145
‘‘(A) select code sets for appropriate data
elements for the transactions referred to in sub-
section (a)(1) from among the code sets that
have been developed by private and public enti-
ties; or
‘‘(B) establish code sets for such data ele-
ments if no code sets for the data elements
have been developed.
‘‘(2) DISTRIBUTION.—The Secretary shall es-
tablish efficient and low-cost procedures for distribu-
tion (including electronic distribution) of code sets
and modifications made to such code sets under sec-
tion 1174(b).
‘‘(d) SECURITY STANDARDS FOR HEALTH INFORMA-
TION.—
‘‘(1) SECURITY
STANDARDS.—The Secretary
shall adopt security standards that—
‘‘(A) take into account—
‘‘(i) the technical capabilities of record
systems used to maintain health informa-
tion;
‘‘(ii) the costs of security measures;
‘‘(iii) the need for training persons
who have access to health information;
146
‘‘(iv) the value of audit trails in com-
puterized record systems; and
‘‘(v) the needs and capabilities of
small health care providers and rural
health care providers (as such providers
are defined by the Secretary); and
‘‘(B) ensure that a clearinghouse, if it is
part of a larger organization, has policies and
security procedures which isolate the activities
of the clearinghouse with respect to processing
information in a manner that prevents unau-
thorized access to such information by such
larger organization.
‘‘(2) SAFEGUARDS.—Each person described in
section 1172(a) who maintains or transmits health
information shall maintain reasonable and appro-
priate administrative, technical, and physical safe-
guards—
‘‘(A) to ensure the integrity and confiden-
tiality of the information;
‘‘(B) to protect against any reasonably an-
ticipated—
‘‘(i) threats or hazards to the security
or integrity of the information; and
147
‘‘(ii) unauthorized uses or disclosures
of the information; and
‘‘(C) otherwise to ensure compliance with
this part by the officers and employees of such
person.
‘‘(e) PRIVACY STANDARDS FOR HEALTH INFORMA-
TION.—The Secretary shall adopt standards with respect
to the privacy of individually identifiable health informa-
tion. Such standards shall include standards concerning
at least the following:
‘‘(1) The rights of an individual who is a sub-
ject of such information.
‘‘(2) The procedures to be established for the
exercise of such rights.
‘‘(3) The uses and disclosures of such informa-
tion that are authorized or required.
‘‘(f) ELECTRONIC SIGNATURE.—
‘‘(1) IN GENERAL.—The Secretary, in coordina-
tion with the Secretary of Commerce, shall adopt
standards specifying procedures for the electronic
transmission and authentication of signatures, com-
pliance with which shall be deemed to satisfy Fed-
eral and State statutory requirements for written
signatures with respect to the transactions referred
to in subsection (a)(1).
148
‘‘(2) PAYMENTS
FOR
SERVICES
AND
PRE-
MIUMS.—Nothing in this part shall be construed to
prohibit payment for health care services or health
plan premiums by debit, credit, payment card or
numbers, or other electronic means.
‘‘(g) COORDINATION OF BENEFITS.—The Secretary
shall adopt standards—
‘‘(1) for determining the financial liability of
health plans when health care benefits are payable
under two or more health plans; and
‘‘(2) for transferring among health plans appro-
priate standard data elements needed for the coordi-
nation of benefits, the sequential processing of
claims, and other data elements for individuals who
have more than one health plan.
‘‘SEC. 1174. TIMETABLES FOR ADOPTION OF STANDARDS.
‘‘(a) INITIAL
STANDARDS.—The Secretary shall
carry out section 1173 not later than 18 months after the
date of the enactment of this part, except that standards
relating to claims attachments shall be adopted not later
than 30 months after such date.
‘‘(b) ADDITIONS AND MODIFICATIONS TO STAND-
ARDS.—
‘‘(1) IN GENERAL.—Except as provided in para-
graph (2), the Secretary shall review the standards
149
adopted under section 1173, and shall adopt addi-
tional or modified standards, as determined appro-
priate, but not more frequently than once every 6
months. Any addition or modification to a standard
shall be completed in a manner which minimizes the
disruption and cost of compliance.
‘‘(2) SPECIAL RULES.—
‘‘(A) FIRST
12-MONTH
PERIOD.—Except
with respect to additions and modifications to
code sets under subparagraph (B), the Sec-
retary may not adopt any modification to a
standard adopted under this part during the
12-month period beginning on the date the
standard is initially adopted, unless the Sec-
retary determines that the modification is nec-
essary in order to permit compliance with the
standard.
‘‘(B) ADDITIONS AND MODIFICATIONS TO
CODE SETS.—
‘‘(i) IN
GENERAL.—The Secretary
shall ensure that procedures exist for the
routine maintenance, testing, enhancement,
and expansion of code sets.
‘‘(ii) ADDITIONAL RULES.—If a code
set is modified under this subsection, the
150
modified code set shall include instructions
on how data elements of health informa-
tion that were encoded prior to the modi-
fication may be converted or translated so
as to preserve the informational value of
the data elements that existed before the
modification. Any modification to a code
set under this subsection shall be imple-
mented in a manner that minimizes the
disruption and cost of complying with such
modification.
‘‘SEC. 1175. REQUIREMENTS.
‘‘(a) CONDUCT OF TRANSACTIONS BY PLANS.—
‘‘(1) IN GENERAL.—If a person desires to con-
duct a transaction referred to in section 1173(a)(1)
with a health plan as a standard transaction—
‘‘(A) the health plan may not refuse to
conduct such transaction as a standard trans-
action;
‘‘(B) the health plan may not delay such
transaction, or otherwise adversely affect, or at-
tempt to adversely affect, the person or the
transaction on the ground that the transaction
is a standard transaction; and