539 
cluding a phone number, email address, or any 
other form of appropriate communication) that 
precludes direct written (or, if specified by the 
individual under subparagraph (A), electronic) 
notification to the individual, a substitute form 
of notice shall be provided, including, in the 
case that there are 10 or more individuals for 
which there is insufficient or out-of-date contact 
information, a conspicuous posting for a period 
determined by the Secretary on the home page 
of the Web site of the covered entity involved or 
notice in major print or broadcast media, in-
cluding major media in geographic areas where 
the individuals affected by the breach likely re-
side. Such a notice in media or web posting will 
include a toll-free phone number where an indi-
vidual can learn whether or not the individual’s 
unsecured protected health information is pos-
sibly included in the breach. 
(C) In any case deemed by the covered en-
tity involved to require urgency because of pos-
sible imminent misuse of unsecured protected 
health information, the covered entity, in addi-
tion to notice provided under subparagraph (A), 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00539
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
540 
may provide information to individuals by tele-
phone or other means, as appropriate. 
(2) MEDIA NOTICE.—Notice shall be provided 
to prominent media outlets serving a State or juris-
diction, following the discovery of a breach described 
in subsection (a), if the unsecured protected health 
information of more than 500 residents of such 
State or jurisdiction is, or is reasonably believed to 
have been, accessed, acquired, or disclosed during 
such breach. 
(3) NOTICE TO SECRETARY.—Notice shall be 
provided to the Secretary by covered entities of un-
secured protected health information that has been 
acquired or disclosed in a breach. If the breach was 
with respect to 500 or more individuals than such 
notice must be provided immediately. If the breach 
was with respect to less than 500 individuals, the 
covered entity involved may maintain a log of any 
such breach occurring and annually submit such a 
log to the Secretary documenting such breaches oc-
curring during the year involved. 
(4) POSTING ON HHS PUBLIC WEBSITE.—The 
Secretary shall make available to the public on the 
Internet website of the Department of Health and 
Human Services a list that identifies each covered 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00540
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
541 
entity involved in a breach described in subsection 
(a) in which the unsecured protected health informa-
tion of more than 500 individuals is acquired or dis-
closed. 
(f) CONTENT OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a breach shall include, to the extent 
possible, the following: 
(1) A brief description of what happened, in-
cluding the date of the breach and the date of the 
discovery of the breach, if known. 
(2) A description of the types of unsecured pro-
tected health information that were involved in the 
breach (such as full name, Social Security number, 
date of birth, home address, account number, or dis-
ability code). 
(3) The steps individuals should take to protect 
themselves from potential harm resulting from the 
breach. 
(4) A brief description of what the covered enti-
ty involved is doing to investigate the breach, to 
mitigate losses, and to protect against any further 
breaches. 
(5) Contact procedures for individuals to ask 
questions or learn additional information, which 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00541
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
542 
shall include a toll-free telephone number, an e-mail 
address, Web site, or postal address. 
(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.—If a law enforcement official 
determines that a notification, notice, or posting required 
under this section would impede a criminal investigation 
or cause damage to national security, such notification, 
notice, or posting shall be delayed in the same manner 
as provided under section 164.528(a)(2) of title 45, Code 
of Federal Regulations, in the case of a disclosure covered 
under such section. 
(h) UNSECURED PROTECTED HEALTH INFORMA-
TION.— 
(1) DEFINITION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), for purposes of this section, the 
term ‘‘unsecured protected health information’’ 
means protected health information that is not 
secured through the use of a technology or 
methodology specified by the Secretary in the 
guidance issued under paragraph (2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under paragraph 
(2) by the date specified in such paragraph, for 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00542
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
543 
purposes of this section, the term ‘‘unsecured 
protected health information’’ shall mean pro-
tected health information that is not secured by 
a technology standard that renders protected 
health information unusable, unreadable, or in-
decipherable to unauthorized individuals and is 
developed or endorsed by a standards devel-
oping organization that is accredited by the 
American National Standards Institute. 
(2) GUIDANCE.—For purposes of paragraph (1) 
and section 407(f)(3), not later than the date that 
is 60 days after the date of the enactment of this 
Act, the Secretary shall, after consultation with 
stakeholders, issue (and annually update) guidance 
specifying the technologies and methodologies that 
render 
protected 
health 
information 
unusable, 
unreadable, or indecipherable to unauthorized indi-
viduals, including use of standards developed under 
section 3002(b)(2)(B)(vi) of the Public Health Serv-
ice Act, as added by section 4101. 
(i) REPORT TO CONGRESS ON BREACHES.— 
(1) IN GENERAL.—Not later than 12 months 
after the date of the enactment of this Act and an-
nually thereafter, the Secretary shall prepare and 
submit to the Committee on Finance and the Com-
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00543
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
544 
mittee on Health, Education, Labor, and Pensions 
of the Senate and the Committee on Ways and 
Means and the Committee on Energy and Commerce 
of the House of Representatives a report containing 
the information described in paragraph (2) regard-
ing breaches for which notice was provided to the 
Secretary under subsection (e)(3). 
(2) INFORMATION.—The information described 
in this paragraph regarding breaches specified in 
paragraph (1) shall include— 
(A) the number and nature of such 
breaches; and 
(B) actions taken in response to such 
breaches. 
(j) REGULATIONS; EFFECTIVE DATE.—To carry out 
this section, the Secretary of Health and Human Services 
shall promulgate interim final regulations by not later 
than the date that is 180 days after the date of the enact-
ment of this title. The provisions of this section shall apply 
to breaches that are discovered on or after the date that 
is 30 days after the date of publication of such interim 
final regulations. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00544
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
545 
SEC. 4403. EDUCATION ON HEALTH INFORMATION PRI-
VACY. 
(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not 
later than 6 months after the date of the enactment of 
this Act, the Secretary shall designate an individual in 
each regional office of the Department of Health and 
Human Services to offer guidance and education to cov-
ered entities, business associates, and individuals on their 
rights and responsibilities related to Federal privacy and 
security requirements for protected health information. 
(b) EDUCATION INITIATIVE ON USES OF HEALTH IN-
FORMATION.—Not later than 12 months after the date of 
the enactment of this Act, the Office for Civil Rights with-
in the Department of Health and Human Services shall 
develop and maintain a multi-faceted national education 
initiative to enhance public transparency regarding the 
uses of protected health information, including programs 
to educate individuals about the potential uses of their 
protected health information, the effects of such uses, and 
the rights of individuals with respect to such uses. Such 
programs shall be conducted in a variety of languages and 
present information in a clear and understandable man-
ner. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00545
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
546 
SEC. 4404. APPLICATION OF PRIVACY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES. 
(a) APPLICATION OF CONTRACT REQUIREMENTS.— 
In the case of a business associate of a covered entity that 
obtains or creates protected health information pursuant 
to a written contract (or other written arrangement) de-
scribed in section 164.502(e)(2) of title 45, Code of Fed-
eral Regulations, with such covered entity, the business 
associate may use and disclose such protected health infor-
mation only if such use or disclosure, respectively, is in 
compliance with each applicable requirement of section 
164.504(e) of such title. The additional requirements of 
this subtitle that relate to privacy and that are made ap-
plicable with respect to covered entities shall also be appli-
cable to such a business associate and shall be incor-
porated into the business associate agreement between the 
business associate and the covered entity. 
(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSO-
CIATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of 
title 45, Code of Federal Regulations, shall apply to a 
business associate described in subsection (a), with respect 
to compliance with such subsection, in the same manner 
that such section applies to a covered entity, with respect 
to compliance with the standards in sections 164.502(e) 
and 164.504(e) of such title, except that in applying such 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00546
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
547 
section 164.504(e)(1)(ii) each reference to the business as-
sociate, with respect to a contract, shall be treated as a 
reference to the covered entity involved in such contract. 
(c) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any provision of subsection (a) or (b), the provisions of 
sections 1176 and 1177 of the Social Security Act (42 
U.S.C. 1320d–5, 1320d–6) shall apply to the business as-
sociate with respect to such violation in the same manner 
as such provisions apply to a person who violates a provi-
sion of part C of title XI of such Act. 
SEC. 4405. RESTRICTIONS ON CERTAIN DISCLOSURES AND 
SALES OF HEALTH INFORMATION; ACCOUNT-
ING OF CERTAIN PROTECTED HEALTH IN-
FORMATION DISCLOSURES; ACCESS TO CER-
TAIN INFORMATION IN ELECTRONIC FOR-
MAT. 
(a) REQUESTED RESTRICTIONS ON CERTAIN DIS-
CLOSURES OF HEALTH INFORMATION.—In the case that 
an individual requests under paragraph (a)(1)(i)(A) of 
section 164.522 of title 45, Code of Federal Regulations, 
that a covered entity restrict the disclosure of the pro-
tected health information of the individual, notwith-
standing paragraph (a)(1)(ii) of such section, the covered 
entity must comply with the requested restriction if— 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00547
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
548 
(1) except as otherwise required by law, the dis-
closure is to a health plan for purposes of carrying 
out payment or health care operations (and is not 
for purposes of carrying out treatment); and 
(2) the protected health information pertains 
solely to a health care item or service for which the 
health care provider involved has been paid out of 
pocket in full. 
(b) DISCLOSURES REQUIRED TO BE LIMITED TO 
THE
LIMITED
DATA
SET
OR
THE
MINIMUM
NEC-
ESSARY.— 
(1) IN GENERAL.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), a covered entity shall be treated as 
being in compliance with section 164.502(b)(1) 
of title 45, Code of Federal Regulations, with 
respect to the use, disclosure, or request of pro-
tected health information described in such sec-
tion, only if the covered entity limits such pro-
tected health information, to the extent prac-
ticable, to the limited data set (as defined in 
section 164.514(e)(2) of such title) or, if needed 
by such entity, to the minimum necessary to ac-
complish the intended purpose of such use, dis-
closure, or request, respectively. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00548
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
549 
(B) 
GUIDANCE.—Not 
later 
than 
months after the date of the enactment of this 
section, the Secretary shall issue guidance on 
what constitutes ‘‘minimum necessary’’ for pur-
poses of subpart E of part 164 of title 45, Code 
of Federal Regulation. In issuing such guidance 
the Secretary shall take into consideration the 
guidance under section 4424(c). 
(C) SUNSET.—Subparagraph (A) shall not 
apply on and after the effective date on which 
the Secretary issues the guidance under sub-
paragraph (B). 
(2) 
DETERMINATION
OF
MINIMUM
NEC-
ESSARY.—For purposes of paragraph (1), in the 
case of the disclosure of protected health informa-
tion, the covered entity or business associate dis-
closing such information shall determine what con-
stitutes the minimum necessary to accomplish the 
intended purpose of such disclosure. 
(3) APPLICATION OF EXCEPTIONS.—The excep-
tions described in section 164.502(b)(2) of title 45, 
Code of Federal Regulations, shall apply to the re-
quirement under paragraph (1) as of the effective 
date described in section 4423 in the same manner 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00549
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
550 
that such exceptions apply to section 164.502(b)(1) 
of such title before such date. 
(4) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed as affecting the use, 
disclosure, or request of protected health information 
that has been de-identified. 
(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH 
INFORMATION DISCLOSURES REQUIRED IF COVERED EN-
TITY USES ELECTRONIC HEALTH RECORD.— 
(1) IN GENERAL.—In applying section 164.528 
of title 45, Code of Federal Regulations, in the case 
that a covered entity uses or maintains an electronic 
health record with respect to protected health infor-
mation— 
(A) 
the 
exception 
under 
paragraph 
(a)(1)(i) of such section shall not apply to dis-
closures through an electronic health record 
made by such entity of such information; and 
(B) an individual shall have a right to re-
ceive an accounting of disclosures described in 
such paragraph of such information made by 
such covered entity during only the three years 
prior to the date on which the accounting is re-
quested. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00550
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
551 
(2) REGULATIONS.—The Secretary shall pro-
mulgate regulations on what information shall be 
collected about each disclosure referred to in para-
graph (1)(A) not later than 18 months after the 
date on which the Secretary adopts standards on ac-
counting for disclosure described in the section 
3002(b)(2)(B)(iv) of the Public Health Service Act, 
as added by section 4101. Such regulations shall 
only require such information to be collected through 
an electronic health record in a manner that takes 
into account the interests of individuals in learning 
the circumstances under which their protected health 
information is being disclosed and takes into account 
the administrative burden of accounting for such 
disclosures. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed as requiring a covered en-
tity to account for disclosures of protected health in-
formation that are not made by such covered entity 
or by a business associate acting on behalf of the 
covered entity. 
(4) EFFECTIVE DATE.— 
(A) CURRENT
USERS
OF
ELECTRONIC 
RECORDS.—In the case of a covered entity inso-
far as it acquired an electronic health record as 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00551
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
552 
of January 1, 2009, paragraph (1) shall apply 
to disclosures, with respect to protected health 
information, made by the covered entity from 
such a record on and after January 1, 2014. 
(B) OTHERS.—In the case of a covered en-
tity insofar as it acquires an electronic health 
record after January 1, 2009, paragraph (1) 
shall apply to disclosures, with respect to pro-
tected health information, made by the covered 
entity from such record on and after the later 
of the following: 
(i) January 1, 2011; or 
(ii) the date that it acquires an elec-
tronic health record. 
(d) REVIEW OF HEALTH CARE OPERATIONS.—Not 
later than 18 months after the date of the enactment of 
this title, the Secretary shall promulgate regulations to 
eliminate from the definition of health care operations 
under section 164.501 of title 45, Code of Federal Regula-
tions, those activities that can reasonably and efficiently 
be conducted through the use of information that is de- 
identified (in accordance with the requirements of section 
164.514(b) of such title) or that should require a valid 
authorization for use or disclosure. In promulgating such 
regulations, the Secretary may choose to narrow or clarify 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00552
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
553 
activities that the Secretary chooses to retain in the defini-
tion of health care operations and the Secretary shall take 
into account the report under section 424(d). In such reg-
ulations the Secretary shall specify the date on which such 
regulations shall apply to disclosures made by a covered 
entity, but in no case would such date be sooner than the 
date that is 24 months after the date of the enactment 
of this section. 
(e) PROHIBITION ON SALE OF ELECTRONIC HEALTH 
RECORDS OR PROTECTED HEALTH INFORMATION.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity or business associate 
shall not directly or indirectly receive remuneration 
in exchange for any protected health information of 
an individual unless the covered entity obtained from 
the individual, in accordance with section 164.508 of 
title 45, Code of Federal Regulations, a valid au-
thorization that includes, in accordance with such 
section, a specification of whether the protected 
health information can be further exchanged for re-
muneration by the entity receiving protected health 
information of that individual. 
(2) EXCEPTIONS.—Paragraph (1) shall not 
apply in the following cases: 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00553
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
554 
(A) The purpose of the exchange is for re-
search or public health activities (as described 
in sections 164.501, 164.512(i), and 164.512(b) 
of title 45, Code of Federal Regulations) and 
the price charged reflects the costs of prepara-
tion and transmittal of the data for such pur-
pose. 
(B) The purpose of the exchange is for the 
treatment of the individual and the price 
charges reflects not more than the costs of 
preparation and transmittal of the data for 
such purpose. 
(C) The purpose of the exchange is the 
health care operation specifically described in 
subparagraph (iv) of paragraph (6) of the defi-
nition of health care operations in section 
164.501 of title 45, Code of Federal Regula-
tions. 
(D) The purpose of the exchange is for re-
muneration that is provided by a covered entity 
to a business associate for activities involving 
the exchange of protected health information 
that the business associate undertakes on behalf 
of and at the specific request of the covered en-
tity pursuant to a business associate agreement. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00554
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
555 
(E) The purpose of the exchange is to pro-
vide an individual with a copy of the individ-
ual’s protected health information pursuant to 
section 164.524 of title 45, Code of Federal 
Regulations. 
(F) The purpose of the exchange is other-
wise determined by the Secretary in regulations 
to be similarly necessary and appropriate as the 
exceptions provided in subparagraphs (A) 
through (E). 
(3) REGULATIONS.—The Secretary shall pro-
mulgate regulations to carry out paragraph (this 
subsection, including exceptions described in para-
graph (2), not later than 18 months after the date 
of the enactment of this title. 
(4) EFFECTIVE
DATE.—Paragraph (1) shall 
apply to exchanges occurring on or after the date 
that is 6 months after the date of the promulgation 
of final regulations implementing this subsection. 
(f) ACCESS TO CERTAIN INFORMATION IN ELEC-
TRONIC FORMAT.—In applying section 164.524 of title 
45, Code of Federal Regulations, in the case that a cov-
ered entity uses or maintains an electronic health record 
with respect to protected health information of an indi-
vidual— 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00555
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
556 
(1) the individual shall have a right to obtain 
from such covered entity a copy of such information 
in an electronic format; and 
(2) notwithstanding paragraph (c)(4) of such 
section, any fee that the covered entity may impose 
for providing such individual with a copy of such in-
formation (or a summary or explanation of such in-
formation) if such copy (or summary or explanation) 
is in an electronic form shall not be greater than the 
entity’s labor costs in responding to the request for 
the copy (or summary or explanation). 
(g) CLARIFICATION.—Nothing in this subtitle shall 
constitute a waiver of any privilege otherwise applicable 
to an individual with respect to the protected health infor-
mation of such individual. 
SEC. 4406. CONDITIONS ON CERTAIN CONTACTS AS PART 
OF HEALTH CARE OPERATIONS. 
(a) MARKETING.— 
(1) IN GENERAL.—A communication by a cov-
ered entity or business associate that is about a 
product or service and that encourages recipients of 
the communication to purchase or use the product 
or service shall not be considered a health care oper-
ation for purposes of subpart E of part 164 of title 
45, Code of Federal Regulations, unless the commu-
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00556
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
557 
nication is made as described in subparagraph (i), 
(ii), or (iii) of paragraph (1) of the definition of 
marketing in section 164.501 of such title. 
(2) 
PAYMENT
FOR
CERTAIN
COMMUNICA-
TIONS.—A covered entity or business associate may 
not receive direct or indirect payment in exchange 
for making any communication described in sub-
paragraph (i), (ii), or (iii) of paragraph (1) of the 
definition of marketing in section 164.501 of title 
45, Code of Federal Regulations, except— 
(A) a business associate of a covered entity 
may receive payment from the covered entity 
for making any such communication on behalf 
of the covered entity that is consistent with the 
written contract (or other written arrangement) 
described in section 164.502(e)(2) of such title 
between such business associate and covered en-
tity; or 
(B) a covered entity may receive payment 
in exchange for making any such communica-
tion if the entity obtains from the recipient of 
the communication, in accordance with section 
164.508 of title 45, Code of Federal Regula-
tions, a valid authorization (as described in 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00557
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
558 
paragraph (b) of such section) with respect to 
such communication. 
(b) FUNDRAISING.—Fundraising for the benefit of a 
covered entity shall not be considered a health care oper-
ation for purposes of section 164.501 of title 45, Code of 
Federal Regulations. 
(c) EFFECTIVE DATE.—This section shall apply to 
contracting occurring on or after the effective date speci-
fied under section 4423. 
SEC. 4407. TEMPORARY BREACH NOTIFICATION REQUIRE-
MENT FOR VENDORS OF PERSONAL HEALTH 
RECORDS AND OTHER NON-HIPAA COVERED 
ENTITIES. 
(a) IN GENERAL.—In accordance with subsection (c), 
each vendor of personal health records, following the dis-
covery of a breach of security of unsecured PHR identifi-
able health information that is in a personal health record 
maintained or offered by such vendor, and each entity de-
scribed in clause (ii) or (iii) of section 4424(b)(1)(A), fol-
lowing the discovery of a breach of security of such infor-
mation that is obtained through a product or service pro-
vided by such entity, shall— 
(1) notify each individual who is a citizen or 
resident of the United States whose unsecured PHR 
identifiable health information was acquired by an 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00558
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
559 
unauthorized person as a result of such a breach of 
security; and 
(2) notify the Federal Trade Commission. 
(b) NOTIFICATION BY THIRD PARTY SERVICE PRO-
VIDERS.—A third party service provider that provides 
services to a vendor of personal health records or to an 
entity described in clause (ii) or (iii) of section 
4424(b)(1)(A) in connection with the offering or mainte-
nance of a personal health record or a related product or 
service and that accesses, maintains, retains, modifies, 
records, stores, destroys, or otherwise holds, uses, or dis-
closes unsecured PHR identifiable health information in 
such a record as a result of such services shall, following 
the discovery of a breach of security of such information, 
notify such vendor or entity, respectively, of such breach. 
Such notice shall include the identification of each indi-
vidual whose unsecured PHR identifiable health informa-
tion has been, or is reasonably believed to have been, 
accessed, acquired, or disclosed during such breach. 
(c) APPLICATION OF REQUIREMENTS FOR TIMELI-
NESS, METHOD, AND CONTENT
OF NOTIFICATIONS.— 
Subsections (c), (d), (e), and (f) of section 402 shall apply 
to a notification required under subsection (a) and a ven-
dor of personal health records, an entity described in sub-
section (a) and a third party service provider described 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00559
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
560 
in subsection (b), with respect to a breach of security 
under subsection (a) of unsecured PHR identifiable health 
information in such records maintained or offered by such 
vendor, in a manner specified by the Federal Trade Com-
mission. 
(d) NOTIFICATION OF THE SECRETARY.—Upon re-
ceipt of a notification of a breach of security under sub-
section (a)(2), the Federal Trade Commission shall notify 
the Secretary of such breach. 
(e) ENFORCEMENT.—A violation of subsection (a) or 
(b) shall be treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or prac-
tices. 
(f) DEFINITIONS.—For purposes of this section: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means, with respect to unsecured PHR 
identifiable health information of an individual in a 
personal health record, acquisition of such informa-
tion without the authorization of the individual. 
(2) PHR IDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘PHR identifiable health informa-
tion’’ means individually identifiable health informa-
tion, as defined in section 1171(6) of the Social Se-
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00560
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
561 
curity Act (42 U.S.C. 1320d(6)), and includes, with 
respect to an individual, information— 
(A) that is provided by or on behalf of the 
individual; and 
(B) that identifies the individual or with 
respect to which there is a reasonable basis to 
believe that the information can be used to 
identify the individual. 
(3) UNSECURED
PHR
IDENTIFIABLE
HEALTH 
INFORMATION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), the term ‘‘unsecured PHR identifi-
able health information’’ means PHR identifi-
able health information that is not protected 
through the use of a technology or methodology 
specified by the Secretary in the guidance 
issued under section 4402(h)(2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under section 
4402(h)(2) by the date specified in such sec-
tion, for purposes of this section, the term ‘‘un-
secured PHR identifiable health information’’ 
shall mean PHR identifiable health information 
that is not secured by a technology standard 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00561
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
562 
that renders protected health information unus-
able, unreadable, or indecipherable to unauthor-
ized individuals and that is developed or en-
dorsed by a standards developing organization 
that is accredited by the American National 
Standards Institute. 
(g) REGULATIONS; EFFECTIVE DATE; SUNSET.— 
(1) 
REGULATIONS; 
EFFECTIVE
DATE.—To 
carry out this section, the Secretary of Health and 
Human Services shall promulgate interim final regu-
lations by not later than the date that is 180 days 
after the date of the enactment of this section. The 
provisions of this section shall apply to breaches of 
security that are discovered on or after the date that 
is 30 days after the date of publication of such in-
terim final regulations. 
(2) SUNSET.—The provisions of this section 
shall not apply to breaches of security occurring on 
or after the earlier of the following the dates: 
(A) The date on which a standard relating 
to requirements for entities that are not covered 
entities that includes requirements relating to 
breach notification has been promulgated by the 
Secretary. 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00562
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
563 
(B) The date on which a standard relating 
to requirements for entities that are not covered 
entities that includes requirements relating to 
breach notification has been promulgated by the 
Federal Trade Commission and has taken ef-
fect. 
SEC. 4408. BUSINESS ASSOCIATE CONTRACTS REQUIRED 
FOR CERTAIN ENTITIES. 
Each organization, with respect to a covered entity, 
that provides data transmission of protected health infor-
mation to such entity (or its business associate) and that 
requires access on a routine basis to such protected health 
information, such as a Health Information Exchange Or-
ganization, Regional Health Information Organization, E- 
prescribing Gateway, or each vendor that contracts with 
a covered entity to allow that covered entity to offer a per-
sonal health record to patients as part of its electronic 
health record, is required to enter into a written contract 
(or other written arrangement) described in section 
164.502(e)(2) of title 45, Code of Federal Regulations and 
a written contract (or other arrangement) described in 
section 164.308(b) of such title, with such entity and shall 
be treated as a business associate of the covered entity 
for purposes of the provisions of this subtitle and subparts 
C and E of part 164 of title 45, Code of Federal Regula-
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00563
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
564 
tions, as such provisions are in effect as of the date of 
enactment of this title. 
SEC. 4409. CLARIFICATION OF APPLICATION OF WRONGFUL 
DISCLOSURES CRIMINAL PENALTIES. 
Section 1177(a) of the Social Security Act (42 U.S.C. 
1320d–6(a)) is amended by adding at the end the fol-
lowing new sentence: ‘‘For purposes of the previous sen-
tence, a person (including an employee or other individual) 
shall be considered to have obtained or disclosed individ-
ually identifiable health information in violation of this 
part if the information is maintained by a covered entity 
(as defined in the HIPAA privacy regulation described in 
section 1180(b)(3)) and the individual obtained or dis-
closed such information without authorization.’’. 
SEC. 4410. IMPROVED ENFORCEMENT. 
(a) IN GENERAL.—Section 1176 of the Social Secu-
rity Act (42 U.S.C. 1320d–5) is amended— 
(1) in subsection (b)(1), by striking ‘‘the act 
constitutes an offense punishable under section 
1177’’ and inserting ‘‘a penalty has been imposed 
under section 1177 with respect to such act’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(c) NONCOMPLIANCE
DUE
TO
WILLFUL
NE-
GLECT.— 
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00564
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
565 
‘‘(1) IN GENERAL.—A violation of a provision 
of this part due to willful neglect is a violation for 
which the Secretary is required to impose a penalty 
under subsection (a)(1). 
‘‘(2) REQUIRED INVESTIGATION.—For purposes 
of paragraph (1), the Secretary shall formally inves-
tigate any complaint of a violation of a provision of 
this part if a preliminary investigation of the facts 
of the complaint indicate such a possible violation 
due to willful neglect.’’. 
(b) EFFECTIVE DATE; REGULATIONS.— 
(1) The amendments made by subsection (a) 
shall apply to penalties imposed on or after the date 
that is 24 months after the date of the enactment 
of this title. 
(2) Not later than 18 months after the date of 
the enactment of this title, the Secretary of Health 
and Human Services shall promulgate regulations to 
implement such amendments. 
(c) DISTRIBUTION OF CERTAIN CIVIL MONETARY 
PENALTIES COLLECTED.— 
(1) IN
GENERAL.—Subject to the regulation 
promulgated pursuant to paragraph (3), any civil 
monetary penalty or monetary settlement collected 
with respect to an offense punishable under this sub-
VerDate Nov 24 2008 
01:08 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00565
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS
566 
title or section 1176 of the Social Security Act (42 
U.S.C. 1320d–5) insofar as such section relates to 
privacy or security shall be transferred to the Office 
of Civil Rights of the Department of Health and 
Human Services to be used for purposes of enforcing 
the provisions of this subtitle and subparts C and E 
of part 164 of title 45, Code of Federal Regulations, 
as such provisions are in effect as of the date of en-
actment of this Act. 
(2) GAO REPORT.—Not later than 18 months 
after the date of the enactment of this title, the 
Comptroller General shall submit to the Secretary a 
report including recommendations for a methodology 
under which an individual who is harmed by an act 
that constitutes an offense referred to in paragraph 
(1) may receive a percentage of any civil monetary 
penalty or monetary settlement collected with re-
spect to such offense. 
(3) ESTABLISHMENT
OF
METHODOLOGY
TO 
DISTRIBUTE PERCENTAGE OF CMPS COLLECTED TO 
HARMED
INDIVIDUALS.—Not later than 3 years 
after the date of the enactment of this title, the Sec-
retary shall establish by regulation and based on the 
recommendations submitted under paragraph (2), a 
methodology under which an individual who is 
VerDate Nov 24 2008 
02:49 Jan 27, 2009
Jkt 079200
PO 00000
Frm 00566
Fmt 6652
Sfmt 6201
E:\BILLS\H1.IH
H1
jbell on PROD1PC69 with BILLS