such 
breaches. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00285
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
286 
(j) REGULATIONS; EFFECTIVE DATE.—To carry out 
this section, the Secretary of Health and Human Services 
shall promulgate interim final regulations by not later than 
the date that is 180 days after the date of the enactment 
of this title. The provisions of this section shall apply to 
breaches that are discovered on or after the date that is 30 
days after the date of publication of such interim final regu-
lations. 
SEC. 4403. EDUCATION ON HEALTH INFORMATION PRIVACY. 
(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not later 
than 6 months after the date of the enactment of this Act, 
the Secretary shall designate an individual in each regional 
office of the Department of Health and Human Services to 
offer guidance and education to covered entities, business 
associates, and individuals on their rights and responsibil-
ities related to Federal privacy and security requirements 
for protected health information. 
(b) EDUCATION INITIATIVE ON USES OF HEALTH IN-
FORMATION.—Not later than 12 months after the date of 
the enactment of this Act, the Office for Civil Rights within 
the Department of Health and Human Services shall de-
velop and maintain a multi-faceted national education ini-
tiative to enhance public transparency regarding the uses 
of protected health information, including programs to edu-
cate individuals about the potential uses of their protected 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00286
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
287 
health information, the effects of such uses, and the rights 
of individuals with respect to such uses. Such programs 
shall be conducted in a variety of languages and present 
information in a clear and understandable manner. 
SEC. 4404. APPLICATION OF PRIVACY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES. 
(a) APPLICATION OF CONTRACT REQUIREMENTS.—In 
the case of a business associate of a covered entity that ob-
tains or creates protected health information pursuant to 
a written contract (or other written arrangement) described 
in section 164.502(e)(2) of title 45, Code of Federal Regula-
tions, with such covered entity, the business associate may 
use and disclose such protected health information only if 
such use or disclosure, respectively, is in compliance with 
each applicable requirement of section 164.504(e) of such 
title. The additional requirements of this subtitle that relate 
to privacy and that are made applicable with respect to 
covered entities shall also be applicable to such a business 
associate and shall be incorporated into the business asso-
ciate agreement between the business associate and the cov-
ered entity. 
(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSOCI-
ATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of title 
45, Code of Federal Regulations, shall apply to a business 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00287
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
288 
associate described in subsection (a), with respect to compli-
ance with such subsection, in the same manner that such 
section applies to a covered entity, with respect to compli-
ance with the standards in sections 164.502(e) and 
164.504(e) of such title, except that in applying such section 
164.504(e)(1)(ii) each reference to the business associate, 
with respect to a contract, shall be treated as a reference 
to the covered entity involved in such contract. 
(c) APPLICATION
OF
CIVIL
AND
CRIMINAL
PEN-
ALTIES.—In the case of a business associate that violates 
any provision of subsection (a) or (b), the provisions of sec-
tions 1176 and 1177 of the Social Security Act (42 U.S.C. 
1320d–5, 1320d–6) shall apply to the business associate 
with respect to such violation in the same manner as such 
provisions apply to a person who violates a provision of 
part C of title XI of such Act. 
SEC. 4405. RESTRICTIONS ON CERTAIN DISCLOSURES AND 
SALES OF HEALTH INFORMATION; ACCOUNT-
ING OF CERTAIN PROTECTED HEALTH INFOR-
MATION DISCLOSURES; ACCESS TO CERTAIN 
INFORMATION IN ELECTRONIC FORMAT. 
(a) REQUESTED RESTRICTIONS ON CERTAIN DISCLO-
SURES OF HEALTH INFORMATION.—In the case that an in-
dividual requests under paragraph (a)(1)(i)(A) of section 
164.522 of title 45, Code of Federal Regulations, that a cov-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00288
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
289 
ered entity restrict the disclosure of the protected health in-
formation of the individual, notwithstanding paragraph 
(a)(1)(ii) of such section, the covered entity must comply 
with the requested restriction if— 
(1) except as otherwise required by law, the dis-
closure is to a health plan for purposes of carrying 
out payment or health care operations (and is not for 
purposes of carrying out treatment); and 
(2) the protected health information pertains 
solely to a health care item or service for which the 
health care provider involved has been paid out of 
pocket in full. 
(b) DISCLOSURES REQUIRED TO BE LIMITED TO THE 
LIMITED DATA SET OR THE MINIMUM NECESSARY.— 
(1) IN GENERAL.— 
(A) IN GENERAL.—Subject to subparagraph 
(B), a covered entity shall be treated as being in 
compliance with section 164.502(b)(1) of title 45, 
Code of Federal Regulations, with respect to the 
use, disclosure, or request of protected health in-
formation described in such section, only if the 
covered entity limits such protected health infor-
mation, to the extent practicable, to the limited 
data set (as defined in section 164.514(e)(2) of 
such title) or, if needed by such entity, to the 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00289
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
290 
minimum necessary to accomplish the intended 
purpose of such use, disclosure, or request, re-
spectively. 
(B) GUIDANCE.—Not later than 18 months 
after the date of the enactment of this section, the 
Secretary shall issue guidance on what con-
stitutes ‘‘minimum necessary’’ for purposes of 
subpart E of part 164 of title 45, Code of Fed-
eral Regulation. In issuing such guidance the 
Secretary shall take into consideration the guid-
ance under section 4424(c). 
(C) SUNSET.—Subparagraph (A) shall not 
apply on and after the effective date on which 
the Secretary issues the guidance under subpara-
graph (B). 
(2) DETERMINATION OF MINIMUM NECESSARY.— 
For purposes of paragraph (1), in the case of the dis-
closure of protected health information, the covered 
entity or business associate disclosing such informa-
tion shall determine what constitutes the minimum 
necessary to accomplish the intended purpose of such 
disclosure. 
(3) APPLICATION OF EXCEPTIONS.—The excep-
tions described in section 164.502(b)(2) of title 45, 
Code of Federal Regulations, shall apply to the re-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00290
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
291 
quirement under paragraph (1) as of the effective date 
described in section 4423 in the same manner that 
such exceptions apply to section 164.502(b)(1) of such 
title before such date. 
(4) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed as affecting the use, dis-
closure, or request of protected health information 
that has been de-identified. 
(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH IN-
FORMATION DISCLOSURES REQUIRED IF COVERED ENTITY 
USES ELECTRONIC HEALTH RECORD.— 
(1) IN GENERAL.—In applying section 164.528 
of title 45, Code of Federal Regulations, in the case 
that a covered entity uses or maintains an electronic 
health record with respect to protected health informa-
tion— 
(A) the exception under paragraph (a)(1)(i) 
of such section shall not apply to disclosures 
through an electronic health record made by such 
entity of such information; and 
(B) an individual shall have a right to re-
ceive an accounting of disclosures described in 
such paragraph of such information made by 
such covered entity during only the three years 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00291
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
292 
prior to the date on which the accounting is re-
quested. 
(2) REGULATIONS.—The Secretary shall promul-
gate regulations on what information shall be col-
lected about each disclosure referred to in paragraph 
(1)(A) not later than 18 months after the date on 
which the Secretary adopts standards on accounting 
for 
disclosure 
described 
in 
the 
section 
3002(b)(2)(B)(iv) of the Public Health Service Act, as 
added by section 4101. Such regulations shall only re-
quire such information to be collected through an elec-
tronic health record in a manner that takes into ac-
count the interests of individuals in learning the cir-
cumstances under which their protected health infor-
mation is being disclosed and takes into account the 
administrative burden of accounting for such disclo-
sures. 
(3) CONSTRUCTION.—Nothing in this subsection 
shall be construed as requiring a covered entity to ac-
count for disclosures of protected health information 
that are not made by such covered entity or by a 
business associate acting on behalf of the covered enti-
ty. 
(4) EFFECTIVE DATE.— 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00292
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
293 
(A) 
CURRENT
USERS
OF
ELECTRONIC 
RECORDS.—In the case of a covered entity inso-
far as it acquired an electronic health record as 
of January 1, 2009, paragraph (1) shall apply 
to disclosures, with respect to protected health in-
formation, made by the covered entity from such 
a record on and after January 1, 2014. 
(B) OTHERS.—In the case of a covered enti-
ty insofar as it acquires an electronic health 
record after January 1, 2009, paragraph (1) 
shall apply to disclosures, with respect to pro-
tected health information, made by the covered 
entity from such record on and after the later of 
the following: 
(i) January 1, 2011; or 
(ii) the date that it acquires an elec-
tronic health record. 
(d) REVIEW OF HEALTH CARE OPERATIONS.—Not 
later than 18 months after the date of the enactment of this 
title, the Secretary shall promulgate regulations to elimi-
nate from the definition of health care operations under sec-
tion 164.501 of title 45, Code of Federal Regulations, those 
activities that can reasonably and efficiently be conducted 
through the use of information that is de-identified (in ac-
cordance with the requirements of section 164.514(b) of such 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00293
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
294 
title) or that should require a valid authorization for use 
or disclosure. In promulgating such regulations, the Sec-
retary may choose to narrow or clarify activities that the 
Secretary chooses to retain in the definition of health care 
operations and the Secretary shall take into account the re-
port under section 424(d). In such regulations the Secretary 
shall specify the date on which such regulations shall apply 
to disclosures made by a covered entity, but in no case 
would such date be sooner than the date that is 24 months 
after the date of the enactment of this section. 
(e) PROHIBITION ON SALE OF ELECTRONIC HEALTH 
RECORDS
OR PROTECTED HEALTH INFORMATION OB-
TAINED FROM ELECTRONIC HEALTH RECORDS.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity or business associate shall 
not directly or indirectly receive remuneration in ex-
change for any protected health information of an in-
dividual unless the covered entity obtained from the 
individual, in accordance with section 164.508 of title 
45, Code of Federal Regulations, a valid authoriza-
tion that includes, in accordance with such section, a 
specification of whether the protected health informa-
tion can be further exchanged for remuneration by the 
entity receiving protected health information of that 
individual. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00294
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
295 
(2) EXCEPTIONS.—Paragraph (1) shall not 
apply in the following cases: 
(A) The purpose of the exchange is for re-
search or public health activities (as described in 
sections 164.501, 164.512(i), and 164.512(b) of 
title 45, Code of Federal Regulations) and the 
price charged reflects the costs of preparation 
and transmittal of the data for such purpose. 
(B) The purpose of the exchange is for the 
treatment of the individual and the price charges 
reflects not more than the costs of preparation 
and transmittal of the data for such purpose. 
(C) The purpose of the exchange is the 
health care operation specifically described in 
subparagraph (iv) of paragraph (6) of the defini-
tion of health care operations in section 164.501 
of title 45, Code of Federal Regulations. 
(D) The purpose of the exchange is for re-
muneration that is provided by a covered entity 
to a business associate for activities involving the 
exchange of protected health information that the 
business associate undertakes on behalf of and at 
the specific request of the covered entity pursuant 
to a business associate agreement. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00295
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
296 
(E) The purpose of the exchange is to pro-
vide an individual with a copy of the individ-
ual’s protected health information pursuant to 
section 164.524 of title 45, Code of Federal Regu-
lations. 
(F) The purpose of the exchange is otherwise 
determined by the Secretary in regulations to be 
similarly necessary and appropriate as the ex-
ceptions provided in subparagraphs (A) through 
(E). 
(3) REGULATIONS.—The Secretary shall promul-
gate regulations to carry out paragraph (this sub-
section, including exceptions described in paragraph 
(2), not later than 18 months after the date of the en-
actment of this title. 
(4) EFFECTIVE
DATE.—Paragraph (1) shall 
apply to exchanges occurring on or after the date that 
is 6 months after the date of the promulgation of final 
regulations implementing this subsection. 
(f) ACCESS TO CERTAIN INFORMATION IN ELECTRONIC 
FORMAT.—In applying section 164.524 of title 45, Code of 
Federal Regulations, in the case that a covered entity uses 
or maintains an electronic health record with respect to 
protected health information of an individual— 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00296
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
297 
(1) the individual shall have a right to obtain 
from such covered entity a copy of such information 
in an electronic format; and 
(2) notwithstanding paragraph (c)(4) of such 
section, any fee that the covered entity may impose 
for providing such individual with a copy of such in-
formation (or a summary or explanation of such in-
formation) if such copy (or summary or explanation) 
is in an electronic form shall not be greater than the 
entity’s labor costs in responding to the request for the 
copy (or summary or explanation). 
SEC. 4406. CONDITIONS ON CERTAIN CONTACTS AS PART 
OF HEALTH CARE OPERATIONS. 
(a) MARKETING.— 
(1) IN GENERAL.—A communication by a cov-
ered entity or business associate that is about a prod-
uct or service and that encourages recipients of the 
communication to purchase or use the product or 
service shall not be considered a health care operation 
for purposes of subpart E of part 164 of title 45, Code 
of Federal Regulations, unless the communication is 
made as described in subparagraph (i), (ii), or (iii) 
of paragraph (1) of the definition of marketing in sec-
tion 164.501 of such title. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00297
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
298 
(2) PAYMENT FOR CERTAIN COMMUNICATIONS.— 
A covered entity or business associate may not receive 
direct or indirect payment in exchange for making 
any communication described in subparagraph (i), 
(ii), or (iii) of paragraph (1) of the definition of mar-
keting in section 164.501 of title 45, Code of Federal 
Regulations, except— 
(A) a business associate of a covered entity 
may receive payment from the covered entity for 
making any such communication on behalf of the 
covered entity that is consistent with the written 
contract (or other written arrangement) de-
scribed in section 164.502(e)(2) of such title be-
tween such business associate and covered entity; 
and 
(B) a covered entity may receive payment 
in exchange for making any such communication 
if the entity obtains from the recipient of the 
communication, in accordance with section 
164.508 of title 45, Code of Federal Regulations, 
a valid authorization (as described in paragraph 
(b) of such section) with respect to such commu-
nication. 
(b) FUNDRAISING.—Fundraising for the benefit of a 
covered entity shall not be considered a health care oper-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00298
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
299 
ation for purposes of section 164.501 of title 45, Code of 
Federal Regulations. 
(c) EFFECTIVE DATE.—This section shall apply to 
contracting occurring on or after the effective date specified 
under section 4423. 
SEC. 4407. TEMPORARY BREACH NOTIFICATION REQUIRE-
MENT FOR VENDORS OF PERSONAL HEALTH 
RECORDS AND OTHER NON-HIPAA COVERED 
ENTITIES. 
(a) IN GENERAL.—In accordance with subsection (c), 
each vendor of personal health records, following the dis-
covery of a breach of security of unsecured PHR identifiable 
health information that is in a personal health record 
maintained or offered by such vendor, and each entity de-
scribed in clause (ii) or (iii) of section 4424(b)(1)(A), fol-
lowing the discovery of a breach of security of such informa-
tion that is obtained through a product or service provided 
by such entity, shall— 
(1) notify each individual who is a citizen or 
resident of the United States whose unsecured PHR 
identifiable health information was acquired by an 
unauthorized person as a result of such a breach of 
security; and 
(2) notify the Federal Trade Commission. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00299
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
300 
(b) NOTIFICATION BY THIRD PARTY SERVICE PRO-
VIDERS.—A third party service provider that provides serv-
ices to a vendor of personal health records or to an entity 
described in clause (ii) or (iii) of section 4424(b)(1)(A) in 
connection with the offering or maintenance of a personal 
health record or a related product or service and that ac-
cesses, maintains, retains, modifies, records, stores, destroys, 
or otherwise holds, uses, or discloses unsecured PHR identi-
fiable health information in such a record as a result of 
such services shall, following the discovery of a breach of 
security of such information, notify such vendor or entity, 
respectively, of such breach. Such notice shall include the 
identification of each individual whose unsecured PHR 
identifiable health information has been, or is reasonably 
believed to have been, accessed, acquired, or disclosed during 
such breach. 
(c) APPLICATION OF REQUIREMENTS FOR TIMELINESS, 
METHOD, AND CONTENT OF NOTIFICATIONS.—Subsections 
(c), (d), (e), and (f) of section 402 shall apply to a notifica-
tion required under subsection (a) and a vendor of personal 
health records, an entity described in subsection (a) and 
a third party service provider described in subsection (b), 
with respect to a breach of security under subsection (a) 
of unsecured PHR identifiable health information in such 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00300
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
301 
records maintained or offered by such vendor, in a manner 
specified by the Federal Trade Commission. 
(d) NOTIFICATION OF THE SECRETARY.—Upon receipt 
of a notification of a breach of security under subsection 
(a)(2), the Federal Trade Commission shall notify the Sec-
retary of such breach. 
(e) ENFORCEMENT.—A violation of subsection (a) or 
(b) shall be treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or prac-
tices. 
(f) DEFINITIONS.—For purposes of this section: 
(1) BREACH OF SECURITY.—The term ‘‘breach of 
security’’ means, with respect to unsecured PHR 
identifiable health information of an individual in a 
personal health record, acquisition of such informa-
tion without the authorization of the individual. 
(2) PHR 
IDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘PHR identifiable health informa-
tion’’ means individually identifiable health informa-
tion, as defined in section 1171(6) of the Social Secu-
rity Act (42 U.S.C. 1320d(6)), and includes, with re-
spect to an individual, information— 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00301
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
302 
(A) that is provided by or on behalf of the 
individual; and 
(B) that identifies the individual or with 
respect to which there is a reasonable basis to be-
lieve that the information can be used to identify 
the individual. 
(3) UNSECURED PHR IDENTIFIABLE HEALTH IN-
FORMATION.— 
(A) IN GENERAL.—Subject to subparagraph 
(B), the term ‘‘unsecured PHR identifiable 
health information’’ means PHR identifiable 
health information that is not protected through 
the use of a technology or methodology specified 
by the Secretary in the guidance issued under 
section 4402(h)(2). 
(B) EXCEPTION IN CASE TIMELY GUIDANCE 
NOT ISSUED.—In the case that the Secretary does 
not issue guidance under section 4402(h)(2) by 
the date specified in such section, for purposes of 
this section, the term ‘‘unsecured PHR identifi-
able health information’’ shall mean PHR iden-
tifiable health information that is not secured by 
a technology standard that renders protected 
health information unusable, unreadable, or in-
decipherable to unauthorized individuals and 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00302
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
303 
that is developed or endorsed by a standards de-
veloping organization that is accredited by the 
American National Standards Institute. 
(g) REGULATIONS; EFFECTIVE DATE; SUNSET.— 
(1) REGULATIONS; EFFECTIVE DATE.—To carry 
out this section, the Secretary of Health and Human 
Services shall promulgate interim final regulations by 
not later than the date that is 180 days after the date 
of the enactment of this section. The provisions of this 
section shall apply to breaches of security that are 
discovered on or after the date that is 30 days after 
the date of publication of such interim final regula-
tions. 
(2) SUNSET.—The provisions of this section shall 
not apply to breaches of security occurring on or after 
the earlier of the following the dates: 
(A) The date on which a standard relating 
to requirements for entities that are not covered 
entities that includes requirements relating to 
breach notification has been promulgated by the 
Secretary. 
(B) The date on which a standard relating 
to requirements for entities that are not covered 
entities that includes requirements relating to 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00303
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
304 
breach notification has been promulgated by the 
Federal Trade Commission and has taken effect. 
SEC. 4408. BUSINESS ASSOCIATE CONTRACTS REQUIRED 
FOR CERTAIN ENTITIES. 
Each organization, with respect to a covered entity, 
that provides data transmission of protected health infor-
mation to such entity (or its business associate) and that 
requires access on a routine basis to such protected health 
information, such as a Health Information Exchange Orga-
nization, Regional Health Information Organization, E- 
prescribing Gateway, or each vendor that contracts with a 
covered entity to allow that covered entity to offer a per-
sonal health record to patients as part of its electronic 
health record, is required to enter into a written contract 
(or other written arrangement) described in section 
164.502(e)(2) of title 45, Code of Federal Regulations and 
a written contract (or other arrangement) described in sec-
tion 164.308(b) of such title, with such entity and shall be 
treated as a business associate of the covered entity for pur-
poses of the provisions of this subtitle and subparts C and 
E of part 164 of title 45, Code of Federal Regulations, as 
such provisions are in effect as of the date of enactment 
of this title. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00304
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
305 
SEC. 4409. CLARIFICATION OF APPLICATION OF WRONGFUL 
DISCLOSURES CRIMINAL PENALTIES. 
Section 1177(a) of the Social Security Act (42 U.S.C. 
1320d–6(a)) is amended by adding at the end the following 
new sentence: ‘‘For purposes of the previous sentence, a per-
son (including an employee or other individual) shall be 
considered to have obtained or disclosed individually identi-
fiable health information in violation of this part if the in-
formation is maintained by a covered entity (as defined in 
the HIPAA privacy regulation described in section 
1180(b)(3)) and the individual obtained or disclosed such 
information without authorization.’’. 
SEC. 4410. IMPROVED ENFORCEMENT. 
(a) IN GENERAL.—Section 1176 of the Social Security 
Act (42 U.S.C. 1320d-5) is amended— 
(1) in subsection (b)(1), by striking ‘‘the act con-
stitutes an offense punishable under section 1177’’ 
and inserting ‘‘a penalty has been imposed under sec-
tion 1177 with respect to such act’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(c) NONCOMPLIANCE DUE TO WILLFUL NEGLECT.— 
‘‘(1) IN GENERAL.—A violation of a provision of 
this part due to willful neglect is a violation for 
which the Secretary is required to impose a penalty 
under subsection (a)(1). 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00305
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
306 
‘‘(2) REQUIRED INVESTIGATION.—For purposes 
of paragraph (1), the Secretary shall formally inves-
tigate any complaint of a violation of a provision of 
this part if a preliminary investigation of the facts 
of the complaint indicate such a possible violation 
due to willful neglect.’’. 
(b) EFFECTIVE DATE; REGULATIONS.— 
(1) The amendments made by subsection (a) 
shall apply to penalties imposed on or after the date 
that is 24 months after the date of the enactment of 
this title. 
(2) Not later than 18 months after the date of the 
enactment of this title, the Secretary of Health and 
Human Services shall promulgate regulations to im-
plement such amendments. 
(c) DISTRIBUTION OF CERTAIN CIVIL MONETARY PEN-
ALTIES COLLECTED.— 
(1) IN GENERAL.—Subject to the regulation pro-
mulgated pursuant to paragraph (3), any civil mone-
tary penalty or monetary settlement collected with re-
spect to an offense punishable under this subtitle or 
section 1176 of the Social Security Act (42 U.S.C. 
1320d–5) insofar as such section relates to privacy or 
security shall be transferred to the Office of Civil 
Rights of the Department of Health and Human 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00306
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
307 
Services to be used for purposes of enforcing the pro-
visions of this subtitle and subparts C and E of part 
164 of title 45, Code of Federal Regulations, as such 
provisions are in effect as of the date of enactment of 
this Act. 
(2) GAO REPORT.—Not later than 18 months 
after the date of the enactment of this title, the Comp-
troller General shall submit to the Secretary a report 
including recommendations for a methodology under 
which an individual who is harmed by an act that 
constitutes an offense referred to in paragraph (1) 
may receive a percentage of any civil monetary pen-
alty or monetary settlement collected with respect to 
such offense. 
(3) ESTABLISHMENT OF METHODOLOGY TO DIS-
TRIBUTE
PERCENTAGE
OF
CMPS
COLLECTED
TO 
HARMED INDIVIDUALS.—Not later than 3 years after 
the date of the enactment of this title, the Secretary 
shall establish by regulation and based on the rec-
ommendations submitted under paragraph (2), a 
methodology under which an individual who is 
harmed by an act that constitutes an offense referred 
to in paragraph (1) may receive a percentage of any 
civil monetary penalty or monetary settlement col-
lected with respect to such offense. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00307
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
308 
(4) APPLICATION OF METHODOLOGY.—The meth-
odology under paragraph (3) shall be applied with re-
spect to civil monetary penalties or monetary settle-
ments imposed on or after the effective date of the reg-
ulation. 
(d) TIERED INCREASE IN AMOUNT OF CIVIL MONE-
TARY PENALTIES.— 
(1) IN GENERAL.—Section 1176(a)(1) of the So-
cial Security Act (42 U.S.C. 1320d–5(a)(1)) is 
amended by striking ‘‘who violates a provision of this 
part a penalty of not more than’’ and all that follows 
and inserting the following: ‘‘who violates a provision 
of this part— 
‘‘(A) in the case of a violation of such pro-
vision in which it is established that the person 
did not know (and by exercising reasonable dili-
gence would not have known) that such person 
violated such provision, a penalty for each such 
violation of an amount that is at least the 
amount described in paragraph (3)(A) but not to 
exceed the amount described in paragraph 
(3)(D); 
‘‘(B) in the case of a violation of such pro-
vision in which it is established that the viola-
tion was due to reasonable cause and not to will-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00308
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
309 
ful neglect, a penalty for each such violation of 
an amount that is at least the amount described 
in paragraph (3)(B) but not to exceed the 
amount described in paragraph (3)(D); and 
‘‘(C) in the case of a violation of such provi-
sion in which it is established that the violation 
was due to willful neglect— 
‘‘(i) if the violation is corrected as de-
scribed in subsection (b)(3)(A), a penalty in 
an amount that is at least the amount de-
scribed in paragraph (3)(C) but not to ex-
ceed the amount described in paragraph 
(3)(D); and 
‘‘(ii) if the violation is not corrected as 
described in such subsection, a penalty in 
an amount that is at least the amount de-
scribed in paragraph (3)(D). 
In determining the amount of a penalty under 
this section for a violation, the Secretary shall 
base such determination on the nature and ex-
tent of the violation and the nature and extent 
of the harm resulting from such violation.’’. 
(2) TIERS OF PENALTIES DESCRIBED.—Section 
1176(a) of such Act (42 U.S.C. 1320d–5(a)) is further 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00309
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
310 
amended by adding at the end the following new 
paragraph: 
‘‘(3) TIERS
OF
PENALTIES
DESCRIBED.—For 
purposes of paragraph (1), with respect to a violation 
by a person of a provision of this part— 
‘‘(A) the amount described in this subpara-
graph is $100 for each such violation, except that 
the total amount imposed on the person for all 
such violations of an identical requirement or 
prohibition during a calendar year may not ex-
ceed $25,000; 
‘‘(B) the amount described in this subpara-
graph is $1,000 for each such violation, except 
that the total amount imposed on the person for 
all such violations of an identical requirement or 
prohibition during a calendar year may not ex-
ceed $100,000; 
‘‘(C) the amount described in this subpara-
graph is $10,000 for each such violation, except 
that the total amount imposed on the person for 
all such violations of an identical requirement or 
prohibition during a calendar year may not ex-
ceed $250,000; and 
‘‘(D) the amount described in this subpara-
graph is $50,000 for each such violation, except 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00310
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
311 
that the total amount imposed on the person for 
all such violations of an identical requirement or 
prohibition during a calendar year may not ex-
ceed $1,500,000.’’. 
(3) 
CONFORMING
AMENDMENTS.—Section 
1176(b) of such Act (42 U.S.C. 1320d–5(b)) is amend-
ed— 
(A) by striking paragraph (2) and redesig-
nating paragraphs (3) and (4) as paragraphs 
(2) and (3), respectively; and 
(B) in paragraph (2), as so redesignated— 
(i) in subparagraph (A), by striking 
‘‘in subparagraph (B), a penalty may not 
be imposed under subsection (a) if’’ and all 
that follows through ‘‘the failure to comply 
is corrected’’ and inserting ‘‘in subpara-
graph (B) or subsection (a)(1)(C), a penalty 
may not be imposed under subsection (a) if 
the failure to comply is corrected’’; and 
(ii) in subparagraph (B), by striking 
‘‘(A)(ii)’’ and inserting ‘‘(A)’’ each place it 
appears. 
(4) EFFECTIVE DATE.—The amendments made 
by this subsection shall apply to violations occurring 
after the date of the enactment of this title. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00311
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
312 
(e) ENFORCEMENT THROUGH STATE ATTORNEYS GEN-
ERAL.— 
(1) IN GENERAL.—Section 1176 of the Social Se-
curity Act (42 U.S.C. 1320d–5) is amended by add-
ing at the end the following new subsection: 
‘‘(c) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
‘‘(1) CIVIL ACTION.—Except as provided in sub-
section (b), in any case in which the attorney general 
of a State has reason to believe that an interest of one 
or more of the residents of that State has been or is 
threatened or adversely affected by any person who 
violates a provision of this part, the attorney general 
of the State, as parens patriae, may bring a civil ac-
tion on behalf of such residents of the State in a dis-
trict court of the United States of appropriate juris-
diction— 
‘‘(A) to enjoin further such violation by the 
defendant; or 
‘‘(B) to obtain damages on behalf of such 
residents of the State, in an amount equal to the 
amount determined under paragraph (2). 
‘‘(2) STATUTORY DAMAGES.— 
‘‘(A) IN GENERAL.—For purposes of para-
graph (1)(B), the amount determined under this 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00312
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
313 
paragraph is the amount calculated by multi-
plying the number of violations by up to $100. 
For purposes of the preceding sentence, in the 
case of a continuing violation, the number of vio-
lations shall be determined consistent with the 
HIPAA privacy regulations (as defined in sec-
tion 1180(b)(3)) for violations of subsection (a). 
‘‘(B) LIMITATION.—The total amount of 
damages imposed on the person for all violations 
of an identical requirement or prohibition dur-
ing a calendar year may not exceed $25,000. 
‘‘(C) REDUCTION OF DAMAGES.—In assess-
ing damages under subparagraph (A), the court 
may consider the factors the Secretary may con-
sider in determining the amount of a civil 
money penalty under subsection (a) under the 
HIPAA privacy regulations. 
‘‘(3) ATTORNEY FEES.—In the case of any suc-
cessful action under paragraph (1), the court, in its 
discretion, may award the costs of the action and rea-
sonable attorney fees to the State. 
‘‘(4) NOTICE TO SECRETARY.—The State shall 
serve prior written notice of any action under para-
graph (1) upon the Secretary and provide the Sec-
retary with a copy of its complaint, except in any 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00313
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
314 
case in which such prior notice is not feasible, in 
which case the State shall serve such notice imme-
diately upon instituting such action. The Secretary 
shall have the right— 
‘‘(A) to intervene in the action; 
‘‘(B) upon so intervening, to be heard on all 
matters arising therein; and 
‘‘(C) to file petitions for appeal. 
‘‘(5) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
section shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State. 
‘‘(6) VENUE; SERVICE OF PROCESS.— 
‘‘(A) VENUE.—Any action brought under 
paragraph (1) may be brought in the district 
court of the United States that meets applicable 
requirements relating to venue under section 
1391 of title 28, United States Code. 
‘‘(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1), process may be 
served in any district in which the defendant— 
‘‘(i) is an inhabitant; or 
‘‘(ii) maintains a physical place of 
business. 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00314
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
315 
‘‘(7) LIMITATION ON STATE ACTION WHILE FED-
ERAL ACTION IS PENDING.—If the Secretary has insti-
tuted an action against a person under subsection (a) 
with respect to a specific violation of this part, no 
State attorney general may bring an action under 
this subsection against the person with respect to such 
violation during the pendency of that action. 
‘‘(8) APPLICATION OF CMP STATUTE OF LIMITA-
TION.—A civil action may not be instituted with re-
spect to a violation of this part unless an action to 
impose a civil money penalty may be instituted 
under subsection (a) with respect to such violation 
consistent with the second sentence of section 
1128A(c)(1).’’. 
(2) CONFORMING AMENDMENTS.—Subsection (b) 
of such section, as amended by subsection (d)(3), is 
amended— 
(A) in paragraph (1), by striking ‘‘A pen-
alty may not be imposed under subsection (a)’’ 
and inserting ‘‘No penalty may be imposed 
under subsection (a) and no damages obtained 
under subsection (c)’’; 
(B) in paragraph (2)(A)— 
(i) in the matter before clause (i), by 
striking ‘‘a penalty may not be imposed 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00315
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
316 
under subsection (a)’’ and inserting ‘‘no 
penalty may be imposed under subsection 
(a) and no damages obtained under sub-
section (c)’’; and 
(ii) in clause (ii), by inserting ‘‘or 
damages’’ after ‘‘the penalty’’; 
(C) in paragraph (2)(B)(i), by striking 
‘‘The period’’ and inserting ‘‘With respect to the 
imposition of a penalty by the Secretary under 
subsection (a), the period’’; and 
(D) in paragraph (3), by inserting ‘‘and 
any damages under subsection (c)’’ after ‘‘any 
penalty under subsection (a)’’. 
(3) EFFECTIVE DATE.—The amendments made 
by this subsection shall apply to violations occurring 
after the date of the enactment of this Act. 
(f) ALLOWING CONTINUED USE OF CORRECTIVE AC-
TION.—Such section is further amended by adding at the 
end the following new subsection: 
‘‘(d) ALLOWING CONTINUED USE OF CORRECTIVE AC-
TION.—Nothing in this section shall be construed as pre-
venting the Office of Civil Rights of the Department of 
Health and Human Services from continuing, in its discre-
tion, to use corrective action without a penalty in cases 
where the person did not know (and by exercising reason-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00316
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
317 
able diligence would not have known) of the violation in-
volved.’’. 
SEC. 4411. AUDITS. 
The Secretary shall provide for periodic audits to en-
sure that covered entities and business associates that are 
subject to the requirements of this subtitle and subparts C 
and E of part 164 of title 45, Code of Federal Regulations, 
as such provisions are in effect as of the date of enactment 
of this Act, comply with such requirements. 
PART II—RELATIONSHIP TO OTHER LAWS; REGU-
LATORY REFERENCES; EFFECTIVE DATE; RE-
PORTS 
SEC. 4421. RELATIONSHIP TO OTHER LAWS. 
(a) APPLICATION OF HIPAA STATE PREEMPTION.— 
Section 1178 of the Social Security Act (42 U.S.C. 1320d– 
7) shall apply to a provision or requirement under this sub-
title in the same manner that such section applies to a pro-
vision or requirement under part C of title XI of such Act 
or a standard or implementation specification adopted or 
established under sections 1172 through 1174 of such Act. 
(b) HEALTH INSURANCE PORTABILITY AND ACCOUNT-
ABILITY ACT.—The standards governing the privacy and 
security of individually identifiable health information pro-
mulgated by the Secretary under sections 262(a) and 264 
of the Health Insurance Portability and Accountability Act 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00317
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
318 
of 1996 shall remain in effect to the extent that they are 
consistent with this subtitle. The Secretary shall by rule 
amend such Federal regulations as required to make such 
regulations consistent with this subtitle. 
SEC. 4422. REGULATORY REFERENCES. 
Each reference in this subtitle to a provision of the 
Code of Federal Regulations refers to such provision as in 
effect on the date of the enactment of this title (or to the 
most recent update of such provision). 
SEC. 4423. EFFECTIVE DATE. 
Except as otherwise specifically provided, the provi-
sions of part I shall take effect on the date that is 12 months 
after the date of the enactment of this title. 
SEC. 4424. STUDIES, REPORTS, GUIDANCE. 
(a) REPORT ON COMPLIANCE.— 
(1) IN GENERAL.—For the first year beginning 
after the date of the enactment of this Act and annu-
ally thereafter, the Secretary shall prepare and sub-
mit to the Committee on Health, Education, Labor, 
and Pensions of the Senate and the Committee on 
Ways and Means and the Committee on Energy and 
Commerce of the House of Representatives a report 
concerning complaints of alleged violations of law, in-
cluding the provisions of this subtitle as well as the 
provisions of subparts C and E of part 164 of title 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00318
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
319 
45, Code of Federal Regulations, (as such provisions 
are in effect as of the date of enactment of this Act) 
relating to privacy and security of health information 
that are received by the Secretary during the year for 
which the report is being prepared. Each such report 
shall include, with respect to such complaints received 
during the year— 
(A) the number of such complaints; 
(B) the number of such complaints resolved 
informally, a summary of the types of such com-
plaints so resolved, and the number of covered 
entities that received technical assistance from 
the Secretary during such year in order to 
achieve compliance with such provisions and the 
types of such technical assistance provided; 
(C) the number of such complaints that 
have resulted in the imposition of civil monetary 
penalties or have been resolved through monetary 
settlements, including the nature of the com-
plaints involved and the amount paid in each 
penalty or settlement; 
(D) the number of compliance reviews con-
ducted and the outcome of each such review; 
(E) the number of subpoenas or inquiries 
issued; 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00319
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
320 
(F) the Secretary’s plan for improving com-
pliance with and enforcement of such provisions 
for the following year; and 
(G) the number of audits performed and a 
summary of audit findings pursuant to section 
4411. 
(2) AVAILABILITY
TO
PUBLIC.—Each report 
under paragraph (1) shall be made available to the 
public on the Internet website of the Department of 
Health and Human Services. 
(b) STUDY AND REPORT ON APPLICATION OF PRIVACY 
AND SECURITY REQUIREMENTS TO NON-HIPAA COVERED 
ENTITIES.— 
(1) STUDY.—Not later than one year after the 
date of the enactment of this title, the Secretary, in 
consultation with the Federal Trade Commission, 
shall conduct a study, and submit a report under 
paragraph (2), on privacy and security requirements 
for entities that are not covered entities or business 
associates as of the date of the enactment of this title, 
including— 
(A) requirements relating to security, pri-
vacy, and notification in the case of a breach of 
security or privacy (including the applicability 
of an exemption to notification in the case of in-
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00320
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
321 
dividually identifiable health information that 
has been rendered unusable, unreadable, or inde-
cipherable through technologies or methodologies 
recognized by appropriate professional organiza-
tion or standard setting bodies to provide effec-
tive security for the information) that should be 
applied to— 
(i) vendors of personal health records; 
(ii) entities that offer products or serv-
ices through the website of a vendor of per-
sonal health records; 
(iii) entities that are not covered enti-
ties and that offer products or services 
through the websites of covered entities that 
offer individuals personal health records; 
(iv) entities that are not covered enti-
ties and that access information in a per-
sonal health record or send information to 
a personal health record; and 
(v) third party service providers used 
by a vendor or entity described in clause 
(i), (ii), (iii), or (iv) to assist in providing 
personal health record products or services; 
(B) a determination of which Federal Gov-
ernment agency is best equipped to enforce such 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00321
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
322 
requirements recommended to be applied to such 
vendors, entities, and service providers under 
subparagraph (A); and 
(C) a timeframe for implementing regula-
tions based on such findings. 
(2) REPORT.—The Secretary shall submit to the 
Committee on Finance, the Committee on Health, 
Education, Labor, and Pensions, and the Committee 
on Commerce of the Senate and the Committee on 
Ways and Means and the Committee on Energy and 
Commerce of the House of Representatives a report on 
the findings of the study under paragraph (1) and 
shall include in such report recommendations on the 
privacy and security requirements described in such 
paragraph. 
(c) GUIDANCE ON IMPLEMENTATION SPECIFICATION 
TO DE-IDENTIFY PROTECTED HEALTH INFORMATION.— 
Not later than 12 months after the date of the enactment 
of this title, the Secretary shall, in consultation with stake-
holders, issue guidance on how best to implement the re-
quirements for the de-identification of protected health in-
formation under section 164.514(b) of title 45, Code of Fed-
eral Regulations. 
(d) GAO REPORT ON TREATMENT DISCLOSURES.— 
Not later than one year after the date of the enactment of 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00322
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
323 
this title, the Comptroller General of the United States shall 
submit to the Committee on Health, Education, Labor, and 
Pensions of the Senate and the Committee on Ways and 
Means and the Committee on Energy and Commerce of the 
House of Representatives a report on the best practices re-
lated to the disclosure among health care providers of pro-
tected health information of an individual for purposes of 
treatment of such individual. Such report shall include an 
examination of the best practices implemented by States 
and by other entities, such as health information exchanges 
and regional health information organizations, an exam-
ination of the extent to which such best practices are suc-
cessful with respect to the quality of the resulting health 
care provided to the individual and with respect to the abil-
ity of the health care provider to manage such best prac-
tices, and an examination of the use of electronic informed 
consent for disclosing protected health information for treat-
ment, payment, and health care operations. 
Subtitle E—Miscellaneous Medicare 
Provisions 
SEC. 4501. MORATORIA ON CERTAIN MEDICARE REGULA-
TIONS. 
(a) DELAY IN PHASE OUT OF MEDICARE HOSPICE 
BUDGET NEUTRALITY ADJUSTMENT FACTOR DURING FIS-
CAL YEAR 2009.—Notwithstanding any other provision of 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00323
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
324 
law, including the final rule published on August 8, 2008, 
73 Federal Register 46464 et seq., relating to Medicare Pro-
gram; Hospice Wage Index for Fiscal Year 2009, the Sec-
retary of Health and Human Services shall not phase out 
or eliminate the budget neutrality adjustment factor in the 
Medicare hospice wage index before October 1, 2009, and 
the Secretary shall recompute and apply the final Medicare 
hospice wage index for fiscal year 2009 as if there had been 
no reduction in the budget neutrality adjustment factor. 
(b) NON-APPLICATION
OF PHASED-OUT INDIRECT 
MEDICAL EDUCATION (IME) ADJUSTMENT FACTOR FOR 
FISCAL YEAR 2009.— 
(1) IN GENERAL.—Section 412.322 of title 42, 
Code of Federal Regulations, shall be applied without 
regard to paragraph (c) of such section, and the Sec-
retary of Health and Human Services shall recom-
pute payments for discharges occurring on or after 
October 1, 2008, as if such paragraph had never been 
in effect. 
(2) NO EFFECT ON SUBSEQUENT YEARS.—Noth-
ing in paragraph (1) shall be construed as having 
any effect on the application of paragraph (d) of sec-
tion 412.322 of title 42, Code of Federal Regulations. 
(c) FUNDING FOR IMPLEMENTATION.—In addition to 
funds otherwise available, for purposes of implementing the 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00324
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
325 
provisions of subsections (a) and (b), including costs in-
curred in reprocessing claims in carrying out such provi-
sions, the Secretary of Health and Human Services shall 
provide for the transfer from the Federal Hospital Insur-
ance Trust Fund established under section 1817 of the So-
cial Security Act (42 U.S.C. 1395i) to the Centers for Medi-
care & Medicaid Services Program Management Account 
of $2,000,000 for fiscal year 2009. 
SEC. 4502. LONG-TERM CARE HOSPITAL TECHNICAL COR-
RECTIONS. 
(a) PAYMENT.—Subsection (c) of section 114 of the 
Medicare, Medicaid, and SCHIP Extension Act of 2007 
(Public Law 110–173) is amended— 
(1) in paragraph (1)— 
(A) by amending the heading to read as fol-
lows: ‘‘DELAY IN APPLICATION OF 25 PERCENT 
PATIENT THRESHOLD PAYMENT ADJUSTMENT’’; 
(B) by striking ‘‘the date of the enactment 
of this Act’’ and inserting ‘‘July 1, 2007,’’; and 
(C) in subparagraph (A), by inserting ‘‘or 
to a long-term care hospital, or satellite facility, 
that as of December 29, 2007, was co-located 
with an entity that is a provider-based, off-cam-
pus location of a subsection (d) hospital which 
did not provide services payable under section 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00325
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
326 
1886(d) of the Social Security Act at the off- 
campus location’’ after ‘‘freestanding long-term 
care hospitals’’; and 
(2) in paragraph (2)— 
(A) in subparagraph (B)(ii), by inserting 
‘‘or that is described in section 412.22(h)(3)(i) of 
such title’’ before the period; and 
(B) in subparagraph (C), by striking ‘‘the 
date of the enactment of this Act’’ and inserting 
‘‘October 1, 2007 (or July 1, 2007, in the case 
of a satellite facility described in section 
412.22(h)(3)(i) of title 42, Code of Federal Regu-
lations)’’. 
(b) MORATORIUM.—Subsection (d)(3)(A) of such sec-
tion is amended by striking ‘‘if the hospital or facility’’ and 
inserting ‘‘if the hospital or facility obtained a certificate 
of need for an increase in beds that is in a State for which 
such certificate of need is required and that was issued on 
or after April 1, 2005, and before December 29, 2007, or 
if the hospital or facility’’. 
(c) EFFECTIVE DATE.—The amendments made by this 
section shall be effective and apply as if included in the 
enactment of the Medicare, Medicaid, and SCHIP Exten-
sion Act of 2007 (Public Law 110–173). 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00326
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00327
Fmt 6652
Sfmt 6203
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS
Union Calendar No. 2 
111TH CONGRESS 
1ST SESSION 
H. R. 598 
[Report No. 111–8, Part I] 
A BILL 
To provide for a portion of the economic recovery 
package relating to revenue measures, unemploy-
ment, and health. 
JANUARY 27, 2009 
Reported from the Committee on Ways and Means with 
an amendment 
JANUARY 27, 2009 
Committees on Energy and Commerce, Science and Tech-
nology, Education and Labor, and Financial Services 
discharged; committed to the Committee of the Whole 
House on the State of the Union and ordered to be 
printed 
VerDate Nov 24 2008 
03:18 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00328
Fmt 6651
Sfmt 6651
E:\BILLS\H598.RH
H598
SMARTINEZ on PROD1PC64 with BILLS