I 
110TH CONGRESS 
2D SESSION 
H. R. 6898 
To promote the adoption and meaningful use of health information technology, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 15, 2008 
Mr. STARK (for himself, Ms. SCHWARTZ, Mr. MCDERMOTT, Mr. MCNULTY, 
Mr. LEVIN, Mr. EMANUEL, Mr. NEAL of Massachusetts, Mr. PASCRELL, 
and Mr. LEWIS of Georgia) introduced the following bill; which was re-
ferred to the Committee on Energy and Commerce, and in addition to 
the Committees on Ways and Means and Science and Technology, for a 
period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To promote the adoption and meaningful use of health 
information technology, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Health-e Information Technology Act of 2008’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
Sec. 1. Short title; table of contents. 
TITLE I—PROMOTION OF HEALTH INFORMATION TECHNOLOGY 
Subtitle A—Improving Health Care Quality, Safety, and Efficiency 
Sec. 101. ONCHIT; standards development and adoption; health information 
technology resource center. 
‘‘TITLE XXX—HEALTH INFORMATION TECHNOLOGY AND 
QUALITY 
‘‘Sec. 3000. Definitions. 
‘‘Subtitle A—Promotion of Health Information Technology 
‘‘Sec. 3001. Office of the National Coordinator for Health Information 
Technology. 
‘‘Sec. 3002. HIT Advisory Committee. 
‘‘Sec. 3003. Process for adoption of recommended standards and guidance. 
‘‘Sec. 3004. Application and use of adopted standards by Federal agencies. 
‘‘Sec. 3005. Voluntary application and use of adopted standards by private 
entities. 
‘‘Sec. 3006. Health Information Technology Resource Center. 
Sec. 102. Transitions. 
Subtitle B—Application and Use of Adopted Health Information Technology 
Standards; Reports 
Sec. 111. Coordination of Federal activities with adopted standards. 
Sec. 112. Application to private entities. 
Sec. 113. Annual reports. 
TITLE II—TESTING OF HEALTH INFORMATION TECHNOLOGY 
Sec. 201. National Institute for Standards and Technology testing. 
TITLE III—INCENTIVES FOR ADOPTION OF HEALTH 
INFORMATION TECHNOLOGY 
Subtitle A—Medicare Program 
Sec. 301. Incentives for eligible professionals. 
Sec. 302. Incentives for hospitals. 
Sec. 303. Incentives for certain Medicare Advantage plans. 
Subtitle B—Other Incentives for the Implementation and Use of Health 
Information Technology 
Sec. 311. Grant, loan, and demonstration programs. 
‘‘Subtitle B—Incentives for the Use of Health Information Technology 
‘‘Sec. 3011. Grants and loans to facilitate the widespread adoption of 
qualified health information technology. 
‘‘Sec. 3012. Demonstration program to integrate information technology 
into clinical education. 
TITLE IV—PRIVACY AND SECURITY PROVISIONS 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
Sec. 400. Definitions. 
Subtitle A—Improved Privacy Provisions and Security Provisions 
Sec. 401. Application of security provisions and penalties to business associates 
of covered entities; annual guidance on privacy and security 
provisions. 
Sec. 402. Notification in the case of breach. 
Sec. 403. Education on health information privacy and report on compliance. 
Sec. 404. Application of penalties to business associates of covered entities for 
violations of privacy contract requirements. 
Sec. 405. Restrictions on certain uses and disclosures and sales of health infor-
mation; accounting of certain protected health information dis-
closures; access to certain information in electronic format. 
Sec. 406. Limitations on certain activities as part of health care operations. 
Sec. 407. Study and report on application of privacy and security requirements 
to non-HIPAA covered entities. 
Sec. 408. Temporary breach notification requirement for vendors of personal 
health records and other non-HIPAA covered entities. 
Sec. 409. Business associate contracts required for certain entities; other provi-
sions related to business associate contracts. 
Sec. 410. Guidance on implementation specification to de-identify protected 
health information. 
Sec. 411. GAO report on treatment, payment, and health care operations uses 
and disclosures. 
Sec. 412. Clarification of application of wrongful disclosures criminal penalties. 
Sec. 413. Improved enforcement. 
Sec. 414. Audits. 
Sec. 415. Technical amendment. 
Subtitle B—Chief Privacy Officer of ONCHIT; Standards and Guidance 
Recommendations Related to Privacy and Security 
Sec. 421. Chief Privacy Officer of the Office of the National Coordinator . 
Sec. 422. Additional standards and guidance recommendations related to pri-
vacy and security. 
Subtitle C—Relationship to Other Laws; Regulatory References; Effective 
Date 
Sec. 431. Relationship to other laws. 
Sec. 432. Regulatory references. 
Sec. 433. Effective date. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6211
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
TITLE 
I—PROMOTION 
OF 
HEALTH INFORMATION TECH-
NOLOGY 
Subtitle A—Improving Health Care 
Quality, Safety, and Efficiency 
SEC. 101. ONCHIT; STANDARDS DEVELOPMENT AND ADOP-
TION; HEALTH INFORMATION TECHNOLOGY 
RESOURCE CENTER. 
(a) IN GENERAL.—The Public Health Service Act 
(42 U.S.C. 201 et seq.) is amended by adding at the end 
the following: 
‘‘TITLE XXX—HEALTH INFORMA-
TION 
TECHNOLOGY 
AND 
QUALITY 
‘‘SEC. 3000. DEFINITIONS. 
‘‘In this title: 
‘‘(1) ELECTRONIC HEALTH RECORD.—The term 
‘electronic health record’ means an electronic record 
of health-related information on an individual that is 
created, managed, and consulted by authorized 
health care clinicians and staff of one or more orga-
nizations, that conforms to standards adopted under 
section 3003(a), and is made accessible electronically 
to other health care organizations and other author-
ized users. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
‘‘(2) HEALTH
CARE
PROVIDER.—The term 
‘health care provider’ means a hospital, skilled nurs-
ing facility, nursing facility, home health entity, 
health care clinic, Federally qualified health center, 
group practice (as defined in section 1877(h)(4) of 
the Social Security Act), a pharmacist, a pharmacy, 
a laboratory, a physician (as defined in section 
1861(r)) of the Social Security Act), a practitioner 
(as described in section 1842(b)(18)(C) of the Social 
Security Act), a provider operated by, or under con-
tract with, the Indian Health Service or by an In-
dian tribe (as defined in the Indian Self-Determina-
tion and Education Assistance Act), tribal organiza-
tion, or urban Indian organization (as defined in 
section 4 of the Indian Health Care Improvement 
Act), a rural health clinic, and any other category of 
facility or clinician determined appropriate by the 
Secretary. 
‘‘(3) HEALTH INFORMATION.—The term ‘health 
information’ has the meaning given such term in 
section 1171(4) of the Social Security Act. 
‘‘(4) HEALTH
INFORMATION
TECHNOLOGY.— 
The term ‘health information technology’ means 
hardware, software, integrated technologies and re-
lated licenses, intellectual property, upgrades, and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
packaged solutions sold as services that are specifi-
cally designed for use by health care entities for the 
electronic creation, maintenance, or exchange of 
health information. 
‘‘(5) HEALTH PLAN.—The term ‘health plan’ 
has the meaning given such term in section 1171(5) 
of the Social Security Act. 
‘‘(6) HIT ADVISORY
COMMITTEE.—The term 
‘HIT Advisory Committee’ means such Committee 
established under section 3002(a). 
‘‘(7) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘individually identifiable 
health information’ has the meaning given such term 
in section 1171(6) of the Social Security Act. 
‘‘(8) LABORATORY.—The term ‘laboratory’ has 
the meaning given such term in section 353(a). 
‘‘(9) NATIONAL COORDINATOR.—The term ‘Na-
tional Coordinator’ means the head of the Office of 
the National Coordinator for Health Information 
Technology established under section 3001(a). 
‘‘(10) PHARMACIST.—The term ‘pharmacist’ 
has the meaning given such term in section 804(2) 
of the Federal Food, Drug, and Cosmetic Act. 
‘‘(11) STATE.—The term ‘State’ means each of 
the several States, the District of Columbia, Puerto 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
Rico, the Virgin Islands, Guam, American Samoa, 
and the Northern Mariana Islands. 
‘‘Subtitle A—Promotion of Health 
Information Technology 
‘‘SEC. 3001. OFFICE OF THE NATIONAL COORDINATOR FOR 
HEALTH INFORMATION TECHNOLOGY. 
‘‘(a) ESTABLISHMENT.—There is established within 
the Department of Health and Human Services an Office 
of the National Coordinator for Health Information Tech-
nology (referred to in this section as the ‘Office’). The Of-
fice shall be headed by a National Coordinator who shall 
be appointed by the Secretary and shall report directly to 
the Secretary. 
‘‘(b) PURPOSE.—The National Coordinator shall per-
form the duties under subsection (c) in a manner con-
sistent with the development of a nationwide health infor-
mation technology infrastructure that allows for the elec-
tronic use and exchange of information and that— 
‘‘(1) ensures that each patient’s health informa-
tion is secure and protected, in accordance with ap-
plicable law; 
‘‘(2) improves health care quality, reduces med-
ical errors, and advances the delivery of patient-cen-
tered medical care; 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
‘‘(3) reduces health care costs resulting from 
inefficiency, medical errors, inappropriate care, du-
plicative care, and incomplete information; 
‘‘(4) ensures that appropriate information to 
help guide medical decisions is available at the time 
and place of care; 
‘‘(5) ensures the inclusion of meaningful public 
input in such development of such infrastructure; 
‘‘(6) improves the coordination of care and in-
formation among hospitals, laboratories, physician 
offices, and other entities through an effective infra-
structure for the secure and authorized exchange of 
health care information; 
‘‘(7) improves public health reporting and facili-
tates the early identification and rapid response to 
public health threats and emergencies, including bio-
terror events and infectious disease outbreaks; 
‘‘(8) facilitates health and clinical research and 
health care quality; 
‘‘(9) promotes prevention of chronic diseases; 
‘‘(10) promotes a more effective marketplace, 
greater competition, greater systems analysis, in-
creased consumer choice, and improved outcomes in 
health care services; and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
‘‘(11) improves efforts to reduce health dispari-
ties. 
‘‘(c) DUTIES OF THE NATIONAL COORDINATOR.— 
‘‘(1) HIT POLICY
COORDINATION.—The Na-
tional Coordinator shall coordinate health informa-
tion technology policy and programs within the De-
partment and with those of other relevant executive 
branch agencies with a goal of avoiding duplication 
of efforts and of helping to ensure that each agency 
undertakes health information technology activities 
primarily within the areas of its greatest expertise 
and technical capability. 
‘‘(2) STANDARDS, GUIDANCE.— 
‘‘(A) DEVELOPMENT
AND
RECOMMENDA-
TIONS OF STANDARDS AND GUIDANCE.— 
‘‘(i) IN GENERAL.— 
‘‘(I) 
INITIAL
IMPLEMENTA-
TION.—The 
National 
Coordinator 
shall, in consultation with the HIT 
Advisory Committee under section 
3002 and consistent with the imple-
mentation of the strategic plan under 
paragraph (6), develop and rec-
ommend to the Secretary standards 
and guidance (which may include best 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
practices), as applicable, for each of 
the categories described in clauses 
(iii), (iv), and (v). In accordance with 
the previous sentence, the National 
Coordinator shall ensure that an ini-
tial set of appropriate standards is de-
veloped and recommended to the Sec-
retary under this subclause by such 
time as to enable the Secretary to 
adopt such an initial set in accordance 
with section 3003(b). 
‘‘(II) BIENNIAL UPDATING.—Bi-
ennially thereafter the National Coor-
dinator, in consultation with the HIT 
Advisory Committee, shall update 
such recommendations and make new 
recommendations as appropriate, in-
cluding in response to a notification 
sent under section 3003(a)(2). 
‘‘(ii) COORDINATION
AMONG
CAT-
EGORIES.—The National Coordinator shall 
coordinate the development, recommenda-
tions, and updating among the categories 
so described to take into account the inter-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
dependence of standards and guidance 
among such categories. 
‘‘(iii) TECHNICAL INTEROPERABILITY 
CATEGORY.— 
‘‘(I) IN GENERAL.—The category 
described in this clause is the category 
for technical interoperability to pro-
vide for the electronic exchange and 
use of health information. 
‘‘(II) 
APPLICATION
TO
DIF-
FERENT
LEVELS
OF
INTEROPER-
ABILITY.—In developing recommenda-
tions respecting the category de-
scribed in this clause, the National 
Coordinator shall initially use the dif-
ferent levels of interoperability (as de-
scribed on pages 6 though 8 of GAO 
report 
08–954 
titled 
‘Electronic 
Health Records: DOD and VA Have 
Increased Sharing of Health Informa-
tion, but More Work Remains’ and 
provide for the development and rec-
ommendations of different standards 
and guidance for each of such dif-
ferent levels. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
‘‘(iv) PRIVACY
AND
SECURITY
CAT-
EGORY.—The category described in this 
clause is the category for privacy and secu-
rity to ensure the secure exchange of pro-
tected health information, in accordance 
with title IV of the Health-e Information 
Technology Act of 2008 including the 
amendments made by such title. 
‘‘(v) CLINICAL
AND
QUALITY
CAT-
EGORY.— 
‘‘(I) IN GENERAL.—The category 
described in this clause is the category 
for clinical and quality functionalities 
of health information technology and 
strategies to enhance the use of such 
technology including for the following 
purposes: 
‘‘(aa) To improve the quality 
of health care, such as through 
the reduction of medical errors, 
using electronic provider order 
entry and clinical decision sup-
port systems. 
‘‘(bb) To facilitate patient- 
centered care, such as through 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
improved patient-provider com-
munication through secure elec-
tronic messaging, and improved 
patient support. 
‘‘(cc) To reduce health dis-
parities. 
‘‘(dd) To improve population 
health, such as through the use 
of registries and automated qual-
ity reporting and performance 
measures. 
‘‘(ee) To improve the con-
tinuity of care among health care 
settings. 
‘‘(II) REQUIREMENTS.—In devel-
oping recommendations respecting the 
category described in this clause, the 
National Coordinator shall ensure the 
following: 
‘‘(aa) Information is col-
lected and transmitted in a man-
ner that is reliable, accurate, and 
unambiguous and based on a uni-
form provider data set, including 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
a set of comprehensive data ele-
ments. 
‘‘(bb) Information is com-
municated in a manner to pro-
mote coordination of health care, 
applying appropriate data fil-
tering for the situation. 
‘‘(cc) Practices optimize for 
continuous 
improvement, 
ad-
vancement of research and edu-
cation, and population disease 
management. 
‘‘(dd) 
Sensitive 
protected 
health information may be seg-
mented, with the goal of mini-
mizing the reluctance of patients 
to seek care (or disclose informa-
tion about a condition) because 
of privacy concerns involving sen-
sitive protected health informa-
tion, while maximizing patient 
safety and clinical utility of the 
information. 
‘‘(B) INCORPORATION OF CURRENT CCHIT 
CERTIFICATION
CRITERIA.—In developing and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
recommending standards and guidance under 
subparagraph (A), the National Coordinator 
shall, to the maximum extent appropriate, in-
corporate 
the 
ambulatory 
and 
inpatient 
functionality certification criteria that have 
been adopted by the Certification Commission 
for Health Information Technology as of the 
date of the enactment of this title. Nothing in 
this paragraph shall be construed as preventing 
the National Coordinator from incorporating 
into such recommendations such certification 
criteria as such Commission is in the process of 
adopting as of such date. 
‘‘(C) PROVIDER AND SETTING SPECIFIC.— 
Recommendations made under subparagraph 
(A) may be established in a provider-specific 
and setting-specific manner and in a manner 
such that they apply to a broad variety of pro-
viders, including physicians, hospitals, and 
other health care providers and to a broad vari-
ety of settings, including for health information 
technology systems that are hospital-based and 
for such systems that are office-based. 
‘‘(D) PILOT TESTING OF STANDARDS AND 
IMPLEMENTATION SPECIFICATIONS.—In the de-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
of such National Coordinator as of the date of the enact-
ment of this Act. 
(b) AHIC.—To the extent consistent with section 
3002 of the Public Health Service Act, as added by section 
101, all functions, personnel, assets, and liabilities applica-
ble to the American Health Information Community cre-
ated in response to Executive Order 13335 as of the day 
before the date of the enactment of this Act shall be trans-
ferred to the HIT Advisory Committee, established under 
section 3002(a)of such Act, as appropriate, as of the date 
of the enactment of this Act. 
(c) RULES OF CONSTRUCTION.— 
(1) ONCHIT.—Nothing in section 3001 of the 
Public Health Service Act, as added by section 101, 
or subsection (a) shall be construed as requiring the 
creation of a new entity to the extent that the Office 
of the National Coordinator for Health Information 
Technology established pursuant to Executive Order 
13335 is consistent with the provisions of such sec-
tion 3001. 
(2) AHIC.—Nothing in section 3002 of the 
Public Health Service Act, as added by section 101, 
or subsection (b) shall be construed as requiring the 
creation of a new entity to the extent that the Amer-
ican Health Information Community created in re-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS