SEC. 312. RESTRICTIONS ON CERTAIN DISCLOSURES OF 
HEALTH 
INFORMATION; 
ACCOUNTING 
OF 
CERTAIN PROTECTED HEALTH INFORMATION 
DISCLOSURES. 
(a) REQUESTED RESTRICTIONS ON CERTAIN DIS-
CLOSURES OF HEALTH INFORMATION.—In the case that 
an individual requests under paragraph (a)(1)(i)(A) of 
section 164.522 of title 45, Code of Federal Regulations, 
that a covered entity restrict the disclosure of the pro-
tected health information of the individual, notwith-
standing paragraph (a)(1)(ii) of such section, the covered 
entity must comply with the requested restriction if— 
(1) except as otherwise required by law, the dis-
closure is to a health plan for purposes of carrying 
out payment or health care operations (and is not 
for purposes of carrying out treatment); and 
(2) the protected health information pertains 
solely to a health care item or service for which the 
health care provider involved has been paid out of 
pocket in full. 
(b) DISCLOSURES REQUIRED TO BE LIMITED TO 
THE
LIMITED
DATA
SET
OR
THE
MINIMUM
NEC-
ESSARY.— 
(1) IN
GENERAL.—A covered entity shall be 
treated as being in compliance with section 
164.502(b)(1) of title 45, Code of Federal Regula-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
tions, with respect to the use, disclosure, or request 
of protected health information described in such 
section, only if the covered entity makes reasonable 
efforts to limit such protected health information to 
the limited data set (as defined in section 
164.514(e)(2) of such title) or, if needed by such en-
tity, to the minimum necessary to accomplish the in-
tended purpose of such use, disclosure, or request, 
respectively. 
(2) APPLICATION OF EXCEPTIONS.—The excep-
tions described in section 164.502(b)(2) of title 45, 
Code of Federal Regulations, shall apply to the re-
quirement under paragraph (1) as of the effective 
date described in section 322 in the same manner 
that such exceptions apply to section 164.502(b)(1) 
of such title before such date. 
(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH 
INFORMATION DISCLOSURES REQUIRED IF COVERED EN-
TITY USES ELECTRONIC MEDICAL RECORD.— 
(1) IN GENERAL.—In the case that a covered 
entity uses or maintains an electronic medical record 
with respect to protected health information, the ex-
ception under section 164.528(a)(1)(i) of title 45, 
Code of Federal Regulations, shall not apply to dis-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
closures (other than oral disclosures) made by such 
entity of such information. 
(2) ELECTRONIC MEDICAL RECORD DEFINED.— 
For purposes of paragraph (1), the term ‘‘electronic 
medical record’’ means an electronic record of indi-
vidually identifiable health information on an indi-
vidual that is created, gathered, managed, and con-
sulted by authorized clinicians and staff within a 
single organization. 
(3) EFFECTIVE DATE.—The provisions of this 
subsection shall apply to disclosures made by a cov-
ered entity on or after the date specified under sec-
tion 322. 
(d) APPLICATION OF CONSENT REQUIREMENTS FOR 
CERTAIN USES AND DISCLOSURES BY HEALTH CARE 
PROVIDERS WITH ELECTRONIC MEDICAL RECORDS.— 
(1) IN GENERAL.—In applying section 164.506 
of title 45, Code of Federal Regulations, in the case 
of a covered entity that is a health care provider, 
with respect to protected health information of an 
individual that is used or maintained by such entity 
in an electronic medical record (as defined in sub-
section (c)(2)), such covered entity may not use or 
disclose such protected health information for pur-
poses of health care operations unless the covered 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
entity obtains the consent of the individual to dis-
close such information for such purposes and any 
such consent shall be revocable by the individual at 
any time. 
(2) EFFECTIVE DATE.—The provisions of this 
subsection shall apply to disclosures made by a cov-
ered entity on or after the date specified under sec-
tion 322. 
SEC. 313. CONDITIONS ON CERTAIN CONTACTS AS PART OF 
HEALTH CARE OPERATIONS. 
(a) IN GENERAL.—A communication by a covered en-
tity or business associate that is about a product or service 
and that encourages recipients of the communication to 
purchase or use the product or service shall not be consid-
ered a health care operation for purposes of subpart E 
of part 164 of title 45, Code of Federal Regulations, un-
less the communication is made as described in subpara-
graph (i), (ii), or (iii) of paragraph (1) of the definition 
of marketing in section 164.501 of such title. A covered 
entity or business associate may not receive direct pay-
ment for any such communication made as described in 
such subparagraph (i), (ii), or (iii). 
(b) EFFECTIVE DATE.—Subsection (a) shall apply to 
contracting occurring on or after the effective date speci-
fied under section 322. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
SEC. 314. STUDY ON APPLICATION OF PRIVACY AND SECU-
RITY REQUIREMENTS TO VENDORS OF PER-
SONAL HEALTH RECORDS. 
Not later than one year after the date of the enact-
ment of this Act, the Secretary , in consultation with the 
Federal Trade Commission, shall submit to Congress rec-
ommendations— 
(1) to identify requirements relating to security, 
privacy, and notification in the case of a breach of 
security or privacy (including the applicability of an 
exemption to notification in the case of protected 
health information which has been rendered indeci-
pherable through the use of encryption or alternative 
technologies) that should be applied to vendors of 
personal health records and to third party service 
providers that such vendors make available to indi-
viduals with personal health records offered or main-
tained by such vendor, with respect to information 
in such a record so offered or maintained; and 
(2) to determine which Federal government 
agency is best equipped to enforce such requirements 
recommended to be applied to such vendors of per-
sonal health records and such third party service 
providers. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
SEC. 315. TEMPORARY BREACH NOTIFICATION REQUIRE-
MENT FOR VENDORS OF PERSONAL HEALTH 
RECORDS. 
(a) IN GENERAL.—In accordance with subsection (c), 
each vendor of personal health records shall, following the 
discovery of a breach of security of unencrypted individ-
ually identifiable health information in such records main-
tained or offered by such vendor— 
(1) notify each individual who is a citizen or 
resident of the United States whose unencrypted in-
dividually identifiable health information was ac-
quired by an unauthorized person as a result of such 
a breach of security; and 
(2) notify the Federal Trade Commission. 
(b) NOTIFICATION
OF
VENDORS
OF
PERSONAL 
HEALTH RECORDS
BY THIRD PARTY SERVICE PRO-
VIDERS.—A third party service provider that is made 
available by a vendor of personal health records to individ-
uals with such records maintained or offered by such ven-
dor and that accesses, maintains, retains, modifies, 
records, stores, destroys, or otherwise holds, uses, or dis-
closes unencrypted individually identifiable health infor-
mation in such records shall, following the discovery of 
a breach of security of such information, notify such ven-
dor of such breach. Such notice shall include the identi-
fication of each individual whose unencrypted individually 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
identifiable health information has been, or is reasonably 
believed to have been, accessed or acquired during such 
breach. 
(c) APPLICATION OF REQUIREMENTS FOR TIMELI-
NESS, METHOD, AND CONTENT
OF NOTIFICATIONS.— 
Subsections (c), (d), (e), and (f) of section 302 shall apply 
to a notification required under subsection (a) and a ven-
dor of personal health records and a third party service 
provider described in subsection (b), with respect to a 
breach of security under subsection (a) of unencrypted in-
dividually identifiable health information in such records 
maintained or offered by such vendor, in the same manner 
that such subsections apply to a notification required 
under such section and a covered entity and a business 
associate of such covered entity, with respect to a breach 
under such section of unencrypted protected health infor-
mation held, used, or disclosed by such covered entity. 
(d) NOTIFICATION OF THE SECRETARY.—Upon re-
ceipt of a notification of a breach of security under sub-
section (a)(2), the Federal Trade Commission shall notify 
the Secretary of such breach. 
(e) ENFORCEMENT.—A violation of subsection (a) or 
(b) shall be treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
57a(a)(1)(B)) regarding unfair or deceptive acts or prac-
tices. 
(f) DEFINITIONS.—For purposes of this section: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means, with respect to unencrypted in-
dividually identifiable health information of an indi-
vidual in a personal health record, acquisition of 
such information without the authorization of the in-
dividual. 
(2) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘‘individually identifiable 
health information’’ has the meaning given such 
term in section 1171(6) of the Social Security Act 
(42 U.S.C. 1320d(6)). 
(3) UNENCRYPTED
INDIVIDUALLY
IDENTIFI-
ABLE
HEALTH
INFORMATION.—The 
term 
‘‘unencrypted individually identifiable health infor-
mation’’ means individually identifiable health infor-
mation that is not protected— 
(A) through the use of encryption; or 
(B) through the use of a technology speci-
fied by the Secretary as being at least as effec-
tive as encryption for purposes of rendering in-
dividually identifiable health information indeci-
pherable without authorization. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(g) EFFECTIVE DATE.—The provisions of this sec-
tion shall apply to breaches of security occurring during 
the 2-year period beginning on the date of the enactment 
of this Act. 
SEC. 316. BUSINESS ASSOCIATE CONTRACTS REQUIRED 
FOR CERTAIN ENTITIES. 
Each organization, with respect to a covered entity, 
that provides data transmission of protected health infor-
mation to such entity and that requires access on a routine 
basis to such protected health information, such as a 
Health Information Exchange, Regional Health Informa-
tion Organization, or E-prescribing Gateway, is required 
to enter into a written contract (or other written arrange-
ment) described in section 164.502(e)(2) of title 45, Code 
of Federal Regulations, with such entity and shall be 
treated as a business associate of the covered entity for 
purposes of section 311. 
SEC. 317. GUIDANCE ON IMPLEMENTATION SPECIFICATION 
TO DE-IDENTIFY PROTECTED HEALTH INFOR-
MATION. 
Not later than 12 months after the date of the enact-
ment of this Act, the Secretary shall, in consultation with 
stakeholders, issue guidance on how best to implement the 
requirements for the de-identification of protected health 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
information under section 164.514(b) of title 45, Code of 
Federal Regulations. 
SEC. 318. GAO REPORT ON TREATMENT DISCLOSURES. 
Not later than one year after the date of the enact-
ment of this Act, the Comptroller General of the United 
States shall submit to Congress a report on the best prac-
tices related to the disclosure among health care providers 
of protected health information of an individual for pur-
poses of treatment of such individual. Such report shall 
include an examination of the best practices implemented 
by States and by other entities, such as health information 
exchanges and regional health information organizations, 
including an examination of the extent to which such best 
practices are successful with respect to the quality of the 
resulting health care provided to the individual and with 
respect to the ability of the health care provider to manage 
such best practices. 
SEC. 319. CLARIFICATION OF APPLICATION OF WRONGFUL 
DISCLOSURES CRIMINAL PENALTIES. 
Section 1177(a) of the Social Security Act (42 U.S.C. 
1320d–6(a)) is amended by adding at the end the fol-
lowing new sentence: ‘‘For purposes of the previous sen-
tence, a person (including an employee or other individual) 
shall be considered to have obtained or disclosed individ-
ually identifiable health information in violation of this 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
part if the information is maintained by a covered entity 
(as defined in the HIPAA privacy regulation described in 
section 1180(b)(3)) and the individual obtained or dis-
closed such information without authorization.’’. 
Subtitle C—Relationship to Other 
Laws; Clarification; Effective Date 
SEC. 321. RELATIONSHIP TO OTHER LAWS. 
(a) APPLICATION OF HIPAA STATE PREEMPTION.— 
Section 1178 of the Social Security Act (42 U.S.C. 
1320d–7) shall apply to a provision or requirement under 
this title in the same manner that such section applies 
to a provision or requirement under part C of title XI of 
such Act or a standard or implementation specification 
adopted or established under sections 1172 through 1174 
of such Act. 
(b) HEALTH INSURANCE PORTABILITY
AND AC-
COUNTABILITY ACT.—The standards governing the pri-
vacy and security of individually identifiable health infor-
mation promulgated by the Secretary under sections 
262(a) and 264 of the Health Insurance Portability and 
Accountability Act of 1996 shall remain in effect to the 
extent that they are consistent with this title. The Sec-
retary shall by rule amend such Federal regulations as re-
quired to make such regulations consistent with this title. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
SEC. 322. EFFECTIVE DATE. 
The provisions of this title (other than sections 
301(c), 303, 314, 315, 317, 318, and 319) shall take ef-
fect on the date that is 12 months after the date of the 
enactment of this Act. 
Æ 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6301
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS